fix: improve secret input

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Application/Execution/TerminationReport.php

@@ -15,6 +15,9 @@ final readonly class TerminationReport
         public array $failures = [],
         public bool $deadlineExceeded = false,
         public bool $limitExceeded = false,
+        public int $deferredListenerInvocations = 0,
+        public bool $deferredEventLimitExceeded = false,
+        public bool $deferredListenerInvocationLimitExceeded = false,
     ) {
     }
 }

core/lib/Event/DeferredProcessingResult.php

@@ -11,6 +11,9 @@ final readonly class DeferredProcessingResult
         public int $remaining,
         public bool $deadlineExceeded,
         public bool $limitExceeded = false,
+        public int $listenerInvocations = 0,
+        public bool $eventLimitExceeded = false,
+        public bool $listenerInvocationLimitExceeded = false,
     ) {
     }
 }

core/lib/Event/EventDispatcher.php

@@ -13,6 +13,10 @@ use Psr\Log\LoggerInterface;
 
 final class EventDispatcher implements EventDispatcherInterface, DeferredEventProcessorInterface
 {
+    private const DEFAULT_DEFERRED_PROCESSING_TIMEOUT_SECONDS = 300.0;
+    private const DEFAULT_MAX_DEFERRED_EVENTS = 1000;
+    private const DEFAULT_MAX_DEFERRED_LISTENER_INVOCATIONS = 50000;
+
     /** @var array<string, list<Event>> */
     private array $deferred = [];
     private ?string $activeExecution = null;
@@ -22,7 +26,19 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
         private readonly EventListenerRegistry $registry,
         private readonly ContainerInterface $container,
         private readonly LoggerInterface $logger,
+        private readonly float $deferredProcessingTimeoutSeconds = self::DEFAULT_DEFERRED_PROCESSING_TIMEOUT_SECONDS,
+        private readonly int $maxDeferredEvents = self::DEFAULT_MAX_DEFERRED_EVENTS,
+        private readonly int $maxDeferredListenerInvocations = self::DEFAULT_MAX_DEFERRED_LISTENER_INVOCATIONS,
     ) {
+        if ($this->deferredProcessingTimeoutSeconds <= 0) {
+            throw new \InvalidArgumentException('The deferred processing timeout must be greater than zero.');
+        }
+        if ($this->maxDeferredEvents <= 0) {
+            throw new \InvalidArgumentException('The deferred event limit must be greater than zero.');
+        }
+        if ($this->maxDeferredListenerInvocations <= 0) {
+            throw new \InvalidArgumentException('The deferred listener invocation limit must be greater than zero.');
+        }
     }
 
     public function dispatch(Event $event): void
@@ -34,7 +50,7 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
 
         try {
             $this->invoke($event, DeliveryMode::Immediate);
-            if ($this->registry->listeners($event->getName(), DeliveryMode::Deferred) !== []) {
+            if ($this->registry->listeners($event->label(), DeliveryMode::Deferred) !== []) {
                 if ($this->activeExecution === null) {
                     throw new \LogicException('Deferred events require an active execution scope.');
                 }
@@ -61,13 +77,15 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
         }
 
         try {
-            $processed = 0;
-            $deadline = microtime(true) + 1.0;
+            $processedEvents = 0;
+            $listenerInvocations = 0;
+            $deadline = microtime(true) + $this->deferredProcessingTimeoutSeconds;
             $deadlineExceeded = false;
-            $limitExceeded = false;
+            $eventLimitExceeded = false;
+            $listenerInvocationLimitExceeded = false;
             while (($event = array_shift($this->deferred[$executionId])) !== null) {
-                if ($processed >= 1000) {
-                    $limitExceeded = true;
+                if ($processedEvents >= $this->maxDeferredEvents) {
+                    $eventLimitExceeded = true;
                     array_unshift($this->deferred[$executionId], $event);
                     break;
                 }
@@ -76,14 +94,29 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
                     array_unshift($this->deferred[$executionId], $event);
                     break;
                 }
-                $processed += $this->invoke($event, DeliveryMode::Deferred);
+
+                $eventListenerCount = count($this->registry->listeners(
+                    $event->label(),
+                    DeliveryMode::Deferred,
+                ));
+                if ($listenerInvocations + $eventListenerCount > $this->maxDeferredListenerInvocations) {
+                    $listenerInvocationLimitExceeded = true;
+                    array_unshift($this->deferred[$executionId], $event);
+                    break;
+                }
+
+                $listenerInvocations += $this->invoke($event, DeliveryMode::Deferred);
+                $processedEvents++;
             }
 
             return new DeferredProcessingResult(
-                $processed,
-                count($this->deferred[$executionId]),
-                $deadlineExceeded,
-                $limitExceeded,
+                processed: $processedEvents,
+                remaining: count($this->deferred[$executionId]),
+                deadlineExceeded: $deadlineExceeded,
+                limitExceeded: $eventLimitExceeded || $listenerInvocationLimitExceeded,
+                listenerInvocations: $listenerInvocations,
+                eventLimitExceeded: $eventLimitExceeded,
+                listenerInvocationLimitExceeded: $listenerInvocationLimitExceeded,
             );
         } finally {
             $this->discardDeferred($executionId);
@@ -101,18 +134,18 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
     private function invoke(Event $event, DeliveryMode $delivery): int
     {
         $processed = 0;
-        foreach ($this->registry->listeners($event->getName(), $delivery) as $listener) {
+        foreach ($this->registry->listeners($event->label(), $delivery) as $listener) {
             if ($event->isPropagationStopped()) {
                 break;
             }
 
