@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/internal/app/user/service.go.hbs

@@ -2,29 +2,19 @@ package user
 
 import (
 	"context"
-	"encoding/json"
-	"errors"
-	"log/slog"
-	"net/http"
 	"strings"
 	"time"
 
+	"{{goModule}}/internal/app/user/application"
 	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
-	"{{goModule}}/internal/shared/config"
-	"{{goModule}}/internal/shared/dberr"
-	"{{goModule}}/internal/shared/id"
 
 	"github.com/google/uuid"
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/google"
-	"gorm.io/gorm"
 )
 
-// repository = what the service needs from the data layer (declared on the
-// consumer side, so it can be faked in tests).
-type repository interface {
+// repository = what the user application needs from the data layer. The
+// interface stays consumer-owned so every use case can be tested without a
+// database, while the concrete GORM implementation remains in repository.go.
+type UserRepository interface {
 	FindByEmail(ctx context.Context, email string) (*model.User, error)
 	FindByID(ctx context.Context, id uuid.UUID) (*model.User, error)
 	UpdateUser(ctx context.Context, u *model.User) error
@@ -40,492 +30,106 @@ type repository interface {
 	// go-scaffold:user-repository-interface
 }
 
-// mailer = what the service needs to send an email — satisfied by
-// platform/mail's AsyncClient (enqueues onto cmd/worker instead of blocking
-// the request on SMTP). Takes ctx so the enqueue can join the caller's
-// transaction where the queue backend supports it.
-type mailer interface {
+// repository is kept as a package-local alias so generated method extensions
+// and focused tests can use the short consumer-side name without hiding the
+// public Dependencies contract from callers outside this package.
+type repository = UserRepository
+
+// mailer = what the service needs to send an email. The concrete client may
+// send inline or enqueue onto cmd/worker; auth only depends on this port.
+type AuthMailer interface {
 	Send(ctx context.Context, to, subject, body string) error
 }
 
 // go-scaffold:user-interfaces
 
-type Service struct {
-	repo       repository
-	tokens     tokenStore
-	mailer     mailer
-	jwtSecret  string
-	accessTTL  time.Duration
-	refreshTTL time.Duration
-	resetTTL   time.Duration
-	resetURL   string
-	verifyTTL  time.Duration
-	verifyURL  string
-	googleOAuth *oauth2.Config
-	// go-scaffold:user-service-fields
-}
-
-func NewService(
-	repo repository,
-	tokens tokenStore,
-	mailer mailer,
-	cfg config.Config,
-	// go-scaffold:user-service-params
-) *Service {
-	return &Service{
-		repo:       repo,
-		tokens:     tokens,
-		mailer:     mailer,
-		jwtSecret:  cfg.JWTSecret,
-		accessTTL:  cfg.JWTAccessTTL,
-		refreshTTL: cfg.JWTRefreshTTL,
-		resetTTL:   cfg.PasswordResetTTL,
-		resetURL:   cfg.PasswordResetURL,
-		verifyTTL:  cfg.EmailVerifyTTL,
-		verifyURL:  cfg.EmailVerifyURL,
-		googleOAuth: &oauth2.Config{
-			ClientID:     cfg.GoogleClientID,
-			ClientSecret: cfg.GoogleClientSecret,
-			RedirectURL:  cfg.GoogleRedirectURL,
-			Scopes:       []string{"openid", "email", "profile"},
-			Endpoint:     google.Endpoint,
-		},
-		// go-scaffold:user-service-init
-	}
-}
-
-// normalizeEmail is applied at every boundary an address enters the service
-// through. The column is a plain case-sensitive UNIQUE, so without this
-// "Foo@x.com" and "foo@x.com" are two accounts that never collide — and a
-// Google login (Google always reports lowercase) fails to find the local
-// account it should have linked to, silently creating a second user for the
-// same person.
-func normalizeEmail(email string) string {
-	return strings.ToLower(strings.TrimSpace(email))
-}
-
-// Failed-attempt policy. Constants rather than config: these are a security
-// posture, not something to tune per environment, and every knob added here is
-// a knob someone can quietly widen until the control stops working. Change the
-// numbers if your threat model differs.
-//
-// The first loginFreeAttempts failures cost nothing — a typo shouldn't lock
-// anyone out. After that each failure doubles the wait (1s, 2s, 4s, ...) up to
-// loginMaxLock, which is the shape OWASP's Authentication Cheat Sheet asks for.
-const (
-	loginFreeAttempts = 3
-	loginMaxLock      = 15 * time.Minute
-)
-
-// throttleKey namespaces the counter by what is being attempted, so a locked
-// login never blocks the password-reset that would fix it — someone who forgot
-// their password is exactly the person who trips the login counter.
-//
-// Hashed, because the counter must exist for addresses that have no account
-// (otherwise "was I throttled" answers "does this account exist"), and a table
-// of plain addresses that anyone has ever typed is a user list.
-func throttleKey(purpose, email string) string {
-	return hashToken(purpose + ":" + normalizeEmail(email))
-}
-
-// throttled reports whether this key is inside its lockout window. A failure
-// to read the counter is treated as not-throttled: this is a brake, and it
-// should not be able to lock everybody out on its own.
-func (s *Service) throttled(ctx context.Context, key string) bool {
-	until, err := s.repo.LoginLockedUntil(ctx, key)
-	if err != nil {
-		slog.Error("read login throttle", "error", err)
-		return false
-	}
-	return !until.IsZero() && time.Now().Before(until)
+// RoleChecker is the narrow capability the user domain needs when RBAC is
+// installed. Keeping the interface here means auth can be generated on its
+// own; the role domain satisfies it structurally when the optional feature is
+// added.
+type RoleChecker interface {
+	CodeExists(ctx context.Context, code string) (bool, error)
 }
 
