Реализовать кластер-безопасные admin refresh-сессии (фаза 1, #23).

Единая auth_session с refresh JWT, rotation и reuse detection; CI/CD временно на workflow_dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-and-test.yml

@@ -1,7 +1,11 @@
+# ВРЕМЕННО ОТКЛЮЧЕНО — CI/CD требует донастройки (см. EventHubBack#23).
+# Ручной запуск: Actions → Run workflow
 name: Test & Deploy to Snapdeploy
 on:
-  push:
+  workflow_dispatch:
-    branches: [ master ]
+# on:
+#   push:
+#     branches: [ master ]
 
 jobs:
   build-test-deploy:
@@ -41,7 +45,7 @@ jobs:
         with:
           registry: git.sabilin.com
           username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          password: ${{ secrets.REGISTRY_PASSWORD }} # 6fc03959f69bb530f77c4d9173903f52532acdc0
 
       - name: Tag and push eventhub image
         if: success()

.gitea/workflows/deploy-stage.yml

@@ -1,8 +1,12 @@
+# ВРЕМЕННО ОТКЛЮЧЕНО — CI/CD требует донастройки.
+# Ручной запуск: Actions → Run workflow
 name: Deploy to Stage
 on:
-  push:
+  workflow_dispatch:
-    tags:
+# on:
-      - 'v*'
+#   push:
+#     tags:
+#       - 'v*'
 
 jobs:
   deploy-stage:

include/records.hrl

@@ -61,6 +61,20 @@
   type            :: refresh
 }).
 
+%% ------------------- ЕДИНАЯ МОДЕЛЬ СЕССИЙ (refresh JWT) ----------------
+-record(auth_session, {
+  session_id    :: binary(),
+  family_id     :: binary(),
+  subject_id    :: binary(),
+  subject_type  :: user | admin,
+  client_type   :: binary(),
+  current_jti   :: binary(),
+  expires_at    :: calendar:datetime(),
+  revoked       :: boolean(),
+  created_at    :: calendar:datetime(),
+  updated_at    :: calendar:datetime()
+}).
+
 %% ------------------- Календари ---------------------------------------
 -record(calendar, {
   id              :: binary(),