+            $processed++;
             try {
                 $service = $this->container->get($listener->service);
                 $service->{$listener->method}($event);
-                $processed++;
             } catch (\Throwable $error) {
                 $this->logger->error('Event listener failed.', [
-                    'event' => $event->getName(),
+                    'event' => $event->label(),
                     'module' => $listener->module,
                     'listener' => $listener->service . '::' . $listener->method,
                     'exception' => $error,

core/lib/Kernel.php

@@ -238,6 +238,9 @@ class Kernel implements KernelInterface
         $remaining = 0;
         $deadlineExceeded = false;
         $limitExceeded = false;
+        $listenerInvocations = 0;
+        $eventLimitExceeded = false;
+        $listenerInvocationLimitExceeded = false;
         $failures = [];
 
         try {
@@ -249,6 +252,9 @@ class Kernel implements KernelInterface
                 $remaining = $result->remaining;
                 $deadlineExceeded = $result->deadlineExceeded;
                 $limitExceeded = $result->limitExceeded;
+                $listenerInvocations = $result->listenerInvocations;
+                $eventLimitExceeded = $result->eventLimitExceeded;
+                $listenerInvocationLimitExceeded = $result->listenerInvocationLimitExceeded;
             }
         } catch (\Throwable $e) {
             $failures[] = $e;
@@ -287,6 +293,9 @@ class Kernel implements KernelInterface
             failures: $failures,
             deadlineExceeded: $deadlineExceeded,
             limitExceeded: $limitExceeded,
+            deferredListenerInvocations: $listenerInvocations,
+            deferredEventLimitExceeded: $eventLimitExceeded,
+            deferredListenerInvocationLimitExceeded: $listenerInvocationLimitExceeded,
         );
     }
 

core/lib/Security/Event/SecurityEventInterface.php

@@ -6,17 +6,17 @@ namespace KTXC\Security\Event;
 
 interface SecurityEventInterface
 {
-    public function getName(): string;
+    public function label(): string;
 
     public function get(string $key, mixed $default = null): mixed;
 
-    public function getData(): array;
+    public function context(): array;
 
-    public function getEventId(): string;
+    public function identifier(): string;
 
-    public function getTenantId(): ?string;
+    public function tenantIdentifier(): ?string;
 
-    public function getIdentityId(): ?string;
+    public function actorIdentity(): ?string;
 
     public function getUserId(): ?string;
 

core/lib/Service/FirewallService.php

@@ -149,7 +149,7 @@ class FirewallService
     {
         $request = $this->requestContext->current();
         $ipAddress = $request?->getClientIp();
-        $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
+        $tenantId = $event->tenantIdentifier() ?? $this->tenantContext->identifier();
 
         if (!$ipAddress || !$tenantId) {
             return;
@@ -262,7 +262,7 @@ class FirewallService
         ?Request $request = null,
     ): ?FirewallLogObject
     {
-        $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
+        $tenantId = $event->tenantIdentifier() ?? $this->tenantContext->identifier();
         $ruleScope = $event->get('ruleScope');
         if (!$tenantId && $ruleScope !== FirewallRuleObject::SCOPE_SYSTEM) {
             return null;
@@ -271,7 +271,7 @@ class FirewallService
         $requestEvent = $event instanceof SecurityRequestEventInterface ? $event : null;
 
         $log = new FirewallLogObject();
-        return $log->setEventId($event->getEventId())
+        return $log->setEventId($event->identifier())
             ->setTenantId($tenantId)
             ->setIpAddress($request?->getClientIp() ?? $requestEvent?->getIpAddress())
             ->setDeviceFingerprint(
@@ -281,13 +281,13 @@ class FirewallService
             ->setUserAgent($request?->headers->get('User-Agent') ?? $requestEvent?->getUserAgent())
             ->setRequestPath($request?->getPathInfo() ?? $requestEvent?->getRequestPath())
             ->setRequestMethod($request?->getMethod() ?? $requestEvent?->getRequestMethod())
-            ->setEventType($this->mapEventToLogType($event->getName()))
+            ->setEventType($this->mapEventToLogType($event->label()))
             ->setResult($this->mapEventToResult($event))
             ->setRuleId($event->get('ruleId'))
             ->setRuleScope($ruleScope)
-            ->setIdentityId($event->getUserId() ?? $event->getIdentityId())
+            ->setIdentityId($event->getUserId() ?? $event->actorIdentity())
             ->setTimestamp(new \DateTimeImmutable())
-            ->setMetadata($event->getData());
+            ->setMetadata($event->context());
     }
 
