@nakedev/go-scaffold 0.1.2 → 0.1.3

package/templates/add/auth/internal/app/user/dto.go.hbs

@@ -0,0 +1,77 @@
+package user
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/user/model"
+
+	"github.com/google/uuid"
+)
+
+type registerInput struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required,min=8"`
+	Name     string `json:"name" binding:"required"`
+}
+
+type loginInput struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required"`
+}
+
+type forgotPasswordInput struct {
+	Email string `json:"email" binding:"required,email"`
+}
+
+type resetPasswordInput struct {
+	Token       string `json:"token" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required,min=8"`
+}
+
+type verifyEmailInput struct {
+	Token string `json:"token" binding:"required"`
+}
+
+// authResponse is what the service returns internally (both tokens); the
+// handler sends the refresh token as an httpOnly cookie instead of echoing
+// it in the body, so meResponse never carries it — see toCookieResponse.
+type authResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"-"`
+	TokenType    string `json:"token_type"`
+	ExpiresIn    int    `json:"expires_in"`
+}
+
+type authCookieResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int    `json:"expires_in"`
+}
+
+func toCookieResponse(a *authResponse) authCookieResponse {
+	return authCookieResponse{AccessToken: a.AccessToken, TokenType: a.TokenType, ExpiresIn: a.ExpiresIn}
+}
+
+type meResponse struct {
+	ID            uuid.UUID `json:"id"`
+	Email         string    `json:"email"`
+	Name          string    `json:"name"`
+	AvatarURL     string    `json:"avatar_url"`
+	EmailVerified bool      `json:"email_verified"`
+	// go-scaffold:user-me-fields
+	CreatedAt time.Time `json:"created_at"`
+}
+
+func toMeResponse(u *model.User) meResponse {
+	return meResponse{
+		ID:            u.ID,
+		Email:         u.Email,
+		Name:          u.Name,
+		AvatarURL:     u.AvatarURL,
+		EmailVerified: u.EmailVerified,
+		CreatedAt:     u.CreatedAt,
+		// go-scaffold:user-me-values
+	}
+}
+
+// go-scaffold:user-dto

package/templates/add/auth/internal/app/user/errors.go.hbs

@@ -0,0 +1,36 @@
+package user
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/apperror"
+)
+
+// functions, not vars: the error middleware writes RequestID onto the
+// returned pointer directly — a shared instance would race across
+// concurrent requests.
+
+func errNotFound() *apperror.AppError {
+	return apperror.New(http.StatusNotFound, "USER_NOT_FOUND", "user not found")
+}
+
+func errEmailTaken() *apperror.AppError {
+	return apperror.New(http.StatusConflict, "USER_EMAIL_TAKEN", "email already registered")
+}
+
+// errInvalidCredentials is returned for both "no such user" and "wrong
+// password" — a single generic message so a login attempt can't be used to
+// enumerate which emails have accounts.
+func errInvalidCredentials() *apperror.AppError {
+	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_CREDENTIALS", "invalid email or password")
+}
+
+func errInvalidToken() *apperror.AppError {
+	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_TOKEN", "invalid or expired refresh token")
+}
+
+func errAlreadyVerified() *apperror.AppError {
+	return apperror.New(http.StatusConflict, "AUTH_ALREADY_VERIFIED", "email is already verified")
+}
+
+// go-scaffold:user-errors

