@dewtech/dare-cli 2.17.0 → 3.1.0

package/templates/stacks/go-gin/internal/db/postgres.go.tpl

@@ -0,0 +1,25 @@
+// Package db — pgx connection pool.
+package db
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Connect returns a pgx pool. Caller closes via pool.Close().
+func Connect(ctx context.Context, url string) (*pgxpool.Pool, error) {
+	cfg, err := pgxpool.ParseConfig(url)
+	if err != nil {
+		return nil, err
+	}
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	if err != nil {
+		return nil, err
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, err
+	}
+	return pool, nil
+}

package/templates/stacks/go-gin/internal/handler/auth_handler.go.tpl

@@ -0,0 +1,72 @@
+// Package handler — HTTP layer (Gin handlers).
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/service"
+)
+
+type AuthHandler struct {
+	auth  *service.AuthService
+	users *service.UsersService
+	cfg   *config.Config
+}
+
+func NewAuthHandler(a *service.AuthService, u *service.UsersService, cfg *config.Config) *AuthHandler {
+	return &AuthHandler{auth: a, users: u, cfg: cfg}
+}
+
+type loginBody struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required,min=8"`
+}
+
+// Login godoc
+// @Summary Exchange email+password for JWT
+// @Accept  json
+// @Produce json
+// @Param   body body loginBody true "credentials"
+// @Success 200 {object} map[string]any
+// @Failure 401 {object} map[string]string
+// @Router  /auth/login [post]
+func (h *AuthHandler) Login(c *gin.Context) {
+	var body loginBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	token, expiresIn, err := h.auth.Login(c.Request.Context(), body.Email, body.Password)
+	if errors.Is(err, service.ErrInvalidCredentials) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"accessToken": token,
+		"tokenType":   "Bearer",
+		"expiresIn":   expiresIn,
+	})
+}
+
+// Me godoc
+// @Summary Current user info
+// @Security BearerAuth
+// @Produce json
+// @Success 200 {object} map[string]any
+// @Router  /auth/me [get]
+func (h *AuthHandler) Me(c *gin.Context) {
+	claims, ok := c.Get("claims")
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+		return
+	}
+	c.JSON(http.StatusOK, claims)
+}

package/templates/stacks/go-gin/internal/handler/users_handler.go.tpl

@@ -0,0 +1,72 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"{{moduleName}}/internal/service"
+)
+
+type UsersHandler struct {
+	svc *service.UsersService
+}
+
+func NewUsersHandler(s *service.UsersService) *UsersHandler {
+	return &UsersHandler{svc: s}
+}
+
+func (h *UsersHandler) List(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	if page < 1 {
+		page = 1
+	}
+	if limit < 1 || limit > 100 {
+		limit = 20
+	}
+	items, total, err := h.svc.Page(c.Request.Context(), page, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"items": items, "total": total, "page": page})
+}
+
+type createUserBody struct {
+	Email    string  `json:"email" binding:"required,email"`
+	Password string  `json:"password" binding:"required,min=8"`
+	Role     *string `json:"role" binding:"omitempty,oneof=USER ADMIN"`
+}
+
+func (h *UsersHandler) Create(c *gin.Context) {
+	claimsAny, _ := c.Get("claims")
+	claims, _ := claimsAny.(map[string]any)
+	if role, _ := claims["role"].(string); role != "ADMIN" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "admin role required"})
+		return
+	}
+
+	var body createUserBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	role := "USER"
+	if body.Role != nil {
+		role = *body.Role
+	}
+
+	user, err := h.svc.Create(c.Request.Context(), body.Email, body.Password, role)
+	if errors.Is(err, service.ErrEmailExists) {
+		c.JSON(http.StatusConflict, gin.H{"error": "email already in use"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal"})
+		return
+	}
+	c.JSON(http.StatusCreated, user)
+}

package/templates/stacks/go-gin/internal/handler/ws_handler.go

@@ -0,0 +1,37 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+	CheckOrigin:     func(_ *http.Request) bool { return true },
+}
+
+type WSHandler struct{}
+
+func NewWSHandler() *WSHandler { return &WSHandler{} }
+
+func (h *WSHandler) Handle(c *gin.Context) {
+	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	defer conn.Close()
+
+	for {
+		mt, msg, err := conn.ReadMessage()
+		if err != nil {
+			return
+		}
+		if err := conn.WriteMessage(mt, msg); err != nil {
+			return
+		}
+	}
+}

