96 lines
4.0 KiB
Erlang
96 lines
4.0 KiB
Erlang
%%%-------------------------------------------------------------------
|
|
%%% @doc Бизнес-логика единой session-модели (refresh JWT + rotation).
|
|
%%% Фаза 1: admin API. Фаза 2: user API. Фаза 3: client web + mobile.
|
|
%%% @end
|
|
%%%-------------------------------------------------------------------
|
|
-module(logic_auth_session).
|
|
-include("records.hrl").
|
|
-export([issue_admin_tokens/2, refresh_admin/1,
|
|
issue_user_tokens/2, refresh_user/1]).
|
|
|
|
-define(USER_CLIENT_WEB, <<"web">>).
|
|
|
|
%%%-------------------------------------------------------------------
|
|
%%% Admin (фаза 1)
|
|
%%%-------------------------------------------------------------------
|
|
|
|
-spec issue_admin_tokens(AdminId :: binary(), Role :: binary()) ->
|
|
{ok, AccessToken :: binary(), RefreshToken :: binary()}.
|
|
issue_admin_tokens(AdminId, Role) ->
|
|
issue_tokens(AdminId, admin, <<"admin">>, Role, fun eventhub_auth:generate_admin_token/2,
|
|
fun eventhub_auth:generate_admin_refresh_token/5).
|
|
|
|
-spec refresh_admin(RefreshToken :: binary()) ->
|
|
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
|
|
{error, atom()}.
|
|
refresh_admin(RefreshToken) ->
|
|
refresh_subject(RefreshToken, fun eventhub_auth:verify_admin_refresh_token/1,
|
|
fun core_admin:get_by_id/1, admin, fun eventhub_auth:generate_admin_token/2,
|
|
fun eventhub_auth:generate_admin_refresh_token/5, <<"admin">>).
|
|
|
|
%%%-------------------------------------------------------------------
|
|
%%% User (фаза 2)
|
|
%%%-------------------------------------------------------------------
|
|
|
|
-spec issue_user_tokens(UserId :: binary(), Role :: binary()) ->
|
|
{ok, AccessToken :: binary(), RefreshToken :: binary()}.
|
|
issue_user_tokens(UserId, Role) ->
|
|
issue_tokens(UserId, user, ?USER_CLIENT_WEB, Role, fun eventhub_auth:generate_user_token/2,
|
|
fun eventhub_auth:generate_user_refresh_token/5).
|
|
|
|
-spec refresh_user(RefreshToken :: binary()) ->
|
|
{ok, AccessToken :: binary(), NewRefreshToken :: binary()} |
|
|
{error, atom()}.
|
|
refresh_user(RefreshToken) ->
|
|
refresh_subject(RefreshToken, fun eventhub_auth:verify_user_refresh_token/1,
|
|
fun core_user:get_by_id/1, user, fun eventhub_auth:generate_user_token/2,
|
|
fun eventhub_auth:generate_user_refresh_token/5, ?USER_CLIENT_WEB).
|
|
|
|
%%%===================================================================
|
|
%%% Internal
|
|
%%%===================================================================
|
|
|
|
issue_tokens(SubjectId, SubjectType, ClientType, Role, GenAccess, GenRefresh) ->
|
|
{ok, Session} = core_auth_session:create(SubjectId, SubjectType, ClientType),
|
|
AccessToken = GenAccess(SubjectId, Role),
|
|
{RefreshToken, _} = GenRefresh(
|
|
Session#auth_session.session_id,
|
|
Session#auth_session.family_id,
|
|
Session#auth_session.current_jti,
|
|
SubjectId,
|
|
ClientType
|
|
),
|
|
{ok, AccessToken, RefreshToken}.
|
|
|
|
refresh_subject(RefreshToken, VerifyFn, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
|
|
case VerifyFn(RefreshToken) of
|
|
{ok, Claims} ->
|
|
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType);
|
|
Error ->
|
|
Error
|
|
end.
|
|
|
|
do_refresh(Claims, GetSubjectFn, SubjectType, GenAccess, GenRefresh, ClientType) ->
|
|
SessionId = maps:get(<<"sid">>, Claims),
|
|
Jti = maps:get(<<"jti">>, Claims),
|
|
SubjectId = maps:get(<<"sub">>, Claims),
|
|
FamilyId = maps:get(<<"fid">>, Claims),
|
|
case core_auth_session:rotate(SessionId, Jti) of
|
|
{ok, NewJti, _Session} ->
|
|
{ok, Subject} = GetSubjectFn(SubjectId),
|
|
Role = subject_role(Subject, SubjectType),
|
|
AccessToken = GenAccess(SubjectId, Role),
|
|
{NewRefresh, _} = GenRefresh(SessionId, FamilyId, NewJti, SubjectId, ClientType),
|
|
{ok, AccessToken, NewRefresh};
|
|
{error, reuse_detected} ->
|
|
core_auth_session:revoke_family(FamilyId),
|
|
{error, reuse_detected};
|
|
Error ->
|
|
Error
|
|
end.
|
|
|
|
subject_role(#admin{role = Role}, admin) ->
|
|
atom_to_binary(Role, utf8);
|
|
subject_role(#user{role = Role}, user) ->
|
|
atom_to_binary(Role, utf8).
|