@nakedev/go-scaffold 0.1.4 → 0.3.1

package/dist/utils/platform-patcher.js

@@ -3,7 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.patchComposeForRedis = patchComposeForRedis;
+exports.patchCiForRedis = patchCiForRedis;
+exports.patchConfigForRedis = patchConfigForRedis;
 exports.patchConfigForWorker = patchConfigForWorker;
+exports.patchConfigForSMTP = patchConfigForSMTP;
 exports.patchMainGoForWorker = patchMainGoForWorker;
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const marker_patch_1 = require("./marker-patch");
@@ -13,25 +17,107 @@ const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
 const READYZ_MARKER = "// go-scaffold:readyz-checks";
 const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
-// patchConfigForWorker adds RedisURL + SMTP_* fields to Config and their
-// env() loads to Load() — via marker comments, the same text-insertion
-// approach as patchMainGo, since config.go.hbs is only rendered once (at
-// `create`) and everything after that is a real file a human may have
-// already edited.
-function patchConfigForWorker(configGoPath) {
+// patchComposeForRedis adds a redis service to docker-compose.yml. Whatever
+// pulls Redis in — `add worker --queue redis`, or `add auth`'s refresh-token
+// store on top of a Postgres queue — makes cmd/api call cache.Open and adds a
+// Redis ping to /readyz. Leaving compose Postgres-only meant the documented
+// path (`make docker-up` then `make run`) produced a permanent 503, which is
+// a rough first five minutes with a brand new project.
+//
+// No-op when the project was scaffolded with --no-docker.
+function patchComposeForRedis(composePath) {
+    if (!fs_extra_1.default.existsSync(composePath))
+        return;
+    const content = fs_extra_1.default.readFileSync(composePath, "utf8");
+    if (/^\s{2}redis:/m.test(content))
+        return;
+    const service = [
+        "  redis:",
+        "    image: redis:7-alpine",
+        "    ports:",
+        '      - "6379:6379"',
+    ].join("\n");
+    // before the top-level `volumes:` key, so redis stays inside `services:`
+    const out = content.includes("\nvolumes:")
+        ? content.replace("\nvolumes:", () => `\n${service}\n\nvolumes:`)
+        : content.replace(/\n?$/, "\n") + `\n${service}\n`;
+    fs_extra_1.default.writeFileSync(composePath, out);
+}
+// patchCiForRedis adds a redis service to .github/workflows/ci.yml, for the
+// same reason patchComposeForRedis exists: once cmd/api calls cache.Open, a
+// test that touches the token store has nothing to connect to on a runner
+// whose only service is Postgres. The generated workflow was written at
+// `create` time, before anything needed Redis, and nothing patched it after.
+//
+// No-op when the workflow was deleted or replaced by hand.
+function patchCiForRedis(ciPath) {
+    if (!fs_extra_1.default.existsSync(ciPath))
+        return;
+    const content = fs_extra_1.default.readFileSync(ciPath, "utf8");
+    if (/^\s{6}redis:/m.test(content))
+        return;
+    // `steps:` sits one level under the job, so it's the first line that ends
+    // the `services:` block — insert the service just above it.
+    const stepsLine = content.split("\n").find((l) => l.trimEnd() === "    steps:");
+    if (!stepsLine)
+        return;
+    const service = [
+        "      redis:",
+        "        image: redis:7-alpine",
+        "        ports:",
+        "          - 6379:6379",
+        "        options: >-",
+        '          --health-cmd "redis-cli ping"',
+        "          --health-interval 10s",
+        "          --health-timeout 5s",
+        "          --health-retries 5",
+        "",
+    ].join("\n");
+    fs_extra_1.default.writeFileSync(ciPath, content.replace(stepsLine, () => `${service}\n${stepsLine}`));
+}
+// patchConfigForRedis adds RedisURL to Config and its env() load to Load().
