@nakedev/go-scaffold 0.1.2 → 0.1.3

package/templates/create/base/cmd/api/main.go.hbs

@@ -11,11 +11,17 @@ import (
 	"time"
 
 	"{{goModule}}/internal/platform/database"
+{{#if observability}}
+	"{{goModule}}/internal/platform/telemetry"
+{{/if}}
 	"{{goModule}}/internal/shared/config"
 	"{{goModule}}/internal/shared/middleware"
 	// go-scaffold:imports
 
 	"github.com/gin-gonic/gin"
+{{#if observability}}
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+{{/if}}
 )
 
 func main() {
@@ -23,7 +29,17 @@ func main() {
 
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: parseLevel(cfg.LogLevel)}))
 	slog.SetDefault(logger)
+	// go-scaffold:config-checks
 
+{{#if observability}}
+	shutdownTelemetry, err := telemetry.Init(context.Background(), "{{projectName}}", cfg.OTELExporterEndpoint)
+	if err != nil {
+		logger.Error("init telemetry", "error", err)
+		os.Exit(1)
+	}
+	defer func() { _ = shutdownTelemetry(context.Background()) }()
+
+{{/if}}
 	db, err := database.Open(cfg)
 	if err != nil {
 		logger.Error("open db", "error", err)
@@ -35,6 +51,7 @@ func main() {
 		logger.Error("db handle", "error", err)
 		os.Exit(1)
 	}
+	// go-scaffold:platform-init
 
 	if cfg.AutoMigrate {
 		// ponytail: AutoMigrate is for dev only (add-only, locks the table once data grows)
@@ -45,10 +62,13 @@ func main() {
 			logger.Error("migrate", "error", err)
 			os.Exit(1)
 		}
+	} else if err := database.CheckMigrationVersion(db); err != nil {
+		logger.Error("migration version check", "error", err)
+		os.Exit(1)
 	}
 
 	r := gin.New()
-	r.Use(gin.Recovery(), middleware.RequestID(), middleware.Logger(logger), middleware.Error())
+	r.Use(gin.Recovery(), middleware.CORS(cfg.CORSAllowedOrigins), middleware.RequestID(), middleware.Logger(logger), middleware.Error(!cfg.IsProd()){{#if observability}}, middleware.Metrics(), middleware.Tracing("{{projectName}}"){{/if}})
 
 	// liveness = is the process up / readiness = ready for traffic (can it reach the DB)
 	r.GET("/livez", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"status": "ok"}) })
@@ -57,8 +77,12 @@ func main() {
 			c.JSON(http.StatusServiceUnavailable, gin.H{"status": "unavailable"})
 			return
 		}
+		// go-scaffold:readyz-checks
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
 	})
+{{#if observability}}
+	r.GET("/metrics", gin.WrapH(promhttp.Handler()))
+{{/if}}
 {{#if openapiDocs}}
 	// hand-written spec at docs/openapi.yaml, split across sibling files (common/, health/,
 	// <domain>/) via relative $ref — serve the whole tree under one prefix so a client that
@@ -99,6 +123,7 @@ func main() {
 	if err := srv.Shutdown(shutdownCtx); err != nil {
 		logger.Error("shutdown", "error", err)
 	}
+	// go-scaffold:shutdown
 	logger.Info("stopped")
 }
 

package/templates/create/base/internal/platform/database/database.go.hbs

@@ -1,7 +1,15 @@
 package database
 
 import (
+	"fmt"
+	"regexp"
+	"strconv"
+
+{{#if observability}}
+	"{{goModule}}/internal/platform/telemetry"
+{{/if}}
 	"{{goModule}}/internal/shared/config"
+	"{{goModule}}/migrations"
 
 	"gorm.io/driver/postgres"
 	"gorm.io/gorm"
@@ -16,6 +24,12 @@ func Open(cfg config.Config) (*gorm.DB, error) {
 		return nil, err
 	}
 
