@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/internal/app/user/tokenstore_redis.go.hbs

@@ -5,33 +5,83 @@ package user
 
 import (
 	"context"
+	"encoding/json"
+	"fmt"
 	"time"
 
 	"github.com/google/uuid"
 	"github.com/redis/go-redis/v9"
+	"gorm.io/gorm"
 )
 
 const (
-	refreshKeyPrefix     = "user:refresh:"      // +hash -> userID, TTL = refreshTTL
-	refreshUserKeyPrefix = "user:refresh:user:" // +userID -> SET of active token hashes
-	refreshUsedKeyPrefix = "user:refresh:used:" // +hash -> userID, TTL = refreshTTL, reuse-detection tombstone
-	pwresetKeyPrefix     = "user:pwreset:"      // +hash -> userID, TTL = resetTTL, GETDEL on consume
-	emailVerifyKeyPrefix = "user:emailverify:"  // +hash -> userID, TTL = emailVerifyTTL, GETDEL on consume
+	// The shared {refresh} hash tag keeps all keys touched by the Lua rotation
+	// script on one Redis Cluster slot as well as making the operation atomic.
+	refreshKeyPrefix     = "user:{refresh}:"      // +hash -> refreshTokenRecord, TTL = ExpiresAt
+	refreshUserKeyPrefix = "user:{refresh}:user:" // +userID -> SET of active token hashes
+	refreshUsedKeyPrefix = "user:{refresh}:used:" // +hash -> refreshTokenRecord, TTL = source token expiry
+	oauthStateKeyPrefix  = "user:{oauth}:state:"
 )
 
 type redisTokenStore struct {
-	rdb *redis.Client
+	rdb      *redis.Client
+	recovery *recoveryTokenStore
 }
 
-func NewRedisTokenStore(rdb *redis.Client) *redisTokenStore {
-	return &redisTokenStore{rdb: rdb}
+func NewRedisTokenStore(rdb *redis.Client, db *gorm.DB) *redisTokenStore {
+	return &redisTokenStore{rdb: rdb, recovery: newRecoveryTokenStore(db)}
 }
 
-func (s *redisTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+var consumeRefreshScript = redis.NewScript(`
+local token = redis.call("GET", KEYS[1])
+local ttl = redis.call("PTTL", KEYS[1])
+if not token or ttl < 1 then
+	-- An empty bulk string maps to a normal "not found" result in go-redis;
+	-- Lua false would be surfaced as redis.Nil and look like an infrastructure
+	-- failure to Service.Refresh.
+	return ""
+end
+
+-- Decode and validate the fields used by this script before mutating anything.
+-- Redis Lua does not roll back earlier writes when a later command errors; the
+-- old order could therefore delete a corrupt active token and then fail while
+-- decoding it, losing the only evidence needed to investigate or retry safely.
+local decoded, token_data = pcall(cjson.decode, token)
+if not decoded or type(token_data) ~= "table" or
+   type(token_data.user_id) ~= "string" or token_data.user_id == "" or
+   type(token_data.expires_at) ~= "string" or token_data.expires_at == "" or
+   type(token_data.absolute_expires_at) ~= "string" or token_data.absolute_expires_at == "" then
+	return redis.error_reply("invalid refresh token record")
+end
+
+redis.call("DEL", KEYS[1])
+redis.call("SREM", KEYS[3] .. token_data.user_id, ARGV[1])
+redis.call("SET", KEYS[2], token, "PX", ttl)
+return token
+`)
+
+var revokeAllRefreshScript = redis.NewScript(`
+local hashes = redis.call("SMEMBERS", KEYS[1])
+for _, hash in ipairs(hashes) do
+  redis.call("DEL", KEYS[2] .. hash)
+end
+redis.call("DEL", KEYS[1])
+return #hashes
+`)
+
+func (s *redisTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, token refreshTokenRecord) error {
+	ttl := time.Until(token.ExpiresAt)
+	if token.UserID == uuid.Nil || ttl <= 0 || token.AbsoluteExpiresAt.IsZero() || token.AbsoluteExpiresAt.Before(token.ExpiresAt) {
+		return fmt.Errorf("refresh token expiry is invalid")
+	}
+	payload, err := json.Marshal(token)
+	if err != nil {
+		return fmt.Errorf("encode refresh token record: %w", err)
+	}
 	pipe := s.rdb.TxPipeline()
-	pipe.Set(ctx, refreshKeyPrefix+tokenHash, userID.String(), ttl)
-	pipe.SAdd(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
-	_, err := pipe.Exec(ctx)
+	pipe.Set(ctx, refreshKeyPrefix+tokenHash, payload, ttl)
+	pipe.SAdd(ctx, refreshUserKeyPrefix+token.UserID.String(), tokenHash)
+	_, err = pipe.Exec(ctx)
 	return err
 }
 