     /**
@@ -317,7 +317,7 @@ class FirewallService
      */
     private function mapEventToResult(SecurityEventInterface $event): string
     {
-        return match ($event->getName()) {
+        return match ($event->label()) {
             AuthenticationSucceededEvent::class => FirewallLogObject::RESULT_ALLOWED,
             FirewallRuleCreatedEvent::class,
             FirewallRuleExtendedEvent::class,

core/lib/User/Event/UserEvent.php

@@ -61,6 +61,11 @@ abstract class UserEvent extends Event
         return $this->userIdentifier;
     }
 
+    public function tenantIdentifier(): string
+    {
+        return $this->tenantIdentifier;
+    }
+
     public function userIdentity(): string
     {
         return $this->userIdentity;

core/src/views/authentication/AuthLogin.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, onMounted, computed, watch } from 'vue';
+import { ref, onMounted, computed, watch, nextTick } from 'vue';
 import { useRoute } from 'vue-router';
 import { useUserStore } from '@KTXC/stores/userStore';
 import { authenticationService } from '@KTXC/services/authenticationService';
@@ -15,6 +15,7 @@ type LoginPhase = 'identity' | 'method' | 'mfa';
 // Form state
 const identity = ref('');
 const authResponse = ref(''); // password, code, etc.
+const authInput = ref<{ focus: () => void } | null>(null);
 const showPassword = ref(false);
 const rememberMe = ref(false);
 
@@ -60,21 +61,19 @@ const pageTitle = computed(() => {
 });
 
 // Input label/type based on selected method
+const isPasswordMethod = computed(() => selectedMethod.value?.id === 'password');
+
 const authInputLabel = computed(() => {
-  if (!selectedMethod.value) return 'Password';
-  return selectedMethod.value.method === 'credential' ? 'Password' : 'Verification Code';
+  return isPasswordMethod.value ? 'Password' : 'Verification Code';
 });
 
 const authInputType = computed(() => {
-  if (!selectedMethod.value) return 'password';
-  return selectedMethod.value.method === 'credential' ? 'password' : 'text';
+  return isPasswordMethod.value ? 'password' : 'text';
 });
 
 // Validation rules
 const identityRules = [
-  (v: string) => !!v.trim() || 'Email is required',
-  (v: string) => !/\s/.test(v.trim()) || 'Email must not contain spaces',
-  (v: string) => /.+@.+\..+/.test(v.trim()) || 'Email must be valid'
+  (v: string) => !!v.trim() || 'Login ID is required',
 ];
 
 const authResponseRules = [
@@ -117,6 +116,9 @@ onMounted(async () => {
 
 // Watch for method selection changes (for challenge-based methods)
 watch(selectedMethod, async (newMethod) => {
+  await nextTick();
+  authInput.value?.focus();
+
   if (newMethod && newMethod.method === 'challenge' && !challengeSent.value) {
     // Initiate challenge for methods that need it (SMS, email, TOTP)
     await initiateChallenge(newMethod.id);
@@ -313,7 +315,16 @@ function backToIdentity() {
 }
 
 function getMethodIcon(method: AuthenticationMethod): string {
-  if (method.icon) return method.icon;
+  if (method.icon?.startsWith('mdi-') || method.icon?.startsWith('$')) {
+    return method.icon;
+  }
+
+  // Authentication providers may return a bare Material Design icon name
+  // (for example, "lock" or "mail") instead of Vuetify's "mdi-*" form.
+  if (method.icon && /^[a-z0-9-]+$/i.test(method.icon)) {
+    return `mdi-${method.icon}`;
+  }
+
   switch (method.method) {
     case 'credential': return 'mdi-key';
     case 'challenge': return 'mdi-shield-check';
@@ -351,16 +362,15 @@ function getMethodIcon(method: AuthenticationMethod): string {
         v-slot="{ errors, isSubmitting }"
       >
         <div class="mb-6">
-          <v-label>Email Address</v-label>
           <v-text-field
             v-model="identity"
             :rules="identityRules"
-            class="mt-2"
+            aria-label="Login ID"
             required
             hide-details="auto"
             variant="outlined"
             color="primary"
-            autocomplete="email"
+            autocomplete="username"
             autofocus
           ></v-text-field>
         </div>
@@ -391,7 +401,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
             size="large"
             @click="initiateSsoLogin(method.id)"
           >
-            <v-icon v-if="method.icon" start>{{ method.icon }}</v-icon>
+            <v-icon start>{{ getMethodIcon(method) }}</v-icon>
             {{ method.label }}
           </v-btn>
         </div>
@@ -445,18 +455,18 @@ function getMethodIcon(method: AuthenticationMethod): string {
         v-slot="{ errors, isSubmitting }"
       >
         <div class="mb-6">
-          <v-label>{{ authInputLabel }}</v-label>
           <v-text-field
+            ref="authInput"
             v-model="authResponse"
             :rules="authResponseRules"
             :type="authInputType === 'password' && !showPassword ? 'password' : 'text'"
-            class="mt-2"
+            :aria-label="authInputLabel"
             required
             hide-details="auto"
             variant="outlined"
             color="primary"
-            :autocomplete="selectedMethod?.method === 'credential' ? 'current-password' : 'one-time-code'"
-            :inputmode="selectedMethod?.method !== 'credential' ? 'numeric' : undefined"
+            :autocomplete="isPasswordMethod ? 'current-password' : 'off'"
+            :inputmode="isPasswordMethod ? undefined : 'numeric'"
             autofocus
           >
             <template v-if="authInputType === 'password'" v-slot:append-inner>
@@ -470,7 +480,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
           </v-text-field>
         </div>
 
