Feature: Auth middleware emits security events
  As a platform operator
  I want authentication outcomes emitted as domain events
  So the audit pipeline captures auth success and failure details

  Scenario: Successful authentication emits AUTH_SUCCESS
    Given an auth middleware with expected token "tok_secret_123"
    And an auth recording event bus
    When I authenticate with token "tok_secret_123" identity "alice@example.com" and ip "10.0.0.5"
    Then the auth result should be true
    And the auth event bus should have exactly 1 event
    And the latest auth event type should be AUTH_SUCCESS
    And the latest auth event should contain detail "user_identity" with value "alice@example.com"
    And the latest auth event should contain detail "ip_address" with value "10.0.0.5"
    And the latest auth event should contain detail "token_prefix" with value "tok_se..."

  Scenario: Short token success masks token_prefix
    Given an auth middleware with expected token "short"
    And an auth recording event bus
    When I authenticate with token "short" identity "alice@example.com" and ip "10.0.0.5"
    Then the auth result should be true
    And the latest auth event type should be AUTH_SUCCESS
    And the latest auth event should contain detail "token_prefix" with value "***..."

  Scenario: Failed authentication emits AUTH_FAILURE
    Given an auth middleware with expected token "tok_secret_123"
    And an auth recording event bus
    When I authenticate with token "tok_wrong_999" identity "alice@example.com" and ip "10.0.0.5"
    Then the auth result should be false
    And the auth event bus should have exactly 1 event
    And the latest auth event type should be AUTH_FAILURE
    And the latest auth event should contain detail "attempted_identity" with value "alice@example.com"
    And the latest auth event should contain detail "failure_reason" with value "invalid_token"
    And the latest auth event should contain detail "token_prefix" with value "tok_wr..."

  Scenario: Missing configured token emits AUTH_FAILURE
    Given an auth middleware with no configured token
    And an auth recording event bus
    When I authenticate with token "tok_any_111" identity "bob@example.com" and ip "10.0.0.9"
    Then the auth result should be false
    And the latest auth event type should be AUTH_FAILURE
    And the latest auth event should contain detail "failure_reason" with value "token_not_configured"

  Scenario: Empty authentication token is rejected before emission
    Given an auth middleware with expected token "tok_secret_123"
    And an auth recording event bus
    When I try to authenticate with an empty token
    Then an auth ValueError should be raised
    And the auth event bus should have exactly 0 event

  Scenario: Auth middleware events persist through AuditEventSubscriber
    Given auth middleware is wired to AuditEventSubscriber with expected token "tok_secret_123"
    When I authenticate with token "tok_secret_123" identity "carol@example.com" and ip "10.1.2.3"
    And I authenticate with token "tok_bad_123" identity "dave@example.com" and ip "10.1.2.4"
    Then the auth result history should be "true,false"
    And the audit log should contain 1 auth_success entry from middleware
    And the latest auth_success audit entry should contain detail "ip_address" with value "10.1.2.3"
    And the latest auth_success audit entry should contain detail "token_prefix" with value "tok_se..."
    And the audit log should contain 1 auth_failure entry from middleware
    And the latest auth_failure audit entry should contain detail "ip_address" with value "10.1.2.4"
    And the latest auth_failure audit entry should contain detail "attempted_identity" with value "dave@example.com"
    And the latest auth_failure audit entry should contain detail "failure_reason" with value "invalid_token"
    And the latest auth_failure audit entry should contain detail "token_prefix" with value "tok_ba..."