chore(deps): update dependency vuetify to v4.1.7

core/lib/Application/Execution/TerminationReport.php

@@ -15,9 +15,6 @@ final readonly class TerminationReport
         public array $failures = [],
         public bool $deadlineExceeded = false,
         public bool $limitExceeded = false,
-        public int $deferredListenerInvocations = 0,
-        public bool $deferredEventLimitExceeded = false,
-        public bool $deferredListenerInvocationLimitExceeded = false,
     ) {
     }
 }

core/lib/Console/Tenant/TenantCreateCommand.php

@@ -4,12 +4,10 @@ declare(strict_types=1);
 
 namespace KTXC\Console\Tenant;
 
-use KTXC\Context\TenantContext;
 use KTXC\Models\Tenant\DomainCollection;
 use KTXC\Models\Tenant\TenantConfiguration;
 use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\TenantService;
-use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use KTXF\Utile\UUID;
@@ -37,8 +35,6 @@ class TenantCreateCommand extends Command
         private readonly TenantService $tenantService,
         private readonly UserRolesStore $rolesStore,
         private readonly UserAccountsStore $userStore,
-        private readonly UserAccountsService $userService,
-        private readonly TenantContext $tenantContext,
         private readonly LoggerInterface $logger
     ) {
         parent::__construct();
@@ -101,10 +97,6 @@ class TenantCreateCommand extends Command
                 $io->error('Failed to create tenant.');
                 return Command::FAILURE;
             }
-            if (!$this->tenantContext->resolveIdentifier($identifier)) {
-                throw new \RuntimeException("Failed to initialize tenant context for '{$identifier}'.");
-            }
-            $identifier = $this->tenantContext->requireIdentifier();
 
             $this->logger->info('Tenant created via console', [
                 'identifier' => $identifier,
@@ -142,7 +134,7 @@ class TenantCreateCommand extends Command
                 if ($this->userStore->fetchByIdentity($identifier, $adminIdentity)) {
                     $io->warning("User '{$adminIdentity}' already exists in tenant '{$identifier}'; skipping admin user creation.");
                 } else {
-                    $this->userService->createUser([
+                    $this->userStore->createUser($identifier, [
                         'identity' => $adminIdentity,
                         'label' => 'Administrator',
                         'enabled' => true,

core/lib/Console/User/UserCreateCommand.php

@@ -4,8 +4,7 @@ declare(strict_types=1);
 
 namespace KTXC\Console\User;
 
-use KTXC\Context\TenantContext;
-use KTXC\Service\UserAccountsService;
+use KTXC\Service\TenantService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use Psr\Log\LoggerInterface;
@@ -29,9 +28,8 @@ use Symfony\Component\Console\Style\SymfonyStyle;
 class UserCreateCommand extends Command
 {
     public function __construct(
-        private readonly TenantContext $tenantContext,
+        private readonly TenantService $tenantService,
         private readonly UserAccountsStore $userStore,
-        private readonly UserAccountsService $userService,
         private readonly UserRolesStore $rolesStore,
         private readonly LoggerInterface $logger
     ) {
@@ -61,11 +59,11 @@ class UserCreateCommand extends Command
         $io->title('Create User');
 
         try {
-            if (!$this->tenantContext->resolveIdentifier($tenant)) {
+            // Ensure the tenant exists
+            if (!$this->tenantService->fetchById($tenant)) {
                 $io->error("Tenant '{$tenant}' not found.");
                 return Command::FAILURE;
             }
-            $tenant = $this->tenantContext->requireIdentifier();
 
             // Ensure identity is unique within the tenant
             if ($this->userStore->fetchByIdentity($tenant, $identity)) {
@@ -97,7 +95,7 @@ class UserCreateCommand extends Command
                 $userData['uid'] = $input->getOption('uid');
             }
 
-            $user = $this->userService->createUser($userData);
+            $user = $this->userStore->createUser($tenant, $userData);
 
             $this->logger->info('User created via console', [
                 'tenant' => $tenant,

core/lib/Console/User/UserDeleteCommand.php

@@ -4,8 +4,6 @@ declare(strict_types=1);
 
 namespace KTXC\Console\User;
 
-use KTXC\Context\TenantContext;
-use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Console\Attribute\AsCommand;
@@ -28,9 +26,7 @@ use Symfony\Component\Console\Style\SymfonyStyle;
 class UserDeleteCommand extends Command
 {
     public function __construct(
-        private readonly TenantContext $tenantContext,
         private readonly UserAccountsStore $userStore,
-        private readonly UserAccountsService $userService,
         private readonly LoggerInterface $logger
     ) {
         parent::__construct();
@@ -56,12 +52,6 @@ class UserDeleteCommand extends Command
         $io->title('Delete User');
 
         try {
-            if (!$this->tenantContext->resolveIdentifier($tenant)) {
-                $io->error("Tenant '{$tenant}' not found.");
-                return Command::FAILURE;
-            }
-            $tenant = $this->tenantContext->requireIdentifier();
-
             $user = $this->userStore->fetchByIdentity($tenant, $identity);
 
             if (!$user) {
@@ -74,7 +64,7 @@ class UserDeleteCommand extends Command
                 return Command::SUCCESS;
             }
 
-            if (!$this->userService->deleteUser($user['uid'])) {
+            if (!$this->userStore->deleteUser($tenant, $user['uid'])) {
                 $io->error("Failed to delete user '{$identity}'.");
                 return Command::FAILURE;
             }

core/lib/Controllers/AuthenticationController.php

@@ -92,9 +92,9 @@ class AuthenticationController extends ControllerAbstract
         }
 
         $request = AuthenticationRequest::verify($session, $method, $response);
-        $response = $this->authManager->handle($request);
+        $authResponse = $this->authManager->handle($request);
 
-        return $this->buildJsonResponse($response);
+        return $this->buildJsonResponse($authResponse);
     }
 
     /**
@@ -120,8 +120,8 @@ class AuthenticationController extends ControllerAbstract
         $host = $request->getHost();
         $callbackUrl = "{$scheme}://{$host}/auth/callback/{$method}";
 
-        $request = AuthenticationRequest::redirect($sessionId, $method, $callbackUrl, $returnUrl);
-        $response = $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::redirect($sessionId, $method, $callbackUrl, $returnUrl);
+        $response = $this->authManager->handle($authRequest);
 
         return $this->buildJsonResponse($response);
     }
@@ -142,8 +142,8 @@ class AuthenticationController extends ControllerAbstract
             return $this->redirectWithError('Missing state parameter');
         }
 
-        $request = AuthenticationRequest::callback($sessionId, $provider, $params);
-        $response = $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::callback($sessionId, $provider, $params);
+        $response = $this->authManager->handle($authRequest);
 
         if ($response->isSuccess()) {
             $returnUrl = $response->returnUrl ?? '/';
@@ -178,8 +178,8 @@ class AuthenticationController extends ControllerAbstract
             );
         }
 
-        $request = AuthenticationRequest::status($sessionId);
-        $response = $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::status($sessionId);
+        $response = $this->authManager->handle($authRequest);
 
         return $this->buildJsonResponse($response);
     }
@@ -192,8 +192,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $sessionId = $request->query->get('session', '');
         
-        $request = AuthenticationRequest::cancel($sessionId);
-        $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::cancel($sessionId);
+        $this->authManager->handle($authRequest);
 
         return new JsonResponse(['status' => 'cancelled', 'message' => 'Session cancelled']);
     }
@@ -217,8 +217,8 @@ class AuthenticationController extends ControllerAbstract
             );
         }
 
-        $request = AuthenticationRequest::refresh($refreshToken);
-        $response = $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::refresh($refreshToken);
+        $response = $this->authManager->handle($authRequest);
 
         if ($response->isFailed()) {
             $httpResponse = new JsonResponse($response->toArray(), $response->httpStatus);
@@ -259,8 +259,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $token = $request->cookies->get('accessToken');
         
-        $request = AuthenticationRequest::logout($token, false);
-        $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::logout($token, false);
+        $this->authManager->handle($authRequest);
 
         $response = new JsonResponse(['status' => 'success', 'message' => 'Logged out successfully']);
         return $this->clearTokenCookies($response);
@@ -274,8 +274,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $token = $request->cookies->get('accessToken');
         
-        $request = AuthenticationRequest::logout($token, true);
-        $this->authManager->handle($request);
+        $authRequest = AuthenticationRequest::logout($token, true);
+        $this->authManager->handle($authRequest);
 
         $response = new JsonResponse(['status' => 'success', 'message' => 'Logged out from all devices']);
         return $this->clearTokenCookies($response);

core/lib/Event/DeferredProcessingResult.php

@@ -11,9 +11,6 @@ final readonly class DeferredProcessingResult
         public int $remaining,
         public bool $deadlineExceeded,
         public bool $limitExceeded = false,
-        public int $listenerInvocations = 0,
-        public bool $eventLimitExceeded = false,
-        public bool $listenerInvocationLimitExceeded = false,
     ) {
     }
 }

core/lib/Event/EventDispatcher.php

@@ -13,10 +13,6 @@ use Psr\Log\LoggerInterface;
 
 final class EventDispatcher implements EventDispatcherInterface, DeferredEventProcessorInterface
 {
-    private const DEFAULT_DEFERRED_PROCESSING_TIMEOUT_SECONDS = 300.0;
-    private const DEFAULT_MAX_DEFERRED_EVENTS = 1000;
-    private const DEFAULT_MAX_DEFERRED_LISTENER_INVOCATIONS = 50000;
-
     /** @var array<string, list<Event>> */
     private array $deferred = [];
     private ?string $activeExecution = null;
@@ -26,19 +22,7 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
         private readonly EventListenerRegistry $registry,
         private readonly ContainerInterface $container,
         private readonly LoggerInterface $logger,
-        private readonly float $deferredProcessingTimeoutSeconds = self::DEFAULT_DEFERRED_PROCESSING_TIMEOUT_SECONDS,
-        private readonly int $maxDeferredEvents = self::DEFAULT_MAX_DEFERRED_EVENTS,
-        private readonly int $maxDeferredListenerInvocations = self::DEFAULT_MAX_DEFERRED_LISTENER_INVOCATIONS,
     ) {
-        if ($this->deferredProcessingTimeoutSeconds <= 0) {
-            throw new \InvalidArgumentException('The deferred processing timeout must be greater than zero.');
-        }
-        if ($this->maxDeferredEvents <= 0) {
-            throw new \InvalidArgumentException('The deferred event limit must be greater than zero.');
-        }
-        if ($this->maxDeferredListenerInvocations <= 0) {
-            throw new \InvalidArgumentException('The deferred listener invocation limit must be greater than zero.');
-        }
     }
 
     public function dispatch(Event $event): void
@@ -50,7 +34,7 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
 
         try {
             $this->invoke($event, DeliveryMode::Immediate);
-            if ($this->registry->listeners($event->label(), DeliveryMode::Deferred) !== []) {
+            if ($this->registry->listeners($event->getName(), DeliveryMode::Deferred) !== []) {
                 if ($this->activeExecution === null) {
                     throw new \LogicException('Deferred events require an active execution scope.');
                 }
@@ -76,16 +60,13 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
             throw new \LogicException('Cannot process deferred events for an inactive execution.');
         }
 
-        try {
-            $processedEvents = 0;
-            $listenerInvocations = 0;
-            $deadline = microtime(true) + $this->deferredProcessingTimeoutSeconds;
+        $processed = 0;
+        $deadline = microtime(true) + 1.0;
         $deadlineExceeded = false;
-            $eventLimitExceeded = false;
-            $listenerInvocationLimitExceeded = false;
+        $limitExceeded = false;
         while (($event = array_shift($this->deferred[$executionId])) !== null) {
-                if ($processedEvents >= $this->maxDeferredEvents) {
-                    $eventLimitExceeded = true;
+            if ($processed >= 1000) {
+                $limitExceeded = true;
                 array_unshift($this->deferred[$executionId], $event);
                 break;
             }
@@ -94,33 +75,19 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
                 array_unshift($this->deferred[$executionId], $event);
                 break;
             }
-
-                $eventListenerCount = count($this->registry->listeners(
-                    $event->label(),
-                    DeliveryMode::Deferred,
-                ));
-                if ($listenerInvocations + $eventListenerCount > $this->maxDeferredListenerInvocations) {
-                    $listenerInvocationLimitExceeded = true;
-                    array_unshift($this->deferred[$executionId], $event);
-                    break;
+            $processed += $this->invoke($event, DeliveryMode::Deferred);
         }
 
-                $listenerInvocations += $this->invoke($event, DeliveryMode::Deferred);
-                $processedEvents++;
-            }
+        $remaining = count($this->deferred[$executionId]);
+        unset($this->deferred[$executionId]);
+        $this->activeExecution = null;
 
         return new DeferredProcessingResult(
-                processed: $processedEvents,
-                remaining: count($this->deferred[$executionId]),
-                deadlineExceeded: $deadlineExceeded,
-                limitExceeded: $eventLimitExceeded || $listenerInvocationLimitExceeded,
-                listenerInvocations: $listenerInvocations,
-                eventLimitExceeded: $eventLimitExceeded,
-                listenerInvocationLimitExceeded: $listenerInvocationLimitExceeded,
+            $processed,
+            $remaining,
+            $deadlineExceeded,
+            $limitExceeded,
         );
-        } finally {
-            $this->discardDeferred($executionId);
-        }
     }
 
     public function discardDeferred(string $executionId): void
@@ -134,18 +101,18 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
     private function invoke(Event $event, DeliveryMode $delivery): int
     {
         $processed = 0;
-        foreach ($this->registry->listeners($event->label(), $delivery) as $listener) {
+        foreach ($this->registry->listeners($event->getName(), $delivery) as $listener) {
             if ($event->isPropagationStopped()) {
                 break;
             }
 
-            $processed++;
             try {
                 $service = $this->container->get($listener->service);
                 $service->{$listener->method}($event);
+                $processed++;
             } catch (\Throwable $error) {
                 $this->logger->error('Event listener failed.', [
-                    'event' => $event->label(),
+                    'event' => $event->getName(),
                     'module' => $listener->module,
                     'listener' => $listener->service . '::' . $listener->method,
                     'exception' => $error,

core/lib/Http/Request/RequestContext.php

@@ -1,32 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Http\Request;
-
-/**
- * Holds the HTTP request for the duration of the current runtime execution.
- */
-final class RequestContext
-{
-    private ?Request $request = null;
-
-    public function initialize(Request $request): void
-    {
-        if ($this->request !== null) {
-            throw new \LogicException('The request context has already been initialized.');
-        }
-
-        $this->request = $request;
-    }
-
-    public function current(): ?Request
-    {
-        return $this->request;
-    }
-
-    public function clear(): void
-    {
-        $this->request = null;
-    }
-}

core/lib/Kernel.php

@@ -238,9 +238,6 @@ class Kernel implements KernelInterface
         $remaining = 0;
         $deadlineExceeded = false;
         $limitExceeded = false;
-        $listenerInvocations = 0;
-        $eventLimitExceeded = false;
-        $listenerInvocationLimitExceeded = false;
         $failures = [];
 
         try {
@@ -252,9 +249,6 @@ class Kernel implements KernelInterface
                 $remaining = $result->remaining;
                 $deadlineExceeded = $result->deadlineExceeded;
                 $limitExceeded = $result->limitExceeded;
-                $listenerInvocations = $result->listenerInvocations;
-                $eventLimitExceeded = $result->eventLimitExceeded;
-                $listenerInvocationLimitExceeded = $result->listenerInvocationLimitExceeded;
             }
         } catch (\Throwable $e) {
             $failures[] = $e;
@@ -293,9 +287,6 @@ class Kernel implements KernelInterface
             failures: $failures,
             deadlineExceeded: $deadlineExceeded,
             limitExceeded: $limitExceeded,
-            deferredListenerInvocations: $listenerInvocations,
-            deferredEventLimitExceeded: $eventLimitExceeded,
-            deferredListenerInvocationLimitExceeded: $listenerInvocationLimitExceeded,
         );
     }
 

core/lib/Module/Module.php

@@ -11,18 +11,8 @@ use KTXC\Service\SystemFirewallStatusService;
 use KTXC\Service\TenantFirewallLogService;
 use KTXC\Service\TenantFirewallRuleService;
 use KTXC\Service\TenantFirewallStatusService;
-use KTXC\Security\Event\AccessDeniedEvent;
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
-use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SuspiciousActivityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\Event\DeliveryMode;
 use KTXF\Event\EventListenerRegistrarInterface;
 use KTXF\Module\ModuleBrowserInterface;
@@ -48,29 +38,21 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
             AuthenticationFailedEvent::class,
             FirewallService::class,
             'handleAuthFailure',
-            DeliveryMode::Immediate,
             priority: 100,
         );
 
-        $this->events->listen(
-            'core',
-            AuthenticationSucceededEvent::class,
-            FirewallService::class,
-            'logAuthenticationSuccess',
-            DeliveryMode::Deferred,
-        );
-
         foreach ([
-            AccessDeniedEvent::class,
-            BruteForceDetectedEvent::class,
-            RateLimitExceededEvent::class,
-            SuspiciousActivityEvent::class,
-            FirewallRuleCreatedEvent::class,
-            FirewallRuleExtendedEvent::class,
-            FirewallRuleEnabledEvent::class,
-            FirewallRuleDisabledEvent::class,
-            FirewallRuleRemovedEvent::class,
-            FirewallSettingsUpdatedEvent::class,
+            SecurityEvent::AUTH_SUCCESS,
+            SecurityEvent::ACCESS_DENIED,
+            SecurityEvent::BRUTE_FORCE_DETECTED,
+            SecurityEvent::RATE_LIMIT_EXCEEDED,
+            SecurityEvent::SUSPICIOUS_ACTIVITY,
+            SecurityEvent::FIREWALL_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_EXTENDED,
+            SecurityEvent::FIREWALL_RULE_ENABLED,
+            SecurityEvent::FIREWALL_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED,
+            SecurityEvent::FIREWALL_SETTINGS_UPDATED,
         ] as $event) {
             $this->events->listen(
                 'core',

core/lib/Runtime/Http/HttpRuntime.php

@@ -11,7 +11,6 @@ use KTXC\Http\Middleware\MiddlewarePipeline;
 use KTXC\Http\Middleware\RouterMiddleware;
 use KTXC\Http\Middleware\TenantMiddleware;
 use KTXC\Http\Request\Request;
-use KTXC\Http\Request\RequestContext;
 use KTXC\Http\Response\Response;
 use KTXC\KernelInterface;
 
