133 lines
4.0 KiB
PHP
133 lines
4.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace KTXC\Service;
|
|
|
|
use KTXC\Context\IdentityContextInterface;
|
|
use KTXC\Models\Firewall\FirewallRuleObject;
|
|
|
|
final class SystemFirewallRuleService
|
|
{
|
|
public const PERMISSION_READ = 'firewall.system.rules.read';
|
|
public const PERMISSION_MANAGE = 'firewall.system.rules.manage';
|
|
|
|
public function __construct(
|
|
private readonly FirewallRuleManager $rules,
|
|
private readonly IdentityContextInterface $identity,
|
|
) {
|
|
}
|
|
|
|
public function listRules(bool $activeOnly = true): array
|
|
{
|
|
$this->requirePermission(self::PERMISSION_READ);
|
|
return $this->rules->list(FirewallRuleScope::system(), $activeOnly);
|
|
}
|
|
|
|
public function queryRules(
|
|
string $status = 'active',
|
|
?string $type = null,
|
|
?string $action = null,
|
|
int $limit = 50,
|
|
int $offset = 0
|
|
): array {
|
|
$this->requirePermission(self::PERMISSION_READ);
|
|
return $this->rules->query(FirewallRuleScope::system(), $status, $type, $action, $limit, $offset);
|
|
}
|
|
|
|
public function fetchRule(string $ruleId): ?FirewallRuleObject
|
|
{
|
|
$this->requirePermission(self::PERMISSION_READ);
|
|
return $this->rules->fetch(FirewallRuleScope::system(), $ruleId);
|
|
}
|
|
|
|
public function createRule(
|
|
string $type,
|
|
string $action,
|
|
string $value,
|
|
string $reason,
|
|
?int $durationSeconds = null,
|
|
?string $currentIp = null,
|
|
bool $confirmCurrentIp = false
|
|
): FirewallRuleObject {
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->createManualRule(
|
|
FirewallRuleScope::system(),
|
|
$type,
|
|
$action,
|
|
$value,
|
|
$reason,
|
|
$this->identity->identifier(),
|
|
$durationSeconds,
|
|
$currentIp,
|
|
$confirmCurrentIp
|
|
);
|
|
}
|
|
|
|
public function blockIp(string $ip, ?string $reason = null, ?int $durationSeconds = null): FirewallRuleObject
|
|
{
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->blockIp(
|
|
FirewallRuleScope::system(), $ip, $reason, $this->identity->identifier(), $durationSeconds
|
|
);
|
|
}
|
|
|
|
public function allowIp(string $ip, ?string $reason = null): FirewallRuleObject
|
|
{
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->allowIp(
|
|
FirewallRuleScope::system(), $ip, $reason, $this->identity->identifier()
|
|
);
|
|
}
|
|
|
|
public function blockIpRange(string $cidr, ?string $reason = null): FirewallRuleObject
|
|
{
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->blockIpRange(
|
|
FirewallRuleScope::system(), $cidr, $reason, $this->identity->identifier()
|
|
);
|
|
}
|
|
|
|
public function blockDevice(
|
|
string $fingerprint,
|
|
?string $reason = null,
|
|
?int $durationSeconds = null
|
|
): FirewallRuleObject {
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->blockDevice(
|
|
FirewallRuleScope::system(),
|
|
$fingerprint,
|
|
$reason,
|
|
$this->identity->identifier(),
|
|
$durationSeconds
|
|
);
|
|
}
|
|
|
|
public function disableRule(string $ruleId): bool
|
|
{
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->disable(
|
|
FirewallRuleScope::system(),
|
|
$ruleId,
|
|
$this->identity->identifier()
|
|
);
|
|
}
|
|
|
|
public function removeRule(string $ruleId): bool
|
|
{
|
|
$this->requirePermission(self::PERMISSION_MANAGE);
|
|
return $this->rules->remove(
|
|
FirewallRuleScope::system(),
|
|
$ruleId,
|
|
$this->identity->identifier()
|
|
);
|
|
}
|
|
|
|
private function requirePermission(string $permission): void
|
|
{
|
|
if (!$this->identity->hasPermission($permission)) {
|
|
throw new \RuntimeException("Missing required permission: {$permission}");
|
|
}
|
|
}
|
|
}
|