@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/migrations/create_auth_tokens.up.sql.hbs

@@ -1,4 +1,5 @@
--- Short-lived auth tokens, for projects scaffolded with `--store postgres`.
+-- Durable recovery tokens for both refresh-store choices. Refresh rotation may
+-- use Redis, but password reset and email verification share this DB contract.
 -- Only the SHA-256 hash is stored; see model/authtoken.go for what `kind`
 -- means and why the rotation tombstone is a separate row.
 CREATE TABLE user_svc.auth_tokens (
@@ -6,11 +7,15 @@ CREATE TABLE user_svc.auth_tokens (
     user_id    UUID NOT NULL,
     kind       VARCHAR(20) NOT NULL,
     expires_at TIMESTAMPTZ NOT NULL,
+    absolute_expires_at TIMESTAMPTZ,
+    provider   VARCHAR(20) NOT NULL DEFAULT '',
+    code_challenge TEXT NOT NULL DEFAULT '',
+    nonce      TEXT NOT NULL DEFAULT '',
     created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 );
 
--- Named to match model.AuthToken's own `index:` tags exactly — GORM's
--- AutoMigrate (dev) reconciles against these names, and an index the
--- migration named differently is what stops the app booting.
+-- Named to match model.AuthToken's own `index:` tags exactly, so the
+-- development bootstrap and production migration describe the same indexes.
 CREATE INDEX idx_auth_tokens_user_kind ON user_svc.auth_tokens (user_id, kind);
 CREATE INDEX idx_auth_tokens_expires_at ON user_svc.auth_tokens (expires_at);
+CREATE INDEX idx_auth_tokens_absolute_expires_at ON user_svc.auth_tokens (absolute_expires_at);

package/templates/add/auth/migrations/create_identities.up.sql.hbs

@@ -10,6 +10,6 @@ CREATE TABLE user_svc.identities (
 
 -- Named unique indexes matching model.Identity's own
 -- `uniqueIndex:idx_identities_*` tags — see create_users.up.sql for why an
--- anonymous UNIQUE constraint breaks AutoMigrate.
+-- anonymous UNIQUE constraint breaks schema parity.
 CREATE UNIQUE INDEX idx_identities_user_provider ON user_svc.identities (user_id, provider);
 CREATE UNIQUE INDEX idx_identities_provider_uid ON user_svc.identities (provider, provider_uid);

package/templates/add/auth/migrations/create_mfa.down.sql.hbs

@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS user_svc.mfa_recovery_codes;
+DROP TABLE IF EXISTS user_svc.mfa_challenges;
+DROP TABLE IF EXISTS user_svc.mfa_enrollments;

package/templates/add/auth/migrations/create_mfa.up.sql.hbs

@@ -0,0 +1,29 @@
+-- MFA state is durable in Postgres for both refresh-token store choices. TOTP
+-- secrets are encrypted by the application; challenges and recovery codes are
+-- stored only as hashes and consumed atomically.
+CREATE TABLE user_svc.mfa_enrollments (
+    user_id          UUID PRIMARY KEY REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    encrypted_secret TEXT NOT NULL,
+    enabled          BOOLEAN NOT NULL DEFAULT false,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE user_svc.mfa_challenges (
+    challenge_hash TEXT PRIMARY KEY,
+    user_id        UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    expires_at     TIMESTAMPTZ NOT NULL,
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_mfa_challenges_user ON user_svc.mfa_challenges (user_id);
+CREATE INDEX idx_mfa_challenges_expires_at ON user_svc.mfa_challenges (expires_at);
+
+CREATE TABLE user_svc.mfa_recovery_codes (
+    user_id    UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    code_hash  TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (user_id, code_hash)
+);
+
+CREATE INDEX idx_mfa_recovery_codes_user ON user_svc.mfa_recovery_codes (user_id);

package/templates/add/auth/migrations/create_users.up.sql.hbs

@@ -12,8 +12,8 @@ CREATE TABLE user_svc.users (
 
 -- A unique INDEX, not an inline UNIQUE constraint, and named to match the
 -- `uniqueIndex:idx_users_email` tag on model.User exactly. Postgres names an
--- inline UNIQUE "users_email_key"; GORM's AutoMigrate (dev, AUTO_MIGRATE=true)
--- then sees uniqueness it didn't create and tries to drop it under its own
+-- inline UNIQUE "users_email_key"; the development bootstrap then sees
+-- uniqueness it didn't create and tries to drop it under its own
 -- name, which fails the boot with
 --   constraint "uni_users_email" of relation "users" does not exist
 -- for anyone who ran `make migrate-up` first — which `add rbac` tells you to.

