EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

User login and refresh on auth_session (phase 2). Refs EventHub/EventHubBack#26

Browse Source
This commit is contained in:
Aleksey Sabilin
2026-07-07 19:33:24 +03:00
parent 7c5f2d26b8
commit 018bf85b87
6 changed files with 862 additions and 748 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/handlers/handler_login.erl
+105 -105
View File
@@ -1,106 +1,106 @@
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
%%% @doc Обработчик входа пользователя (клиентский API). %%% @doc Обработчик входа пользователя (клиентский API).
%%% POST – аутентифицирует пользователя по email и паролю, %%% POST – аутентифицирует пользователя по email и паролю,
%%% возвращает JWT токен и refresh токен. %%% возвращает JWT токен и refresh токен.
%%% @end %%% @end
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
-module(handler_login). -module(handler_login).
-behaviour(cowboy_handler). -behaviour(cowboy_handler).
-export([init/2]). -export([init/2]).
-export([trails/0]). -export([trails/0]).
-include("records.hrl"). -include("records.hrl").
%%% cowboy_handler callback %%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}. -spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
init(Req, Opts) -> init(Req, Opts) ->
handle(Req, Opts). handle(Req, Opts).
%%% Swagger metadata %%% Swagger metadata
-spec trails() -> [map()]. -spec trails() -> [map()].
trails() -> trails() ->
[ [
#{ #{
path => <<"/v1/login">>, path => <<"/v1/login">>,
method => <<"POST">>, method => <<"POST">>,
description => <<"User login">>, description => <<"User login">>,
tags => [<<"Auth">>], tags => [<<"Auth">>],
requestBody => #{ requestBody => #{
required => true, required => true,
content => #{<<"application/json">> => #{schema => #{ content => #{<<"application/json">> => #{schema => #{
type => object, type => object,
required => [<<"email">>, <<"password">>], required => [<<"email">>, <<"password">>],
properties => #{ properties => #{
email => #{type => string, format => <<"email">>}, email => #{type => string, format => <<"email">>},
password => #{type => string, format => <<"password">>} password => #{type => string, format => <<"password">>}
} }
}}} }}}
}, },
responses => #{ responses => #{
200 => #{description => <<"Login successful, returns token and user info">>}, 200 => #{description => <<"Login successful, returns token and user info">>},
400 => #{description => <<"Missing email or password, or invalid JSON">>}, 400 => #{description => <<"Missing email or password, or invalid JSON">>},
401 => #{description => <<"Invalid credentials">>}, 401 => #{description => <<"Invalid credentials">>},
403 => #{description => <<"Account frozen or deleted">>} 403 => #{description => <<"Account frozen or deleted">>}
} }
} }
]. ].
%%%=================================================================== %%%===================================================================
%%% HTTP-методы %%% HTTP-методы
%%%=================================================================== %%%===================================================================
%% @private %% @private
-spec handle(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}. -spec handle(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
handle(Req, _Opts) -> handle(Req, _Opts) ->
case cowboy_req:method(Req) of case cowboy_req:method(Req) of
<<"POST">> -> login(Req); <<"POST">> -> login(Req);
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>) _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end. end.
%% @doc POST /v1/login — аутентификация пользователя. %% @doc POST /v1/login — аутентификация пользователя.
-spec login(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}. -spec login(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
login(Req) -> login(Req) ->
case cowboy_req:has_body(Req) of case cowboy_req:has_body(Req) of
true -> true ->
{ok, Body, Req1} = cowboy_req:read_body(Req), {ok, Body, Req1} = cowboy_req:read_body(Req),
case Body of case Body of
<<>> -> <<>> ->
handler_utils:send_error(Req1, 400, <<"Empty request body">>); handler_utils:send_error(Req1, 400, <<"Empty request body">>);
_ -> _ ->
try jsx:decode(Body, [return_maps]) of try jsx:decode(Body, [return_maps]) of
#{<<"email">> := Email, <<"password">> := Password} -> #{<<"email">> := Email, <<"password">> := Password} ->
case eventhub_auth:authenticate_user_request(Req1, Email, Password) of case eventhub_auth:authenticate_user_request(Req1, Email, Password) of
{ok, Token, User} -> {ok, _Token, User} ->
UserId = maps:get(id, User), UserId = maps:get(id, User),
{RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId), Role = maps:get(role, User),
core_session:create(UserId, RefreshToken), {ok, Token, RefreshToken} = logic_auth_session:issue_user_tokens(UserId, Role),
core_user:update_last_login(UserId), core_user:update_last_login(UserId),
Response = #{ Response = #{
<<"token">> => Token, <<"token">> => Token,
<<"user">> => #{ <<"user">> => #{
<<"id">> => UserId, <<"id">> => UserId,
<<"email">> => maps:get(email, User), <<"email">> => maps:get(email, User),
<<"role">> => maps:get(role, User) <<"role">> => maps:get(role, User)
}, },
<<"refresh_token">> => RefreshToken <<"refresh_token">> => RefreshToken
}, },
handler_utils:send_json(Req1, 200, Response); handler_utils:send_json(Req1, 200, Response);
{error, not_verified} -> {error, not_verified} ->
handler_utils:send_error(Req1, 403, <<"Account not verified">>); handler_utils:send_error(Req1, 403, <<"Account not verified">>);
{error, frozen} -> {error, frozen} ->
handler_utils:send_error(Req1, 403, <<"Account frozen">>); handler_utils:send_error(Req1, 403, <<"Account frozen">>);
{error, deleted} -> {error, deleted} ->
handler_utils:send_error(Req1, 403, <<"Account deleted">>); handler_utils:send_error(Req1, 403, <<"Account deleted">>);
{error, _Reason} -> {error, _Reason} ->
handler_utils:send_error(Req1, 401, <<"Invalid credentials">>) handler_utils:send_error(Req1, 401, <<"Invalid credentials">>)
end; end;
_ -> _ ->
handler_utils:send_error(Req1, 400, <<"Missing email or password">>) handler_utils:send_error(Req1, 400, <<"Missing email or password">>)
catch catch
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>) _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
end end
end; end;
false -> false ->
handler_utils:send_error(Req, 400, <<"Missing request body">>) handler_utils:send_error(Req, 400, <<"Missing request body">>)
end. end.
src/handlers/handler_refresh.erl
+95 -102
View File
@@ -1,102 +1,95 @@
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
%%% @doc Обработчик обновления токена (клиентский API). %%% @doc Обработчик обновления токена (клиентский API).
%%% POST – принимает refresh_token, возвращает новую пару access + refresh токенов. %%% POST – принимает refresh_token, возвращает новую пару access + refresh токенов.
