| 1 |
|
defmodule WalletAuth.Events.SuspiciousActivityDetected do |
| 2 |
|
@moduledoc """ |
| 3 |
|
Emitted when suspicious auth behavior is detected. |
| 4 |
|
|
| 5 |
|
Used as a risk handoff hook to wallet_risk for further scoring. |
| 6 |
|
Per checklist Track C: suspicious activity hooks for risk handoff. |
| 7 |
|
""" |
| 8 |
|
@behaviour WalletEvents.DomainEvent |
| 9 |
|
|
| 10 |
|
@impl true |
| 11 |
2 |
def event_name, do: "SuspiciousActivityDetected.v1" |
| 12 |
|
|
| 13 |
|
@impl true |
| 14 |
2 |
def event_version, do: 1 |
| 15 |
|
|
| 16 |
|
@type signal :: |
| 17 |
|
:otp_exhausted |
| 18 |
|
| :login_rate_limited |
| 19 |
|
| :refresh_replay_detected |
| 20 |
|
| :token_validation_failed |
| 21 |
|
|
| 22 |
:-( |
def build(user_id, signal, opts \\ []) do |
| 23 |
2 |
%{ |
| 24 |
|
event_id: WalletSharedKernel.Correlation.new_request_id(), |
| 25 |
|
event_name: event_name(), |
| 26 |
|
event_version: event_version(), |
| 27 |
|
aggregate_id: user_id, |
| 28 |
|
correlation_id: Keyword.get(opts, :correlation_id, WalletSharedKernel.Correlation.new_correlation_id()), |
| 29 |
|
occurred_at: DateTime.utc_now(), |
| 30 |
|
payload: %{ |
| 31 |
|
user_id: user_id, |
| 32 |
|
signal: signal, |
| 33 |
|
ip_address: Keyword.get(opts, :ip_address), |
| 34 |
|
metadata: Keyword.get(opts, :metadata, %{}) |
| 35 |
|
} |
| 36 |
|
} |
| 37 |
|
end |
| 38 |
|
end |