EventHub/EventHubBack
3
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ролевая модель и аудит Часть 1.

Browse Source
This commit is contained in:
Алексей Сабилин
2026-04-28 19:12:02 +03:00
parent 7ea4efd7d9
commit b2cea7896d
32 changed files with 369 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/handlers/admin/admin_handler_banned_words.erl
+1 -10
View File
@@ -95,7 +95,7 @@ update_banned_word(Word, Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -103,15 +103,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
banned_word_to_json(BW) ->
#{
id => BW#banned_word.id,
src/handlers/admin/admin_handler_health.erl
+11 -8
View File
@@ -1,15 +1,18 @@
-module(admin_handler_health).
-behaviour(cowboy_handler).
-export([init/2]).
init(Req, _Opts) ->
init(Req, State) ->
case cowboy_req:method(Req) of
<<"GET">> ->
Body = jsx:encode(#{status => <<"ok">>}),
Req1 = cowboy_req:reply(200, #{<<"content-type">> => <<"application/json">>}, Body, Req),
{ok, Req1, []};
Req2 = cowboy_req:reply(200, #{<<"content-type">> => <<"application/json">>}, Body, Req),
{ok, Req2, State};
_ ->
Body = jsx:encode(#{error => <<"Method not allowed">>}),
Req1 = cowboy_req:reply(405, #{<<"content-type">> => <<"application/json">>}, Body, Req),
{ok, Req1, []}
end.
send_error(Req, 405, <<"Method not allowed">>)
end.
send_error(Req, Status, Message) ->
Body = jsx:encode(#{error => Message}),
Req2 = cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req),
{ok, Req2, []}.
src/handlers/admin/admin_handler_login.erl
+11 -4
View File
@@ -12,13 +12,18 @@ init(Req0, State) ->
#{<<"email">> := Email, <<"password">> := Password} ->
case eventhub_auth:authenticate_admin_request(Req1, Email, Password) of
{ok, Token, User} ->
% Генерация refresh-токена для администратора
{RefreshToken, _ExpiresAt} = eventhub_auth:generate_refresh_token(maps:get(id, User)),
% Сохранение refresh-токена в admin_session
core_admin_session:create(maps:get(id, User), RefreshToken),
Resp = jsx:encode(#{
<<"token">> => Token,
<<"user">> => #{
<<"id">> => maps:get(id, User),
<<"email">> => maps:get(email, User),
<<"role">> => maps:get(role, User)
}
},
<<"refresh_token">> => RefreshToken
}),
Req2 = cowboy_req:reply(200, #{
<<"content-type">> => <<"application/json">>,
@@ -26,14 +31,16 @@ init(Req0, State) ->
}, Resp, Req1),
{ok, Req2, State};
{error, insufficient_permissions} ->
error_response(403, insufficient_permissions, Req1, State);
error_response(403, <<"insufficient_permissions">>, Req1, State);
{error, Reason} when is_atom(Reason) ->
error_response(401, atom_to_binary(Reason, utf8), Req1, State);
{error, Reason} ->
error_response(401, Reason, Req1, State)
end;
_ ->
error_response(400, <<"invalid_request">>, Req1, State)
error_response(400, <<"Missing email or password">>, Req1, State)
catch
_:_ -> error_response(400, <<"invalid_request">>, Req1, State)
_:_ -> error_response(400, <<"Invalid JSON">>, Req1, State)
end;
false ->
error_response(400, <<"Missing request body">>, Req0, State)
src/handlers/admin/admin_handler_moderation.erl
+1 -10
View File
@@ -99,7 +99,7 @@ handle_user(_Id, _Action, Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -107,15 +107,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
calendar_to_json(C) ->
#{
id => C#calendar.id,
src/handlers/admin/admin_handler_report_by_id.erl
+2 -11
View File
@@ -14,7 +14,7 @@ init(Req, _Opts) ->
get_report(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
ReportId = cowboy_req:binding(id, Req1),
case core_report:get_by_id(ReportId) of
@@ -33,7 +33,7 @@ get_report(Req) ->
update_report(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
ReportId = cowboy_req:binding(id, Req1),
{ok, Body, Req2} = cowboy_req:read_body(Req1),
@@ -60,15 +60,6 @@ update_report(Req) ->
send_error(Req1, Code, Message)
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
report_to_json(R) ->
#{
id => R#report.id,
src/handlers/admin/admin_handler_reports.erl
+3 -12
View File
@@ -8,13 +8,13 @@ init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"GET">> -> list_reports(Req);
<<"PUT">> -> update_report(Req);
_ -> send_error(Req, 405, <<"Method not allowed">>)
_ -> send_error(Req, 405, <<"Method not allowed">>)
end.
