EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Browse Source 
Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Алексей Сабилин
2026-07-07 15:30:27 +03:00
parent efd67ef1e3
commit 9de57bd52c
13 changed files with 525 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/core_auth_session.erl
+135
View File
@@ -0,0 +1,135 @@
%%%-------------------------------------------------------------------
%%% @doc Единая модель сессий (refresh JWT) в Mnesia.
%%% Таблица `auth_session` реплицируется через disc_copies — безопасна в кластере.
%%% @end
%%%-------------------------------------------------------------------
-module(core_auth_session).
-include("records.hrl").
-export([create/3, get/1, rotate/2, revoke/1, revoke_family/1]).
-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
%%%-------------------------------------------------------------------
%%% @doc Создать новую сессию устройства/клиента.
%%% @end
%%%-------------------------------------------------------------------
-spec create(SubjectId :: binary(), SubjectType :: user | admin, ClientType :: binary()) ->
{ok, #auth_session{}}.
create(SubjectId, SubjectType, ClientType) ->
Now = calendar:universal_time(),
ExpiresAt = calendar:gregorian_seconds_to_datetime(
calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
),
Session = #auth_session{
session_id = infra_utils:generate_id(16),
family_id = infra_utils:generate_id(16),
subject_id = SubjectId,
subject_type = SubjectType,
client_type = ClientType,
current_jti = infra_utils:generate_id(16),
expires_at = ExpiresAt,
revoked = false,
created_at = Now,
updated_at = Now
},
mnesia:dirty_write(Session),
inc_counter(SubjectType),
{ok, Session}.
%%%-------------------------------------------------------------------
%%% @doc Получить сессию по идентификатору.
%%% @end
%%%-------------------------------------------------------------------
-spec get(SessionId :: binary()) -> {ok, #auth_session{}} | {error, not_found}.
get(SessionId) ->
case mnesia:dirty_read({auth_session, SessionId}) of
[Session] -> {ok, Session};
[] -> {error, not_found}
end.
%%%-------------------------------------------------------------------
%%% @doc Ротация refresh-токена: проверяет jti и выдаёт новый.
%%% Несовпадение jti после ротации означает reuse — возвращает `{error, reuse_detected}`.
%%% @end
%%%-------------------------------------------------------------------
-spec rotate(SessionId :: binary(), PresentedJti :: binary()) ->
{ok, NewJti :: binary(), #auth_session{}} |
{error, not_found | expired | revoked | reuse_detected}.
rotate(SessionId, PresentedJti) ->
case mnesia:dirty_read({auth_session, SessionId}) of
[Session] ->
rotate_session(Session, PresentedJti);
[] ->
{error, not_found}
end.
%%%-------------------------------------------------------------------
%%% @doc Отозвать одну сессию.
%%% @end
%%%-------------------------------------------------------------------
-spec revoke(SessionId :: binary()) -> ok | {error, not_found}.
revoke(SessionId) ->
case mnesia:dirty_read({auth_session, SessionId}) of
[Session] when Session#auth_session.revoked =:= true ->
ok;
[Session] ->
Now = calendar:universal_time(),
mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
dec_counter(Session#auth_session.subject_type),
ok;
[] ->
{error, not_found}
end.
%%%-------------------------------------------------------------------
%%% @doc Отозвать все сессии семейства (reuse attack / принудительный logout).
%%% @end
%%%-------------------------------------------------------------------
-spec revoke_family(FamilyId :: binary()) -> ok.
revoke_family(FamilyId) ->
Sessions = mnesia:dirty_index_read(auth_session, FamilyId, #auth_session.family_id),
Now = calendar:universal_time(),
lists:foreach(fun(Session) ->
case Session#auth_session.revoked of
true -> ok;
false ->
mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
dec_counter(Session#auth_session.subject_type)
end
end, Sessions),
ok.
%%%===================================================================
%%% Internal
%%%===================================================================
rotate_session(Session, PresentedJti) ->
case Session#auth_session.revoked of
true ->
{error, revoked};
false ->
Now = calendar:universal_time(),
case Session#auth_session.expires_at > Now of
false ->
{error, expired};
true ->
case Session#auth_session.current_jti =:= PresentedJti of
true ->
NewJti = infra_utils:generate_id(16),
Updated = Session#auth_session{
current_jti = NewJti,
updated_at = Now
},
mnesia:dirty_write(Updated),
{ok, NewJti, Updated};
false ->
{error, reuse_detected}
end
end
end.
inc_counter(admin) -> core_counters:inc(admin_active_sessions);
inc_counter(user) -> core_counters:inc(active_sessions).
dec_counter(admin) -> core_counters:dec(admin_active_sessions);
dec_counter(user) -> core_counters:dec(active_sessions).