@@ -26,15 +25,10 @@ final class HttpRuntime
     public function run(?Request $request = null, bool $send = true): Response
     {
         $request ??= Request::createFromGlobals();
-        $requestContext = null;
 
-        try {
         return $this->kernel->executionRunner()->execute(
             ExecutionDescriptor::http(),
-                function () use ($request, $send, &$requestContext): Response {
-                    $requestContext = $this->kernel->container()->get(RequestContext::class);
-                    $requestContext->initialize($request);
-
+            function () use ($request, $send): Response {
                 $response = $this->pipeline()->handle($request);
                 if ($send) {
                     $response->send();
@@ -51,9 +45,6 @@ final class HttpRuntime
                 return $response;
             },
         );
-        } finally {
-            $requestContext?->clear();
-        }
     }
 
     private function pipeline(): MiddlewarePipeline

core/lib/Security/AuthenticationManager.php

@@ -8,14 +8,11 @@ use KTXC\Models\Identity\User;
 use KTXC\Resource\ProviderManager;
 use KTXC\Security\Authentication\AuthenticationRequest;
 use KTXC\Security\Authentication\AuthenticationResponse;
-use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
 use KTXC\Service\TokenService;
 use KTXC\Service\UserAccountsService;
 use KTXC\Context\TenantContextInterface;
 use KTXF\Cache\CacheScope;
 use KTXF\Cache\EphemeralCacheInterface;
-use KTXF\Event\EventDispatcherInterface;
 use KTXF\Security\Authentication\AuthenticationProviderInterface;
 use KTXF\Security\Authentication\AuthenticationSession;
 use KTXF\Security\Authentication\ProviderContext;
@@ -34,7 +31,6 @@ class AuthenticationManager
         private readonly ProviderManager $providerManager,
         private readonly TokenService $tokenService,
         private readonly UserAccountsService $userService,
-        private readonly EventDispatcherInterface $events,
     ) {
         $this->securityCode = $this->tenantContext->configuration()->security()->code();
     }
@@ -191,10 +187,6 @@ class AuthenticationManager
 
         if (!$result->isSuccess()) {
             $this->saveSession($session);
-            $this->publishAuthenticationFailure(
-                $session,
-                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
-            );
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
                 'Authentication failed. If you haven\'t set up this method, try another option.',
@@ -397,10 +389,6 @@ class AuthenticationManager
         $result = $provider->completeRedirect($context, $request->params);
 
         if ($result->isFailed()) {
-            $this->publishAuthenticationFailure(
-                $session,
-                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
-            );
             $this->deleteSession($session->id);
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
@@ -578,17 +566,6 @@ class AuthenticationManager
     // Helper Methods
     // =========================================================================
 
-    private function publishAuthenticationFailure(
-        AuthenticationSession $session,
-        string $reason,
-    ): void {
-        $this->events->dispatch(new AuthenticationFailedEvent(
-            userId: $session->userIdentifier,
-            reason: $reason,
-            tenantId: $session->tenantIdentifier,
-        ));
-    }
-
     /**
      * Build provider context from session
      */
@@ -617,16 +594,7 @@ class AuthenticationManager
      */
     private function completeAuthentication(AuthenticationSession $session): AuthenticationResponse
     {
-        $userId = $session->userIdentifier;
-        if ($userId === null) {
-            return AuthenticationResponse::failed(
-                AuthenticationResponse::ERROR_INVALID_SESSION,
-                'Authenticated user is missing',
-                401,
-            );
-        }
-
-        $userData = $this->userService->fetchByIdentifier($userId);
+        $userData = $this->userService->fetchByIdentifier($session->userIdentifier);
         
         if ($userData === null) {
             return AuthenticationResponse::failed(
@@ -643,11 +611,6 @@ class AuthenticationManager
 
         $this->deleteSession($session->id);
 
-        $this->events->dispatch(new AuthenticationSucceededEvent(
-            $userId,
-            $session->tenantIdentifier,
-        ));
-
         return AuthenticationResponse::success(
             $this->buildUserData($user),
             $tokens

core/lib/Security/Event/AccessDeniedEvent.php

@@ -1,88 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXC\Models\Firewall\FirewallRuleObject;
-use KTXF\Event\Event;
-
-final class AccessDeniedEvent extends Event implements SecurityRequestEventInterface
-{
-    public function __construct(
-        private readonly string $ipAddress,
-        private readonly string $ruleId,
-        private readonly string $ruleScope,
-        private readonly ?string $deviceFingerprint = null,
-        private readonly ?string $reason = null,
-        ?string $tenantId = null,
-        ?string $identityId = null,
-    ) {
-        if ($ipAddress === '') {
-            throw new \InvalidArgumentException('Access denial requires an IP address.');
-        }
-        if ($ruleId === '') {
-            throw new \InvalidArgumentException('Access denial requires a firewall rule ID.');
-        }
-        if (!in_array($ruleScope, [FirewallRuleObject::SCOPE_SYSTEM, FirewallRuleObject::SCOPE_TENANT], true)) {
-            throw new \InvalidArgumentException('Access denial requires a valid firewall rule scope.');
-        }
-
-        parent::__construct(
-            self::class,
-            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
-            $tenantId,
-            $identityId,
-        );
-    }
-
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getRuleId(): string
-    {
-        return $this->ruleId;
-    }
-
-    public function getRuleScope(): string
-    {
-        return $this->ruleScope;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return null;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::WARNING;
-    }
-}

core/lib/Security/Event/AuthenticationFailedEvent.php

@@ -9,10 +9,15 @@ use KTXF\Event\Event;
 final class AuthenticationFailedEvent extends Event implements SecurityEventInterface
 {
     public function __construct(
+        private readonly string $ipAddress,
+        private readonly ?string $deviceFingerprint = null,
         private readonly ?string $userId = null,
         private readonly ?string $reason = null,
         ?string $tenantId = null,
         ?string $identityId = null,
+        private readonly ?string $userAgent = null,
+        private readonly ?string $requestPath = null,
+        private readonly ?string $requestMethod = null,
     ) {
         parent::__construct(
             self::class,
@@ -22,6 +27,31 @@ final class AuthenticationFailedEvent extends Event implements SecurityEventInte
         );
     }
 
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return $this->userAgent;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return $this->requestPath;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return $this->requestMethod;
+    }
+
     public function getUserId(): ?string
     {
         return $this->userId;
@@ -32,8 +62,8 @@ final class AuthenticationFailedEvent extends Event implements SecurityEventInte
         return $this->reason;
     }
 
-    public function getSeverity(): SecurityEventSeverity
+    public function getSeverity(): int
     {
-        return SecurityEventSeverity::WARNING;
+        return SecurityEvent::SEVERITY_WARNING;
     }
 }

core/lib/Security/Event/AuthenticationSucceededEvent.php

@@ -1,40 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class AuthenticationSucceededEvent extends Event implements SecurityEventInterface
-{
-    public function __construct(
-        private readonly string $userId,
-        ?string $tenantId = null,
-    ) {
-        if ($userId === '') {
-            throw new \InvalidArgumentException('Successful authentication requires a user ID.');
-        }
-
-        parent::__construct(
-            self::class,
-            ['userId' => $userId],
-            $tenantId,
-        );
-    }
-
-    public function getUserId(): string
-    {
-        return $this->userId;
-    }
-
-    public function getReason(): ?string
-    {
-        return null;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::INFO;
-    }
-}

core/lib/Security/Event/BruteForceDetectedEvent.php

@@ -1,91 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class BruteForceDetectedEvent extends Event implements SecurityRequestEventInterface
-{
-    private readonly string $reason;
-
-    public function __construct(
-        private readonly string $ipAddress,
-        private readonly int $failureCount,
-        private readonly int $windowSeconds,
-        ?string $tenantId = null,
-    ) {
-        if ($ipAddress === '') {
-            throw new \InvalidArgumentException('Brute-force detection requires an IP address.');
-        }
-        if ($failureCount < 1) {
-            throw new \InvalidArgumentException('Brute-force detection requires at least one failure.');
-        }
-        if ($windowSeconds < 1) {
-            throw new \InvalidArgumentException('Brute-force detection requires a positive window.');
-        }
-
-        $this->reason = sprintf(
-            '%d failed attempts in %d seconds',
-            $failureCount,
-            $windowSeconds,
-        );
-
-        parent::__construct(
-            self::class,
-            ['failureCount' => $failureCount, 'windowSeconds' => $windowSeconds],
-            $tenantId,
-        );
-    }
-
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getFailureCount(): int
-    {
-        return $this->failureCount;
-    }
-
-    public function getWindowSeconds(): int
-    {
-        return $this->windowSeconds;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return null;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return null;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::CRITICAL;
-    }
-}

core/lib/Security/Event/DeviceBlockedEvent.php

@@ -1,66 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class DeviceBlockedEvent extends Event implements SecurityRequestEventInterface
-{
-    public function __construct(
-        private readonly string $deviceFingerprint,
-        private readonly ?string $reason = null,
-        ?string $tenantId = null,
-    ) {
-        if ($deviceFingerprint === '') {
-            throw new \InvalidArgumentException('Device-block events require a fingerprint.');
-        }
-
-        parent::__construct(
-            self::class,
-            ['device' => $deviceFingerprint, 'reason' => $reason],
-            $tenantId,
-        );
-    }
-
-    public function getIpAddress(): ?string
-    {
-        return null;
-    }
-
-    public function getDeviceFingerprint(): string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return null;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::CRITICAL;
-    }
-}

core/lib/Security/Event/FirewallIpEvent.php

@@ -1,68 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-abstract class FirewallIpEvent extends Event implements SecurityRequestEventInterface
-{
-    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::INFO;
-
-    final public function __construct(
-        private readonly string $ipAddress,
-        private readonly ?string $reason = null,
-        ?string $tenantId = null,
-    ) {
-        if ($ipAddress === '') {
-            throw new \InvalidArgumentException('Firewall IP events require an IP address.');
-        }
-
-        parent::__construct(
-            static::class,
-            ['ip' => $ipAddress, 'reason' => $reason],
-            $tenantId,
-        );
-    }
-
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return null;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return null;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return static::SEVERITY;
-    }
-}

core/lib/Security/Event/FirewallRuleCreatedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class FirewallRuleCreatedEvent extends FirewallRuleEvent
-{
-}

core/lib/Security/Event/FirewallRuleDisabledEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class FirewallRuleDisabledEvent extends FirewallRuleEvent
-{
-}

core/lib/Security/Event/FirewallRuleEnabledEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class FirewallRuleEnabledEvent extends FirewallRuleEvent
-{
-}

core/lib/Security/Event/FirewallRuleEvent.php

@@ -1,158 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXC\Models\Firewall\FirewallRuleObject;
-use KTXF\Event\Event;
-
-abstract class FirewallRuleEvent extends Event implements SecurityEventInterface
-{
-    final protected function __construct(
-        private readonly string $ruleId,
-        private readonly string $ruleScope,
-        private readonly string $ruleType,
-        private readonly string $ruleAction,
-        private readonly string $ruleValue,
-        private readonly ?string $reason,
-        private readonly string $origin,
-        private readonly ?string $expiresAt,
-        private readonly array $details,
-        ?string $tenantId,
-        ?string $identityId,
-    ) {
-        if ($ruleId === '') {
-            throw new \InvalidArgumentException('Firewall rule events require a rule ID.');
-        }
-        foreach ([
-            'scope' => $ruleScope,
-            'type' => $ruleType,
-            'action' => $ruleAction,
-            'value' => $ruleValue,
-            'origin' => $origin,
-        ] as $field => $value) {
-            if ($value === '') {
-                throw new \InvalidArgumentException("Firewall rule events require a rule {$field}.");
-            }
-        }
-        foreach ([
-            'scope' => $ruleScope,
-            'type' => $ruleType,
-            'action' => $ruleAction,
-            'value' => $ruleValue,
-            'origin' => $origin,
-        ] as $field => $value) {
-            if ($value === '') {
-                throw new \InvalidArgumentException("Firewall rule events require a rule {$field}.");
-            }
-        }
-
-        parent::__construct(
-            static::class,
-            [
-                'ruleId' => $ruleId,
-                'ruleScope' => $ruleScope,
-                'ruleType' => $ruleType,
-                'ruleAction' => $ruleAction,
-                'ruleValue' => $ruleValue,
-                'reason' => $reason,
-                'origin' => $origin,
-                'expiresAt' => $expiresAt,
-                ...$details,
-            ],
-            $tenantId,
-            $identityId,
-        );
-    }
-
-    public static function fromRule(
-        FirewallRuleObject $rule,
-        ?string $actorId = null,
-        array $change = [],
-    ): static {
-        $metadata = $rule->getMetadata() ?? [];
-        $details = [...$metadata, ...$change];
-        foreach ([
-            'ruleId',
-            'ruleScope',
-            'ruleType',
-            'ruleAction',
-            'ruleValue',
-            'reason',
-            'origin',
-            'expiresAt',
-        ] as $reservedKey) {
-            unset($details[$reservedKey]);
-        }
-
-        return new static(
-            ruleId: (string) $rule->getId(),
-            ruleScope: (string) $rule->getScope(),
-            ruleType: (string) $rule->getType(),
-            ruleAction: (string) $rule->getAction(),
-            ruleValue: (string) $rule->getValue(),
-            reason: $rule->getReason(),
-            origin: (string) ($metadata['origin'] ?? 'manual'),
-            expiresAt: $rule->getExpiresAt()?->format(\DateTimeInterface::ATOM),
-            details: $details,
-            tenantId: $rule->getTenantId(),
-            identityId: $actorId ?? $rule->getCreatedBy(),
-        );
-    }
-
-    public function getRuleId(): string
-    {
-        return $this->ruleId;
-    }
-
-    public function getRuleScope(): string
-    {
-        return $this->ruleScope;
-    }
-
-    public function getRuleType(): string
-    {
-        return $this->ruleType;
-    }
-
-    public function getRuleAction(): string
-    {
-        return $this->ruleAction;
-    }
-
-    public function getRuleValue(): string
-    {
-        return $this->ruleValue;
-    }
-
-    public function getOrigin(): string
-    {
-        return $this->origin;
-    }
-
-    public function getExpiresAt(): ?string
-    {
-        return $this->expiresAt;
-    }
-
-    public function getDetails(): array
-    {
-        return $this->details;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::INFO;
-    }
-}

core/lib/Security/Event/FirewallRuleExtendedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class FirewallRuleExtendedEvent extends FirewallRuleEvent
-{
-}

core/lib/Security/Event/FirewallRuleRemovedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class FirewallRuleRemovedEvent extends FirewallRuleEvent
-{
-}

core/lib/Security/Event/FirewallSettingsUpdatedEvent.php

@@ -1,76 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class FirewallSettingsUpdatedEvent extends Event implements SecurityEventInterface
-{
-    public function __construct(
-        private readonly string $changeReason,
-        private readonly array $previous,
-        private readonly array $current,
-        string $tenantId,
-        ?string $actorId = null,
-        private readonly string $changeOrigin = 'manual',
-    ) {
-        if ($changeReason === '') {
-            throw new \InvalidArgumentException('Firewall settings updates require a change reason.');
-        }
-        if ($tenantId === '') {
-            throw new \InvalidArgumentException('Firewall settings updates require a tenant ID.');
-        }
-        if ($changeOrigin === '') {
-            throw new \InvalidArgumentException('Firewall settings updates require a change origin.');
-        }
-
-        parent::__construct(
-            self::class,
-            [
-                'changeReason' => $changeReason,
-                'changeOrigin' => $changeOrigin,
-                'previous' => $previous,
-                'current' => $current,
-            ],
-            $tenantId,
-            $actorId,
-        );
-    }
-
-    public function getChangeReason(): string
-    {
-        return $this->changeReason;
-    }
-
-    public function getPrevious(): array
-    {
-        return $this->previous;
-    }
-
-    public function getCurrent(): array
-    {
-        return $this->current;
-    }
-
-    public function getChangeOrigin(): string
-    {
-        return $this->changeOrigin;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): string
-    {
-        return $this->changeReason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::INFO;
-    }
-}

core/lib/Security/Event/IpAllowedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class IpAllowedEvent extends FirewallIpEvent
-{
-}

core/lib/Security/Event/IpBlockedEvent.php

@@ -1,10 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-final class IpBlockedEvent extends FirewallIpEvent
-{
-    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::CRITICAL;
-}

core/lib/Security/Event/RateLimitExceededEvent.php

@@ -1,104 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class RateLimitExceededEvent extends Event implements SecurityRequestEventInterface
-{
-    private readonly string $reason;
-
-    public function __construct(
-        private readonly string $ipAddress,
-        private readonly int $requestCount,
-        private readonly int $windowSeconds,
-        private readonly ?string $endpoint = null,
-        ?string $tenantId = null,
-    ) {
-        if ($ipAddress === '') {
-            throw new \InvalidArgumentException('Rate-limit detection requires an IP address.');
-        }
-        if ($requestCount < 1) {
-            throw new \InvalidArgumentException('Rate-limit detection requires at least one request.');
-        }
-        if ($windowSeconds < 1) {
-            throw new \InvalidArgumentException('Rate-limit detection requires a positive window.');
-        }
-        if ($endpoint === '') {
-            throw new \InvalidArgumentException('A supplied rate-limit endpoint cannot be empty.');
-        }
-
-        $this->reason = sprintf(
-            '%d requests in %d seconds',
-            $requestCount,
-            $windowSeconds,
-        );
-
-        parent::__construct(
-            self::class,
-            [
-                'requestCount' => $requestCount,
-                'windowSeconds' => $windowSeconds,
-                'endpoint' => $endpoint,
-            ],
-            $tenantId,
-        );
-    }
-
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getRequestCount(): int
-    {
-        return $this->requestCount;
-    }
-
-    public function getWindowSeconds(): int
-    {
-        return $this->windowSeconds;
-    }
-
-    public function getEndpoint(): ?string
-    {
-        return $this->endpoint;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return null;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return null;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return $this->endpoint;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return null;
-    }
-
-    public function getUserId(): ?string
-    {
-        return null;
-    }
-
-    public function getReason(): string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::ERROR;
-    }
-}