@@ -43,11 +93,33 @@ func (s *redisTokenStore) GetRefreshToken(ctx context.Context, tokenHash string)
 	if err != nil {
 		return uuid.Nil, false, err
 	}
-	id, err := uuid.Parse(raw)
+	token, err := decodeRefreshTokenRecord(raw)
 	if err != nil {
-		return uuid.Nil, false, err
+		return uuid.Nil, false, fmt.Errorf("decode refresh token record: %w", err)
+	}
+	return token.UserID, true, nil
+}
+
+// ConsumeRefreshToken uses one Lua script for active-token deletion,
+// per-user-session cleanup, and the reuse tombstone. A concurrent caller
+// cannot observe the active value after another caller has won the rotation.
+func (s *redisTokenStore) ConsumeRefreshToken(ctx context.Context, tokenHash string) (refreshTokenRecord, bool, error) {
+	result, err := consumeRefreshScript.Run(ctx, s.rdb,
+		[]string{refreshKeyPrefix + tokenHash, refreshUsedKeyPrefix + tokenHash, refreshUserKeyPrefix},
+		tokenHash,
+	).Result()
+	if err != nil {
+		return refreshTokenRecord{}, false, err
 	}
-	return id, true, nil
+	raw, ok := result.(string)
+	if !ok || raw == "" {
+		return refreshTokenRecord{}, false, nil
+	}
+	token, err := decodeRefreshTokenRecord(raw)
+	if err != nil {
+		return refreshTokenRecord{}, false, fmt.Errorf("decode consumed refresh token record: %w", err)
+	}
+	return token, true, nil
 }
 
 func (s *redisTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID) error {
@@ -58,37 +130,20 @@ func (s *redisTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash stri
 	return err
 }
 
-// RevokeAllRefreshTokens walks the per-user session set and deletes every
-// active refresh token for that user — used when reuse of an already-rotated
-// token is detected (see Service.Refresh): that means the raw token leaked,
-// so every session, not just the replayed one, is treated as compromised.
-//
-// ponytail: the per-user set has no per-member TTL cleanup of its own — a
-// member outlives its key's TTL as a stale entry until the next revoke or
-// rotation touches it. Self-heals over time; revisit if a single user's
-// session count grows large enough to matter.
+// RevokeAllRefreshTokens snapshots the per-user session set, deletes every
+// active refresh token, and removes the set in one Lua invocation. This is
+// important because SetRefreshToken updates two keys: a SMEMBERS followed by
+// a separate pipeline could miss a token added between those operations and
+// leave an active token with no session-set member.
 func (s *redisTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
 	setKey := refreshUserKeyPrefix + userID.String()
-	hashes, err := s.rdb.SMembers(ctx, setKey).Result()
-	if err != nil {
-		return err
-	}
-	if len(hashes) == 0 {
-		return nil
-	}
-	pipe := s.rdb.TxPipeline()
-	for _, h := range hashes {
-		pipe.Del(ctx, refreshKeyPrefix+h)
-	}
-	pipe.Del(ctx, setKey)
-	_, err = pipe.Exec(ctx)
+	_, err := revokeAllRefreshScript.Run(ctx, s.rdb,
+		[]string{setKey, refreshKeyPrefix},
+		userID.String(),
+	).Result()
 	return err
 }
 
