@nakedev/go-scaffold 0.4.0 → 0.4.3

package/templates/add/auth/internal/app/user/application/oauth.go.hbs

@@ -0,0 +1,132 @@
+// Package application contains auth use cases and ports that are independent
+// of Gin, GORM models, OAuth SDKs, and HTTP error payloads.
+package application
+
+import (
+	"context"
+	"errors"
+	"fmt"
+)
+
+// LoginProvider is the outbound port for an external authorization-code
+// provider. Implementations own provider SDKs, token exchange, claims/userinfo
+// validation, and provider-specific HTTP details. The user application only
+// sees these small, provider-neutral values.
+type LoginProvider interface {
+	Name() string
+	Begin(context.Context, LoginStartInput) (Authorization, error)
+	Complete(context.Context, LoginCompleteInput) (ExternalIdentity, error)
+}
+
+type LoginStartInput struct {
+	State               string
+	CodeChallenge       string
+	CodeChallengeMethod string
+	Nonce               string
+}
+
+type Authorization struct {
+	URL string
+}
+
+type LoginCompleteInput struct {
+	Code         string
+	CodeVerifier string
+	Nonce        string
+}
+
+// ExternalIdentity is the normalized identity returned by every provider
+// adapter. Provider must be the registry name and Subject must be the
+// provider's stable subject identifier, never an email address.
+type ExternalIdentity struct {
+	Provider      string
+	Subject       string
+	Email         string
+	EmailVerified bool
+	Name          string
+	AvatarURL     string
+}
+
+// ProviderRegistry is an immutable-by-convention lookup boundary. It is
+// assembled in the composition root from providers whose configuration is
+// complete; an absent provider is therefore an expected unavailable state,
+// not an invitation to construct an empty redirect URL.
+type ProviderRegistry struct {
+	providers map[string]LoginProvider
+}
+
+func NewProviderRegistry(providers ...LoginProvider) ProviderRegistry {
+	byName := make(map[string]LoginProvider, len(providers))
+	for _, provider := range providers {
+		if provider == nil || provider.Name() == "" {
+			continue
+		}
+		byName[provider.Name()] = provider
+	}
+	return ProviderRegistry{providers: byName}
+}
+
+func (r ProviderRegistry) Lookup(name string) (LoginProvider, bool) {
+	provider, ok := r.providers[name]
+	return provider, ok
+}
+
+type OAuthErrorCode string
+
+const (
+	OAuthDenied             OAuthErrorCode = "oauth_denied"
+	OAuthStateInvalid       OAuthErrorCode = "oauth_state_invalid"
+	OAuthProviderUnavailable OAuthErrorCode = "oauth_provider_unavailable"
+	OAuthFailed             OAuthErrorCode = "oauth_failed"
+)
+
+// OAuthError is the public, controlled error contract for the browser login
+// start/exchange boundary. Cause is retained only for server-side logs and
+// unwrapping; handlers never serialize Error() to the browser.
+type OAuthError struct {
+	Code  OAuthErrorCode
+	Cause error
+}
+
+func (e *OAuthError) Error() string {
+	if e.Cause == nil {
+		return string(e.Code)
+	}
+	return fmt.Sprintf("%s: %v", e.Code, e.Cause)
+}
+
+func (e *OAuthError) Unwrap() error { return e.Cause }
+
+func NewOAuthError(code OAuthErrorCode, cause error) *OAuthError {
+	return &OAuthError{Code: code, Cause: cause}
+}
+
+type ProviderError struct {
+	Unavailable bool
+	Cause       error
+}
+
+func (e *ProviderError) Error() string {
+	if e.Cause == nil {
+		if e.Unavailable {
+			return "oauth provider unavailable"
+		}
+		return "oauth provider failed"
+	}
+	return e.Cause.Error()
+}
+
+func (e *ProviderError) Unwrap() error { return e.Cause }
+
+func NewProviderUnavailable(cause error) error {
+	return &ProviderError{Unavailable: true, Cause: cause}
+}
+
+func NewProviderFailure(cause error) error {
+	return &ProviderError{Cause: cause}
+}
+
+func IsProviderUnavailable(err error) bool {
+	var providerErr *ProviderError
+	return errors.As(err, &providerErr) && providerErr.Unavailable
+}