+// Split out from the worker patch because Redis is no longer the worker's
+// concern by default — `add auth` needs it for the refresh-token store even
+// when the queue lives in Postgres.
+function patchConfigForRedis(configGoPath) {
     let content = fs_extra_1.default.readFileSync(configGoPath, "utf8");
-    const fieldsBlock = ["RedisURL string", "", "SMTPHost string", "SMTPPort string", "SMTPUsername string", "SMTPPassword string", "SMTPFrom string"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "RedisURL string");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, "RedisURL string", "RedisURL");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, 'RedisURL: env("REDIS_URL", "redis://localhost:6379/0"),', 'env("REDIS_URL"');
+    fs_extra_1.default.writeFileSync(configGoPath, content);
+}
+// patchConfigForWorker adds the SMTP_* fields (and RedisURL, when Redis is
+// the queue's backing store) to Config and their env() loads to Load() — via
+// marker comments, the same text-insertion approach as patchMainGo, since
+// config.go.hbs is only rendered once (at `create`) and everything after
+// that is a real file a human may have already edited.
+function patchConfigForWorker(configGoPath, opts) {
+    if (opts.redis)
+        patchConfigForRedis(configGoPath);
+    patchConfigForSMTP(configGoPath);
+}
+// Sentinels here match a bare identifier, never `Name string` or
+// `Name: env(...)`: gofmt aligns struct fields and map values into columns, so
+// the moment one of these blocks lands the literal spacing a sentinel was
+// written with no longer exists in the file. A sentinel that misses means the
+// block gets inserted a second time and the project stops compiling on a
+// redeclared field — which is exactly what `add auth` then `add worker` did.
+//
+// patchConfigForSMTP is split out because `add auth` needs these fields even
+// when there is no worker: without a queue it sends mail synchronously, and it
+// still has to know where to send it. Idempotent, so whichever command gets
+// here first wins and the second is a no-op.
+function patchConfigForSMTP(configGoPath) {
+    let content = fs_extra_1.default.readFileSync(configGoPath, "utf8");
+    const fieldsBlock = ["SMTPHost string", "SMTPPort string", "SMTPUsername string", "SMTPPassword string", "SMTPFrom string"].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_FIELDS_MARKER, fieldsBlock, "SMTPHost");
     const loadBlock = [
-        'RedisURL: env("REDIS_URL", "redis://localhost:6379/0"),',
-        "",
         'SMTPHost:     env("SMTP_HOST", ""),',
         'SMTPPort:     env("SMTP_PORT", "587"),',
         'SMTPUsername: env("SMTP_USERNAME", ""),',
         'SMTPPassword: env("SMTP_PASSWORD", ""),',
         'SMTPFrom:     env("SMTP_FROM", "no-reply@example.local"),',
     ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'RedisURL: env("REDIS_URL"');
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, loadBlock, 'env("SMTP_HOST"');
     fs_extra_1.default.writeFileSync(configGoPath, content);
 }
 // patchMainGoForWorker wires Redis into cmd/api: opened alongside the DB, and
@@ -44,7 +130,7 @@ function patchMainGoForWorker(mainGoPath, goModule) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const cacheImport = `"${goModule}/internal/platform/cache"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, cacheImport, cacheImport);
-    const initBlock = ["rdb, err := cache.Open(cfg)", "if err != nil {", '\tlogger.Error("open redis", "error", err)', "\tos.Exit(1)", "}"].join("\n");
+    const initBlock = ["rdb, err := cache.Open(cfg)", "if err != nil {", '\treturn fmt.Errorf("open redis: %w", err)', "}"].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, initBlock, "rdb, err := cache.Open(cfg)");
     const readyzBlock = [
         "if err := rdb.Ping(c.Request.Context()).Err(); err != nil {",