-func (s *redisTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, refreshUsedKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
 func (s *redisTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
 	raw, err := s.rdb.Get(ctx, refreshUsedKeyPrefix+tokenHash).Result()
 	if err == redis.Nil {
@@ -97,51 +152,70 @@ func (s *redisTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash stri
 	if err != nil {
 		return uuid.Nil, false, err
 	}
-	id, err := uuid.Parse(raw)
+	token, err := decodeRefreshTokenRecord(raw)
 	if err != nil {
-		return uuid.Nil, false, err
+		return uuid.Nil, false, fmt.Errorf("decode used refresh token record: %w", err)
 	}
-	return id, true, nil
+	return token.UserID, true, nil
 }
 
-func (s *redisTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, pwresetKeyPrefix+tokenHash, userID.String(), ttl).Err()
+func (s *redisTokenStore) SetLoginTransaction(ctx context.Context, stateHash string, transaction loginTransaction) error {
+	if !transaction.ExpiresAt.After(time.Now()) {
+		return fmt.Errorf("oauth login transaction expiry is invalid")
+	}
+	payload, err := json.Marshal(transaction)
+	if err != nil {
+		return fmt.Errorf("encode oauth login transaction: %w", err)
+	}
+	return s.rdb.Set(ctx, oauthStateKeyPrefix+stateHash, payload, time.Until(transaction.ExpiresAt)).Err()
 }
 
-// ConsumePasswordResetToken is one-time-use by construction: GETDEL is
-// atomic, so a token can't be raced into being consumed twice.
-func (s *redisTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, pwresetKeyPrefix+tokenHash).Result()
+func (s *redisTokenStore) ConsumeLoginTransaction(ctx context.Context, stateHash string) (loginTransaction, bool, error) {
+	raw, err := s.rdb.GetDel(ctx, oauthStateKeyPrefix+stateHash).Result()
 	if err == redis.Nil {
-		return uuid.Nil, false, nil
+		return loginTransaction{}, false, nil
 	}
 	if err != nil {
-		return uuid.Nil, false, err
+		return loginTransaction{}, false, err
 	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
+	var transaction loginTransaction
+	if err := json.Unmarshal([]byte(raw), &transaction); err != nil {
+		return loginTransaction{}, false, fmt.Errorf("decode oauth login transaction: %w", err)
 	}
-	return id, true, nil
+	return transaction, true, nil
+}
+
+func decodeRefreshTokenRecord(raw string) (refreshTokenRecord, error) {
+	var token refreshTokenRecord
+	if err := json.Unmarshal([]byte(raw), &token); err != nil {
+		return refreshTokenRecord{}, err
+	}
+	if token.UserID == uuid.Nil || token.ExpiresAt.IsZero() || token.AbsoluteExpiresAt.IsZero() || token.AbsoluteExpiresAt.Before(token.ExpiresAt) {
+		return refreshTokenRecord{}, fmt.Errorf("refresh token record is incomplete")
+	}
+	return token, nil
+}
+
+func (s *redisTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
+	return s.recovery.put(ctx, tokenHash, kindPasswordSet, userID, ttl)
+}
+
+// ConsumePasswordResetToken is one-time-use by construction: the SQL DELETE
+// runs inside the same transaction as the user update.
+func (s *redisTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
+	return s.recovery.consume(ctx, tokenHash, kindPasswordSet)
 }
 
 func (s *redisTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, emailVerifyKeyPrefix+tokenHash, userID.String(), ttl).Err()
+	return s.recovery.put(ctx, tokenHash, kindEmailVerify, userID, ttl)
 }
 
 // ConsumeEmailVerifyToken is one-time-use by construction, same as
-// ConsumePasswordResetToken — GETDEL is atomic.
+// ConsumePasswordResetToken — the SQL delete participates in the transaction.
 func (s *redisTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, emailVerifyKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
+	return s.recovery.consume(ctx, tokenHash, kindEmailVerify)
+}
+
+func (s *redisTokenStore) WithTransaction(ctx context.Context, fn func(context.Context) error) error {
+	return s.recovery.withTransaction(ctx, fn)
 }