-func (s *Service) Register(ctx context.Context, in registerInput) (*authResponse, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	u := &model.User{ID: id.New(), Email: normalizeEmail(in.Email), Name: in.Name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		if dberr.IsDuplicate(err) {
-			return nil, errEmailTaken()
-		}
-		return nil, apperror.NewInternal()
-	}
-	// best-effort: a mail failure shouldn't block registration — the user can
-	// always ask for another link via ResendVerificationEmail.
-	s.sendVerificationEmail(ctx, u)
-	return s.issueTokens(ctx, u)
-}
-
-func (s *Service) Login(ctx context.Context, in loginInput) (*authResponse, error) {
-	key := throttleKey("login", in.Email)
-	if s.throttled(ctx, key) {
-		return nil, errTooManyAttempts()
-	}
-
-	// Every failure below is recorded against the same key whether or not the
-	// account exists, and answers with the same error — so the counter cannot
-	// be used to enumerate accounts either.
-	fail := func() (*authResponse, error) {
-		if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
-			slog.Error("record login failure", "error", err)
-		}
-		return nil, errInvalidCredentials()
-	}
-
-	u, err := s.repo.FindByEmail(ctx, normalizeEmail(in.Email))
-	if err != nil {
-		return fail()
-	}
-	ident, err := s.repo.FindIdentity(ctx, u.ID, model.ProviderLocal)
-	if err != nil || ident.PasswordHash == nil {
-		return fail()
-	}
-	if err := bcrypt.CompareHashAndPassword([]byte(*ident.PasswordHash), []byte(in.Password)); err != nil {
-		return fail()
-	}
-
-	if err := s.repo.ClearLoginFailures(ctx, key); err != nil {
-		slog.Error("clear login failures", "error", err)
-	}
-	return s.issueTokens(ctx, u)
-}
-
-// Refresh rotates a refresh token: the presented one is consumed (deleted +
-// tombstoned as "used") and a fresh pair is issued. If the presented token
-// isn't active but WAS already used, that means this exact raw value got
-// replayed after rotation — i.e. it leaked — so every session for that user
-// is revoked, not just this one.
-func (s *Service) Refresh(ctx context.Context, rawRefreshToken string) (*authResponse, error) {
-	hash := hashToken(rawRefreshToken)
-	userID, ok, err := s.tokens.GetRefreshToken(ctx, hash)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if !ok {
-		if reusedBy, used, uerr := s.tokens.IsRefreshTokenUsed(ctx, hash); uerr == nil && used {
-			_ = s.tokens.RevokeAllRefreshTokens(ctx, reusedBy)
-		}
-		return nil, errInvalidToken()
-	}
-
-	if err := s.tokens.DeleteRefreshToken(ctx, hash, userID); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if err := s.tokens.MarkRefreshTokenUsed(ctx, hash, userID, s.refreshTTL); err != nil {
-		return nil, apperror.NewInternal()
-	}
-
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return nil, errInvalidToken()
-	}
-	return s.issueTokens(ctx, u)
-}
-
-// Logout is intentional, not reuse — no tombstoning, and idempotent (a
-// missing/already-gone token still succeeds).
-func (s *Service) Logout(ctx context.Context, rawRefreshToken string) error {
-	if rawRefreshToken == "" {
-		return nil
-	}
-	hash := hashToken(rawRefreshToken)
-	userID, ok, err := s.tokens.GetRefreshToken(ctx, hash)
-	if err != nil || !ok {
-		return nil
-	}
-	return s.tokens.DeleteRefreshToken(ctx, hash, userID)
-}
-
-// LogoutAll is the authenticated, self-service version of what ResetPassword
-// already does automatically: end every session for this user, not just the
-// one making the request — e.g. "log out everywhere" after a lost device.
-func (s *Service) LogoutAll(ctx context.Context, userID uuid.UUID) error {
-	return s.tokens.RevokeAllRefreshTokens(ctx, userID)
-}
-
-func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*model.User, error) {
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, errNotFound()
-		}
-		return nil, apperror.NewInternal()
-	}
-	return u, nil
-}
-
-// List is unused until an admin-facing route calls it (see `add rbac`'s
-// GET /users) — kept here rather than gated behind a patch since it's a
-// generically useful piece of data access, same as UpdateUser.
-func (s *Service) List(ctx context.Context, limit, offset int) ([]model.User, error) {
-	items, err := s.repo.FindAll(ctx, limit, offset)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return items, nil
-}
-
-// ForgotPassword always succeeds from the caller's point of view — whether
