@dewtech/dare-cli 2.17.0 → 3.1.0

package/templates/stacks/go-stdlib/.dare/skills.yml

@@ -0,0 +1,11 @@
+version: 1
+skills:
+  - id: skill-go-stdlib-api
+    source: skill-go-stdlib-api
+    description: net/http stdlib + sqlc + pgx Layered Design (no framework)
+  - id: dare-ax
+    source: dare-ax
+    description: Agent eXperience invariants (llms.txt, OpenAPI, --json, rate limit)
+  - id: dare-layered-design
+    source: dare-layered-design
+    description: Handler → Service → Repository → Model 4-layer architecture

package/templates/stacks/go-stdlib/.env.example

@@ -0,0 +1,24 @@
+# Application
+APP_PORT=8000
+LOG_LEVEL=info
+
+# Database
+DATABASE_URL=postgres://user:pass@localhost:5432/myapi?sslmode=disable
+
+# JWT auth
+JWT_SECRET=replace-me-in-prod
+JWT_EXP_HOURS=1
+
+# Password hashing
+BCRYPT_COST=12
+
+# Rate limit (token bucket per IP)
+RATE_LIMIT_PER_SEC=10
+RATE_LIMIT_BURST=20
+
+# CORS
+CORS_ORIGINS=http://localhost:3000
+
+# LLM
+LLM_PROVIDER=dummy
+# OPENAI_API_KEY=

package/templates/stacks/go-stdlib/.github/workflows/dare-ci.yml

@@ -0,0 +1,42 @@
+name: DARE CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.61
+
+  test:
+    name: go test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - run: go mod download
+      - run: go test ./...

package/templates/stacks/go-stdlib/README.md.tpl

@@ -0,0 +1,41 @@
+# {{projectName}}
+
+DARE-shaped Go API on **net/http** (no framework). Layered Design (Handler → Service → Repository → Model).
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+go mod tidy
+go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+sqlc generate
+go run ./cmd/server
+```
+
+## Endpoints
+
+- `POST /auth/login` — exchange email/password for JWT
+- `GET /auth/me` — current user (Bearer JWT)
+- `GET /users` — list users (paginated)
+- `POST /users` — create user (admin only)
+- `GET /ws` — WebSocket echo
+- `GET /openapi.json` — OpenAPI surface (static)
+
+## Commands
+
+- `go run ./cmd/server` — dev server (port 8000)
+- `go test ./...` — tests
+- `golangci-lint run` — lint
+- `govulncheck ./...` — vuln scan
+- `sqlc generate` — regenerate type-safe DB code
+
+## Why no framework?
+
+Go 1.22's `http.ServeMux` supports method + path patterns (e.g. `POST /auth/login`),
+which removes the historical reason for using Gin / Echo / Chi. This template uses
+stdlib for routing, middleware chaining, and JSON serialization.
+
+## DARE Method
+
+See `.dare/skills.yml`.

