feat(firewall): add audited configuration management

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-08-03 22:44:34 -04:00
parent d5ca89e160
commit fb39aa57fd
15 changed files with 410 additions and 8 deletions
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Integration\Service;
+
+use KTXC\Db\DataStore;
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\FirewallSettingsService;
+use KTXC\Service\TenantService;
+use KTXC\Stores\TenantStore;
+use KTXF\Event\EventDispatcherInterface;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallSettingsServiceTest extends TestCase
+{
+    private DataStore $dataStore;
+    private bool $databaseAvailable = false;
+
+    protected function setUp(): void
+    {
+        $system = require dirname(__DIR__, 4).'/config/system.php';
+        $database = $system['database'];
+        $database['database'] = sprintf('ktrix_firewall_settings_test_%d', getmypid());
+        $this->dataStore = new DataStore($database);
+
+        try {
+            $this->dataStore->getDatabase()->drop();
+            $this->databaseAvailable = true;
+        } catch (\MongoDB\Driver\Exception\Exception $error) {
+            self::markTestSkipped('MongoDB is unavailable: '.$error->getMessage());
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        if ($this->databaseAvailable) {
+            $this->dataStore->getDatabase()->drop();
+        }
+    }
+
+    #[TestDox('Firewall settings updates persist without replacing unrelated tenant configuration')]
+    public function testPersistence(): void
+    {
+        $tenants = new TenantService(new TenantStore($this->dataStore));
+        $tenants->deposit((new TenantObject())
+            ->setIdentifier('tenant-a')
+            ->setEnabled(true)
+            ->setLabel('Tenant A')
+            ->setDomains(new DomainCollection(['tenant-a.example.test']))
+            ->setConfiguration((new TenantConfiguration())->jsonDeserialize([
+                'security' => ['code' => 'keep-me'],
+            ])));
+        $settings = new FirewallSettingsService(
+            $tenants,
+            $this->createStub(EventDispatcherInterface::class)
+        );
+
+        $settings->update(
+            'tenant-a', false, 8, 600, 7200, 'Tighten authentication controls', 'admin-a'
+        );
+        $stored = $tenants->fetchById('tenant-a')->getConfiguration();
+
+        self::assertFalse($stored->firewall()->enabled());
+        self::assertSame(8, $stored->firewall()->maxAuthFailures());
+        self::assertSame(600, $stored->firewall()->authFailureWindow());
+        self::assertSame(7200, $stored->firewall()->autoBlockDuration());
+        self::assertSame('keep-me', $stored->security()->code());
+    }
+}