package/dist/utils/rbac-patcher.js

@@ -13,12 +13,17 @@ exports.patchUserServiceTestForRbac = patchUserServiceTestForRbac;
 exports.patchUserDTOForRbac = patchUserDTOForRbac;
 exports.patchUserHandlerForRbac = patchUserHandlerForRbac;
 exports.patchUserErrorsForRbac = patchUserErrorsForRbac;
+exports.userSvcLineFor = userSvcLineFor;
+exports.assertRbacPatchable = assertRbacPatchable;
 exports.patchMainGoForRbac = patchMainGoForRbac;
 exports.patchCmdSeedForRbac = patchCmdSeedForRbac;
 const fs_extra_1 = __importDefault(require("fs-extra"));
+const auth_patcher_1 = require("./auth-patcher");
 const marker_patch_1 = require("./marker-patch");
 const IMPORT_MARKER = "// go-scaffold:imports";
+const SCHEMA_MARKER = "// go-scaffold:schemas";
 const MODEL_MARKER = "// go-scaffold:models";
+const ROUTE_MARKER = "// go-scaffold:routes";
 const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
 const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 // patchAuthDocsForRbac adds `role` to the hand-written MeResponse schema in
@@ -233,26 +238,71 @@ function patchUserErrorsForRbac(errorsGoPath) {
 // isn't enough — REPLACES the `add auth` PR's user.NewHandler(...) call with
 // a version that also builds roleSvc/authz and passes them through, plus
 // registers role's own routes right after it.
-function patchMainGoForRbac(mainGoPath, goModule) {
+// userSvcLineFor rebuilds the exact line `add auth` wrote, from the same
+// helper it used. Exported so the command can check for it *before* it starts
+// patching: every other file rbac touches is edited first, and until this
+// existed a mismatch here threw after user.NewService had already grown a
+// roleChecker parameter — leaving a project that no longer compiled and an
+// error telling you to restore a line that wouldn't have fixed it.
+function userSvcLineFor(goModule, store, worker) {
+    const { tokenStore, mailer } = (0, auth_patcher_1.authWiringLines)({ goModule, queueBackend: "river", store, worker });
+    return `userSvc := user.NewService(user.NewRepository(db), ${tokenStore}, ${mailer}, cfg)`;
+}
+function assertRbacPatchable(mainGoPath, goModule, store, worker) {
+    const expected = userSvcLineFor(goModule, store, worker);
+    if (fs_extra_1.default.readFileSync(mainGoPath, "utf8").includes(expected))
+        return;
+    throw new Error("cmd/api/wiring.go's userSvc line doesn't match what `add auth` wrote, so `add rbac` can't extend it.\n" +
+        `Expected to find:\n  ${expected}\n\n` +
+        "It was probably hand-edited. Restore that line and re-run — nothing has been changed yet.");
+}
+function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/role"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
     const modelImportLine = `rolemodel "${goModule}/internal/app/role/model"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
+    const schemaBlock = [
+        'if err := db.Exec("CREATE SCHEMA IF NOT EXISTS role_svc").Error; err != nil {',
+        '\treturn fmt.Errorf("create schema role_svc: %w", err)',
+        "}",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS role_svc");
     const migrateLines = ["&rolemodel.Role{},", "&rolemodel.Permission{},", "&rolemodel.RolePermission{},"];
     for (const line of migrateLines) {
         content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, line, line);
     }
-    const oldRouteLine = "user.NewHandler(user.NewService(user.NewRepository(db), user.NewRedisTokenStore(rdb), mail.NewAsyncClient(q), cfg), cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, rdb).Register(api)";
-    if (content.includes(oldRouteLine)) {
-        const newRouteBlock = [
-            "roleSvc := role.NewService(role.NewRepository(db))",
-            "authz := middleware.NewAuthz(roleSvc.PermissionsOf, cfg.AuthzCacheTTL)",
-            "user.NewHandler(user.NewService(user.NewRepository(db), user.NewRedisTokenStore(rdb), mail.NewAsyncClient(q), cfg, roleSvc), cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, rdb, authz).Register(api)",
-            "role.NewHandler(roleSvc, cfg.JWTSecret, authz).Register(api)",
-        ].join("\n");
-        content = content.replace(oldRouteLine, newRouteBlock);
+    // roleSvc and authz have to be declared *above* userSvc, which now takes
+    // roleSvc — so this rewrites the service line in place rather than
+    // appending at the marker (which would land below it).
+    // Rebuilt from the same helper `add auth` used, so a project on either store
+    // gets its own line matched rather than a hardcoded guess at one of them.
+    const { limiter } = (0, auth_patcher_1.authWiringLines)({ goModule, queueBackend: "river", store, worker });
+    const userSvcLine = userSvcLineFor(goModule, store, worker);
+    // Throw rather than skip: the roleSvc/authz declarations this rewrite adds
+    // are what the unconditional patches below refer to. Skipping quietly still
+    // emits `roleSvc`/`authz` references with nothing declaring them, so the
+    // command reports success over a main.go that doesn't compile.
+    if (!content.includes(userSvcLine)) {
+        throw new Error(`cmd/api/wiring.go's userSvc line doesn't match what \`add auth\` wrote, so \`add rbac\` can't extend it.\n` +
+            `Expected to find:\n  ${userSvcLine}\n\n` +
+            `It was probably hand-edited. Restore that line (add rbac will re-extend it), or apply the rbac wiring by hand:\n` +
+            `  roleSvc := role.NewService(role.NewRepository(db))\n` +
+            `  authz := middleware.NewAuthz(roleSvc.PermissionsOf, cfg.AuthzCacheTTL)\n` +
+            `  ...then pass roleSvc as user.NewService's last argument.`);
     }
+    content = content.replace(userSvcLine, [
+        "roleSvc := role.NewService(role.NewRepository(db))",
+        "authz := middleware.NewAuthz(roleSvc.PermissionsOf, cfg.AuthzCacheTTL)",
+        `${userSvcLine.slice(0, -1)}, roleSvc)`,
+    ].join("\n"));
+    const userRouteLine = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${limiter}).Register(api)`;
+    // strip the trailing `).Register(api)` — not just `.Register(api)` — so authz
+    // lands inside NewHandler's argument list rather than after its closing paren
+    const tail = ").Register(api)";
+    content = content.replace(userRouteLine, `${userRouteLine.slice(0, -tail.length)}, authz${tail}`);
+    const roleRouteLine = "role.NewHandler(roleSvc, cfg.JWTSecret, authz).Register(api)";
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, roleRouteLine, roleRouteLine);
     fs_extra_1.default.writeFileSync(mainGoPath, content);
 }
 // patchCmdSeedForRbac makes the seeded admin actually an admin: wires a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nakedev/go-scaffold",
-  "version": "0.1.4",
+  "version": "0.3.1",
   "description": "Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard",
   "repository": {
     "type": "git",
@@ -12,9 +12,7 @@
   "files": [
     "dist",
     "templates",
-    "bin",
-    "scripts",
-    "tests"
+    "bin"
   ],
   "type": "commonjs",
   "packageManager": "pnpm@11.0.7",
@@ -26,7 +24,7 @@
     "test:integration": "node --test tests/integration/*.test.mjs",
     "test:smoke": "node scripts/smoke-test.mjs",
     "verify": "pnpm run build && pnpm run test",
-    "prepack": "pnpm run build",
+    "prepack": "rm -rf dist && pnpm run build",
     "prepublishOnly": "pnpm run verify"
   },
   "keywords": [

