Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/unit/admin_handler_login_tests.erl

@@ -1,5 +1,6 @@
 -module(admin_handler_login_tests).
 -include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
 
 -define(JWT_SECRET,       <<"test-user-secret-key-32-byt!">>).
 -define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
@@ -7,6 +8,16 @@
 setup() ->
     ok = meck:new(logic_auth, [non_strict]),
     ok = meck:new(cowboy_req, [non_strict]),
+    ok = meck:new(core_admin, [non_strict]),
+    ok = meck:new(admin_utils, [non_strict]),
+    mnesia:start(),
+    catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+    mnesia:create_table(auth_session, [
+        {attributes, record_info(fields, auth_session)},
+        {ram_copies, [node()]}
+    ]),
+    mnesia:add_table_index(auth_session, #auth_session.family_id),
+    mnesia:add_table_index(auth_session, #auth_session.subject_id),
     application:set_env(eventhub, jwt_secret, ?JWT_SECRET),
     application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
     {ok, _} = application:ensure_all_started(jose).
@@ -15,6 +26,11 @@ cleanup(_) ->
     application:unset_env(eventhub, jwt_secret),
     application:unset_env(eventhub, admin_jwt_secret),
     application:stop(jose),
+    catch mnesia:delete_table(auth_session),
+    catch ets:delete(eventhub_counters),
+    mnesia:stop(),
+    meck:unload(admin_utils),
+    meck:unload(core_admin),
     meck:unload(cowboy_req),
     meck:unload(logic_auth),
     ok.
@@ -52,8 +68,10 @@ prepare_req(Method, HasBody, Body) ->
 
 test_valid_admin_login() ->
     UserMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>},
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(<<"admin@test.com">>, <<"pass">>) -> {ok, UserMap} end),
+    ok = meck:expect(core_admin, update_last_login, fun(_) -> ok end),
+    ok = meck:expect(admin_utils, log_admin_action, fun(_, _, _, _, _, _) -> ok end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"admin@test.com">>, password => <<"pass">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
     {Code, Headers, Body} = get(test_reply),
@@ -61,10 +79,11 @@ test_valid_admin_login() ->
     ?assertEqual(<<"application/json">>, maps:get(<<"content-type">>, Headers)),
     Resp = jsx:decode(Body, [return_maps]),
     ?assert(is_map_key(<<"token">>, Resp)),
+    ?assert(is_map_key(<<"refresh_token">>, Resp)),
     ?assertEqual(<<"superadmin">>, maps:get(<<"role">>, maps:get(<<"user">>, Resp))).
 
 test_invalid_credentials() ->
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(_, _) -> {error, bad_credentials} end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"bad@test.com">>, password => <<"wrong">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
@@ -74,7 +93,7 @@ test_invalid_credentials() ->
 
 test_insufficient_permissions() ->
     UserMap = #{id => <<"user1">>, email => <<"user@test.com">>, role => <<"user">>},
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(_, _) -> {ok, UserMap} end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"user@test.com">>, password => <<"pass">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
@@ -87,7 +106,7 @@ test_malformed_json() ->
     {ok, _, _} = admin_handler_login:init(Req0, []),
     {Code, _, Body} = get(test_reply),
     ?assertEqual(400, Code),
-    #{<<"error">> := <<"invalid_request">>} = jsx:decode(Body, [return_maps]).
+    #{<<"error">> := <<"Invalid JSON">>} = jsx:decode(Body, [return_maps]).
 
 test_missing_body() ->
     Req0 = prepare_req(<<"POST">>, false, undefined),