+{{#if observability}}
+	if err := db.Use(telemetry.NewGormPlugin()); err != nil {
+		return nil, err
+	}
+
+{{/if}}
 	sqlDB, err := db.DB()
 	if err != nil {
 		return nil, err
@@ -26,3 +40,42 @@ func Open(cfg config.Config) (*gorm.DB, error) {
 
 	return db, nil
 }
+
+var migrationVersionRe = regexp.MustCompile(`^(\d+)_.*\.up\.sql$`)
+
+// CheckMigrationVersion fails fast if the DB's applied schema version (the
+// golang-migrate CLI's own schema_migrations table) doesn't match the newest
+// migration file baked into this binary — instead of booting against a stale
+// or half-applied schema and failing later on whatever query hits the
+// missing column first. Only meaningful when AutoMigrate is off (prod); call
+// this from that branch only.
+func CheckMigrationVersion(db *gorm.DB) error {
+	entries, err := migrations.FS.ReadDir(".")
+	if err != nil {
+		return fmt.Errorf("read embedded migrations: %w", err)
+	}
+	var latest int
+	for _, e := range entries {
+		m := migrationVersionRe.FindStringSubmatch(e.Name())
+		if m == nil {
+			continue
+		}
+		if v, _ := strconv.Atoi(m[1]); v > latest {
+			latest = v
+		}
+	}
+
+	var version int
+	var dirty bool
+	row := db.Raw("SELECT version, dirty FROM schema_migrations").Row()
+	if err := row.Scan(&version, &dirty); err != nil {
+		return fmt.Errorf("read schema_migrations (did you run `make migrate-up`?): %w", err)
+	}
+	if dirty {
+		return fmt.Errorf("schema_migrations is dirty at version %d — a previous migration failed partway; fix it before starting the app", version)
+	}
+	if version != latest {
+		return fmt.Errorf("DB schema is at migration %d, this binary expects %d — run `make migrate-up`", version, latest)
+	}
+	return nil
+}

package/templates/create/base/internal/shared/config/config.go.hbs

@@ -1,13 +1,16 @@
 package config
 
 import (
+	"fmt"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 )
 
 // Config loads from env (with dev-friendly defaults).
 type Config struct {
+	AppEnv            string // "development" | "production" — the one source of truth for env-gated behavior; see IsProd (validated in Load)
 	Port              string
 	DBDSN             string
 	LogLevel          string
@@ -15,10 +18,22 @@ type Config struct {
 	DBMaxOpenConns    int
 	DBMaxIdleConns    int
 	DBConnMaxLifetime time.Duration
+
+	CORSAllowedOrigins []string
+{{#if observability}}
+	OTELExporterEndpoint string
+{{/if}}
+	// go-scaffold:config-fields
 }
 
+// IsProd reports whether env-gated production behavior should be active
+// (e.g. hiding internal error details from responses). Everything that
+// isn't APP_ENV=production is treated the same way.
+func (c Config) IsProd() bool { return c.AppEnv == "production" }
+
 func Load() Config {
-	return Config{
+	cfg := Config{
+		AppEnv:            env("APP_ENV", "development"),
 		Port:              env("PORT", "8080"),
 		DBDSN:             env("DB_DSN", "postgres://postgres:postgres@localhost:5432/{{dbName}}?sslmode=disable"),
 		LogLevel:          env("LOG_LEVEL", "info"),
@@ -26,7 +41,23 @@ func Load() Config {
 		DBMaxOpenConns:    envInt("DB_MAX_OPEN_CONNS", 10),
 		DBMaxIdleConns:    envInt("DB_MAX_IDLE_CONNS", 10),
 		DBConnMaxLifetime: time.Duration(envInt("DB_CONN_MAX_LIFETIME_MIN", 5)) * time.Minute,
+
+		CORSAllowedOrigins: envList("CORS_ALLOWED_ORIGINS", "http://localhost:3000"),
+{{#if observability}}
+		OTELExporterEndpoint: env("OTEL_EXPORTER_OTLP_ENDPOINT", ""),
+{{/if}}
+		// go-scaffold:config-load
+	}
+
+	// Fail closed on an unknown APP_ENV: an unrecognized value (typo, stale var)
+	// would otherwise be treated as non-prod and silently disable the prod guard
+	// (leaking error details). Panics here — the one place the binary loads
+	// config — so a bad value is caught at boot, not discovered in prod later.
+	if cfg.AppEnv != "development" && cfg.AppEnv != "production" {
+		panic(fmt.Sprintf("invalid APP_ENV %q — must be development or production", cfg.AppEnv))
 	}
+
+	return cfg
 }
 