package/templates/stacks/go-gin/internal/llm/dummy.go

@@ -0,0 +1,14 @@
+package llm
+
+import "context"
+
+type DummyProvider struct{}
+
+func NewDummyProvider() *DummyProvider { return &DummyProvider{} }
+
+func (d *DummyProvider) Complete(_ context.Context, prompt string, maxTokens int) (string, error) {
+	if maxTokens > 0 && len(prompt) > maxTokens {
+		return "[dummy] " + prompt[:maxTokens], nil
+	}
+	return "[dummy] " + prompt, nil
+}

package/templates/stacks/go-gin/internal/llm/provider.go

@@ -0,0 +1,8 @@
+// Package llm — LLM provider abstraction.
+package llm
+
+import "context"
+
+type Provider interface {
+	Complete(ctx context.Context, prompt string, maxTokens int) (string, error)
+}

package/templates/stacks/go-gin/internal/middleware/jwt.go.tpl

@@ -0,0 +1,58 @@
+// Package middleware — Gin middlewares (JWT, rate limit, CORS).
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+
+	"{{moduleName}}/internal/config"
+)
+
+func JWT(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		raw := c.GetHeader("Authorization")
+		token := strings.TrimPrefix(raw, "Bearer ")
+		if token == raw {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer"})
+			return
+		}
+		parsed, err := jwt.Parse(token, func(t *jwt.Token) (any, error) {
+			if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+				return nil, jwt.ErrSignatureInvalid
+			}
+			return []byte(cfg.JWTSecret), nil
+		})
+		if err != nil || !parsed.Valid {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+			return
+		}
+		claims, _ := parsed.Claims.(jwt.MapClaims)
+		c.Set("claims", map[string]any(claims))
+		c.Next()
+	}
+}
+
+// CORS — comma-separated whitelist of origins from env.
+func CORS(allow []string) gin.HandlerFunc {
+	set := make(map[string]bool, len(allow))
+	for _, o := range allow {
+		set[o] = true
+	}
+	return func(c *gin.Context) {
+		origin := c.Request.Header.Get("Origin")
+		if origin != "" && set[origin] {
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Header("Vary", "Origin")
+			c.Header("Access-Control-Allow-Headers", "Authorization, Content-Type")
+			c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+		}
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+		c.Next()
+	}
+}

package/templates/stacks/go-gin/internal/middleware/rate_limit.go

@@ -0,0 +1,55 @@
+package middleware
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/time/rate"
+)
+
+// RateLimit returns a token-bucket-per-IP middleware. Idle IP entries are
+// pruned every 5 minutes to keep memory bounded.
+func RateLimit(perSec, burst int) gin.HandlerFunc {
+	type bucket struct {
+		limiter *rate.Limiter
+		seen    time.Time
+	}
+	var (
+		mu      sync.Mutex
+		buckets = make(map[string]*bucket)
+	)
+
+	go func() {
+		t := time.NewTicker(5 * time.Minute)
+		defer t.Stop()
+		for now := range t.C {
+			mu.Lock()
+			for ip, b := range buckets {
+				if now.Sub(b.seen) > 10*time.Minute {
+					delete(buckets, ip)
+				}
+			}
+			mu.Unlock()
+		}
+	}()
+
+	return func(c *gin.Context) {
+		ip := c.ClientIP()
+		mu.Lock()
+		b, ok := buckets[ip]
+		if !ok {
+			b = &bucket{limiter: rate.NewLimiter(rate.Limit(perSec), burst)}
+			buckets[ip] = b
+		}
+		b.seen = time.Now()
+		mu.Unlock()
+
+		if !b.limiter.Allow() {
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "rate limit exceeded"})
+			return
+		}
+		c.Next()
+	}
+}

package/templates/stacks/go-gin/internal/model/user.go

@@ -0,0 +1,17 @@
+// Package model — domain entities.
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type User struct {
+	ID        uuid.UUID `json:"id"`
+	Email     string    `json:"email"`
+	Password  string    `json:"-"`
+	Role      string    `json:"role"`
+	CreatedAt time.Time `json:"createdAt"`
+	UpdatedAt time.Time `json:"updatedAt"`
+}

