refactor(security): add typed suspicious-activity event

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Event/SuspiciousActivityEventTest.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEvent;
+use KTXC\Security\Event\SuspiciousActivityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SuspiciousActivityEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Suspicious-activity state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new SuspiciousActivityEvent(
+            ipAddress: '203.0.113.20',
+            detector: 'payload-signature',
+            detectionData: ['score' => 98],
+            tenantId: 'tenant-a',
+            identityId: 'identity-a',
+            deviceFingerprint: 'device-a',
+            userAgent: 'Test Agent',
+            requestPath: '/admin',
+            requestMethod: 'POST',
+            userId: 'user-a',
+            reason: 'Matched a blocked payload signature',
+        );
+
+        self::assertSame(SuspiciousActivityEvent::class, $event->getName());
+        self::assertSame('203.0.113.20', $event->getIpAddress());
+        self::assertSame('payload-signature', $event->getDetector());
+        self::assertSame(['score' => 98], $event->getDetectionData());
+        self::assertSame(['detector' => 'payload-signature', 'score' => 98], $event->getData());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('device-a', $event->getDeviceFingerprint());
+        self::assertSame('Test Agent', $event->getUserAgent());
+        self::assertSame('/admin', $event->getRequestPath());
+        self::assertSame('POST', $event->getRequestMethod());
+        self::assertSame('user-a', $event->getUserId());
+        self::assertSame('Matched a blocked payload signature', $event->getReason());
+        self::assertSame(SecurityEvent::SEVERITY_ERROR, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Suspicious activity rejects incomplete or conflicting detection context')]
+    public function rejectsInvalidDetectionContext(): void
+    {
+        foreach ([
+            ['', 'payload-signature', []],
+            ['203.0.113.20', '', []],
+            ['203.0.113.20', 'payload-signature', ['detector' => 'replacement']],
+        ] as $arguments) {
+            try {
+                new SuspiciousActivityEvent(...$arguments);
+                self::fail('Invalid suspicious-activity context was accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}