package/templates/stacks/go-stdlib/cmd/server/main.go.tpl

@@ -0,0 +1,82 @@
+// {{projectName}} — net/http stdlib API entrypoint.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/joho/godotenv"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/db"
+	"{{moduleName}}/internal/handler"
+	"{{moduleName}}/internal/middleware"
+	"{{moduleName}}/internal/repository"
+	"{{moduleName}}/internal/service"
+)
+
+func main() {
+	_ = godotenv.Load()
+
+	cfg, err := config.FromEnv()
+	if err != nil {
+		log.Fatalf("config: %v", err)
+	}
+
+	pool, err := db.Connect(context.Background(), cfg.DatabaseURL)
+	if err != nil {
+		log.Fatalf("db: %v", err)
+	}
+	defer pool.Close()
+
+	repo := repository.NewUsersRepository(pool)
+	svcAuth := service.NewAuthService(repo, cfg)
+	svcUsers := service.NewUsersService(repo, cfg)
+
+	authH := handler.NewAuthHandler(svcAuth, svcUsers, cfg)
+	usersH := handler.NewUsersHandler(svcUsers)
+	wsH := handler.NewWSHandler()
+
+	mux := http.NewServeMux()
+
+	// Public routes
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	})
+	mux.HandleFunc("GET /openapi.json", func(w http.ResponseWriter, _ *http.Request) {
+		b, _ := os.ReadFile("openapi.json")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(b)
+	})
+	mux.HandleFunc("POST /auth/login", authH.Login)
+
+	// Bearer-protected routes
+	jwtMW := middleware.JWT(cfg)
+	mux.Handle("GET /auth/me", jwtMW(http.HandlerFunc(authH.Me)))
+	mux.Handle("GET /users", jwtMW(http.HandlerFunc(usersH.List)))
+	mux.Handle("POST /users", jwtMW(http.HandlerFunc(usersH.Create)))
+
+	// WebSocket — upgrade endpoint
+	mux.HandleFunc("GET /ws", wsH.Handle)
+
+	// Global middleware chain
+	handler := middleware.Chain(
+		mux,
+		middleware.CORS(cfg.CORSOrigins),
+		middleware.RateLimit(cfg.RateLimitPerSec, cfg.RateLimitBurst),
+	)
+
+	addr := ":" + strconv.Itoa(cfg.AppPort)
+	log.Printf("listening on %s", addr)
+	srv := &http.Server{
+		Addr:    addr,
+		Handler: handler,
+	}
+	if err := srv.ListenAndServe(); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/stacks/go-stdlib/db/migrations/0001_create_users.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS ix_users_email;
+DROP TABLE IF EXISTS users;

package/templates/stacks/go-stdlib/db/migrations/0001_create_users.up.sql

@@ -0,0 +1,12 @@
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+CREATE TABLE IF NOT EXISTS users (
+    id          UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    email       VARCHAR(254) NOT NULL UNIQUE,
+    password    VARCHAR(255) NOT NULL,
+    role        VARCHAR(16) NOT NULL DEFAULT 'USER',
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS ix_users_email ON users (email);

package/templates/stacks/go-stdlib/db/queries/users.sql

@@ -0,0 +1,23 @@
+-- name: FindUserByEmail :one
+SELECT id, email, password, role, created_at, updated_at
+FROM users
+WHERE email = $1;
+
+-- name: GetUserByID :one
+SELECT id, email, password, role, created_at, updated_at
+FROM users
+WHERE id = $1;
+
+-- name: ListUsers :many
+SELECT id, email, password, role, created_at, updated_at
+FROM users
+ORDER BY created_at DESC
+LIMIT $1 OFFSET $2;
+
+-- name: CountUsers :one
+SELECT COUNT(*) FROM users;
+
+-- name: CreateUser :one
+INSERT INTO users (id, email, password, role)
+VALUES ($1, $2, $3, $4)
+RETURNING id, email, password, role, created_at, updated_at;

package/templates/stacks/go-stdlib/gitignore

@@ -0,0 +1,6 @@
+/bin/
+/vendor/
+.env
+.env.local
+*.log
+.DS_Store

package/templates/stacks/go-stdlib/go.mod.tpl

@@ -0,0 +1,15 @@
+module {{moduleName}}
+
+go 1.22
+
+require (
+	github.com/caarlos0/env/v11 v11.2.2
+	github.com/coder/websocket v1.8.12
+	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/google/uuid v1.6.0
+	github.com/jackc/pgx/v5 v5.7.1
+	github.com/joho/godotenv v1.5.1
+	github.com/stretchr/testify v1.9.0
+	golang.org/x/crypto v0.28.0
+	golang.org/x/time v0.7.0
+)

