80 lines
3.3 KiB
PHP
80 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace KTXT\Unit\Event;
|
|
|
|
use KTXC\Security\Event\DeviceBlockedEvent;
|
|
use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
|
|
use KTXC\Security\Event\IpAllowedEvent;
|
|
use KTXC\Security\Event\IpBlockedEvent;
|
|
use KTXC\Security\Event\SecurityEvent;
|
|
use PHPUnit\Framework\Attributes\Test;
|
|
use PHPUnit\Framework\Attributes\TestDox;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class FirewallPolicyEventTest extends TestCase
|
|
{
|
|
#[Test]
|
|
#[TestDox('IP and device policy events expose typed immutable state')]
|
|
public function constructsSubjectPolicyEvents(): void
|
|
{
|
|
$blocked = new IpBlockedEvent('203.0.113.10', 'Repeated abuse', 'tenant-a');
|
|
$allowed = new IpAllowedEvent('203.0.113.11', 'Trusted service', 'tenant-a');
|
|
$device = new DeviceBlockedEvent('device-a', 'Compromised device', 'tenant-a');
|
|
|
|
self::assertSame(IpBlockedEvent::class, $blocked->getName());
|
|
self::assertSame('203.0.113.10', $blocked->getIpAddress());
|
|
self::assertSame('Repeated abuse', $blocked->getReason());
|
|
self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $blocked->getSeverity());
|
|
self::assertSame(IpAllowedEvent::class, $allowed->getName());
|
|
self::assertSame('203.0.113.11', $allowed->getIpAddress());
|
|
self::assertSame(SecurityEvent::SEVERITY_INFO, $allowed->getSeverity());
|
|
self::assertSame(DeviceBlockedEvent::class, $device->getName());
|
|
self::assertSame('device-a', $device->getDeviceFingerprint());
|
|
self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $device->getSeverity());
|
|
}
|
|
|
|
#[Test]
|
|
#[TestDox('Firewall settings events capture the complete configuration transition')]
|
|
public function constructsSettingsEvent(): void
|
|
{
|
|
$event = new FirewallSettingsUpdatedEvent(
|
|
'Tighten controls',
|
|
['maxAuthFailures' => 5],
|
|
['maxAuthFailures' => 3],
|
|
'tenant-a',
|
|
'operator-a',
|
|
);
|
|
|
|
self::assertSame(FirewallSettingsUpdatedEvent::class, $event->getName());
|
|
self::assertSame('Tighten controls', $event->getChangeReason());
|
|
self::assertSame(['maxAuthFailures' => 5], $event->getPrevious());
|
|
self::assertSame(['maxAuthFailures' => 3], $event->getCurrent());
|
|
self::assertSame('tenant-a', $event->getTenantId());
|
|
self::assertSame('operator-a', $event->getIdentityId());
|
|
self::assertSame('manual', $event->getChangeOrigin());
|
|
self::assertSame(SecurityEvent::SEVERITY_INFO, $event->getSeverity());
|
|
}
|
|
|
|
#[Test]
|
|
#[TestDox('Firewall policy events reject missing subject and ownership context')]
|
|
public function rejectsIncompletePolicyContext(): void
|
|
{
|
|
foreach ([
|
|
static fn() => new IpBlockedEvent(''),
|
|
static fn() => new IpAllowedEvent(''),
|
|
static fn() => new DeviceBlockedEvent(''),
|
|
static fn() => new FirewallSettingsUpdatedEvent('', [], [], 'tenant-a'),
|
|
static fn() => new FirewallSettingsUpdatedEvent('Reason', [], [], ''),
|
|
] as $construction) {
|
|
try {
|
|
$construction();
|
|
self::fail('Incomplete firewall policy context was accepted.');
|
|
} catch (\InvalidArgumentException) {
|
|
$this->addToAssertionCount(1);
|
|
}
|
|
}
|
|
}
|
|
}
|