%%% @end %%% @end
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
-module(handler_refresh). -module(handler_refresh).
-behaviour(cowboy_handler). -behaviour(cowboy_handler).
-export([init/2]). -export([init/2]).
-export([trails/0]). -export([trails/0]).
-include("records.hrl"). %%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
%%% cowboy_handler callback init(Req, _Opts) ->
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}. case cowboy_req:method(Req) of
init(Req, _Opts) -> <<"POST">> -> refresh(Req);
case cowboy_req:method(Req) of _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
<<"POST">> -> refresh(Req); end.
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end. %%% Swagger metadata
-spec trails() -> [map()].
%%% Swagger metadata trails() ->
-spec trails() -> [map()]. [
trails() -> #{
[ path => <<"/v1/refresh">>,
#{ method => <<"POST">>,
path => <<"/v1/auth/refresh">>, description => <<"Refresh user access token using refresh token">>,
method => <<"POST">>, tags => [<<"Auth">>],
description => <<"Refresh user access token using refresh token">>, requestBody => #{
tags => [<<"Auth">>], required => true,
requestBody => #{ content => #{
required => true, <<"application/json">> => #{
content => #{ schema => #{
<<"application/json">> => #{ type => object,
schema => #{ required => [<<"refresh_token">>],
type => object, properties => #{refresh_token => #{type => string}}
required => [<<"refresh_token">>], }
properties => #{refresh_token => #{type => string}} }
} }
} },
} responses => #{
}, 200 => #{
responses => #{ description => <<"New user token pair (access + refresh)">>,
200 => #{ content => #{
description => <<"New user token pair (access + refresh)">>, <<"application/json">> => #{
content => #{ schema => token_pair_schema()
<<"application/json">> => #{ }
schema => token_pair_schema() }
} },
} 400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
}, 401 => #{description => <<"Refresh token expired or not found">>}
400 => #{description => <<"Missing refresh_token field or invalid JSON">>}, }
401 => #{description => <<"Refresh token expired or not found">>} }
} ].
}
]. token_pair_schema() ->
#{
token_pair_schema() -> type => object,
#{ properties => #{
type => object, token => #{type => string, description => <<"JWT access token">>},
properties => #{ refresh_token => #{type => string, description => <<"Refresh token">>}
token => #{type => string, description => <<"JWT access token">>}, }
refresh_token => #{type => string, description => <<"Refresh token">>} }.
}
}. %%%===================================================================
%%% HTTP-методы
%%%=================================================================== %%%===================================================================
%%% HTTP-методы
%%%=================================================================== %% @doc POST /v1/refresh — обновление пользовательского токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
%% @doc POST /v1/auth/refresh — обновление пользовательского токена. refresh(Req) ->
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}. {ok, Body, Req1} = cowboy_req:read_body(Req),
refresh(Req) -> try jsx:decode(Body, [return_maps]) of
{ok, Body, Req1} = cowboy_req:read_body(Req), #{<<"refresh_token">> := RefreshToken} ->
try jsx:decode(Body, [return_maps]) of case logic_auth_session:refresh_user(RefreshToken) of
#{<<"refresh_token">> := RefreshToken} -> {ok, NewToken, NewRefreshToken} ->
case core_session:validate(RefreshToken) of handler_utils:send_json(Req1, 200, #{
{ok, UserId, User} -> token => NewToken,
user_refresh(UserId, User, RefreshToken, Req1); refresh_token => NewRefreshToken
{error, not_found} -> });
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>); {error, reuse_detected} ->
{error, expired} -> handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>) {error, not_found} ->
end; handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
_ -> {error, expired} ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>) handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
catch {error, revoked} ->
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>) handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
end. {error, _} ->
handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
%%%=================================================================== end;
%%% Внутренние функции _ ->
%%%=================================================================== handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
catch
%% @private Обновляет токен для обычного пользователя. _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
-spec user_refresh(binary(), #user{}, binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}. end.
user_refresh(UserId, User, OldToken, Req) ->
core_session:delete(OldToken),
Role = atom_to_binary(User#user.role, utf8),
NewToken = eventhub_auth:generate_user_token(UserId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_session:create(UserId, NewRefreshToken),
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
src/infra/eventhub_auth.erl
+263 -244
View File
@@ -1,245 +1,264 @@
-module(eventhub_auth). -module(eventhub_auth).
-export([ -export([
generate_user_token/2, generate_user_token/2,
generate_admin_token/2, generate_admin_token/2,
verify_user_token/1, verify_user_token/1,
verify_admin_token/1, verify_admin_token/1,
authenticate_user_request/3, authenticate_user_request/3,
authenticate_admin_request/3, authenticate_admin_request/3,
generate_refresh_token/1, generate_refresh_token/1,
generate_admin_refresh_token/5, generate_admin_refresh_token/5,
verify_admin_refresh_token/1 verify_admin_refresh_token/1,
]). generate_user_refresh_token/5,
verify_user_refresh_token/1
%% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ========== ]).
-spec get_user_secret() -> binary(). %% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
get_user_secret() ->
case application:get_env(eventhub, jwt_secret) of -spec get_user_secret() -> binary().
{ok, Secret} when is_binary(Secret) -> Secret; get_user_secret() ->
undefined -> get_user_secret_from_env() case application:get_env(eventhub, jwt_secret) of
end. {ok, Secret} when is_binary(Secret) -> Secret;
undefined -> get_user_secret_from_env()
get_user_secret_from_env() -> end.
case os:getenv("JWT_SECRET") of
false -> <<"user-secret-key-32-bytes-minimum!">>; get_user_secret_from_env() ->
S -> list_to_binary(S) case os:getenv("JWT_SECRET") of
end. false -> <<"user-secret-key-32-bytes-minimum!">>;
S -> list_to_binary(S)
-spec get_admin_secret() -> binary(). end.
get_admin_secret() ->
case application:get_env(eventhub, admin_jwt_secret) of -spec get_admin_secret() -> binary().
{ok, Secret} when is_binary(Secret) -> Secret; get_admin_secret() ->
undefined -> get_admin_secret_from_env() case application:get_env(eventhub, admin_jwt_secret) of
end. {ok, Secret} when is_binary(Secret) -> Secret;
undefined -> get_admin_secret_from_env()
get_admin_secret_from_env() -> end.
case os:getenv("ADMIN_JWT_SECRET") of
false -> <<"admin-secret-key-32-bytes-minimum!">>; get_admin_secret_from_env() ->
S -> list_to_binary(S) case os:getenv("ADMIN_JWT_SECRET") of
end. false -> <<"admin-secret-key-32-bytes-minimum!">>;
S -> list_to_binary(S)
-spec get_user_jwk() -> jose_jwk:key(). end.
get_user_jwk() -> jose_jwk:from_oct(get_user_secret()).