core/lib/Security/Event/SecurityEvent.php

@@ -0,0 +1,249 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+/**
+ * Security-specific event for authentication and access control events
+ */
+final class SecurityEvent extends Event implements SecurityEventInterface
+{
+    // Event names
+    public const AUTH_SUCCESS = 'security.auth.success';
+    public const AUTH_LOGOUT = 'security.auth.logout';
+    public const TOKEN_REFRESH = 'security.token.refresh';
+    public const TOKEN_REVOKED = 'security.token.revoked';
+    
+    public const ACCESS_DENIED = 'security.access.denied';
+    public const ACCESS_GRANTED = 'security.access.granted';
+    
+    public const BRUTE_FORCE_DETECTED = 'security.brute_force.detected';
+    public const RATE_LIMIT_EXCEEDED = 'security.rate_limit.exceeded';
+    public const SUSPICIOUS_ACTIVITY = 'security.suspicious.activity';
+    
+    public const IP_BLOCKED = 'security.ip.blocked';
+    public const IP_ALLOWED = 'security.ip.allowed';
+    public const DEVICE_BLOCKED = 'security.device.blocked';
+    public const FIREWALL_RULE_CREATED = 'security.firewall.rule.created';
+    public const FIREWALL_RULE_EXTENDED = 'security.firewall.rule.extended';
+    public const FIREWALL_RULE_ENABLED = 'security.firewall.rule.enabled';
+    public const FIREWALL_RULE_DISABLED = 'security.firewall.rule.disabled';
+    public const FIREWALL_RULE_REMOVED = 'security.firewall.rule.removed';
+    public const FIREWALL_SETTINGS_UPDATED = 'security.firewall.settings.updated';
+
+    // Severity levels
+    public const SEVERITY_DEBUG = 0;
+    public const SEVERITY_INFO = 1;
+    public const SEVERITY_WARNING = 2;
+    public const SEVERITY_ERROR = 3;
+    public const SEVERITY_CRITICAL = 4;
+
+    private readonly int $severity;
+
+    public function __construct(
+        string $name,
+        array $data = [],
+        ?string $tenantId = null,
+        ?string $identityId = null,
+        private readonly ?string $ipAddress = null,
+        private readonly ?string $deviceFingerprint = null,
+        private readonly ?string $userAgent = null,
+        private readonly ?string $requestPath = null,
+        private readonly ?string $requestMethod = null,
+        private readonly ?string $userId = null,
+        private readonly ?string $reason = null,
+        ?int $severity = null,
+    ) {
+        parent::__construct($name, $data, $tenantId, $identityId);
+
+        $this->severity = $severity ?? self::getSeverityForEvent($name);
+    }
+
+    /**
+     * Create a security event with common parameters
+     */
+    public static function create(
+        string $name,
+        ?string $ipAddress = null,
+        ?string $deviceFingerprint = null,
+        array $data = [],
+        ?string $tenantId = null,
+        ?string $identityId = null,
+        ?string $userAgent = null,
+        ?string $requestPath = null,
+        ?string $requestMethod = null,
+        ?string $userId = null,
+        ?string $reason = null,
+        ?int $severity = null,
+    ): self {
+        return new self(
+            $name,
+            $data,
+            $tenantId,
+            $identityId,
+            $ipAddress,
+            $deviceFingerprint,
+            $userAgent,
+            $requestPath,
+            $requestMethod,
+            $userId,
+            $reason,
+            $severity,
+        );
+    }
+
+    /**
+     * Create an authentication success event
+     */
+    public static function authSuccess(
+        string $ipAddress,
+        ?string $deviceFingerprint = null,
+        ?string $userId = null,
+        ?string $tenantId = null,
+    ): self {
+        return self::create(
+            self::AUTH_SUCCESS,
+            $ipAddress,
+            $deviceFingerprint,
+            ['userId' => $userId],
+            tenantId: $tenantId,
+            userId: $userId,
+        );
+    }
+
+    /**
+     * Create a brute force detection event
+     */
+    public static function bruteForceDetected(
+        string $ipAddress,
+        int $failureCount,
+        int $windowSeconds,
+        ?string $tenantId = null,
+    ): self {
+        return self::create(
+            self::BRUTE_FORCE_DETECTED,
+            $ipAddress,
+            data: ['failureCount' => $failureCount, 'windowSeconds' => $windowSeconds],
+            tenantId: $tenantId,
+            reason: sprintf('%d failed attempts in %d seconds', $failureCount, $windowSeconds),
+        );
+    }
+
+    /**
+     * Create a rate limit exceeded event
+     */
+    public static function rateLimitExceeded(
+        string $ipAddress,
+        int $requestCount,
+        int $windowSeconds,
+        ?string $endpoint = null,
+        ?string $tenantId = null,
+    ): self {
+        return self::create(
+            self::RATE_LIMIT_EXCEEDED,
+            $ipAddress,
+            data: [
+                'requestCount' => $requestCount,
+                'windowSeconds' => $windowSeconds,
+                'endpoint' => $endpoint,
+            ],
+            tenantId: $tenantId,
+            requestPath: $endpoint,
+            reason: sprintf('%d requests in %d seconds', $requestCount, $windowSeconds),
+        );
+    }
+
+    /**
+     * Create an access denied event
+     */
+    public static function accessDenied(
+        string $ipAddress,
+        ?string $deviceFingerprint = null,
+        ?string $ruleId = null,
+        ?string $ruleScope = null,
+        ?string $reason = null,
+        ?string $tenantId = null,
+        ?string $identityId = null,
+    ): self {
+        return self::create(
+            self::ACCESS_DENIED,
+            $ipAddress,
+            $deviceFingerprint,
+            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
+            $tenantId,
+            $identityId,
+            reason: $reason,
+        );
+    }
+
+    /**
+     * Get default severity for event types
+     */
+    private static function getSeverityForEvent(string $eventName): int
+    {
+        return match ($eventName) {
+            self::AUTH_SUCCESS,
+            self::ACCESS_GRANTED,
+            self::TOKEN_REFRESH => self::SEVERITY_INFO,
+            
+            self::ACCESS_DENIED,
+            self::AUTH_LOGOUT,
+            self::TOKEN_REVOKED => self::SEVERITY_WARNING,
+            
+            self::RATE_LIMIT_EXCEEDED,
+            self::SUSPICIOUS_ACTIVITY => self::SEVERITY_ERROR,
+            
+            self::BRUTE_FORCE_DETECTED,
+            self::IP_BLOCKED,
+            self::DEVICE_BLOCKED => self::SEVERITY_CRITICAL,
+            
+            default => self::SEVERITY_INFO,
+        };
+    }
+
+    // Getters and setters
+
+    public function getIpAddress(): ?string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return $this->userAgent;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return $this->requestPath;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return $this->requestMethod;
+    }
+
+    public function getUserId(): ?string
+    {
+        return $this->userId;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): int
+    {
+        return $this->severity;
+    }
+
+}

core/lib/Security/Event/SecurityEventInterface.php

@@ -6,21 +6,31 @@ namespace KTXC\Security\Event;
 
 interface SecurityEventInterface
 {
-    public function label(): string;
+    public function getName(): string;
 
     public function get(string $key, mixed $default = null): mixed;
 
-    public function context(): array;
+    public function getData(): array;
 
-    public function identifier(): string;
+    public function getEventId(): string;
 
-    public function tenantIdentifier(): ?string;
+    public function getTenantId(): ?string;
 
-    public function actorIdentity(): ?string;
+    public function getIdentityId(): ?string;
+
+    public function getIpAddress(): ?string;
+
+    public function getDeviceFingerprint(): ?string;
+
+    public function getUserAgent(): ?string;
+
+    public function getRequestPath(): ?string;
+
+    public function getRequestMethod(): ?string;
 
     public function getUserId(): ?string;
 
     public function getReason(): ?string;
 
-    public function getSeverity(): SecurityEventSeverity;
+    public function getSeverity(): int;
 }

core/lib/Security/Event/SecurityEventSeverity.php

@@ -1,14 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-enum SecurityEventSeverity: int
-{
-    case DEBUG = 0;
-    case INFO = 1;
-    case WARNING = 2;
-    case ERROR = 3;
-    case CRITICAL = 4;
-}

core/lib/Security/Event/SecurityRequestEventInterface.php

@@ -1,18 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-interface SecurityRequestEventInterface extends SecurityEventInterface
-{
-    public function getIpAddress(): ?string;
-
-    public function getDeviceFingerprint(): ?string;
-
-    public function getUserAgent(): ?string;
-
-    public function getRequestPath(): ?string;
-
-    public function getRequestMethod(): ?string;
-}

core/lib/Security/Event/SuspiciousActivityEvent.php

@@ -1,100 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\Security\Event;
-
-use KTXF\Event\Event;
-
-final class SuspiciousActivityEvent extends Event implements SecurityRequestEventInterface
-{
-    public function __construct(
-        private readonly string $ipAddress,
-        private readonly string $detector,
-        private readonly array $detectionData = [],
-        ?string $tenantId = null,
-        ?string $identityId = null,
-        private readonly ?string $deviceFingerprint = null,
-        private readonly ?string $userAgent = null,
-        private readonly ?string $requestPath = null,
-        private readonly ?string $requestMethod = null,
-        private readonly ?string $userId = null,
-        private readonly ?string $reason = null,
-    ) {
-        if ($ipAddress === '') {
-            throw new \InvalidArgumentException('Suspicious activity requires an IP address.');
-        }
-        if ($detector === '') {
-            throw new \InvalidArgumentException('Suspicious activity requires a detector.');
-        }
-        if (array_key_exists('detector', $detectionData)) {
-            throw new \InvalidArgumentException('Detection data cannot replace the detector.');
-        }
-        if (array_key_exists('detector', $detectionData)) {
-            throw new \InvalidArgumentException('Detection data cannot replace the detector.');
-        }
-        if ($requestPath === '') {
-            throw new \InvalidArgumentException('A supplied request path cannot be empty.');
-        }
-        if ($requestMethod === '') {
-            throw new \InvalidArgumentException('A supplied request method cannot be empty.');
-        }
-
-        parent::__construct(
-            self::class,
-            ['detector' => $detector] + $detectionData,
-            $tenantId,
-            $identityId,
-        );
-    }
-
-    public function getIpAddress(): string
-    {
-        return $this->ipAddress;
-    }
-
-    public function getDetector(): string
-    {
-        return $this->detector;
-    }
-
-    public function getDetectionData(): array
-    {
-        return $this->detectionData;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return $this->userAgent;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return $this->requestPath;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return $this->requestMethod;
-    }
-
-    public function getUserId(): ?string
-    {
-        return $this->userId;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function getSeverity(): SecurityEventSeverity
-    {
-        return SecurityEventSeverity::ERROR;
-    }
-}

core/lib/Service/FirewallRuleManager.php

@@ -5,17 +5,9 @@ declare(strict_types=1);
 namespace KTXC\Service;
 
 use KTXC\Models\Firewall\FirewallRuleObject;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\DeviceBlockedEvent;
-use KTXC\Security\Event\IpAllowedEvent;
-use KTXC\Security\Event\IpBlockedEvent;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\IpUtils;
 
 final class FirewallRuleManager
@@ -194,7 +186,7 @@ final class FirewallRuleManager
             $origin,
             $metadata
         );
-        $this->events->dispatch(new IpBlockedEvent($ipAddress, $reason, $scope->tenantId));
+        $this->publishIpEvent(SecurityEvent::IP_BLOCKED, $scope, $ipAddress, $reason);
 
         return $rule;
     }
@@ -217,7 +209,7 @@ final class FirewallRuleManager
             null,
             $origin
         );
-        $this->events->dispatch(new IpAllowedEvent($ipAddress, $reason, $scope->tenantId));
+        $this->publishIpEvent(SecurityEvent::IP_ALLOWED, $scope, $ipAddress, $reason);
 
         return $rule;
     }
@@ -262,7 +254,13 @@ final class FirewallRuleManager
             $origin
         );
 
-        $event = new DeviceBlockedEvent($fingerprint, $reason, $scope->tenantId);
+        $event = new SecurityEvent(
+            SecurityEvent::DEVICE_BLOCKED,
+            ['device' => $fingerprint, 'reason' => $reason],
+            tenantId: $scope->tenantId,
+            deviceFingerprint: $fingerprint,
+            reason: $reason,
+        );
         $this->events->dispatch($event);
 
         return $rule;
@@ -284,7 +282,7 @@ final class FirewallRuleManager
             $this->store->depositRule($rule);
             $this->cache->invalidate();
             $this->publishLifecycleEvent(
-                FirewallRuleDisabledEvent::class,
+                SecurityEvent::FIREWALL_RULE_DISABLED,
                 $rule,
                 $actorId,
                 ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
@@ -323,7 +321,7 @@ final class FirewallRuleManager
             $this->store->depositRule($rule);
             $this->cache->invalidate();
             $this->publishLifecycleEvent(
-                FirewallRuleEnabledEvent::class,
+                SecurityEvent::FIREWALL_RULE_ENABLED,
                 $rule,
                 $actorId,
                 ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
@@ -367,7 +365,7 @@ final class FirewallRuleManager
         $this->store->depositRule($rule);
         $this->cache->invalidate();
         $this->publishLifecycleEvent(
-            FirewallRuleExtendedEvent::class,
+            SecurityEvent::FIREWALL_RULE_EXTENDED,
             $rule,
             $actorId,
             [
@@ -394,7 +392,7 @@ final class FirewallRuleManager
         $this->store->destroyRule($rule);
         $this->cache->invalidate();
         $this->publishLifecycleEvent(
-            FirewallRuleRemovedEvent::class,
+            SecurityEvent::FIREWALL_RULE_REMOVED,
             $rule,
             $actorId,
             ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
@@ -449,10 +447,9 @@ final class FirewallRuleManager
         }
         $rule->setMetadata($metadata);
 
-        $rule = $this->store->depositRule($rule)
-            ?? throw new \RuntimeException('Failed to persist firewall rule.');
+        $this->store->depositRule($rule);
         $this->cache->invalidate();
-        $this->publishLifecycleEvent(FirewallRuleCreatedEvent::class, $rule);
+        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_CREATED, $rule);
 
         return $rule;
     }
@@ -489,7 +486,7 @@ final class FirewallRuleManager
 
         $this->store->depositRule($rule);
         $this->cache->invalidate();
-        $this->publishLifecycleEvent(FirewallRuleExtendedEvent::class, $rule);
+        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_EXTENDED, $rule);
 
         return $rule;
     }
@@ -501,17 +498,46 @@ final class FirewallRuleManager
         return $rule && $scope->owns($rule) ? $rule : null;
     }
 
-    /**
-     * @param class-string<FirewallRuleEvent> $eventClass
-     */
+    private function publishIpEvent(
+        string $name,
+        FirewallRuleScope $scope,
+        string $ipAddress,
+        ?string $reason
+    ): void {
+        $event = new SecurityEvent(
+            $name,
+            ['ip' => $ipAddress, 'reason' => $reason],
+            tenantId: $scope->tenantId,
+            ipAddress: $ipAddress,
+            reason: $reason,
+        );
+        $this->events->dispatch($event);
+    }
+
     private function publishLifecycleEvent(
-        string $eventClass,
+        string $name,
         FirewallRuleObject $rule,
         ?string $actorId = null,
         array $change = []
     ): void
     {
-        $event = $eventClass::fromRule($rule, $actorId, $change);
+        $event = new SecurityEvent(
+            $name,
+            [
+                'ruleId' => $rule->getId(),
+                'ruleScope' => $rule->getScope(),
+                'ruleType' => $rule->getType(),
+                'ruleAction' => $rule->getAction(),
+                'ruleValue' => $rule->getValue(),
+                'reason' => $rule->getReason(),
+                'origin' => $rule->getMetadata()['origin'] ?? self::ORIGIN_MANUAL,
+                'expiresAt' => $rule->getExpiresAt()?->format(\DateTimeInterface::ATOM),
+                ...($rule->getMetadata() ?? []),
+                ...$change,
+            ],
+            tenantId: $rule->getTenantId(),
+            identityId: $actorId ?? $rule->getCreatedBy(),
+        );
         $this->events->dispatch($event);
     }
 }

core/lib/Service/FirewallService.php

@@ -5,25 +5,13 @@ declare(strict_types=1);
 namespace KTXC\Service;
 
 use KTXC\Http\Request\Request;
-use KTXC\Http\Request\RequestContext;
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Stores\FirewallStore;
 use KTXC\Context\TenantContextInterface;
-use KTXC\Security\Event\AccessDeniedEvent;
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
-use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SuspiciousActivityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXC\Security\Event\SecurityEventInterface;
-use KTXC\Security\Event\SecurityRequestEventInterface;
 use KTXF\Event\EventDispatcherInterface;
 use KTXF\IpUtils;
 
@@ -59,7 +47,6 @@ class FirewallService
         private readonly EventDispatcherInterface $events,
         private readonly FirewallRuleManager $rules,
         private readonly FirewallRuleCache $ruleCache,
-        private readonly RequestContext $requestContext,
     ) {
     }
 
@@ -147,15 +134,14 @@ class FirewallService
      */
     public function handleAuthFailure(AuthenticationFailedEvent $event): void
     {
-        $request = $this->requestContext->current();
-        $ipAddress = $request?->getClientIp();
-        $tenantId = $event->tenantIdentifier() ?? $this->tenantContext->identifier();
+        $ipAddress = $event->getIpAddress();
+        $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
 
         if (!$ipAddress || !$tenantId) {
             return;
         }
 
-        $log = $this->securityLog($event, $request);
+        $log = $this->securityLog($event);
         if ($log === null || !$this->store->createLogOnce($log)) {
             return;
         }
@@ -210,7 +196,7 @@ class FirewallService
         int $blockDuration
     ): void {
         // Publish brute force event
-        $event = new BruteForceDetectedEvent(
+        $event = SecurityEvent::bruteForceDetected(
             $ipAddress,
             $failureCount,
             $windowSeconds,
@@ -249,45 +235,29 @@ class FirewallService
         }
     }
 
-    public function logAuthenticationSuccess(AuthenticationSucceededEvent $event): void
+    private function securityLog(SecurityEventInterface $event): ?FirewallLogObject
     {
-        $log = $this->securityLog($event, $this->requestContext->current());
-        if ($log !== null) {
-            $this->store->createLog($log);
-        }
-    }
-
-    private function securityLog(
-        SecurityEventInterface $event,
-        ?Request $request = null,
-    ): ?FirewallLogObject
-    {
-        $tenantId = $event->tenantIdentifier() ?? $this->tenantContext->identifier();
+        $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
         $ruleScope = $event->get('ruleScope');
         if (!$tenantId && $ruleScope !== FirewallRuleObject::SCOPE_SYSTEM) {
             return null;
         }
 