package/templates/stacks/go-stdlib/internal/config/config.go

@@ -0,0 +1,41 @@
+// Package config — runtime configuration from environment via caarlos0/env.
+package config
+
+import (
+	"strings"
+
+	"github.com/caarlos0/env/v11"
+)
+
+type Config struct {
+	AppPort         int      `env:"APP_PORT" envDefault:"8000"`
+	DatabaseURL     string   `env:"DATABASE_URL,required"`
+	JWTSecret       string   `env:"JWT_SECRET" envDefault:"replace-me-in-prod"`
+	JWTExpHours     int      `env:"JWT_EXP_HOURS" envDefault:"1"`
+	BcryptCost      int      `env:"BCRYPT_COST" envDefault:"12"`
+	RateLimitPerSec int      `env:"RATE_LIMIT_PER_SEC" envDefault:"10"`
+	RateLimitBurst  int      `env:"RATE_LIMIT_BURST" envDefault:"20"`
+	CORSOriginsRaw  string   `env:"CORS_ORIGINS" envDefault:"http://localhost:3000"`
+	LLMProvider     string   `env:"LLM_PROVIDER" envDefault:"dummy"`
+	CORSOrigins     []string `env:"-"`
+}
+
+func FromEnv() (*Config, error) {
+	cfg := &Config{}
+	if err := env.Parse(cfg); err != nil {
+		return nil, err
+	}
+	cfg.CORSOrigins = splitAndTrim(cfg.CORSOriginsRaw)
+	return cfg, nil
+}
+
+func splitAndTrim(s string) []string {
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if t := strings.TrimSpace(p); t != "" {
+			out = append(out, t)
+		}
+	}
+	return out
+}

package/templates/stacks/go-stdlib/internal/db/postgres.go.tpl

@@ -0,0 +1,24 @@
+// Package db — pgx connection pool.
+package db
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func Connect(ctx context.Context, url string) (*pgxpool.Pool, error) {
+	cfg, err := pgxpool.ParseConfig(url)
+	if err != nil {
+		return nil, err
+	}
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	if err != nil {
+		return nil, err
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, err
+	}
+	return pool, nil
+}

package/templates/stacks/go-stdlib/internal/handler/auth_handler.go.tpl

@@ -0,0 +1,71 @@
+// Package handler — net/http handlers.
+package handler
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/httpx"
+	"{{moduleName}}/internal/middleware"
+	"{{moduleName}}/internal/service"
+)
+
+type AuthHandler struct {
+	auth  *service.AuthService
+	users *service.UsersService
+	cfg   *config.Config
+}
+
+func NewAuthHandler(a *service.AuthService, u *service.UsersService, cfg *config.Config) *AuthHandler {
+	return &AuthHandler{auth: a, users: u, cfg: cfg}
+}
+
+type loginBody struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+}
+
+func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
+	var body loginBody
+	if err := httpx.DecodeJSON(r, &body); err != nil {
+		httpx.WriteError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if !strings.Contains(body.Email, "@") || len(body.Password) < 8 {
+		httpx.WriteError(w, http.StatusBadRequest, "invalid email or password")
+		return
+	}
+	token, expiresIn, err := h.auth.Login(r.Context(), body.Email, body.Password)
+	if errors.Is(err, service.ErrInvalidCredentials) {
+		httpx.WriteError(w, http.StatusUnauthorized, "invalid credentials")
+		return
+	}
+	if err != nil {
+		httpx.WriteError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, map[string]any{
+		"accessToken": token,
+		"tokenType":   "Bearer",
+		"expiresIn":   expiresIn,
+	})
+}
+
+func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) {
+	claims, ok := claimsFromContext(r.Context())
+	if !ok {
+		httpx.WriteError(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, claims)
+}
+
+// claimsFromContext extracts the JWT claims placed by middleware.JWT.
+func claimsFromContext(ctx context.Context) (map[string]any, bool) {
+	v := ctx.Value(middleware.ClaimsContextKey)
+	c, ok := v.(map[string]any)
+	return c, ok
+}