src/core/core_auth_session.erl

@@ -0,0 +1,135 @@
+%%%-------------------------------------------------------------------
+%%% @doc Единая модель сессий (refresh JWT) в Mnesia.
+%%% Таблица `auth_session` реплицируется через disc_copies — безопасна в кластере.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(core_auth_session).
+-include("records.hrl").
+-export([create/3, get/1, rotate/2, revoke/1, revoke_family/1]).
+
+-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
+
+%%%-------------------------------------------------------------------
+%%% @doc Создать новую сессию устройства/клиента.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec create(SubjectId :: binary(), SubjectType :: user | admin, ClientType :: binary()) ->
+  {ok, #auth_session{}}.
+create(SubjectId, SubjectType, ClientType) ->
+  Now = calendar:universal_time(),
+  ExpiresAt = calendar:gregorian_seconds_to_datetime(
+    calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
+  ),
+  Session = #auth_session{
+    session_id   = infra_utils:generate_id(16),
+    family_id    = infra_utils:generate_id(16),
+    subject_id   = SubjectId,
+    subject_type = SubjectType,
+    client_type  = ClientType,
+    current_jti  = infra_utils:generate_id(16),
+    expires_at   = ExpiresAt,
+    revoked      = false,
+    created_at   = Now,
+    updated_at   = Now
+  },
+  mnesia:dirty_write(Session),
+  inc_counter(SubjectType),
+  {ok, Session}.
+
+%%%-------------------------------------------------------------------
+%%% @doc Получить сессию по идентификатору.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec get(SessionId :: binary()) -> {ok, #auth_session{}} | {error, not_found}.
+get(SessionId) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] -> {ok, Session};
+    [] -> {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Ротация refresh-токена: проверяет jti и выдаёт новый.
+%%% Несовпадение jti после ротации означает reuse — возвращает `{error, reuse_detected}`.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec rotate(SessionId :: binary(), PresentedJti :: binary()) ->
+  {ok, NewJti :: binary(), #auth_session{}} |
+  {error, not_found | expired | revoked | reuse_detected}.
+rotate(SessionId, PresentedJti) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] ->
+      rotate_session(Session, PresentedJti);
+    [] ->
+      {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Отозвать одну сессию.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec revoke(SessionId :: binary()) -> ok | {error, not_found}.
+revoke(SessionId) ->
+  case mnesia:dirty_read({auth_session, SessionId}) of
+    [Session] when Session#auth_session.revoked =:= true ->
+      ok;
+    [Session] ->
+      Now = calendar:universal_time(),
+      mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
+      dec_counter(Session#auth_session.subject_type),
+      ok;
+    [] ->
+      {error, not_found}
+  end.
+
+%%%-------------------------------------------------------------------
+%%% @doc Отозвать все сессии семейства (reuse attack / принудительный logout).
+%%% @end
+%%%-------------------------------------------------------------------
+-spec revoke_family(FamilyId :: binary()) -> ok.
+revoke_family(FamilyId) ->
+  Sessions = mnesia:dirty_index_read(auth_session, FamilyId, #auth_session.family_id),
+  Now = calendar:universal_time(),
+  lists:foreach(fun(Session) ->
+    case Session#auth_session.revoked of
+      true -> ok;
+      false ->
+        mnesia:dirty_write(Session#auth_session{revoked = true, updated_at = Now}),
+        dec_counter(Session#auth_session.subject_type)
+    end
+                end, Sessions),
+  ok.
+
+%%%===================================================================
+%%% Internal
+%%%===================================================================
+
+rotate_session(Session, PresentedJti) ->
+  case Session#auth_session.revoked of
+    true ->
+      {error, revoked};
+    false ->
+      Now = calendar:universal_time(),
+      case Session#auth_session.expires_at > Now of
+        false ->
+          {error, expired};
+        true ->
+          case Session#auth_session.current_jti =:= PresentedJti of
+            true ->
+              NewJti = infra_utils:generate_id(16),
+              Updated = Session#auth_session{
+                current_jti = NewJti,
+                updated_at  = Now
+              },
+              mnesia:dirty_write(Updated),
+              {ok, NewJti, Updated};
+            false ->
+              {error, reuse_detected}
+          end
+      end
+  end.
+
+inc_counter(admin) -> core_counters:inc(admin_active_sessions);
+inc_counter(user) -> core_counters:inc(active_sessions).
+
+dec_counter(admin) -> core_counters:dec(admin_active_sessions);
+dec_counter(user) -> core_counters:dec(active_sessions).

src/handlers/admin/admin_handler_login.erl

@@ -19,10 +19,10 @@ init(Req0, _State) ->
           try jsx:decode(Body, [return_maps]) of
             #{<<"email">> := Email, <<"password">> := Password} ->
               case eventhub_auth:authenticate_admin_request(Req1, Email, Password) of
-                {ok, Token, User} ->
+                {ok, _Token, User} ->
                   UserId = maps:get(id, User),
-                  {RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(UserId),
+                  Role = maps:get(role, User),
-                  core_admin_session:create(UserId, RefreshToken),
+                  {ok, Token, RefreshToken} = logic_auth_session:issue_admin_tokens(UserId, Role),
                   core_admin:update_last_login(UserId),
                   % Аудит успешного входа
                   admin_utils:log_admin_action(UserId, <<"login">>, <<"admin">>, Email, <<>>, Req1),

src/handlers/admin/admin_handler_refresh.erl

@@ -7,8 +7,6 @@
 -export([init/2]).
 -export([trails/0]).
 