-        $requestEvent = $event instanceof SecurityRequestEventInterface ? $event : null;
-
         $log = new FirewallLogObject();
-        return $log->setEventId($event->identifier())
+        return $log->setEventId($event->getEventId())
             ->setTenantId($tenantId)
-            ->setIpAddress($request?->getClientIp() ?? $requestEvent?->getIpAddress())
-            ->setDeviceFingerprint(
-                $request?->headers->get('X-Device-Fingerprint')
-                    ?? $requestEvent?->getDeviceFingerprint()
-            )
-            ->setUserAgent($request?->headers->get('User-Agent') ?? $requestEvent?->getUserAgent())
-            ->setRequestPath($request?->getPathInfo() ?? $requestEvent?->getRequestPath())
-            ->setRequestMethod($request?->getMethod() ?? $requestEvent?->getRequestMethod())
-            ->setEventType($this->mapEventToLogType($event->label()))
+            ->setIpAddress($event->getIpAddress())
+            ->setDeviceFingerprint($event->getDeviceFingerprint())
+            ->setUserAgent($event->getUserAgent())
+            ->setRequestPath($event->getRequestPath())
+            ->setRequestMethod($event->getRequestMethod())
+            ->setEventType($this->mapEventToLogType($event->getName()))
             ->setResult($this->mapEventToResult($event))
             ->setRuleId($event->get('ruleId'))
             ->setRuleScope($ruleScope)
-            ->setIdentityId($event->getUserId() ?? $event->actorIdentity())
+            ->setIdentityId($event->getUserId() ?? $event->getIdentityId())
             ->setTimestamp(new \DateTimeImmutable())
-            ->setMetadata($event->context());
+            ->setMetadata($event->getData());
     }
 
     /**
@@ -297,17 +267,17 @@ class FirewallService
     {
         return match ($eventName) {
             AuthenticationFailedEvent::class => FirewallLogObject::EVENT_AUTH_FAILURE,
-            AuthenticationSucceededEvent::class => FirewallLogObject::EVENT_ACCESS_CHECK,
-            BruteForceDetectedEvent::class => FirewallLogObject::EVENT_BRUTE_FORCE,
-            RateLimitExceededEvent::class => FirewallLogObject::EVENT_RATE_LIMIT,
-            AccessDeniedEvent::class => FirewallLogObject::EVENT_RULE_MATCH,
-            SuspiciousActivityEvent::class => FirewallLogObject::EVENT_SUSPICIOUS,
-            FirewallRuleCreatedEvent::class => FirewallLogObject::EVENT_RULE_CREATED,
-            FirewallRuleExtendedEvent::class => FirewallLogObject::EVENT_RULE_EXTENDED,
-            FirewallRuleEnabledEvent::class => FirewallLogObject::EVENT_RULE_ENABLED,
-            FirewallRuleDisabledEvent::class => FirewallLogObject::EVENT_RULE_DISABLED,
-            FirewallRuleRemovedEvent::class => FirewallLogObject::EVENT_RULE_REMOVED,
-            FirewallSettingsUpdatedEvent::class => FirewallLogObject::EVENT_SETTINGS_UPDATED,
+            SecurityEvent::AUTH_SUCCESS => FirewallLogObject::EVENT_ACCESS_CHECK,
+            SecurityEvent::BRUTE_FORCE_DETECTED => FirewallLogObject::EVENT_BRUTE_FORCE,
+            SecurityEvent::RATE_LIMIT_EXCEEDED => FirewallLogObject::EVENT_RATE_LIMIT,
+            SecurityEvent::ACCESS_DENIED => FirewallLogObject::EVENT_RULE_MATCH,
+            SecurityEvent::SUSPICIOUS_ACTIVITY => FirewallLogObject::EVENT_SUSPICIOUS,
+            SecurityEvent::FIREWALL_RULE_CREATED => FirewallLogObject::EVENT_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_EXTENDED => FirewallLogObject::EVENT_RULE_EXTENDED,
+            SecurityEvent::FIREWALL_RULE_ENABLED => FirewallLogObject::EVENT_RULE_ENABLED,
+            SecurityEvent::FIREWALL_RULE_DISABLED => FirewallLogObject::EVENT_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED => FirewallLogObject::EVENT_RULE_REMOVED,
+            SecurityEvent::FIREWALL_SETTINGS_UPDATED => FirewallLogObject::EVENT_SETTINGS_UPDATED,
             default => FirewallLogObject::EVENT_ACCESS_CHECK,
         };
     }
@@ -317,14 +287,15 @@ class FirewallService
      */
     private function mapEventToResult(SecurityEventInterface $event): string
     {
-        return match ($event->label()) {
-            AuthenticationSucceededEvent::class => FirewallLogObject::RESULT_ALLOWED,
-            FirewallRuleCreatedEvent::class,
-            FirewallRuleExtendedEvent::class,
-            FirewallRuleEnabledEvent::class,
-            FirewallRuleDisabledEvent::class,
-            FirewallRuleRemovedEvent::class,
-            FirewallSettingsUpdatedEvent::class => FirewallLogObject::RESULT_RECORDED,
+        return match ($event->getName()) {
+            SecurityEvent::AUTH_SUCCESS,
+            SecurityEvent::ACCESS_GRANTED => FirewallLogObject::RESULT_ALLOWED,
+            SecurityEvent::FIREWALL_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_EXTENDED,
+            SecurityEvent::FIREWALL_RULE_ENABLED,
+            SecurityEvent::FIREWALL_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED,
+            SecurityEvent::FIREWALL_SETTINGS_UPDATED => FirewallLogObject::RESULT_RECORDED,
             default => FirewallLogObject::RESULT_BLOCKED,
         };
     }
@@ -337,13 +308,13 @@ class FirewallService
         ?string $deviceFingerprint,
         FirewallRuleObject $rule
     ): void {
-        $event = new AccessDeniedEvent(
-            ipAddress: $ipAddress,
-            ruleId: $rule->getId(),
-            ruleScope: $rule->getScope(),
-            deviceFingerprint: $deviceFingerprint,
-            reason: $rule->getReason(),
-            tenantId: $this->tenantContext->identifier(),
+        $event = SecurityEvent::accessDenied(
+            $ipAddress,
+            $deviceFingerprint,
+            $rule->getId(),
+            $rule->getScope(),
+            $rule->getReason(),
+            $this->tenantContext->identifier(),
         );
         $this->events->dispatch($event);
     }

core/lib/Service/FirewallSettingsService.php

@@ -6,7 +6,7 @@ namespace KTXC\Service;
 
 use KTXC\Models\Tenant\TenantConfiguration;
 use KTXF\Event\EventDispatcherInterface;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\SecurityEvent;
 
 final class FirewallSettingsService
 {
@@ -52,13 +52,16 @@ final class FirewallSettingsService
         $tenant->setConfiguration($configuration);
         $this->tenants->deposit($tenant);
 
-        $event = new FirewallSettingsUpdatedEvent(
-            changeReason: $reason,
-            previous: $previous,
-            current: $current,
+        $event = new SecurityEvent(
+            SecurityEvent::FIREWALL_SETTINGS_UPDATED,
+            [
+                'changeReason' => $reason,
+                'changeOrigin' => FirewallRuleManager::ORIGIN_MANUAL,
+                'previous' => $previous,
+                'current' => $current,
+            ],
             tenantId: $tenantId,
-            actorId: $actorId,
-            changeOrigin: FirewallRuleManager::ORIGIN_MANUAL,
+            identityId: $actorId,
         );
         $this->events->dispatch($event);
 

core/lib/Service/UserAccountsService.php

@@ -6,10 +6,6 @@ use KTXC\Models\Identity\User;
 use KTXC\Context\IdentityContextInterface;
 use KTXC\Context\TenantContextInterface;
 use KTXC\Stores\UserAccountsStore;
-use KTXC\User\Event\UserCreatedEvent;
-use KTXC\User\Event\UserDeletingEvent;
-use KTXC\User\Event\UserUpdatedEvent;
-use KTXF\Event\EventDispatcherInterface;
 
 class UserAccountsService
 {
@@ -17,8 +13,7 @@ class UserAccountsService
     public function __construct(
         private readonly TenantContextInterface $tenantContext,
 		private readonly IdentityContextInterface $identityContext,
-        private readonly UserAccountsStore $userStore,
-        private readonly EventDispatcherInterface $events,
+        private readonly UserAccountsStore $userStore
     ) {
     }
 
@@ -70,53 +65,17 @@ class UserAccountsService
 
     public function createUser(array $userData): array
     {
-        $tenantId = $this->tenantContext->requireIdentifier();
-        $user = $this->userStore->createUser($tenantId, $userData);
-        $this->events->dispatch(UserCreatedEvent::fromUser(
-            $user,
-            $tenantId,
-            $this->identityContext->identifier(),
-        ));
-
-        return $user;
+        return $this->userStore->createUser($this->tenantContext->identifier(), $userData);
     }
 
-    public function updateUser(string $userId, array $updates): bool
+    public function updateUser(string $uid, array $updates): bool
     {
-        $tenantId = $this->tenantContext->requireIdentifier();
-        if (!$this->userStore->updateUser($tenantId, $userId, $updates)) {
-            return false;
+        return $this->userStore->updateUser($this->tenantContext->identifier(), $uid, $updates);
     }
 
-        $user = $this->userStore->fetchByIdentifier($tenantId, $userId);
-        if ($user === null) {
-            throw new \RuntimeException("Updated user '{$userId}' could not be retrieved.");
-        }
-
-        $this->events->dispatch(UserUpdatedEvent::fromUser(
-            $user,
-            $tenantId,
-            $this->identityContext->identifier(),
-        ));
-
-        return true;
-    }
-
-    public function deleteUser(string $userId): bool
+    public function deleteUser(string $uid): bool
     {
-        $tenantId = $this->tenantContext->requireIdentifier();
-        $user = $this->userStore->fetchByIdentifier($tenantId, $userId);
-        if ($user === null) {
-            return false;
-        }
-
-        $this->events->dispatch(UserDeletingEvent::fromUser(
-            $user,
-            $tenantId,
-            $this->identityContext->identifier(),
-        ));
-
-        return $this->userStore->deleteUser($tenantId, $userId);
+        return $this->userStore->deleteUser($this->tenantContext->identifier(), $uid);
     }
 
     // =========================================================================
@@ -167,6 +126,10 @@ class UserAccountsService
         return $this->userStore->storeSettings($this->tenantContext->identifier(), $this->identityContext->identifier(), $settings);
     }
 
+    // =========================================================================
+    // Helper Methods
+    // =========================================================================
+
     /**
      * Check if a profile field is editable by the user
      * 

core/lib/User/Event/UserCreatedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\User\Event;
-
-final class UserCreatedEvent extends UserEvent
-{
-}

core/lib/User/Event/UserDeletingEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\User\Event;
-
-final class UserDeletingEvent extends UserEvent
-{
-}

core/lib/User/Event/UserEvent.php

@@ -1,94 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\User\Event;
-
-use KTXF\Event\Event;
-
-abstract class UserEvent extends Event
-{
-    final public function __construct(
-        private readonly string $userIdentifier,
-        private readonly string $userIdentity,
-        private readonly string $userLabel,
-        private readonly bool $userEnabled,
-        private readonly array $userRoles,
-        private readonly string $tenantIdentifier,
-        private readonly ?string $actorIdentifier = null,
-    ) {
-        if ($userIdentifier === '') {
-            throw new \InvalidArgumentException('User lifecycle events require a user ID.');
-        }
-        if ($userIdentity === '') {
-            throw new \InvalidArgumentException('User lifecycle events require a user identity.');
-        }
-        if ($tenantIdentifier === '') {
-            throw new \InvalidArgumentException('User lifecycle events require a tenant ID.');
-        }
-        parent::__construct(
-            static::class,
-            [
-                'identifier' => $userIdentifier,
-                'identity' => $userIdentity,
-                'label' => $userLabel,
-                'roles' => $userRoles,
-                'enabled' => $userEnabled,
-            ],
-            $tenantIdentifier,
-            $actorIdentifier,
-        );
-    }
-
-    public static function fromUser(
-        array $user,
-        string $tenantIdentifier,
-        ?string $actorIdentifier = null,
-    ): static {
-        return new static(
-            (string) ($user['uid'] ?? ''),
-            (string) ($user['identity'] ?? ''),
-            (string) ($user['label'] ?? $user['identity'] ?? ''),
-            (bool) ($user['enabled'] ?? true),
-            array_values((array) ($user['roles'] ?? [])),
-            $tenantIdentifier,
-            $actorIdentifier,
-        );
-    }
-
-    public function userIdentifier(): string
-    {
-        return $this->userIdentifier;
-    }
-
-    public function tenantIdentifier(): string
-    {
-        return $this->tenantIdentifier;
-    }
-
-    public function userIdentity(): string
-    {
-        return $this->userIdentity;
-    }
-
-    public function userLabel(): string
-    {
-        return $this->userLabel;
-    }
-
-    public function userRoles(): array
-    {
-        return $this->userRoles;
-    }
-
-    public function userEnabled(): bool
-    {
-        return $this->userEnabled;
-    }
-
-    public function actorIdentifier(): ?string
-    {
-        return $this->actorIdentifier;
-    }
-
-}

core/lib/User/Event/UserUpdatedEvent.php

@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXC\User\Event;
-
-final class UserUpdatedEvent extends UserEvent
-{
-}

core/src/views/authentication/AuthLogin.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, onMounted, computed, watch, nextTick } from 'vue';
+import { ref, onMounted, computed, watch } from 'vue';
 import { useRoute } from 'vue-router';
 import { useUserStore } from '@KTXC/stores/userStore';
 import { authenticationService } from '@KTXC/services/authenticationService';
@@ -15,7 +15,6 @@ type LoginPhase = 'identity' | 'method' | 'mfa';
 // Form state
 const identity = ref('');
 const authResponse = ref(''); // password, code, etc.
-const authInput = ref<{ focus: () => void } | null>(null);
 const showPassword = ref(false);
 const rememberMe = ref(false);
 
@@ -61,19 +60,21 @@ const pageTitle = computed(() => {
 });
 
 // Input label/type based on selected method
-const isPasswordMethod = computed(() => selectedMethod.value?.id === 'password');
-
 const authInputLabel = computed(() => {
-  return isPasswordMethod.value ? 'Password' : 'Verification Code';
+  if (!selectedMethod.value) return 'Password';
+  return selectedMethod.value.method === 'credential' ? 'Password' : 'Verification Code';
 });
 
 const authInputType = computed(() => {
-  return isPasswordMethod.value ? 'password' : 'text';
+  if (!selectedMethod.value) return 'password';
+  return selectedMethod.value.method === 'credential' ? 'password' : 'text';
 });
 
 // Validation rules
 const identityRules = [
-  (v: string) => !!v.trim() || 'Login ID is required',
+  (v: string) => !!v.trim() || 'Email is required',
+  (v: string) => !/\s/.test(v.trim()) || 'Email must not contain spaces',
+  (v: string) => /.+@.+\..+/.test(v.trim()) || 'Email must be valid'
 ];
 
 const authResponseRules = [
@@ -116,9 +117,6 @@ onMounted(async () => {
 
 // Watch for method selection changes (for challenge-based methods)
 watch(selectedMethod, async (newMethod) => {
-  await nextTick();
-  authInput.value?.focus();
-
   if (newMethod && newMethod.method === 'challenge' && !challengeSent.value) {
     // Initiate challenge for methods that need it (SMS, email, TOTP)
     await initiateChallenge(newMethod.id);
@@ -315,16 +313,7 @@ function backToIdentity() {
 }
 
 function getMethodIcon(method: AuthenticationMethod): string {
-  if (method.icon?.startsWith('mdi-') || method.icon?.startsWith('$')) {
-    return method.icon;
-  }
-
-  // Authentication providers may return a bare Material Design icon name
-  // (for example, "lock" or "mail") instead of Vuetify's "mdi-*" form.
-  if (method.icon && /^[a-z0-9-]+$/i.test(method.icon)) {
-    return `mdi-${method.icon}`;
-  }
-
+  if (method.icon) return method.icon;
   switch (method.method) {
     case 'credential': return 'mdi-key';
     case 'challenge': return 'mdi-shield-check';
@@ -362,15 +351,16 @@ function getMethodIcon(method: AuthenticationMethod): string {
         v-slot="{ errors, isSubmitting }"
       >
         <div class="mb-6">
+          <v-label>Email Address</v-label>
           <v-text-field
             v-model="identity"
             :rules="identityRules"
-            aria-label="Login ID"
+            class="mt-2"
             required
             hide-details="auto"
             variant="outlined"
             color="primary"
-            autocomplete="username"
+            autocomplete="email"
             autofocus
           ></v-text-field>
         </div>
@@ -401,7 +391,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
             size="large"
             @click="initiateSsoLogin(method.id)"
           >
-            <v-icon start>{{ getMethodIcon(method) }}</v-icon>
+            <v-icon v-if="method.icon" start>{{ method.icon }}</v-icon>
             {{ method.label }}
           </v-btn>
         </div>
@@ -455,18 +445,18 @@ function getMethodIcon(method: AuthenticationMethod): string {
         v-slot="{ errors, isSubmitting }"
       >
         <div class="mb-6">
+          <v-label>{{ authInputLabel }}</v-label>
           <v-text-field
-            ref="authInput"
             v-model="authResponse"
             :rules="authResponseRules"
             :type="authInputType === 'password' && !showPassword ? 'password' : 'text'"
-            :aria-label="authInputLabel"
+            class="mt-2"
             required
             hide-details="auto"
             variant="outlined"
             color="primary"
-            :autocomplete="isPasswordMethod ? 'current-password' : 'off'"
-            :inputmode="isPasswordMethod ? undefined : 'numeric'"
+            :autocomplete="selectedMethod?.method === 'credential' ? 'current-password' : 'one-time-code'"
+            :inputmode="selectedMethod?.method !== 'credential' ? 'numeric' : undefined"
             autofocus
           >
             <template v-if="authInputType === 'password'" v-slot:append-inner>
@@ -480,7 +470,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
           </v-text-field>
         </div>
 
