EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

хендлер рефреш токена для админа #22

Browse Source
This commit is contained in:
Алексей Сабилин
2026-05-24 22:18:05 +03:00
parent 2b91e10f64
commit 6098039632
7 changed files with 208 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+2 -1
View File
@@ -289,8 +289,9 @@ docker-swarm-deploy: ## Запустить кластер
@set JWT_SECRET=$$(grep JWT_SECRET docker/.env | cut -d '=' -f2)
@docker stack deploy -c docker/docker-compose.swarm.yml eventhub --detach=true
@echo "✅ Кластер запущен"
@echo "Admin UI: https://admin-ui.eventhub.local"
docker-swarm-stop: ## Запустить кластер
docker-swarm-stop: ## Остановить кластер
@docker stack rm eventhub
##@docker volume prune -f
@echo "✅ Кластер удален"
src/eventhub_app.erl
+1
View File
@@ -109,6 +109,7 @@ start_admin_http() ->
{"/admin/health", admin_handler_health, []},
{"/v1/admin/stats", admin_handler_stats, []},
{"/v1/admin/login", admin_handler_login, []},
{"/v1/admin/refresh", admin_handler_refresh, []},
% ================== ПОЛЬЗОВАТЕЛИ ==================
{"/v1/admin/users", admin_handler_users, []},
{"/v1/admin/users/:id", admin_handler_user_by_id, []},
src/handlers/admin/admin_handler_refresh.erl
+102
View File
@@ -0,0 +1,102 @@
%%%-------------------------------------------------------------------
%%% @doc Обработчик обновления административного токена.
%%% @end
%%%-------------------------------------------------------------------
-module(admin_handler_refresh).
-behaviour(cowboy_handler).
-export([init/2]).
-export([trails/0]).
-include("records.hrl").
%%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"POST">> -> refresh(Req);
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end.
%%% Swagger metadata
-spec trails() -> [map()].
trails() ->
[
#{
path => <<"/v1/admin/refresh">>,
method => <<"POST">>,
description => <<"Refresh admin access token using refresh token">>,
tags => [<<"Admin">>],
requestBody => #{
required => true,
content => #{
<<"application/json">> => #{
schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{refresh_token => #{type => string}}
}
}
}
},
responses => #{
200 => #{
description => <<"New admin token pair (access + refresh)">>,
content => #{
<<"application/json">> => #{
schema => token_pair_schema()
}
}
},
400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
401 => #{description => <<"Refresh token expired or not found">>}
}
}
].
token_pair_schema() ->
#{
type => object,
properties => #{
token => #{type => string, description => <<"JWT access token">>},
refresh_token => #{type => string, description => <<"Refresh token">>}
}
}.
%%%===================================================================
%%% HTTP-методы
%%%===================================================================
%% @doc POST /v1/admin/refresh — обновление административного токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case core_admin_session:validate(RefreshToken) of
{ok, AdminId} ->
admin_refresh(AdminId, RefreshToken, Req1);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
catch
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
end.
%%%===================================================================
%%% Внутренние функции
%%%===================================================================
%% @private Обновляет токен для администратора.
-spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
admin_refresh(AdminId, OldToken, Req) ->
core_admin_session:delete(OldToken),
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
core_admin_session:create(AdminId, NewRefreshToken),
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
src/handlers/handler_refresh.erl
+41 -52
View File
@@ -5,7 +5,6 @@
%%%-------------------------------------------------------------------
-module(handler_refresh).
-behaviour(cowboy_handler).
-export([init/2]).
-export([trails/0]).
@@ -16,7 +15,7 @@
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"POST">> -> refresh(Req);
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
_ -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
end.
%%% Swagger metadata
@@ -24,43 +23,63 @@ init(Req, _Opts) ->
trails() ->
[
#{
path => <<"/v1/refresh">>,
method => <<"POST">>,
description => <<"Refresh access token using refresh token">>,
tags => [<<"Auth">>],
path => <<"/v1/auth/refresh">>,
method => <<"POST">>,
description => <<"Refresh user access token using refresh token">>,
tags => [<<"Auth">>],
requestBody => #{
required => true,
content => #{<<"application/json">> => #{schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{
refresh_token => #{type => string}
content => #{
<<"application/json">> => #{
schema => #{
type => object,
required => [<<"refresh_token">>],
properties => #{refresh_token => #{type => string}}
}
}
}}}
}
},
responses => #{
200 => #{description => <<"New token pair (access + refresh)">>},
200 => #{
description => <<"New user token pair (access + refresh)">>,
content => #{
<<"application/json">> => #{
schema => token_pair_schema()
}
}
},
400 => #{description => <<"Missing refresh_token field or invalid JSON">>},
401 => #{description => <<"Refresh token expired or not found">>}
}
}
].
token_pair_schema() ->
#{
type => object,
properties => #{
token => #{type => string, description => <<"JWT access token">>},
refresh_token => #{type => string, description => <<"Refresh token">>}
}
}.
%%%===================================================================
%%% HTTP-методы
%%%===================================================================
%% @doc POST /v1/refresh — обновление токена.
%% @doc POST /v1/auth/refresh — обновление пользовательского токена.
-spec refresh(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case find_and_refresh(RefreshToken) of
{ok, NewTokenPair} ->
handler_utils:send_json(Req1, 200, NewTokenPair);
{error, Reason} ->
handler_utils:send_error(Req1, 401, Reason)
case core_session:validate(RefreshToken) of
{ok, UserId, User} ->
user_refresh(UserId, User, RefreshToken, Req1);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
@@ -72,42 +91,12 @@ refresh(Req) ->
%%% Внутренние функции
%%%===================================================================
%% @private Проверяет refresh-токен в таблицах пользовательских и админских сессий.