 func env(k, def string) string {
@@ -36,6 +67,17 @@ func env(k, def string) string {
 	return def
 }
 
+func envList(k, def string) []string {
+	raw := strings.Split(env(k, def), ",")
+	out := make([]string, 0, len(raw))
+	for _, v := range raw {
+		if v = strings.TrimSpace(v); v != "" {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
 func envInt(k string, def int) int {
 	if v := os.Getenv(k); v != "" {
 		if n, err := strconv.Atoi(v); err == nil {

package/templates/create/base/internal/shared/middleware/cors.go.hbs

@@ -0,0 +1,29 @@
+package middleware
+
+import (
+	"net/http"
+	"slices"
+
+	"github.com/gin-gonic/gin"
+)
+
+// CORS allows a fixed set of browser origins to call the API with
+// credentials (cookies) — "*" can't be combined with Allow-Credentials per
+// the fetch spec, so the origin is echoed back only when it's in
+// allowedOrigins.
+func CORS(allowedOrigins []string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Vary", "Origin")
+		if origin := c.GetHeader("Origin"); slices.Contains(allowedOrigins, origin) {
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Header("Access-Control-Allow-Credentials", "true")
+			c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+			c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		}
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+		c.Next()
+	}
+}

package/templates/create/base/internal/shared/middleware/error.go.hbs

@@ -11,7 +11,12 @@ import (
 
 // Error reads the last error attached via c.Error() and renders it once, so
 // handlers only ever do c.Error(err); return — no c.JSON per call site.
-func Error() gin.HandlerFunc {
+//
+// exposeDetail controls whether an error's Details (a validation field map,
+// or an unexpected error's real message) is echoed back in the response body
+// — wire this to !cfg.IsProd() so a caller hitting the API directly never
+// learns field names/shape from prod responses; devs still get it locally.
+func Error(exposeDetail bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Next()
 
@@ -25,6 +30,13 @@ func Error() gin.HandlerFunc {
 			// Unexpected error: log the real thing, answer the client generically.
 			slog.Error("unhandled error", "error", err.Err, "request_id", c.GetString(RequestIDKey))
 			appErr = apperror.NewInternal()
+			if exposeDetail {
+				appErr.Details = err.Err.Error()
+			}
+		} else if !exposeDetail {
+			// Known AppError (e.g. VALIDATION_ERROR): still strip Details in
+			// prod, so a direct API call doesn't get field-level hints.
+			appErr.Details = nil
 		}
 
 		appErr.RequestID = c.GetString(RequestIDKey)

package/templates/create/base/migrations/embed.go.hbs

@@ -0,0 +1,15 @@
+// Package migrations embeds the migration SQL files so the running binary
+// can check its own schema version without shelling out to the migrate CLI.
+package migrations
+
+import "embed"
+
+// ponytail: pattern is "*", not "*.sql" — a fresh project has zero .sql files
+// until the first `generate module`, and "*.sql" fails to compile ("no
+// matching files") until one exists. "*" always matches at least .gitkeep, so
+// this builds from `create` onward; the harmless cost is embedding .gitkeep
+// and this file itself alongside real migrations, which CheckMigrationVersion
+// already skips over (regex requires a numeric prefix and .up.sql suffix).
+//
+//go:embed *
+var FS embed.FS

package/templates/create/features/docs/architecture.md.hbs

@@ -91,6 +91,28 @@ Scalar/Swagger UI/Redoc to follow them).
 comment-generated (swaggo) if hand-updates start drifting.
 {{/if}}
 