package/templates/stacks/go-stdlib/internal/handler/users_handler.go.tpl

@@ -0,0 +1,84 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"{{moduleName}}/internal/httpx"
+	"{{moduleName}}/internal/service"
+)
+
+type UsersHandler struct {
+	svc *service.UsersService
+}
+
+func NewUsersHandler(s *service.UsersService) *UsersHandler {
+	return &UsersHandler{svc: s}
+}
+
+func (h *UsersHandler) List(w http.ResponseWriter, r *http.Request) {
+	page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	if page < 1 {
+		page = 1
+	}
+	if limit < 1 || limit > 100 {
+		limit = 20
+	}
+	items, total, err := h.svc.Page(r.Context(), page, limit)
+	if err != nil {
+		httpx.WriteError(w, http.StatusInternalServerError, "internal")
+		return
+	}
+	httpx.WriteJSON(w, http.StatusOK, map[string]any{
+		"items": items, "total": total, "page": page,
+	})
+}
+
+type createUserBody struct {
+	Email    string  `json:"email"`
+	Password string  `json:"password"`
+	Role     *string `json:"role,omitempty"`
+}
+
+func (h *UsersHandler) Create(w http.ResponseWriter, r *http.Request) {
+	claims, ok := claimsFromContext(r.Context())
+	if !ok {
+		httpx.WriteError(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+	if role, _ := claims["role"].(string); role != "ADMIN" {
+		httpx.WriteError(w, http.StatusForbidden, "admin role required")
+		return
+	}
+
+	var body createUserBody
+	if err := httpx.DecodeJSON(r, &body); err != nil {
+		httpx.WriteError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if len(body.Password) < 8 {
+		httpx.WriteError(w, http.StatusBadRequest, "password must be at least 8 chars")
+		return
+	}
+	role := "USER"
+	if body.Role != nil {
+		if *body.Role != "USER" && *body.Role != "ADMIN" {
+			httpx.WriteError(w, http.StatusBadRequest, "role must be USER or ADMIN")
+			return
+		}
+		role = *body.Role
+	}
+
+	user, err := h.svc.Create(r.Context(), body.Email, body.Password, role)
+	if errors.Is(err, service.ErrEmailExists) {
+		httpx.WriteError(w, http.StatusConflict, "email already in use")
+		return
+	}
+	if err != nil {
+		httpx.WriteError(w, http.StatusInternalServerError, "internal")
+		return
+	}
+	httpx.WriteJSON(w, http.StatusCreated, user)
+}

package/templates/stacks/go-stdlib/internal/handler/ws_handler.go

@@ -0,0 +1,36 @@
+package handler
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+type WSHandler struct{}
+
+func NewWSHandler() *WSHandler { return &WSHandler{} }
+
+func (h *WSHandler) Handle(w http.ResponseWriter, r *http.Request) {
+	c, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		InsecureSkipVerify: true, // tighten for production
+	})
+	if err != nil {
+		return
+	}
+	defer c.CloseNow()
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Minute)
+	defer cancel()
+
+	for {
+		typ, data, err := c.Read(ctx)
+		if err != nil {
+			return
+		}
+		if err := c.Write(ctx, typ, data); err != nil {
+			return
+		}
+	}
+}

package/templates/stacks/go-stdlib/internal/httpx/json.go

@@ -0,0 +1,32 @@
+// Package httpx — small helpers around encoding/json for handlers.
+package httpx
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+// WriteJSON encodes v as JSON with the given status.
+func WriteJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(v)
+}
+
+// WriteError writes an RFC 7807 Problem Details JSON.
+func WriteError(w http.ResponseWriter, status int, detail string) {
+	WriteJSON(w, status, map[string]any{
+		"type":   "urn:problem:" + http.StatusText(status),
+		"title":  http.StatusText(status),
+		"status": status,
+		"detail": detail,
+	})
+}
+
+// DecodeJSON reads a JSON body into v. Returns nil on success, error on
+// malformed body or unexpected extra fields.
+func DecodeJSON(r *http.Request, v any) error {
+	dec := json.NewDecoder(r.Body)
+	dec.DisallowUnknownFields()
+	return dec.Decode(v)
+}