--include("records.hrl").
-
 %%% cowboy_handler callback
 -spec init(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
 init(Req, _Opts) ->
@@ -72,31 +70,25 @@ refresh(Req) ->
   {ok, Body, Req1} = cowboy_req:read_body(Req),
   try jsx:decode(Body, [return_maps]) of
     #{<<"refresh_token">> := RefreshToken} ->
-      case core_admin_session:validate(RefreshToken) of
+      case logic_auth_session:refresh_admin(RefreshToken) of
-        {ok, AdminId} ->
+        {ok, NewToken, NewRefreshToken} ->
-          admin_refresh(AdminId, RefreshToken, Req1);
+          handler_utils:send_json(Req1, 200, #{
+            token => NewToken,
+            refresh_token => NewRefreshToken
+          });
+        {error, reuse_detected} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token reuse detected">>);
         {error, not_found} ->
           handler_utils:send_error(Req1, 401, <<"Refresh token not found">>);
         {error, expired} ->
-          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>)
+          handler_utils:send_error(Req1, 401, <<"Refresh token expired">>);
+        {error, revoked} ->
+          handler_utils:send_error(Req1, 401, <<"Refresh token revoked">>);
+        {error, _} ->
+          handler_utils:send_error(Req1, 401, <<"Invalid refresh token">>)
       end;
     _ ->
       handler_utils:send_error(Req1, 400, <<"Missing refresh_token field">>)
   catch
     _:_ -> handler_utils:send_error(Req1, 400, <<"Invalid JSON">>)
-  end.
+  end.
-
-%%%===================================================================
-%%% Внутренние функции
-%%%===================================================================
-
-%% @private Обновляет токен для администратора.
--spec admin_refresh(binary(), binary(), cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
-admin_refresh(AdminId, OldToken, Req) ->
-  core_admin_session:delete(OldToken),
-  {ok, Admin} = core_admin:get_by_id(AdminId),
-  Role = atom_to_binary(Admin#admin.role, utf8),
-  NewToken = eventhub_auth:generate_admin_token(AdminId, Role),
-  {NewRefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(AdminId),
-  core_admin_session:create(AdminId, NewRefreshToken),
-  handler_utils:send_json(Req, 200, #{token => NewToken, refresh_token => NewRefreshToken}).

src/infra/eventhub_auth.erl

@@ -6,7 +6,9 @@
   verify_admin_token/1,
   authenticate_user_request/3,
   authenticate_admin_request/3,
-  generate_refresh_token/1
+  generate_refresh_token/1,
+  generate_admin_refresh_token/5,
+  verify_admin_refresh_token/1
 ]).
 
 %% ========== КОНФИГУРАЦИЯ СЕКРЕТОВ ==========
@@ -146,13 +148,98 @@ authenticate_admin_request(_Req, Email, Password) ->
 is_admin_role(Role) ->
   lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
 
-%% ========== REFRESH TOKEN ==========
+-define(REFRESH_TTL_SECONDS, 30 * 24 * 3600).
+
+%% ========== REFRESH TOKEN (opaque, legacy user flow — фаза 2) ==========
 
