EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

User login and refresh on auth_session (phase 2). Refs EventHub/EventHubBack#26

Browse Source
This commit is contained in:
Aleksey Sabilin
2026-07-07 19:33:24 +03:00
parent 7c5f2d26b8
commit 018bf85b87
6 changed files with 862 additions and 748 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/handlers/handler_login.erl
+3 -3
View File
@@ -71,10 +71,10 @@ login(Req) ->
try jsx:decode(Body, [return_maps]) of
#{<<"email">> := Email, <<"password">> := Password} ->
case eventhub_auth:authenticate_user_request(Req1, Email, Password) of
{ok, Token, User} ->
{ok, _Token, User} ->
UserId = maps:get(id, User),
{RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_session:create(UserId, RefreshToken),
Role = maps:get(role, User),
{ok, Token, RefreshToken} = logic_auth_session:issue_user_tokens(UserId, Role),
core_user:update_last_login(UserId),
Response = #{
<<"token">> => Token,
src/handlers/handler_refresh.erl
+15 -22
View File
@@ -8,8 +8,6 @@
-export([init/2]).
-export([trails/0]).
-include("records.hrl").
%%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
init(Req, _Opts) ->
@@ -23,7 +21,7 @@ init(Req, _Opts) ->
trails() ->
[
#{
path => <<"/v1/auth/refresh">>,
path => <<"/v1/refresh">>,
method => <<"POST">>,
description => <<"Refresh user access token using refresh token">>,
tags => [<<"Auth">>],
@@ -67,36 +65,31 @@ token_pair_schema() ->
%%% HTTP-методы
%%%===================================================================
%% @doc POST /v1/auth/refresh — обновление пользовательского токена.
%% @doc POST /v1/refresh — обновление пользовательского токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case core_session:validate(RefreshToken) of
{ok, UserId, User} ->
user_refresh(UserId, User, RefreshToken, Req1);
case logic_auth_session:refresh_user(RefreshToken) of
{ok, NewToken, NewRefreshToken} ->
handler_utils:send_json(Req1, 200, #{
token => NewToken,
refresh_token => NewRefreshToken
});
{error, reuse_detected} ->
handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
{error, revoked} ->
handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
{error, _} ->
handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
catch
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
end.
%%%===================================================================
%%% Внутренние функции
%%%===================================================================
%% @private Обновляет токен для обычного пользователя.
-spec user_refresh(binary(), #user{}, binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
user_refresh(UserId, User, OldToken, Req) ->
core_session:delete(OldToken),
Role = atom_to_binary(User#user.role, utf8),
NewToken = eventhub_auth:generate_user_token(UserId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_session:create(UserId, NewRefreshToken),
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
src/infra/eventhub_auth.erl
+21 -2
View File
@@ -8,7 +8,9 @@
authenticate_admin_request/3,
generate_refresh_token/1,
generate_admin_refresh_token/5,
verify_admin_refresh_token/1
verify_admin_refresh_token/1,
generate_user_refresh_token/5,
verify_user_refresh_token/1
]).
%% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
@@ -150,7 +152,7 @@ is_admin_role(Role) ->
-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ==========
%% ========== REFRESH TOKEN (opaque, legacy — не используется login/refresh user с фазы 2) ==========
-spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
generate_refresh_token(_UserId) ->
@@ -180,6 +182,23 @@ generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
verify_admin_refresh_token(Token) ->
verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
-spec generate_user_refresh_token(
SessionId :: binary(),
FamilyId :: binary(),
Jti :: binary(),
SubjectId :: binary(),
ClientType :: binary()
) -> {binary(), calendar:datetime()}.
generate_user_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
generate_refresh_jwt(
get_user_jwk(), SubjectId, <<"user">>, SessionId, FamilyId, Jti, ClientType
).
-spec verify_user_refresh_token(Token :: binary()) ->
{ok, map()} | {error, atom()}.
verify_user_refresh_token(Token) ->
verify_refresh_jwt(get_user_jwk(), Token, <<"user">>).
generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
Claims = #{
src/logic/logic_auth_session.erl
+61 -28
View File
@@ -1,58 +1,86 @@
%%%-------------------------------------------------------------------
%%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
%%% Фаза 1: admin API. Фазы 2–3: user / client web / mobile.
%%% Фаза 1: admin API. Фаза 2: user API. Фаза 3: client web + mobile.
%%% @end
%%%-------------------------------------------------------------------
-module(logic_auth_session).
-include("records.hrl").
-export([issue_admin_tokens/2, refresh_admin/1]).
-export([issue_admin_tokens/2, refresh_admin/1,
issue_user_tokens/2, refresh_user/1]).
-define(USER_CLIENT_WEB, <<"web">>).
%%%-------------------------------------------------------------------
%%% @doc Выдать пару access + refresh JWT при входе администратора.