+{{#if observability}}
+## 9. Observability
+
+**Decision:** Prometheus metrics (`GET /metrics`, request count + latency
+per route) always-on when this feature is enabled; OpenTelemetry tracing
+(Gin + GORM) exports via OTLP/HTTP only when `OTEL_EXPORTER_OTLP_ENDPOINT`
+is set — empty means no exporter is created and no network calls are made.
+**Rationale:** Metrics have no external dependency to turn on (Prometheus
+scrapes the app, the app never dials out) so there's no reason to gate them
+further. Tracing needs a collector to be useful, so it stays off until one's
+actually configured, instead of trying to dial a collector that isn't there.
+This is a `create`-time choice (unlike `add auth`/`add rbac`), not something
+layered on afterward — flip it by hand (`internal/shared/middleware/{metrics,tracing}.go`,
+`internal/platform/telemetry/tracing.go`, wiring in `cmd/api/main.go` and
+`internal/platform/database`) if the project needs it later. Both the Gin and
+GORM tracing hooks are hand-rolled against the OTel SDK directly, not the
+official `otelgin`/`gorm.io/plugin/opentelemetry` contrib packages — those
+pull in a newer Gin (→ HTTP/3/quic-go) and every DB driver they support
+tracing for (MySQL, ClickHouse, MongoDB), respectively, for a Postgres-only
+project that only wants request/query spans.
+
+{{/if}}
 ## Evolution Notes
 
 - `go-scaffold generate module <name>` adds a new domain package and

package/templates/create/features/docs/common/responses.yaml.hbs

@@ -18,3 +18,18 @@ UnprocessableEntityError:
   content:
     application/json:
       schema: { $ref: './schemas.yaml#/Error' }
+UnauthorizedError:
+  description: missing, invalid, or expired credentials
+  content:
+    application/json:
+      schema: { $ref: './schemas.yaml#/Error' }
+ForbiddenError:
+  description: authenticated but lacking the required permission
+  content:
+    application/json:
+      schema: { $ref: './schemas.yaml#/Error' }
+TooManyRequestsError:
+  description: rate limit exceeded, retry later
+  content:
+    application/json:
+      schema: { $ref: './schemas.yaml#/Error' }

package/templates/create/features/docs/observability/metrics.yaml.hbs

@@ -0,0 +1,12 @@
+get:
+  summary: Prometheus metrics
+  description: Text-format metrics for Prometheus to scrape — not part of the JSON API surface.
+  operationId: getMetrics
+  tags: [observability]
+  security: []
+  responses:
+    "200":
+      description: ok
+      content:
+        text/plain:
+          schema: { type: string }

package/templates/create/features/docs/openapi.yaml.hbs

@@ -19,6 +19,10 @@ paths:
     $ref: './health/health-livez.yaml'
   /readyz:
     $ref: './health/health-readyz.yaml'
+{{#if observability}}
+  /metrics:
+    $ref: './observability/metrics.yaml'
+{{/if}}
   # go-scaffold:paths
 
 components:
@@ -31,3 +35,12 @@ components:
     NotFoundError: { $ref: './common/responses.yaml#/NotFoundError' }
     ConflictError: { $ref: './common/responses.yaml#/ConflictError' }
     UnprocessableEntityError: { $ref: './common/responses.yaml#/UnprocessableEntityError' }
+    UnauthorizedError: { $ref: './common/responses.yaml#/UnauthorizedError' }
+    ForbiddenError: { $ref: './common/responses.yaml#/ForbiddenError' }
+    TooManyRequestsError: { $ref: './common/responses.yaml#/TooManyRequestsError' }
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: "access token from POST /auth/login or /auth/register, sent as `Authorization: Bearer <token>`"

