EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

хендлер рефреш токена для админа #22

Browse Source
This commit is contained in:
Алексей Сабилин
2026-05-24 22:18:05 +03:00
parent 2b91e10f64
commit 6098039632
7 changed files with 208 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/eventhub_app.erl
+1
View File
@@ -109,6 +109,7 @@ start_admin_http() ->
{"/admin/health", admin_handler_health, []},
{"/v1/admin/stats", admin_handler_stats, []},
{"/v1/admin/login", admin_handler_login, []},
{"/v1/admin/refresh", admin_handler_refresh, []},
% ================== ПОЛЬЗОВАТЕЛИ ==================
{"/v1/admin/users", admin_handler_users, []},
{"/v1/admin/users/:id", admin_handler_user_by_id, []},
src/handlers/admin/admin_handler_refresh.erl
+102
View File
@@ -0,0 +1,102 @@
%%%-------------------------------------------------------------------
%%% @doc Обработчик обновления административного токена.
%%% @end
%%%-------------------------------------------------------------------
-module(admin_handler_refresh).
-behaviour(cowboy_handler).
-export([init/2]).
-export([trails/0]).
-include("records.hrl").
%%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"POST">> -> refresh(Req);
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end.
%%% Swagger metadata
-spec trails() -> [map()].
trails() ->
[
#{
path => <<"/v1/admin/refresh">>,
method => <<"POST">>,
description => <<"Refresh admin access token using refresh token">>,
tags => [<<"Admin">>],
requestBody => #{
required => true,
content => #{
<<"application/json">> => #{
schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{refresh_token => #{type => string}}
}
}
}
},
responses => #{
200 => #{
description => <<"New admin token pair (access + refresh)">>,
content => #{
<<"application/json">> => #{
schema => token_pair_schema()
}
}
},
400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
401 => #{description => <<"Refresh token expired or not found">>}
}
}
].
token_pair_schema() ->
#{
type => object,
properties => #{
token => #{type => string, description => <<"JWT access token">>},
refresh_token => #{type => string, description => <<"Refresh token">>}
}
}.
%%%===================================================================
%%% HTTP-методы
%%%===================================================================
%% @doc POST /v1/admin/refresh — обновление административного токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case core_admin_session:validate(RefreshToken) of
{ok, AdminId} ->
admin_refresh(AdminId, RefreshToken, Req1);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
catch
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
end.
%%%===================================================================
%%% Внутренние функции
%%%===================================================================
%% @private Обновляет токен для администратора.
-spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
admin_refresh(AdminId, OldToken, Req) ->
core_admin_session:delete(OldToken),
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
core_admin_session:create(AdminId, NewRefreshToken),
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
src/handlers/handler_refresh.erl
+41 -52
View File
@@ -5,7 +5,6 @@
%%%-------------------------------------------------------------------
-module(handler_refresh).
-behaviour(cowboy_handler).
-export([init/2]).
-export([trails/0]).
@@ -16,7 +15,7 @@
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"POST">> -> refresh(Req);
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end.
%%% Swagger metadata
@@ -24,43 +23,63 @@ init(Req, _Opts) ->
trails() ->
[
#{
path => <<"/v1/refresh">>,
method => <<"POST">>,
description => <<"Refresh access token using refresh token">>,
tags => [<<"Auth">>],
path => <<"/v1/auth/refresh">>,
method => <<"POST">>,
description => <<"Refresh user access token using refresh token">>,
tags => [<<"Auth">>],
requestBody => #{
required => true,
content => #{<<"application/json">> => #{schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{
refresh_token => #{type => string}
content => #{
<<"application/json">> => #{
schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{refresh_token => #{type => string}}
}
}
}}}
}
},
responses => #{
200 => #{description => <<"New token pair (access + refresh)">>},
200 => #{
description => <<"New user token pair (access + refresh)">>,
content => #{
<<"application/json">> => #{
schema => token_pair_schema()
}
}
},
400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
401 => #{description => <<"Refresh token expired or not found">>}
}
}
].
token_pair_schema() ->
#{
type => object,
properties => #{
token => #{type => string, description => <<"JWT access token">>},
refresh_token => #{type => string, description => <<"Refresh token">>}
}
}.
%%%===================================================================
%%% HTTP-методы
%%%===================================================================
%% @doc POST /v1/refresh — обновление токена.
%% @doc POST /v1/auth/refresh — обновление пользовательского токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case find_and_refresh(RefreshToken) of
{ok, NewTokenPair} ->
handler_utils:send_json(Req1, 200, NewTokenPair);
{error, Reason} ->
handler_utils:send_error(Req1, 401, Reason)
case core_session:validate(RefreshToken) of
{ok, UserId, User} ->
user_refresh(UserId, User, RefreshToken, Req1);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
@@ -72,42 +91,12 @@ refresh(Req) ->
%%% Внутренние функции
%%%===================================================================
%% @private Проверяет refresh-токен в таблицах пользовательских и админских сессий.
-spec find_and_refresh(binary()) -> {ok, map()} | {error, binary()}.
find_and_refresh(RefreshToken) ->
case core_session:validate(RefreshToken) of
{ok, UserId, User} ->
user_refresh(UserId, User, RefreshToken);
{error, not_found} ->
case core_admin_session:validate(RefreshToken) of
{ok, AdminId} ->
admin_refresh(AdminId, RefreshToken);
{error, not_found} ->
{error, <<"Refresh token not found">>};
{error, expired} ->
{error, <<"Refresh token expired">>}
end;
{error, expired} ->
{error, <<"Refresh token expired">>}
end.
%% @private Обновляет токен для обычного пользователя.
-spec user_refresh(binary(), #user{}, binary()) -> {ok, map()}.
user_refresh(UserId, User, OldToken) ->
-spec user_refresh(binary(), #user{}, binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
user_refresh(UserId, User, OldToken, Req) ->
core_session:delete(OldToken),
Role = atom_to_binary(User#user.role, utf8),
NewToken = eventhub_auth:generate_user_token(UserId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_session:create(UserId, NewRefreshToken),
{ok, #{token => NewToken, refresh_token => NewRefreshToken}}.
%% @private Обновляет токен для администратора.
-spec admin_refresh(binary(), binary()) -> {ok, map()}.
admin_refresh(AdminId, OldToken) ->
core_admin_session:delete(OldToken),
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
core_admin_session:create(AdminId, NewRefreshToken),
{ok, #{token => NewToken, refresh_token => NewRefreshToken}}.
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).