package/templates/add/auth/internal/app/user/errors.go.hbs

@@ -21,6 +21,13 @@ func errEmailTaken() *apperror.AppError {
 // errInvalidCredentials is returned for both "no such user" and "wrong
 // password" — a single generic message so a login attempt can't be used to
 // enumerate which emails have accounts.
+// errTooManyAttempts is the account-level lockout, distinct from the per-IP
+// RATE_LIMITED the middleware returns: this one follows the account wherever
+// the attempts come from.
+func errTooManyAttempts() *apperror.AppError {
+	return apperror.New(http.StatusTooManyRequests, "AUTH_TOO_MANY_ATTEMPTS", "too many failed attempts — try again later")
+}
+
 func errInvalidCredentials() *apperror.AppError {
 	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_CREDENTIALS", "invalid email or password")
 }

package/templates/add/auth/internal/app/user/handler.go.hbs

@@ -2,6 +2,7 @@ package user
 
 import (
 	"net/http"
+	"strings"
 	"time"
 
 	"{{goModule}}/internal/shared/httpx"
@@ -10,19 +11,26 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
-	"github.com/redis/go-redis/v9"
 )
 
-const refreshCookieName = "refresh_token"
+const (
+	refreshCookieName = "refresh_token"
+	// oauthStateCookieName holds the nonce that binds a Google login to the
+	// browser that started it — see Service.GoogleLoginURL.
+	oauthStateCookieName = "oauth_state"
+)
 
 // go-scaffold:user-handler-consts
 
 type Handler struct {
-	svc          *Service
-	jwtSecret    string
-	refreshTTL   time.Duration
-	cookieSecure bool
-	rdb          *redis.Client
+	svc            *Service
+	jwtSecret      string
+	refreshTTL     time.Duration
+	cookieSecure   bool
+	cookieSameSite string
+	// limiter, not a *redis.Client: which backing store counts the requests is
+	// decided by `add auth --store`, and this file must not care.
+	limiter middleware.Limiter
 	// go-scaffold:user-handler-fields
 }
 
