fix(firewall): serialize automatic brute-force blocking

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Service/FirewallService.php

@@ -164,7 +164,22 @@ class FirewallService
         );
 
         if ($failureCount >= $maxFailures) {
-            $this->handleBruteForce($tenantId, $ipAddress, $failureCount, $windowSeconds);
+            $blockDuration = $this->getBoundedIntegerConfig(
+                self::CONFIG_AUTO_BLOCK_DURATION,
+                self::DEFAULT_AUTO_BLOCK_DURATION,
+                self::MAX_AUTO_BLOCK_DURATION
+            );
+            if (!$this->store->claimBruteForce($tenantId, $ipAddress, $blockDuration)) {
+                return;
+            }
+
+            $this->handleBruteForce(
+                $tenantId,
+                $ipAddress,
+                $failureCount,
+                $windowSeconds,
+                $blockDuration
+            );
         }
     }
 
@@ -175,20 +190,14 @@ class FirewallService
         string $tenantId,
         string $ipAddress,
         int $failureCount,
-        int $windowSeconds
+        int $windowSeconds,
+        int $blockDuration
     ): void {
         // Publish brute force event
         $event = SecurityEvent::bruteForceDetected($ipAddress, $failureCount, $windowSeconds);
         $event->setTenantId($tenantId);
         $this->events->dispatch($event);
 
-        // Auto-block the IP
-        $blockDuration = $this->getBoundedIntegerConfig(
-            self::CONFIG_AUTO_BLOCK_DURATION,
-            self::DEFAULT_AUTO_BLOCK_DURATION,
-            self::MAX_AUTO_BLOCK_DURATION
-        );
-
         $this->rules->blockIp(
             FirewallRuleScope::tenant($tenantId),
             $ipAddress,
@@ -334,10 +343,12 @@ class FirewallService
     {
         $expiredRules = $this->store->cleanupExpiredRules();
         $oldLogs = $this->store->cleanupOldLogs(30);
+        $expiredClaims = $this->store->cleanupExpiredBruteForceClaims();
 
         return [
             'expiredRules' => $expiredRules,
             'oldLogs' => $oldLogs,
+            'expiredBruteForceClaims' => $expiredClaims,
         ];
     }
 }