-        <div v-if="selectedMethod?.method === 'credential'" class="d-flex align-center mt-4 mb-7 mb-sm-0">
+        <div v-if="isPasswordMethod" class="d-flex align-center mt-4 mb-7 mb-sm-0">
           <v-checkbox
             v-model="rememberMe"
             label="Keep me logged in"
@@ -493,7 +503,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
           size="large" 
           type="submit"
         >
-          {{ selectedMethod?.method === 'credential' ? 'Login' : 'Verify' }}
+          {{ isPasswordMethod ? 'Login' : 'Verify' }}
         </v-btn>
 
         <v-btn 
@@ -534,6 +544,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
         <div class="mb-6">
           <v-label>Verification Code</v-label>
           <v-text-field
+            ref="authInput"
             v-model="authResponse"
             :rules="authResponseRules"
             type="text"
@@ -542,7 +553,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
             hide-details="auto"
             variant="outlined"
             color="primary"
-            autocomplete="one-time-code"
+            autocomplete="off"
             inputmode="numeric"
             autofocus
           ></v-text-field>

package-lock.json

@@ -6642,9 +6642,9 @@
       }
     },
     "node_modules/vuetify": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-4.1.8.tgz",
-      "integrity": "sha512-003D/8b5462uZCD5CMRTZF3smADmOn47mzthNY0aP/xkslovR5yIc1qXjPdFN0LHcu+p3GEAVmMQabldaIQ5pg==",
+      "version": "4.1.6",
+      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-4.1.6.tgz",
+      "integrity": "sha512-VOsRTsNfs+FE4JXMONZkqX2yznSqC/FXG9/pgVVjsoqIjUvJg+CfFTuOlgyWVFrZYY+crk7LV9uaiN8bZREV/g==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -6653,7 +6653,7 @@
       "peerDependencies": {
         "typescript": ">=4.7",
         "vite-plugin-vuetify": ">=2.1.0",
-        "vue": "^3.5.0 || ^3.6.0-0",
+        "vue": "^3.5.0",
         "webpack-plugin-vuetify": ">=3.1.0"
       },
       "peerDependenciesMeta": {

shared/lib/Event/Event.php

@@ -10,74 +10,74 @@ namespace KTXF\Event;
 class Event
 {
     private bool $propagationStopped = false;
-    private readonly array $data;
+    private readonly array $context;
     private readonly float $timestamp;
-    private readonly string $eventId;
+    private readonly string $identifier;
 
     public function __construct(
-        private readonly string $name,
-        array $data = [],
-        private readonly ?string $tenantId = null,
-        private readonly ?string $identityId = null,
+        private readonly string $label,
+        array $context = [],
+        private readonly ?string $tenantIdentifier = null,
+        private readonly ?string $actorIdentity = null,
     ) {
-        self::validateData($data);
+        self::validateContext($context);
 
-        $this->data = $data;
+        $this->context = $context;
         $this->timestamp = microtime(true);
-        $this->eventId = bin2hex(random_bytes(16));
+        $this->identifier = bin2hex(random_bytes(16));
     }
 
     /**
-     * Get the event name
+     * Get the event label
      */
-    public function getName(): string
+    public function label(): string
     {
-        return $this->name;
+        return $this->label;
     }
 
     /**
-     * Get a data value by key
+     * Get a context value by key
      */
     public function get(string $key, mixed $default = null): mixed
     {
-        return $this->data[$key] ?? $default;
+        return $this->context[$key] ?? $default;
     }
 
     /**
-     * Check if a data key exists
+     * Check if a context key exists
      */
     public function has(string $key): bool
     {
-        return array_key_exists($key, $this->data);
+        return array_key_exists($key, $this->context);
     }
 
     /**
-     * Get all data
+     * Get the event context
      */
-    public function getData(): array
+    public function context(): array
     {
-        return $this->data;
+        return $this->context;
     }
 
