User login and refresh on auth_session (phase 2). Refs EventHub/EventHubBack#26

2026-07-07 19:33:24 +03:00
parent 7c5f2d26b8
commit 018bf85b87
6 changed files with 862 additions and 748 deletions
@@ -1,69 +1,114 @@
-module(logic_auth_session_tests).
-include_lib("eunit/include/eunit.hrl").
-include("records.hrl").
-
-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
-
-setup() ->
-  ok = meck:new(core_admin, [non_strict]),
-  mnesia:start(),
-  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
-  mnesia:create_table(auth_session, [
-    {attributes, record_info(fields, auth_session)},
-    {ram_copies, [node()]}
-  ]),
-  mnesia:add_table_index(auth_session, #auth_session.family_id),
-  mnesia:add_table_index(auth_session, #auth_session.subject_id),
-  application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
-  {ok, _} = application:ensure_all_started(jose),
-  ok.
-
-cleanup(_) ->
-  application:unset_env(eventhub, admin_jwt_secret),
-  application:stop(jose),
-  meck:unload(core_admin),
-  catch mnesia:delete_table(auth_session),
-  catch ets:delete(eventhub_counters),
-  mnesia:stop(),
-  ok.
-
-logic_auth_session_test_() ->
-  {foreach, fun setup/0, fun cleanup/1, [
-    {"Issue and refresh admin tokens", fun test_issue_and_refresh/0},
-    {"Refresh reuse revokes family", fun test_reuse_revokes/0}
-  ]}.
-
-test_issue_and_refresh() ->
-  AdminId = <<"adm1">>,
-  Admin = #admin{
-    id = AdminId, email = <<"a@test.com">>, role = superadmin,
-    password_hash = <<>>, status = active, nickname = <<>>,
-    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
-    phone = <<>>, preferences = #{}, last_login = undefined,
-    created_at = undefined, updated_at = undefined
-  },
-  ok = meck:expect(core_admin, get_by_id, fun(Id) ->
-    ?assertEqual(AdminId, Id), {ok, Admin}
-  end),
-  {ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
-  ?assert(is_binary(Access1)),
-  {ok, _, _} = eventhub_auth:verify_admin_token(Access1),
-  {ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
-  ?assert(is_binary(Access2)),
-  ?assertNotEqual(Refresh1, Refresh2),
-  {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
-
-test_reuse_revokes() ->
-  AdminId = <<"adm1">>,
-  Admin = #admin{
-    id = AdminId, email = <<"a@test.com">>, role = admin,
-    password_hash = <<>>, status = active, nickname = <<>>,
-    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
-    phone = <<>>, preferences = #{}, last_login = undefined,
-    created_at = undefined, updated_at = undefined
-  },
-  ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
-  {ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
-  {ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
-  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
-  ?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
+-module(logic_auth_session_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
+-define(USER_JWT_SECRET, <<"test-user-secret-key-32-by">>).
+
+setup() ->
+  ok = meck:new(core_admin, [non_strict]),
+  ok = meck:new(core_user, [non_strict]),
+  mnesia:start(),
+  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+  mnesia:create_table(auth_session, [
+    {attributes, record_info(fields, auth_session)},
+    {ram_copies, [node()]}
+  ]),
+  mnesia:add_table_index(auth_session, #auth_session.family_id),
+  mnesia:add_table_index(auth_session, #auth_session.subject_id),
+  application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
+  application:set_env(eventhub, jwt_secret, ?USER_JWT_SECRET),
+  {ok, _} = application:ensure_all_started(jose),
+  ok.
+
+cleanup(_) ->
+  application:unset_env(eventhub, admin_jwt_secret),
+  application:unset_env(eventhub, jwt_secret),
+  application:stop(jose),
+  meck:unload(core_admin),
+  meck:unload(core_user),
+  catch mnesia:delete_table(auth_session),
+  catch ets:delete(eventhub_counters),
+  mnesia:stop(),
+  ok.
+
+logic_auth_session_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"Issue and refresh admin tokens", fun test_issue_and_refresh_admin/0},
+    {"Refresh admin reuse revokes family", fun test_admin_reuse_revokes/0},
+    {"Issue and refresh user tokens", fun test_issue_and_refresh_user/0},
+    {"Refresh user reuse revokes family", fun test_user_reuse_revokes/0}
+  ]}.
+
+test_issue_and_refresh_admin() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = superadmin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(Id) ->
+    ?assertEqual(AdminId, Id), {ok, Admin}
+  end),
+  {ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
+  ?assert(is_binary(Access1)),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access1),
+  {ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assert(is_binary(Access2)),
+  ?assertNotEqual(Refresh1, Refresh2),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
+
+test_admin_reuse_revokes() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = admin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
+  {ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
+  {ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
+  ?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
+
+test_issue_and_refresh_user() ->
+  UserId = <<"usr1">>,
+  User = #user{
+    id = UserId, email = <<"u@test.com">>, role = user,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_user, get_by_id, fun(Id) ->
+    ?assertEqual(UserId, Id), {ok, User}
+  end),
+  {ok, Access1, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
+  ?assert(is_binary(Access1)),
+  {ok, _, _} = eventhub_auth:verify_user_token(Access1),
+  {ok, Claims} = eventhub_auth:verify_user_refresh_token(Refresh1),
+  ?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
+  ?assertEqual(<<"web">>, maps:get(<<"client">>, Claims)),
+  {ok, Access2, Refresh2} = logic_auth_session:refresh_user(Refresh1),
+  ?assert(is_binary(Access2)),
+  ?assertNotEqual(Refresh1, Refresh2),
+  {ok, _, _} = eventhub_auth:verify_user_token(Access2).
+
+test_user_reuse_revokes() ->
+  UserId = <<"usr1">>,
+  User = #user{
+    id = UserId, email = <<"u@test.com">>, role = user,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_user, get_by_id, fun(_) -> {ok, User} end),
+  {ok, _, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
+  {ok, _, Refresh2} = logic_auth_session:refresh_user(Refresh1),
+  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_user(Refresh1)),
+  ?assertMatch({error, revoked}, logic_auth_session:refresh_user(Refresh2)).