 -spec generate_refresh_token(UserId :: binary()) -> {binary(), calendar:datetime()}.
 generate_refresh_token(_UserId) ->
   RefreshToken = base64:encode(crypto:strong_rand_bytes(32)),
   Now = calendar:universal_time(),
   ExpiresAt = calendar:gregorian_seconds_to_datetime(
-    calendar:datetime_to_gregorian_seconds(Now) + 30 * 24 * 3600
+    calendar:datetime_to_gregorian_seconds(Now) + ?REFRESH_TTL_SECONDS
   ),
-  {RefreshToken, ExpiresAt}.
+  {RefreshToken, ExpiresAt}.
+
+%% ========== REFRESH JWT (единая session-модель) ==========
+
+-spec generate_admin_refresh_token(
+  SessionId :: binary(),
+  FamilyId :: binary(),
+  Jti :: binary(),
+  SubjectId :: binary(),
+  ClientType :: binary()
+) -> {binary(), calendar:datetime()}.
+generate_admin_refresh_token(SessionId, FamilyId, Jti, SubjectId, ClientType) ->
+  generate_refresh_jwt(
+    get_admin_jwk(), SubjectId, <<"admin">>, SessionId, FamilyId, Jti, ClientType
+  ).
+
+-spec verify_admin_refresh_token(Token :: binary()) ->
+  {ok, map()} | {error, atom()}.
+verify_admin_refresh_token(Token) ->
+  verify_refresh_jwt(get_admin_jwk(), Token, <<"admin">>).
+
+generate_refresh_jwt(JWK, SubjectId, Audience, SessionId, FamilyId, Jti, ClientType) ->
+  ExpTime = erlang:system_time(second) + ?REFRESH_TTL_SECONDS,
+  Claims = #{
+    <<"typ">>    => <<"refresh">>,
+    <<"sub">>    => SubjectId,
+    <<"aud">>    => Audience,
+    <<"sid">>    => SessionId,
+    <<"fid">>    => FamilyId,
+    <<"jti">>    => Jti,
+    <<"client">> => ClientType,
+    <<"exp">>    => ExpTime,
+    <<"iat">>    => erlang:system_time(second)
+  },
+  JWT = jose_jwt:sign(JWK, #{<<"alg">> => <<"HS256">>}, Claims),
+  {_, Token} = jose_jws:compact(JWT),
+  ExpiresAt = calendar:gregorian_seconds_to_datetime(
+    calendar:datetime_to_gregorian_seconds(calendar:universal_time()) + ?REFRESH_TTL_SECONDS
+  ),
+  {Token, ExpiresAt}.
+
+verify_refresh_jwt(JWK, Token, ExpectedAud) ->
+  try
+    case jose_jwt:verify(JWK, Token) of
+      {true, {jose_jwt, Claims}, _} ->
+        validate_refresh_claims(Claims, ExpectedAud);
+      {true, Claims, _} when is_map(Claims) ->
+        validate_refresh_claims(Claims, ExpectedAud);
+      _ ->
+        {error, invalid_signature}
+    end
+  catch
+    _:_ -> {error, invalid_token}
+  end.
+
+validate_refresh_claims(Claims, ExpectedAud) ->
+  case maps:get(<<"typ">>, Claims, undefined) of
+    <<"refresh">> ->
+      case maps:get(<<"aud">>, Claims, undefined) of
+        ExpectedAud ->
+          validate_refresh_exp(Claims);
+        _ ->
+          {error, invalid_audience}
+      end;
+    _ ->
+      {error, invalid_token_type}
+  end.
+
+validate_refresh_exp(Claims) ->
+  Required = [<<"sid">>, <<"fid">>, <<"jti">>, <<"sub">>, <<"exp">>],
+  case [K || K <- Required, not maps:is_key(K, Claims)] of
+    [] ->
+      case maps:get(<<"exp">>, Claims) of
+        Exp when is_integer(Exp) ->
+          case Exp > erlang:system_time(second) of
+            true -> {ok, Claims};
+            false -> {error, expired}
+          end;
+        _ ->
+          {error, expired}
+      end;
+    _ ->
+      {error, invalid_token}
+  end.

src/infra/infra_mnesia.erl

@@ -12,7 +12,7 @@
   terminate/2, code_change/3]).
 
 -define(TABLES, [
-  user, session, verification, admin, admin_session,
+  user, session, verification, admin, admin_session, auth_session,
   calendar, calendar_share, calendar_specialist,
   event, recurrence_exception,
   booking,
@@ -239,6 +239,7 @@ table_opts(schema_migration) -> [{disc_copies, [node()]}, {attributes, record_in
 table_opts(session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, session)}];
 table_opts(verification) -> [{ram_copies, [node()]}, {attributes, record_info(fields, verification)}];
 table_opts(admin_session) -> [{ram_copies, [node()]}, {attributes, record_info(fields, admin_session)}];
+table_opts(auth_session) -> [{disc_copies, [node()]}, {attributes, record_info(fields, auth_session)}];
 table_opts(node_metric) -> [{disc_copies, [node()]}, {local_content, true}, {attributes, record_info(fields, node_metric)}].
 
