@nakedev/go-scaffold 0.1.4 → 0.3.1

package/templates/add/auth/internal/app/user/tokenstore.go.hbs

@@ -5,19 +5,17 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/redis/go-redis/v9"
 )
 
-const (
-	refreshKeyPrefix     = "user:refresh:"      // +hash -> userID, TTL = refreshTTL
-	refreshUserKeyPrefix = "user:refresh:user:"  // +userID -> SET of active token hashes
-	refreshUsedKeyPrefix = "user:refresh:used:"  // +hash -> userID, TTL = refreshTTL (reuse-detection tombstone)
-	pwresetKeyPrefix     = "user:pwreset:"       // +hash -> userID, TTL = resetTTL, GETDEL on consume
-	emailVerifyKeyPrefix = "user:emailverify:"   // +hash -> userID, TTL = emailVerifyTTL, GETDEL on consume
-)
-
-// tokenStore is what Service needs from Redis for refresh tokens — declared
-// consumer-side so it can be faked in tests without a real Redis.
+// tokenStore is the short-lived-token surface Service needs — declared
+// consumer-side so it can be faked in tests, and so the backing store is a
+// choice rather than a hard dependency. Two implementations ship with the
+// scaffold and exactly one is written into a project:
+//
+//   `add auth --store postgres`  ->  tokenstore_pg.go     (default, no extra service)
+//   `add auth --store redis`     ->  tokenstore_redis.go  (exact across pods)
+//
+// Service never learns which one it got.
 type tokenStore interface {
 	SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
 	GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
@@ -30,130 +28,3 @@ type tokenStore interface {
 	SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
 	ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
 }
-
-type redisTokenStore struct {
-	rdb *redis.Client
-}
-
-func NewRedisTokenStore(rdb *redis.Client) *redisTokenStore {
-	return &redisTokenStore{rdb: rdb}
-}
-
-func (s *redisTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	pipe := s.rdb.TxPipeline()
-	pipe.Set(ctx, refreshKeyPrefix+tokenHash, userID.String(), ttl)
-	pipe.SAdd(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
-	_, err := pipe.Exec(ctx)
-	return err
-}
-
-func (s *redisTokenStore) GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.Get(ctx, refreshKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID) error {
-	pipe := s.rdb.TxPipeline()
-	pipe.Del(ctx, refreshKeyPrefix+tokenHash)
-	pipe.SRem(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
-	_, err := pipe.Exec(ctx)
-	return err
-}
-
-// RevokeAllRefreshTokens walks the per-user session set and deletes every
-// active refresh token for that user — used when reuse of an already-rotated
-// token is detected (see Service.Refresh): that means the raw token leaked,
-// so every session, not just the replayed one, is treated as compromised.
-//
-// ponytail: the per-user set has no per-member TTL cleanup of its own — a
-// member outlives its key's TTL as a stale entry until the next revoke or
-// rotation touches it. Self-heals over time; revisit if a single user's
-// session count grows large enough to matter.
-func (s *redisTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
-	setKey := refreshUserKeyPrefix + userID.String()
-	hashes, err := s.rdb.SMembers(ctx, setKey).Result()
-	if err != nil {
-		return err
-	}
-	if len(hashes) == 0 {
-		return nil
-	}
-	pipe := s.rdb.TxPipeline()
-	for _, h := range hashes {
-		pipe.Del(ctx, refreshKeyPrefix+h)
-	}
-	pipe.Del(ctx, setKey)
-	_, err = pipe.Exec(ctx)
-	return err
-}
-
-func (s *redisTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, refreshUsedKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-func (s *redisTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.Get(ctx, refreshUsedKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, pwresetKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-// ConsumePasswordResetToken is one-time-use by construction: GETDEL is
-// atomic, so a token can't be raced into being consumed twice.
-func (s *redisTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, pwresetKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, emailVerifyKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-// ConsumeEmailVerifyToken is one-time-use by construction, same as
-// ConsumePasswordResetToken — GETDEL is atomic.
-func (s *redisTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, emailVerifyKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}