-        <div v-if="isPasswordMethod" class="d-flex align-center mt-4 mb-7 mb-sm-0">
+        <div v-if="selectedMethod?.method === 'credential'" class="d-flex align-center mt-4 mb-7 mb-sm-0">
           <v-checkbox
             v-model="rememberMe"
             label="Keep me logged in"
@@ -503,7 +493,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
           size="large" 
           type="submit"
         >
-          {{ isPasswordMethod ? 'Login' : 'Verify' }}
+          {{ selectedMethod?.method === 'credential' ? 'Login' : 'Verify' }}
         </v-btn>
 
         <v-btn 
@@ -544,7 +534,6 @@ function getMethodIcon(method: AuthenticationMethod): string {
         <div class="mb-6">
           <v-label>Verification Code</v-label>
           <v-text-field
-            ref="authInput"
             v-model="authResponse"
             :rules="authResponseRules"
             type="text"
@@ -553,7 +542,7 @@ function getMethodIcon(method: AuthenticationMethod): string {
             hide-details="auto"
             variant="outlined"
             color="primary"
-            autocomplete="off"
+            autocomplete="one-time-code"
             inputmode="numeric"
             autofocus
           ></v-text-field>

deploy/update-test-server.sh

@@ -33,30 +33,6 @@ require_command()
     fi
 }
 
-# Cron runs with a bare PATH, so nvm-installed npm (added to PATH only by
-# .bashrc sourcing nvm.sh in an interactive shell) is invisible here even
-# though it works fine when this script is run by hand. Resolve nvm's
-# current npm via bash (nvm.sh is not POSIX sh compatible) and prepend it,
-# so a later `nvm use`/`nvm install` doesn't require updating this script
-# or the crontab.
-ensure_npm_on_path()
-{
-    command -v npm >/dev/null 2>&1 && return 0
-
-    nvm_dir=${NVM_DIR:-${HOME:-/root}/.nvm}
-    [ -s "$nvm_dir/nvm.sh" ] || return 0
-    command -v bash >/dev/null 2>&1 || return 0
-
-    npm_path=$(bash -c ". \"\$1/nvm.sh\" >/dev/null 2>&1 && command -v npm" _ "$nvm_dir" 2>/dev/null) || return 0
-    [ -n "$npm_path" ] || return 0
-
-    PATH=$(dirname -- "$npm_path"):$PATH
-    export PATH
-    log "Resolved npm via nvm: $npm_path"
-}
-
-ensure_npm_on_path
-
 git_in()
 {
     repository=$1

package-lock.json

@@ -6642,9 +6642,9 @@
       }
     },
     "node_modules/vuetify": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-4.1.6.tgz",
-      "integrity": "sha512-VOsRTsNfs+FE4JXMONZkqX2yznSqC/FXG9/pgVVjsoqIjUvJg+CfFTuOlgyWVFrZYY+crk7LV9uaiN8bZREV/g==",
+      "version": "4.1.7",
+      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-4.1.7.tgz",
+      "integrity": "sha512-07qxu0S1oxPjmknP/Yn5276PtIhlCvHnpcp7HuOKEHni89/6BGiM2aVdKlEGeyM5RfytDkiv0SNieabGT2D8qQ==",
       "license": "MIT",
       "funding": {
         "type": "github",

shared/lib/Event/Event.php

@@ -10,74 +10,74 @@ namespace KTXF\Event;
 class Event
 {
     private bool $propagationStopped = false;
-    private readonly array $context;
+    private readonly array $data;
     private readonly float $timestamp;
-    private readonly string $identifier;
+    private readonly string $eventId;
 
     public function __construct(
-        private readonly string $label,
-        array $context = [],
-        private readonly ?string $tenantIdentifier = null,
-        private readonly ?string $actorIdentity = null,
+        private readonly string $name,
+        array $data = [],
+        private readonly ?string $tenantId = null,
+        private readonly ?string $identityId = null,
     ) {
-        self::validateContext($context);
+        self::validateData($data);
 
-        $this->context = $context;
+        $this->data = $data;
         $this->timestamp = microtime(true);
-        $this->identifier = bin2hex(random_bytes(16));
+        $this->eventId = bin2hex(random_bytes(16));
     }
 
     /**
-     * Get the event label
+     * Get the event name
      */
-    public function label(): string
+    public function getName(): string
     {
-        return $this->label;
+        return $this->name;
     }
 
     /**
-     * Get a context value by key
+     * Get a data value by key
      */
     public function get(string $key, mixed $default = null): mixed
     {
-        return $this->context[$key] ?? $default;
+        return $this->data[$key] ?? $default;
     }
 
     /**
-     * Check if a context key exists
+     * Check if a data key exists
      */
     public function has(string $key): bool
     {
-        return array_key_exists($key, $this->context);
+        return array_key_exists($key, $this->data);
     }
 
     /**
-     * Get the event context
+     * Get all data
      */
-    public function context(): array
+    public function getData(): array
     {
-        return $this->context;
+        return $this->data;
     }
 
     /**
-     * Get all event context
+     * Alias for getData() for backward compatibility
      */
     public function all(): array
     {
-        return $this->context;
+        return $this->data;
     }
 
     /**
      * Get the event timestamp
      */
-    public function timestamp(): float
+    public function getTimestamp(): float
     {
         return $this->timestamp;
     }
 
-    public function identifier(): string
+    public function getEventId(): string
     {
-        return $this->identifier;
+        return $this->eventId;
     }
 
     /**
@@ -99,29 +99,29 @@ class Event
     /**
      * Get tenant ID for multi-tenant context
      */
-    public function tenantIdentifier(): ?string
+    public function getTenantId(): ?string
     {
-        return $this->tenantIdentifier;
+        return $this->tenantId;
     }
 
     /**
-     * Get the identity of the actor who triggered the event
+     * Get identity ID (user who triggered the event)
      */
-    public function actorIdentity(): ?string
+    public function getIdentityId(): ?string
     {
-        return $this->actorIdentity;
+        return $this->identityId;
     }
 
-    private static function validateContext(array $context): void
+    private static function validateData(array $data): void
     {
-        foreach ($context as $value) {
+        foreach ($data as $value) {
             if (is_array($value)) {
-                self::validateContext($value);
+                self::validateData($value);
                 continue;
             }
             if ($value !== null && !is_scalar($value)) {
                 throw new \InvalidArgumentException(
-                    'Event context must contain only scalar, null, or array values.',
+                    'Event data must contain only scalar, null, or array values.',
                 );
             }
         }

tests/php/Unit/Console/Tenant/TenantCreateCommandTest.php

@@ -5,10 +5,8 @@ declare(strict_types=1);
 namespace KTXT\Unit\Console\Tenant;
 
 use KTXC\Console\Tenant\TenantCreateCommand;
-use KTXC\Context\TenantContext;
 use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\TenantService;
-use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -24,7 +22,6 @@ class TenantCreateCommandTest extends TestCase
     private TenantService&MockObject $tenantService;
     private UserRolesStore $rolesStore;
     private UserAccountsStore $userStore;
-    private UserAccountsService $userService;
     private CommandTester $tester;
     private ?TenantObject $deposited = null;
 
@@ -34,21 +31,12 @@ class TenantCreateCommandTest extends TestCase
         $this->rolesStore = $this->createStub(UserRolesStore::class);
         $this->rolesStore->method('createRole')->willReturn(['rid' => 'admin']);
         $this->userStore = $this->createStub(UserAccountsStore::class);
-        $this->userService = $this->createStub(UserAccountsService::class);
-        $this->userService->method('createUser')->willReturn(['uid' => 'admin']);
-        $contextTenantService = $this->createStub(TenantService::class);
-        $contextTenantService->method('fetchById')->willReturnCallback(
-            fn(string $identifier): ?TenantObject => $this->deposited?->getIdentifier() === $identifier
-                ? $this->deposited
-                : null,
-        );
+        $this->userStore->method('createUser')->willReturn(['uid' => 'admin']);
         $this->tester = new CommandTester(
             new TenantCreateCommand(
                 $this->tenantService,
                 $this->rolesStore,
                 $this->userStore,
-                $this->userService,
-                new TenantContext($contextTenantService),
                 new NullLogger(),
             )
         );

tests/php/Unit/Event/AccessDeniedEventTest.php

@@ -1,58 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Models\Firewall\FirewallRuleObject;
-use KTXC\Security\Event\AccessDeniedEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class AccessDeniedEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Access-denial state is typed and complete at construction')]
-    public function constructsTypedState(): void
-    {
-        $event = new AccessDeniedEvent(
-            '203.0.113.10',
-            'rule-a',
-            FirewallRuleObject::SCOPE_TENANT,
-            'device-a',
-            'Blocked by policy',
-            'tenant-a',
-            'identity-a',
-        );
-
-        self::assertSame(AccessDeniedEvent::class, $event->label());
-        self::assertSame('203.0.113.10', $event->getIpAddress());
-        self::assertSame('device-a', $event->getDeviceFingerprint());
-        self::assertSame('rule-a', $event->getRuleId());
-        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
-        self::assertSame('Blocked by policy', $event->getReason());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('identity-a', $event->actorIdentity());
-        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Access denial rejects incomplete rule context')]
-    public function rejectsIncompleteRuleContext(): void
-    {
-        foreach ([
-            ['', 'rule-a', FirewallRuleObject::SCOPE_TENANT],
-            ['203.0.113.10', '', FirewallRuleObject::SCOPE_TENANT],
-            ['203.0.113.10', 'rule-a', 'unknown'],
-        ] as $arguments) {
-            try {
-                new AccessDeniedEvent(...$arguments);
-                self::fail('Incomplete access-denial context was accepted.');
-            } catch (\InvalidArgumentException) {
-                $this->addToAssertionCount(1);
-            }
-        }
-    }
-}

tests/php/Unit/Event/AuthenticationFailedEventTest.php

@@ -5,8 +5,7 @@ declare(strict_types=1);
 namespace KTXT\Unit\Event;
 
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use KTXC\Security\Event\SecurityRequestEventInterface;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -18,18 +17,27 @@ final class AuthenticationFailedEventTest extends TestCase
     public function constructsTypedState(): void
     {
         $event = new AuthenticationFailedEvent(
+            '203.0.113.10',
+            'device-a',
             'user-a',
             'Invalid credentials',
             'tenant-a',
             'identity-a',
+            'Test Agent',
+            '/login',
+            'POST',
         );
 
-        self::assertSame(AuthenticationFailedEvent::class, $event->label());
+        self::assertSame(AuthenticationFailedEvent::class, $event->getName());
+        self::assertSame('203.0.113.10', $event->getIpAddress());
+        self::assertSame('device-a', $event->getDeviceFingerprint());
         self::assertSame('user-a', $event->getUserId());
         self::assertSame('Invalid credentials', $event->getReason());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('identity-a', $event->actorIdentity());
-        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
-        self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('Test Agent', $event->getUserAgent());
+        self::assertSame('/login', $event->getRequestPath());
+        self::assertSame('POST', $event->getRequestMethod());
+        self::assertSame(SecurityEvent::SEVERITY_WARNING, $event->getSeverity());
     }
 }

tests/php/Unit/Event/AuthenticationSucceededEventTest.php

@@ -1,41 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use KTXC\Security\Event\SecurityRequestEventInterface;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class AuthenticationSucceededEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Successful-authentication state is typed and complete at construction')]
-    public function constructsTypedState(): void
-    {
-        $event = new AuthenticationSucceededEvent(
-            'user-a',
-            'tenant-a',
-        );
-
-        self::assertSame(AuthenticationSucceededEvent::class, $event->label());
-        self::assertSame('user-a', $event->getUserId());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame(['userId' => 'user-a'], $event->context());
-        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
-        self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
-    }
-
-    #[Test]
-    #[TestDox('Successful authentication requires a user ID')]
-    public function rejectsIncompleteAuthenticationContext(): void
-    {
-        $this->expectException(\InvalidArgumentException::class);
-
-        new AuthenticationSucceededEvent('');
-    }
-}

tests/php/Unit/Event/BruteForceDetectedEventTest.php

@@ -1,56 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class BruteForceDetectedEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Brute-force detection state is typed and complete at construction')]
-    public function constructsTypedState(): void
-    {
-        $event = new BruteForceDetectedEvent(
-            '203.0.113.10',
-            5,
-            300,
-            'tenant-a',
-        );
-
-        self::assertSame(BruteForceDetectedEvent::class, $event->label());
-        self::assertSame('203.0.113.10', $event->getIpAddress());
-        self::assertSame(5, $event->getFailureCount());
-        self::assertSame(300, $event->getWindowSeconds());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('5 failed attempts in 300 seconds', $event->getReason());
-        self::assertSame(
-            ['failureCount' => 5, 'windowSeconds' => 300],
-            $event->context(),
-        );
-        self::assertSame(SecurityEventSeverity::CRITICAL, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Brute-force detection rejects invalid measurements')]
-    public function rejectsInvalidMeasurements(): void
-    {
-        foreach ([
-            ['', 5, 300],
-            ['203.0.113.10', 0, 300],
-            ['203.0.113.10', 5, 0],
-        ] as $arguments) {
-            try {
-                new BruteForceDetectedEvent(...$arguments);
-                self::fail('Invalid brute-force measurements were accepted.');
-            } catch (\InvalidArgumentException) {
-                $this->addToAssertionCount(1);
-            }
-        }
-    }
-}

tests/php/Unit/Event/EventDispatcherTest.php

@@ -167,43 +167,6 @@ final class EventDispatcherTest extends TestCase
         $dispatcher->dispatch(new Event('test.event'));
     }
 
-    #[Test]
-    #[TestDox('Propagated deferred failures close their execution scope')]
-    public function recoversFromDeferredFailure(): void
-    {
-        $registry = new EventListenerRegistry();
-        $registry->listen(
-            'test',
-            'test.event',
-            FailingListener::class,
-            'fail',
-            DeliveryMode::Deferred,
-            failurePolicy: FailurePolicy::Propagate,
-        );
-        $registry->freeze();
-
-        $dispatcher = new EventDispatcher(
-            $registry,
-            new RecordingContainer([FailingListener::class => new FailingListener()]),
-            new NullLogger(),
-        );
-        $dispatcher->beginExecution('failed');
-        $dispatcher->dispatch(new Event('test.event'));
-
-        try {
-            $dispatcher->processDeferred('failed');
-            self::fail('Expected deferred listener failure to propagate.');
-        } catch (\RuntimeException $error) {
-            self::assertSame('Listener failed.', $error->getMessage());
-        }
-
-        $dispatcher->beginExecution('next');
-        $result = $dispatcher->processDeferred('next');
-
-        self::assertSame(0, $result->processed);
-        self::assertSame(0, $result->remaining);
-    }
-
     #[Test]
     #[TestDox('Deferred processing stops at its configured count limit')]
     public function boundsDeferredWork(): void
@@ -230,57 +193,9 @@ final class EventDispatcherTest extends TestCase
         $result = $dispatcher->processDeferred('test');
 
         self::assertSame(1000, $result->processed);
-        self::assertSame(1000, $result->listenerInvocations);
         self::assertSame(1, $result->remaining);
         self::assertFalse($result->deadlineExceeded);
         self::assertTrue($result->limitExceeded);
-        self::assertTrue($result->eventLimitExceeded);
-        self::assertFalse($result->listenerInvocationLimitExceeded);
-    }
-
-    #[Test]
-    #[TestDox('Deferred event and listener invocation limits are tracked separately')]
-    public function boundsDeferredListenerInvocations(): void
-    {
-        $recursive = new RecursiveListener();
-        $recording = new RecordingListener();
-        $registry = new EventListenerRegistry();
-        $registry->listen(
-            'test',
-            'test.event',
-            RecursiveListener::class,
-            'deferred',
-            DeliveryMode::Deferred,
-        );
-        $registry->listen(
-            'test',
-            'test.event',
-            RecordingListener::class,
-            'deferred',
-            DeliveryMode::Deferred,
-        );
-        $registry->freeze();
-        $dispatcher = new EventDispatcher(
-            $registry,
-            new RecordingContainer([
-                RecursiveListener::class => $recursive,
-                RecordingListener::class => $recording,
-            ]),
-            new NullLogger(),
-            maxDeferredListenerInvocations: 3,
-        );
-        $recursive->dispatcher = $dispatcher;
-        $dispatcher->beginExecution('test');
-        $dispatcher->dispatch(new Event('test.event'));
-
-        $result = $dispatcher->processDeferred('test');
-
-        self::assertSame(1, $result->processed);
-        self::assertSame(2, $result->listenerInvocations);
-        self::assertSame(1, $result->remaining);
-        self::assertTrue($result->limitExceeded);
-        self::assertFalse($result->eventLimitExceeded);
-        self::assertTrue($result->listenerInvocationLimitExceeded);
     }
 }
 

tests/php/Unit/Event/EventTest.php

@@ -22,15 +22,12 @@ final class EventTest extends TestCase
             'identity-a',
         );
 
-        $copy = $event->context();
+        $copy = $event->getData();
         $copy['nested']['value'] = 'changed';
 
         self::assertSame('original', $event->get('nested')['value']);
-        self::assertSame('test.event', $event->label());
-        self::assertNotSame('', $event->identifier());
-        self::assertGreaterThan(0, $event->timestamp());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('identity-a', $event->actorIdentity());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
     }
 
