Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-07 15:30:27 +03:00
parent efd67ef1e3
commit 9de57bd52c
13 changed files with 525 additions and 45 deletions
@@ -0,0 +1,69 @@
+-module(logic_auth_session_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
+
+setup() ->
+  ok = meck:new(core_admin, [non_strict]),
+  mnesia:start(),
+  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+  mnesia:create_table(auth_session, [
+    {attributes, record_info(fields, auth_session)},
+    {ram_copies, [node()]}
+  ]),
+  mnesia:add_table_index(auth_session, #auth_session.family_id),
+  mnesia:add_table_index(auth_session, #auth_session.subject_id),
+  application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
+  {ok, _} = application:ensure_all_started(jose),
+  ok.
+
+cleanup(_) ->
+  application:unset_env(eventhub, admin_jwt_secret),
+  application:stop(jose),
+  meck:unload(core_admin),
+  catch mnesia:delete_table(auth_session),
+  catch ets:delete(eventhub_counters),
+  mnesia:stop(),
+  ok.
+
+logic_auth_session_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"Issue and refresh admin tokens", fun test_issue_and_refresh/0},
+    {"Refresh reuse revokes family", fun test_reuse_revokes/0}
+  ]}.
+
+test_issue_and_refresh() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = superadmin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(Id) ->
+    ?assertEqual(AdminId, Id), {ok, Admin}
+  end),
+  {ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
+  ?assert(is_binary(Access1)),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access1),
+  {ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assert(is_binary(Access2)),
+  ?assertNotEqual(Refresh1, Refresh2),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
+
+test_reuse_revokes() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = admin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
+  {ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
+  {ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
+  ?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).