package/templates/add/auth/internal/app/user/tokenstore_pg.go.hbs

@@ -0,0 +1,144 @@
+// Postgres-backed tokenStore — installed by `add auth --store postgres` (the
+// default). The Redis-backed alternative lives in tokenstore_redis.go; only
+// one of the two is ever written into a project.
+//
+// Everything Redis needed two keys for collapses into one table here: the
+// per-user session set is just a WHERE clause, and expiry is a column every
+// read filters on rather than a TTL the store enforces. What that costs is a
+// sweep to keep the table from growing — see DeleteExpired.
+package user
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"time"
+
+	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/shared/tx"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+const (
+	kindRefresh     = "refresh"
+	kindRefreshUsed = "refresh_used"
+	kindPasswordSet = "pwreset"
+	kindEmailVerify = "emailverify"
+)
+
+type pgTokenStore struct {
+	db *gorm.DB
+}
+
+func NewPgTokenStore(db *gorm.DB) *pgTokenStore { return &pgTokenStore{db: db} }
+
+// put writes a token row, replacing any row that already carries the same
+// hash — a collision is astronomically unlikely, but "upsert" is the right
+// semantic for "this hash now means this" either way.
+func (s *pgTokenStore) put(ctx context.Context, hash, kind string, userID uuid.UUID, ttl time.Duration) error {
+	row := model.AuthToken{TokenHash: hash, UserID: userID, Kind: kind, ExpiresAt: time.Now().Add(ttl)}
+	return tx.From(ctx, s.db).WithContext(ctx).
+		Where("token_hash = ?", hash).
+		Assign(map[string]any{"user_id": userID, "kind": kind, "expires_at": row.ExpiresAt}).
+		FirstOrCreate(&row).Error
+}
+
+// lookup finds a live token of the given kind. Expiry is enforced here rather
+// than by a sweep, so a row that outlived its TTL is already invisible.
+func (s *pgTokenStore) lookup(ctx context.Context, hash, kind string) (uuid.UUID, bool, error) {
+	var row model.AuthToken
+	err := tx.From(ctx, s.db).WithContext(ctx).
+		Where("token_hash = ? AND kind = ? AND expires_at > now()", hash, kind).
+		Take(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return row.UserID, true, nil
+}
+
+// consume deletes and returns in one statement, which is what makes a
+// one-time token actually one-time: two requests racing on the same token
+// cannot both come away with a user id.
+func (s *pgTokenStore) consume(ctx context.Context, hash, kind string) (uuid.UUID, bool, error) {
+	var userID uuid.UUID
+	err := tx.From(ctx, s.db).WithContext(ctx).Raw(
+		`DELETE FROM user_svc.auth_tokens
+		 WHERE token_hash = ? AND kind = ? AND expires_at > now()
+		 RETURNING user_id`, hash, kind).Row().Scan(&userID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return userID, true, nil
+}
+
+func (s *pgTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.put(ctx, tokenHash, kindRefresh, userID, ttl)
+}
+
+func (s *pgTokenStore) GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	return s.lookup(ctx, tokenHash, kindRefresh)
+}
+
+// DeleteRefreshToken removes the row outright and leaves nothing behind — see
+// the AuthToken doc comment for why logout must not leave a tombstone.
+func (s *pgTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, _ uuid.UUID) error {
+	return tx.From(ctx, s.db).WithContext(ctx).
+		Where("token_hash = ? AND kind = ?", tokenHash, kindRefresh).
+		Delete(&model.AuthToken{}).Error
+}
+
+// RevokeAllRefreshTokens is one statement here because Postgres can query by
+// value — the Redis store has to keep a separate per-user set to answer this,
+// and that set accumulates stale members its own comment calls out.
+// Tombstones are left in place so reuse detection still works afterwards.
+func (s *pgTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
+	return tx.From(ctx, s.db).WithContext(ctx).
+		Where("user_id = ? AND kind = ?", userID, kindRefresh).
+		Delete(&model.AuthToken{}).Error
+}
+
+func (s *pgTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.put(ctx, tokenHash, kindRefreshUsed, userID, ttl)
+}
+
+func (s *pgTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	return s.lookup(ctx, tokenHash, kindRefreshUsed)
+}
+
+func (s *pgTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.put(ctx, tokenHash, kindPasswordSet, userID, ttl)
+}
+
+func (s *pgTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	return s.consume(ctx, tokenHash, kindPasswordSet)
+}
+
+func (s *pgTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.put(ctx, tokenHash, kindEmailVerify, userID, ttl)
+}
+
+func (s *pgTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	return s.consume(ctx, tokenHash, kindEmailVerify)
+}
+
+// DeleteExpired drops rows nothing can use any more. Correctness never depends
+// on it — every read already filters on expires_at — so it is purely about
+// table size, and calling it on a timer from cmd/worker (or a cron) is enough.
+//
+// ponytail: not scheduled for you. Wire it up the day the table is big enough
+// to notice; a scaffold that silently runs background sweeps nobody asked for
+// is harder to reason about than one line you add when it matters.
+func (s *pgTokenStore) DeleteExpired(ctx context.Context) (int64, error) {
+	res := tx.From(ctx, s.db).WithContext(ctx).
+		Where("expires_at <= now()").
+		Delete(&model.AuthToken{})
+	return res.RowsAffected, res.Error
+}