package/templates/stacks/go-gin/internal/repository/users_repository.go.tpl

@@ -0,0 +1,79 @@
+// Package repository — pgx-backed DB queries for the User aggregate.
+//
+// Production setups can replace these queries with sqlc-generated code from
+// db/queries/users.sql by running `sqlc generate` (output goes to
+// internal/repository/sqlcgen/). The hand-written queries below are kept as
+// a fallback so the project compiles before sqlc has been run.
+package repository
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"{{moduleName}}/internal/model"
+)
+
+type UsersRepository struct {
+	pool *pgxpool.Pool
+}
+
+func NewUsersRepository(pool *pgxpool.Pool) *UsersRepository {
+	return &UsersRepository{pool: pool}
+}
+
+func (r *UsersRepository) FindByEmail(ctx context.Context, email string) (*model.User, error) {
+	row := r.pool.QueryRow(ctx,
+		`SELECT id, email, password, role, created_at, updated_at FROM users WHERE email = $1`, email)
+	u := &model.User{}
+	if err := row.Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return u, nil
+}
+
+func (r *UsersRepository) Page(ctx context.Context, offset, limit int64) ([]*model.User, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT id, email, password, role, created_at, updated_at
+		 FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2`, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []*model.User
+	for rows.Next() {
+		u := &model.User{}
+		if err := rows.Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, u)
+	}
+	return out, rows.Err()
+}
+
+func (r *UsersRepository) Count(ctx context.Context) (int64, error) {
+	var total int64
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM users`).Scan(&total)
+	return total, err
+}
+
+func (r *UsersRepository) Create(ctx context.Context, email, passwordHash, role string) (*model.User, error) {
+	u := &model.User{}
+	err := r.pool.QueryRow(ctx,
+		`INSERT INTO users (id, email, password, role)
+		 VALUES ($1, $2, $3, $4)
+		 RETURNING id, email, password, role, created_at, updated_at`,
+		uuid.New(), email, passwordHash, role,
+	).Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}

package/templates/stacks/go-gin/internal/service/auth_service.go.tpl

@@ -0,0 +1,55 @@
+// Package service — business logic. Calls repositories, never DB drivers.
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/repository"
+)
+
+var ErrInvalidCredentials = errors.New("invalid credentials")
+
+type AuthService struct {
+	repo *repository.UsersRepository
+	cfg  *config.Config
+}
+
+func NewAuthService(r *repository.UsersRepository, cfg *config.Config) *AuthService {
+	return &AuthService{repo: r, cfg: cfg}
+}
+
+func (s *AuthService) Login(ctx context.Context, email, password string) (string, int64, error) {
+	email = strings.TrimSpace(strings.ToLower(email))
+	user, err := s.repo.FindByEmail(ctx, email)
+	if err != nil {
+		return "", 0, err
+	}
+	if user == nil {
+		return "", 0, ErrInvalidCredentials
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+		return "", 0, ErrInvalidCredentials
+	}
+
+	expHours := s.cfg.JWTExpHours
+	expiresAt := time.Now().Add(time.Duration(expHours) * time.Hour)
+	claims := jwt.MapClaims{
+		"sub":   user.ID.String(),
+		"email": user.Email,
+		"role":  user.Role,
+		"exp":   expiresAt.Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(s.cfg.JWTSecret))
+	if err != nil {
+		return "", 0, err
+	}
+	return signed, int64(expHours) * 3600, nil
+}

package/templates/stacks/go-gin/internal/service/users_service.go.tpl

@@ -0,0 +1,53 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/model"
+	"{{moduleName}}/internal/repository"
+)
+
+var ErrEmailExists = errors.New("email already in use")
+
+type UsersService struct {
+	repo *repository.UsersRepository
+	cfg  *config.Config
+}
+
+func NewUsersService(r *repository.UsersRepository, cfg *config.Config) *UsersService {
+	return &UsersService{repo: r, cfg: cfg}
+}
+
+func (s *UsersService) Page(ctx context.Context, page, limit int) ([]*model.User, int64, error) {
+	offset := int64((page - 1) * limit)
+	items, err := s.repo.Page(ctx, offset, int64(limit))
+	if err != nil {
+		return nil, 0, err
+	}
+	total, err := s.repo.Count(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+	return items, total, nil
+}
+
+func (s *UsersService) Create(ctx context.Context, email, password, role string) (*model.User, error) {
+	email = strings.TrimSpace(strings.ToLower(email))
+	existing, err := s.repo.FindByEmail(ctx, email)
+	if err != nil {
+		return nil, err
+	}
+	if existing != nil {
+		return nil, ErrEmailExists
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), s.cfg.BcryptCost)
+	if err != nil {
+		return nil, err
+	}
+	return s.repo.Create(ctx, email, string(hash), role)
+}