-spec get_user_jwk() -> jose_jwk:key().
-spec get_admin_jwk() -> jose_jwk:key(). get_user_jwk() -> jose_jwk:from_oct(get_user_secret()).
get_admin_jwk() -> jose_jwk:from_oct(get_admin_secret()).
-spec get_admin_jwk() -> jose_jwk:key().
%% ========== ГЕНЕРАЦИЯ ТОКЕНОВ ========== get_admin_jwk() -> jose_jwk:from_oct(get_admin_secret()).
-spec generate_user_token(UserId :: binary(), Role :: binary()) -> binary(). %% ========== ГЕНЕРАЦИЯ ТОКЕНОВ ==========
generate_user_token(UserId, Role) ->
generate_token(get_user_jwk(), UserId, Role, <<"user">>). -spec generate_user_token(UserId :: binary(), Role :: binary()) -> binary().
generate_user_token(UserId, Role) ->
-spec generate_admin_token(UserId :: binary(), Role :: binary()) -> binary(). generate_token(get_user_jwk(), UserId, Role, <<"user">>).
generate_admin_token(UserId, Role) ->
generate_token(get_admin_jwk(), UserId, Role, <<"admin">>). -spec generate_admin_token(UserId :: binary(), Role :: binary()) -> binary().
generate_admin_token(UserId, Role) ->
generate_token(JWK, UserId, Role, Audience) -> generate_token(get_admin_jwk(), UserId, Role, <<"admin">>).
ExpTime = erlang:system_time(second) + 86400,
Claims = #{ generate_token(JWK, UserId, Role, Audience) ->
<<"user_id">> => UserId, ExpTime = erlang:system_time(second) + 86400,
<<"role">> => Role, Claims = #{
<<"aud">> => Audience, <<"user_id">> => UserId,
<<"exp">> => ExpTime, <<"role">> => Role,
<<"iat">> => erlang:system_time(second) <<"aud">> => Audience,
}, <<"exp">> => ExpTime,
JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims), <<"iat">> => erlang:system_time(second)
{_, Token} = jose_jws:compact(JWT), },
Token. JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
{_, Token} = jose_jws:compact(JWT),
%% ========== ПРОВЕРКА ТОКЕНОВ ========== Token.
-spec verify_user_token(Token :: binary()) -> %% ========== ПРОВЕРКА ТОКЕНОВ ==========
{ok, UserId :: binary(), Role :: binary()} | {error, atom()}.
verify_user_token(Token) -> -spec verify_user_token(Token :: binary()) ->
verify_token(get_user_jwk(), Token, <<"user">>). {ok, UserId :: binary(), Role :: binary()} | {error, atom()}.
verify_user_token(Token) ->
-spec verify_admin_token(Token :: binary()) -> verify_token(get_user_jwk(), Token, <<"user">>).
{ok, UserId :: binary(), Role :: binary()} | {error, atom()}.
verify_admin_token(Token) -> -spec verify_admin_token(Token :: binary()) ->
verify_token(get_admin_jwk(), Token, <<"admin">>). {ok, UserId :: binary(), Role :: binary()} | {error, atom()}.
verify_admin_token(Token) ->
verify_token(JWK, Token, ExpectedAud) -> verify_token(get_admin_jwk(), Token, <<"admin">>).
try
case jose_jwt:verify(JWK, Token) of verify_token(JWK, Token, ExpectedAud) ->
{true, {jose_jwt, Claims}, _} -> try
validate_claims(Claims, ExpectedAud); case jose_jwt:verify(JWK, Token) of
{true, Claims, _} when is_map(Claims) -> {true, {jose_jwt, Claims}, _} ->
validate_claims(Claims, ExpectedAud); validate_claims(Claims, ExpectedAud);
_ -> {true, Claims, _} when is_map(Claims) ->
{error, invalid_signature} validate_claims(Claims, ExpectedAud);
end _ ->
catch {error, invalid_signature}
_:_ -> {error, invalid_token} end
end. catch
_:_ -> {error, invalid_token}
validate_claims(Claims, ExpectedAud) -> end.
case maps:find(<<"aud">>, Claims) of
{ok, ExpectedAud} -> validate_claims(Claims, ExpectedAud) ->
case maps:find(<<"exp">>, Claims) of case maps:find(<<"aud">>, Claims) of
{ok, Exp} when is_integer(Exp) -> {ok, ExpectedAud} ->
Now = erlang:system_time(second), case maps:find(<<"exp">>, Claims) of
if {ok, Exp} when is_integer(Exp) ->
Exp > Now -> Now = erlang:system_time(second),
UserId = maps:get(<<"user_id">>, Claims, undefined), if
Role = maps:get(<<"role">>, Claims, <<"user">>), Exp > Now ->
{ok, UserId, Role}; UserId = maps:get(<<"user_id">>, Claims, undefined),
true -> Role = maps:get(<<"role">>, Claims, <<"user">>),
{error, expired} {ok, UserId, Role};
end; true ->
{ok, _Exp} -> {error, expired}; {error, expired}
_ -> {error, no_expiration} end;
end; {ok, _Exp} -> {error, expired};
{ok, _} -> {error, invalid_audience}; _ -> {error, no_expiration}
error -> {error, missing_audience} end;
end. {ok, _} -> {error, invalid_audience};
error -> {error, missing_audience}
%% ========== АУТЕНТИФИКАЦИЯ ЗАПРОСА ========== end.
-spec authenticate_user_request(Req :: cowboy_req:req(), Email :: binary(), Password :: binary()) -> %% ========== АУТЕНТИФИКАЦИЯ ЗАПРОСА ==========
{ok, Token :: binary(), User :: map()} | {error, atom()}.
authenticate_user_request(_Req, Email, Password) -> -spec authenticate_user_request(Req :: cowboy_req:req(), Email :: binary(), Password :: binary()) ->
case logic_auth:authenticate_user(Email, Password) of {ok, Token :: binary(), User :: map()} | {error, atom()}.
{ok, User} -> authenticate_user_request(_Req, Email, Password) ->
UserId = maps:get(id, User), case logic_auth:authenticate_user(Email, Password) of
Role = maps:get(role, User, <<"user">>), {ok, User} ->
Token = generate_user_token(UserId, Role), UserId = maps:get(id, User),
{ok, Token, User}; Role = maps:get(role, User, <<"user">>),
Error -> Error Token = generate_user_token(UserId, Role),
end. {ok, Token, User};
Error -> Error
-spec authenticate_admin_request(Req :: cowboy_req:req(), Email :: binary(), Password :: binary()) -> end.