package/templates/add/auth/internal/app/user/tokenstore_redis.go.hbs

@@ -0,0 +1,147 @@
+// Redis-backed tokenStore — installed by `add auth --store redis`.
+// The Postgres-backed alternative lives in tokenstore_pg.go; only one of the
+// two is ever written into a project, and Service never learns which.
+package user
+
+import (
+	"context"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/redis/go-redis/v9"
+)
+
+const (
+	refreshKeyPrefix     = "user:refresh:"      // +hash -> userID, TTL = refreshTTL
+	refreshUserKeyPrefix = "user:refresh:user:" // +userID -> SET of active token hashes
+	refreshUsedKeyPrefix = "user:refresh:used:" // +hash -> userID, TTL = refreshTTL, reuse-detection tombstone
+	pwresetKeyPrefix     = "user:pwreset:"      // +hash -> userID, TTL = resetTTL, GETDEL on consume
+	emailVerifyKeyPrefix = "user:emailverify:"  // +hash -> userID, TTL = emailVerifyTTL, GETDEL on consume
+)
+
+type redisTokenStore struct {
+	rdb *redis.Client
+}
+
+func NewRedisTokenStore(rdb *redis.Client) *redisTokenStore {
+	return &redisTokenStore{rdb: rdb}
+}
+
+func (s *redisTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	pipe := s.rdb.TxPipeline()
+	pipe.Set(ctx, refreshKeyPrefix+tokenHash, userID.String(), ttl)
+	pipe.SAdd(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
+	_, err := pipe.Exec(ctx)
+	return err
+}
+
+func (s *redisTokenStore) GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	raw, err := s.rdb.Get(ctx, refreshKeyPrefix+tokenHash).Result()
+	if err == redis.Nil {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	id, err := uuid.Parse(raw)
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return id, true, nil
+}
+
+func (s *redisTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID) error {
+	pipe := s.rdb.TxPipeline()
+	pipe.Del(ctx, refreshKeyPrefix+tokenHash)
+	pipe.SRem(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
+	_, err := pipe.Exec(ctx)
+	return err
+}
+
+// RevokeAllRefreshTokens walks the per-user session set and deletes every
+// active refresh token for that user — used when reuse of an already-rotated
+// token is detected (see Service.Refresh): that means the raw token leaked,
+// so every session, not just the replayed one, is treated as compromised.
+//
+// ponytail: the per-user set has no per-member TTL cleanup of its own — a
+// member outlives its key's TTL as a stale entry until the next revoke or
+// rotation touches it. Self-heals over time; revisit if a single user's
+// session count grows large enough to matter.
+func (s *redisTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
+	setKey := refreshUserKeyPrefix + userID.String()
+	hashes, err := s.rdb.SMembers(ctx, setKey).Result()
+	if err != nil {
+		return err
+	}
+	if len(hashes) == 0 {
+		return nil
+	}
+	pipe := s.rdb.TxPipeline()
+	for _, h := range hashes {
+		pipe.Del(ctx, refreshKeyPrefix+h)
+	}
+	pipe.Del(ctx, setKey)
+	_, err = pipe.Exec(ctx)
+	return err
+}
+
+func (s *redisTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.rdb.Set(ctx, refreshUsedKeyPrefix+tokenHash, userID.String(), ttl).Err()
+}
+
+func (s *redisTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	raw, err := s.rdb.Get(ctx, refreshUsedKeyPrefix+tokenHash).Result()
+	if err == redis.Nil {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	id, err := uuid.Parse(raw)
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return id, true, nil
+}
+
+func (s *redisTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.rdb.Set(ctx, pwresetKeyPrefix+tokenHash, userID.String(), ttl).Err()
+}
+
+// ConsumePasswordResetToken is one-time-use by construction: GETDEL is
+// atomic, so a token can't be raced into being consumed twice.
+func (s *redisTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	raw, err := s.rdb.GetDel(ctx, pwresetKeyPrefix+tokenHash).Result()
+	if err == redis.Nil {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	id, err := uuid.Parse(raw)
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return id, true, nil
+}
+
+func (s *redisTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.rdb.Set(ctx, emailVerifyKeyPrefix+tokenHash, userID.String(), ttl).Err()
+}
+
+// ConsumeEmailVerifyToken is one-time-use by construction, same as
+// ConsumePasswordResetToken — GETDEL is atomic.
+func (s *redisTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	raw, err := s.rdb.GetDel(ctx, emailVerifyKeyPrefix+tokenHash).Result()
+	if err == redis.Nil {
+		return uuid.Nil, false, nil
+	}
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	id, err := uuid.Parse(raw)
+	if err != nil {
+		return uuid.Nil, false, err
+	}
+	return id, true, nil
+}

package/templates/add/auth/internal/shared/middleware/ratelimit.go.hbs

@@ -1,40 +1,42 @@
 package middleware
 
 import (
+	"context"
 	"net/http"
 	"time"
 