src/handlers/admin/admin_handler_login.erl
+3 -3
View File
@@ -19,10 +19,10 @@ init(Req0, _State) ->
try jsx:decode(Body, [return_maps]) of
#{<<"email">> := Email, <<"password">> := Password} ->
case eventhub_auth:authenticate_admin_request(Req1, Email, Password) of
{ok, Token, User} ->
{ok, _Token, User} ->
UserId = maps:get(id, User),
{RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
core_admin_session:create(UserId, RefreshToken),
Role = maps:get(role, User),
{ok, Token, RefreshToken} = logic_auth_session:issue_admin_tokens(UserId, Role),
core_admin:update_last_login(UserId),
% Аудит успешного входа
admin_utils:log_admin_action(UserId, <<"login">>, <<"admin">>, Email, <<>>, Req1),
src/handlers/admin/admin_handler_refresh.erl
+14 -22
View File
@@ -7,8 +7,6 @@
-export([init/2]).
-export([trails/0]).
-include("records.hrl").
%%% cowboy_handler callback
-spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
init(Req, _Opts) ->
@@ -72,31 +70,25 @@ refresh(Req) ->
{ok, Body, Req1} = cowboy_req:read_body(Req),
try jsx:decode(Body, [return_maps]) of
#{<<"refresh_token">> := RefreshToken} ->
case core_admin_session:validate(RefreshToken) of
{ok, AdminId} ->
admin_refresh(AdminId, RefreshToken, Req1);
case logic_auth_session:refresh_admin(RefreshToken) of
{ok, NewToken, NewRefreshToken} ->
handler_utils:send_json(Req1, 200, #{
token => NewToken,
refresh_token => NewRefreshToken
});
{error, reuse_detected} ->
handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
{error, not_found} ->
handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
{error, expired} ->
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
{error, revoked} ->
handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
{error, _} ->
handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
end;
_ ->
handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
catch
_:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
end.
%%%===================================================================
%%% Внутренние функции
%%%===================================================================
%% @private Обновляет токен для администратора.
-spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
admin_refresh(AdminId, OldToken, Req) ->
core_admin_session:delete(OldToken),
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
core_admin_session:create(AdminId, NewRefreshToken),
handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
end.
src/infra/eventhub_auth.erl
+91 -4
View File
@@ -6,7 +6,9 @@
verify_admin_token/1,
authenticate_user_request/3,
authenticate_admin_request/3,
generate_refresh_token/1
generate_refresh_token/1,
generate_admin_refresh_token/5,
verify_admin_refresh_token/1
]).
%% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
@@ -146,13 +148,98 @@ authenticate_admin_request(_Req, Email, Password) ->
is_admin_role(Role) ->
lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
%% ========== REFRESH TOKEN ==========
-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ==========
-spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
generate_refresh_token(_UserId) ->
RefreshToken = base64:encode(crypto:strong_rand_bytes(32)),
Now = calendar:universal_time(),
ExpiresAt = calendar:gregorian_seconds_to_datetime(
calendar:datetime_to_gregorian_seconds(Now) + 30 * 24 * 3600
calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
),
{RefreshToken, ExpiresAt}.
{RefreshToken, ExpiresAt}.
%% ========== REFRESH JWT (единая session-модель) ==========
-spec generate_admin_refresh_token(
SessionId :: binary(),
FamilyId :: binary(),
Jti :: binary(),
SubjectId :: binary(),
ClientType :: binary()
) -> {binary(), calendar:datetime()}.
generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
generate_refresh_jwt(
get_admin_jwk(), SubjectId, <<"admin">>, SessionId, FamilyId, Jti, ClientType
).
-spec verify_admin_refresh_token(Token :: binary()) ->
{ok, map()} | {error, atom()}.
verify_admin_refresh_token(Token) ->
verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
Claims = #{
<<"typ">> => <<"refresh">>,
<<"sub">> => SubjectId,
<<"aud">> => Audience,
<<"sid">> => SessionId,
<<"fid">> => FamilyId,
<<"jti">> => Jti,
<<"client">> => ClientType,
<<"exp">> => ExpTime,
<<"iat">> => erlang:system_time(second)
},
JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
{_, Token} = jose_jws:compact(JWT),
ExpiresAt = calendar:gregorian_seconds_to_datetime(
calendar:datetime_to_gregorian_seconds(calendar:universal_time()) + ?REFRESH_TTL_SECONDS
),
{Token, ExpiresAt}.
verify_refresh_jwt(JWK, Token, ExpectedAud) ->
try
case jose_jwt:verify(JWK, Token) of
{true, {jose_jwt, Claims}, _} ->
validate_refresh_claims(Claims, ExpectedAud);
{true, Claims, _} when is_map(Claims) ->
validate_refresh_claims(Claims, ExpectedAud);
_ ->
{error, invalid_signature}
end
catch
_:_ -> {error, invalid_token}
end.