{ok, Token :: binary(), User :: map()} | {error, atom()}.
authenticate_admin_request(_Req, Email, Password) -> -spec authenticate_admin_request(Req :: cowboy_req:req(), Email :: binary(), Password :: binary()) ->
case logic_auth:authenticate_admin(Email, Password) of {ok, Token :: binary(), User :: map()} | {error, atom()}.
{ok, AdminMap} -> authenticate_admin_request(_Req, Email, Password) ->
Role = maps:get(role, AdminMap, <<"admin">>), case logic_auth:authenticate_admin(Email, Password) of
case is_admin_role(Role) of {ok, AdminMap} ->
true -> Role = maps:get(role, AdminMap, <<"admin">>),
AdminId = maps:get(id, AdminMap), case is_admin_role(Role) of
Token = generate_admin_token(AdminId, Role), true ->
{ok, Token, AdminMap}; AdminId = maps:get(id, AdminMap),
false -> {error, insufficient_permissions} Token = generate_admin_token(AdminId, Role),
end; {ok, Token, AdminMap};
Error -> Error false -> {error, insufficient_permissions}
end. end;
Error -> Error
is_admin_role(Role) -> end.
lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
is_admin_role(Role) ->
-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600). lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ========== -define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
-spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}. %% ========== REFRESH TOKEN (opaque, legacy — не используется login/refresh user с фазы 2) ==========
generate_refresh_token(_UserId) ->
RefreshToken = base64:encode(crypto:strong_rand_bytes(32)), -spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
Now = calendar:universal_time(), generate_refresh_token(_UserId) ->
ExpiresAt = calendar:gregorian_seconds_to_datetime( RefreshToken = base64:encode(crypto:strong_rand_bytes(32)),
calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS Now = calendar:universal_time(),
), ExpiresAt = calendar:gregorian_seconds_to_datetime(
{RefreshToken, ExpiresAt}. calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
),
%% ========== REFRESH JWT (единая session-модель) ========== {RefreshToken, ExpiresAt}.
-spec generate_admin_refresh_token( %% ========== REFRESH JWT (единая session-модель) ==========
SessionId :: binary(),
FamilyId :: binary(), -spec generate_admin_refresh_token(
Jti :: binary(), SessionId :: binary(),
SubjectId :: binary(), FamilyId :: binary(),
ClientType :: binary() Jti :: binary(),
) -> {binary(), calendar:datetime()}. SubjectId :: binary(),
generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) -> ClientType :: binary()
generate_refresh_jwt( ) -> {binary(), calendar:datetime()}.
get_admin_jwk(), SubjectId, <<"admin">>, SessionId, FamilyId, Jti, ClientType generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
). generate_refresh_jwt(
get_admin_jwk(), SubjectId, <<"admin">>, SessionId, FamilyId, Jti, ClientType
-spec verify_admin_refresh_token(Token :: binary()) -> ).
{ok, map()} | {error, atom()}.
verify_admin_refresh_token(Token) -> -spec verify_admin_refresh_token(Token :: binary()) ->
verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>). {ok, map()} | {error, atom()}.
verify_admin_refresh_token(Token) ->
generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) -> verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
Claims = #{ -spec generate_user_refresh_token(
<<"typ">> => <<"refresh">>, SessionId :: binary(),
<<"sub">> => SubjectId, FamilyId :: binary(),
<<"aud">> => Audience, Jti :: binary(),
<<"sid">> => SessionId, SubjectId :: binary(),
<<"fid">> => FamilyId, ClientType :: binary()
<<"jti">> => Jti, ) -> {binary(), calendar:datetime()}.
<<"client">> => ClientType, generate_user_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
<<"exp">> => ExpTime, generate_refresh_jwt(
<<"iat">> => erlang:system_time(second) get_user_jwk(), SubjectId, <<"user">>, SessionId, FamilyId, Jti, ClientType
}, ).
JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
{_, Token} = jose_jws:compact(JWT), -spec verify_user_refresh_token(Token :: binary()) ->
ExpiresAt = calendar:gregorian_seconds_to_datetime( {ok, map()} | {error, atom()}.
calendar:datetime_to_gregorian_seconds(calendar:universal_time()) + ?REFRESH_TTL_SECONDS verify_user_refresh_token(Token) ->
), verify_refresh_jwt(get_user_jwk(), Token, <<"user">>).
{Token, ExpiresAt}.
generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
verify_refresh_jwt(JWK, Token, ExpectedAud) -> ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
try Claims = #{
case jose_jwt:verify(JWK, Token) of <<"typ">> => <<"refresh">>,
{true, {jose_jwt, Claims}, _} -> <<"sub">> => SubjectId,
validate_refresh_claims(Claims, ExpectedAud); <<"aud">> => Audience,
{true, Claims, _} when is_map(Claims) -> <<"sid">> => SessionId,
validate_refresh_claims(Claims, ExpectedAud); <<"fid">> => FamilyId,
_ -> <<"jti">> => Jti,
{error, invalid_signature} <<"client">> => ClientType,
end <<"exp">> => ExpTime,
catch <<"iat">> => erlang:system_time(second)
_:_ -> {error, invalid_token} },
end. JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
{_, Token} = jose_jws:compact(JWT),
validate_refresh_claims(Claims, ExpectedAud) -> ExpiresAt = calendar:gregorian_seconds_to_datetime(
case maps:get(<<"typ">>, Claims, undefined) of calendar:datetime_to_gregorian_seconds(calendar:universal_time()) + ?REFRESH_TTL_SECONDS
<<"refresh">> -> ),
case maps:get(<<"aud">>, Claims, undefined) of {Token, ExpiresAt}.
ExpectedAud ->
validate_refresh_exp(Claims); verify_refresh_jwt(JWK, Token, ExpectedAud) ->
_ -> try
{error, invalid_audience} case jose_jwt:verify(JWK, Token) of
end; {true, {jose_jwt, Claims}, _} ->
_ -> validate_refresh_claims(Claims, ExpectedAud);
{error, invalid_token_type} {true, Claims, _} when is_map(Claims) ->
end. validate_refresh_claims(Claims, ExpectedAud);
_ ->
validate_refresh_exp(Claims) -> {error, invalid_signature}
Required = [<<"sid">>, <<"fid">>, <<"jti">>, <<"sub">>, <<"exp">>], end
case [K || K <- Required, not maps:is_key(K, Claims)] of catch
[] -> _:_ -> {error, invalid_token}
case maps:get(<<"exp">>, Claims) of end.