 %% ===================================================================
@@ -267,4 +268,6 @@ create_indices() ->
   mnesia:add_table_index(user, email),
   mnesia:add_table_index(notification, user_id),
   mnesia:add_table_index(notification, is_read),
+  mnesia:add_table_index(auth_session, family_id),
+  mnesia:add_table_index(auth_session, subject_id),
   ok.

src/logic/logic_auth_session.erl

@@ -0,0 +1,62 @@
+%%%-------------------------------------------------------------------
+%%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
+%%% Фаза 1: admin API. Фазы 2–3: user / client web / mobile.
+%%% @end
+%%%-------------------------------------------------------------------
+-module(logic_auth_session).
+-include("records.hrl").
+-export([issue_admin_tokens/2, refresh_admin/1]).
+
+%%%-------------------------------------------------------------------
+%%% @doc Выдать пару access + refresh JWT при входе администратора.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
+  {ok, AccessToken :: binary(), RefreshToken :: binary()}.
+issue_admin_tokens(AdminId, Role) ->
+  {ok, Session} = core_auth_session:create(AdminId, admin, <<"admin">>),
+  AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
+  {RefreshToken, _} = eventhub_auth:generate_admin_refresh_token(
+    Session#auth_session.session_id,
+    Session#auth_session.family_id,
+    Session#auth_session.current_jti,
+    AdminId,
+    <<"admin">>
+  ),
+  {ok, AccessToken, RefreshToken}.
+
+%%%-------------------------------------------------------------------
+%%% @doc Обновить пару токенов администратора по refresh JWT.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec refresh_admin(RefreshToken :: binary()) ->
+  {ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
+  {error, atom()}.
+refresh_admin(RefreshToken) ->
+  case eventhub_auth:verify_admin_refresh_token(RefreshToken) of
+    {ok, Claims} ->
+      do_refresh_admin(Claims);
+    Error ->
+      Error
+  end.
+
+do_refresh_admin(Claims) ->
+  SessionId = maps:get(<<"sid">>, Claims),
+  Jti = maps:get(<<"jti">>, Claims),
+  AdminId = maps:get(<<"sub">>, Claims),
+  FamilyId = maps:get(<<"fid">>, Claims),
+  case core_auth_session:rotate(SessionId, Jti) of
+    {ok, NewJti, _Session} ->
+      {ok, Admin} = core_admin:get_by_id(AdminId),
+      Role = atom_to_binary(Admin#admin.role, utf8),
+      AccessToken = eventhub_auth:generate_admin_token(AdminId, Role),
+      {NewRefresh, _} = eventhub_auth:generate_admin_refresh_token(
+        SessionId, FamilyId, NewJti, AdminId, <<"admin">>
+      ),
+      {ok, AccessToken, NewRefresh};
+    {error, reuse_detected} ->
+      core_auth_session:revoke_family(FamilyId),
+      {error, reuse_detected};
+    Error ->
+      Error
+  end.

test/unit/admin_handler_login_tests.erl

@@ -1,5 +1,6 @@
 -module(admin_handler_login_tests).
 -include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
 
 -define(JWT_SECRET,       <<"test-user-secret-key-32-byt!">>).
 -define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
@@ -7,6 +8,16 @@
 setup() ->
     ok = meck:new(logic_auth, [non_strict]),
     ok = meck:new(cowboy_req, [non_strict]),
+    ok = meck:new(core_admin, [non_strict]),
+    ok = meck:new(admin_utils, [non_strict]),
+    mnesia:start(),
+    catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+    mnesia:create_table(auth_session, [
+        {attributes, record_info(fields, auth_session)},
+        {ram_copies, [node()]}
+    ]),
+    mnesia:add_table_index(auth_session, #auth_session.family_id),
+    mnesia:add_table_index(auth_session, #auth_session.subject_id),
     application:set_env(eventhub, jwt_secret, ?JWT_SECRET),
     application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
     {ok, _} = application:ensure_all_started(jose).
@@ -15,6 +26,11 @@ cleanup(_) ->
     application:unset_env(eventhub, jwt_secret),
     application:unset_env(eventhub, admin_jwt_secret),
     application:stop(jose),
+    catch mnesia:delete_table(auth_session),
+    catch ets:delete(eventhub_counters),
+    mnesia:stop(),
+    meck:unload(admin_utils),
+    meck:unload(core_admin),
     meck:unload(cowboy_req),
     meck:unload(logic_auth),
     ok.
@@ -52,8 +68,10 @@ prepare_req(Method, HasBody, Body) ->
 
