@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/internal/app/user/handler_mfa.go.hbs

@@ -0,0 +1,83 @@
+package user
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func (h *Handler) verifyMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in mfaChallengeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.VerifyMFA(c.Request.Context(), in.Challenge, in.Code)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) mfaStatus(c *gin.Context) {
+	setNoStoreHeaders(c)
+	status, err := h.svc.MFAStatus(c.Request.Context(), currentUserID(c))
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.JSON(http.StatusOK, mfaStatusResponse(status))
+}
+
+func (h *Handler) setupMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	setup, err := h.svc.SetupMFA(c.Request.Context(), currentUserID(c))
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.JSON(http.StatusOK, mfaSetupResponse{Secret: setup.Secret, OTPAuthURI: setup.OTPAuthURI})
+}
+
+func (h *Handler) confirmMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in mfaCodeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	codes, err := h.svc.ConfirmMFA(c.Request.Context(), currentUserID(c), in.Code)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.JSON(http.StatusOK, mfaConfirmResponse{RecoveryCodes: codes})
+}
+
+func (h *Handler) disableMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in mfaCodeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.DisableMFA(c.Request.Context(), currentUserID(c), in.Code); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func currentUserID(c *gin.Context) uuid.UUID {
+	return c.MustGet(middleware.UserIDKey).(uuid.UUID)
+}

package/templates/add/auth/internal/app/user/handler_oauth.go.hbs

@@ -0,0 +1,70 @@
+package user
+
+import (
+	"errors"
+	"log/slog"
+	"net/http"
+
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/shared/apperror"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) providerLogin(c *gin.Context) {
+	start, err := h.svc.BeginLogin(c.Request.Context(), c.Param("provider"), application.LoginStartInput{
+		State:               c.Query("state"),
+		CodeChallenge:       c.Query("code_challenge"),
+		CodeChallengeMethod: c.Query("code_challenge_method"),
+	})
+	if err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), err))
+		return
+	}
+	c.Redirect(http.StatusFound, start.URL)
+}
+
+func (h *Handler) providerExchange(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in loginExchangeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), application.NewOAuthError(application.OAuthFailed, err)))
+		return
+	}
+	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), in)
+	if err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), err))
+		return
+	}
+	h.writeAuthResult(c, http.StatusOK, auth)
+}
+
+func (h *Handler) oauthAppError(provider string, err error) *apperror.AppError {
+	code := application.OAuthFailed
+	status := http.StatusBadRequest
+	message := "external login failed"
+	var oauthErr *application.OAuthError
+	if errors.As(err, &oauthErr) {
+		switch oauthErr.Code {
+		case application.OAuthDenied:
+			code = application.OAuthDenied
+			message = "external login was denied"
+		case application.OAuthStateInvalid:
+			code = application.OAuthStateInvalid
+			message = "oauth state or PKCE verifier is invalid"
+		case application.OAuthProviderUnavailable:
+			code = application.OAuthProviderUnavailable
+			status = http.StatusServiceUnavailable
+			message = "external login provider is unavailable"
+		case application.OAuthFailed:
+			code = application.OAuthFailed
+		default:
+			code = application.OAuthFailed
+		}
+	}
+	slog.Warn("oauth request failed", "provider", provider, "code", code, "error", err)
+	return apperror.New(status, string(code), message)
+}

package/templates/add/auth/internal/app/user/handler_recovery.go.hbs

@@ -0,0 +1,49 @@
+package user
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/httpx"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) forgotPassword(c *gin.Context) {
+	var in forgotPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
+		c.Error(err)
+		return
+	}
+	// Always the same response, whether or not the email exists.
+	c.JSON(http.StatusOK, gin.H{"message": "if that email exists, a reset link has been sent"})
+}
+
+func (h *Handler) resetPassword(c *gin.Context) {
+	var in resetPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) verifyEmail(c *gin.Context) {
+	var in verifyEmailInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}