Exp when is_integer(Exp) ->
case Exp > erlang:system_time(second) of validate_refresh_claims(Claims, ExpectedAud) ->
true -> {ok, Claims}; case maps:get(<<"typ">>, Claims, undefined) of
false -> {error, expired} <<"refresh">> ->
end; case maps:get(<<"aud">>, Claims, undefined) of
_ -> ExpectedAud ->
{error, expired} validate_refresh_exp(Claims);
end; _ ->
_ -> {error, invalid_audience}
{error, invalid_token} end;
_ ->
{error, invalid_token_type}
end.
validate_refresh_exp(Claims) ->
Required = [<<"sid">>, <<"fid">>, <<"jti">>, <<"sub">>, <<"exp">>],
case [K || K <- Required, not maps:is_key(K, Claims)] of
[] ->
case maps:get(<<"exp">>, Claims) of
Exp when is_integer(Exp) ->
case Exp > erlang:system_time(second) of
true -> {ok, Claims};
false -> {error, expired}
end;
_ ->
{error, expired}
end;
_ ->
{error, invalid_token}
end. end.
src/logic/logic_auth_session.erl
+95 -62
View File
@@ -1,62 +1,95 @@
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
%%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation). %%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
%%% Фаза 1: admin API. Фазы 2–3: user / client web / mobile. %%% Фаза 1: admin API. Фаза 2: user API. Фаза 3: client web + mobile.
%%% @end %%% @end
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
-module(logic_auth_session). -module(logic_auth_session).
-include("records.hrl"). -include("records.hrl").
-export([issue_admin_tokens/2, refresh_admin/1]). -export([issue_admin_tokens/2, refresh_admin/1,
issue_user_tokens/2, refresh_user/1]).
%%%-------------------------------------------------------------------
%%% @doc Выдать пару access + refresh JWT при входе администратора. -define(USER_CLIENT_WEB, <<"web">>).
%%% @end
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
-spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) -> %%% Admin (фаза 1)
{ok, AccessToken :: binary(), RefreshToken :: binary()}. %%%-------------------------------------------------------------------
issue_admin_tokens(AdminId, Role) ->
{ok, Session} = core_auth_session:create(AdminId, admin, <<"admin">>), -spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role), {ok, AccessToken :: binary(), RefreshToken :: binary()}.
{RefreshToken, _} = eventhub_auth:generate_admin_refresh_token( issue_admin_tokens(AdminId, Role) ->
Session#auth_session.session_id, issue_tokens(AdminId, admin, <<"admin">>, Role, fun eventhub_auth:generate_admin_token/2,
Session#auth_session.family_id, fun eventhub_auth:generate_admin_refresh_token/5).
Session#auth_session.current_jti,
AdminId, -spec refresh_admin(RefreshToken :: binary()) ->
<<"admin">> {ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
), {error, atom()}.
{ok, AccessToken, RefreshToken}. refresh_admin(RefreshToken) ->
refresh_subject(RefreshToken, fun eventhub_auth:verify_admin_refresh_token/1,
%%%------------------------------------------------------------------- fun core_admin:get_by_id/1, admin, fun eventhub_auth:generate_admin_token/2,
%%% @doc Обновить пару токенов администратора по refresh JWT. fun eventhub_auth:generate_admin_refresh_token/5, <<"admin">>).
%%% @end
%%%------------------------------------------------------------------- %%%-------------------------------------------------------------------
-spec refresh_admin(RefreshToken :: binary()) -> %%% User (фаза 2)
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} | %%%-------------------------------------------------------------------
{error, atom()}.
refresh_admin(RefreshToken) -> -spec issue_user_tokens(UserId :: binary(), Role :: binary()) ->
case eventhub_auth:verify_admin_refresh_token(RefreshToken) of {ok, AccessToken :: binary(), RefreshToken :: binary()}.
{ok, Claims} -> issue_user_tokens(UserId, Role) ->
do_refresh_admin(Claims); issue_tokens(UserId, user, ?USER_CLIENT_WEB, Role, fun eventhub_auth:generate_user_token/2,
Error -> fun eventhub_auth:generate_user_refresh_token/5).
Error
end. -spec refresh_user(RefreshToken :: binary()) ->
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
do_refresh_admin(Claims) -> {error, atom()}.
SessionId = maps:get(<<"sid">>, Claims), refresh_user(RefreshToken) ->
Jti = maps:get(<<"jti">>, Claims), refresh_subject(RefreshToken, fun eventhub_auth:verify_user_refresh_token/1,
AdminId = maps:get(<<"sub">>, Claims), fun core_user:get_by_id/1, user, fun eventhub_auth:generate_user_token/2,
FamilyId = maps:get(<<"fid">>, Claims), fun eventhub_auth:generate_user_refresh_token/5, ?USER_CLIENT_WEB).
case core_auth_session:rotate(SessionId, Jti) of
{ok, NewJti, _Session} -> %%%===================================================================
{ok, Admin} = core_admin:get_by_id(AdminId), %%% Internal
Role = atom_to_binary(Admin#admin.role, utf8), %%%===================================================================
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefresh, _} = eventhub_auth:generate_admin_refresh_token( issue_tokens(SubjectId, SubjectType, ClientType, Role, GenAccess, GenRefresh) ->
SessionId, FamilyId, NewJti, AdminId, <<"admin">> {ok, Session} = core_auth_session:create(SubjectId, SubjectType, ClientType),
), AccessToken = GenAccess(SubjectId, Role),
{ok, AccessToken, NewRefresh}; {RefreshToken, _} = GenRefresh(
{error, reuse_detected} -> Session#auth_session.session_id,
core_auth_session:revoke_family(FamilyId), Session#auth_session.family_id,
{error, reuse_detected}; Session#auth_session.current_jti,
Error -> SubjectId,
Error ClientType
end. ),
{ok, AccessToken, RefreshToken}.
refresh_subject(RefreshToken, VerifyFn, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
case VerifyFn(RefreshToken) of
{ok, Claims} ->
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType);
Error ->
Error
end.
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
SessionId = maps:get(<<"sid">>, Claims),
Jti = maps:get(<<"jti">>, Claims),
SubjectId = maps:get(<<"sub">>, Claims),
FamilyId = maps:get(<<"fid">>, Claims),
case core_auth_session:rotate(SessionId, Jti) of
{ok, NewJti, _Session} ->
{ok, Subject} = GetSubjectFn(SubjectId),
Role = subject_role(Subject, SubjectType),
AccessToken = GenAccess(SubjectId, Role),
{NewRefresh, _} = GenRefresh(SessionId, FamilyId, NewJti, SubjectId, ClientType),
{ok, AccessToken, NewRefresh};
{error, reuse_detected} ->
core_auth_session:revoke_family(FamilyId),
{error, reuse_detected};
Error ->
Error
end.
subject_role(#admin{role = Role}, admin) ->
atom_to_binary(Role, utf8);
subject_role(#user{role = Role}, user) ->
atom_to_binary(Role, utf8).
test/unit/auth_test.erl
+190 -166
View File
@@ -1,167 +1,191 @@
-module(auth_test). -module(auth_test).