list_reports(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
{ok, Reports} = core_report:list_all(),
send_json(Req1, 200, [report_to_json(R) || R <- Reports]);
@@ -28,7 +28,7 @@ list_reports(Req) ->
update_report(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
ReportId = cowboy_req:binding(id, Req1),
{ok, Body, Req2} = cowboy_req:read_body(Req1),
@@ -54,15 +54,6 @@ update_report(Req) ->
send_error(Req1, Code, Message)
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
report_to_json(R) ->
#{
id => R#report.id,
src/handlers/admin/admin_handler_reviews.erl
+2 -11
View File
@@ -14,7 +14,7 @@ init(Req, _Opts) ->
get_review(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
ReviewId = cowboy_req:binding(id, Req1),
case core_review:get_by_id(ReviewId) of
@@ -33,7 +33,7 @@ get_review(Req) ->
update_review(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
ReviewId = cowboy_req:binding(id, Req1),
{ok, Body, Req2} = cowboy_req:read_body(Req1),
@@ -59,15 +59,6 @@ update_review(Req) ->
send_error(Req1, Code, Message)
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
review_to_json(R) ->
#{
id => R#review.id,
src/handlers/admin/admin_handler_stats.erl
+2 -18
View File
@@ -1,14 +1,8 @@
-module(admin_handler_stats).
-include("records.hrl").
-export([init/2]).
-export([count_users/0, count_calendars/0, count_events/0, count_bookings/0,
count_reviews/0, count_reports/0, count_tickets/0, count_subscriptions/0]).
-export([is_admin/1]).
init(Req, Opts) ->
handle(Req, Opts).
handle(Req, _Opts) ->
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"GET">> -> get_stats(Req);
_ -> send_error(Req, 405, <<"Method not allowed">>)
@@ -17,7 +11,7 @@ handle(Req, _Opts) ->
get_stats(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
Stats = #{
users => count_users(),
@@ -37,16 +31,6 @@ get_stats(Req) ->
send_error(Req1, Code, Message)
end.
%% Вспомогательные функции
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
count_users() -> length(mnesia:dirty_match_object(#user{_ = '_'})).
count_calendars() -> length(mnesia:dirty_match_object(#calendar{_ = '_'})).
count_events() -> length(mnesia:dirty_match_object(#event{is_instance = false, _ = '_'})).
src/handlers/admin/admin_handler_subscriptions.erl
+1 -10
View File
@@ -114,7 +114,7 @@ delete_subscription(SubscriptionId, Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -122,15 +122,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
subscription_to_json(S) ->
#{
id => S#subscription.id,
src/handlers/admin/admin_handler_ticket_by_id.erl
+1 -10
View File
@@ -67,7 +67,7 @@ delete_ticket(Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -75,15 +75,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
ticket_to_json(T) ->
#{
id => T#ticket.id,
src/handlers/admin/admin_handler_ticket_stats.erl
+1 -10
View File
@@ -22,7 +22,7 @@ get_stats(Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -30,15 +30,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
send_json(Req, Status, Data) ->
Body = jsx:encode(Data),
cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req),
src/handlers/admin/admin_handler_tickets.erl
+1 -10
View File
@@ -112,7 +112,7 @@ delete_ticket(TicketId, Req) ->
auth_admin(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true -> {ok, AdminId, Req1};
false -> {error, 403, <<"Admin access required">>, Req1}
end;
@@ -120,15 +120,6 @@ auth_admin(Req) ->
{error, Code, Message, Req1}
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} ->
Role = User#user.role,
Role =:= admin orelse Role =:= superadmin orelse
Role =:= moderator orelse Role =:= support;
_ -> false
end.
ticket_to_json(T) ->
#{
id => T#ticket.id,
src/handlers/admin/admin_handler_user_by_id.erl
+7 -19
View File
@@ -1,28 +1,22 @@
-module(admin_handler_user_by_id).
-include("records.hrl").
-export([init/2]).