%%% @end
%%% Admin (фаза 1)
%%%-------------------------------------------------------------------
-spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
{ok, AccessToken :: binary(), RefreshToken :: binary()}.
issue_admin_tokens(AdminId, Role) ->
{ok, Session} = core_auth_session:create(AdminId, admin, <<"admin">>),
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
{RefreshToken, _} = eventhub_auth:generate_admin_refresh_token(
Session#auth_session.session_id,
Session#auth_session.family_id,
Session#auth_session.current_jti,
AdminId,
<<"admin">>
),
{ok, AccessToken, RefreshToken}.
issue_tokens(AdminId, admin, <<"admin">>, Role, fun eventhub_auth:generate_admin_token/2,
fun eventhub_auth:generate_admin_refresh_token/5).
%%%-------------------------------------------------------------------
%%% @doc Обновить пару токенов администратора по refresh JWT.
%%% @end
%%%-------------------------------------------------------------------
-spec refresh_admin(RefreshToken :: binary()) ->
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
{error, atom()}.
refresh_admin(RefreshToken) ->
case eventhub_auth:verify_admin_refresh_token(RefreshToken) of
refresh_subject(RefreshToken, fun eventhub_auth:verify_admin_refresh_token/1,
fun core_admin:get_by_id/1, admin, fun eventhub_auth:generate_admin_token/2,
fun eventhub_auth:generate_admin_refresh_token/5, <<"admin">>).
%%%-------------------------------------------------------------------
%%% User (фаза 2)
%%%-------------------------------------------------------------------
-spec issue_user_tokens(UserId :: binary(), Role :: binary()) ->
{ok, AccessToken :: binary(), RefreshToken :: binary()}.
issue_user_tokens(UserId, Role) ->
issue_tokens(UserId, user, ?USER_CLIENT_WEB, Role, fun eventhub_auth:generate_user_token/2,
fun eventhub_auth:generate_user_refresh_token/5).
-spec refresh_user(RefreshToken :: binary()) ->
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
{error, atom()}.
refresh_user(RefreshToken) ->
refresh_subject(RefreshToken, fun eventhub_auth:verify_user_refresh_token/1,
fun core_user:get_by_id/1, user, fun eventhub_auth:generate_user_token/2,
fun eventhub_auth:generate_user_refresh_token/5, ?USER_CLIENT_WEB).
%%%===================================================================
%%% Internal
%%%===================================================================
issue_tokens(SubjectId, SubjectType, ClientType, Role, GenAccess, GenRefresh) ->
{ok, Session} = core_auth_session:create(SubjectId, SubjectType, ClientType),
AccessToken = GenAccess(SubjectId, Role),
{RefreshToken, _} = GenRefresh(
Session#auth_session.session_id,
Session#auth_session.family_id,
Session#auth_session.current_jti,
SubjectId,
ClientType
),
{ok, AccessToken, RefreshToken}.
refresh_subject(RefreshToken, VerifyFn, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
case VerifyFn(RefreshToken) of
{ok, Claims} ->
do_refresh_admin(Claims);
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType);
Error ->
Error
end.
do_refresh_admin(Claims) ->
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
SessionId = maps:get(<<"sid">>, Claims),
Jti = maps:get(<<"jti">>, Claims),
AdminId = maps:get(<<"sub">>, Claims),
SubjectId = maps:get(<<"sub">>, Claims),
FamilyId = maps:get(<<"fid">>, Claims),
case core_auth_session:rotate(SessionId, Jti) of
{ok, NewJti, _Session} ->
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefresh, _} = eventhub_auth:generate_admin_refresh_token(
SessionId, FamilyId, NewJti, AdminId, <<"admin">>
),
{ok, Subject} = GetSubjectFn(SubjectId),
Role = subject_role(Subject, SubjectType),
AccessToken = GenAccess(SubjectId, Role),
{NewRefresh, _} = GenRefresh(SessionId, FamilyId, NewJti, SubjectId, ClientType),
{ok, AccessToken, NewRefresh};
{error, reuse_detected} ->
core_auth_session:revoke_family(FamilyId),
@@ -60,3 +88,8 @@ do_refresh_admin(Claims) ->
Error ->
Error
end.
subject_role(#admin{role = Role}, admin) ->
atom_to_binary(Role, utf8);
subject_role(#user{role = Role}, user) ->
atom_to_binary(Role, utf8).
test/unit/auth_test.erl
+27 -3
View File
@@ -156,12 +156,36 @@ admin_refresh_jwt_test_() ->
?assertEqual(Jti, maps:get(<<"jti">>, Claims)),
?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims))
end},
{"User refresh JWT rejected by admin verifier",
{"Admin refresh JWT rejected by user verifier",
fun() ->
{Token, _} = eventhub_auth:generate_admin_refresh_token(
<<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"admin">>
<<"s">>, <<"f">>, <<"j">>, <<"a">>, <<"admin">>
),
?assertMatch({error, invalid_signature},
eventhub_auth:verify_user_token(Token))
eventhub_auth:verify_user_refresh_token(Token))
end}
]}.