package/templates/add/auth/internal/app/user/handler_test.go.hbs

@@ -0,0 +1,290 @@
+package user
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+type allowAllLimiter struct{}
+
+func (allowAllLimiter) Allow(_ context.Context, _ string, _ int, _ time.Duration) bool { return true }
+
+type allowAllAuthorizer struct{}
+
+func (allowAllAuthorizer) Require(_ string) gin.HandlerFunc {
+	return func(c *gin.Context) { c.Next() }
+}
+
+const handlerOAuthVerifier = "client-code-verifier-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+func newOAuthTestRouter(t *testing.T) (*gin.Engine, *fakeLoginProvider) {
+	t.Helper()
+	provider := &fakeLoginProvider{name: "fake"}
+	provider.beginFn = func(in application.LoginStartInput) (application.Authorization, error) {
+		return application.Authorization{URL: "https://provider.example.test/authorize?" + url.Values{
+			"state":                 {in.State},
+			"code_challenge":        {in.CodeChallenge},
+			"code_challenge_method": {in.CodeChallengeMethod},
+		}.Encode()}, nil
+	}
+	provider.completeFn = func(application.LoginCompleteInput) (application.ExternalIdentity, error) {
+		return application.ExternalIdentity{Provider: "fake", Subject: "subject", Email: "user@example.com", EmailVerified: true, Name: "User"}, nil
+	}
+	svc := newTestServiceWithProviders(&fakeRepo{}, newFakeTokenStore(), provider)
+	h := NewHandler(svc, "test-secret", time.Hour, true, "strict", allowAllLimiter{}, allowAllAuthorizer{})
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(middleware.Error(false))
+	h.Register(router)
+	return router, provider
+}
+
+func newCrossSiteTestRouter(t *testing.T) *gin.Engine {
+	t.Helper()
+	provider := &fakeLoginProvider{name: "fake"}
+	provider.beginFn = func(in application.LoginStartInput) (application.Authorization, error) {
+		return application.Authorization{URL: "https://provider.example.test/authorize?state=" + url.QueryEscape(in.State)}, nil
+	}
+	provider.completeFn = func(application.LoginCompleteInput) (application.ExternalIdentity, error) {
+		return application.ExternalIdentity{Provider: "fake", Subject: "subject", Email: "user@example.com", EmailVerified: true}, nil
+	}
+	svc := newTestServiceWithProviders(&fakeRepo{}, newFakeTokenStore(), provider)
+	h := NewHandlerWithOrigins(svc, "test-secret", time.Hour, true, "none", []string{"https://app.example.test"}, allowAllLimiter{}, allowAllAuthorizer{})
+	router := gin.New()
+	router.Use(middleware.Error(false))
+	h.Register(router)
+	return router
+}
+
+func beginOAuthFlow(t *testing.T, router *gin.Engine) (string, string) {
+	t.Helper()
+	const state = "client-state"
+	const verifier = handlerOAuthVerifier
+	request := httptest.NewRequest(http.MethodGet, "/auth/fake/login?"+url.Values{
+		"state":                 {state},
+		"code_challenge":        {pkceChallenge(verifier)},
+		"code_challenge_method": {"S256"},
+	}.Encode(), nil)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusFound {
+		t.Fatalf("login status = %d, want 302; body=%s", response.Code, response.Body.String())
+	}
+	if cookies := response.Result().Cookies(); len(cookies) != 0 {
+		t.Fatalf("client-owned callback must not set a server OAuth state cookie: %#v", cookies)
+	}
+	location, err := url.Parse(response.Header().Get("Location"))
+	if err != nil {
+		t.Fatalf("parse provider location: %v", err)
+	}
+	if location.Query().Get("state") != state || location.Query().Get("code_challenge") != pkceChallenge(verifier) || location.Query().Get("code_challenge_method") != "S256" {
+		t.Fatalf("provider location did not preserve state/PKCE: %s", location)
+	}
+	return state, verifier
+}
+
+func TestHandler_ProviderExchangeReturnsJSONAndSetsRefreshCookie(t *testing.T) {
+	router, _ := newOAuthTestRouter(t)
+	state, verifier := beginOAuthFlow(t, router)
+	request := httptest.NewRequest(http.MethodPost, "/auth/fake/exchange", strings.NewReader(
+		"{\"code\":\"code\",\"state\":\"" + state + "\",\"code_verifier\":\"" + verifier + "\"}",
+	))
+	request.Header.Set("Content-Type", "application/json")
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+
+	if response.Code != http.StatusOK {
+		t.Fatalf("exchange status = %d, want 200; body=%s", response.Code, response.Body.String())
+	}
+	if response.Header().Get("Location") != "" {
