Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-07 15:30:27 +03:00
parent efd67ef1e3
commit 9de57bd52c
13 changed files with 525 additions and 45 deletions
@@ -0,0 +1,135 @@
+%%%-------------------------------------------------------------------
+%%% @doc Единая модель сессий (refresh JWT) в Mnesia.
+%%% Таблица `auth_session` реплицируется через disc_copies — безопасна в кластере.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(core_auth_session).
+-include("records.hrl").
+-export([create/3, get/1, rotate/2, revoke/1, revoke_family/1]).
+
+-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
+
+%%%-------------------------------------------------------------------
+%%% @doc Создать новую сессию устройства/клиента.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec create(SubjectId :: binary(), SubjectType :: user | admin, ClientType :: binary()) ->
+  {ok, #auth_session{}}.
+create(SubjectId, SubjectType, ClientType) ->
+  Now = calendar:universal_time(),
+  ExpiresAt = calendar:gregorian_seconds_to_datetime(
+    calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
+  ),
+  Session = #auth_session{
+    session_id   = infra_utils:generate_id(16),
+    family_id    = infra_utils:generate_id(16),
+    subject_id   = SubjectId,
+    subject_type = SubjectType,
+    client_type  = ClientType,
+    current_jti  = infra_utils:generate_id(16),
+    expires_at   = ExpiresAt,
+    revoked      = false,
+    created_at   = Now,
+    updated_at   = Now
+  },
+  mnesia:dirty_write(Session),
+  inc_counter(SubjectType),
+  {ok, Session}.
+
+%%%-------------------------------------------------------------------
+%%% @doc Получить сессию по идентификатору.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec get(SessionId :: binary()) -> {ok, #auth_session{}} | {error, not_found}.
+get(SessionId) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] -> {ok, Session};
+    [] -> {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Ротация refresh-токена: проверяет jti и выдаёт новый.
+%%% Несовпадение jti после ротации означает reuse — возвращает `{error, reuse_detected}`.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec rotate(SessionId :: binary(), PresentedJti :: binary()) ->
+  {ok, NewJti :: binary(), #auth_session{}} |
+  {error, not_found | expired | revoked | reuse_detected}.
+rotate(SessionId, PresentedJti) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] ->
+      rotate_session(Session, PresentedJti);
+    [] ->
+      {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Отозвать одну сессию.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec revoke(SessionId :: binary()) -> ok | {error, not_found}.
+revoke(SessionId) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] when Session#auth_session.revoked =:= true ->
+      ok;
+    [Session] ->
+      Now = calendar:universal_time(),
+      mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
+      dec_counter(Session#auth_session.subject_type),
+      ok;
+    [] ->
+      {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Отозвать все сессии семейства (reuse attack / принудительный logout).
+%%% @end
+%%%-------------------------------------------------------------------
+-spec revoke_family(FamilyId :: binary()) -> ok.
+revoke_family(FamilyId) ->
+  Sessions = mnesia:dirty_index_read(auth_session, FamilyId, #auth_session.family_id),
+  Now = calendar:universal_time(),
+  lists:foreach(fun(Session) ->
+    case Session#auth_session.revoked of
+      true -> ok;
+      false ->
+        mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
+        dec_counter(Session#auth_session.subject_type)
+    end
+                end, Sessions),
+  ok.
+
+%%%===================================================================
+%%% Internal
+%%%===================================================================
+
+rotate_session(Session, PresentedJti) ->
+  case Session#auth_session.revoked of
+    true ->
+      {error, revoked};
+    false ->
+      Now = calendar:universal_time(),
+      case Session#auth_session.expires_at > Now of
+        false ->
+          {error, expired};
+        true ->
+          case Session#auth_session.current_jti =:= PresentedJti of
+            true ->
+              NewJti = infra_utils:generate_id(16),
+              Updated = Session#auth_session{
+                current_jti = NewJti,
+                updated_at  = Now
+              },
+              mnesia:dirty_write(Updated),
+              {ok, NewJti, Updated};
+            false ->
+              {error, reuse_detected}
+          end
+      end
+  end.
+
+inc_counter(admin) -> core_counters:inc(admin_active_sessions);
+inc_counter(user) -> core_counters:inc(active_sessions).
+
+dec_counter(admin) -> core_counters:dec(admin_active_sessions);
+dec_counter(user) -> core_counters:dec(active_sessions).