-spec find_and_refresh(binary()) -> {ok, map()} | {error, binary()}.
find_and_refresh(RefreshToken) ->
case core_session:validate(RefreshToken) of
{ok, UserId, User} ->
user_refresh(UserId, User, RefreshToken);
{error, not_found} ->
case core_admin_session:validate(RefreshToken) of
{ok, AdminId} ->
admin_refresh(AdminId, RefreshToken);
{error, not_found} ->
{error, <<"Refresh token not found">>};
{error, expired} ->
{error, <<"Refresh token expired">>}
end;
{error, expired} ->
{error, <<"Refresh token expired">>}
end.
%% @private Обновляет токен для обычного пользователя.
-spec user_refresh(binary(), #user{}, binary()) -> {ok, map()}.
user_refresh(UserId, User, OldToken) ->
-spec user_refresh(binary(), #user{}, binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
user_refresh(UserId, User, OldToken, Req) ->
core_session:delete(OldToken),
Role = atom_to_binary(User#user.role, utf8),
NewToken = eventhub_auth:generate_user_token(UserId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_session:create(UserId, NewRefreshToken),
{ok, #{token => NewToken, refresh_token => NewRefreshToken}}.
%% @private Обновляет токен для администратора.
-spec admin_refresh(binary(), binary()) -> {ok, map()}.
admin_refresh(AdminId, OldToken) ->
core_admin_session:delete(OldToken),
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
core_admin_session:create(AdminId, NewRefreshToken),
{ok, #{token => NewToken, refresh_token => NewRefreshToken}}.
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
test/api/admins/admin_refresh_tests.erl
+48
View File
@@ -0,0 +1,48 @@
%%%-------------------------------------------------------------------
%%% @doc Тесты административного API для обновления токена.
%%% Покрывает эндпоинт:
%%% POST /v1/admin/refresh
%%% @end
%%%-------------------------------------------------------------------
-module(admin_refresh_tests).
-include_lib("eunit/include/eunit.hrl").
-export([test/0]).
-spec test() -> ok.
test() ->
ct:pal("=== Admin Refresh Tests ==="),
RefreshToken = api_test_runner:get_admin_refresh_token(),
test_successful_refresh(RefreshToken),
test_invalid_refresh_token(),
test_missing_refresh_token(),
ct:pal("=== All admin refresh tests passed ==="),
ok.
-spec test_successful_refresh(binary()) -> ok.
test_successful_refresh(RefreshToken) ->
ct:pal(" TEST: Successful admin token refresh"),
Resp = api_test_runner:admin_request(post, <<"/v1/admin/refresh">>, <<>>,
jsx:encode(#{refresh_token => RefreshToken})),
{ok, 200, _, Body} = Resp,
#{<<"token">> := NewToken, <<"refresh_token">> := NewRefresh} =
jsx:decode(list_to_binary(Body), [return_maps]),
?assert(is_binary(NewToken)),
?assert(is_binary(NewRefresh)),
?assertNotEqual(RefreshToken, NewRefresh),
ct:pal(" OK: got new admin token pair").
-spec test_invalid_refresh_token() -> ok.
test_invalid_refresh_token() ->
ct:pal(" TEST: Invalid admin refresh token"),
Resp = api_test_runner:admin_request(post, <<"/v1/admin/refresh">>, <<>>,
jsx:encode(#{refresh_token => <<"bad">>})),
{ok, 401, _, _} = Resp,
ct:pal(" OK: got 401").
-spec test_missing_refresh_token() -> ok.
test_missing_refresh_token() ->
ct:pal(" TEST: Missing refresh_token field for admin"),
Resp = api_test_runner:admin_request(post, <<"/v1/admin/refresh">>, <<>>,
jsx:encode(#{})),
?assertMatch({ok, 400, _, _}, Resp),
ct:pal(" OK: got 400").
test/api/api_test_runner.erl
+10 -1
View File
@@ -23,7 +23,7 @@
register_and_login/2,
create_calendar/2,
create_event/3
]).
, get_admin_refresh_token/0]).
-export([
admin_request/3,
admin_request/4,
@@ -133,6 +133,15 @@ get_moderator_token() ->
get_support_token() ->
get_or_login(support, admin_support_email(), admin_support_password()).
-spec get_admin_refresh_token() -> binary().
get_admin_refresh_token() ->
Email = admin_email(),
Password = admin_password(),
Body = jsx:encode(#{email => Email, password => Password}),
{ok, 200, _, RespBody} = admin_request(post, <<"/v1/admin/login">>, <<>>, Body),
#{<<"refresh_token">> := RefreshToken} = jsx:decode(list_to_binary(RespBody), [return_maps]),
RefreshToken.
-spec get_or_login(atom(), binary(), binary()) -> binary().
get_or_login(Role, Email, Password) ->
Key = {?MODULE, admin_token, Role},
test/api_admins_SUITE.erl
+4
View File
@@ -36,6 +36,7 @@ all() ->
admin_test_audit,
admin_test_stats,
admin_test_me,
admin_test_refresh,
admin_test_admins,
admin_test_websocket
].
@@ -118,6 +119,9 @@ admin_test_stats(_Config) ->
admin_test_me(_Config) ->
admin_me_tests:test().
admin_test_refresh(_Config) ->
admin_refresh_tests:test().
admin_test_admins(_Config) ->
admin_admins_tests:test().