EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Browse Source 
Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Алексей Сабилин
2026-07-07 15:30:27 +03:00
parent efd67ef1e3
commit 9de57bd52c
13 changed files with 525 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/unit/auth_test.erl
+33 -5
View File
@@ -104,7 +104,7 @@ authenticate_admin_request_test_() ->
{"Successful admin login returns admin token",
fun() ->
AdminMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>},
ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, AdminMap} end),
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, AdminMap} end),
Req = undefined,
{ok, Token, ReturnedUser} = eventhub_auth:authenticate_admin_request(Req, <<"admin@test.com">>, <<"pass">>),
?assert(is_binary(Token)),
@@ -116,7 +116,7 @@ authenticate_admin_request_test_() ->
{"Non-admin role is rejected with insufficient_permissions",
fun() ->
UserMap = #{id => <<"simpleuser">>, email => <<"u@test.com">>, role => <<"user">>},
ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, UserMap} end),
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, UserMap} end),
Req = undefined,
?assertEqual({error, insufficient_permissions},
eventhub_auth:authenticate_admin_request(Req, <<"u@test.com">>, <<"pwd">>))
@@ -124,7 +124,7 @@ authenticate_admin_request_test_() ->
{"Moderator role is accepted as admin",
fun() ->
ModMap = #{id => <<"moder1">>, email => <<"mod@test.com">>, role => <<"moderator">>},
ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, ModMap} end),
ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, ModMap} end),
Req = undefined,
{ok, Token, _} = eventhub_auth:authenticate_admin_request(Req, <<"mod@test.com">>, <<"pwd">>),
{ok, _, Role} = eventhub_auth:verify_admin_token(Token),
@@ -133,7 +133,35 @@ authenticate_admin_request_test_() ->
]}.
%% ------------------------------------------------------------------
%% Тест generate_refresh_token/1
%% Тест generate_refresh_token/1 (legacy opaque, user flow)
%% ------------------------------------------------------------------
generate_refresh_token_test() ->
{_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>).
{_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>).
%% ------------------------------------------------------------------
%% Тесты refresh JWT (admin)
%% ------------------------------------------------------------------
admin_refresh_jwt_test_() ->
{setup, fun setup/0, fun cleanup/1, [
{"Generate and verify admin refresh JWT",
fun() ->
Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
{Token, _} = eventhub_auth:generate_admin_refresh_token(
Sid, Fid, Jti, <<"admin1">>, <<"admin">>
),
?assert(is_binary(Token)),
{ok, Claims} = eventhub_auth:verify_admin_refresh_token(Token),
?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
?assertEqual(Fid, maps:get(<<"fid">>, Claims)),
?assertEqual(Jti, maps:get(<<"jti">>, Claims)),
?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims))
end},
{"User refresh JWT rejected by admin verifier",
fun() ->
{Token, _} = eventhub_auth:generate_admin_refresh_token(
<<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"admin">>
),
?assertMatch({error, invalid_signature},
eventhub_auth:verify_user_token(Token))
end}
]}.