feat(firewall): add audited configuration management

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-08-03 22:44:34 -04:00
parent d5ca89e160
commit fb39aa57fd
15 changed files with 410 additions and 8 deletions
@@ -336,6 +336,28 @@ class FirewallServiceTest extends TestCase
        $this->service->logSecurityEvent($event);
    }

+    #[TestDox('Settings changes map to recorded tenant audit entries')]
+    public function testSettingsAudit(): void
+    {
+        $this->store->expects(self::once())
+            ->method('createLog')
+            ->with(self::callback(static fn(FirewallLogObject $log): bool =>
+                $log->getEventType() === FirewallLogObject::EVENT_SETTINGS_UPDATED
+                && $log->getResult() === FirewallLogObject::RESULT_RECORDED
+                && $log->getTenantId() === 'tenant-a'
+                && $log->getIdentityId() === 'operator'
+                && $log->getMetadata()['changeReason'] === 'Tighten controls'
+            ))
+            ->willReturnArgument(0);
+        $event = new \KTXF\Event\SecurityEvent(
+            \KTXF\Event\SecurityEvent::FIREWALL_SETTINGS_UPDATED,
+            ['changeReason' => 'Tighten controls']
+        );
+        $event->setTenantId('tenant-a')->setIdentityId('operator');
+
+        $this->service->logSecurityEvent($event);
+    }
+
    #[TestDox('Typed tenant firewall settings drive brute-force thresholds')]
    public function testFirewallConfiguration(): void
    {