package/templates/add/auth/internal/app/user/application/recovery.go.hbs

@@ -0,0 +1,113 @@
+// Package application contains auth use cases and ports that are independent
+// of Gin, GORM models, and HTTP error payloads. Adapters in the parent user
+// package translate those contracts at the feature boundary.
+package application
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+)
+
+var ErrInvalidToken = errors.New("invalid or expired one-time token")
+
+type Identity struct {
+	ID           uuid.UUID
+	UserID       uuid.UUID
+	PasswordHash string
+}
+
+type User struct {
+	ID            uuid.UUID
+	EmailVerified bool
+}
+
+// RecoveryRepository is an outbound port owned by the recovery use case.
+// Implementations map persistence rows to these plain application values.
+type RecoveryRepository interface {
+	FindIdentity(context.Context, uuid.UUID) (*Identity, error)
+	UpdateIdentity(context.Context, *Identity) error
+	FindUser(context.Context, uuid.UUID) (*User, error)
+	UpdateUser(context.Context, *User) error
+}
+
+type RecoveryTokens interface {
+	WithTransaction(context.Context, func(context.Context) error) error
+	ConsumePasswordResetToken(context.Context, string) (uuid.UUID, bool, error)
+	ConsumeEmailVerifyToken(context.Context, string) (uuid.UUID, bool, error)
+}
+
+type PasswordHasher interface {
+	Hash(string) (string, error)
+}
+
+type Recovery struct {
+	repo   RecoveryRepository
+	tokens RecoveryTokens
+	hasher PasswordHasher
+}
+
+func NewRecovery(repo RecoveryRepository, tokens RecoveryTokens, hasher PasswordHasher) *Recovery {
+	return &Recovery{repo: repo, tokens: tokens, hasher: hasher}
+}
+
+// ResetPassword consumes the token and updates the identity in one unit of
+// work. Postgres-backed token adapters run both writes through the same DB
+// transaction; the contract is deliberately a port so another adapter can
+// provide an equivalent retry-safe boundary.
+func (r *Recovery) ResetPassword(ctx context.Context, tokenHash, newPassword string) (uuid.UUID, error) {
+	hash, err := r.hasher.Hash(newPassword)
+	if err != nil {
+		return uuid.Nil, fmt.Errorf("hash password: %w", err)
+	}
+
+	var userID uuid.UUID
+	err = r.tokens.WithTransaction(ctx, func(txctx context.Context) error {
+		id, ok, err := r.tokens.ConsumePasswordResetToken(txctx, tokenHash)
+		if err != nil {
+			return fmt.Errorf("consume password reset token: %w", err)
+		}
+		if !ok {
+			return ErrInvalidToken
+		}
+
+		identity, err := r.repo.FindIdentity(txctx, id)
+		if err != nil {
+			return fmt.Errorf("find local identity: %w", err)
+		}
+		identity.PasswordHash = hash
+		if err := r.repo.UpdateIdentity(txctx, identity); err != nil {
+			return fmt.Errorf("update password: %w", err)
+		}
+		userID = id
+		return nil
+	})
+	return userID, err
+}
+
+func (r *Recovery) VerifyEmail(ctx context.Context, tokenHash string) (uuid.UUID, error) {
+	var userID uuid.UUID
+	err := r.tokens.WithTransaction(ctx, func(txctx context.Context) error {
+		id, ok, err := r.tokens.ConsumeEmailVerifyToken(txctx, tokenHash)
+		if err != nil {
+			return fmt.Errorf("consume email verification token: %w", err)
+		}
+		if !ok {
+			return ErrInvalidToken
+		}
+
+		user, err := r.repo.FindUser(txctx, id)
+		if err != nil {
+			return fmt.Errorf("find user for email verification: %w", err)
+		}
+		user.EmailVerified = true
+		if err := r.repo.UpdateUser(txctx, user); err != nil {
+			return fmt.Errorf("mark email verified: %w", err)
+		}
+		userID = id
+		return nil
+	})
+	return userID, err
+}

