refactor(security): add typed brute-force detection event

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Security/Event/BruteForceDetectedEvent.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class BruteForceDetectedEvent extends Event implements SecurityRequestEventInterface
+{
+    private readonly string $reason;
+
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly int $failureCount,
+        private readonly int $windowSeconds,
+        ?string $tenantId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Brute-force detection requires an IP address.');
+        }
+        if ($failureCount < 1) {
+            throw new \InvalidArgumentException('Brute-force detection requires at least one failure.');
+        }
+        if ($windowSeconds < 1) {
+            throw new \InvalidArgumentException('Brute-force detection requires a positive window.');
+        }
+
+        $this->reason = sprintf(
+            '%d failed attempts in %d seconds',
+            $failureCount,
+            $windowSeconds,
+        );
+
+        parent::__construct(
+            self::class,
+            ['failureCount' => $failureCount, 'windowSeconds' => $windowSeconds],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getFailureCount(): int
+    {
+        return $this->failureCount;
+    }
+
+    public function getWindowSeconds(): int
+    {
+        return $this->windowSeconds;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return null;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): int
+    {
+        return SecurityEvent::SEVERITY_CRITICAL;
+    }
+}

core/lib/Security/Event/SecurityEvent.php

@@ -20,7 +20,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
     public const ACCESS_DENIED = 'security.access.denied';
     public const ACCESS_GRANTED = 'security.access.granted';
     
-    public const BRUTE_FORCE_DETECTED = 'security.brute_force.detected';
     public const RATE_LIMIT_EXCEEDED = 'security.rate_limit.exceeded';
     public const SUSPICIOUS_ACTIVITY = 'security.suspicious.activity';
     
@@ -114,24 +113,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
         );
     }
 
-    /**
-     * Create a brute force detection event
-     */
-    public static function bruteForceDetected(
-        string $ipAddress,
-        int $failureCount,
-        int $windowSeconds,
-        ?string $tenantId = null,
-    ): self {
-        return self::create(
-            self::BRUTE_FORCE_DETECTED,
-            $ipAddress,
-            data: ['failureCount' => $failureCount, 'windowSeconds' => $windowSeconds],
-            tenantId: $tenantId,
-            reason: sprintf('%d failed attempts in %d seconds', $failureCount, $windowSeconds),
-        );
-    }
-
     /**
      * Create a rate limit exceeded event
      */
@@ -196,7 +177,6 @@ final class SecurityEvent extends Event implements SecurityRequestEventInterface
             self::RATE_LIMIT_EXCEEDED,
             self::SUSPICIOUS_ACTIVITY => self::SEVERITY_ERROR,
             
-            self::BRUTE_FORCE_DETECTED,
             self::IP_BLOCKED,
             self::DEVICE_BLOCKED => self::SEVERITY_CRITICAL,