package/templates/add/auth/internal/app/user/tokenstore_redis_test.go.hbs

@@ -0,0 +1,185 @@
+package user
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/redis/go-redis/v9"
+)
+
+func redisClientForTest(t *testing.T) *redis.Client {
+	t.Helper()
+	url := os.Getenv("TEST_REDIS_URL")
+	if url == "" {
+		if os.Getenv("REQUIRE_TEST_REDIS") == "true" {
+			t.Fatal("TEST_REDIS_URL is required when REQUIRE_TEST_REDIS=true")
+		}
+		t.Skip("token-store integration test skipped: set TEST_REDIS_URL to a Redis instance")
+	}
+
+	options, err := redis.ParseURL(url)
+	if err != nil {
+		if os.Getenv("REQUIRE_TEST_REDIS") == "true" {
+			t.Fatalf("parse required Redis URL: %v", err)
+		}
+		t.Skipf("token-store integration test skipped: %v", err)
+	}
+	client := redis.NewClient(options)
+	if err := client.Ping(context.Background()).Err(); err != nil {
+		_ = client.Close()
+		if os.Getenv("REQUIRE_TEST_REDIS") == "true" {
+			t.Fatalf("ping required Redis: %v", err)
+		}
+		t.Skipf("token-store integration test skipped: %v", err)
+	}
+	t.Cleanup(func() { _ = client.Close() })
+	return client
+}
+
+func TestRefreshTokenRecord_JSONUsesLuaFieldNames(t *testing.T) {
+	raw, err := json.Marshal(testRefreshTokenRecord(uuid.New()))
+	if err != nil {
+		t.Fatalf("marshal refresh token record: %v", err)
+	}
+
+	var payload map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &payload); err != nil {
+		t.Fatalf("decode refresh token record: %v", err)
+	}
+	if _, ok := payload["user_id"]; !ok {
+		t.Fatalf("Redis refresh payload must contain user_id, got %s", raw)
+	}
+	if _, ok := payload["UserID"]; ok {
+		t.Fatalf("Redis refresh payload must not contain Go field name UserID: %s", raw)
+	}
+}
+
+func TestRedisTokenStore_ConsumeRefreshToken_ConcurrentRealRedis(t *testing.T) {
+	client := redisClientForTest(t)
+	store := NewRedisTokenStore(client, nil)
+	ctx := context.Background()
+	userID := uuid.New()
+	hash := "real-redis-refresh-" + uuid.NewString()
+	if err := store.SetRefreshToken(ctx, hash, testRefreshTokenRecord(userID)); err != nil {
+		t.Fatalf("seed refresh token: %v", err)
+	}
+	t.Cleanup(func() { _ = store.RevokeAllRefreshTokens(ctx, userID) })
+
+	const callers = 32
+	start := make(chan struct{})
+	results := make(chan struct {
+		token refreshTokenRecord
+		ok    bool
+		err   error
+	}, callers)
+	for i := 0; i < callers; i++ {
+		go func() {
+			<-start
+			token, ok, err := store.ConsumeRefreshToken(ctx, hash)
+			results <- struct {
+				token refreshTokenRecord
+				ok    bool
+				err   error
+			}{token: token, ok: ok, err: err}
+		}()
+	}
+	close(start)
+
+	winners := 0
+	for i := 0; i < callers; i++ {
+		got := <-results
+		if got.err != nil {
+			t.Fatalf("concurrent consume: %v", got.err)
+		}
+		if got.ok {
+			winners++
+			if got.token.UserID != userID {
+				t.Fatalf("winner returned user %s, want %s", got.token.UserID, userID)
+			}
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one real-Redis refresh winner, got %d", winners)
+	}
+}
+
+func TestRedisTokenStore_ConsumeRefreshToken_MalformedRecordDoesNotDelete(t *testing.T) {
+	client := redisClientForTest(t)
+	store := NewRedisTokenStore(client, nil)
+	ctx := context.Background()
+	hash := "real-redis-malformed-" + uuid.NewString()
+	key := refreshKeyPrefix + hash
+	if err := client.Set(ctx, key, "not-json", time.Minute).Err(); err != nil {
+		t.Fatalf("seed malformed refresh token: %v", err)
+	}
+	t.Cleanup(func() { _ = client.Del(ctx, key).Err() })
+
+	if _, ok, err := store.ConsumeRefreshToken(ctx, hash); err == nil || ok {
+		t.Fatalf("malformed refresh token must fail without being consumed, ok=%t err=%v", ok, err)
+	}
+	exists, err := client.Exists(ctx, key).Result()
+	if err != nil {
+		t.Fatalf("check malformed refresh token: %v", err)
+	}
+	if exists != 1 {
+		t.Fatal("malformed refresh token was deleted before validation")
+	}
+}
+
+func TestRedisTokenStore_RevokeAllRefreshTokens_IsAtomicWithSet(t *testing.T) {
+	client := redisClientForTest(t)
+	store := NewRedisTokenStore(client, nil)
+	ctx := context.Background()
+	userID := uuid.New()
+	setKey := refreshUserKeyPrefix + userID.String()
+	t.Cleanup(func() { _ = store.RevokeAllRefreshTokens(ctx, userID) })
+
+	// An invariant is stronger than checking the final session count: an
+	// active token must always have a member in the user's set. The old
+	// SMEMBERS -> pipeline implementation could leave exactly that split when
+	// SetRefreshToken landed between the two phases.
+	for i := 0; i < 128; i++ {
+		existingHash := fmt.Sprintf("real-redis-existing-%s-%d", userID, i)
+		newHash := fmt.Sprintf("real-redis-racing-%s-%d", userID, i)
+		if err := store.SetRefreshToken(ctx, existingHash, testRefreshTokenRecord(userID)); err != nil {
+			t.Fatalf("seed existing token: %v", err)
+		}
+
+		start := make(chan struct{})
+		errs := make(chan error, 2)
+		go func() {
+			<-start
+			errs <- store.RevokeAllRefreshTokens(ctx, userID)
+		}()
+		go func() {
+			<-start
+			errs <- store.SetRefreshToken(ctx, newHash, testRefreshTokenRecord(userID))
+		}()
+		close(start)
+		for j := 0; j < 2; j++ {
+			if err := <-errs; err != nil {
+				t.Fatalf("concurrent revoke/set: %v", err)
+			}
+		}
+
+		_, active, err := store.GetRefreshToken(ctx, newHash)
+		if err != nil {
+			t.Fatalf("read racing token: %v", err)
+		}
+		member, err := client.SIsMember(ctx, setKey, newHash).Result()
+		if err != nil {
+			t.Fatalf("read session set: %v", err)
+		}
+		if active != member {
+			t.Fatalf("inconsistent Redis session state at round %d: active=%t set_member=%t", i, active, member)
+		}
+		if err := store.RevokeAllRefreshTokens(ctx, userID); err != nil {
+			t.Fatalf("cleanup round %d: %v", i, err)
+		}
+	}
+}

