feat(auth): list/revoke sessions with device_name and client_type. Fixes EventHub/EventHubBack#74

src/handlers/admin/admin_handler_login.erl

@@ -22,7 +22,7 @@ init(Req0, _State) ->
                 {ok, _Token, User} ->
                   UserId = maps:get(id, User),
                   Role = maps:get(role, User),
-                  {ok, Token, RefreshToken} = logic_auth_session:issue_admin_tokens(UserId, Role),
+                  {ok, Token, RefreshToken, SessionId} = logic_auth_session:issue_admin_tokens(UserId, Role),
                   core_admin:update_last_login(UserId),
                   % Аудит успешного входа
                   admin_utils:log_admin_action(UserId, <<"login">>, <<"admin">>, Email, <<>>, Req1),
@@ -33,7 +33,8 @@ init(Req0, _State) ->
                       <<"email">> => maps:get(email, User),
                       <<"role">> => maps:get(role, User)
                     },
-                    <<"refresh_token">> => RefreshToken
+                    <<"refresh_token">> => RefreshToken,
+                    <<"session_id">> => SessionId
                   },
                   handler_utils:send_json(Req1, 200, Resp);
                 {error, insufficient_permissions} ->

src/handlers/admin/admin_handler_refresh.erl

@@ -71,10 +71,11 @@ refresh(Req) ->
   try jsx:decode(Body, [return_maps]) of
     #{<<"refresh_token">> := RefreshToken} ->
       case logic_auth_session:refresh_admin(RefreshToken) of
-        {ok, NewToken, NewRefreshToken} ->
+        {ok, NewToken, NewRefreshToken, SessionId} ->
           handler_utils:send_json(Req1, 200, #{
             token => NewToken,
-            refresh_token => NewRefreshToken
+            refresh_token => NewRefreshToken,
+            session_id => SessionId
           });
         {error, reuse_detected} ->
           handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);

src/handlers/handler_login.erl

@@ -32,8 +32,10 @@ trails() ->
           type       => object,
           required   => [<<"email">>, <<"password">>],
           properties => #{
-            email    => #{type => string, format => <<"email">>},
-            password => #{type => string, format => <<"password">>}
+            email => #{type => string, format => <<"email">>},
+            password => #{type => string, format => <<"password">>},
+            client_type => #{type => string, enum => [<<"web">>, <<"mobile">>]},
+            device_name => #{type => string}
           }
         }}}
       },
@@ -69,23 +71,35 @@ login(Req) ->
           handler_utils:send_error(Req1, 400, <<"Empty request body">>);
         _ ->
           try jsx:decode(Body, [return_maps]) of
-            #{<<"email">> := Email, <<"password">> := Password} ->
+            #{<<"email">> := Email, <<"password">> := Password} = Map ->
+              ClientType = maps:get(<<"client_type">>, Map, <<"web">>),
+              DeviceName = maps:get(<<"device_name">>, Map, <<>>),
+              UserAgent = case cowboy_req:header(<<"user-agent">>, Req1) of
+                undefined -> <<>>;
+                UA -> UA
+              end,
               case eventhub_auth:authenticate_user_request(Req1, Email, Password) of
                 {ok, _Token, User} ->
                   UserId = maps:get(id, User),
                   Role = maps:get(role, User),
-                  {ok, Token, RefreshToken} = logic_auth_session:issue_user_tokens(UserId, Role),
-                  core_user:update_last_login(UserId),
-                  Response = #{
-                    <<"token">>         => Token,
-                    <<"user">>          => #{
-                      <<"id">>    => UserId,
-                      <<"email">> => maps:get(email, User),
-                      <<"role">>  => maps:get(role, User)
-                    },
-                    <<"refresh_token">> => RefreshToken
-                  },
-                  handler_utils:send_json(Req1, 200, Response);
+                  case logic_auth_session:issue_user_tokens(
+                         UserId, Role, ClientType, DeviceName, UserAgent) of
+                    {ok, Token, RefreshToken, SessionId} ->
+                      core_user:update_last_login(UserId),
+                      Response = #{
+                        <<"token">>         => Token,
+                        <<"user">>          => #{
+                          <<"id">>    => UserId,
+                          <<"email">> => maps:get(email, User),
+                          <<"role">>  => maps:get(role, User)
+                        },
+                        <<"refresh_token">> => RefreshToken,
+                        <<"session_id">>    => SessionId
+                      },
+                      handler_utils:send_json(Req1, 200, Response);
+                    {error, invalid_client_type} ->
+                      handler_utils:send_error(Req1, 400, <<"Invalid client_type">>)
+                  end;
                 {error, not_verified} ->
                   handler_utils:send_error(Req1, 403, <<"Account not verified">>);
                 {error, frozen} ->
@@ -103,4 +117,4 @@ login(Req) ->
       end;
     false ->
       handler_utils:send_error(Req, 400, <<"Missing request body">>)
-  end.
+  end.

src/handlers/handler_refresh.erl

@@ -57,7 +57,8 @@ token_pair_schema() ->
     type => object,
     properties => #{
       token => #{type => string, description => <<"JWT access token">>},
-      refresh_token => #{type => string, description => <<"Refresh token">>}
+      refresh_token => #{type => string, description => <<"Refresh token">>},
+      session_id => #{type => string, description => <<"auth_session id">>}
     }
   }.
 