package/templates/add/auth/internal/app/user/browser_policy.go.hbs

@@ -0,0 +1,98 @@
+package user
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"{{goModule}}/internal/shared/apperror"
+
+	"github.com/gin-gonic/gin"
+)
+
+// requireBrowserOrigin is the CSRF guard for the cross-site cookie mode. CORS
+// controls whether a caller can read the response; this exact origin check
+// independently controls whether a state-changing request may use an ambient
+// refresh cookie.
+func (h *Handler) requireBrowserOrigin(c *gin.Context) bool {
+	if !strings.EqualFold(strings.TrimSpace(h.cookieSameSite), "none") {
+		return true
+	}
+
+	origin := strings.TrimSpace(c.GetHeader("Origin"))
+	if origin == "" {
+		if referer := strings.TrimSpace(c.GetHeader("Referer")); referer != "" {
+			if parsed, err := url.Parse(referer); err == nil && (parsed.Scheme == "http" || parsed.Scheme == "https") && parsed.Host != "" && parsed.User == nil {
+				origin = parsed.Scheme + "://" + parsed.Host
+			}
+		}
+	}
+	if !browserOriginAllowed(origin, h.allowedOrigins) {
+		c.Error(apperror.New(http.StatusForbidden, "CSRF_ORIGIN_INVALID", "request origin is not allowed"))
+		c.Abort()
+		return false
+	}
+	return true
+}
+
+func browserOriginAllowed(origin string, allowed []string) bool {
+	origin = strings.TrimSpace(origin)
+	if _, ok := canonicalBrowserOrigin(origin); !ok {
+		return false
+	}
+	for _, candidate := range allowed {
+		candidate = strings.TrimSpace(candidate)
+		if _, candidateOK := canonicalBrowserOrigin(candidate); candidateOK && candidate == origin {
+			return true
+		}
+	}
+	return false
+}
+
+func canonicalBrowserOrigin(value string) (string, bool) {
+	parsed, err := url.Parse(strings.TrimSpace(value))
+	if err != nil || parsed.User != nil || parsed.Opaque != "" || parsed.Host == "" || parsed.Path != "" || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return "", false
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return "", false
+	}
+	return parsed.Scheme + "://" + parsed.Host, true
+}
+
+// validateBrowserCookiePolicy ties deployment topology to the attributes used
+// by /auth/refresh. Same-site is the safe local default; cross-site must opt
+// into None + Secure, and production always requires Secure.
+func validateBrowserCookiePolicy(topology, sameSite string, secure, production bool) error {
+	if production && !secure {
+		return fmt.Errorf("production browser cookies require COOKIE_SECURE=true")
+	}
+	switch strings.ToLower(strings.TrimSpace(topology)) {
+	case "same-origin", "same-site":
+		if strings.EqualFold(strings.TrimSpace(sameSite), "none") && !secure {
+			return fmt.Errorf("COOKIE_SAMESITE=none requires COOKIE_SECURE=true")
+		}
+		return nil
+	case "cross-site":
+		if !strings.EqualFold(strings.TrimSpace(sameSite), "none") || !secure {
+			return fmt.Errorf("cross-site browser topology requires COOKIE_SAMESITE=none and COOKIE_SECURE=true")
+		}
+		return nil
+	default:
+		return fmt.Errorf("unsupported browser topology %q", topology)
+	}
+}
+
+// sameSiteFrom maps COOKIE_SAMESITE to the net/http constant and defaults to
+// the strictest option for anything unrecognised.
+func sameSiteFrom(mode string) http.SameSite {
+	switch strings.ToLower(mode) {
+	case "none":
+		return http.SameSiteNoneMode
+	case "lax":
+		return http.SameSiteLaxMode
+	default:
+		return http.SameSiteStrictMode
+	}
+}