 	"{{goModule}}/internal/shared/apperror"
 
 	"github.com/gin-gonic/gin"
-	"github.com/redis/go-redis/v9"
 )
 
+// Limiter counts requests per key within a window. Two implementations ship
+// with the scaffold and which one a project gets follows `add auth --store`:
+// in-memory alongside the Postgres token store, Redis alongside the Redis one.
+// They are paired on purpose — "exact across pods" is one decision, not two.
+type Limiter interface {
+	// Allow records one hit for key and reports whether it stayed within
+	// limit. An implementation that cannot reach its backing store should
+	// return true: a limiter outage must not take login down with it.
+	Allow(ctx context.Context, key string, limit int, window time.Duration) bool
+}
+
 // RateLimit throttles requests per client IP to `limit` within `window`,
 // keyed by `name` (a per-route label so /auth/login and /auth/register don't
-// share a budget) — a fixed-window counter via Redis INCR+EXPIRE.
+// share a budget) — a fixed-window counter.
 //
 // ponytail: fixed-window, not sliding — simple and correct, the tradeoff is
 // a client can burst up to ~2x limit right at a window boundary (limit
 // requests just before it resets, then limit more right after). Good enough
-// for throttling credential-stuffing/spam, not a hard quota; move to a
-// sliding-window log if that boundary burst ever actually matters.
-func RateLimit(rdb *redis.Client, name string, limit int, window time.Duration) gin.HandlerFunc {
+// for throttling spam, not a hard quota; move to a sliding-window log if that
+// boundary burst ever actually matters.
+//
+// This is the coarse layer. It keys on c.ClientIP(), which a distributed
+// attacker simply spreads across — the control that actually stops credential
+// stuffing is the per-account lockout in the user service, not this.
+func RateLimit(l Limiter, name string, limit int, window time.Duration) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		key := "ratelimit:" + name + ":" + c.ClientIP()
-		ctx := c.Request.Context()
-
-		count, err := rdb.Incr(ctx, key).Result()
-		if err != nil {
-			// fail open: a Redis blip shouldn't take down login/register
-			// entirely — the endpoint's own logic is still the real guard.
-			c.Next()
-			return
-		}
-		if count == 1 {
-			rdb.Expire(ctx, key, window)
-		}
-		if count > int64(limit) {
+		if !l.Allow(c.Request.Context(), name+":"+c.ClientIP(), limit, window) {
 			c.Error(apperror.New(http.StatusTooManyRequests, "RATE_LIMITED", "too many requests, try again later"))
 			c.Abort()
 			return

package/templates/add/auth/internal/shared/middleware/ratelimit_memory.go.hbs

@@ -0,0 +1,63 @@
+package middleware
+
+import (
+	"context"
+	"sync"
+	"time"
+)
+
+// MemoryLimiter keeps the counters in this process. It is the limiter that
+// ships alongside the Postgres token store, so a project can run auth with no
+// service beyond its own database.
+//
+// ponytail: per-process budget. Behind N replicas a client effectively gets
+// N x limit, because nothing is shared. That is a deliberate trade: this layer
+// only damps casual abuse, and the control that has to be exact — failed-login
+// lockout — lives in Postgres where every replica sees the same counter.
+// Switch to `add auth --store redis` if you need this layer exact too.
+//
+// Deliberately a fixed-window counter written by hand rather than
+// golang.org/x/time/rate: the Redis limiter is a fixed window, and keeping the
+// two identical means changing --store never changes what a client observes.
+// A token bucket would have been fewer lines and different behaviour.
+type MemoryLimiter struct {
+	mu        sync.Mutex
+	windows   map[string]*rateWindow
+	lastSweep time.Time
+}
+
+type rateWindow struct {
+	count   int
+	resetAt time.Time
+}
+
+func NewMemoryLimiter() *MemoryLimiter {
+	return &MemoryLimiter{windows: map[string]*rateWindow{}, lastSweep: time.Now()}
+}
+
+func (m *MemoryLimiter) Allow(_ context.Context, key string, limit int, window time.Duration) bool {
+	now := time.Now()
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// Sweep at most once per window: every entry is dead within one window of
+	// its last use, so this is enough to stop the map growing with every
+	// distinct client IP, without paying an O(n) walk on each request.
+	if now.Sub(m.lastSweep) > window {
+		for k, w := range m.windows {
+			if now.After(w.resetAt) {
+				delete(m.windows, k)
+			}
+		}
+		m.lastSweep = now
+	}
+
+	w, ok := m.windows[key]
+	if !ok || now.After(w.resetAt) {
+		m.windows[key] = &rateWindow{count: 1, resetAt: now.Add(window)}
+		return true
+	}
+	w.count++
+	return w.count <= limit
+}