-// the email exists or not — so a login-attempt-shaped probe can't be used to
-// enumerate registered accounts. Only if the email resolves to a local
-// (password-based) identity does it actually issue+email a reset token.
-func (s *Service) ForgotPassword(ctx context.Context, email string) error {
-	// Its own counter, so hammering this endpoint cannot lock anyone out of
-	// logging in, and a locked-out login cannot block the reset that fixes it.
-	// Every request counts here, not just failures: what this throttles is
-	// using someone else's address as a mail-bomb target.
-	key := throttleKey("pwreset", email)
-	if s.throttled(ctx, key) {
-		return nil // same answer as always — silence is the whole design here
-	}
-	if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
-		slog.Error("record password reset attempt", "error", err)
-	}
-
-	u, err := s.repo.FindByEmail(ctx, normalizeEmail(email))
-	if err != nil {
-		return nil
-	}
-	ident, err := s.repo.FindIdentity(ctx, u.ID, model.ProviderLocal)
-	if err != nil || ident.PasswordHash == nil {
-		return nil // google-only account has no password to reset
-	}
-
-	raw, err := randomToken()
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if err := s.tokens.SetPasswordResetToken(ctx, hashToken(raw), u.ID, s.resetTTL); err != nil {
-		return apperror.NewInternal()
-	}
-
-	link := s.resetURL + "?token=" + raw
-	if err := s.mailer.Send(ctx, u.Email, "Reset your password", "Reset your password: "+link); err != nil {
-		// token's already stored — a mail failure shouldn't fail the request,
-		// just get logged so it's visible operationally.
-		slog.Error("send password reset email", "error", err)
-	}
-	return nil
-}
-
-// ResetPassword consumes a one-time reset token (GETDEL — see
-// tokenStore.ConsumePasswordResetToken), sets the new password, and revokes
-// every existing session for that user: a password reset should end every
-// session an attacker (or the legitimate user on another device) still holds.
-func (s *Service) ResetPassword(ctx context.Context, rawToken, newPassword string) error {
-	userID, ok, err := s.tokens.ConsumePasswordResetToken(ctx, hashToken(rawToken))
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if !ok {
-		return errInvalidToken()
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	ident, err := s.repo.FindIdentity(ctx, userID, model.ProviderLocal)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	ident.PasswordHash = &hashStr
-	if err := s.repo.UpdateIdentity(ctx, ident); err != nil {
-		return apperror.NewInternal()
-	}
-	return s.tokens.RevokeAllRefreshTokens(ctx, userID)
-}
-
-// sendVerificationEmail issues a one-time token and emails the link — called
-// from Register (best-effort) and ResendVerificationEmail. Not exported:
-// callers that want to send one go through one of those two, which decide
-// whether it's appropriate to (e.g. ResendVerificationEmail checks the user
-// isn't already verified first).
-func (s *Service) sendVerificationEmail(ctx context.Context, u *model.User) {
-	raw, err := randomToken()
-	if err != nil {
-		slog.Error("generate email verification token", "error", err)
-		return
-	}
-	if err := s.tokens.SetEmailVerifyToken(ctx, hashToken(raw), u.ID, s.verifyTTL); err != nil {
-		slog.Error("store email verification token", "error", err)
-		return
-	}
-	link := s.verifyURL + "?token=" + raw
-	if err := s.mailer.Send(ctx, u.Email, "Verify your email", "Verify your email: "+link); err != nil {
-		slog.Error("send email verification email", "error", err)
-	}
+// Service is the stable facade exposed to handlers, cmd/seed, and generated
+// extensions. The behavior is implemented in focused files by use-case area:
+// local_auth.go, sessions.go, recovery_service.go, external_login.go, and
+// user_query.go. Keeping the facade avoids route and generator compatibility
+// churn while preventing one 600-line service file from becoming the place
+// where every auth concern must be edited.
+type Service struct {
+	repo              UserRepository
+	refreshTokens     RefreshTokenStore
+	oauthTransactions OAuthTransactionStore
+	recoveryTokens    RecoveryTokenStore
+	mfa               MFAStore
+	mailer            AuthMailer
+	providers         ProviderRegistry
+	recovery          *application.Recovery
+	config            AuthConfig
+	roles             RoleChecker
+	now               func() time.Time
+	// go-scaffold:user-service-fields
 }
 