package/templates/add/auth/internal/app/user/composition.go.hbs

@@ -0,0 +1,165 @@
+package user
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/app/user/model"
+	googleprovider "{{goModule}}/internal/platform/authprovider/google"
+	"{{goModule}}/internal/platform/mail"
+	"{{goModule}}/internal/shared/config"
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+	{{#if redis}}
+	"github.com/redis/go-redis/v9"
+	{{/if}}
+	{{#if worker}}
+	"{{goModule}}/internal/platform/queue"
+	{{/if}}
+	"gorm.io/gorm"
+)
+
+// recoveryRepositoryAdapter maps persistence models to the plain values used
+// by the application recovery use case. The adapter is the only layer that
+// knows both the GORM model and the application port.
+type recoveryRepositoryAdapter struct {
+	repo repository
+}
+
+func (a recoveryRepositoryAdapter) FindIdentity(ctx context.Context, userID uuid.UUID) (*application.Identity, error) {
+	identity, err := a.repo.FindIdentity(ctx, userID, model.ProviderLocal)
+	if err != nil {
+		return nil, err
+	}
+	if identity.PasswordHash == nil {
+		return nil, fmt.Errorf("local identity has no password")
+	}
+	return &application.Identity{ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash}, nil
+}
+
+func (a recoveryRepositoryAdapter) UpdateIdentity(ctx context.Context, identity *application.Identity) error {
+	current, err := a.repo.FindIdentity(ctx, identity.UserID, model.ProviderLocal)
+	if err != nil {
+		return err
+	}
+	current.PasswordHash = &identity.PasswordHash
+	return a.repo.UpdateIdentity(ctx, current)
+}
+
+func (a recoveryRepositoryAdapter) FindUser(ctx context.Context, userID uuid.UUID) (*application.User, error) {
+	user, err := a.repo.FindByID(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	return &application.User{ID: user.ID, EmailVerified: user.EmailVerified}, nil
+}
+
+func (a recoveryRepositoryAdapter) UpdateUser(ctx context.Context, user *application.User) error {
+	current, err := a.repo.FindByID(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+	current.EmailVerified = user.EmailVerified
+	return a.repo.UpdateUser(ctx, current)
+}
+
+type bcryptPasswordHasher struct{}
+
+func (bcryptPasswordHasher) Hash(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+func newRecovery(repo repository, tokens application.RecoveryTokens) *application.Recovery {
+	return application.NewRecovery(recoveryRepositoryAdapter{repo: repo}, tokens, bcryptPasswordHasher{})
+}
+
+// NewHandlerFromDB is auth's local composition root. cmd/api owns shared
+// infrastructure and cross-feature dependencies; repository, token store,
+// mailer, service, limiter, and handler construction stays in this package.
+func NewHandlerFromDB(
+	db *gorm.DB,
+	cfg config.Config,
+{{#if redis}}
+	rdb *redis.Client,
+{{/if}}
+{{#if worker}}
+	q queue.Enqueuer,
+	{{/if}}
+	roleChecker RoleChecker,
+	authz authorizer,
+) *Handler {
+{{#if redis}}
+tokens := NewRedisTokenStore(rdb, db)
+{{else}}
+tokens := NewPgTokenStore(db)
+{{/if}}
+
+{{#if worker}}
+outbound := mail.NewAsyncClient(q)
+{{else}}
+outbound := mail.NewSyncClient(mail.Open(cfg))
+{{/if}}
+
+	var providers []application.LoginProvider
+	if cfg.GoogleClientID != "" && cfg.GoogleClientSecret != "" && cfg.GoogleOAuthRedirectURI != "" {
+		providers = append(providers, googleprovider.New(googleprovider.Config{
+			ClientID:     cfg.GoogleClientID,
+			ClientSecret: cfg.GoogleClientSecret,
+			RedirectURL:  cfg.GoogleOAuthRedirectURI,
+		}))
+	}
+	providerRegistry := application.NewProviderRegistry(providers...)
+	if err := validateBrowserCookiePolicy(cfg.AuthBrowserTopology, cfg.CookieSameSite, cfg.CookieSecure, cfg.IsProd()); err != nil {
+		panic(err)
+	}
+	if cfg.JWTRefreshTTL <= 0 || cfg.JWTRefreshMaxTTL <= 0 {
+		panic(fmt.Errorf("JWT refresh token lifetimes must be positive"))
+	}
+	if cfg.OAuthStateTTL <= 0 {
+		panic(fmt.Errorf("OAUTH_STATE_TTL_MIN must be positive"))
+	}
+
+	service := NewService(Dependencies{
+		Repository:        NewRepository(db),
+		RefreshTokens:     tokens,
+		OAuthTransactions: tokens,
+		RecoveryTokens:    tokens,
+		MFA:               NewPostgresMFAStore(db),
+		Mailer:            outbound,
+		Providers:         providerRegistry,
+		Roles:             roleChecker,
+		Clock:             time.Now,
+	}, AuthConfig{
+		JWTSecret:        cfg.JWTSecret,
+		JWTAccessTTL:     cfg.JWTAccessTTL,
+		JWTRefreshTTL:    cfg.JWTRefreshTTL,
+		JWTRefreshMaxTTL: cfg.JWTRefreshMaxTTL,
+		OAuthStateTTL:    cfg.OAuthStateTTL,
+		PasswordResetTTL: cfg.PasswordResetTTL,
+		PasswordResetURL: cfg.PasswordResetURL,
+		EmailVerifyTTL:   cfg.EmailVerifyTTL,
+		EmailVerifyURL:   cfg.EmailVerifyURL,
+		MFA: MFASettings{
+			Enabled:           cfg.AuthMFAEnabled,
+			Issuer:            cfg.MFAIssuer,
+			EncryptionKey:     cfg.MFAEncryptionKey,
+			ChallengeTTL:      cfg.MFAChallengeTTL,
+			TOTPWindow:        cfg.MFATOTPWindow,
+			RecoveryCodeCount: cfg.MFARecoveryCodeCount,
+		},
+	})
+{{#if redis}}
+	limiter := middleware.NewRedisLimiter(rdb)
+{{else}}
+	limiter := middleware.NewMemoryLimiter()
+{{/if}}
+	return NewHandlerWithOrigins(service, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, cfg.CORSAllowedOrigins, limiter, authz)
+}

