Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/infra/eventhub_auth.erl

@@ -6,7 +6,9 @@
   verify_admin_token/1,
   authenticate_user_request/3,
   authenticate_admin_request/3,
-  generate_refresh_token/1
+  generate_refresh_token/1,
+  generate_admin_refresh_token/5,
+  verify_admin_refresh_token/1
 ]).
 
 %% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
@@ -146,13 +148,98 @@ authenticate_admin_request(_Req, Email, Password) ->
 is_admin_role(Role) ->
   lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
 
-%% ========== REFRESH TOKEN ==========
+-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
+
+%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ==========
 
 -spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
 generate_refresh_token(_UserId) ->
   RefreshToken = base64:encode(crypto:strong_rand_bytes(32)),
   Now = calendar:universal_time(),
   ExpiresAt = calendar:gregorian_seconds_to_datetime(
-    calendar:datetime_to_gregorian_seconds(Now) + 30 * 24 * 3600
+    calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
   ),
-  {RefreshToken, ExpiresAt}.
+  {RefreshToken, ExpiresAt}.
+
+%% ========== REFRESH JWT (единая session-модель) ==========
+
+-spec generate_admin_refresh_token(
+  SessionId :: binary(),
+  FamilyId :: binary(),
+  Jti :: binary(),
+  SubjectId :: binary(),
+  ClientType :: binary()
+) -> {binary(), calendar:datetime()}.
+generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
+  generate_refresh_jwt(
+    get_admin_jwk(), SubjectId, <<"admin">>, SessionId, FamilyId, Jti, ClientType
+  ).
+
+-spec verify_admin_refresh_token(Token :: binary()) ->
+  {ok, map()} | {error, atom()}.
+verify_admin_refresh_token(Token) ->
+  verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
+
+generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
+  ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
+  Claims = #{
+    <<"typ">>    => <<"refresh">>,
+    <<"sub">>    => SubjectId,
+    <<"aud">>    => Audience,
+    <<"sid">>    => SessionId,
+    <<"fid">>    => FamilyId,
+    <<"jti">>    => Jti,
+    <<"client">> => ClientType,
+    <<"exp">>    => ExpTime,
+    <<"iat">>    => erlang:system_time(second)
+  },
+  JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
+  {_, Token} = jose_jws:compact(JWT),
+  ExpiresAt = calendar:gregorian_seconds_to_datetime(
+    calendar:datetime_to_gregorian_seconds(calendar:universal_time()) + ?REFRESH_TTL_SECONDS
+  ),
+  {Token, ExpiresAt}.
+
+verify_refresh_jwt(JWK, Token, ExpectedAud) ->
+  try
+    case jose_jwt:verify(JWK, Token) of
+      {true, {jose_jwt, Claims}, _} ->
+        validate_refresh_claims(Claims, ExpectedAud);
+      {true, Claims, _} when is_map(Claims) ->
+        validate_refresh_claims(Claims, ExpectedAud);
+      _ ->
+        {error, invalid_signature}
+    end
+  catch
+    _:_ -> {error, invalid_token}
+  end.
+
+validate_refresh_claims(Claims, ExpectedAud) ->
+  case maps:get(<<"typ">>, Claims, undefined) of
+    <<"refresh">> ->
+      case maps:get(<<"aud">>, Claims, undefined) of
+        ExpectedAud ->
+          validate_refresh_exp(Claims);
+        _ ->
+          {error, invalid_audience}
+      end;
+    _ ->
+      {error, invalid_token_type}
+  end.
+
+validate_refresh_exp(Claims) ->
+  Required = [<<"sid">>, <<"fid">>, <<"jti">>, <<"sub">>, <<"exp">>],
+  case [K || K <- Required, not maps:is_key(K, Claims)] of
+    [] ->
+      case maps:get(<<"exp">>, Claims) of
+        Exp when is_integer(Exp) ->
+          case Exp > erlang:system_time(second) of
+            true -> {ok, Claims};
+            false -> {error, expired}
+          end;
+        _ ->
+          {error, expired}
+      end;
+    _ ->
+      {error, invalid_token}
+  end.

src/infra/infra_mnesia.erl

@@ -12,7 +12,7 @@
   terminate/2, code_change/3]).
 
 -define(TABLES, [
-  user, session, verification, admin, admin_session,
+  user, session, verification, admin, admin_session, auth_session,
   calendar, calendar_share, calendar_specialist,
   event, recurrence_exception,
   booking,
@@ -239,6 +239,7 @@ table_opts(schema_migration) -> [{disc_copies, [node()]}, {attributes, record_in
 table_opts(session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, session)}];
 table_opts(verification) -> [{ram_copies, [node()]}, {attributes, record_info(fields, verification)}];
 table_opts(admin_session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, admin_session)}];
+table_opts(auth_session) -> [{disc_copies, [node()]}, {attributes, record_info(fields, auth_session)}];
 table_opts(node_metric) -> [{disc_copies, [node()]}, {local_content, true}, {attributes, record_info(fields, node_metric)}].
 
 %% ===================================================================
@@ -267,4 +268,6 @@ create_indices() ->
   mnesia:add_table_index(user, email),
   mnesia:add_table_index(notification, user_id),
   mnesia:add_table_index(notification, is_read),
+  mnesia:add_table_index(auth_session, family_id),
+  mnesia:add_table_index(auth_session, subject_id),
   ok.