     /**
-     * Alias for getData() for backward compatibility
+     * Get all event context
      */
     public function all(): array
     {
-        return $this->data;
+        return $this->context;
     }
 
     /**
      * Get the event timestamp
      */
-    public function getTimestamp(): float
+    public function timestamp(): float
     {
         return $this->timestamp;
     }
 
-    public function getEventId(): string
+    public function identifier(): string
     {
-        return $this->eventId;
+        return $this->identifier;
     }
 
     /**
@@ -99,29 +99,29 @@ class Event
     /**
      * Get tenant ID for multi-tenant context
      */
-    public function getTenantId(): ?string
+    public function tenantIdentifier(): ?string
     {
-        return $this->tenantId;
+        return $this->tenantIdentifier;
     }
 
     /**
-     * Get identity ID (user who triggered the event)
+     * Get the identity of the actor who triggered the event
      */
-    public function getIdentityId(): ?string
+    public function actorIdentity(): ?string
     {
-        return $this->identityId;
+        return $this->actorIdentity;
     }
 
-    private static function validateData(array $data): void
+    private static function validateContext(array $context): void
     {
-        foreach ($data as $value) {
+        foreach ($context as $value) {
             if (is_array($value)) {
-                self::validateData($value);
+                self::validateContext($value);
                 continue;
             }
             if ($value !== null && !is_scalar($value)) {
                 throw new \InvalidArgumentException(
-                    'Event data must contain only scalar, null, or array values.',
+                    'Event context must contain only scalar, null, or array values.',
                 );
             }
         }

tests/php/Unit/Event/AccessDeniedEventTest.php

@@ -27,14 +27,14 @@ final class AccessDeniedEventTest extends TestCase
             'identity-a',
         );
 
-        self::assertSame(AccessDeniedEvent::class, $event->getName());
+        self::assertSame(AccessDeniedEvent::class, $event->label());
         self::assertSame('203.0.113.10', $event->getIpAddress());
         self::assertSame('device-a', $event->getDeviceFingerprint());
         self::assertSame('rule-a', $event->getRuleId());
         self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
         self::assertSame('Blocked by policy', $event->getReason());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('identity-a', $event->actorIdentity());
         self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
     }
 

tests/php/Unit/Event/AuthenticationFailedEventTest.php

@@ -24,11 +24,11 @@ final class AuthenticationFailedEventTest extends TestCase
             'identity-a',
         );
 
-        self::assertSame(AuthenticationFailedEvent::class, $event->getName());
+        self::assertSame(AuthenticationFailedEvent::class, $event->label());
         self::assertSame('user-a', $event->getUserId());
         self::assertSame('Invalid credentials', $event->getReason());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('identity-a', $event->actorIdentity());
         self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
         self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
     }

tests/php/Unit/Event/AuthenticationSucceededEventTest.php

@@ -22,10 +22,10 @@ final class AuthenticationSucceededEventTest extends TestCase
             'tenant-a',
         );
 
-        self::assertSame(AuthenticationSucceededEvent::class, $event->getName());
+        self::assertSame(AuthenticationSucceededEvent::class, $event->label());
         self::assertSame('user-a', $event->getUserId());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame(['userId' => 'user-a'], $event->getData());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame(['userId' => 'user-a'], $event->context());
         self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
         self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
     }

tests/php/Unit/Event/BruteForceDetectedEventTest.php

@@ -23,15 +23,15 @@ final class BruteForceDetectedEventTest extends TestCase
             'tenant-a',
         );
 
-        self::assertSame(BruteForceDetectedEvent::class, $event->getName());
+        self::assertSame(BruteForceDetectedEvent::class, $event->label());
         self::assertSame('203.0.113.10', $event->getIpAddress());
         self::assertSame(5, $event->getFailureCount());
         self::assertSame(300, $event->getWindowSeconds());
-        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
         self::assertSame('5 failed attempts in 300 seconds', $event->getReason());
         self::assertSame(
             ['failureCount' => 5, 'windowSeconds' => 300],
-            $event->getData(),
+            $event->context(),
         );
         self::assertSame(SecurityEventSeverity::CRITICAL, $event->getSeverity());
     }

tests/php/Unit/Event/EventDispatcherTest.php

@@ -230,9 +230,57 @@ final class EventDispatcherTest extends TestCase
         $result = $dispatcher->processDeferred('test');
 