package/templates/add/auth/internal/app/user/handler.go.hbs

@@ -0,0 +1,235 @@
+package user
+
+import (
+	"net/http"
+	"time"
+
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+	// go-scaffold:user-handler-imports
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/redis/go-redis/v9"
+)
+
+const refreshCookieName = "refresh_token"
+
+// go-scaffold:user-handler-consts
+
+type Handler struct {
+	svc          *Service
+	jwtSecret    string
+	refreshTTL   time.Duration
+	cookieSecure bool
+	rdb          *redis.Client
+	// go-scaffold:user-handler-fields
+}
+
+func NewHandler(
+	svc *Service,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	rdb *redis.Client,
+	// go-scaffold:user-handler-params
+) *Handler {
+	return &Handler{
+		svc:          svc,
+		jwtSecret:    jwtSecret,
+		refreshTTL:   refreshTTL,
+		cookieSecure: cookieSecure,
+		rdb:          rdb,
+		// go-scaffold:user-handler-init
+	}
+}
+
+// Register wires both a public /auth group (register/login/refresh/logout)
+// and a /users group gated by RequireAuth — public vs protected is decided
+// here, per domain, not centrally in main.go.
+func (h *Handler) Register(rg gin.IRouter) {
+	// per-IP, per-route budgets — separate names so a burst on one endpoint
+	// doesn't spend another's budget. refresh/logout/google aren't limited:
+	// refresh/logout are gated by possessing a valid cookie already, and the
+	// Google flow's abuse surface lives on Google's side, not ours.
+	loginLimit := middleware.RateLimit(h.rdb, "login", 10, time.Minute)
+	registerLimit := middleware.RateLimit(h.rdb, "register", 5, time.Minute)
+	forgotPasswordLimit := middleware.RateLimit(h.rdb, "forgot-password", 5, time.Minute)
+	resetPasswordLimit := middleware.RateLimit(h.rdb, "reset-password", 10, time.Minute)
+	verifyEmailLimit := middleware.RateLimit(h.rdb, "verify-email", 10, time.Minute)
+	resendVerificationLimit := middleware.RateLimit(h.rdb, "resend-verification", 5, time.Minute)
+
+	authGroup := rg.Group("/auth")
+	authGroup.POST("/register", registerLimit, h.register)
+	authGroup.POST("/login", loginLimit, h.login)
+	authGroup.POST("/refresh", h.refresh)
+	authGroup.POST("/logout", h.logout)
+	authGroup.POST("/forgot-password", forgotPasswordLimit, h.forgotPassword)
+	authGroup.POST("/reset-password", resetPasswordLimit, h.resetPassword)
+	authGroup.POST("/verify-email", verifyEmailLimit, h.verifyEmail)
+	authGroup.GET("/google/login", h.googleLogin)
+	authGroup.GET("/google/callback", h.googleCallback)
+
+	usersGroup := rg.Group("/users", middleware.RequireAuth(h.jwtSecret))
+	usersGroup.GET("/me", h.me)
+	usersGroup.POST("/me/resend-verification", resendVerificationLimit, h.resendVerification)
+	usersGroup.POST("/me/logout-all", h.logoutAll)
+	// go-scaffold:user-routes
+}
+
+func (h *Handler) register(c *gin.Context) {
+	var in registerInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Register(c.Request.Context(), in)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusCreated, toCookieResponse(auth))
+}
+
+func (h *Handler) login(c *gin.Context) {
+	var in loginInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Login(c.Request.Context(), in)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) refresh(c *gin.Context) {
+	raw, err := c.Cookie(refreshCookieName)
+	if err != nil || raw == "" {
+		c.Error(errInvalidToken())
+		return
+	}
+	auth, err := h.svc.Refresh(c.Request.Context(), raw)
+	if err != nil {
+		h.clearRefreshCookie(c)
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) logout(c *gin.Context) {
+	raw, _ := c.Cookie(refreshCookieName)
+	_ = h.svc.Logout(c.Request.Context(), raw)
+	h.clearRefreshCookie(c)
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) forgotPassword(c *gin.Context) {
+	var in forgotPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
+		c.Error(err)
+		return
+	}
+	// always the same response, whether or not the email exists — see
+	// Service.ForgotPassword for why.
+	c.JSON(http.StatusOK, gin.H{"message": "if that email exists, a reset link has been sent"})
+}
+
+func (h *Handler) resetPassword(c *gin.Context) {
+	var in resetPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) verifyEmail(c *gin.Context) {
+	var in verifyEmailInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) resendVerification(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	if err := h.svc.ResendVerificationEmail(c.Request.Context(), userID); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// logoutAll ends every session for the caller, not just the one making the
+// request — also clears this request's own cookie, since that session is
+// dead too now.
+func (h *Handler) logoutAll(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	if err := h.svc.LogoutAll(c.Request.Context(), userID); err != nil {
+		c.Error(err)
+		return
+	}
+	h.clearRefreshCookie(c)
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) googleLogin(c *gin.Context) {
+	url, err := h.svc.GoogleLoginURL()
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.Redirect(http.StatusFound, url)
+}
+
+func (h *Handler) googleCallback(c *gin.Context) {
+	auth, err := h.svc.GoogleCallback(c.Request.Context(), c.Query("code"), c.Query("state"))
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) me(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	u, err := h.svc.Get(c.Request.Context(), userID)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}
+
+// go-scaffold:user-handler-funcs
+
+func (h *Handler) setRefreshCookie(c *gin.Context, token string) {
+	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetCookie(refreshCookieName, token, int(h.refreshTTL.Seconds()), "/", "", h.cookieSecure, true)
+}
+
+func (h *Handler) clearRefreshCookie(c *gin.Context) {
+	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetCookie(refreshCookieName, "", -1, "/", "", h.cookieSecure, true)
+}