package/templates/add/auth/internal/shared/middleware/ratelimit_redis.go.hbs

@@ -0,0 +1,32 @@
+package middleware
+
+import (
+	"context"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+// RedisLimiter shares one counter across every replica, so `limit` means the
+// same thing whether you run one pod or ten. It ships alongside the Redis
+// token store (`add auth --store redis`).
+type RedisLimiter struct {
+	rdb *redis.Client
+}
+
+func NewRedisLimiter(rdb *redis.Client) *RedisLimiter { return &RedisLimiter{rdb: rdb} }
+
+func (r *RedisLimiter) Allow(ctx context.Context, key string, limit int, window time.Duration) bool {
+	redisKey := "ratelimit:" + key
+
+	count, err := r.rdb.Incr(ctx, redisKey).Result()
+	if err != nil {
+		// fail open: a Redis blip shouldn't take down login/register entirely
+		// — the endpoint's own logic is still the real guard.
+		return true
+	}
+	if count == 1 {
+		r.rdb.Expire(ctx, redisKey, window)
+	}
+	return count <= int64(limit)
+}

package/templates/add/auth/migrations/create_auth_tokens.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.auth_tokens;

package/templates/add/auth/migrations/create_auth_tokens.up.sql.hbs

@@ -0,0 +1,16 @@
+-- Short-lived auth tokens, for projects scaffolded with `--store postgres`.
+-- Only the SHA-256 hash is stored; see model/authtoken.go for what `kind`
+-- means and why the rotation tombstone is a separate row.
+CREATE TABLE user_svc.auth_tokens (
+    token_hash TEXT PRIMARY KEY,
+    user_id    UUID NOT NULL,
+    kind       VARCHAR(20) NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Named to match model.AuthToken's own `index:` tags exactly — GORM's
+-- AutoMigrate (dev) reconciles against these names, and an index the
+-- migration named differently is what stops the app booting.
+CREATE INDEX idx_auth_tokens_user_kind ON user_svc.auth_tokens (user_id, kind);
+CREATE INDEX idx_auth_tokens_expires_at ON user_svc.auth_tokens (expires_at);

package/templates/add/auth/migrations/create_identities.down.sql.hbs

@@ -1 +1 @@
-DROP TABLE IF EXISTS identities;
+DROP TABLE IF EXISTS user_svc.identities;

package/templates/add/auth/migrations/create_identities.up.sql.hbs

@@ -1,11 +1,15 @@
-CREATE TABLE identities (
+CREATE TABLE user_svc.identities (
     id            UUID PRIMARY KEY,
-    user_id       UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    user_id       UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
     provider      VARCHAR(20) NOT NULL,
     password_hash TEXT,
     provider_uid  TEXT,
     created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
-    UNIQUE (user_id, provider),
-    UNIQUE (provider, provider_uid)
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
 );
+
+-- Named unique indexes matching model.Identity's own
+-- `uniqueIndex:idx_identities_*` tags — see create_users.up.sql for why an
+-- anonymous UNIQUE constraint breaks AutoMigrate.
+CREATE UNIQUE INDEX idx_identities_user_provider ON user_svc.identities (user_id, provider);
+CREATE UNIQUE INDEX idx_identities_provider_uid ON user_svc.identities (provider, provider_uid);

package/templates/add/auth/migrations/create_login_throttle.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.login_throttle;

package/templates/add/auth/migrations/create_login_throttle.up.sql.hbs

@@ -0,0 +1,10 @@
+-- Failed-attempt counter per account. Keyed on a hash of the submitted email
+-- so it works for addresses that have no account (otherwise throttling itself
+-- leaks which addresses are registered) and so this table is not a user list.
+-- See model/loginthrottle.go for why this exists separately from the rate limiter.
+CREATE TABLE user_svc.login_throttle (
+    email_hash   TEXT PRIMARY KEY,
+    failures     INTEGER NOT NULL DEFAULT 0,
+    locked_until TIMESTAMPTZ,
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);

package/templates/add/auth/migrations/create_users.down.sql.hbs

@@ -1 +1 @@
-DROP TABLE IF EXISTS users;
+DROP TABLE IF EXISTS user_svc.users;