-// ResendVerificationEmail is the authenticated counterpart to the automatic
-// send in Register — for when the first email never arrived or its token
-// expired. Rejects an already-verified user instead of silently no-op'ing:
-// unlike ForgotPassword this is authenticated, so there's no enumeration
-// concern in telling the caller their own account's real state.
-func (s *Service) ResendVerificationEmail(ctx context.Context, userID uuid.UUID) error {
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return apperror.NewInternal()
+// NewService is deliberately explicit: infrastructure dependencies and auth
+// policy are separate values, so the application layer never receives the
+// generated project's catch-all shared configuration object.
+func NewService(deps Dependencies, cfg AuthConfig) *Service {
+	if cfg.JWTAccessTTL <= 0 {
+		cfg.JWTAccessTTL = 15 * time.Minute
 	}
-	if u.EmailVerified {
-		return errAlreadyVerified()
+	if cfg.JWTRefreshTTL <= 0 {
+		cfg.JWTRefreshTTL = 12 * time.Hour
 	}
-	s.sendVerificationEmail(ctx, u)
-	return nil
-}
-
-// VerifyEmail consumes a one-time verification token (GETDEL — see
-// tokenStore.ConsumeEmailVerifyToken) and marks the user verified.
-func (s *Service) VerifyEmail(ctx context.Context, rawToken string) error {
-	userID, ok, err := s.tokens.ConsumeEmailVerifyToken(ctx, hashToken(rawToken))
-	if err != nil {
-		return apperror.NewInternal()
+	cfg.JWTRefreshMaxTTL = defaultDuration(cfg.JWTRefreshMaxTTL, cfg.JWTRefreshTTL)
+	cfg.OAuthStateTTL = defaultDuration(cfg.OAuthStateTTL, 10*time.Minute)
+	if cfg.MFA.RecoveryCodeCount == 0 {
+		cfg.MFA.RecoveryCodeCount = defaultMFACodes
 	}
-	if !ok {
-		return errInvalidToken()
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
 	}
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return apperror.NewInternal()
+	providers := deps.Providers
+	if providers == nil {
+		providers = application.NewProviderRegistry()
 	}
-	u.EmailVerified = true
-	return s.repo.UpdateUser(ctx, u)
-}
-
-// GoogleLoginURL signs a short-lived CSRF state token and builds the redirect
-// URL. The second return value is the nonce the caller must set as a cookie:
-// the callback checks it against the one inside the state (see jwt.go), which
-// is what binds the flow to this one browser.
-func (s *Service) GoogleLoginURL() (string, string, error) {
-	state, nonce, err := s.issueOAuthState()
-	if err != nil {
-		return "", "", apperror.NewInternal()
+	return &Service{
+		repo:              deps.Repository,
+		refreshTokens:     deps.RefreshTokens,
+		oauthTransactions: deps.OAuthTransactions,
+		recoveryTokens:    deps.RecoveryTokens,
+		mfa:               deps.MFA,
+		mailer:            deps.Mailer,
+		providers:         providers,
+		recovery:          newRecovery(deps.Repository, deps.RecoveryTokens),
+		config:            cfg,
+		roles:             deps.Roles,
+		now:               clock,
+		// go-scaffold:user-service-init
 	}
-	return s.googleOAuth.AuthCodeURL(state), nonce, nil
-}
-
-type googleUserInfo struct {
-	Sub           string `json:"sub"`
-	Email         string `json:"email"`
-	EmailVerified bool   `json:"email_verified"`
-	Name          string `json:"name"`
-	Picture       string `json:"picture"`
 }
 
