@nakedev/go-scaffold 0.1.2 → 0.1.3

package/templates/generate/module/handler_test.go.hbs

@@ -2,24 +2,37 @@ package {{pkg}}
 
 import (
 	"bytes"
+{{#if permission}}
+	"context"
+{{/if}}
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"sync"
 	"testing"
+{{#if auth}}
+	"time"
+{{/if}}
 
 	"{{goModule}}/internal/app/{{modulePath}}/model"
 	"{{goModule}}/internal/shared/middleware"
 
 	"github.com/gin-gonic/gin"
+{{#if auth}}
+	"github.com/golang-jwt/jwt/v5"
+{{/if}}
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
 	"gorm.io/gorm"
 )
 
-// integration test backed by real Postgres (same engine as prod, no sqlite) — skips if the DB isn't reachable
-// start the DB: docker compose up -d  (override with TEST_DB_DSN)
+// integration test backed by real Postgres (same engine as prod, no sqlite) — skips if the DB isn't reachable.
+// Runs against its own {{dbName}}_test database, never the one DB_DSN points at: the
+// harness does DropTable+AutoMigrate on every run, which would otherwise wipe the
+// schema `make migrate-up` built in your dev DB (FK constraints, seed data and all).
+// Create it once with `make db-create DB_NAME={{dbName}}_test`, or point TEST_DB_DSN
+// somewhere else.
 var (
 	testDBOnce sync.Once
 	testDB     *gorm.DB
@@ -31,7 +44,7 @@ func dbForTest(t *testing.T) *gorm.DB {
 	testDBOnce.Do(func() {
 		dsn := os.Getenv("TEST_DB_DSN")
 		if dsn == "" {
-			dsn = "postgres://postgres:postgres@localhost:5432/{{dbName}}?sslmode=disable"
+			dsn = "postgres://postgres:postgres@localhost:5432/{{dbName}}_test?sslmode=disable"
 		}
 		if testDB, testDBErr = gorm.Open(postgres.Open(dsn), &gorm.Config{TranslateError: true}); testDBErr == nil {
 			// drop first — AutoMigrate can't change an existing column's type, always start from a fresh schema
@@ -40,7 +53,7 @@ func dbForTest(t *testing.T) *gorm.DB {
 		}
 	})
 	if testDBErr != nil {
-		t.Skipf("postgres not ready (docker compose up -d, or set TEST_DB_DSN): %v", testDBErr)
+		t.Skipf("postgres not ready (make db-create DB_NAME={{dbName}}_test, or set TEST_DB_DSN): %v", testDBErr)
 	}
 	return testDB
 }
@@ -52,14 +65,44 @@ func setup(t *testing.T) *gin.Engine {
 	tx := dbForTest(t).Begin()
 	t.Cleanup(func() { tx.Rollback() })
 	r := gin.New()
-	r.Use(middleware.RequestID(), middleware.Error())
-	NewHandler(NewService(NewRepository(tx))).Register(r)
+	r.Use(middleware.RequestID(), middleware.Error(true))
+{{#if permission}}
+	// stub authz: always grants "{{permission}}" — this test is about the
+	// CRUD handler, not re-proving RBAC (that's covered by the role
+	// package's own tests), so the resolver doesn't need a real DB lookup.
+	authz := middleware.NewAuthz(func(_ context.Context, _ string) (map[string]struct{}, error) {
+		return map[string]struct{}{"{{permission}}": {}}, nil
+	}, time.Minute)
+{{/if}}
+	NewHandler(NewService(NewRepository(tx)){{#if auth}}, testJWTSecret{{/if}}{{#if permission}}, authz{{/if}}).Register(r)
 	return r
 }
 
+{{#if auth}}
+const testJWTSecret = "test-secret"
+
+// authHeader mints a valid access token signed with testJWTSecret — the
+// route's own RequireAuth(testJWTSecret) (wired in via NewHandler above)
+// verifies against the same secret, so this round-trips for real.
+func authHeader() string {
+	claims := jwt.MapClaims{
+		"typ":  "access",
+		"sub":  uuid.NewString(),
+		"role": "staff",
+		"exp":  time.Now().Add(time.Hour).Unix(),
+		"iat":  time.Now().Unix(),
+	}
+	tok, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(testJWTSecret))
+	return "Bearer " + tok
+}
+
+{{/if}}
 func do(r *gin.Engine, method, path, body string) *httptest.ResponseRecorder {
 	req := httptest.NewRequest(method, path, bytes.NewBufferString(body))
 	req.Header.Set("Content-Type", "application/json")
+{{#if auth}}
+	req.Header.Set("Authorization", authHeader())
+{{/if}}
 	w := httptest.NewRecorder()
 	r.ServeHTTP(w, req)
 	return w

package/templates/generate/module/minimal/handler.go.hbs

@@ -1,22 +1,40 @@
 package {{pkg}}
 
 import (
+{{#if auth}}
+	"{{goModule}}/internal/shared/middleware"
+
+{{/if}}
 	"github.com/gin-gonic/gin"
 )
 
