refactor(firewall): separate enforcement from rule management

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-30 22:35:24 -04:00
parent 266b364c93
commit da81f1ddf1
14 changed files with 814 additions and 436 deletions
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+use KTXC\Models\Firewall\FirewallRuleObject;
+
+final class TenantFirewallRuleService
+{
+    public const PERMISSION_READ = 'firewall.tenant.rules.read';
+    public const PERMISSION_MANAGE = 'firewall.tenant.rules.manage';
+
+    public function __construct(
+        private readonly FirewallRuleManager $rules,
+        private readonly TenantContextInterface $tenant,
+        private readonly IdentityContextInterface $identity,
+    ) {
+    }
+
+    public function listRules(bool $activeOnly = true): array
+    {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->list($this->scope(), $activeOnly);
+    }
+
+    public function blockIp(string $ip, ?string $reason = null, ?int $durationSeconds = null): FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->blockIp(
+            $this->scope(), $ip, $reason, $this->identity->identifier(), $durationSeconds
+        );
+    }
+
+    public function allowIp(string $ip, ?string $reason = null): FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->allowIp($this->scope(), $ip, $reason, $this->identity->identifier());
+    }
+
+    public function blockIpRange(string $cidr, ?string $reason = null): FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->blockIpRange($this->scope(), $cidr, $reason, $this->identity->identifier());
+    }
+
+    public function blockDevice(
+        string $fingerprint,
+        ?string $reason = null,
+        ?int $durationSeconds = null
+    ): FirewallRuleObject {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->blockDevice(
+            $this->scope(), $fingerprint, $reason, $this->identity->identifier(), $durationSeconds
+        );
+    }
+
+    public function disableRule(string $ruleId): bool
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->disable($this->scope(), $ruleId);
+    }
+
+    public function removeRule(string $ruleId): bool
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->remove($this->scope(), $ruleId);
+    }
+
+    private function scope(): FirewallRuleScope
+    {
+        return FirewallRuleScope::tenant($this->tenant->requireIdentifier());
+    }
+
+    private function requirePermission(string $permission): void
+    {
+        if (!$this->identity->hasPermission($permission)) {
+            throw new \RuntimeException("Missing required permission: {$permission}");
+        }
+    }
+}