package/templates/create/features/docs/techstack.md.hbs

@@ -23,6 +23,7 @@
 - Graceful shutdown, structured logging, `/livez` + `/readyz`: always enabled
 - Docker Compose (local Postgres): `{{#if docker}}enabled{{else}}disabled{{/if}}`
 - OpenAPI docs (`docs/openapi.yaml`, whole `docs/` tree served at `/docs`): `{{#if openapiDocs}}enabled{{else}}disabled{{/if}}`
+- Metrics + tracing (Prometheus `/metrics`, OpenTelemetry for Gin + GORM): `{{#if observability}}enabled{{else}}disabled{{/if}}`
 - API route prefix: `{{#if apiPrefix}}/{{apiPrefix}}{{else}}(none){{/if}}`
 - CI (`.github/workflows/ci.yml` — build, vet, gofmt check, golangci-lint, `go test` with a real Postgres service): always enabled
 
@@ -34,5 +35,7 @@
   `false` in prod and run `migrate up` as a deploy step instead
 {{#if openapiDocs}}- `docs/openapi.yaml` is hand-written, not generated — update it whenever an
   endpoint or DTO changes
+{{/if}}{{#if observability}}- `OTEL_EXPORTER_OTLP_ENDPOINT` unset (dev default) means tracing exports
+  nowhere — set it to a real OTLP/HTTP collector address to see traces
 {{/if}}- Versions above are what `go-scaffold create` pinned in `go.mod` — bump them
   by hand (`go get -u` + `go mod tidy`) as the stack evolves

package/templates/create/features/observability/middleware/metrics.go.hbs

@@ -0,0 +1,41 @@
+package middleware
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+	httpRequestsTotal = promauto.NewCounterVec(
+		prometheus.CounterOpts{Name: "http_requests_total", Help: "Total HTTP requests"},
+		[]string{"method", "path", "status"},
+	)
+	httpRequestDuration = promauto.NewHistogramVec(
+		prometheus.HistogramOpts{Name: "http_request_duration_seconds", Help: "HTTP request duration in seconds"},
+		[]string{"method", "path", "status"},
+	)
+)
+
+// Metrics records request count and latency per route for GET /metrics to
+// expose to Prometheus. Uses c.FullPath() (the route template, e.g.
+// "/v1/invoices/:id") rather than the raw request path — a UUID or other
+// path param would otherwise create one label series per distinct value,
+// growing unbounded with traffic instead of staying one series per route.
+func Metrics() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		start := time.Now()
+		c.Next()
+
+		path := c.FullPath()
+		if path == "" {
+			path = "unmatched" // no route matched (404) — one shared label, not the raw unbounded path
+		}
+		status := strconv.Itoa(c.Writer.Status())
+		httpRequestsTotal.WithLabelValues(c.Request.Method, path, status).Inc()
+		httpRequestDuration.WithLabelValues(c.Request.Method, path, status).Observe(time.Since(start).Seconds())
+	}
+}

package/templates/create/features/observability/middleware/tracing.go.hbs

@@ -0,0 +1,46 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Tracing starts one span per request, propagating an incoming W3C
+// traceparent header (if any) so a request already being traced upstream
+// stays part of the same trace, not a new root.
+//
+// Hand-rolled instead of the official otelgin contrib package: pulling it in
+// forces this project's gin dependency to a newer minimum version than the
+// one this scaffold pins, which itself drags in HTTP/3 (quic-go) — weight
+// unrelated to tracing. Gin's middleware surface (Next/Writer.Status/Errors)
+// is small enough that duplicating just the part actually used isn't worth
+// that.
+func Tracing(serviceName string) gin.HandlerFunc {
+	tracer := otel.Tracer(serviceName)
+	return func(c *gin.Context) {
+		ctx := otel.GetTextMapPropagator().Extract(c.Request.Context(), propagation.HeaderCarrier(c.Request.Header))
+
+		spanName := c.FullPath()
+		if spanName == "" {
+			spanName = c.Request.URL.Path // no route matched (404) — still traced, just without a route template
+		}
+		ctx, span := tracer.Start(ctx, spanName, trace.WithSpanKind(trace.SpanKindServer))
+		defer span.End()
+		c.Request = c.Request.WithContext(ctx)
+
+		c.Next()
+
+		span.SetAttributes(
+			attribute.String("http.method", c.Request.Method),
+			attribute.Int("http.status_code", c.Writer.Status()),
+		)
+		if len(c.Errors) > 0 {
+			span.RecordError(c.Errors.Last())
+			span.SetStatus(codes.Error, c.Errors.String())
+		}
+	}
+}