package/templates/add/rbac/internal/app/role/composition.go.hbs

@@ -0,0 +1,35 @@
+package role
+
+import (
+	"time"
+
+	"{{goModule}}/internal/shared/middleware"
+
+	"gorm.io/gorm"
+)
+
+// Composition groups role's service, authorization adapter, and HTTP handler
+// so cmd/api can register the feature without constructing its internals.
+type Composition struct {
+	Service *Service
+	Authz   *middleware.Authz
+	Handler *Handler
+}
+
+// NewServiceFromDB is the role feature's persistence composition boundary.
+func NewServiceFromDB(db *gorm.DB) *Service {
+	return NewService(NewRepository(db))
+}
+
+// NewCompositionFromDB builds role and its authorization middleware locally.
+// The API binary supplies the shared DB/config values and only registers the
+// returned handlers.
+func NewCompositionFromDB(db *gorm.DB, jwtSecret string, cacheTTL time.Duration) *Composition {
+	service := NewServiceFromDB(db)
+	authz := middleware.NewAuthz(service.PermissionsOf, cacheTTL)
+	return &Composition{
+		Service: service,
+		Authz:   authz,
+		Handler: NewHandler(service, jwtSecret, authz),
+	}
+}

package/templates/add/rbac/internal/app/role/service.go.hbs

@@ -52,7 +52,7 @@ func (s *Service) PermissionsOf(ctx context.Context, roleCode string) (map[strin
 }
 
 // CodeExists reports whether code names a real role — used by user.Service's
-// SetRole to validate a role assignment: AutoMigrate-only test schemas never
+// SetRole to validate a role assignment: development-only test schemas never
 // create the users_role_fkey FK, so that alone can't be relied on to reject
 // an unknown code.
 func (s *Service) CodeExists(ctx context.Context, code string) (bool, error) {
@@ -75,7 +75,7 @@ type roleListItem struct {
 func (s *Service) List(ctx context.Context, limit, offset int) ([]roleListItem, error) {
 	roles, err := s.repo.FindAll(ctx, limit, offset)
 	if err != nil {
-		return nil, apperror.NewInternal()
+		return nil, apperror.NewInternal(err)
 	}
 	// ponytail: one query per role, not a join. A system has a handful of
 	// roles, so this is a handful of round trips on an admin screen nobody
@@ -88,7 +88,7 @@ func (s *Service) List(ctx context.Context, limit, offset int) ([]roleListItem,
 	for i, r := range roles {
 		perms, err := s.repo.PermissionCodes(ctx, r.Code)
 		if err != nil {
-			return nil, apperror.NewInternal()
+			return nil, apperror.NewInternal(err)
 		}
 		out[i] = roleListItem{Role: r, Permissions: perms}
 	}
@@ -108,7 +108,7 @@ func (s *Service) Create(ctx context.Context, in CreateInput) (*roleListItem, er
 		if dberr.IsDuplicate(err) {
 			return nil, errConflict()
 		}
-		return nil, apperror.NewInternal()
+		return nil, apperror.NewInternal(err)
 	}
 	return &roleListItem{Role: *m, Permissions: []string{}}, nil
 }
@@ -127,7 +127,7 @@ func (s *Service) SetPermissions(ctx context.Context, code string, permissionCod
 	if !slices.Contains(permissionCodes, PermRoleManage) {
 		isLast, err := s.isLastRoleManager(ctx, code)
 		if err != nil {
-			return nil, apperror.NewInternal()
+			return nil, apperror.NewInternal(err)
 		}
 		if isLast {
 			return nil, errLastRoleManager()
@@ -139,18 +139,18 @@ func (s *Service) SetPermissions(ctx context.Context, code string, permissionCod
 		if dberr.IsForeignKey(err) {
 			return nil, errUnknownPermission()
 		}
-		return nil, apperror.NewInternal()
+		return nil, apperror.NewInternal(err)
 	}
 	return &roleListItem{Role: *m, Permissions: permissionCodes}, nil
 }
 
 // validatePermissionCodes checks every code against the actual permission
-// catalog — the DB's FK alone isn't enough (AutoMigrate, used in dev/tests,
+// catalog — the DB's FK alone isn't enough (the development bootstrap, used in dev/tests,
 // never creates it, only the raw migration SQL does).
 func (s *Service) validatePermissionCodes(ctx context.Context, codes []string) error {
 	all, err := s.repo.AllPermissionCodes(ctx)
 	if err != nil {
-		return apperror.NewInternal()
+		return apperror.NewInternal(err)
 	}
 	valid := make(map[string]struct{}, len(all))
 	for _, c := range all {
@@ -174,7 +174,7 @@ func (s *Service) Delete(ctx context.Context, code string) error {
 	}
 	isLast, err := s.isLastRoleManager(ctx, code)
 	if err != nil {
-		return apperror.NewInternal()
+		return apperror.NewInternal(err)
 	}
 	if isLast {
 		return errLastRoleManager()
@@ -183,7 +183,7 @@ func (s *Service) Delete(ctx context.Context, code string) error {
 		if dberr.IsForeignKey(err) {
 			return errHasReferences()
 		}
-		return apperror.NewInternal()
+		return apperror.NewInternal(err)
 	}
 	return nil
 }
@@ -204,7 +204,7 @@ func (s *Service) isLastRoleManager(ctx context.Context, code string) (bool, err
 func (s *Service) ListPermissions(ctx context.Context, limit, offset int) ([]model.Permission, error) {
 	items, err := s.repo.FindAllPermissions(ctx, limit, offset)
 	if err != nil {
-		return nil, apperror.NewInternal()
+		return nil, apperror.NewInternal(err)
 	}
 	return items, nil
 }
@@ -213,5 +213,5 @@ func wrapFindErr(err error) error {
 	if errors.Is(err, gorm.ErrRecordNotFound) {
 		return errNotFound()
 	}
-	return apperror.NewInternal()
+	return apperror.NewInternal(err)
 }