User login and refresh on auth_session (phase 2). Refs EventHub/EventHubBack#26

src/handlers/handler_login.erl

@@ -71,10 +71,10 @@ login(Req) ->
           try jsx:decode(Body, [return_maps]) of
             #{<<"email">> := Email, <<"password">> := Password} ->
               case eventhub_auth:authenticate_user_request(Req1, Email, Password) of
-                {ok, Token, User} ->
+                {ok, _Token, User} ->
                   UserId = maps:get(id, User),
-                  {RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
+                  Role = maps:get(role, User),
-                  core_session:create(UserId, RefreshToken),
+                  {ok, Token, RefreshToken} = logic_auth_session:issue_user_tokens(UserId, Role),
                   core_user:update_last_login(UserId),
                   Response = #{
                     <<"token">>         => Token,

src/handlers/handler_refresh.erl

@@ -8,8 +8,6 @@
 -export([init/2]).
 -export([trails/0]).
 
--include("records.hrl").
-
 %%% cowboy_handler callback
 -spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
 init(Req, _Opts) ->
@@ -23,7 +21,7 @@ init(Req, _Opts) ->
 trails() ->
   [
     #{
-      path => <<"/v1/auth/refresh">>,
+      path => <<"/v1/refresh">>,
       method => <<"POST">>,
       description => <<"Refresh user access token using refresh token">>,
       tags => [<<"Auth">>],
@@ -67,36 +65,31 @@ token_pair_schema() ->
 %%% HTTP-методы
 %%%===================================================================
 
-%% @doc POST /v1/auth/refresh — обновление пользовательского токена.
+%% @doc POST /v1/refresh — обновление пользовательского токена.
 -spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
 refresh(Req) ->
   {ok, Body, Req1} = cowboy_req:read_body(Req),
   try jsx:decode(Body, [return_maps]) of
     #{<<"refresh_token">> := RefreshToken} ->
-      case core_session:validate(RefreshToken) of
+      case logic_auth_session:refresh_user(RefreshToken) of
-        {ok, UserId, User} ->
+        {ok, NewToken, NewRefreshToken} ->
-          user_refresh(UserId, User, RefreshToken, Req1);
+          handler_utils:send_json(Req1, 200, #{
+            token => NewToken,
+            refresh_token => NewRefreshToken
+          });
+        {error, reuse_detected} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
         {error, not_found} ->
           handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
         {error, expired} ->
-          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
+          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
+        {error, revoked} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
+        {error, _} ->
+          handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
       end;
     _ ->
       handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
   catch
     _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
   end.
-
-%%%===================================================================
-%%% Внутренние функции
-%%%===================================================================
-
-%% @private Обновляет токен для обычного пользователя.
--spec user_refresh(binary(), #user{}, binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
-user_refresh(UserId, User, OldToken, Req) ->
-  core_session:delete(OldToken),
-  Role = atom_to_binary(User#user.role, utf8),
-  NewToken = eventhub_auth:generate_user_token(UserId, Role),
-  {NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
-  core_session:create(UserId, NewRefreshToken),
-  handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).

src/infra/eventhub_auth.erl

@@ -8,7 +8,9 @@
   authenticate_admin_request/3,
   generate_refresh_token/1,
   generate_admin_refresh_token/5,
-  verify_admin_refresh_token/1
+  verify_admin_refresh_token/1,
+  generate_user_refresh_token/5,
+  verify_user_refresh_token/1
 ]).
 