@@ -72,10 +73,11 @@ refresh(Req) ->
   try jsx:decode(Body, [return_maps]) of
     #{<<"refresh_token">> := RefreshToken} ->
       case logic_auth_session:refresh_user(RefreshToken) of
-        {ok, NewToken, NewRefreshToken} ->
+        {ok, NewToken, NewRefreshToken, SessionId} ->
           handler_utils:send_json(Req1, 200, #{
             token => NewToken,
-            refresh_token => NewRefreshToken
+            refresh_token => NewRefreshToken,
+            session_id => SessionId
           });
         {error, reuse_detected} ->
           handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);

src/handlers/handler_sessions.erl

@@ -0,0 +1,131 @@
+%%%-------------------------------------------------------------------
+%%% @doc User session list / revoke (Back#74).
+%%% GET    /v1/sessions
+%%% DELETE /v1/sessions/:id
+%%% POST   /v1/sessions/revoke-others
+%%% @end
+%%%-------------------------------------------------------------------
+-module(handler_sessions).
+-behaviour(cowboy_handler).
+
+-export([init/2, trails/0]).
+
+-include("records.hrl").
+
+-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
+init(Req, Opts) ->
+  Method = cowboy_req:method(Req),
+  case handler_utils:auth_user(Req) of
+    {ok, UserId, Req1} ->
+      case Method of
+        <<"GET">> ->
+          list_sessions(Req1, UserId);
+        <<"POST">> ->
+          case cowboy_req:path(Req1) of
+            <<"/v1/sessions/revoke-others">> ->
+              revoke_others(Req1, UserId);
+            _ ->
+              handler_utils:send_error(Req1, 405, <<"Method not allowed">>)
+          end;
+        <<"DELETE">> ->
+          SessionId = cowboy_req:binding(id, Req1),
+          revoke_one(Req1, UserId, SessionId);
+        _ ->
+          handler_utils:send_error(Req1, 405, <<"Method not allowed">>)
+      end;
+    {error, Code, Message, Req1} ->
+      handler_utils:send_error(Req1, Code, Message)
+  end,
+  {ok, Req, Opts}.
+
+-spec trails() -> [map()].
+trails() ->
+  [
+    #{
+      path => <<"/v1/sessions">>,
+      method => <<"GET">>,
+      description => <<"List active user sessions">>,
+      tags => [<<"Auth">>],
+      responses => #{
+        200 => #{description => <<"Session list">>},
+        401 => #{description => <<"Unauthorized">>}
+      }
+    },
+    #{
+      path => <<"/v1/sessions/:id">>,
+      method => <<"DELETE">>,
+      description => <<"Revoke one own session">>,
+      tags => [<<"Auth">>],
+      responses => #{
+        200 => #{description => <<"Revoked">>},
+        401 => #{description => <<"Unauthorized">>},
+        404 => #{description => <<"Not found">>}
+      }
+    },
+    #{
+      path => <<"/v1/sessions/revoke-others">>,
+      method => <<"POST">>,
+      description => <<"Revoke all sessions except current (from refresh_token)">>,
+      tags => [<<"Auth">>],
+      requestBody => #{
+        required => true,
+        content => #{
+          <<"application/json">> => #{
+            schema => #{
+              type => object,
+              required => [<<"refresh_token">>],
+              properties => #{refresh_token => #{type => string}}
+            }
+          }
+        }
+      },
+      responses => #{
+        200 => #{description => <<"Others revoked">>},
+        400 => #{description => <<"Bad request">>},
+        401 => #{description => <<"Unauthorized">>}
+      }
+    }
+  ].
+
+list_sessions(Req, UserId) ->
+  Items = [session_to_json(S) || S <- logic_auth_session:list_user_sessions(UserId)],
+  handler_utils:send_json(Req, 200, #{<<"sessions">> => Items}).
+
+revoke_one(Req, UserId, SessionId) when is_binary(SessionId), SessionId =/= <<>> ->
+  case logic_auth_session:revoke_user_session(UserId, SessionId) of
+    ok ->
+      handler_utils:send_json(Req, 200, #{<<"ok">> => true});
+    {error, not_found} ->
+      handler_utils:send_error(Req, 404, <<"Session not found">>)
+  end;
+revoke_one(Req, _UserId, _) ->
+  handler_utils:send_error(Req, 404, <<"Session not found">>).
+
+revoke_others(Req0, UserId) ->
+  {ok, Body, Req} = cowboy_req:read_body(Req0),
+  try jsx:decode(Body, [return_maps]) of
+    #{<<"refresh_token">> := RefreshToken} ->
+      case logic_auth_session:revoke_other_user_sessions(UserId, RefreshToken) of
+        {ok, Count} ->
+          handler_utils:send_json(Req, 200, #{<<"ok">> => true, <<"revoked">> => Count});
+        {error, forbidden} ->
+          handler_utils:send_error(Req, 403, <<"Refresh token subject mismatch">>);
+        {error, _} ->
+          handler_utils:send_error(Req, 401, <<"Invalid refresh token">>)
+      end;
+    _ ->
+      handler_utils:send_error(Req, 400, <<"Missing refresh_token field">>)
+  catch
+    _:_ -> handler_utils:send_error(Req, 400, <<"Invalid JSON">>)
+  end.
+
+session_to_json(#auth_session{} = S) ->
+  #{
+    <<"session_id">> => S#auth_session.session_id,
+    <<"client_type">> => S#auth_session.client_type,
+    <<"device_name">> => S#auth_session.device_name,
+    <<"user_agent">> => S#auth_session.user_agent,
+    <<"created_at">> => handler_utils:datetime_to_iso8601(S#auth_session.created_at),
+    <<"updated_at">> => handler_utils:datetime_to_iso8601(S#auth_session.updated_at),
+    <<"expires_at">> => handler_utils:datetime_to_iso8601(S#auth_session.expires_at)
+  }.