         self::assertSame(1000, $result->processed);
+        self::assertSame(1000, $result->listenerInvocations);
         self::assertSame(1, $result->remaining);
         self::assertFalse($result->deadlineExceeded);
         self::assertTrue($result->limitExceeded);
+        self::assertTrue($result->eventLimitExceeded);
+        self::assertFalse($result->listenerInvocationLimitExceeded);
+    }
+
+    #[Test]
+    #[TestDox('Deferred event and listener invocation limits are tracked separately')]
+    public function boundsDeferredListenerInvocations(): void
+    {
+        $recursive = new RecursiveListener();
+        $recording = new RecordingListener();
+        $registry = new EventListenerRegistry();
+        $registry->listen(
+            'test',
+            'test.event',
+            RecursiveListener::class,
+            'deferred',
+            DeliveryMode::Deferred,
+        );
+        $registry->listen(
+            'test',
+            'test.event',
+            RecordingListener::class,
+            'deferred',
+            DeliveryMode::Deferred,
+        );
+        $registry->freeze();
+        $dispatcher = new EventDispatcher(
+            $registry,
+            new RecordingContainer([
+                RecursiveListener::class => $recursive,
+                RecordingListener::class => $recording,
+            ]),
+            new NullLogger(),
+            maxDeferredListenerInvocations: 3,
+        );
+        $recursive->dispatcher = $dispatcher;
+        $dispatcher->beginExecution('test');
+        $dispatcher->dispatch(new Event('test.event'));
+
+        $result = $dispatcher->processDeferred('test');
+
+        self::assertSame(1, $result->processed);
+        self::assertSame(2, $result->listenerInvocations);
+        self::assertSame(1, $result->remaining);
+        self::assertTrue($result->limitExceeded);
+        self::assertFalse($result->eventLimitExceeded);
+        self::assertTrue($result->listenerInvocationLimitExceeded);
     }
 }
 

tests/php/Unit/Event/EventTest.php

@@ -22,12 +22,15 @@ final class EventTest extends TestCase
             'identity-a',
         );
 
-        $copy = $event->getData();
+        $copy = $event->context();
         $copy['nested']['value'] = 'changed';
 
         self::assertSame('original', $event->get('nested')['value']);
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('test.event', $event->label());
+        self::assertNotSame('', $event->identifier());
+        self::assertGreaterThan(0, $event->timestamp());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('identity-a', $event->actorIdentity());
     }
 
     #[Test]

tests/php/Unit/Event/FirewallPolicyEventTest.php

@@ -23,14 +23,14 @@ final class FirewallPolicyEventTest extends TestCase
         $allowed = new IpAllowedEvent('203.0.113.11', 'Trusted service', 'tenant-a');
         $device = new DeviceBlockedEvent('device-a', 'Compromised device', 'tenant-a');
 
-        self::assertSame(IpBlockedEvent::class, $blocked->getName());
+        self::assertSame(IpBlockedEvent::class, $blocked->label());
         self::assertSame('203.0.113.10', $blocked->getIpAddress());
         self::assertSame('Repeated abuse', $blocked->getReason());
         self::assertSame(SecurityEventSeverity::CRITICAL, $blocked->getSeverity());
-        self::assertSame(IpAllowedEvent::class, $allowed->getName());
+        self::assertSame(IpAllowedEvent::class, $allowed->label());
         self::assertSame('203.0.113.11', $allowed->getIpAddress());
         self::assertSame(SecurityEventSeverity::INFO, $allowed->getSeverity());
-        self::assertSame(DeviceBlockedEvent::class, $device->getName());
+        self::assertSame(DeviceBlockedEvent::class, $device->label());
         self::assertSame('device-a', $device->getDeviceFingerprint());
         self::assertSame(SecurityEventSeverity::CRITICAL, $device->getSeverity());
     }
@@ -47,12 +47,12 @@ final class FirewallPolicyEventTest extends TestCase
             'operator-a',
         );
 
-        self::assertSame(FirewallSettingsUpdatedEvent::class, $event->getName());
+        self::assertSame(FirewallSettingsUpdatedEvent::class, $event->label());
         self::assertSame('Tighten controls', $event->getChangeReason());
         self::assertSame(['maxAuthFailures' => 5], $event->getPrevious());
         self::assertSame(['maxAuthFailures' => 3], $event->getCurrent());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('operator-a', $event->actorIdentity());
         self::assertSame('manual', $event->getChangeOrigin());
         self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
     }

tests/php/Unit/Event/FirewallRuleEventTest.php

@@ -41,7 +41,7 @@ final class FirewallRuleEventTest extends TestCase
         );
         $rule->setReason('Mutated after publication');
 
-        self::assertSame(FirewallRuleExtendedEvent::class, $event->getName());
+        self::assertSame(FirewallRuleExtendedEvent::class, $event->label());
         self::assertSame('rule-a', $event->getRuleId());
         self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
         self::assertSame(FirewallRuleObject::TYPE_IP, $event->getRuleType());
@@ -50,8 +50,8 @@ final class FirewallRuleEventTest extends TestCase
         self::assertSame('Repeated abuse', $event->getReason());
         self::assertSame('automatic', $event->getOrigin());
         self::assertSame($expiresAt->format(\DateTimeInterface::ATOM), $event->getExpiresAt());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('operator-a', $event->actorIdentity());
         self::assertSame(5, $event->get('failureCount'));
         self::assertSame('Continue monitoring', $event->get('changeReason'));
         self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
@@ -75,7 +75,7 @@ final class FirewallRuleEventTest extends TestCase
             FirewallRuleDisabledEvent::class,
             FirewallRuleRemovedEvent::class,
         ] as $eventClass) {
-            self::assertSame($eventClass, $eventClass::fromRule($rule)->getName());
+            self::assertSame($eventClass, $eventClass::fromRule($rule)->label());
         }
     }
 }

tests/php/Unit/Event/RateLimitExceededEventTest.php

@@ -24,13 +24,13 @@ final class RateLimitExceededEventTest extends TestCase
             'tenant-a',
         );
 
