хендлер рефреш токена для админа #22

src/handlers/admin/admin_handler_refresh.erl

@@ -0,0 +1,102 @@
+%%%-------------------------------------------------------------------
+%%% @doc Обработчик обновления административного токена.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(admin_handler_refresh).
+-behaviour(cowboy_handler).
+-export([init/2]).
+-export([trails/0]).
+
+-include("records.hrl").
+
+%%% cowboy_handler callback
+-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
+init(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"POST">> -> refresh(Req);
+    _ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+%%% Swagger metadata
+-spec trails() -> [map()].
+trails() ->
+  [
+    #{
+      path => <<"/v1/admin/refresh">>,
+      method => <<"POST">>,
+      description => <<"Refresh admin access token using refresh token">>,
+      tags => [<<"Admin">>],
+      requestBody => #{
+        required => true,
+        content => #{
+          <<"application/json">> => #{
+            schema => #{
+              type => object,
+              required => [<<"refresh_token">>],
+              properties => #{refresh_token => #{type => string}}
+            }
+          }
+        }
+      },
+      responses => #{
+        200 => #{
+          description => <<"New admin token pair (access + refresh)">>,
+          content => #{
+            <<"application/json">> => #{
+              schema => token_pair_schema()
+            }
+          }
+        },
+        400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
+        401 => #{description => <<"Refresh token expired or not found">>}
+      }
+    }
+  ].
+
+token_pair_schema() ->
+  #{
+    type => object,
+    properties => #{
+      token => #{type => string, description => <<"JWT access token">>},
+      refresh_token => #{type => string, description => <<"Refresh token">>}
+    }
+  }.
+
+%%%===================================================================
+%%% HTTP-методы
+%%%===================================================================
+
+%% @doc POST /v1/admin/refresh — обновление административного токена.
+-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
+refresh(Req) ->
+  {ok, Body, Req1} = cowboy_req:read_body(Req),
+  try jsx:decode(Body, [return_maps]) of
+    #{<<"refresh_token">> := RefreshToken} ->
+      case core_admin_session:validate(RefreshToken) of
+        {ok, AdminId} ->
+          admin_refresh(AdminId, RefreshToken, Req1);
+        {error, not_found} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
+        {error, expired} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
+      end;
+    _ ->
+      handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
+  catch
+    _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
+  end.
+
+%%%===================================================================
+%%% Внутренние функции
+%%%===================================================================
+
+%% @private Обновляет токен для администратора.
+-spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
+admin_refresh(AdminId, OldToken, Req) ->
+  core_admin_session:delete(OldToken),
+  {ok, Admin} = core_admin:get_by_id(AdminId),
+  Role = atom_to_binary(Admin#admin.role, utf8),
+  NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
+  {NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
+  core_admin_session:create(AdminId, NewRefreshToken),
+  handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).