 // Handler = delivery for {{pkg}} (parses HTTP, calls the service, attaches errors for the middleware to render)
 type Handler struct {
 	svc *Service
+{{#if auth}}
+	jwtSecret string
+{{/if}}
+{{#if permission}}
+	authz *middleware.Authz
+{{/if}}
 }
 
-func NewHandler(svc *Service) *Handler {
-	return &Handler{svc: svc}
+func NewHandler(svc *Service{{#if auth}}, jwtSecret string{{/if}}{{#if permission}}, authz *middleware.Authz{{/if}}) *Handler {
+	return &Handler{
+		svc: svc,
+{{#if auth}}
+		jwtSecret: jwtSecret,
+{{/if}}
+{{#if permission}}
+		authz: authz,
+{{/if}}
+	}
 }
 
 // Register wires {{pkg}}'s routes onto the router group (takes an IRouter so it can be nested under /v1)
 // minimal module: no routes yet — add them with `go-scaffold generate method {{pkg}} <name> --type ...`
 func (h *Handler) Register(rg gin.IRouter) {
-	g := rg.Group("/{{plural}}")
+	g := rg.Group("/{{plural}}"{{#if auth}}, middleware.RequireAuth(h.jwtSecret){{/if}}{{#if permission}}, h.authz.Require("{{permission}}"){{/if}})
 	_ = g
 	// go-scaffold:handler-routes
 }

package/templates/generate/module/minimal/handler_test.go.hbs

@@ -2,10 +2,16 @@ package {{pkg}}
 
 import (
 	"bytes"
+{{#if permission}}
+	"context"
+{{/if}}
 	"net/http/httptest"
 	"os"
 	"sync"
 	"testing"
+{{#if auth}}
+	"time"
+{{/if}}
 
 	"{{goModule}}/internal/app/{{modulePath}}/model"
 	"{{goModule}}/internal/shared/middleware"
@@ -13,13 +19,21 @@ import (
 	"gorm.io/gorm"
 
 	"github.com/gin-gonic/gin"
+{{#if auth}}
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+{{/if}}
 	"gorm.io/driver/postgres"
 )
 
 // integration test harness, backed by real Postgres (same engine as prod, no sqlite) — skips if
 // the DB isn't reachable. minimal module: no routes yet, so no tests reference this yet — kept
-// ready for once `generate method` adds endpoints (start the DB: docker compose up -d, override
-// with TEST_DB_DSN)
+// ready for once `generate method` adds endpoints.
+// Runs against its own {{dbName}}_test database, never the one DB_DSN points at: the
+// harness does DropTable+AutoMigrate on every run, which would otherwise wipe the
+// schema `make migrate-up` built in your dev DB (FK constraints, seed data and all).
+// Create it once with `make db-create DB_NAME={{dbName}}_test`, or point TEST_DB_DSN
+// somewhere else.
 //nolint:unused
 var (
 	testDBOnce sync.Once
@@ -33,7 +47,7 @@ func dbForTest(t *testing.T) *gorm.DB {
 	testDBOnce.Do(func() {
 		dsn := os.Getenv("TEST_DB_DSN")
 		if dsn == "" {
-			dsn = "postgres://postgres:postgres@localhost:5432/{{dbName}}?sslmode=disable"
+			dsn = "postgres://postgres:postgres@localhost:5432/{{dbName}}_test?sslmode=disable"
 		}
 		if testDB, testDBErr = gorm.Open(postgres.Open(dsn), &gorm.Config{TranslateError: true}); testDBErr == nil {
 			_ = testDB.Migrator().DropTable(&model.{{pascalName}}{})
@@ -41,7 +55,7 @@ func dbForTest(t *testing.T) *gorm.DB {
 		}
 	})
 	if testDBErr != nil {
-		t.Skipf("postgres not ready (docker compose up -d, or set TEST_DB_DSN): %v", testDBErr)
+		t.Skipf("postgres not ready (make db-create DB_NAME={{dbName}}_test, or set TEST_DB_DSN): %v", testDBErr)
 	}
 	return testDB
 }
@@ -55,15 +69,48 @@ func setup(t *testing.T) *gin.Engine {
 	tx := dbForTest(t).Begin()
 	t.Cleanup(func() { tx.Rollback() })
 	r := gin.New()
-	r.Use(middleware.RequestID(), middleware.Error())
-	NewHandler(NewService(NewRepository(tx))).Register(r)
+	r.Use(middleware.RequestID(), middleware.Error(true))
+{{#if permission}}
+	// stub authz: always grants "{{permission}}" — this test is about the
+	// CRUD handler, not re-proving RBAC (that's covered by the role
+	// package's own tests), so the resolver doesn't need a real DB lookup.
+	authz := middleware.NewAuthz(func(_ context.Context, _ string) (map[string]struct{}, error) {
+		return map[string]struct{}{"{{permission}}": {}}, nil
+	}, time.Minute)
+{{/if}}
+	NewHandler(NewService(NewRepository(tx)){{#if auth}}, testJWTSecret{{/if}}{{#if permission}}, authz{{/if}}).Register(r)
 	return r
 }
 