+		t.Fatalf("exchange must not redirect: %q", response.Header().Get("Location"))
+	}
+	if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Pragma") != "no-cache" {
+		t.Fatalf("token response must disable caching: Cache-Control=%q Pragma=%q", response.Header().Get("Cache-Control"), response.Header().Get("Pragma"))
+	}
+	var refreshCookie *http.Cookie
+	for _, cookie := range response.Result().Cookies() {
+		if cookie.Name == refreshCookieName && cookie.Value != "" {
+			refreshCookie = cookie
+			break
+		}
+	}
+	if refreshCookie == nil || !refreshCookie.HttpOnly || !refreshCookie.Secure || refreshCookie.Path != "/" {
+		t.Fatalf("expected secure HttpOnly refresh cookie, got %#v", refreshCookie)
+	}
+	if !strings.Contains(response.Body.String(), "\"access_token\"") || strings.Contains(response.Body.String(), "\"refresh_token\"") {
+		t.Fatalf("response must expose only the access token, got %s", response.Body.String())
+	}
+}
+
+func TestHandler_ProviderCallbackIsFrontendOwnedAndErrorsDoNotRedirect(t *testing.T) {
+	router, provider := newOAuthTestRouter(t)
+	callback := httptest.NewRequest(http.MethodGet, "/auth/fake/callback?error=access_denied&error_description=do-not-leak", nil)
+	callbackResponse := httptest.NewRecorder()
+	router.ServeHTTP(callbackResponse, callback)
+	if callbackResponse.Code != http.StatusNotFound {
+		t.Fatalf("API callback status = %d, want 404 for frontend-owned callback", callbackResponse.Code)
+	}
+	if provider.completeCnt != 0 {
+		t.Fatal("provider must not exchange a frontend callback error")
+	}
+
+	invalid := httptest.NewRequest(http.MethodPost, "/auth/fake/exchange?return_to=https%3A%2F%2Fevil.example", strings.NewReader(
+		"{\"code\":\"code\",\"state\":\"\",\"code_verifier\":\""+handlerOAuthVerifier+"\",\"error_description\":\"do-not-leak\"}",
+	))
+	invalid.Header.Set("Content-Type", "application/json")
+	invalidResponse := httptest.NewRecorder()
+	router.ServeHTTP(invalidResponse, invalid)
+	if invalidResponse.Code != http.StatusBadRequest || !strings.Contains(invalidResponse.Body.String(), "oauth_state_invalid") {
+		t.Fatalf("invalid exchange response = %d %s", invalidResponse.Code, invalidResponse.Body.String())
+	}
+	if invalidResponse.Header().Get("Location") != "" || strings.Contains(invalidResponse.Body.String(), "do-not-leak") || strings.Contains(invalidResponse.Body.String(), "evil.example") {
+		t.Fatalf("exchange exposed redirect or provider details: headers=%v body=%s", invalidResponse.Header(), invalidResponse.Body.String())
+	}
+}
+
+func TestHandler_ProviderLoginAndExchangeUnconfiguredProviderUseControlledJSON(t *testing.T) {
+	router, _ := newOAuthTestRouter(t)
+	login := httptest.NewRequest(http.MethodGet, "/auth/google/login?"+url.Values{
+		"state":                 {"client-state"},
+		"code_challenge":        {"client-code-challenge"},
+		"code_challenge_method": {"S256"},
+	}.Encode(), nil)
+	loginResponse := httptest.NewRecorder()
+	router.ServeHTTP(loginResponse, login)
+	if loginResponse.Code != http.StatusServiceUnavailable || !strings.Contains(loginResponse.Body.String(), "oauth_provider_unavailable") {
+		t.Fatalf("unconfigured provider login = %d %s", loginResponse.Code, loginResponse.Body.String())
+	}
+	if loginResponse.Header().Get("Location") != "" {
+		t.Fatalf("unconfigured provider must not redirect: %q", loginResponse.Header().Get("Location"))
+	}
+
+	exchange := httptest.NewRequest(http.MethodPost, "/auth/google/exchange", strings.NewReader(
+		"{\"code\":\"code\",\"state\":\"state\",\"code_verifier\":\"verifier\"}",
+	))
+	exchange.Header.Set("Content-Type", "application/json")
+	exchangeResponse := httptest.NewRecorder()
+	router.ServeHTTP(exchangeResponse, exchange)
+	if exchangeResponse.Code != http.StatusServiceUnavailable || !strings.Contains(exchangeResponse.Body.String(), "oauth_provider_unavailable") {
+		t.Fatalf("unconfigured provider exchange = %d %s", exchangeResponse.Code, exchangeResponse.Body.String())
+	}
+	if exchangeResponse.Header().Get("Location") != "" {
+		t.Fatalf("unconfigured provider exchange must not redirect: %q", exchangeResponse.Header().Get("Location"))
+	}
+}
+
+func TestHandler_ProviderExchangeRejectsMissingStatePKCEAndCode(t *testing.T) {
+	router, _ := newOAuthTestRouter(t)
+	tests := []struct {
+		name string
