59 lines
2.0 KiB
PHP
59 lines
2.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace KTXT\Unit\Event;
|
|
|
|
use KTXC\Models\Firewall\FirewallRuleObject;
|
|
use KTXC\Security\Event\AccessDeniedEvent;
|
|
use KTXC\Security\Event\SecurityEventSeverity;
|
|
use PHPUnit\Framework\Attributes\Test;
|
|
use PHPUnit\Framework\Attributes\TestDox;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class AccessDeniedEventTest extends TestCase
|
|
{
|
|
#[Test]
|
|
#[TestDox('Access-denial state is typed and complete at construction')]
|
|
public function constructsTypedState(): void
|
|
{
|
|
$event = new AccessDeniedEvent(
|
|
'203.0.113.10',
|
|
'rule-a',
|
|
FirewallRuleObject::SCOPE_TENANT,
|
|
'device-a',
|
|
'Blocked by policy',
|
|
'tenant-a',
|
|
'identity-a',
|
|
);
|
|
|
|
self::assertSame(AccessDeniedEvent::class, $event->getName());
|
|
self::assertSame('203.0.113.10', $event->getIpAddress());
|
|
self::assertSame('device-a', $event->getDeviceFingerprint());
|
|
self::assertSame('rule-a', $event->getRuleId());
|
|
self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
|
|
self::assertSame('Blocked by policy', $event->getReason());
|
|
self::assertSame('tenant-a', $event->getTenantId());
|
|
self::assertSame('identity-a', $event->getIdentityId());
|
|
self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
|
|
}
|
|
|
|
#[Test]
|
|
#[TestDox('Access denial rejects incomplete rule context')]
|
|
public function rejectsIncompleteRuleContext(): void
|
|
{
|
|
foreach ([
|
|
['', 'rule-a', FirewallRuleObject::SCOPE_TENANT],
|
|
['203.0.113.10', '', FirewallRuleObject::SCOPE_TENANT],
|
|
['203.0.113.10', 'rule-a', 'unknown'],
|
|
] as $arguments) {
|
|
try {
|
|
new AccessDeniedEvent(...$arguments);
|
|
self::fail('Incomplete access-denial context was accepted.');
|
|
} catch (\InvalidArgumentException) {
|
|
$this->addToAssertionCount(1);
|
|
}
|
|
}
|
|
}
|
|
}
|