@@ -31,15 +39,17 @@ func NewHandler(
 	jwtSecret string,
 	refreshTTL time.Duration,
 	cookieSecure bool,
-	rdb *redis.Client,
+	cookieSameSite string,
+	limiter middleware.Limiter,
 	// go-scaffold:user-handler-params
 ) *Handler {
 	return &Handler{
-		svc:          svc,
-		jwtSecret:    jwtSecret,
-		refreshTTL:   refreshTTL,
-		cookieSecure: cookieSecure,
-		rdb:          rdb,
+		svc:            svc,
+		jwtSecret:      jwtSecret,
+		refreshTTL:     refreshTTL,
+		cookieSecure:   cookieSecure,
+		cookieSameSite: cookieSameSite,
+		limiter:        limiter,
 		// go-scaffold:user-handler-init
 	}
 }
@@ -52,12 +62,12 @@ func (h *Handler) Register(rg gin.IRouter) {
 	// doesn't spend another's budget. refresh/logout/google aren't limited:
 	// refresh/logout are gated by possessing a valid cookie already, and the
 	// Google flow's abuse surface lives on Google's side, not ours.
-	loginLimit := middleware.RateLimit(h.rdb, "login", 10, time.Minute)
-	registerLimit := middleware.RateLimit(h.rdb, "register", 5, time.Minute)
-	forgotPasswordLimit := middleware.RateLimit(h.rdb, "forgot-password", 5, time.Minute)
-	resetPasswordLimit := middleware.RateLimit(h.rdb, "reset-password", 10, time.Minute)
-	verifyEmailLimit := middleware.RateLimit(h.rdb, "verify-email", 10, time.Minute)
-	resendVerificationLimit := middleware.RateLimit(h.rdb, "resend-verification", 5, time.Minute)
+	loginLimit := middleware.RateLimit(h.limiter, "login", 10, time.Minute)
+	registerLimit := middleware.RateLimit(h.limiter, "register", 5, time.Minute)
+	forgotPasswordLimit := middleware.RateLimit(h.limiter, "forgot-password", 5, time.Minute)
+	resetPasswordLimit := middleware.RateLimit(h.limiter, "reset-password", 10, time.Minute)
+	verifyEmailLimit := middleware.RateLimit(h.limiter, "verify-email", 10, time.Minute)
+	resendVerificationLimit := middleware.RateLimit(h.limiter, "resend-verification", 5, time.Minute)
 
 	authGroup := rg.Group("/auth")
 	authGroup.POST("/register", registerLimit, h.register)
@@ -194,16 +204,26 @@ func (h *Handler) logoutAll(c *gin.Context) {
 }
 
 func (h *Handler) googleLogin(c *gin.Context) {
-	url, err := h.svc.GoogleLoginURL()
+	url, nonce, err := h.svc.GoogleLoginURL()
 	if err != nil {
 		c.Error(err)
 		return
 	}
+	// Lax, not Strict, and deliberately not h.cookieSameSite: the callback
+	// arrives as a top-level navigation from Google, i.e. cross-site, and a
+	// Strict cookie is not sent on one — the flow would fail every time.
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oauthStateCookieName, nonce, int(oauthStateTTL.Seconds()), "/", "", h.cookieSecure, true)
 	c.Redirect(http.StatusFound, url)
 }
 
 func (h *Handler) googleCallback(c *gin.Context) {
-	auth, err := h.svc.GoogleCallback(c.Request.Context(), c.Query("code"), c.Query("state"))
+	nonce, _ := c.Cookie(oauthStateCookieName)
+	// One shot, whatever happens next.
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oauthStateCookieName, "", -1, "/", "", h.cookieSecure, true)
+
+	auth, err := h.svc.GoogleCallback(c.Request.Context(), c.Query("code"), c.Query("state"), nonce)
 	if err != nil {
 		c.Error(err)
 		return
@@ -225,11 +245,32 @@ func (h *Handler) me(c *gin.Context) {
 // go-scaffold:user-handler-funcs
 
 func (h *Handler) setRefreshCookie(c *gin.Context, token string) {
-	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
 	c.SetCookie(refreshCookieName, token, int(h.refreshTTL.Seconds()), "/", "", h.cookieSecure, true)
 }
 