+		body string
+		code string
+	}{
+		{name: "malformed JSON", body: "{", code: "oauth_failed"},
+		{name: "missing state", body: "{\"code\":\"code\",\"code_verifier\":\"" + handlerOAuthVerifier + "\"}", code: "oauth_state_invalid"},
+		{name: "missing verifier", body: "{\"code\":\"code\",\"state\":\"state\"}", code: "oauth_state_invalid"},
+		{name: "missing code", body: "{\"state\":\"state\",\"code_verifier\":\"" + handlerOAuthVerifier + "\"}", code: "oauth_failed"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodPost, "/auth/fake/exchange", strings.NewReader(tt.body))
+			request.Header.Set("Content-Type", "application/json")
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code != http.StatusBadRequest || !strings.Contains(response.Body.String(), tt.code) {
+				t.Fatalf("exchange response = %d %s, want %s", response.Code, response.Body.String(), tt.code)
+			}
+			if response.Header().Get("Location") != "" {
+				t.Fatalf("exchange must not redirect: %q", response.Header().Get("Location"))
+			}
+		})
+	}
+}
+
+func TestHandler_ValidateBrowserCookiePolicy(t *testing.T) {
+	tests := []struct {
+		name       string
+		topology   string
+		sameSite   string
+		secure     bool
+		production bool
+		wantErr    bool
+	}{
+		{name: "same-site default", topology: "same-site", sameSite: "strict", secure: false},
+		{name: "same-origin strict", topology: "same-origin", sameSite: "strict", secure: true},
+		{name: "same-site production without secure", topology: "same-site", sameSite: "strict", secure: false, production: true, wantErr: true},
+		{name: "same-origin production secure", topology: "same-origin", sameSite: "strict", secure: true, production: true},
+		{name: "cross-site secure none", topology: "cross-site", sameSite: "none", secure: true, production: true},
+		{name: "cross-site without secure", topology: "cross-site", sameSite: "none", secure: false, wantErr: true},
+		{name: "cross-site lax", topology: "cross-site", sameSite: "lax", secure: true, wantErr: true},
+		{name: "unknown topology", topology: "mobile", sameSite: "strict", secure: true, wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateBrowserCookiePolicy(tt.topology, tt.sameSite, tt.secure, tt.production)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("validateBrowserCookiePolicy() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestHandler_SetRefreshCookie_CrossSiteUsesNoneAndSecure(t *testing.T) {
+	h := &Handler{refreshTTL: time.Hour, cookieSecure: true, cookieSameSite: "none"}
+	response := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(response)
+	h.setRefreshCookie(c, "refresh-token")
+
+	cookies := response.Result().Cookies()
+	if len(cookies) != 1 || cookies[0].Name != refreshCookieName || cookies[0].SameSite != http.SameSiteNoneMode || !cookies[0].Secure || !cookies[0].HttpOnly {
+		t.Fatalf("expected a cross-site None + Secure HttpOnly refresh cookie, got %#v", cookies)
+	}
+}
+
+func TestHandler_CrossSiteStateChangingRequestsRequireAnAllowedOrigin(t *testing.T) {
+	router := newCrossSiteTestRouter(t)
+	tests := []struct {
+		name       string
+		origin     string
+		wantStatus int
+	}{
+		{name: "missing origin", wantStatus: http.StatusForbidden},
+		{name: "untrusted origin", origin: "https://evil.example.test", wantStatus: http.StatusForbidden},
+		{name: "allowed exact origin", origin: "https://app.example.test", wantStatus: http.StatusNoContent},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodPost, "/auth/logout", nil)
+			if tt.origin != "" {
+				request.Header.Set("Origin", tt.origin)
+			}
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code != tt.wantStatus {
+				t.Fatalf("logout status = %d, want %d; body=%s", response.Code, tt.wantStatus, response.Body.String())
+			}
+			if tt.wantStatus == http.StatusForbidden && !strings.Contains(response.Body.String(), "CSRF_ORIGIN_INVALID") {
+				t.Fatalf("missing controlled CSRF error: %s", response.Body.String())
+			}
+		})
+	}
+}
+
+func TestHandler_SetNoStoreHeaders(t *testing.T) {
+	response := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(response)
+	setNoStoreHeaders(c)
+	if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Pragma") != "no-cache" {
+		t.Fatalf("unexpected no-store headers: %v", response.Header())
+	}
+}

