fix(firewall): serialize automatic brute-force blocking

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Service/FirewallServiceTest.php

@@ -392,6 +392,10 @@ class FirewallServiceTest extends TestCase
             ->method('countRecentFailures')
             ->with('tenant-event', '203.0.113.10', 300)
             ->willReturn(5);
+        $this->store->expects($this->once())
+            ->method('claimBruteForce')
+            ->with('tenant-event', '203.0.113.10', 3600)
+            ->willReturn(true);
         $this->store->expects($this->once())
             ->method('findExactIpRule')
             ->with(
@@ -431,6 +435,26 @@ class FirewallServiceTest extends TestCase
         self::assertSame(FirewallRuleManager::ORIGIN_AUTOMATIC, $lifecycleOrigin);
     }
 
+    #[TestDox('Workers that lose the brute-force claim do not block or publish detection events')]
+    public function testAutomaticBlockClaimLoss(): void
+    {
+        $this->store->method('createLogOnce')->willReturn(true);
+        $this->store->expects($this->once())
+            ->method('countRecentFailures')
+            ->with('tenant-a', '203.0.113.10', 300)
+            ->willReturn(5);
+        $this->store->expects($this->once())
+            ->method('claimBruteForce')
+            ->with('tenant-a', '203.0.113.10', 3600)
+            ->willReturn(false);
+        $this->store->expects($this->never())->method('depositRule');
+        $this->events->expects($this->never())->method('dispatch');
+
+        $this->service->handleAuthFailure(
+            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+        );
+    }
+
     #[TestDox('Authentication events without a tenant use the current tenant')]
     public function testAutomaticBlockTenantFallback(): void
     {