Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/handlers/admin/admin_handler_login.erl

@@ -19,10 +19,10 @@ init(Req0, _State) ->
           try jsx:decode(Body, [return_maps]) of
             #{<<"email">> := Email, <<"password">> := Password} ->
               case eventhub_auth:authenticate_admin_request(Req1, Email, Password) of
-                {ok, Token, User} ->
+                {ok, _Token, User} ->
                   UserId = maps:get(id, User),
-                  {RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
-                  core_admin_session:create(UserId, RefreshToken),
+                  Role = maps:get(role, User),
+                  {ok, Token, RefreshToken} = logic_auth_session:issue_admin_tokens(UserId, Role),
                   core_admin:update_last_login(UserId),
                   % Аудит успешного входа
                   admin_utils:log_admin_action(UserId, <<"login">>, <<"admin">>, Email, <<>>, Req1),

src/handlers/admin/admin_handler_refresh.erl

@@ -7,8 +7,6 @@
 -export([init/2]).
 -export([trails/0]).
 
--include("records.hrl").
-
 %%% cowboy_handler callback
 -spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
 init(Req, _Opts) ->
@@ -72,31 +70,25 @@ refresh(Req) ->
   {ok, Body, Req1} = cowboy_req:read_body(Req),
   try jsx:decode(Body, [return_maps]) of
     #{<<"refresh_token">> := RefreshToken} ->
-      case core_admin_session:validate(RefreshToken) of
-        {ok, AdminId} ->
-          admin_refresh(AdminId, RefreshToken, Req1);
+      case logic_auth_session:refresh_admin(RefreshToken) of
+        {ok, NewToken, NewRefreshToken} ->
+          handler_utils:send_json(Req1, 200, #{
+            token => NewToken,
+            refresh_token => NewRefreshToken
+          });
+        {error, reuse_detected} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
         {error, not_found} ->
           handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
         {error, expired} ->
-          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
+          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
+        {error, revoked} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
+        {error, _} ->
+          handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
       end;
     _ ->
       handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
   catch
     _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
-  end.
-
-%%%===================================================================
-%%% Внутренние функции
-%%%===================================================================
-
-%% @private Обновляет токен для администратора.
--spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
-admin_refresh(AdminId, OldToken, Req) ->
-  core_admin_session:delete(OldToken),
-  {ok, Admin} = core_admin:get_by_id(AdminId),
-  Role = atom_to_binary(Admin#admin.role, utf8),
-  NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
-  {NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
-  core_admin_session:create(AdminId, NewRefreshToken),
-  handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).
+  end.