     #[Test]

tests/php/Unit/Event/FirewallPolicyEventTest.php

@@ -1,79 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\DeviceBlockedEvent;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
-use KTXC\Security\Event\IpAllowedEvent;
-use KTXC\Security\Event\IpBlockedEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class FirewallPolicyEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('IP and device policy events expose typed immutable state')]
-    public function constructsSubjectPolicyEvents(): void
-    {
-        $blocked = new IpBlockedEvent('203.0.113.10', 'Repeated abuse', 'tenant-a');
-        $allowed = new IpAllowedEvent('203.0.113.11', 'Trusted service', 'tenant-a');
-        $device = new DeviceBlockedEvent('device-a', 'Compromised device', 'tenant-a');
-
-        self::assertSame(IpBlockedEvent::class, $blocked->label());
-        self::assertSame('203.0.113.10', $blocked->getIpAddress());
-        self::assertSame('Repeated abuse', $blocked->getReason());
-        self::assertSame(SecurityEventSeverity::CRITICAL, $blocked->getSeverity());
-        self::assertSame(IpAllowedEvent::class, $allowed->label());
-        self::assertSame('203.0.113.11', $allowed->getIpAddress());
-        self::assertSame(SecurityEventSeverity::INFO, $allowed->getSeverity());
-        self::assertSame(DeviceBlockedEvent::class, $device->label());
-        self::assertSame('device-a', $device->getDeviceFingerprint());
-        self::assertSame(SecurityEventSeverity::CRITICAL, $device->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Firewall settings events capture the complete configuration transition')]
-    public function constructsSettingsEvent(): void
-    {
-        $event = new FirewallSettingsUpdatedEvent(
-            'Tighten controls',
-            ['maxAuthFailures' => 5],
-            ['maxAuthFailures' => 3],
-            'tenant-a',
-            'operator-a',
-        );
-
-        self::assertSame(FirewallSettingsUpdatedEvent::class, $event->label());
-        self::assertSame('Tighten controls', $event->getChangeReason());
-        self::assertSame(['maxAuthFailures' => 5], $event->getPrevious());
-        self::assertSame(['maxAuthFailures' => 3], $event->getCurrent());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('operator-a', $event->actorIdentity());
-        self::assertSame('manual', $event->getChangeOrigin());
-        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Firewall policy events reject missing subject and ownership context')]
-    public function rejectsIncompletePolicyContext(): void
-    {
-        foreach ([
-            static fn() => new IpBlockedEvent(''),
-            static fn() => new IpAllowedEvent(''),
-            static fn() => new DeviceBlockedEvent(''),
-            static fn() => new FirewallSettingsUpdatedEvent('', [], [], 'tenant-a'),
-            static fn() => new FirewallSettingsUpdatedEvent('Reason', [], [], ''),
-        ] as $construction) {
-            try {
-                $construction();
-                self::fail('Incomplete firewall policy context was accepted.');
-            } catch (\InvalidArgumentException) {
-                $this->addToAssertionCount(1);
-            }
-        }
-    }
-}

tests/php/Unit/Event/FirewallRuleEventTest.php

@@ -1,81 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Models\Firewall\FirewallRuleObject;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class FirewallRuleEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Firewall rule events capture immutable rule snapshots')]
-    public function capturesRuleSnapshot(): void
-    {
-        $expiresAt = new \DateTimeImmutable('+5 minutes');
-        $rule = (new FirewallRuleObject())
-            ->setId('rule-a')
-            ->setScope(FirewallRuleObject::SCOPE_TENANT)
-            ->setTenantId('tenant-a')
-            ->setType(FirewallRuleObject::TYPE_IP)
-            ->setAction(FirewallRuleObject::ACTION_BLOCK)
-            ->setValue('203.0.113.10')
-            ->setReason('Repeated abuse')
-            ->setCreatedBy('creator-a')
-            ->setExpiresAt($expiresAt)
-            ->setMetadata(['origin' => 'automatic', 'failureCount' => 5]);
-
-        $event = FirewallRuleExtendedEvent::fromRule(
-            $rule,
-            'operator-a',
-            ['changeReason' => 'Continue monitoring'],
-        );
-        $rule->setReason('Mutated after publication');
-
-        self::assertSame(FirewallRuleExtendedEvent::class, $event->label());
-        self::assertSame('rule-a', $event->getRuleId());
-        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
-        self::assertSame(FirewallRuleObject::TYPE_IP, $event->getRuleType());
-        self::assertSame(FirewallRuleObject::ACTION_BLOCK, $event->getRuleAction());
-        self::assertSame('203.0.113.10', $event->getRuleValue());
-        self::assertSame('Repeated abuse', $event->getReason());
-        self::assertSame('automatic', $event->getOrigin());
-        self::assertSame($expiresAt->format(\DateTimeInterface::ATOM), $event->getExpiresAt());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('operator-a', $event->actorIdentity());
-        self::assertSame(5, $event->get('failureCount'));
-        self::assertSame('Continue monitoring', $event->get('changeReason'));
-        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Each firewall rule lifecycle operation has a dedicated event key')]
-    public function exposesDedicatedLifecycleKeys(): void
-    {
-        $rule = (new FirewallRuleObject())
-            ->setId('rule-a')
-            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
-            ->setType(FirewallRuleObject::TYPE_IP)
-            ->setAction(FirewallRuleObject::ACTION_BLOCK)
-            ->setValue('203.0.113.10');
-
-        foreach ([
-            FirewallRuleCreatedEvent::class,
-            FirewallRuleExtendedEvent::class,
-            FirewallRuleEnabledEvent::class,
-            FirewallRuleDisabledEvent::class,
-            FirewallRuleRemovedEvent::class,
-        ] as $eventClass) {
-            self::assertSame($eventClass, $eventClass::fromRule($rule)->label());
-        }
-    }
-}

tests/php/Unit/Event/RateLimitExceededEventTest.php

@@ -1,56 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class RateLimitExceededEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Rate-limit state is typed and complete at construction')]
-    public function constructsTypedState(): void
-    {
-        $event = new RateLimitExceededEvent(
-            '203.0.113.10',
-            101,
-            60,
-            '/login',
-            'tenant-a',
-        );
-
-        self::assertSame(RateLimitExceededEvent::class, $event->label());
-        self::assertSame('203.0.113.10', $event->getIpAddress());
-        self::assertSame(101, $event->getRequestCount());
-        self::assertSame(60, $event->getWindowSeconds());
-        self::assertSame('/login', $event->getEndpoint());
-        self::assertSame('/login', $event->getRequestPath());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('101 requests in 60 seconds', $event->getReason());
-        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Rate-limit detection rejects invalid measurements')]
-    public function rejectsInvalidMeasurements(): void
-    {
-        foreach ([
-            ['', 101, 60, '/login'],
-            ['203.0.113.10', 0, 60, '/login'],
-            ['203.0.113.10', 101, 0, '/login'],
-            ['203.0.113.10', 101, 60, ''],
-        ] as $arguments) {
-            try {
-                new RateLimitExceededEvent(...$arguments);
-                self::fail('Invalid rate-limit measurements were accepted.');
-            } catch (\InvalidArgumentException) {
-                $this->addToAssertionCount(1);
-            }
-        }
-    }
-}

tests/php/Unit/Event/SecurityEventSeverityTest.php

@@ -1,24 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\SecurityEventSeverity;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class SecurityEventSeverityTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Security severity levels expose stable numeric values')]
-    public function exposesStableNumericValues(): void
-    {
-        self::assertSame(0, SecurityEventSeverity::DEBUG->value);
-        self::assertSame(1, SecurityEventSeverity::INFO->value);
-        self::assertSame(2, SecurityEventSeverity::WARNING->value);
-        self::assertSame(3, SecurityEventSeverity::ERROR->value);
-        self::assertSame(4, SecurityEventSeverity::CRITICAL->value);
-    }
-}

tests/php/Unit/Event/SecurityEventTest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SecurityEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Direct construction applies the event type default severity')]
+    public function appliesDefaultSeverityDuringConstruction(): void
+    {
+        self::assertSame(
+            SecurityEvent::SEVERITY_WARNING,
+            (new SecurityEvent(SecurityEvent::AUTH_LOGOUT))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_ERROR,
+            (new SecurityEvent(SecurityEvent::RATE_LIMIT_EXCEEDED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_CRITICAL,
+            (new SecurityEvent(SecurityEvent::DEVICE_BLOCKED))->getSeverity(),
+        );
+        self::assertSame(
+            SecurityEvent::SEVERITY_INFO,
+            (new SecurityEvent(SecurityEvent::FIREWALL_RULE_CREATED))->getSeverity(),
+        );
+    }
+
+    #[Test]
+    #[TestDox('Construction can override the event type default severity')]
+    public function allowsSeverityOverride(): void
+    {
+        $event = new SecurityEvent(
+            SecurityEvent::AUTH_LOGOUT,
+            severity: SecurityEvent::SEVERITY_CRITICAL,
+        );
+
+        self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Event state exposes no mutation methods')]
+    public function exposesNoMutationMethods(): void
+    {
+        foreach ([
+            'set',
+            'setTenantId',
+            'setIdentityId',
+            'setIpAddress',
+            'setDeviceFingerprint',
+            'setUserAgent',
+            'setRequestPath',
+            'setRequestMethod',
+            'setUserId',
+            'setReason',
+            'setSeverity',
+        ] as $method) {
+            self::assertFalse(method_exists(SecurityEvent::class, $method));
+        }
+    }
+}

tests/php/Unit/Event/SuspiciousActivityEventTest.php

@@ -1,66 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\Security\Event\SecurityEventSeverity;
-use KTXC\Security\Event\SuspiciousActivityEvent;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class SuspiciousActivityEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Suspicious-activity state is typed and complete at construction')]
-    public function constructsTypedState(): void
-    {
-        $event = new SuspiciousActivityEvent(
-            ipAddress: '203.0.113.20',
-            detector: 'payload-signature',
-            detectionData: ['score' => 98],
-            tenantId: 'tenant-a',
-            identityId: 'identity-a',
-            deviceFingerprint: 'device-a',
-            userAgent: 'Test Agent',
-            requestPath: '/admin',
-            requestMethod: 'POST',
-            userId: 'user-a',
-            reason: 'Matched a blocked payload signature',
-        );
-
-        self::assertSame(SuspiciousActivityEvent::class, $event->label());
-        self::assertSame('203.0.113.20', $event->getIpAddress());
-        self::assertSame('payload-signature', $event->getDetector());
-        self::assertSame(['score' => 98], $event->getDetectionData());
-        self::assertSame(['detector' => 'payload-signature', 'score' => 98], $event->context());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('identity-a', $event->actorIdentity());
-        self::assertSame('device-a', $event->getDeviceFingerprint());
-        self::assertSame('Test Agent', $event->getUserAgent());
-        self::assertSame('/admin', $event->getRequestPath());
-        self::assertSame('POST', $event->getRequestMethod());
-        self::assertSame('user-a', $event->getUserId());
-        self::assertSame('Matched a blocked payload signature', $event->getReason());
-        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
-    }
-
-    #[Test]
-    #[TestDox('Suspicious activity rejects incomplete or conflicting detection context')]
-    public function rejectsInvalidDetectionContext(): void
-    {
-        foreach ([
-            ['', 'payload-signature', []],
-            ['203.0.113.20', '', []],
-            ['203.0.113.20', 'payload-signature', ['detector' => 'replacement']],
-        ] as $arguments) {
-            try {
-                new SuspiciousActivityEvent(...$arguments);
-                self::fail('Invalid suspicious-activity context was accepted.');
-            } catch (\InvalidArgumentException) {
-                $this->addToAssertionCount(1);
-            }
-        }
-    }
-}

tests/php/Unit/Event/UserEventTest.php

@@ -1,64 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Event;
-
-use KTXC\User\Event\UserCreatedEvent;
-use KTXC\User\Event\UserDeletingEvent;
-use KTXC\User\Event\UserEvent;
-use KTXC\User\Event\UserUpdatedEvent;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class UserEventTest extends TestCase
-{
-    #[Test]
-    #[TestDox('User lifecycle events contain an immutable user snapshot')]
-    public function containsUserSnapshot(): void
-    {
-        $event = UserCreatedEvent::fromUser(
-            [
-                'uid' => 'user-a',
-                'identity' => 'person@example.test',
-                'label' => 'Person',
-                'enabled' => true,
-                'roles' => ['member'],
-            ],
-            'tenant-a',
-            'actor-a',
-        );
-
-        self::assertSame(UserCreatedEvent::class, $event->label());
-        self::assertSame('user-a', $event->userIdentifier());
-        self::assertSame('person@example.test', $event->userIdentity());
-        self::assertSame('Person', $event->userLabel());
-        self::assertTrue($event->userEnabled());
-        self::assertSame(['member'], $event->userRoles());
-        self::assertSame('tenant-a', $event->tenantIdentifier());
-        self::assertSame('actor-a', $event->actorIdentifier());
-        self::assertSame('actor-a', $event->actorIdentity());
-        self::assertSame('string', (string) (new \ReflectionMethod(UserEvent::class, 'tenantIdentifier'))->getReturnType());
-    }
-
-    #[Test]
-    #[TestDox('Created, updated, and deleting users have distinct event names')]
-    public function distinguishesLifecycleStage(): void
-    {
-        $user = ['uid' => 'user-a', 'identity' => 'person@example.test'];
-
-        self::assertSame(UserCreatedEvent::class, UserCreatedEvent::fromUser($user, 'tenant-a')->label());
-        self::assertSame(UserUpdatedEvent::class, UserUpdatedEvent::fromUser($user, 'tenant-a')->label());
-        self::assertSame(UserDeletingEvent::class, UserDeletingEvent::fromUser($user, 'tenant-a')->label());
-    }
-
-    #[Test]
-    #[TestDox('User lifecycle events reject incomplete snapshots')]
-    public function rejectsIncompleteSnapshot(): void
-    {
-        $this->expectException(\InvalidArgumentException::class);
-
-        UserCreatedEvent::fromUser(['identity' => 'person@example.test'], 'tenant-a');
-    }
-}

tests/php/Unit/Module/CoreModuleTest.php

@@ -16,18 +16,8 @@ use KTXC\Service\TenantFirewallStatusService;
 use KTXC\Service\SystemFirewallStatusService;
 use KTXC\Service\TenantFirewallRuleService;
 use KTXC\Event\EventListenerRegistry;
-use KTXC\Security\Event\AccessDeniedEvent;
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
-use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SuspiciousActivityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\Event\DeliveryMode;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -52,24 +42,15 @@ final class CoreModuleTest extends TestCase
             $registry->listeners(AuthenticationFailedEvent::class, DeliveryMode::Immediate)[0]->service,
         );
         self::assertSame([], $registry->listeners(AuthenticationFailedEvent::class, DeliveryMode::Deferred));
-        $successListeners = $registry->listeners(
-            AuthenticationSucceededEvent::class,
-            DeliveryMode::Deferred,
-        );
-        self::assertCount(1, $successListeners);
-        self::assertSame(FirewallService::class, $successListeners[0]->service);
-        self::assertSame('logAuthenticationSuccess', $successListeners[0]->method);
         foreach ([
-            AccessDeniedEvent::class,
-            BruteForceDetectedEvent::class,
-            RateLimitExceededEvent::class,
-            SuspiciousActivityEvent::class,
-            FirewallRuleCreatedEvent::class,
-            FirewallRuleExtendedEvent::class,
-            FirewallRuleDisabledEvent::class,
-            FirewallRuleEnabledEvent::class,
-            FirewallRuleRemovedEvent::class,
-            FirewallSettingsUpdatedEvent::class,
+            SecurityEvent::RATE_LIMIT_EXCEEDED,
+            SecurityEvent::SUSPICIOUS_ACTIVITY,
+            SecurityEvent::FIREWALL_RULE_CREATED,
+            SecurityEvent::FIREWALL_RULE_EXTENDED,
+            SecurityEvent::FIREWALL_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_ENABLED,
+            SecurityEvent::FIREWALL_RULE_REMOVED,
+            SecurityEvent::FIREWALL_SETTINGS_UPDATED,
         ] as $event) {
             $listeners = $registry->listeners($event, DeliveryMode::Deferred);
             self::assertCount(1, $listeners);

tests/php/Unit/Runtime/HttpRuntimeTest.php

@@ -20,7 +20,6 @@ use KTXC\Http\Middleware\RequestHandlerInterface;
 use KTXC\Http\Middleware\RouterMiddleware;
 use KTXC\Http\Middleware\TenantMiddleware;
 use KTXC\Http\Request\Request;
-use KTXC\Http\Request\RequestContext;
 use KTXC\Http\Response\Response;
 use KTXC\Http\Response\StreamedResponse;
 use KTXC\KernelInterface;
@@ -79,31 +78,6 @@ final class HttpRuntimeTest extends TestCase
         self::assertTrue($kernel->outcome?->successful);
     }
 
-    #[Test]
-    #[TestDox('HTTP requests are available only for the active runtime execution')]
-    public function scopesRequestContext(): void
-    {
-        $requestContext = new RequestContext();
-        $observer = new RequestContextMiddleware($requestContext);
-        $kernel = new RuntimeKernel(
-            new RuntimeContainer([
-                RequestContext::class => $requestContext,
-                TenantMiddleware::class => new PassMiddleware(),
-                FirewallMiddleware::class => new PassMiddleware(),
-                AuthenticationMiddleware::class => new PassMiddleware(),
-                RouterMiddleware::class => $observer,
-            ]),
-            new TenantContext($this->createStub(TenantService::class)),
-            new IdentityContext(),
-        );
-        $request = Request::create('/auth/verify', 'POST');
-
-        (new HttpRuntime($kernel, false))->run($request, send: false);
-
-        self::assertSame($request, $observer->observed);
-        self::assertNull($requestContext->current());
-    }
-
     #[Test]
     #[TestDox('HTTP exceptions render a response and still terminate')]
     public function fails(): void
@@ -224,12 +198,9 @@ final class RuntimeKernel implements KernelInterface
 
 final class RuntimeContainer implements ContainerInterface
 {
-    private readonly array $services;
-
     public function __construct(
-        array $services,
+        private readonly array $services,
     ) {
-        $this->services = [RequestContext::class => new RequestContext(), ...$services];
     }
 
     public function get(string $id): mixed
@@ -279,21 +250,6 @@ final class ResponseMiddleware extends PassMiddleware
     }
 }
 