package/templates/add/auth/internal/app/user/jwt.go.hbs

@@ -0,0 +1,84 @@
+package user
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+)
+
+const (
+	tokenTypeAccess     = "access"
+	tokenTypeOAuthState = "oauth_state"
+	oauthStateTTL       = 10 * time.Minute
+)
+
+// accessClaims — see internal/shared/middleware/auth.go for why this struct
+// is duplicated there instead of imported. Also reused (with no Subject) for
+// the Google OAuth CSRF state token below — Typ is what stops one kind being
+// presented where the other is expected.
+type accessClaims struct {
+	Typ string `json:"typ"`
+	// go-scaffold:jwt-claims
+	jwt.RegisteredClaims
+}
+
+func (s *Service) issueAccessToken(
+	userID uuid.UUID,
+	// go-scaffold:issue-access-token-params
+) (string, error) {
+	claims := accessClaims{
+		Typ: tokenTypeAccess,
+		// go-scaffold:jwt-claims-values
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   userID.String(),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(s.accessTTL)),
+		},
+	}
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
+}
+
+// issueOAuthState / verifyOAuthState round-trip a short-lived, stateless CSRF
+// token through Google's own redirect — no server-side row needed, the JWT's
+// signature + short TTL is the whole protection.
+func (s *Service) issueOAuthState() (string, error) {
+	claims := accessClaims{
+		Typ: tokenTypeOAuthState,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(oauthStateTTL)),
+		},
+	}
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
+}
+
+func (s *Service) verifyOAuthState(raw string) error {
+	var claims accessClaims
+	_, err := jwt.ParseWithClaims(raw, &claims, func(*jwt.Token) (any, error) {
+		return []byte(s.jwtSecret), nil
+	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name}))
+	if err != nil || claims.Typ != tokenTypeOAuthState {
+		return errInvalidToken()
+	}
+	return nil
+}
+
+// randomToken generates an opaque refresh token — deliberately not a JWT:
+// nothing needs to read claims out of it, and only its hash (see hashToken)
+// is ever stored, so a leaked server-side store never exposes usable tokens.
+func randomToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func hashToken(raw string) string {
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}

package/templates/add/auth/internal/app/user/model/identity.go.hbs

@@ -0,0 +1,28 @@
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type Provider string
+
+const (
+	ProviderLocal  Provider = "local"
+	ProviderGoogle Provider = "google"
+)
+
+// Identity = how you log in (one row per login method). PasswordHash is set
+// for a "local" identity; ProviderUID is set for "google" (the provider's own
+// subject id). Split from User so adding a login method never touches the
+// profile row — one person can have both and resolve to the same account.
+type Identity struct {
+	ID           uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
+	UserID       uuid.UUID `json:"user_id" gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
+	Provider     Provider  `json:"provider" gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
+	PasswordHash *string   `json:"-"`
+	ProviderUID  *string   `json:"-" gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
+	CreatedAt    time.Time `json:"created_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
+}

package/templates/add/auth/internal/app/user/model/user.go.hbs

@@ -0,0 +1,22 @@
+// Package model holds this domain's GORM tables.
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// User = who you are (profile). How you log in is a separate concept — see
+// Identity — so the same person can have both a password and a Google login
+// resolving to one account.
+type User struct {
+	ID            uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
+	Email         string    `json:"email" gorm:"uniqueIndex;not null"`
+	Name          string    `json:"name"`
+	AvatarURL     string    `json:"avatar_url"`
+	EmailVerified bool      `json:"email_verified"`
+	// go-scaffold:user-fields
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}

package/templates/add/auth/internal/app/user/repository.go.hbs

@@ -0,0 +1,84 @@
+package user
+
+import (
+	"context"
+
+	"{{goModule}}/internal/app/user/model"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+func NewRepository(db *gorm.DB) *Repository {
+	return &Repository{db: db}
+}
+
+func (r *Repository) FindByEmail(ctx context.Context, email string) (*model.User, error) {
+	var u model.User
+	if err := r.db.WithContext(ctx).First(&u, "email = ?", email).Error; err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*model.User, error) {
+	var u model.User
+	if err := r.db.WithContext(ctx).First(&u, "id = ?", id).Error; err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
+func (r *Repository) UpdateUser(ctx context.Context, u *model.User) error {
+	return r.db.WithContext(ctx).Save(u).Error
+}
+
+func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]model.User, error) {
+	var items []model.User
+	err := r.db.WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&items).Error
+	return items, err
+}
+
+func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider model.Provider) (*model.Identity, error) {
+	var i model.Identity
+	if err := r.db.WithContext(ctx).First(&i, "user_id = ? AND provider = ?", userID, provider).Error; err != nil {
+		return nil, err
+	}
+	return &i, nil
+}
+
+func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider model.Provider, providerUID string) (*model.Identity, error) {
+	var i model.Identity
+	if err := r.db.WithContext(ctx).First(&i, "provider = ? AND provider_uid = ?", provider, providerUID).Error; err != nil {
+		return nil, err
+	}
+	return &i, nil
+}
+
+// CreateIdentity links a new login method onto an EXISTING user (e.g.
+// Google linking onto an account that registered with a password first) —
+// see CreateUserWithIdentity for the "brand new user" case.
+func (r *Repository) CreateIdentity(ctx context.Context, i *model.Identity) error {
+	return r.db.WithContext(ctx).Create(i).Error
+}
+
+func (r *Repository) UpdateIdentity(ctx context.Context, i *model.Identity) error {
+	return r.db.WithContext(ctx).Save(i).Error
+}
+
+// CreateUserWithIdentity inserts the profile and its first login method in
+// one transaction — a user with no identity at all can't log in any way, so
+// the two rows always exist together or not at all.
+func (r *Repository) CreateUserWithIdentity(ctx context.Context, u *model.User, i *model.Identity) error {
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Create(u).Error; err != nil {
+			return err
+		}
+		i.UserID = u.ID
+		return tx.Create(i).Error
+	})
+}