validate_refresh_claims(Claims, ExpectedAud) ->
case maps:get(<<"typ">>, Claims, undefined) of
<<"refresh">> ->
case maps:get(<<"aud">>, Claims, undefined) of
ExpectedAud ->
validate_refresh_exp(Claims);
_ ->
{error, invalid_audience}
end;
_ ->
{error, invalid_token_type}
end.
validate_refresh_exp(Claims) ->
Required = [<<"sid">>, <<"fid">>, <<"jti">>, <<"sub">>, <<"exp">>],
case [K || K <- Required, not maps:is_key(K, Claims)] of
[] ->
case maps:get(<<"exp">>, Claims) of
Exp when is_integer(Exp) ->
case Exp > erlang:system_time(second) of
true -> {ok, Claims};
false -> {error, expired}
end;
_ ->
{error, expired}
end;
_ ->
{error, invalid_token}
end.
src/infra/infra_mnesia.erl
+4 -1
View File
@@ -12,7 +12,7 @@
terminate/2, code_change/3]).
-define(TABLES, [
user, session, verification, admin, admin_session,
user, session, verification, admin, admin_session, auth_session,
calendar, calendar_share, calendar_specialist,
event, recurrence_exception,
booking,
@@ -239,6 +239,7 @@ table_opts(schema_migration) -> [{disc_copies, [node()]}, {attributes, record_in
table_opts(session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, session)}];
table_opts(verification) -> [{ram_copies, [node()]}, {attributes, record_info(fields, verification)}];
table_opts(admin_session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, admin_session)}];
table_opts(auth_session) -> [{disc_copies, [node()]}, {attributes, record_info(fields, auth_session)}];
table_opts(node_metric) -> [{disc_copies, [node()]}, {local_content, true}, {attributes, record_info(fields, node_metric)}].
%% ===================================================================
@@ -267,4 +268,6 @@ create_indices() ->
mnesia:add_table_index(user, email),
mnesia:add_table_index(notification, user_id),
mnesia:add_table_index(notification, is_read),
mnesia:add_table_index(auth_session, family_id),
mnesia:add_table_index(auth_session, subject_id),
ok.
src/logic/logic_auth_session.erl
+62
View File
@@ -0,0 +1,62 @@
%%%-------------------------------------------------------------------
%%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
%%% Фаза 1: admin API. Фазы 2–3: user / client web / mobile.
%%% @end
%%%-------------------------------------------------------------------
-module(logic_auth_session).
-include("records.hrl").
-export([issue_admin_tokens/2, refresh_admin/1]).
%%%-------------------------------------------------------------------
%%% @doc Выдать пару access + refresh JWT при входе администратора.
%%% @end
%%%-------------------------------------------------------------------
-spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
{ok, AccessToken :: binary(), RefreshToken :: binary()}.
issue_admin_tokens(AdminId, Role) ->
{ok, Session} = core_auth_session:create(AdminId, admin, <<"admin">>),
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
{RefreshToken, _} = eventhub_auth:generate_admin_refresh_token(
Session#auth_session.session_id,
Session#auth_session.family_id,
Session#auth_session.current_jti,
AdminId,
<<"admin">>
),
{ok, AccessToken, RefreshToken}.
%%%-------------------------------------------------------------------
%%% @doc Обновить пару токенов администратора по refresh JWT.
%%% @end
%%%-------------------------------------------------------------------
-spec refresh_admin(RefreshToken :: binary()) ->
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
{error, atom()}.
refresh_admin(RefreshToken) ->
case eventhub_auth:verify_admin_refresh_token(RefreshToken) of
{ok, Claims} ->
do_refresh_admin(Claims);
Error ->
Error
end.
do_refresh_admin(Claims) ->
SessionId = maps:get(<<"sid">>, Claims),
Jti = maps:get(<<"jti">>, Claims),
AdminId = maps:get(<<"sub">>, Claims),
FamilyId = maps:get(<<"fid">>, Claims),
case core_auth_session:rotate(SessionId, Jti) of
{ok, NewJti, _Session} ->
{ok, Admin} = core_admin:get_by_id(AdminId),
Role = atom_to_binary(Admin#admin.role, utf8),
AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
{NewRefresh, _} = eventhub_auth:generate_admin_refresh_token(
SessionId, FamilyId, NewJti, AdminId, <<"admin">>
),
{ok, AccessToken, NewRefresh};
{error, reuse_detected} ->
core_auth_session:revoke_family(FamilyId),
{error, reuse_detected};
Error ->
Error
end.