+{{#if auth}}
+//nolint:unused
+const testJWTSecret = "test-secret"
+
+// authHeader mints a valid access token signed with testJWTSecret — the
+// route's own RequireAuth(testJWTSecret) (wired in via NewHandler above)
+// verifies against the same secret, so this round-trips for real.
+//
+//nolint:unused
+func authHeader() string {
+	claims := jwt.MapClaims{
+		"typ":  "access",
+		"sub":  uuid.NewString(),
+		"role": "staff",
+		"exp":  time.Now().Add(time.Hour).Unix(),
+		"iat":  time.Now().Unix(),
+	}
+	tok, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(testJWTSecret))
+	return "Bearer " + tok
+}
+
+{{/if}}
 //nolint:unused
 func do(r *gin.Engine, method, path, body string) *httptest.ResponseRecorder {
 	req := httptest.NewRequest(method, path, bytes.NewBufferString(body))
 	req.Header.Set("Content-Type", "application/json")
+{{#if auth}}
+	req.Header.Set("Authorization", authHeader())
+{{/if}}
 	w := httptest.NewRecorder()
 	r.ServeHTTP(w, req)
 	return w

package/templates/generate/module/permission.down.sql.hbs

@@ -0,0 +1,5 @@
+-- intentionally not deleting the permission row: another module generated
+-- later may have reused this same code (the up migration's ON CONFLICT
+-- assumes exactly that), and this file can't know whether that happened.
+-- An unused permission row with no route checking it is harmless — delete
+-- it by hand if you're sure nothing else references '{{permission}}'.

package/templates/generate/module/permission.up.sql.hbs

@@ -0,0 +1,4 @@
+-- ON CONFLICT DO NOTHING: safe to re-generate a module reusing a permission
+-- code another module already inserted (e.g. a shared "orders:manage").
+INSERT INTO permissions (code, description) VALUES ('{{permission}}', 'Manage {{plural}}')
+ON CONFLICT (code) DO NOTHING;

package/dist/utils/module-paths.js

@@ -1,33 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.listVersionFolders = listVersionFolders;
-exports.versionsContainingModule = versionsContainingModule;
-exports.nextVersionName = nextVersionName;
-const fs_extra_1 = __importDefault(require("fs-extra"));
-const path_1 = __importDefault(require("path"));
-// folder-based domain versioning lays modules out as internal/app/v<n>/<pkg>.
-// listVersionFolders returns the existing v<n> dirs, sorted ascending.
-function listVersionFolders(projectDir) {
-    const appDir = path_1.default.join(projectDir, "internal", "app");
-    if (!fs_extra_1.default.existsSync(appDir))
-        return [];
-    return fs_extra_1.default
-        .readdirSync(appDir, { withFileTypes: true })
-        .filter((e) => e.isDirectory() && /^v\d+$/.test(e.name))
-        .map((e) => e.name)
-        .sort((a, b) => parseInt(a.slice(1), 10) - parseInt(b.slice(1), 10));
-}
-// version folders that actually contain the given module (identified by its
-// handler.go) — a module can legitimately live in more than one version at
-// once (that's the point of versioning), so callers that need exactly one
-// (generate method, remove module) must pick among the matches.
-function versionsContainingModule(projectDir, pkg) {
-    return listVersionFolders(projectDir).filter((v) => fs_extra_1.default.existsSync(path_1.default.join(projectDir, "internal", "app", v, pkg, "handler.go")));
-}
-function nextVersionName(versions) {
-    const max = versions.reduce((m, v) => Math.max(m, parseInt(v.slice(1), 10) || 0), 0);
-    return `v${max + 1}`;
-}