 test_valid_admin_login() ->
     UserMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>},
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(<<"admin@test.com">>, <<"pass">>) -> {ok, UserMap} end),
+    ok = meck:expect(core_admin, update_last_login, fun(_) -> ok end),
+    ok = meck:expect(admin_utils, log_admin_action, fun(_, _, _, _, _, _) -> ok end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"admin@test.com">>, password => <<"pass">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
     {Code, Headers, Body} = get(test_reply),
@@ -61,10 +79,11 @@ test_valid_admin_login() ->
     ?assertEqual(<<"application/json">>, maps:get(<<"content-type">>, Headers)),
     Resp = jsx:decode(Body, [return_maps]),
     ?assert(is_map_key(<<"token">>, Resp)),
+    ?assert(is_map_key(<<"refresh_token">>, Resp)),
     ?assertEqual(<<"superadmin">>, maps:get(<<"role">>, maps:get(<<"user">>, Resp))).
 
 test_invalid_credentials() ->
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(_, _) -> {error, bad_credentials} end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"bad@test.com">>, password => <<"wrong">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
@@ -74,7 +93,7 @@ test_invalid_credentials() ->
 
 test_insufficient_permissions() ->
     UserMap = #{id => <<"user1">>, email => <<"user@test.com">>, role => <<"user">>},
-    ok = meck:expect(logic_auth, authenticate_user,
+    ok = meck:expect(logic_auth, authenticate_admin,
         fun(_, _) -> {ok, UserMap} end),
     Req0 = prepare_req(<<"POST">>, true, jsx:encode(#{email => <<"user@test.com">>, password => <<"pass">>})),
     {ok, _, _} = admin_handler_login:init(Req0, []),
@@ -87,7 +106,7 @@ test_malformed_json() ->
     {ok, _, _} = admin_handler_login:init(Req0, []),
     {Code, _, Body} = get(test_reply),
     ?assertEqual(400, Code),
-    #{<<"error">> := <<"invalid_request">>} = jsx:decode(Body, [return_maps]).
+    #{<<"error">> := <<"Invalid JSON">>} = jsx:decode(Body, [return_maps]).
 
 test_missing_body() ->
     Req0 = prepare_req(<<"POST">>, false, undefined),

test/unit/auth_test.erl

@@ -104,7 +104,7 @@ authenticate_admin_request_test_() ->
     {"Successful admin login returns admin token",
       fun() ->
         AdminMap = #{id => <<"adm1">>, email => <<"admin@test.com">>, role => <<"superadmin">>},
-        ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, AdminMap} end),
+        ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, AdminMap} end),
         Req = undefined,
         {ok, Token, ReturnedUser} = eventhub_auth:authenticate_admin_request(Req, <<"admin@test.com">>, <<"pass">>),
         ?assert(is_binary(Token)),
@@ -116,7 +116,7 @@ authenticate_admin_request_test_() ->
     {"Non-admin role is rejected with insufficient_permissions",
       fun() ->
         UserMap = #{id => <<"simpleuser">>, email => <<"u@test.com">>, role => <<"user">>},
-        ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, UserMap} end),
+        ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, UserMap} end),
         Req = undefined,
         ?assertEqual({error, insufficient_permissions},
           eventhub_auth:authenticate_admin_request(Req, <<"u@test.com">>, <<"pwd">>))
@@ -124,7 +124,7 @@ authenticate_admin_request_test_() ->
     {"Moderator role is accepted as admin",
       fun() ->
         ModMap = #{id => <<"moder1">>, email => <<"mod@test.com">>, role => <<"moderator">>},
-        ok = meck:expect(logic_auth, authenticate_user, fun(_Email, _Password) -> {ok, ModMap} end),
+        ok = meck:expect(logic_auth, authenticate_admin, fun(_Email, _Password) -> {ok, ModMap} end),
         Req = undefined,
         {ok, Token, _} = eventhub_auth:authenticate_admin_request(Req, <<"mod@test.com">>, <<"pwd">>),
         {ok, _, Role} = eventhub_auth:verify_admin_token(Token),
@@ -133,7 +133,35 @@ authenticate_admin_request_test_() ->
   ]}.
 