-export([user_to_json/1, convert_updates/1]).
init(Req, Opts) ->
handle(Req, Opts).
handle(Req, _Opts) ->
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"GET">> -> get_user(Req);
<<"PUT">> -> update_user(Req);
<<"GET">> -> get_user(Req);
<<"PUT">> -> update_user(Req);
<<"DELETE">> -> delete_user(Req);
_ -> send_error(Req, 405, <<"Method not allowed">>)
_ -> send_error(Req, 405, <<"Method not allowed">>)
end.
get_user(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
UserId = cowboy_req:binding(id, Req1),
case core_user:get_by_id(UserId) of
{ok, User} when User#user.status =:= deleted ->
send_error(Req1, 404, <<"User not found">>);
{ok, User} ->
send_json(Req1, 200, user_to_json(User));
{error, not_found} ->
@@ -38,7 +32,7 @@ get_user(Req) ->
update_user(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
UserId = cowboy_req:binding(id, Req1),
{ok, Body, Req2} = cowboy_req:read_body(Req1),
@@ -69,7 +63,7 @@ update_user(Req) ->
delete_user(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case is_admin(AdminId) of
case admin_utils:is_admin(AdminId) of
true ->
UserId = cowboy_req:binding(id, Req1),
case core_user:delete(UserId) of
@@ -85,12 +79,6 @@ delete_user(Req) ->
send_error(Req1, Code, Message)
end.
is_admin(UserId) ->
case core_user:get_by_id(UserId) of
{ok, User} -> User#user.role =:= admin;
_ -> false
end.
user_to_json(User) ->
#{
id => User#user.id,
src/handlers/admin/admin_handler_users.erl
+27 -22
View File
@@ -1,35 +1,40 @@
-module(admin_handler_users).
-behaviour(cowboy_handler).
-include("records.hrl").
-export([init/2]).
init(Req, _Opts) ->
case cowboy_req:method(Req) of
<<"GET">> ->
case handler_auth:authenticate(Req) of
{ok, _UserId, Req1} ->
{ok, Users} = core_user:list_users(),
Response = [user_to_map(U) || U <- Users],
send_json(Req1, 200, Response);
{error, Code, Message, Req1} ->
send_error(Req1, Code, Message)
end;
_ ->
send_error(Req, 405, <<"Method not allowed">>)
<<"GET">> -> list_users(Req);
_ -> send_error(Req, 405, <<"Method not allowed">>)
end.
user_to_map(User) ->
list_users(Req) ->
case handler_auth:authenticate(Req) of
{ok, AdminId, Req1} ->
case admin_utils:is_admin(AdminId) of
true ->
Users = core_user:list_users(),
send_json(Req1, 200, [user_to_json(U) || U <- Users]);
false ->
send_error(Req1, 403, <<"Admin access required">>)
end;
{error, Code, Message, Req1} ->
send_error(Req1, Code, Message)
end.
user_to_json(U) ->
#{
id => maps:get(id, User),
email => maps:get(email, User),
role => maps:get(role, User),
status => maps:get(status, User),
created_at => datetime_to_iso8601(maps:get(created_at, User)),
updated_at => datetime_to_iso8601(maps:get(updated_at, User))
id => U#user.id,
email => U#user.email,
role => U#user.role,
status => U#user.status,
created_at => datetime_to_iso8601(U#user.created_at),
updated_at => datetime_to_iso8601(U#user.updated_at)
}.
datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ",
[Year, Month, Day, Hour, Minute, Second])).
datetime_to_iso8601({{Y,M,D},{H,Min,S}}) ->
iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ", [Y,M,D,H,Min,S]));
datetime_to_iso8601(_) -> null.
send_json(Req, Status, Data) ->
Body = jsx:encode(Data),
src/handlers/admin/admin_ws_handler.erl
+2 -5
View File
@@ -22,7 +22,7 @@ init(Req, _Opts) ->
case logic_auth:verify_jwt(Token) of
{ok, UserId, Role} ->
io:format("[ADMIN_WS] UserId: ~s, Role: ~s~n", [UserId, Role]),
case is_admin_role(Role) of
case admin_utils:is_admin(Role) of
true ->
io:format("[ADMIN_WS] Admin access granted~n"),
{cowboy_websocket, Req, #state{admin_id = UserId}};
@@ -81,7 +81,4 @@ websocket_info(_Info, State) ->
terminate(_Reason, _Req, _State) ->
pg:leave(eventhub_admin_ws, self()),
ok.
is_admin_role(Role) ->
lists:member(Role, [<<"admin">>, <<"superadmin">>, <<"moderator">>, <<"support">>]).
ok.