package/templates/stacks/go-gin/llms.txt.tpl

@@ -0,0 +1,54 @@
+# {{projectName}}
+
+DARE-shaped Go API on Gin 1.10+. Layered Design: Handler → Service → Repository → Model.
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+go mod tidy
+sqlc generate          # type-safe DB code from db/queries/*.sql
+swag init -g cmd/server/main.go -o docs   # OpenAPI from annotations
+go run ./cmd/server
+```
+
+## Commands
+
+- `go run ./cmd/server` — dev server (port 8000)
+- `go test ./...` — full test suite
+- `golangci-lint run` — lint
+- `govulncheck ./...` — vuln scan
+- `sqlc generate` — regenerate repos from SQL
+- `swag init -g cmd/server/main.go -o docs` — refresh OpenAPI
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST | `/auth/login` | none | Exchange email+password for JWT |
+| GET | `/auth/me` | Bearer | Current user |
+| GET | `/users` | Bearer | List (query: page, limit) |
+| POST | `/users` | Bearer (admin) | Create user |
+| GET | `/ws` | upgrade | WebSocket echo |
+| GET | `/openapi.json` | none | OpenAPI document |
+| GET | `/swagger/index.html` | none | Swagger UI |
+
+## Layered Design
+
+- `internal/handler/` — Gin handlers (HTTP)
+- `internal/service/` — business logic
+- `internal/repository/` — sqlx/pgx queries via sqlc-generated code
+- `internal/model/` — domain structs
+- `internal/middleware/` — JWT + rate limit
+- `internal/llm/` — provider abstraction
+
+Handlers never call pgx directly.
+
+## Env vars
+
+See `.env.example`. Required: `DATABASE_URL`, `JWT_SECRET`.
+
+## DARE skills
+
+See `.dare/skills.yml`.

package/templates/stacks/go-gin/openapi.json.tpl

@@ -0,0 +1,46 @@
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "{{projectName}}",
+    "version": "0.1.0",
+    "description": "DARE-shaped Gin API. Regenerate from annotations: swag init -g cmd/server/main.go -o docs"
+  },
+  "paths": {
+    "/auth/login": {
+      "post": {
+        "summary": "Exchange email+password for JWT",
+        "responses": { "200": { "description": "JWT issued" }, "401": { "description": "Invalid credentials" } }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "summary": "Current user",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "User" }, "401": { "description": "Unauthorized" } }
+      }
+    },
+    "/users": {
+      "get": {
+        "summary": "List users",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "Page of users" } }
+      },
+      "post": {
+        "summary": "Create user (admin)",
+        "security": [{ "bearer": [] }],
+        "responses": { "201": { "description": "Created" }, "403": { "description": "Forbidden" } }
+      }
+    },
+    "/ws": {
+      "get": {
+        "summary": "WebSocket echo",
+        "responses": { "101": { "description": "Switching Protocols" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }
+    }
+  }
+}

package/templates/stacks/go-gin/sqlc.yaml

@@ -0,0 +1,14 @@
+version: "2"
+sql:
+  - engine: "postgresql"
+    queries: "db/queries"
+    schema: "db/migrations"
+    gen:
+      go:
+        package: "sqlcgen"
+        out: "internal/repository/sqlcgen"
+        sql_package: "pgx/v5"
+        emit_json_tags: true
+        emit_prepared_queries: false
+        emit_interface: false
+        emit_exact_table_names: false

package/templates/stacks/go-gin/tests/smoke_test.go.tpl

@@ -0,0 +1,22 @@
+// Smoke tests — exercise pure helpers without a DB.
+package tests
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"{{moduleName}}/internal/config"
+)
+
+func TestConfigFromEnvDefaultsAreSane(t *testing.T) {
+	t.Setenv("DATABASE_URL", "postgres://u:p@localhost:5432/x?sslmode=disable")
+	t.Setenv("APP_PORT", "")
+	os.Unsetenv("APP_PORT")
+	cfg, err := config.FromEnv()
+	require.NoError(t, err)
+	require.Equal(t, 8000, cfg.AppPort)
+	require.GreaterOrEqual(t, cfg.RateLimitBurst, cfg.RateLimitPerSec)
+	require.NotEmpty(t, cfg.CORSOrigins)
+}