 %% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
@@ -150,7 +152,7 @@ is_admin_role(Role) ->
 
 -define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
 
-%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ==========
+%% ========== REFRESH TOKEN (opaque, legacy — не используется login/refresh user с фазы 2) ==========
 
 -spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
 generate_refresh_token(_UserId) ->
@@ -180,6 +182,23 @@ generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
 verify_admin_refresh_token(Token) ->
   verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
 
+-spec generate_user_refresh_token(
+  SessionId :: binary(),
+  FamilyId :: binary(),
+  Jti :: binary(),
+  SubjectId :: binary(),
+  ClientType :: binary()
+) -> {binary(), calendar:datetime()}.
+generate_user_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
+  generate_refresh_jwt(
+    get_user_jwk(), SubjectId, <<"user">>, SessionId, FamilyId, Jti, ClientType
+  ).
+
+-spec verify_user_refresh_token(Token :: binary()) ->
+  {ok, map()} | {error, atom()}.
+verify_user_refresh_token(Token) ->
+  verify_refresh_jwt(get_user_jwk(), Token, <<"user">>).
+
 generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
   ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
   Claims = #{

src/logic/logic_auth_session.erl

@@ -1,58 +1,86 @@
 %%%-------------------------------------------------------------------
 %%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
-%%% Фаза 1: admin API. Фазы 2–3: user / client web / mobile.
+%%% Фаза 1: admin API. Фаза 2: user API. Фаза 3: client web + mobile.
 %%% @end
 %%%-------------------------------------------------------------------
 -module(logic_auth_session).
 -include("records.hrl").
--export([issue_admin_tokens/2, refresh_admin/1]).
+-export([issue_admin_tokens/2, refresh_admin/1,
+  issue_user_tokens/2, refresh_user/1]).
+
+-define(USER_CLIENT_WEB, <<"web">>).
 
 %%%-------------------------------------------------------------------
-%%% @doc Выдать пару access + refresh JWT при входе администратора.
+%%% Admin (фаза 1)
-%%% @end
 %%%-------------------------------------------------------------------
+
 -spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
   {ok, AccessToken :: binary(), RefreshToken :: binary()}.
 issue_admin_tokens(AdminId, Role) ->
-  {ok, Session} = core_auth_session:create(AdminId, admin, <<"admin">>),
+  issue_tokens(AdminId, admin, <<"admin">>, Role, fun eventhub_auth:generate_admin_token/2,
-  AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
+    fun eventhub_auth:generate_admin_refresh_token/5).
-  {RefreshToken, _} = eventhub_auth:generate_admin_refresh_token(
-    Session#auth_session.session_id,
-    Session#auth_session.family_id,
-    Session#auth_session.current_jti,
-    AdminId,
-    <<"admin">>
-  ),
-  {ok, AccessToken, RefreshToken}.
 
-%%%-------------------------------------------------------------------
-%%% @doc Обновить пару токенов администратора по refresh JWT.
-%%% @end
-%%%-------------------------------------------------------------------
 -spec refresh_admin(RefreshToken :: binary()) ->
   {ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
   {error, atom()}.
 refresh_admin(RefreshToken) ->
-  case eventhub_auth:verify_admin_refresh_token(RefreshToken) of
+  refresh_subject(RefreshToken, fun eventhub_auth:verify_admin_refresh_token/1,
+    fun core_admin:get_by_id/1, admin, fun eventhub_auth:generate_admin_token/2,
+    fun eventhub_auth:generate_admin_refresh_token/5, <<"admin">>).
+
+%%%-------------------------------------------------------------------
+%%% User (фаза 2)
+%%%-------------------------------------------------------------------
+
+-spec issue_user_tokens(UserId :: binary(), Role :: binary()) ->
+  {ok, AccessToken :: binary(), RefreshToken :: binary()}.
+issue_user_tokens(UserId, Role) ->
+  issue_tokens(UserId, user, ?USER_CLIENT_WEB, Role, fun eventhub_auth:generate_user_token/2,
+    fun eventhub_auth:generate_user_refresh_token/5).
+
+-spec refresh_user(RefreshToken :: binary()) ->
+  {ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
+  {error, atom()}.
+refresh_user(RefreshToken) ->
+  refresh_subject(RefreshToken, fun eventhub_auth:verify_user_refresh_token/1,
+    fun core_user:get_by_id/1, user, fun eventhub_auth:generate_user_token/2,
+    fun eventhub_auth:generate_user_refresh_token/5, ?USER_CLIENT_WEB).
+
+%%%===================================================================
+%%% Internal
+%%%===================================================================
+
+issue_tokens(SubjectId, SubjectType, ClientType, Role, GenAccess, GenRefresh) ->
+  {ok, Session} = core_auth_session:create(SubjectId, SubjectType, ClientType),
+  AccessToken = GenAccess(SubjectId, Role),
+  {RefreshToken, _} = GenRefresh(
+    Session#auth_session.session_id,
+    Session#auth_session.family_id,
+    Session#auth_session.current_jti,
+    SubjectId,
+    ClientType
+  ),
+  {ok, AccessToken, RefreshToken}.
+
+refresh_subject(RefreshToken, VerifyFn, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
+  case VerifyFn(RefreshToken) of
     {ok, Claims} ->
-      do_refresh_admin(Claims);
+      do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType);
     Error ->
       Error
   end.
 