 %% ------------------------------------------------------------------
-%% Тест generate_refresh_token/1
+%% Тест generate_refresh_token/1 (legacy opaque, user flow)
 %% ------------------------------------------------------------------
 generate_refresh_token_test() ->
-  {_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>).
+  {_, _} = eventhub_auth:generate_refresh_token(<<"anyuser">>).
+
+%% ------------------------------------------------------------------
+%% Тесты refresh JWT (admin)
+%% ------------------------------------------------------------------
+admin_refresh_jwt_test_() ->
+  {setup, fun setup/0, fun cleanup/1, [
+    {"Generate and verify admin refresh JWT",
+      fun() ->
+        Sid = <<"sess123">>, Fid = <<"fam456">>, Jti = <<"jti789">>,
+        {Token, _} = eventhub_auth:generate_admin_refresh_token(
+          Sid, Fid, Jti, <<"admin1">>, <<"admin">>
+        ),
+        ?assert(is_binary(Token)),
+        {ok, Claims} = eventhub_auth:verify_admin_refresh_token(Token),
+        ?assertEqual(Sid, maps:get(<<"sid">>, Claims)),
+        ?assertEqual(Fid, maps:get(<<"fid">>, Claims)),
+        ?assertEqual(Jti, maps:get(<<"jti">>, Claims)),
+        ?assertEqual(<<"admin1">>, maps:get(<<"sub">>, Claims))
+      end},
+    {"User refresh JWT rejected by admin verifier",
+      fun() ->
+        {Token, _} = eventhub_auth:generate_admin_refresh_token(
+          <<"s">>, <<"f">>, <<"j">>, <<"u">>, <<"admin">>
+        ),
+        ?assertMatch({error, invalid_signature},
+          eventhub_auth:verify_user_token(Token))
+      end}
+  ]}.

test/unit/core_auth_session_tests.erl

@@ -0,0 +1,63 @@
+-module(core_auth_session_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
+
+setup() ->
+  mnesia:start(),
+  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+  mnesia:create_table(auth_session, [
+    {attributes, record_info(fields, auth_session)},
+    {ram_copies, [node()]}
+  ]),
+  mnesia:add_table_index(auth_session, #auth_session.family_id),
+  mnesia:add_table_index(auth_session, #auth_session.subject_id),
+  application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
+  {ok, _} = application:ensure_all_started(jose),
+  ok.
+
+cleanup(_) ->
+  mnesia:delete_table(auth_session),
+  catch ets:delete(eventhub_counters),
+  application:unset_env(eventhub, admin_jwt_secret),
+  application:stop(jose),
+  mnesia:stop(),
+  ok.
+
+core_auth_session_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"Create session", fun test_create/0},
+    {"Rotate session updates jti", fun test_rotate/0},
+    {"Reuse detection", fun test_reuse/0},
+    {"Revoke family", fun test_revoke_family/0}
+  ]}.
+
+test_create() ->
+  {ok, Session} = core_auth_session:create(<<"admin1">>, admin, <<"admin">>),
+  ?assertEqual(<<"admin1">>, Session#auth_session.subject_id),
+  ?assertEqual(admin, Session#auth_session.subject_type),
+  ?assertEqual(false, Session#auth_session.revoked),
+  {ok, Loaded} = core_auth_session:get(Session#auth_session.session_id),
+  ?assertEqual(Session#auth_session.session_id, Loaded#auth_session.session_id).
+
+test_rotate() ->
+  {ok, Session} = core_auth_session:create(<<"admin1">>, admin, <<"admin">>),
+  OldJti = Session#auth_session.current_jti,
+  {ok, NewJti, _} = core_auth_session:rotate(Session#auth_session.session_id, OldJti),
+  ?assertNotEqual(OldJti, NewJti),
+  ?assertMatch({error, reuse_detected},
+    core_auth_session:rotate(Session#auth_session.session_id, OldJti)).
+
+test_reuse() ->
+  {ok, Session} = core_auth_session:create(<<"admin1">>, admin, <<"admin">>),
+  Jti = Session#auth_session.current_jti,
+  {ok, _, _} = core_auth_session:rotate(Session#auth_session.session_id, Jti),
+  ?assertMatch({error, reuse_detected},
+    core_auth_session:rotate(Session#auth_session.session_id, Jti)).
+
+test_revoke_family() ->
+  {ok, S1} = core_auth_session:create(<<"admin1">>, admin, <<"admin">>),
+  ok = core_auth_session:revoke_family(S1#auth_session.family_id),
+  ?assertMatch({error, revoked},
+    core_auth_session:rotate(S1#auth_session.session_id, S1#auth_session.current_jti)).