user_refresh_jwt_test_() ->
{setup, fun setup/0, fun cleanup/1, [
{"Generate and verify user refresh JWT",
fun() ->
Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
{Token, _} = eventhub_auth:generate_user_refresh_token(
Sid, Fid, Jti, <<"user1">>, <<"web">>
),
?assert(is_binary(Token)),
{ok, Claims} = eventhub_auth:verify_user_refresh_token(Token),
?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
?assertEqual(<<"web">>, maps:get(<<"client">>, Claims))
end},
{"User refresh JWT rejected by admin verifier",
fun() ->
{Token, _} = eventhub_auth:generate_user_refresh_token(
<<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"web">>
),
?assertMatch({error, invalid_signature},
eventhub_auth:verify_admin_refresh_token(Token))
end}
]}.
test/unit/logic_auth_session_tests.erl
+49 -4
View File
@@ -3,9 +3,11 @@
-include("records.hrl").
-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
-define(USER_JWT_SECRET, <<"test-user-secret-key-32-by">>).
setup() ->
ok = meck:new(core_admin, [non_strict]),
ok = meck:new(core_user, [non_strict]),
mnesia:start(),
catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
mnesia:create_table(auth_session, [
@@ -15,13 +17,16 @@ setup() ->
mnesia:add_table_index(auth_session, #auth_session.family_id),
mnesia:add_table_index(auth_session, #auth_session.subject_id),
application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
application:set_env(eventhub, jwt_secret, ?USER_JWT_SECRET),
{ok, _} = application:ensure_all_started(jose),
ok.
cleanup(_) ->
application:unset_env(eventhub, admin_jwt_secret),
application:unset_env(eventhub, jwt_secret),
application:stop(jose),
meck:unload(core_admin),
meck:unload(core_user),
catch mnesia:delete_table(auth_session),
catch ets:delete(eventhub_counters),
mnesia:stop(),
@@ -29,11 +34,13 @@ cleanup(_) ->
logic_auth_session_test_() ->
{foreach, fun setup/0, fun cleanup/1, [
{"Issue and refresh admin tokens", fun test_issue_and_refresh/0},
{"Refresh reuse revokes family", fun test_reuse_revokes/0}
{"Issue and refresh admin tokens", fun test_issue_and_refresh_admin/0},
{"Refresh admin reuse revokes family", fun test_admin_reuse_revokes/0},
{"Issue and refresh user tokens", fun test_issue_and_refresh_user/0},
{"Refresh user reuse revokes family", fun test_user_reuse_revokes/0}
]}.
test_issue_and_refresh() ->
test_issue_and_refresh_admin() ->
AdminId = <<"adm1">>,
Admin = #admin{
id = AdminId, email = <<"a@test.com">>, role = superadmin,
@@ -53,7 +60,7 @@ test_issue_and_refresh() ->
?assertNotEqual(Refresh1, Refresh2),
{ok, _, _} = eventhub_auth:verify_admin_token(Access2).
test_reuse_revokes() ->
test_admin_reuse_revokes() ->
AdminId = <<"adm1">>,
Admin = #admin{
id = AdminId, email = <<"a@test.com">>, role = admin,
@@ -67,3 +74,41 @@ test_reuse_revokes() ->
{ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).
test_issue_and_refresh_user() ->
UserId = <<"usr1">>,
User = #user{
id = UserId, email = <<"u@test.com">>, role = user,
password_hash = <<>>, status = active, nickname = <<>>,
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined
},
ok = meck:expect(core_user, get_by_id, fun(Id) ->
?assertEqual(UserId, Id), {ok, User}
end),
{ok, Access1, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
?assert(is_binary(Access1)),
{ok, _, _} = eventhub_auth:verify_user_token(Access1),
{ok, Claims} = eventhub_auth:verify_user_refresh_token(Refresh1),
?assertEqual(<<"user">>, maps:get(<<"aud">>, Claims)),
?assertEqual(<<"web">>, maps:get(<<"client">>, Claims)),
{ok, Access2, Refresh2} = logic_auth_session:refresh_user(Refresh1),
?assert(is_binary(Access2)),
?assertNotEqual(Refresh1, Refresh2),
{ok, _, _} = eventhub_auth:verify_user_token(Access2).
test_user_reuse_revokes() ->
UserId = <<"usr1">>,
User = #user{
id = UserId, email = <<"u@test.com">>, role = user,
password_hash = <<>>, status = active, nickname = <<>>,
avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
phone = <<>>, preferences = #{}, last_login = undefined,
created_at = undefined, updated_at = undefined
},
ok = meck:expect(core_user, get_by_id, fun(_) -> {ok, User} end),
{ok, _, Refresh1} = logic_auth_session:issue_user_tokens(UserId, <<"user">>),
{ok, _, Refresh2} = logic_auth_session:refresh_user(Refresh1),
?assertMatch({error, reuse_detected}, logic_auth_session:refresh_user(Refresh1)),
?assertMatch({error, revoked}, logic_auth_session:refresh_user(Refresh2)).