-do_refresh_admin(Claims) ->
+do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
   SessionId = maps:get(<<"sid">>, Claims),
   Jti = maps:get(<<"jti">>, Claims),
-  AdminId = maps:get(<<"sub">>, Claims),
+  SubjectId = maps:get(<<"sub">>, Claims),
   FamilyId = maps:get(<<"fid">>, Claims),
   case core_auth_session:rotate(SessionId, Jti) of
     {ok, NewJti, _Session} ->
-      {ok, Admin} = core_admin:get_by_id(AdminId),
+      {ok, Subject} = GetSubjectFn(SubjectId),
-      Role = atom_to_binary(Admin#admin.role, utf8),
+      Role = subject_role(Subject, SubjectType),
-      AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
+      AccessToken = GenAccess(SubjectId, Role),
-      {NewRefresh, _} = eventhub_auth:generate_admin_refresh_token(
+      {NewRefresh, _} = GenRefresh(SessionId, FamilyId, NewJti, SubjectId, ClientType),
-        SessionId, FamilyId, NewJti, AdminId, <<"admin">>
-      ),
       {ok, AccessToken, NewRefresh};
     {error, reuse_detected} ->
       core_auth_session:revoke_family(FamilyId),
@@ -60,3 +88,8 @@ do_refresh_admin(Claims) ->
     Error ->
       Error
   end.
+
+subject_role(#admin{role = Role}, admin) ->
+  atom_to_binary(Role, utf8);
+subject_role(#user{role = Role}, user) ->
+  atom_to_binary(Role, utf8).

test/unit/auth_test.erl

@@ -156,12 +156,36 @@ admin_refresh_jwt_test_() ->
         ?assertEqual(Jti, maps:get(<<"jti">>, Claims)),
         ?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims))
       end},
-    {"User refresh JWT rejected by admin verifier",
+    {"Admin refresh JWT rejected by user verifier",
       fun() ->
         {Token, _} = eventhub_auth:generate_admin_refresh_token(
-          <<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"admin">>
+          <<"s">>, <<"f">>, <<"j">>, <<"a">>, <<"admin">>
         ),
         ?assertMatch({error, invalid_signature},
-          eventhub_auth:verify_user_token(Token))
+          eventhub_auth:verify_user_refresh_token(Token))
+      end}
+  ]}.
+
+user_refresh_jwt_test_() ->
+  {setup, fun setup/0, fun cleanup/1, [
+    {"Generate and verify user refresh JWT",
+      fun() ->
+        Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
+        {Token, _} = eventhub_auth:generate_user_refresh_token(
+          Sid, Fid, Jti, <<"user1">>, <<"web">>
+        ),
+        ?assert(is_binary(Token)),
+        {ok, Claims} = eventhub_auth:verify_user_refresh_token(Token),
+        ?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
+        ?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
+        ?assertEqual(<<"web">>, maps:get(<<"client">>, Claims))
+      end},
+    {"User refresh JWT rejected by admin verifier",
+      fun() ->
+        {Token, _} = eventhub_auth:generate_user_refresh_token(
+          <<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"web">>
+        ),
+        ?assertMatch({error, invalid_signature},
+          eventhub_auth:verify_admin_refresh_token(Token))
       end}
   ]}.

test/unit/logic_auth_session_tests.erl

@@ -3,9 +3,11 @@
 -include("records.hrl").
 