-final class RequestContextMiddleware extends PassMiddleware
-{
-    public ?Request $observed = null;
-
-    public function __construct(
-        private readonly RequestContext $requestContext,
-    ) {}
-
-    public function process(Request $request, RequestHandlerInterface $handler): Response
-    {
-        $this->observed = $this->requestContext->current();
-        return new Response('ok');
-    }
-}
-
 final class ThrowingMiddleware extends PassMiddleware
 {
     public function process(Request $request, RequestHandlerInterface $handler): Response

tests/php/Unit/Security/AuthenticationManagerTest.php

@@ -1,283 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Security;
-
-use KTXC\Context\TenantContextInterface;
-use KTXC\Models\Tenant\TenantConfiguration;
-use KTXC\Resource\ProviderManager;
-use KTXC\Security\Authentication\AuthenticationRequest;
-use KTXC\Security\AuthenticationManager;
-use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Service\TokenService;
-use KTXC\Service\UserAccountsService;
-use KTXF\Cache\CacheScope;
-use KTXF\Cache\EphemeralCacheInterface;
-use KTXF\Event\EventDispatcherInterface;
-use KTXF\Security\Authentication\AuthenticationProviderInterface;
-use KTXF\Security\Authentication\AuthenticationSession;
-use KTXF\Security\Authentication\ProviderContext;
-use KTXF\Security\Authentication\ProviderResult;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\TestCase;
-
-final class AuthenticationManagerTest extends TestCase
-{
-    #[Test]
-    public function completedAuthenticationPublishesAuthenticationSucceededEvent(): void
-    {
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('identifier')->willReturn('tenant-a');
-        $tenant->method('configuration')->willReturn(new TenantConfiguration());
-
-        $session = new AuthenticationSession(
-            id: 'auth-session',
-            state: AuthenticationSession::STATE_IDENTIFIED,
-            tenantIdentifier: 'tenant-a',
-            userIdentifier: 'user-a',
-            userIdentity: 'person@example.com',
-            methodsAvailable: ['password'],
-            createdAt: time(),
-            expiresAt: time() + 300,
-        );
-
-        $cache = $this->createMock(EphemeralCacheInterface::class);
-        $cache->expects($this->once())
-            ->method('get')
-            ->with('auth-session', CacheScope::Tenant, 'auth')
-            ->willReturn($session);
-        $cache->expects($this->once())->method('set')->willReturn(true);
-        $cache->expects($this->once())
-            ->method('delete')
-            ->with('auth-session', CacheScope::Tenant, 'auth')
-            ->willReturn(true);
-
-        $provider = new SuccessfulAuthenticationProvider();
-        $providers = $this->createStub(ProviderManager::class);
-        $providers->method('resolve')->willReturn($provider);
-
-        $users = $this->createMock(UserAccountsService::class);
-        $users->expects($this->once())
-            ->method('fetchByIdentifier')
-            ->with('user-a')
-            ->willReturn([
-                'uid' => 'user-a',
-                'identity' => 'person@example.com',
-                'label' => 'Person',
-                'permissions' => [],
-            ]);
-
-        $tokens = $this->createStub(TokenService::class);
-        $tokens->method('createToken')->willReturn('token');
-
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->once())
-            ->method('dispatch')
-            ->with(self::callback(static fn($event): bool =>
-                $event instanceof AuthenticationSucceededEvent
-                && $event->getUserId() === 'user-a'
-                && $event->tenantIdentifier() === 'tenant-a'
-            ));
-
-        $manager = new AuthenticationManager(
-            $tenant,
-            $cache,
-            $providers,
-            $tokens,
-            $users,
-            $events,
-        );
-
-        $response = $manager->handle(AuthenticationRequest::verify(
-            'auth-session',
-            'password',
-            'correct',
-        ));
-
-        self::assertTrue($response->isSuccess());
-    }
-
-    #[Test]
-    public function rejectedCredentialPublishesAuthenticationFailedEvent(): void
-    {
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('configuration')->willReturn(new TenantConfiguration());
-
-        $session = new AuthenticationSession(
-            id: 'auth-session',
-            state: AuthenticationSession::STATE_IDENTIFIED,
-            tenantIdentifier: 'tenant-a',
-            userIdentifier: 'user-a',
-            userIdentity: 'person@example.com',
-            methodsAvailable: ['password'],
-            createdAt: time(),
-            expiresAt: time() + 300,
-        );
-
-        $cache = $this->createMock(EphemeralCacheInterface::class);
-        $cache->expects($this->once())
-            ->method('get')
-            ->with('auth-session', CacheScope::Tenant, 'auth')
-            ->willReturn($session);
-        $cache->expects($this->once())
-            ->method('set')
-            ->willReturn(true);
-
-        $provider = new class implements AuthenticationProviderInterface {
-            public int $verificationCount = 0;
-
-            public function type(): string
-            {
-                return 'authentication';
-            }
-
-            public function identifier(): string
-            {
-                return 'password';
-            }
-
-            public function label(): string
-            {
-                return 'Password';
-            }
-
-            public function description(): string
-            {
-                return 'Test provider';
-            }
-
-            public function method(): string
-            {
-                return self::METHOD_CREDENTIAL;
-            }
-
-            public function icon(): string
-            {
-                return '';
-            }
-
-            public function verify(ProviderContext $context, string $secret): ProviderResult
-            {
-                $this->verificationCount++;
-                return ProviderResult::failed(ProviderResult::ERROR_INVALID_FACTOR);
-            }
-
-            public function beginChallenge(ProviderContext $context): ProviderResult
-            {
-                return ProviderResult::failed();
-            }
-
-            public function verifyChallenge(ProviderContext $context, string $code): ProviderResult
-            {
-                return ProviderResult::failed();
-            }
-
-            public function beginRedirect(
-                ProviderContext $context,
-                string $callbackUrl,
-                ?string $returnUrl = null,
-            ): ProviderResult {
-                return ProviderResult::failed();
-            }
-
-            public function completeRedirect(ProviderContext $context, array $params): ProviderResult
-            {
-                return ProviderResult::failed();
-            }
-        };
-
-        $providers = $this->createMock(ProviderManager::class);
-        $providers->method('resolve')->with('authentication', 'password')->willReturn($provider);
-
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->once())
-            ->method('dispatch')
-            ->with(self::callback(static function ($event): bool {
-                return $event instanceof AuthenticationFailedEvent
-                    && $event->getUserId() === 'user-a'
-                    && $event->getReason() === ProviderResult::ERROR_INVALID_FACTOR
-                    && $event->tenantIdentifier() === 'tenant-a';
-            }));
-
-        $manager = new AuthenticationManager(
-            $tenant,
-            $cache,
-            $providers,
-            $this->createStub(TokenService::class),
-            $this->createStub(UserAccountsService::class),
-            $events,
-        );
-
-        $response = $manager->handle(AuthenticationRequest::verify(
-            'auth-session',
-            'password',
-            'incorrect',
-        ));
-
-        self::assertTrue($response->isFailed());
-        self::assertSame(1, $provider->verificationCount);
-    }
-}
-
-final class SuccessfulAuthenticationProvider implements AuthenticationProviderInterface
-{
-    public function type(): string
-    {
-        return 'authentication';
-    }
-
-    public function identifier(): string
-    {
-        return 'password';
-    }
-
-    public function label(): string
-    {
-        return 'Password';
-    }
-
-    public function description(): string
-    {
-        return 'Successful test provider';
-    }
-
-    public function method(): string
-    {
-        return self::METHOD_CREDENTIAL;
-    }
-
-    public function icon(): string
-    {
-        return '';
-    }
-
-    public function verify(ProviderContext $context, string $secret): ProviderResult
-    {
-        return ProviderResult::success();
-    }
-
-    public function beginChallenge(ProviderContext $context): ProviderResult
-    {
-        return ProviderResult::failed();
-    }
-
-    public function verifyChallenge(ProviderContext $context, string $code): ProviderResult
-    {
-        return ProviderResult::failed();
-    }
-
-    public function beginRedirect(
-        ProviderContext $context,
-        string $callbackUrl,
-        ?string $returnUrl = null,
-    ): ProviderResult {
-        return ProviderResult::failed();
-    }
-
-    public function completeRedirect(ProviderContext $context, array $params): ProviderResult
-    {
-        return ProviderResult::failed();
-    }
-}

tests/php/Unit/Service/FirewallRuleManagerTest.php

@@ -11,14 +11,7 @@ use KTXC\Service\FirewallRuleManager;
 use KTXC\Service\FirewallRuleScope;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallRuleEnabledEvent;
-use KTXC\Security\Event\FirewallRuleExtendedEvent;
-use KTXC\Security\Event\FirewallRuleRemovedEvent;
-use KTXC\Security\Event\DeviceBlockedEvent;
-use KTXC\Security\Event\IpAllowedEvent;
-use KTXC\Security\Event\IpBlockedEvent;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -48,10 +41,7 @@ class FirewallRuleManagerTest extends TestCase
         $this->store->method('findExactIpRule')->willReturn(null);
         $this->store->expects($this->exactly(2))
             ->method('depositRule')
-            ->willReturnCallback(static function (FirewallRuleObject $rule): FirewallRuleObject {
-                static $sequence = 0;
-                return $rule->setId('rule-' . ++$sequence);
-            });
+            ->willReturnArgument(0);
 
         $tenant = $this->manager->blockIp(
             FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin-a'
@@ -145,11 +135,7 @@ class FirewallRuleManagerTest extends TestCase
     public function testConfirmedCurrentIpBlock(): void
     {
         $this->store->method('findExactIpRule')->willReturn(null);
-        $this->store->expects(self::once())
-            ->method('depositRule')
-            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
-                $rule->setId('rule-confirmed')
-            );
+        $this->store->expects(self::once())->method('depositRule')->willReturnArgument(0);
 
         $rule = $this->manager->createManualRule(
             FirewallRuleScope::tenant('tenant-a'),
@@ -263,9 +249,7 @@ class FirewallRuleManagerTest extends TestCase
         $cache = new FirewallRuleCache($this->store);
         $manager = new FirewallRuleManager($this->store, $cache, $this->events);
         $this->store->method('findExactIpRule')->willReturn(null);
-        $this->store->method('depositRule')->willReturnCallback(
-            static fn(FirewallRuleObject $rule): FirewallRuleObject => $rule->setId('rule-cache')
-        );
+        $this->store->method('depositRule')->willReturnArgument(0);
 
         self::assertSame([], $cache->tenant('tenant-a'));
         $manager->blockIp(FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin');
@@ -285,7 +269,7 @@ class FirewallRuleManagerTest extends TestCase
         $this->events->expects($this->exactly(2))
             ->method('dispatch')
             ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$events): void {
-                $events[$event->label()] = $event;
+                $events[$event->getName()] = $event;
             });
 
         $this->manager->blockIp(
@@ -296,50 +280,14 @@ class FirewallRuleManagerTest extends TestCase
             300
         );
 
-        $audit = $events[FirewallRuleCreatedEvent::class];
+        $audit = $events[SecurityEvent::FIREWALL_RULE_CREATED];
         self::assertSame('rule-123', $audit->get('ruleId'));
         self::assertSame(FirewallRuleObject::SCOPE_TENANT, $audit->get('ruleScope'));
         self::assertSame(FirewallRuleObject::TYPE_IP, $audit->get('ruleType'));
         self::assertSame(FirewallRuleObject::ACTION_BLOCK, $audit->get('ruleAction'));
         self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $audit->get('origin'));
-        self::assertSame('admin-a', $audit->actorIdentity());
+        self::assertSame('admin-a', $audit->getIdentityId());
         self::assertNotNull($audit->get('expiresAt'));
-        self::assertInstanceOf(IpBlockedEvent::class, $events[IpBlockedEvent::class]);
-        self::assertSame('203.0.113.10', $events[IpBlockedEvent::class]->getIpAddress());
-    }
-
-    #[TestDox('IP allowance and device blocking publish dedicated policy events')]
-    public function testSubjectPolicyEvents(): void
-    {
-        $this->store->method('findExactIpRule')->willReturn(null);
-        $this->store->method('depositRule')->willReturnCallback(
-            static function (FirewallRuleObject $rule): FirewallRuleObject {
-                static $sequence = 0;
-                return $rule->setId('policy-rule-' . ++$sequence);
-            }
-        );
-        $events = [];
-        $this->events->expects($this->exactly(4))
-            ->method('dispatch')
-            ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$events): void {
-                $events[] = $event;
-            });
-
-        $this->manager->allowIp(
-            FirewallRuleScope::tenant('tenant-a'),
-            '203.0.113.11',
-            'Trusted service',
-            'admin-a',
-        );
-        $this->manager->blockDevice(
-            FirewallRuleScope::tenant('tenant-a'),
-            'device-a',
-            'Compromised device',
-            'admin-a',
-        );
-
-        self::assertCount(1, array_filter($events, static fn($event): bool => $event instanceof IpAllowedEvent));
-        self::assertCount(1, array_filter($events, static fn($event): bool => $event instanceof DeviceBlockedEvent));
     }
 
     #[TestDox('Manual lifecycle changes persist state, reasons, actors, and extension history')]
@@ -381,17 +329,17 @@ class FirewallRuleManagerTest extends TestCase
         self::assertGreaterThan($originalExpiry, $extended->getExpiresAt());
         self::assertCount(1, $extended->getMetadata()['extensions']);
         self::assertSame([
-            FirewallRuleDisabledEvent::class,
-            FirewallRuleEnabledEvent::class,
-            FirewallRuleExtendedEvent::class,
-            FirewallRuleRemovedEvent::class,
-        ], array_map(static fn($event): string => $event->label(), $audits));
+            SecurityEvent::FIREWALL_RULE_DISABLED,
+            SecurityEvent::FIREWALL_RULE_ENABLED,
+            SecurityEvent::FIREWALL_RULE_EXTENDED,
+            SecurityEvent::FIREWALL_RULE_REMOVED,
+        ], array_map(static fn($event): string => $event->getName(), $audits));
         self::assertSame(
             ['Investigation', 'Threat confirmed', 'Continue monitoring', 'Case closed'],
             array_map(static fn($event): string => $event->get('changeReason'), $audits)
         );
         self::assertSame(['operator'], array_values(array_unique(array_map(
-            static fn($event): ?string => $event->actorIdentity(),
+            static fn($event): ?string => $event->getIdentityId(),
             $audits
         ))));
     }
@@ -453,7 +401,7 @@ class FirewallRuleManagerTest extends TestCase
         $this->events->expects(self::once())
             ->method('dispatch')
             ->with(self::callback(static fn(\KTXF\Event\Event $event): bool =>
-                $event instanceof FirewallRuleExtendedEvent
+                $event->getName() === SecurityEvent::FIREWALL_RULE_EXTENDED
                 && $event->get('lastFailureCount') === 8
             ));
 

tests/php/Unit/Service/FirewallRuleServicesTest.php

@@ -102,9 +102,7 @@ class FirewallRuleServicesTest extends TestCase
             ->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
                 $rule->isTenantScoped() && $rule->getTenantId() === 'tenant-a'
             ))
-            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
-                $rule->setId('tenant-rule')
-            );
+            ->willReturnArgument(0);
 
         $this->tenantService()->blockIp('203.0.113.10');
     }
@@ -119,9 +117,7 @@ class FirewallRuleServicesTest extends TestCase
             ->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
                 $rule->isSystemScoped() && $rule->getTenantId() === null
             ))
-            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
-                $rule->setId('system-rule')
-            );
+            ->willReturnArgument(0);
 
         $this->systemService()->blockIp('203.0.113.10');
     }

tests/php/Unit/Service/FirewallServiceTest.php

@@ -5,20 +5,10 @@ declare(strict_types=1);
 namespace KTXT\Unit\Service;
 
 use KTXC\Context\TenantContextInterface;
-use KTXC\Http\Request\Request;
-use KTXC\Http\Request\RequestContext;
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Models\Tenant\TenantConfiguration;
-use KTXC\Security\Event\AccessDeniedEvent;
 use KTXC\Security\Event\AuthenticationFailedEvent;
-use KTXC\Security\Event\AuthenticationSucceededEvent;
-use KTXC\Security\Event\BruteForceDetectedEvent;
-use KTXC\Security\Event\FirewallRuleCreatedEvent;
-use KTXC\Security\Event\FirewallRuleDisabledEvent;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
-use KTXC\Security\Event\RateLimitExceededEvent;
-use KTXC\Security\Event\SuspiciousActivityEvent;
 use KTXC\Service\FirewallService;
 use KTXC\Service\FirewallRuleCache;
 use KTXC\Service\FirewallRuleManager;
@@ -35,7 +25,6 @@ class FirewallServiceTest extends TestCase
     private FirewallStore&MockObject $store;
     private TenantContextInterface&MockObject $tenantContext;
     private EventDispatcherInterface&MockObject $events;
-    private RequestContext $requestContext;
     private FirewallService $service;
     private ?string $currentTenant;
     private ?TenantConfiguration $currentConfiguration;
@@ -45,16 +34,6 @@ class FirewallServiceTest extends TestCase
         $this->store = $this->createMock(FirewallStore::class);
         $this->tenantContext = $this->createMock(TenantContextInterface::class);
         $this->events = $this->createMock(EventDispatcherInterface::class);
-        $this->requestContext = new RequestContext();
-        $this->requestContext->initialize(Request::create(
-            '/login',
-            'POST',
-            server: [
-                'REMOTE_ADDR' => '203.0.113.10',
-                'HTTP_USER_AGENT' => 'Test Agent',
-                'HTTP_X_DEVICE_FINGERPRINT' => 'device-a',
-            ],
-        ));
         $this->currentTenant = 'tenant-a';
         $this->currentConfiguration = null;
         $this->tenantContext->method('identifier')->willReturnCallback(
@@ -70,8 +49,7 @@ class FirewallServiceTest extends TestCase
             $this->tenantContext,
             $this->events,
             $manager,
-            $cache,
-            $this->requestContext,
+            $cache
         );
     }
 
@@ -93,15 +71,7 @@ class FirewallServiceTest extends TestCase
 
         $this->store->expects($this->once())->method('listSystemRules')->willReturn([$systemBlock]);
         $this->store->expects($this->once())->method('listRules')->with('tenant-a')->willReturn([$tenantAllow]);
-        $this->events->expects($this->once())
-            ->method('dispatch')
-            ->with(self::callback(static function ($event): bool {
-                return $event instanceof AccessDeniedEvent
-                    && $event->getIpAddress() === '203.0.113.10'
-                    && $event->getRuleId() === 'system-block'
-                    && $event->getRuleScope() === FirewallRuleObject::SCOPE_SYSTEM
-                    && $event->getReason() === 'system-block';
-            }));
+        $this->events->expects($this->once())->method('dispatch');
 
         $result = $this->service->analyze('203.0.113.10');
 
@@ -241,12 +211,13 @@ class FirewallServiceTest extends TestCase
                     && $log->getEventType() === FirewallLogObject::EVENT_RULE_MATCH;
             }))
             ->willReturnArgument(0);
-        $event = new AccessDeniedEvent(
-            ipAddress: '203.0.113.10',
-            ruleId: 'tenant-rule',
-            ruleScope: FirewallRuleObject::SCOPE_TENANT,
-            reason: 'Tenant block',
-            tenantId: 'tenant-a',
+        $event = \KTXC\Security\Event\SecurityEvent::accessDenied(
+            '203.0.113.10',
+            null,
+            'tenant-rule',
+            FirewallRuleObject::SCOPE_TENANT,
+            'Tenant block',
+            'tenant-a',
         );
 