package/templates/create/features/observability/platform/telemetry/tracing.go.hbs

@@ -0,0 +1,130 @@
+// Package telemetry wires OpenTelemetry tracing — it talks to a real
+// external system (the OTLP collector), so it lives in platform/, not
+// shared/, same split rule as internal/platform/database.
+package telemetry
+
+import (
+	"context"
+	"time"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/trace"
+	"gorm.io/gorm"
+)
+
+// Init wires a global TracerProvider that exports spans via OTLP/HTTP to
+// endpoint. An empty endpoint (the default — see OTEL_EXPORTER_OTLP_ENDPOINT
+// in .env.example) skips exporter setup entirely and returns a no-op
+// shutdown: tracing quietly does nothing instead of trying to dial a
+// collector that isn't there, same "off unless configured" shape as the
+// rest of this app's optional integrations.
+func Init(ctx context.Context, serviceName, endpoint string) (shutdown func(context.Context) error, err error) {
+	noop := func(context.Context) error { return nil }
+	if endpoint == "" {
+		return noop, nil
+	}
+
+	exporter, err := otlptracehttp.New(ctx, otlptracehttp.WithEndpoint(endpoint), otlptracehttp.WithInsecure())
+	if err != nil {
+		return noop, err
+	}
+
+	res, err := resource.New(ctx, resource.WithAttributes(attribute.String("service.name", serviceName)))
+	if err != nil {
+		return noop, err
+	}
+
+	tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter), sdktrace.WithResource(res))
+	otel.SetTracerProvider(tp)
+	otel.SetTextMapPropagator(propagation.TraceContext{})
+
+	return func(shutdownCtx context.Context) error {
+		ctx, cancel := context.WithTimeout(shutdownCtx, 5*time.Second)
+		defer cancel()
+		return tp.Shutdown(ctx)
+	}, nil
+}
+
+const tracerName = "gorm"
+
+// gormPlugin wraps every GORM operation (query, create, update, delete, row,
+// raw) in a span — a hand-rolled GORM callback plugin instead of
+// gorm.io/plugin/opentelemetry: that module's go.mod pulls in every driver
+// it supports tracing for (MySQL, ClickHouse, MongoDB) plus their own
+// transitive trees (gRPC, QUIC, ...) as indirect requires, even though this
+// project only ever uses Postgres. GORM's callback API is small enough that
+// replicating just "start a span before, end it after, record the error if
+// any" isn't worth that weight.
+type gormPlugin struct{}
+
+// NewGormPlugin returns a gorm.Plugin — wire it in via db.Use(...).
+func NewGormPlugin() gorm.Plugin { return gormPlugin{} }
+
+func (gormPlugin) Name() string { return "otel-tracing" }
+
+// Initialize registers a before/after pair on each of GORM's six operation
+// callbacks (create/query/update/delete/row/raw) — spelled out individually,
+// not looped, because db.Callback().Create() etc. return GORM's unexported
+// *processor type: a package outside gorm can chain its methods but can't
+// name the type, so it can't be held in a slice/struct field to loop over.
+func (gormPlugin) Initialize(db *gorm.DB) error {
+	before := func(op string) func(*gorm.DB) {
+		return func(tx *gorm.DB) {
+			ctx, span := otel.Tracer(tracerName).Start(tx.Statement.Context, "gorm."+op)
+			span.SetAttributes(attribute.String("db.sql.table", tx.Statement.Table))
+			tx.Statement.Context = ctx
+		}
+	}
+	after := func(tx *gorm.DB) {
+		span := trace.SpanFromContext(tx.Statement.Context)
+		if tx.Error != nil {
+			span.RecordError(tx.Error)
+			span.SetStatus(codes.Error, tx.Error.Error())
+		}
+		span.End()
+	}
+
+	if err := db.Callback().Create().Before("gorm:create").Register("otel:before_create", before("create")); err != nil {
+		return err
+	}
+	if err := db.Callback().Create().After("gorm:create").Register("otel:after_create", after); err != nil {
+		return err
+	}
+	if err := db.Callback().Query().Before("gorm:query").Register("otel:before_query", before("query")); err != nil {
+		return err
+	}
+	if err := db.Callback().Query().After("gorm:query").Register("otel:after_query", after); err != nil {
+		return err
+	}
+	if err := db.Callback().Update().Before("gorm:update").Register("otel:before_update", before("update")); err != nil {
+		return err
+	}
+	if err := db.Callback().Update().After("gorm:update").Register("otel:after_update", after); err != nil {
+		return err
+	}
+	if err := db.Callback().Delete().Before("gorm:delete").Register("otel:before_delete", before("delete")); err != nil {
+		return err
+	}
+	if err := db.Callback().Delete().After("gorm:delete").Register("otel:after_delete", after); err != nil {
+		return err
+	}
+	if err := db.Callback().Row().Before("gorm:row").Register("otel:before_row", before("row")); err != nil {
+		return err
+	}
+	if err := db.Callback().Row().After("gorm:row").Register("otel:after_row", after); err != nil {
+		return err
+	}
+	if err := db.Callback().Raw().Before("gorm:raw").Register("otel:before_raw", before("raw")); err != nil {
+		return err
+	}
+	if err := db.Callback().Raw().After("gorm:raw").Register("otel:after_raw", after); err != nil {
+		return err
+	}
+	return nil
+}