 -define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
+-define(USER_JWT_SECRET, <<"test-user-secret-key-32-by">>).
 
 setup() ->
   ok = meck:new(core_admin, [non_strict]),
+  ok = meck:new(core_user, [non_strict]),
   mnesia:start(),
   catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
   mnesia:create_table(auth_session, [
@@ -15,13 +17,16 @@ setup() ->
   mnesia:add_table_index(auth_session, #auth_session.family_id),
   mnesia:add_table_index(auth_session, #auth_session.subject_id),
   application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
+  application:set_env(eventhub, jwt_secret, ?USER_JWT_SECRET),
   {ok, _} = application:ensure_all_started(jose),
   ok.
 
 cleanup(_) ->
   application:unset_env(eventhub, admin_jwt_secret),
+  application:unset_env(eventhub, jwt_secret),
   application:stop(jose),
   meck:unload(core_admin),
+  meck:unload(core_user),
   catch mnesia:delete_table(auth_session),
   catch ets:delete(eventhub_counters),
   mnesia:stop(),
@@ -29,11 +34,13 @@ cleanup(_) ->
 
 logic_auth_session_test_() ->
   {foreach, fun setup/0, fun cleanup/1, [
-    {"Issue and refresh admin tokens", fun test_issue_and_refresh/0},
+    {"Issue and refresh admin tokens", fun test_issue_and_refresh_admin/0},
-    {"Refresh reuse revokes family", fun test_reuse_revokes/0}
+    {"Refresh admin reuse revokes family", fun test_admin_reuse_revokes/0},
+    {"Issue and refresh user tokens", fun test_issue_and_refresh_user/0},
+    {"Refresh user reuse revokes family", fun test_user_reuse_revokes/0}
   ]}.
 
-test_issue_and_refresh() ->
+test_issue_and_refresh_admin() ->
   AdminId = <<"adm1">>,
   Admin = #admin{
     id = AdminId, email = <<"a@test.com">>, role = superadmin,
@@ -53,7 +60,7 @@ test_issue_and_refresh() ->
   ?assertNotEqual(Refresh1, Refresh2),
   {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
 
-test_reuse_revokes() ->
+test_admin_reuse_revokes() ->
   AdminId = <<"adm1">>,
   Admin = #admin{
     id = AdminId, email = <<"a@test.com">>, role = admin,
@@ -67,3 +74,41 @@ test_reuse_revokes() ->
   {ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
   ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
   ?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
+
+test_issue_and_refresh_user() ->
+  UserId = <<"usr1">>,
+  User = #user{
+    id = UserId, email = <<"u@test.com">>, role = user,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_user, get_by_id, fun(Id) ->
+    ?assertEqual(UserId, Id), {ok, User}
+  end),
+  {ok, Access1, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
+  ?assert(is_binary(Access1)),
+  {ok, _, _} = eventhub_auth:verify_user_token(Access1),
+  {ok, Claims} = eventhub_auth:verify_user_refresh_token(Refresh1),
+  ?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
+  ?assertEqual(<<"web">>, maps:get(<<"client">>, Claims)),
+  {ok, Access2, Refresh2} = logic_auth_session:refresh_user(Refresh1),
+  ?assert(is_binary(Access2)),
+  ?assertNotEqual(Refresh1, Refresh2),
+  {ok, _, _} = eventhub_auth:verify_user_token(Access2).
+
+test_user_reuse_revokes() ->
+  UserId = <<"usr1">>,
+  User = #user{
+    id = UserId, email = <<"u@test.com">>, role = user,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_user, get_by_id, fun(_) -> {ok, User} end),
+  {ok, _, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
+  {ok, _, Refresh2} = logic_auth_session:refresh_user(Refresh1),
+  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_user(Refresh1)),
+  ?assertMatch({error, revoked}, logic_auth_session:refresh_user(Refresh2)).