 func (h *Handler) clearRefreshCookie(c *gin.Context) {
-	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
 	c.SetCookie(refreshCookieName, "", -1, "/", "", h.cookieSecure, true)
 }
+
+// sameSiteFrom maps COOKIE_SAMESITE onto the http constant, defaulting to the
+// strictest option for anything it doesn't recognise.
+//
+// "strict" is right while the frontend and this API are the same site
+// (localhost:3000 -> localhost:8080 is, and so is app.example.com ->
+// api.example.com). A frontend on a genuinely different site — the usual
+// vercel.app-plus-own-API-domain split — needs "none", because the browser
+// will not attach a Strict or Lax cookie to the fetch that calls
+// /auth/refresh: sessions then die at every access-token expiry with no
+// error anywhere to explain it. "none" requires COOKIE_SECURE=true.
+func sameSiteFrom(mode string) http.SameSite {
+	switch strings.ToLower(mode) {
+	case "none":
+		return http.SameSiteNoneMode
+	case "lax":
+		return http.SameSiteLaxMode
+	default:
+		return http.SameSiteStrictMode
+	}
+}

package/templates/add/auth/internal/app/user/jwt.go.hbs

@@ -3,6 +3,7 @@ package user
 import (
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/hex"
 	"time"
 
@@ -22,6 +23,8 @@ const (
 // presented where the other is expected.
 type accessClaims struct {
 	Typ string `json:"typ"`
+	// Nonce is only set on the OAuth state token — see issueOAuthState.
+	Nonce string `json:"nonce,omitempty"`
 	// go-scaffold:jwt-claims
 	jwt.RegisteredClaims
 }
@@ -42,21 +45,37 @@ func (s *Service) issueAccessToken(
 	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
 }
 
-// issueOAuthState / verifyOAuthState round-trip a short-lived, stateless CSRF
-// token through Google's own redirect — no server-side row needed, the JWT's
-// signature + short TTL is the whole protection.
-func (s *Service) issueOAuthState() (string, error) {
+// issueOAuthState / verifyOAuthState round-trip a short-lived CSRF token
+// through Google's own redirect. The signature and TTL are not the whole
+// protection: a signed-but-unbound state is one anyone can fetch from
+// GET /auth/google/login and then replay in a victim's browser, which is
+// exactly the login-CSRF the state parameter exists to stop. So the token
+// carries a nonce that the handler also drops in a short-lived httpOnly
+// cookie, and the callback only proceeds when the two agree — the state is
+// then usable in one browser only, the one that started the flow.
+//
+// Returns the state and the nonce to put in that cookie.
+func (s *Service) issueOAuthState() (string, string, error) {
+	nonce, err := randomToken()
+	if err != nil {
+		return "", "", err
+	}
 	claims := accessClaims{
-		Typ: tokenTypeOAuthState,
+		Typ:   tokenTypeOAuthState,
+		Nonce: nonce,
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(oauthStateTTL)),
 		},
 	}
-	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
+	state, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
+	if err != nil {
+		return "", "", err
+	}
+	return state, nonce, nil
 }
 
-func (s *Service) verifyOAuthState(raw string) error {
+func (s *Service) verifyOAuthState(raw, nonce string) error {
 	var claims accessClaims
 	_, err := jwt.ParseWithClaims(raw, &claims, func(*jwt.Token) (any, error) {
 		return []byte(s.jwtSecret), nil
@@ -64,6 +83,11 @@ func (s *Service) verifyOAuthState(raw string) error {
 	if err != nil || claims.Typ != tokenTypeOAuthState {
 		return errInvalidToken()
 	}
+	// A missing cookie is a mismatch, not a pass — otherwise stripping the
+	// cookie is all it takes to get the old, unbound behavior back.
+	if nonce == "" || subtle.ConstantTimeCompare([]byte(claims.Nonce), []byte(nonce)) != 1 {
+		return errInvalidToken()
+	}
 	return nil
 }
 