-include_lib("eunit/include/eunit.hrl"). -include_lib("eunit/include/eunit.hrl").
-define(JWT_SECRET, <<"test-user-secret-key-32-byt!">>). -define(JWT_SECRET, <<"test-user-secret-key-32-byt!">>).
-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>). -define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% EUnit фикстуры – запуск и остановка моков %% EUnit фикстуры – запуск и остановка моков
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
setup() -> setup() ->
ok = meck:new(logic_auth, [non_strict]), ok = meck:new(logic_auth, [non_strict]),
application:set_env(eventhub, jwt_secret, ?JWT_SECRET), application:set_env(eventhub, jwt_secret, ?JWT_SECRET),
application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET), application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
{ok, _} = application:ensure_all_started(jose), {ok, _} = application:ensure_all_started(jose),
ok. ok.
cleanup(_) -> cleanup(_) ->
application:unset_env(eventhub, jwt_secret), application:unset_env(eventhub, jwt_secret),
application:unset_env(eventhub, admin_jwt_secret), application:unset_env(eventhub, admin_jwt_secret),
application:stop(jose), application:stop(jose),
meck:unload(logic_auth). meck:unload(logic_auth).
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тесты генерации токенов %% Тесты генерации токенов
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
generate_user_token_test_() -> generate_user_token_test_() ->
{setup, fun setup/0, fun cleanup/1, [ {setup, fun setup/0, fun cleanup/1, [
{"Generate user token returns a binary", {"Generate user token returns a binary",
fun() -> fun() ->
Token = eventhub_auth:generate_user_token(<<"user123">>, <<"user">>), Token = eventhub_auth:generate_user_token(<<"user123">>, <<"user">>),
?assert(is_binary(Token)), ?assert(is_binary(Token)),
?assert(size(Token) > 0) ?assert(size(Token) > 0)
end}, end},
{"Generated user token can be verified", {"Generated user token can be verified",
fun() -> fun() ->
Token = eventhub_auth:generate_user_token(<<"user123">>, <<"user">>), Token = eventhub_auth:generate_user_token(<<"user123">>, <<"user">>),
{ok, UserId, Role} = eventhub_auth:verify_user_token(Token), {ok, UserId, Role} = eventhub_auth:verify_user_token(Token),
?assertEqual(<<"user123">>, UserId), ?assertEqual(<<"user123">>, UserId),
?assertEqual(<<"user">>, Role) ?assertEqual(<<"user">>, Role)
end}, end},
{"Generate admin token with superadmin role", {"Generate admin token with superadmin role",
fun() -> fun() ->
Token = eventhub_auth:generate_admin_token(<<"admin1">>, <<"superadmin">>), Token = eventhub_auth:generate_admin_token(<<"admin1">>, <<"superadmin">>),
{ok, UserId, Role} = eventhub_auth:verify_admin_token(Token), {ok, UserId, Role} = eventhub_auth:verify_admin_token(Token),
?assertEqual(<<"admin1">>, UserId), ?assertEqual(<<"admin1">>, UserId),
?assertEqual(<<"superadmin">>, Role) ?assertEqual(<<"superadmin">>, Role)
end} end}
]}. ]}.
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тесты верификации токенов (граничные случаи) %% Тесты верификации токенов (граничные случаи)
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
verify_token_errors_test_() -> verify_token_errors_test_() ->
{setup, fun setup/0, fun cleanup/1, [ {setup, fun setup/0, fun cleanup/1, [
{"Invalid token signature returns error", {"Invalid token signature returns error",
fun() -> fun() ->
FakeToken = <<"not.a.valid.token">>, FakeToken = <<"not.a.valid.token">>,
?assertEqual({error, invalid_token}, eventhub_auth:verify_user_token(FakeToken)), ?assertEqual({error, invalid_token}, eventhub_auth:verify_user_token(FakeToken)),
?assertEqual({error, invalid_token}, eventhub_auth:verify_admin_token(FakeToken)) ?assertEqual({error, invalid_token}, eventhub_auth:verify_admin_token(FakeToken))
end}, end},
{"User token rejected by admin verifier (different secret)", {"User token rejected by admin verifier (different secret)",
fun() -> fun() ->
Token = eventhub_auth:generate_user_token(<<"x">>, <<"user">>), Token = eventhub_auth:generate_user_token(<<"x">>, <<"user">>),
% Разные секреты → подпись недействительна для admin JWK % Разные секреты → подпись недействительна для admin JWK
?assertEqual({error, invalid_signature}, eventhub_auth:verify_admin_token(Token)) ?assertEqual({error, invalid_signature}, eventhub_auth:verify_admin_token(Token))
end}, end},
{"Admin token rejected by user verifier (different secret)", {"Admin token rejected by user verifier (different secret)",
fun() -> fun() ->
Token = eventhub_auth:generate_admin_token(<<"x">>, <<"admin">>), Token = eventhub_auth:generate_admin_token(<<"x">>, <<"admin">>),
?assertEqual({error, invalid_signature}, eventhub_auth:verify_user_token(Token)) ?assertEqual({error, invalid_signature}, eventhub_auth:verify_user_token(Token))
end} end}
]}. ]}.
