<?php

declare(strict_types=1);

namespace KTXC\Security\Event;

use KTXC\Models\Firewall\FirewallRuleObject;
use KTXF\Event\Event;

final class AccessDeniedEvent extends Event implements SecurityRequestEventInterface
{
    public function __construct(
        private readonly string $ipAddress,
        private readonly string $ruleId,
        private readonly string $ruleScope,
        private readonly ?string $deviceFingerprint = null,
        private readonly ?string $reason = null,
        ?string $tenantId = null,
        ?string $identityId = null,
    ) {
        if ($ipAddress === '') {
            throw new \InvalidArgumentException('Access denial requires an IP address.');
        }
        if ($ruleId === '') {
            throw new \InvalidArgumentException('Access denial requires a firewall rule ID.');
        }
        if (!in_array($ruleScope, [FirewallRuleObject::SCOPE_SYSTEM, FirewallRuleObject::SCOPE_TENANT], true)) {
            throw new \InvalidArgumentException('Access denial requires a valid firewall rule scope.');
        }

        parent::__construct(
            self::class,
            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
            $tenantId,
            $identityId,
        );
    }

    public function getIpAddress(): string
    {
        return $this->ipAddress;
    }

    public function getRuleId(): string
    {
        return $this->ruleId;
    }

    public function getRuleScope(): string
    {
        return $this->ruleScope;
    }

    public function getDeviceFingerprint(): ?string
    {
        return $this->deviceFingerprint;
    }

    public function getUserAgent(): ?string
    {
        return null;
    }

    public function getRequestPath(): ?string
    {
        return null;
    }

    public function getRequestMethod(): ?string
    {
        return null;
    }

    public function getUserId(): ?string
    {
        return null;
    }

    public function getReason(): ?string
    {
        return $this->reason;
    }

    public function getSeverity(): SecurityEventSeverity
    {
        return SecurityEventSeverity::WARNING;
    }
}