-        self::assertSame(RateLimitExceededEvent::class, $event->getName());
+        self::assertSame(RateLimitExceededEvent::class, $event->label());
         self::assertSame('203.0.113.10', $event->getIpAddress());
         self::assertSame(101, $event->getRequestCount());
         self::assertSame(60, $event->getWindowSeconds());
         self::assertSame('/login', $event->getEndpoint());
         self::assertSame('/login', $event->getRequestPath());
-        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
         self::assertSame('101 requests in 60 seconds', $event->getReason());
         self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
     }

tests/php/Unit/Event/SuspiciousActivityEventTest.php

@@ -30,13 +30,13 @@ final class SuspiciousActivityEventTest extends TestCase
             reason: 'Matched a blocked payload signature',
         );
 
-        self::assertSame(SuspiciousActivityEvent::class, $event->getName());
+        self::assertSame(SuspiciousActivityEvent::class, $event->label());
         self::assertSame('203.0.113.20', $event->getIpAddress());
         self::assertSame('payload-signature', $event->getDetector());
         self::assertSame(['score' => 98], $event->getDetectionData());
-        self::assertSame(['detector' => 'payload-signature', 'score' => 98], $event->getData());
-        self::assertSame('tenant-a', $event->getTenantId());
-        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame(['detector' => 'payload-signature', 'score' => 98], $event->context());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
+        self::assertSame('identity-a', $event->actorIdentity());
         self::assertSame('device-a', $event->getDeviceFingerprint());
         self::assertSame('Test Agent', $event->getUserAgent());
         self::assertSame('/admin', $event->getRequestPath());

tests/php/Unit/Event/UserEventTest.php

@@ -6,6 +6,7 @@ namespace KTXT\Unit\Event;
 
 use KTXC\User\Event\UserCreatedEvent;
 use KTXC\User\Event\UserDeletingEvent;
+use KTXC\User\Event\UserEvent;
 use KTXC\User\Event\UserUpdatedEvent;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -29,15 +30,16 @@ final class UserEventTest extends TestCase
             'actor-a',
         );
 
-        self::assertSame(UserCreatedEvent::class, $event->getName());
+        self::assertSame(UserCreatedEvent::class, $event->label());
         self::assertSame('user-a', $event->userIdentifier());
         self::assertSame('person@example.test', $event->userIdentity());
         self::assertSame('Person', $event->userLabel());
         self::assertTrue($event->userEnabled());
         self::assertSame(['member'], $event->userRoles());
-        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('tenant-a', $event->tenantIdentifier());
         self::assertSame('actor-a', $event->actorIdentifier());
-        self::assertSame('actor-a', $event->getIdentityId());
+        self::assertSame('actor-a', $event->actorIdentity());
+        self::assertSame('string', (string) (new \ReflectionMethod(UserEvent::class, 'tenantIdentifier'))->getReturnType());
     }
 
     #[Test]
@@ -46,9 +48,9 @@ final class UserEventTest extends TestCase
     {
         $user = ['uid' => 'user-a', 'identity' => 'person@example.test'];
 
-        self::assertSame(UserCreatedEvent::class, UserCreatedEvent::fromUser($user, 'tenant-a')->getName());
-        self::assertSame(UserUpdatedEvent::class, UserUpdatedEvent::fromUser($user, 'tenant-a')->getName());
-        self::assertSame(UserDeletingEvent::class, UserDeletingEvent::fromUser($user, 'tenant-a')->getName());
+        self::assertSame(UserCreatedEvent::class, UserCreatedEvent::fromUser($user, 'tenant-a')->label());
+        self::assertSame(UserUpdatedEvent::class, UserUpdatedEvent::fromUser($user, 'tenant-a')->label());
+        self::assertSame(UserDeletingEvent::class, UserDeletingEvent::fromUser($user, 'tenant-a')->label());
     }
 
     #[Test]

tests/php/Unit/Security/AuthenticationManagerTest.php

@@ -78,7 +78,7 @@ final class AuthenticationManagerTest extends TestCase
             ->with(self::callback(static fn($event): bool =>
                 $event instanceof AuthenticationSucceededEvent
                 && $event->getUserId() === 'user-a'
-                && $event->getTenantId() === 'tenant-a'
+                && $event->tenantIdentifier() === 'tenant-a'
             ));
 