package/templates/stacks/go-stdlib/internal/llm/dummy.go

@@ -0,0 +1,14 @@
+package llm
+
+import "context"
+
+type DummyProvider struct{}
+
+func NewDummyProvider() *DummyProvider { return &DummyProvider{} }
+
+func (d *DummyProvider) Complete(_ context.Context, prompt string, maxTokens int) (string, error) {
+	if maxTokens > 0 && len(prompt) > maxTokens {
+		return "[dummy] " + prompt[:maxTokens], nil
+	}
+	return "[dummy] " + prompt, nil
+}

package/templates/stacks/go-stdlib/internal/llm/provider.go

@@ -0,0 +1,8 @@
+// Package llm — LLM provider abstraction.
+package llm
+
+import "context"
+
+type Provider interface {
+	Complete(ctx context.Context, prompt string, maxTokens int) (string, error)
+}

package/templates/stacks/go-stdlib/internal/middleware/chain.go

@@ -0,0 +1,21 @@
+// Package middleware — composable HTTP middlewares for net/http.
+package middleware
+
+import "net/http"
+
+// Middleware is the canonical wrapping shape.
+type Middleware func(http.Handler) http.Handler
+
+// Chain applies middlewares in order: Chain(h, A, B, C) → A(B(C(h))).
+func Chain(h http.Handler, mws ...Middleware) http.Handler {
+	for i := len(mws) - 1; i >= 0; i-- {
+		h = mws[i](h)
+	}
+	return h
+}
+
+// contextKey is unexported so callers can't collide on the value.
+type contextKey string
+
+// ClaimsContextKey is the request-context key where JWT claims are stashed.
+const ClaimsContextKey contextKey = "jwt.claims"

package/templates/stacks/go-stdlib/internal/middleware/cors.go

@@ -0,0 +1,27 @@
+package middleware
+
+import "net/http"
+
+// CORS applies a whitelist of origins (NEVER use "*"). Empty list disables CORS.
+func CORS(allow []string) Middleware {
+	set := make(map[string]bool, len(allow))
+	for _, o := range allow {
+		set[o] = true
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			origin := r.Header.Get("Origin")
+			if origin != "" && set[origin] {
+				w.Header().Set("Access-Control-Allow-Origin", origin)
+				w.Header().Set("Vary", "Origin")
+				w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
+				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+			}
+			if r.Method == http.MethodOptions {
+				w.WriteHeader(http.StatusNoContent)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}

package/templates/stacks/go-stdlib/internal/middleware/jwt.go.tpl

@@ -0,0 +1,51 @@
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+
+	"{{moduleName}}/internal/config"
+)
+
+// JWT returns a middleware that validates a Bearer token and stashes the
+// claims as a map[string]any in request context under ClaimsContextKey.
+func JWT(cfg *config.Config) Middleware {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			raw := r.Header.Get("Authorization")
+			token := strings.TrimPrefix(raw, "Bearer ")
+			if token == raw || token == "" {
+				writeAuthError(w, http.StatusUnauthorized, "missing bearer")
+				return
+			}
+			parsed, err := jwt.Parse(token, func(t *jwt.Token) (any, error) {
+				if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+					return nil, jwt.ErrSignatureInvalid
+				}
+				return []byte(cfg.JWTSecret), nil
+			})
+			if err != nil || !parsed.Valid {
+				writeAuthError(w, http.StatusUnauthorized, "invalid token")
+				return
+			}
+			claims, _ := parsed.Claims.(jwt.MapClaims)
+			ctx := context.WithValue(r.Context(), ClaimsContextKey, map[string]any(claims))
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+func writeAuthError(w http.ResponseWriter, status int, detail string) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"type":   "urn:problem:Unauthorized",
+		"title":  http.StatusText(status),
+		"status": status,
+		"detail": detail,
+	})
+}