test/unit/logic_auth_session_tests.erl

@@ -0,0 +1,69 @@
+-module(logic_auth_session_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(ADMIN_JWT_SECRET, <<"test-admin-secret-key-32-b">>).
+
+setup() ->
+  ok = meck:new(core_admin, [non_strict]),
+  mnesia:start(),
+  catch ets:new(eventhub_counters, [named_table, public, set, {write_concurrency, true}]),
+  mnesia:create_table(auth_session, [
+    {attributes, record_info(fields, auth_session)},
+    {ram_copies, [node()]}
+  ]),
+  mnesia:add_table_index(auth_session, #auth_session.family_id),
+  mnesia:add_table_index(auth_session, #auth_session.subject_id),
+  application:set_env(eventhub, admin_jwt_secret, ?ADMIN_JWT_SECRET),
+  {ok, _} = application:ensure_all_started(jose),
+  ok.
+
+cleanup(_) ->
+  application:unset_env(eventhub, admin_jwt_secret),
+  application:stop(jose),
+  meck:unload(core_admin),
+  catch mnesia:delete_table(auth_session),
+  catch ets:delete(eventhub_counters),
+  mnesia:stop(),
+  ok.
+
+logic_auth_session_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"Issue and refresh admin tokens", fun test_issue_and_refresh/0},
+    {"Refresh reuse revokes family", fun test_reuse_revokes/0}
+  ]}.
+
+test_issue_and_refresh() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = superadmin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(Id) ->
+    ?assertEqual(AdminId, Id), {ok, Admin}
+  end),
+  {ok, Access1, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"superadmin">>),
+  ?assert(is_binary(Access1)),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access1),
+  {ok, Access2, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assert(is_binary(Access2)),
+  ?assertNotEqual(Refresh1, Refresh2),
+  {ok, _, _} = eventhub_auth:verify_admin_token(Access2).
+
+test_reuse_revokes() ->
+  AdminId = <<"adm1">>,
+  Admin = #admin{
+    id = AdminId, email = <<"a@test.com">>, role = admin,
+    password_hash = <<>>, status = active, nickname = <<>>,
+    avatar_url = default, timezone = <<"UTC">>, language = <<"ru">>,
+    phone = <<>>, preferences = #{}, last_login = undefined,
+    created_at = undefined, updated_at = undefined
+  },
+  ok = meck:expect(core_admin, get_by_id, fun(_) -> {ok, Admin} end),
+  {ok, _, Refresh1} = logic_auth_session:issue_admin_tokens(AdminId, <<"admin">>),
+  {ok, _, Refresh2} = logic_auth_session:refresh_admin(Refresh1),
+  ?assertMatch({error, reuse_detected}, logic_auth_session:refresh_admin(Refresh1)),
+  ?assertMatch({error, revoked}, logic_auth_session:refresh_admin(Refresh2)).