         $manager = new AuthenticationManager(
@@ -198,7 +198,7 @@ final class AuthenticationManagerTest extends TestCase
                 return $event instanceof AuthenticationFailedEvent
                     && $event->getUserId() === 'user-a'
                     && $event->getReason() === ProviderResult::ERROR_INVALID_FACTOR
-                    && $event->getTenantId() === 'tenant-a';
+                    && $event->tenantIdentifier() === 'tenant-a';
             }));
 
         $manager = new AuthenticationManager(

tests/php/Unit/Service/FirewallRuleManagerTest.php

@@ -285,7 +285,7 @@ class FirewallRuleManagerTest extends TestCase
         $this->events->expects($this->exactly(2))
             ->method('dispatch')
             ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$events): void {
-                $events[$event->getName()] = $event;
+                $events[$event->label()] = $event;
             });
 
         $this->manager->blockIp(
@@ -302,7 +302,7 @@ class FirewallRuleManagerTest extends TestCase
         self::assertSame(FirewallRuleObject::TYPE_IP, $audit->get('ruleType'));
         self::assertSame(FirewallRuleObject::ACTION_BLOCK, $audit->get('ruleAction'));
         self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $audit->get('origin'));
-        self::assertSame('admin-a', $audit->getIdentityId());
+        self::assertSame('admin-a', $audit->actorIdentity());
         self::assertNotNull($audit->get('expiresAt'));
         self::assertInstanceOf(IpBlockedEvent::class, $events[IpBlockedEvent::class]);
         self::assertSame('203.0.113.10', $events[IpBlockedEvent::class]->getIpAddress());
@@ -385,13 +385,13 @@ class FirewallRuleManagerTest extends TestCase
             FirewallRuleEnabledEvent::class,
             FirewallRuleExtendedEvent::class,
             FirewallRuleRemovedEvent::class,
-        ], array_map(static fn($event): string => $event->getName(), $audits));
+        ], array_map(static fn($event): string => $event->label(), $audits));
         self::assertSame(
             ['Investigation', 'Threat confirmed', 'Continue monitoring', 'Case closed'],
             array_map(static fn($event): string => $event->get('changeReason'), $audits)
         );
         self::assertSame(['operator'], array_values(array_unique(array_map(
-            static fn($event): ?string => $event->getIdentityId(),
+            static fn($event): ?string => $event->actorIdentity(),
             $audits
         ))));
     }

tests/php/Unit/Service/FirewallServiceTest.php

@@ -539,7 +539,7 @@ class FirewallServiceTest extends TestCase
                 &$lifecycleOrigin,
                 &$bruteForceEvent,
             ): void {
-                $publishedTenants[] = $event->getTenantId();
+                $publishedTenants[] = $event->tenantIdentifier();
                 if ($event instanceof BruteForceDetectedEvent) {
                     $bruteForceEvent = $event;
                 }
@@ -616,12 +616,12 @@ class FirewallServiceTest extends TestCase
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(1);
         $event = new AuthenticationFailedEvent();
-        $eventId = $event->getEventId();
+        $eventId = $event->identifier();
 
         $this->service->handleAuthFailure($event);
         $this->service->handleAuthFailure($event);
 
-        self::assertSame($eventId, $event->getEventId());
+        self::assertSame($eventId, $event->identifier());
     }
 
     #[TestDox('Cleanup records successful maintenance counts')]

tests/php/Unit/Service/FirewallSettingsServiceTest.php

@@ -38,9 +38,9 @@ final class FirewallSettingsServiceTest extends TestCase
         $events->expects(self::once())
             ->method('dispatch')
             ->with(self::callback(static fn(FirewallSettingsUpdatedEvent $event): bool =>
-                $event->getName() === FirewallSettingsUpdatedEvent::class
-                && $event->getTenantId() === 'tenant-a'
-                && $event->getIdentityId() === 'admin-a'
+                $event->label() === FirewallSettingsUpdatedEvent::class
+                && $event->tenantIdentifier() === 'tenant-a'
+                && $event->actorIdentity() === 'admin-a'
                 && $event->get('changeReason') === 'Tighten authentication controls'
                 && $event->get('previous')['maxAuthFailures'] === 5
                 && $event->get('current')['maxAuthFailures'] === 8

tests/php/Unit/Service/UserAccountsServiceTest.php

@@ -70,7 +70,7 @@ final class UserAccountsServiceTest extends TestCase
         self::assertInstanceOf(UserCreatedEvent::class, $emitted[0]);
         self::assertInstanceOf(UserDeletingEvent::class, $emitted[1]);
         self::assertSame('actor-a', $emitted[0]->actorIdentifier());
-        self::assertSame('tenant-a', $emitted[1]->getTenantId());
+        self::assertSame('tenant-a', $emitted[1]->tenantIdentifier());
         self::assertSame(['event', 'delete'], $operations);
     }