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тесты для authenticate_user_request/3 %% Тесты для authenticate_user_request/3
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
authenticate_user_request_test_() -> authenticate_user_request_test_() ->
{setup, fun setup/0, fun cleanup/1, [ {setup, fun setup/0, fun cleanup/1, [
{"Successful user login returns token and user data", {"Successful user login returns token and user data",
fun() -> fun() ->
UserMap = #{id => <<"user1">>, email => <<"u@test.com">>, role => <<"user">>}, UserMap = #{id => <<"user1">>, email => <<"u@test.com">>, role => <<"user">>},
ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, UserMap} end), ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, UserMap} end),
Req = undefined, Req = undefined,
{ok, Token, ReturnedUser} = eventhub_auth:authenticate_user_request(Req, <<"u@test.com">>, <<"pass">>), {ok, Token, ReturnedUser} = eventhub_auth:authenticate_user_request(Req, <<"u@test.com">>, <<"pass">>),
?assert(is_binary(Token)), ?assert(is_binary(Token)),
?assertEqual(UserMap, ReturnedUser), ?assertEqual(UserMap, ReturnedUser),
{ok, UserId, Role} = eventhub_auth:verify_user_token(Token), {ok, UserId, Role} = eventhub_auth:verify_user_token(Token),
?assertEqual(<<"user1">>, UserId), ?assertEqual(<<"user1">>, UserId),
?assertEqual(<<"user">>, Role) ?assertEqual(<<"user">>, Role)
end}, end},
{"User login failure propagates error from logic_auth", {"User login failure propagates error from logic_auth",
fun() -> fun() ->
ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {error, bad_credentials} end), ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {error, bad_credentials} end),
Req = undefined, Req = undefined,
?assertEqual({error, bad_credentials}, eventhub_auth:authenticate_user_request(Req, <<"bad">>, <<"pwd">>)) ?assertEqual({error, bad_credentials}, eventhub_auth:authenticate_user_request(Req, <<"bad">>, <<"pwd">>))
end} end}
]}. ]}.
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тесты для authenticate_admin_request/3 %% Тесты для authenticate_admin_request/3
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
authenticate_admin_request_test_() -> authenticate_admin_request_test_() ->
{setup, fun setup/0, fun cleanup/1, [ {setup, fun setup/0, fun cleanup/1, [
{"Successful admin login returns admin token", {"Successful admin login returns admin token",
fun() -> fun() ->
AdminMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>}, AdminMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>},
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, AdminMap} end), ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, AdminMap} end),
Req = undefined, Req = undefined,
{ok, Token, ReturnedUser} = eventhub_auth:authenticate_admin_request(Req, <<"admin@test.com">>, <<"pass">>), {ok, Token, ReturnedUser} = eventhub_auth:authenticate_admin_request(Req, <<"admin@test.com">>, <<"pass">>),
?assert(is_binary(Token)), ?assert(is_binary(Token)),
?assertEqual(AdminMap, ReturnedUser), ?assertEqual(AdminMap, ReturnedUser),
{ok, UserId, Role} = eventhub_auth:verify_admin_token(Token), {ok, UserId, Role} = eventhub_auth:verify_admin_token(Token),
?assertEqual(<<"adm1">>, UserId), ?assertEqual(<<"adm1">>, UserId),
?assertEqual(<<"superadmin">>, Role) ?assertEqual(<<"superadmin">>, Role)
end}, end},
{"Non-admin role is rejected with insufficient_permissions", {"Non-admin role is rejected with insufficient_permissions",
fun() -> fun() ->
UserMap = #{id => <<"simpleuser">>, email => <<"u@test.com">>, role => <<"user">>}, UserMap = #{id => <<"simpleuser">>, email => <<"u@test.com">>, role => <<"user">>},
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, UserMap} end), ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, UserMap} end),
Req = undefined, Req = undefined,
?assertEqual({error, insufficient_permissions}, ?assertEqual({error, insufficient_permissions},
eventhub_auth:authenticate_admin_request(Req, <<"u@test.com">>, <<"pwd">>)) eventhub_auth:authenticate_admin_request(Req, <<"u@test.com">>, <<"pwd">>))
end}, end},
{"Moderator role is accepted as admin", {"Moderator role is accepted as admin",
fun() -> fun() ->
ModMap = #{id => <<"moder1">>, email => <<"mod@test.com">>, role => <<"moderator">>}, ModMap = #{id => <<"moder1">>, email => <<"mod@test.com">>, role => <<"moderator">>},
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, ModMap} end), ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, ModMap} end),
Req = undefined, Req = undefined,
{ok, Token, _} = eventhub_auth:authenticate_admin_request(Req, <<"mod@test.com">>, <<"pwd">>), {ok, Token, _} = eventhub_auth:authenticate_admin_request(Req, <<"mod@test.com">>, <<"pwd">>),
{ok, _, Role} = eventhub_auth:verify_admin_token(Token), {ok, _, Role} = eventhub_auth:verify_admin_token(Token),
?assertEqual(<<"moderator">>, Role) ?assertEqual(<<"moderator">>, Role)
end} end}
]}. ]}.
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тест generate_refresh_token/1 (legacy opaque, user flow) %% Тест generate_refresh_token/1 (legacy opaque, user flow)
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
generate_refresh_token_test() -> generate_refresh_token_test() ->
{_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>). {_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>).
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
%% Тесты refresh JWT (admin) %% Тесты refresh JWT (admin)
%% ------------------------------------------------------------------ %% ------------------------------------------------------------------
admin_refresh_jwt_test_() -> admin_refresh_jwt_test_() ->
{setup, fun setup/0, fun cleanup/1, [ {setup, fun setup/0, fun cleanup/1, [
{"Generate and verify admin refresh JWT", {"Generate and verify admin refresh JWT",
fun() -> fun() ->
Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>, Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
{Token, _} = eventhub_auth:generate_admin_refresh_token( {Token, _} = eventhub_auth:generate_admin_refresh_token(
Sid, Fid, Jti, <<"admin1">>, <<"admin">> Sid, Fid, Jti, <<"admin1">>, <<"admin">>
), ),
?assert(is_binary(Token)), ?assert(is_binary(Token)),
{ok, Claims} = eventhub_auth:verify_admin_refresh_token(Token), {ok, Claims} = eventhub_auth:verify_admin_refresh_token(Token),
?assertEqual(Sid, maps:get(<<"sid">>, Claims)), ?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
?assertEqual(Fid, maps:get(<<"fid">>, Claims)), ?assertEqual(Fid, maps:get(<<"fid">>, Claims)),
?assertEqual(Jti, maps:get(<<"jti">>, Claims)), ?assertEqual(Jti, maps:get(<<"jti">>, Claims)),
?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims)) ?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims))
end}, end},
{"User refresh JWT rejected by admin verifier", {"Admin refresh JWT rejected by user verifier",
fun() -> fun() ->
{Token, _} = eventhub_auth:generate_admin_refresh_token( {Token, _} = eventhub_auth:generate_admin_refresh_token(
<<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"admin">> <<"s">>, <<"f">>, <<"j">>, <<"a">>, <<"admin">>
), ),
?assertMatch({error, invalid_signature}, ?assertMatch({error, invalid_signature},
eventhub_auth:verify_user_token(Token)) eventhub_auth:verify_user_refresh_token(Token))
end} end}
]}.
user_refresh_jwt_test_() ->
{setup, fun setup/0, fun cleanup/1, [
{"Generate and verify user refresh JWT",
fun() ->
Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
{Token, _} = eventhub_auth:generate_user_refresh_token(
Sid, Fid, Jti, <<"user1">>, <<"web">>
),
?assert(is_binary(Token)),
{ok, Claims} = eventhub_auth:verify_user_refresh_token(Token),
?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
?assertEqual(<<"web">>, maps:get(<<"client">>, Claims))
end},
{"User refresh JWT rejected by admin verifier",
fun() ->
{Token, _} = eventhub_auth:generate_user_refresh_token(
<<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"web">>
),
?assertMatch({error, invalid_signature},
eventhub_auth:verify_admin_refresh_token(Token))
end}
]}. ]}.
test/unit/logic_auth_session_tests.erl
+114 -69
View File
@@ -1,69 +1,114 @@
-module(logic_auth_session_tests). -module(logic_auth_session_tests).