package/templates/add/auth/internal/app/user/handler_user.go.hbs

@@ -0,0 +1,41 @@
+package user
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func (h *Handler) resendVerification(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	if err := h.svc.ResendVerificationEmail(c.Request.Context(), userID); err != nil {
+		c.Error(err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// logoutAll ends every session for the caller, including the cookie used by
+// this request.
+func (h *Handler) logoutAll(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	if err := h.svc.LogoutAll(c.Request.Context(), userID); err != nil {
+		c.Error(err)
+		return
+	}
+	h.clearRefreshCookie(c)
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) me(c *gin.Context) {
+	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
+	u, err := h.svc.Get(c.Request.Context(), userID)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}

package/templates/add/auth/internal/app/user/jwt.go.hbs

@@ -3,28 +3,20 @@ package user
 import (
 	"crypto/rand"
 	"crypto/sha256"
-	"crypto/subtle"
 	"encoding/hex"
-	"time"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
 )
 
 const (
-	tokenTypeAccess     = "access"
-	tokenTypeOAuthState = "oauth_state"
-	oauthStateTTL       = 10 * time.Minute
+	tokenTypeAccess = "access"
 )
 
 // accessClaims — see internal/shared/middleware/auth.go for why this struct
-// is duplicated there instead of imported. Also reused (with no Subject) for
-// the Google OAuth CSRF state token below — Typ is what stops one kind being
-// presented where the other is expected.
+// is duplicated there instead of imported.
 type accessClaims struct {
 	Typ string `json:"typ"`
-	// Nonce is only set on the OAuth state token — see issueOAuthState.
-	Nonce string `json:"nonce,omitempty"`
 	// go-scaffold:jwt-claims
 	jwt.RegisteredClaims
 }
@@ -33,62 +25,17 @@ func (s *Service) issueAccessToken(
 	userID uuid.UUID,
 	// go-scaffold:issue-access-token-params
 ) (string, error) {
+	now := s.clock()
 	claims := accessClaims{
 		Typ: tokenTypeAccess,
 		// go-scaffold:jwt-claims-values
 		RegisteredClaims: jwt.RegisteredClaims{
 			Subject:   userID.String(),
-			IssuedAt:  jwt.NewNumericDate(time.Now()),
-			ExpiresAt: jwt.NewNumericDate(time.Now().Add(s.accessTTL)),
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(s.config.JWTAccessTTL)),
 		},
 	}
-	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
-}
-
-// issueOAuthState / verifyOAuthState round-trip a short-lived CSRF token
-// through Google's own redirect. The signature and TTL are not the whole
-// protection: a signed-but-unbound state is one anyone can fetch from
-// GET /auth/google/login and then replay in a victim's browser, which is
-// exactly the login-CSRF the state parameter exists to stop. So the token
-// carries a nonce that the handler also drops in a short-lived httpOnly
-// cookie, and the callback only proceeds when the two agree — the state is
-// then usable in one browser only, the one that started the flow.
-//
-// Returns the state and the nonce to put in that cookie.
-func (s *Service) issueOAuthState() (string, string, error) {
-	nonce, err := randomToken()
-	if err != nil {
-		return "", "", err
-	}
-	claims := accessClaims{
-		Typ:   tokenTypeOAuthState,
-		Nonce: nonce,
-		RegisteredClaims: jwt.RegisteredClaims{
-			IssuedAt:  jwt.NewNumericDate(time.Now()),
-			ExpiresAt: jwt.NewNumericDate(time.Now().Add(oauthStateTTL)),
-		},
-	}
-	state, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
-	if err != nil {
-		return "", "", err
-	}
-	return state, nonce, nil
-}
-
-func (s *Service) verifyOAuthState(raw, nonce string) error {
-	var claims accessClaims
-	_, err := jwt.ParseWithClaims(raw, &claims, func(*jwt.Token) (any, error) {
-		return []byte(s.jwtSecret), nil
-	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name}))
-	if err != nil || claims.Typ != tokenTypeOAuthState {
-		return errInvalidToken()
-	}
-	// A missing cookie is a mismatch, not a pass — otherwise stripping the
-	// cookie is all it takes to get the old, unbound behavior back.
-	if nonce == "" || subtle.ConstantTimeCompare([]byte(claims.Nonce), []byte(nonce)) != 1 {
-		return errInvalidToken()
-	}
-	return nil
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.config.JWTSecret))
 }
 
 // randomToken generates an opaque refresh token — deliberately not a JWT: