Security

Security considerations for WPZylos Events.

Event Data Security

Sensitive Data in Events

Be careful with sensitive data in events:

// Good: Good - Only include necessary data
class UserLoggedIn
{
    public function __construct(
        public readonly int $userId,
        public readonly string $ipAddress
    ) {}
}

// Bad: Bad - Don't include passwords or tokens
class UserLoggedIn
{
    public function __construct(
        public readonly User $user,
        public readonly string $password  // Never do this!
    ) {}
}

Event Immutability

Make events immutable to prevent tampering:

class SecureEvent
{
    public function __construct(
        public readonly int $id,
        public readonly string $data
    ) {}
}

Listener Security

Permission Checks

Check permissions in listeners:

$dispatcher->listen(AdminActionRequested::class, function ($event) {
    if (!current_user_can('manage_options')) {
        throw new \Exception('Unauthorized');
    }
    // Process action
});

Input Validation

Validate event data in listeners:

$dispatcher->listen(FormSubmitted::class, function ($event) {
    $email = sanitize_email($event->data['email'] ?? '');
    if (!is_email($email)) {
        throw new ValidationException('Invalid email');
    }
});

Logging Events

Log security-relevant events:

$dispatcher->listen(UserLoggedIn::class, function ($event) {
    $this->logger->info('User login', [
        'user_id' => $event->userId,
        'ip' => $event->ipAddress,
    ]);
});

$dispatcher->listen(PermissionDenied::class, function ($event) {
    $this->logger->warning('Permission denied', [
        'user_id' => $event->userId,
        'action' => $event->action,
    ]);
});