         $this->service->logSecurityEvent($event);
@@ -264,11 +235,12 @@ class FirewallServiceTest extends TestCase
                     && $log->getRuleScope() === FirewallRuleObject::SCOPE_SYSTEM;
             }))
             ->willReturnArgument(0);
-        $event = new AccessDeniedEvent(
-            ipAddress: '203.0.113.10',
-            ruleId: 'system-rule',
-            ruleScope: FirewallRuleObject::SCOPE_SYSTEM,
-            reason: 'System block',
+        $event = \KTXC\Security\Event\SecurityEvent::accessDenied(
+            '203.0.113.10',
+            null,
+            'system-rule',
+            FirewallRuleObject::SCOPE_SYSTEM,
+            'System block'
         );
 
         $this->service->logSecurityEvent($event);
@@ -281,7 +253,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('createLog');
 
         $this->service->logSecurityEvent(
-            new AuthenticationFailedEvent()
+            new AuthenticationFailedEvent('203.0.113.10')
         );
     }
 
@@ -300,7 +272,7 @@ class FirewallServiceTest extends TestCase
                     && $metadata['windowSeconds'] === 60;
             }))
             ->willReturnArgument(0);
-        $event = new RateLimitExceededEvent(
+        $event = \KTXC\Security\Event\SecurityEvent::rateLimitExceeded(
             '203.0.113.10',
             101,
             60,
@@ -311,25 +283,6 @@ class FirewallServiceTest extends TestCase
         $this->service->logSecurityEvent($event);
     }
 
-    #[TestDox('Successful authentication maps to an allowed access log')]
-    public function testAuthenticationSuccessAudit(): void
-    {
-        $this->store->expects($this->once())
-            ->method('createLog')
-            ->with(self::callback(static function (FirewallLogObject $log): bool {
-                return $log->getEventType() === FirewallLogObject::EVENT_ACCESS_CHECK
-                    && $log->getResult() === FirewallLogObject::RESULT_ALLOWED
-                    && $log->getIpAddress() === '203.0.113.10'
-                    && $log->getIdentityId() === 'user-a';
-            }))
-            ->willReturnArgument(0);
-
-        $this->service->logAuthenticationSuccess(new AuthenticationSucceededEvent(
-            'user-a',
-            'tenant-a',
-        ));
-    }
-
     #[TestDox('Suspicious-activity events retain request and detection metadata')]
     public function testSuspiciousActivityAudit(): void
     {
@@ -344,9 +297,11 @@ class FirewallServiceTest extends TestCase
                     && $log->getMetadata()['detector'] === 'payload-signature';
             }))
             ->willReturnArgument(0);
-        $event = new SuspiciousActivityEvent(
-            ipAddress: '203.0.113.20',
-            detector: 'payload-signature',
+        $event = \KTXC\Security\Event\SecurityEvent::create(
+            \KTXC\Security\Event\SecurityEvent::SUSPICIOUS_ACTIVITY,
+            '203.0.113.20',
+            null,
+            ['detector' => 'payload-signature'],
             tenantId: 'tenant-a',
             requestPath: '/admin',
             requestMethod: 'POST',
@@ -369,15 +324,14 @@ class FirewallServiceTest extends TestCase
                     && $log->getIdentityId() === 'operator';
             }))
             ->willReturnArgument(0);
-        $event = FirewallRuleDisabledEvent::fromRule(
-            (new FirewallRuleObject())
-                ->setId('rule-123')
-                ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
-                ->setType(FirewallRuleObject::TYPE_IP)
-                ->setAction(FirewallRuleObject::ACTION_BLOCK)
-                ->setValue('203.0.113.10')
-                ->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]),
-            'operator',
+        $event = new \KTXC\Security\Event\SecurityEvent(
+            \KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_DISABLED,
+            [
+                'ruleId' => 'rule-123',
+                'ruleScope' => FirewallRuleObject::SCOPE_SYSTEM,
+                'origin' => FirewallRuleManager::ORIGIN_MANUAL,
+            ],
+            identityId: 'operator',
         );
 
         $this->service->logSecurityEvent($event);
@@ -396,12 +350,11 @@ class FirewallServiceTest extends TestCase
                 && $log->getMetadata()['changeReason'] === 'Tighten controls'
             ))
             ->willReturnArgument(0);
-        $event = new FirewallSettingsUpdatedEvent(
-            changeReason: 'Tighten controls',
-            previous: ['maxAuthFailures' => 5],
-            current: ['maxAuthFailures' => 3],
+        $event = new \KTXC\Security\Event\SecurityEvent(
+            \KTXC\Security\Event\SecurityEvent::FIREWALL_SETTINGS_UPDATED,
+            ['changeReason' => 'Tighten controls'],
             tenantId: 'tenant-a',
-            actorId: 'operator',
+            identityId: 'operator',
         );
 
         $this->service->logSecurityEvent($event);
@@ -425,53 +378,16 @@ class FirewallServiceTest extends TestCase
             ->willReturn(4);
         $this->events->expects($this->never())->method('dispatch');
 
-        $event = new AuthenticationFailedEvent(tenantId: 'tenant-a');
+        $event = new AuthenticationFailedEvent(
+            '203.0.113.10',
+            tenantId: 'tenant-a',
+        );
         $this->service->handleAuthFailure($event);
 
         self::assertSame(8, $this->currentConfiguration->firewall()->maxAuthFailures());
         self::assertSame(7200, $this->currentConfiguration->firewall()->autoBlockDuration());
     }
 
-    #[TestDox('Authentication failures combine event facts with the current request')]
-    public function testAuthenticationFailureRequestContext(): void
-    {
-        $this->store->expects($this->once())
-            ->method('createLogOnce')
-            ->with(self::callback(static function (FirewallLogObject $log): bool {
-                return $log->getIpAddress() === '203.0.113.10'
-                    && $log->getDeviceFingerprint() === 'device-a'
-                    && $log->getUserAgent() === 'Test Agent'
-                    && $log->getRequestPath() === '/login'
-                    && $log->getRequestMethod() === 'POST'
-                    && $log->getIdentityId() === 'user-a'
-                    && $log->getMetadata()['reason'] === 'invalid_credentials';
-            }))
-            ->willReturn(true);
-        $this->store->expects($this->once())
-            ->method('countRecentFailures')
-            ->with('tenant-a', '203.0.113.10', 300)
-            ->willReturn(0);
-
-        $this->service->handleAuthFailure(new AuthenticationFailedEvent(
-            userId: 'user-a',
-            reason: 'invalid_credentials',
-            tenantId: 'tenant-a',
-        ));
-    }
-
-    #[TestDox('Authentication failures outside HTTP request context are ignored')]
-    public function testAuthenticationFailureWithoutRequestContext(): void
-    {
-        $this->requestContext->clear();
-        $this->store->expects($this->never())->method('createLogOnce');
-        $this->store->expects($this->never())->method('countRecentFailures');
-
-        $this->service->handleAuthFailure(new AuthenticationFailedEvent(
-            reason: 'invalid_credentials',
-            tenantId: 'tenant-a',
-        ));
-    }
-
     #[TestDox('Unsafe numeric firewall settings fall back to safe defaults')]
     public function testConfigurationBounds(): void
     {
@@ -488,7 +404,10 @@ class FirewallServiceTest extends TestCase
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(0);
 
-        $event = new AuthenticationFailedEvent(tenantId: 'tenant-a');
+        $event = new AuthenticationFailedEvent(
+            '203.0.113.10',
+            tenantId: 'tenant-a',
+        );
         $this->service->handleAuthFailure($event);
     }
 
@@ -525,37 +444,29 @@ class FirewallServiceTest extends TestCase
                     && $metadata['lastFailureCount'] === 5
                     && $metadata['blockDurationSeconds'] === 3600;
             }))
-            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
-                $rule->setId('automatic-rule')
-            );
+            ->willReturnArgument(0);
 
         $publishedTenants = [];
         $lifecycleOrigin = null;
-        $bruteForceEvent = null;
         $this->events->expects($this->exactly(3))
             ->method('dispatch')
             ->willReturnCallback(static function (\KTXF\Event\Event $event) use (
                 &$publishedTenants,
-                &$lifecycleOrigin,
-                &$bruteForceEvent,
+                &$lifecycleOrigin
             ): void {
-                $publishedTenants[] = $event->tenantIdentifier();
-                if ($event instanceof BruteForceDetectedEvent) {
-                    $bruteForceEvent = $event;
-                }
-                if ($event instanceof FirewallRuleCreatedEvent) {
+                $publishedTenants[] = $event->getTenantId();
+                if ($event->getName() === \KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_CREATED) {
                     $lifecycleOrigin = $event->get('origin');
                 }
             });
 
-        $event = new AuthenticationFailedEvent(tenantId: 'tenant-event');
+        $event = new AuthenticationFailedEvent(
+            '203.0.113.10',
+            tenantId: 'tenant-event',
+        );
         $this->service->handleAuthFailure($event);
 
         self::assertSame(['tenant-event', 'tenant-event', 'tenant-event'], $publishedTenants);
-        self::assertInstanceOf(BruteForceDetectedEvent::class, $bruteForceEvent);
-        self::assertSame('203.0.113.10', $bruteForceEvent->getIpAddress());
-        self::assertSame(5, $bruteForceEvent->getFailureCount());
-        self::assertSame(300, $bruteForceEvent->getWindowSeconds());
         self::assertSame(FirewallRuleManager::ORIGIN_AUTOMATIC, $lifecycleOrigin);
     }
 
@@ -575,7 +486,7 @@ class FirewallServiceTest extends TestCase
         $this->events->expects($this->never())->method('dispatch');
 
         $this->service->handleAuthFailure(
-            new AuthenticationFailedEvent()
+            new AuthenticationFailedEvent('203.0.113.10')
         );
     }
 
@@ -589,7 +500,7 @@ class FirewallServiceTest extends TestCase
             ->willReturn(0);
 
         $this->service->handleAuthFailure(
-            new AuthenticationFailedEvent()
+            new AuthenticationFailedEvent('203.0.113.10')
         );
     }
 
@@ -601,7 +512,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('depositRule');
 
         $this->service->handleAuthFailure(
-            new AuthenticationFailedEvent()
+            new AuthenticationFailedEvent('203.0.113.10')
         );
     }
 
@@ -615,13 +526,13 @@ class FirewallServiceTest extends TestCase
             ->method('countRecentFailures')
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(1);
-        $event = new AuthenticationFailedEvent();
-        $eventId = $event->identifier();
+        $event = new AuthenticationFailedEvent('203.0.113.10');
+        $eventId = $event->getEventId();
 
         $this->service->handleAuthFailure($event);
         $this->service->handleAuthFailure($event);
 
-        self::assertSame($eventId, $event->identifier());
+        self::assertSame($eventId, $event->getEventId());
     }
 
     #[TestDox('Cleanup records successful maintenance counts')]

tests/php/Unit/Service/FirewallSettingsServiceTest.php

@@ -9,7 +9,7 @@ use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\FirewallSettingsService;
 use KTXC\Service\TenantService;
 use KTXF\Event\EventDispatcherInterface;
-use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
 
@@ -37,10 +37,10 @@ final class FirewallSettingsServiceTest extends TestCase
         $events = $this->createMock(EventDispatcherInterface::class);
         $events->expects(self::once())
             ->method('dispatch')
-            ->with(self::callback(static fn(FirewallSettingsUpdatedEvent $event): bool =>
-                $event->label() === FirewallSettingsUpdatedEvent::class
-                && $event->tenantIdentifier() === 'tenant-a'
-                && $event->actorIdentity() === 'admin-a'
+            ->with(self::callback(static fn(SecurityEvent $event): bool =>
+                $event->getName() === SecurityEvent::FIREWALL_SETTINGS_UPDATED
+                && $event->getTenantId() === 'tenant-a'
+                && $event->getIdentityId() === 'admin-a'
                 && $event->get('changeReason') === 'Tighten authentication controls'
                 && $event->get('previous')['maxAuthFailures'] === 5
                 && $event->get('current')['maxAuthFailures'] === 8

tests/php/Unit/Service/UserAccountsServiceTest.php

@@ -1,191 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\Unit\Service;
-
-use KTXC\Context\IdentityContextInterface;
-use KTXC\Context\TenantContextInterface;
-use KTXC\Service\UserAccountsService;
-use KTXC\Stores\UserAccountsStore;
-use KTXC\User\Event\UserCreatedEvent;
-use KTXC\User\Event\UserDeletingEvent;
-use KTXC\User\Event\UserUpdatedEvent;
-use KTXF\Event\EventDispatcherInterface;
-use PHPUnit\Framework\Attributes\Test;
-use PHPUnit\Framework\Attributes\TestDox;
-use PHPUnit\Framework\TestCase;
-
-final class UserAccountsServiceTest extends TestCase
-{
-    #[Test]
-    #[TestDox('Successful user creation and deletion emit complete lifecycle events')]
-    public function emitsLifecycleEvents(): void
-    {
-        $user = [
-            'uid' => 'user-a',
-            'identity' => 'person@example.test',
-            'label' => 'Person',
-            'enabled' => true,
-            'roles' => ['member'],
-        ];
-
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('requireIdentifier')->willReturn('tenant-a');
-        $identity = $this->createStub(IdentityContextInterface::class);
-        $identity->method('identifier')->willReturn('actor-a');
-        $store = $this->createMock(UserAccountsStore::class);
-        $store->expects($this->once())
-            ->method('createUser')
-            ->with('tenant-a', ['identity' => 'person@example.test'])
-            ->willReturn($user);
-        $store->expects($this->once())
-            ->method('fetchByIdentifier')
-            ->with('tenant-a', 'user-a')
-            ->willReturn($user);
-        $operations = [];
-        $store->expects($this->once())
-            ->method('deleteUser')
-            ->with('tenant-a', 'user-a')
-            ->willReturnCallback(static function () use (&$operations): bool {
-                $operations[] = 'delete';
-                return true;
-            });
-
-        $emitted = [];
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->exactly(2))
-            ->method('dispatch')
-            ->willReturnCallback(static function ($event) use (&$emitted, &$operations): void {
-                $emitted[] = $event;
-                if ($event instanceof UserDeletingEvent) {
-                    $operations[] = 'event';
-                }
-            });
-
-        $service = new UserAccountsService($tenant, $identity, $store, $events);
-
-        self::assertSame($user, $service->createUser(['identity' => 'person@example.test']));
-        self::assertTrue($service->deleteUser('user-a'));
-        self::assertInstanceOf(UserCreatedEvent::class, $emitted[0]);
-        self::assertInstanceOf(UserDeletingEvent::class, $emitted[1]);
-        self::assertSame('actor-a', $emitted[0]->actorIdentifier());
-        self::assertSame('tenant-a', $emitted[1]->tenantIdentifier());
-        self::assertSame(['event', 'delete'], $operations);
-    }
-
-    #[Test]
-    #[TestDox('Deleting event precedes a failed persistence attempt')]
-    public function emitsBeforeFailedDeletion(): void
-    {
-        $store = $this->createStub(UserAccountsStore::class);
-        $store->method('fetchByIdentifier')->willReturn([
-            'uid' => 'user-a',
-            'identity' => 'person@example.test',
-        ]);
-        $store->method('deleteUser')->willReturn(false);
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->once())
-            ->method('dispatch')
-            ->with(self::isInstanceOf(UserDeletingEvent::class));
-
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('requireIdentifier')->willReturn('tenant-a');
-        $service = new UserAccountsService(
-            $tenant,
-            $this->createStub(IdentityContextInterface::class),
-            $store,
-            $events,
-        );
-
-        self::assertFalse($service->deleteUser('user-a'));
-    }
-
-    #[Test]
-    #[TestDox('Successful updates emit the persisted user snapshot after storage')]
-    public function emitsAfterSuccessfulUpdate(): void
-    {
-        $updatedUser = [
-            'uid' => 'user-a',
-            'identity' => 'person@example.test',
-            'label' => 'Updated Person',
-            'enabled' => true,
-            'roles' => ['admin'],
-        ];
-        $operations = [];
-        $store = $this->createMock(UserAccountsStore::class);
-        $store->expects($this->once())
-            ->method('updateUser')
-            ->with('tenant-a', 'user-a', ['label' => 'Updated Person'])
-            ->willReturnCallback(static function () use (&$operations): bool {
-                $operations[] = 'update';
-                return true;
-            });
-        $store->expects($this->once())
-            ->method('fetchByIdentifier')
-            ->with('tenant-a', 'user-a')
-            ->willReturnCallback(static function () use (&$operations, $updatedUser): array {
-                $operations[] = 'fetch';
-                return $updatedUser;
-            });
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->once())
-            ->method('dispatch')
-            ->with(self::callback(static function ($event) use (&$operations): bool {
-                $operations[] = 'event';
-                return $event instanceof UserUpdatedEvent
-                    && $event->userLabel() === 'Updated Person'
-                    && $event->userRoles() === ['admin'];
-            }));
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('requireIdentifier')->willReturn('tenant-a');
-        $identity = $this->createStub(IdentityContextInterface::class);
-        $identity->method('identifier')->willReturn('actor-a');
-        $service = new UserAccountsService($tenant, $identity, $store, $events);
-
-        self::assertTrue($service->updateUser('user-a', ['label' => 'Updated Person']));
-        self::assertSame(['update', 'fetch', 'event'], $operations);
-    }
-
-    #[Test]
-    #[TestDox('Unchanged users do not emit an updated event')]
-    public function ignoresUnchangedUser(): void
-    {
-        $store = $this->createMock(UserAccountsStore::class);
-        $store->expects($this->once())->method('updateUser')->willReturn(false);
-        $store->expects($this->never())->method('fetchByIdentifier');
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->never())->method('dispatch');
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('requireIdentifier')->willReturn('tenant-a');
-        $service = new UserAccountsService(
-            $tenant,
-            $this->createStub(IdentityContextInterface::class),
-            $store,
-            $events,
-        );
-
-        self::assertFalse($service->updateUser('user-a', ['label' => 'Person']));
-    }
-
-    #[Test]
-    #[TestDox('Missing users do not emit a deleting event')]
-    public function ignoresMissingUser(): void
-    {
-        $store = $this->createStub(UserAccountsStore::class);
-        $store->method('fetchByIdentifier')->willReturn(null);
-        $events = $this->createMock(EventDispatcherInterface::class);
-        $events->expects($this->never())->method('dispatch');
-
-        $tenant = $this->createStub(TenantContextInterface::class);
-        $tenant->method('requireIdentifier')->willReturn('tenant-a');
-        $service = new UserAccountsService(
-            $tenant,
-            $this->createStub(IdentityContextInterface::class),
-            $store,
-            $events,
-        );
-
-        self::assertFalse($service->deleteUser('missing'));
-    }
-}