-func (s *Service) GoogleCallback(ctx context.Context, code, state, nonce string) (*authResponse, error) {
-	if err := s.verifyOAuthState(state, nonce); err != nil {
-		return nil, err
-	}
-	tok, err := s.googleOAuth.Exchange(ctx, code)
-	if err != nil {
-		return nil, errInvalidToken()
-	}
-
-	resp, err := s.googleOAuth.Client(ctx, tok).Get("https://openidconnect.googleapis.com/v1/userinfo")
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusOK {
-		return nil, apperror.NewInternal()
+func defaultDuration(value, fallback time.Duration) time.Duration {
+	if value > 0 {
+		return value
 	}
-	var info googleUserInfo
-	if err := json.NewDecoder(resp.Body).Decode(&info); err != nil {
-		return nil, apperror.NewInternal()
-	}
-
-	u, err := s.findOrCreateGoogleUser(ctx, info)
-	if err != nil {
-		return nil, err
-	}
-	return s.issueTokens(ctx, u)
+	return fallback
 }
 
-// findOrCreateGoogleUser: (1) an existing google identity for this sub wins
-// outright; (2) failing that, ONLY if Google says the email is verified, link
-// a new google identity onto an existing local account with that email — an
-// unverified email can't be used to take over someone else's account; (3)
-// otherwise, brand new user + identity.
-func (s *Service) findOrCreateGoogleUser(ctx context.Context, info googleUserInfo) (*model.User, error) {
-	if ident, err := s.repo.FindIdentityByProviderUID(ctx, model.ProviderGoogle, info.Sub); err == nil {
-		return s.repo.FindByID(ctx, ident.UserID)
-	}
-
-	providerUID := info.Sub
-	email := normalizeEmail(info.Email)
-	if info.EmailVerified {
-		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-			ident := &model.Identity{ID: id.New(), UserID: u.ID, Provider: model.ProviderGoogle, ProviderUID: &providerUID}
-			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
-				return nil, apperror.NewInternal()
-			}
-			return u, nil
-		}
-	}
-
-	u := &model.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.Picture, EmailVerified: info.EmailVerified}
-	ident := &model.Identity{ID: id.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
-		if dberr.IsDuplicate(err) {
-			return nil, errEmailTaken()
-		}
-		return nil, apperror.NewInternal()
+func (s *Service) clock() time.Time {
+	if s.now == nil {
+		return time.Now()
 	}
-	return u, nil
+	return s.now()
 }
 
-// EnsureUser is idempotent: an existing user with this email is returned
-// as-is (password untouched — cmd/seed shouldn't silently reset a real
-// password on every deploy), otherwise a new local user+identity is
-// created. Used by cmd/seed only — nothing in the HTTP API calls this.
-func (s *Service) EnsureUser(ctx context.Context, email, password, name string) (*model.User, error) {
-	email = normalizeEmail(email)
-	if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-		return u, nil
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	u := &model.User{ID: id.New(), Email: email, Name: name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return u, nil
+// normalizeEmail is applied at every boundary an address enters the service
+// through. The column is a plain case-sensitive UNIQUE, so without this
+// "Foo@x.com" and "foo@x.com" could become two accounts.
+func normalizeEmail(email string) string {
+	return strings.ToLower(strings.TrimSpace(email))
 }
 
 // go-scaffold:user-service-methods
-
-func (s *Service) issueTokens(ctx context.Context, u *model.User) (*authResponse, error) {
-	access, err := s.issueAccessToken(
-		u.ID,
-		// go-scaffold:issue-access-token-args
-	)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	refresh, err := randomToken()
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if err := s.tokens.SetRefreshToken(ctx, hashToken(refresh), u.ID, s.refreshTTL); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return &authResponse{
-		AccessToken:  access,
-		RefreshToken: refresh,
-		TokenType:    "Bearer",
-		ExpiresIn:    int(s.accessTTL.Seconds()),
-	}, nil
-}