package/templates/add/auth/internal/app/user/user_query.go.hbs

@@ -0,0 +1,65 @@
+package user
+
+import (
+	"context"
+	"errors"
+
+	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/shared/id"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+)
+
+// wrapFindErr is shared by methods added through `generate method`. Keeping
+// not-found translation in this query file means the small service facade
+// does not need to import database-specific error packages just because a
+// later method was generated.
+func wrapFindErr(err error) error {
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return errNotFound()
+	}
+	return apperror.NewInternal(err)
+}
+
+func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*model.User, error) {
+	u, err := s.repo.FindByID(ctx, userID)
+	if err != nil {
+		return nil, wrapFindErr(err)
+	}
+	return u, nil
+}
+
+// List is kept for the optional RBAC admin routes. It is not part of the
+// public self-service auth surface until that feature is installed.
+func (s *Service) List(ctx context.Context, limit, offset int) ([]model.User, error) {
+	items, err := s.repo.FindAll(ctx, limit, offset)
+	if err != nil {
+		return nil, apperror.NewInternal(err)
+	}
+	return items, nil
+}
+
+// EnsureUser is idempotent and used only by cmd/seed. It never resets an
+// existing user's password as a side effect of a later deployment.
+func (s *Service) EnsureUser(ctx context.Context, email, password, name string) (*model.User, error) {
+	email = normalizeEmail(email)
+	if u, err := s.repo.FindByEmail(ctx, email); err == nil {
+		return u, nil
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, apperror.NewInternal(err)
+	}
+	hashStr := string(hash)
+
+	u := &model.User{ID: id.New(), Email: email, Name: name}
+	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
+	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
+		return nil, apperror.NewInternal(err)
+	}
+	return u, nil
+}