package/templates/generate/module/handler.go.hbs

@@ -4,6 +4,9 @@ import (
 	"net/http"
 
 	"{{goModule}}/internal/shared/httpx"
+{{#if auth}}
+	"{{goModule}}/internal/shared/middleware"
+{{/if}}
 	"{{goModule}}/internal/shared/pagination"
 
 	"github.com/gin-gonic/gin"
@@ -12,15 +15,29 @@ import (
 // Handler = delivery for {{pkg}} (parses HTTP, calls the service, attaches errors for the middleware to render)
 type Handler struct {
 	svc *Service
+{{#if auth}}
+	jwtSecret string
+{{/if}}
+{{#if permission}}
+	authz *middleware.Authz
+{{/if}}
 }
 
-func NewHandler(svc *Service) *Handler {
-	return &Handler{svc: svc}
+func NewHandler(svc *Service{{#if auth}}, jwtSecret string{{/if}}{{#if permission}}, authz *middleware.Authz{{/if}}) *Handler {
+	return &Handler{
+		svc: svc,
+{{#if auth}}
+		jwtSecret: jwtSecret,
+{{/if}}
+{{#if permission}}
+		authz: authz,
+{{/if}}
+	}
 }
 
 // Register wires {{pkg}}'s routes onto the router group (takes an IRouter so it can be nested under /v1)
 func (h *Handler) Register(rg gin.IRouter) {
-	g := rg.Group("/{{plural}}")
+	g := rg.Group("/{{plural}}"{{#if auth}}, middleware.RequireAuth(h.jwtSecret){{/if}}{{#if permission}}, h.authz.Require("{{permission}}"){{/if}})
 	g.POST("", h.create)
 	g.GET("", h.list)
 	g.GET("/:id", h.get)