package/templates/add/auth/internal/app/user/model/authtoken.go.hbs

@@ -0,0 +1,39 @@
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// AuthToken is one short-lived token — the Postgres equivalent of the keys the
+// Redis store would hold. Only the SHA-256 hash of the raw token is stored, so
+// a database dump never yields a usable token.
+//
+// `Kind` mirrors the Redis key prefixes one-for-one, deliberately:
+//
+//	refresh       an active refresh token
+//	refresh_used  a tombstone left by rotation, so replaying a rotated-out
+//	              token is detectable as reuse rather than merely unknown
+//	pwreset       password reset, consumed once
+//	emailverify   email verification, consumed once
+//
+// Keeping the tombstone a separate row (rather than a used_at column on the
+// refresh row) is what preserves logout's semantics: logout deletes the row
+// outright and leaves no tombstone, so someone replaying a logged-out token
+// gets a plain rejection instead of tripping reuse detection and nuking every
+// session the user has.
+//
+// No foreign key to users on purpose: GORM's AutoMigrate (dev) wouldn't create
+// one from these tags, and a constraint that exists in production but not in
+// development is the exact mismatch that stops the app booting. A token whose
+// user is gone simply fails the lookup that follows.
+type AuthToken struct {
+	TokenHash string    `gorm:"primaryKey;type:text"`
+	UserID    uuid.UUID `gorm:"type:uuid;not null;index:idx_auth_tokens_user_kind,priority:1"`
+	Kind      string    `gorm:"type:varchar(20);not null;index:idx_auth_tokens_user_kind,priority:2"`
+	ExpiresAt time.Time `gorm:"not null;index:idx_auth_tokens_expires_at"`
+	CreatedAt time.Time
+}
+
+func (AuthToken) TableName() string { return "user_svc.auth_tokens" }

package/templates/add/auth/internal/app/user/model/identity.go.hbs

@@ -26,3 +26,6 @@ type Identity struct {
 	CreatedAt    time.Time `json:"created_at"`
 	UpdatedAt    time.Time `json:"updated_at"`
 }
+
+// TableName — see User.TableName; same schema, same reasoning.
+func (Identity) TableName() string { return "user_svc.identities" }

package/templates/add/auth/internal/app/user/model/loginthrottle.go.hbs

@@ -0,0 +1,26 @@
+package model
+
+import "time"
+
+// LoginThrottle is the failed-attempt counter that makes lockout survive a
+// deploy and mean the same thing on every replica. It is not the rate limiter
+// — that one counts requests per IP and is allowed to be approximate. This
+// counts failures per account, and per OWASP that is the control that actually
+// stops credential stuffing: an attacker with a proxy pool keeps per-IP volume
+// under any threshold you set, but they cannot spread attempts against one
+// account across accounts.
+//
+// EmailHash, not the address: the counter has to be keyed on what the caller
+// typed whether or not an account exists — otherwise "did this get throttled"
+// answers "does this account exist" — and hashing means this table never
+// becomes a directory of who has signed up.
+type LoginThrottle struct {
+	EmailHash string `gorm:"primaryKey;type:text"`
+	Failures  int    `gorm:"not null;default:0"`
+	// nil until the free attempts are spent; afterwards it moves further out
+	// with each failure.
+	LockedUntil *time.Time
+	UpdatedAt   time.Time
+}
+
+func (LoginThrottle) TableName() string { return "user_svc.login_throttle" }

package/templates/add/auth/internal/app/user/model/user.go.hbs

@@ -12,7 +12,10 @@ import (
 // resolving to one account.
 type User struct {
 	ID            uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
-	Email         string    `json:"email" gorm:"uniqueIndex;not null"`
+	// index named explicitly, and named the same in create_users.up.sql: an
+	// anonymous `uniqueIndex` makes GORM invent one, and AutoMigrate then
+	// tries to DROP the differently-named constraint the migration created.
+	Email         string    `json:"email" gorm:"uniqueIndex:idx_users_email;not null"`
 	Name          string    `json:"name"`
 	AvatarURL     string    `json:"avatar_url"`
 	EmailVerified bool      `json:"email_verified"`
@@ -20,3 +23,8 @@ type User struct {
 	CreatedAt time.Time `json:"created_at"`
 	UpdatedAt time.Time `json:"updated_at"`
 }
+
+// TableName pins this to user_svc rather than GORM's default inflection
+// ("users", schema-less) — every domain gets its own schema, see
+// docs/architect/patterns.md.
+func (User) TableName() string { return "user_svc.users" }