-include_lib("eunit/include/eunit.hrl"). -include_lib("eunit/include/eunit.hrl").
-include("records.hrl"). -include("records.hrl").
-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>). -define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
-define(USER_JWT_SECRET, <<"test-user-secret-key-32-by">>).
setup() ->
ok = meck:new(core_admin, [non_strict]), setup() ->
mnesia:start(), ok = meck:new(core_admin, [non_strict]),
catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]), ok = meck:new(core_user, [non_strict]),
mnesia:create_table(auth_session, [ mnesia:start(),
{attributes, record_info(fields, auth_session)}, catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
{ram_copies, [node()]} mnesia:create_table(auth_session, [
]), {attributes, record_info(fields, auth_session)},
mnesia:add_table_index(auth_session, #auth_session.family_id), {ram_copies, [node()]}
mnesia:add_table_index(auth_session, #auth_session.subject_id), ]),
application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET), mnesia:add_table_index(auth_session, #auth_session.family_id),
{ok, _} = application:ensure_all_started(jose), mnesia:add_table_index(auth_session, #auth_session.subject_id),
ok. application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
application:set_env(eventhub, jwt_secret, ?USER_JWT_SECRET),
cleanup(_) -> {ok, _} = application:ensure_all_started(jose),
application:unset_env(eventhub, admin_jwt_secret), ok.
application:stop(jose),
meck:unload(core_admin), cleanup(_) ->
catch mnesia:delete_table(auth_session), application:unset_env(eventhub, admin_jwt_secret),
catch ets:delete(eventhub_counters), application:unset_env(eventhub, jwt_secret),
mnesia:stop(), application:stop(jose),
ok. meck:unload(core_admin),
meck:unload(core_user),
logic_auth_session_test_() -> catch mnesia:delete_table(auth_session),
{foreach, fun setup/0, fun cleanup/1, [ catch ets:delete(eventhub_counters),
{"Issue and refresh admin tokens", fun test_issue_and_refresh/0}, mnesia:stop(),
{"Refresh reuse revokes family", fun test_reuse_revokes/0} ok.
]}.
logic_auth_session_test_() ->
test_issue_and_refresh() -> {foreach, fun setup/0, fun cleanup/1, [
AdminId = <<"adm1">>, {"Issue and refresh admin tokens", fun test_issue_and_refresh_admin/0},
Admin = #admin{ {"Refresh admin reuse revokes family", fun test_admin_reuse_revokes/0},
id = AdminId, email = <<"a@test.com">>, role = superadmin, {"Issue and refresh user tokens", fun test_issue_and_refresh_user/0},
password_hash = <<>>, status = active, nickname = <<>>, {"Refresh user reuse revokes family", fun test_user_reuse_revokes/0}
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>, ]}.
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined test_issue_and_refresh_admin() ->
}, AdminId = <<"adm1">>,
ok = meck:expect(core_admin, get_by_id, fun(Id) -> Admin = #admin{
?assertEqual(AdminId, Id), {ok, Admin} id = AdminId, email = <<"a@test.com">>, role = superadmin,
end), password_hash = <<>>, status = active, nickname = <<>>,
{ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>), avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
?assert(is_binary(Access1)), phone = <<>>, preferences = #{}, last_login = undefined,
{ok, _, _} = eventhub_auth:verify_admin_token(Access1), created_at = undefined, updated_at = undefined
{ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1), },
?assert(is_binary(Access2)), ok = meck:expect(core_admin, get_by_id, fun(Id) ->
?assertNotEqual(Refresh1, Refresh2), ?assertEqual(AdminId, Id), {ok, Admin}
{ok, _, _} = eventhub_auth:verify_admin_token(Access2). end),
{ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
test_reuse_revokes() -> ?assert(is_binary(Access1)),
AdminId = <<"adm1">>, {ok, _, _} = eventhub_auth:verify_admin_token(Access1),
Admin = #admin{ {ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
id = AdminId, email = <<"a@test.com">>, role = admin, ?assert(is_binary(Access2)),
password_hash = <<>>, status = active, nickname = <<>>, ?assertNotEqual(Refresh1, Refresh2),
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>, {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined test_admin_reuse_revokes() ->
}, AdminId = <<"adm1">>,
ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end), Admin = #admin{
{ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>), id = AdminId, email = <<"a@test.com">>, role = admin,
{ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1), password_hash = <<>>, status = active, nickname = <<>>,
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)), avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)). phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined
},
ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
{ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
{ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
test_issue_and_refresh_user() ->
UserId = <<"usr1">>,
User = #user{
id = UserId, email = <<"u@test.com">>, role = user,
password_hash = <<>>, status = active, nickname = <<>>,
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined
},
ok = meck:expect(core_user, get_by_id, fun(Id) ->
?assertEqual(UserId, Id), {ok, User}
end),
{ok, Access1, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
?assert(is_binary(Access1)),
{ok, _, _} = eventhub_auth:verify_user_token(Access1),
{ok, Claims} = eventhub_auth:verify_user_refresh_token(Refresh1),
?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
?assertEqual(<<"web">>, maps:get(<<"client">>, Claims)),
{ok, Access2, Refresh2} = logic_auth_session:refresh_user(Refresh1),
?assert(is_binary(Access2)),
?assertNotEqual(Refresh1, Refresh2),
{ok, _, _} = eventhub_auth:verify_user_token(Access2).
test_user_reuse_revokes() ->
UserId = <<"usr1">>,
User = #user{
id = UserId, email = <<"u@test.com">>, role = user,
password_hash = <<>>, status = active, nickname = <<>>,
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined
},
ok = meck:expect(core_user, get_by_id, fun(_) -> {ok, User} end),
{ok, _, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
{ok, _, Refresh2} = logic_auth_session:refresh_user(Refresh1),
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_user(Refresh1)),
?assertMatch({error, revoked}, logic_auth_session:refresh_user(Refresh2)).