package/templates/add/auth/internal/app/user/contracts.go.hbs

@@ -0,0 +1,88 @@
+package user
+
+import (
+	"context"
+	"time"
+
+	"{{goModule}}/internal/app/user/application"
+
+	"github.com/google/uuid"
+)
+
+// Dependencies is the explicit composition contract for the auth application.
+// Each port represents one lifecycle or capability, so a new adapter does not
+// have to implement unrelated token operations just to be wired in.
+type Dependencies struct {
+	Repository        UserRepository
+	RefreshTokens     RefreshTokenStore
+	OAuthTransactions OAuthTransactionStore
+	RecoveryTokens    RecoveryTokenStore
+	MFA               MFAStore
+	Mailer            AuthMailer
+	Providers         ProviderRegistry
+	Roles             RoleChecker
+	Clock             func() time.Time
+}
+
+// MFASettings is the operator-side MFA policy. Enabled is a capability
+// switch; each user's enrollment is still disabled until that user confirms a
+// TOTP code. Keeping both switches lets an operator turn the feature off
+// without deleting user enrollments.
+type MFASettings struct {
+	Enabled           bool
+	Issuer            string
+	EncryptionKey     string
+	ChallengeTTL      time.Duration
+	TOTPWindow        int
+	RecoveryCodeCount int
+}
+
+// AuthConfig contains only auth policy. The application layer intentionally
+// does not depend on the generated project's shared config package.
+type AuthConfig struct {
+	JWTSecret         string
+	JWTAccessTTL      time.Duration
+	JWTRefreshTTL     time.Duration
+	JWTRefreshMaxTTL  time.Duration
+	OAuthStateTTL     time.Duration
+	PasswordResetTTL  time.Duration
+	PasswordResetURL  string
+	EmailVerifyTTL    time.Duration
+	EmailVerifyURL    string
+	MFA               MFASettings
+}
+
+// ProviderRegistry is the application-facing lookup port for external login
+// providers. The concrete registry lives in the application package; callers
+// may supply a test double or another registry without coupling Service to
+// that implementation.
+type ProviderRegistry interface {
+	Lookup(name string) (application.LoginProvider, bool)
+}
+
+// MFAEnrollment is the storage-neutral representation returned by MFAStore.
+// The secret is always encrypted at rest; it is never serialized by an API
+// response.
+type MFAEnrollment struct {
+	EncryptedSecret string
+	Enabled         bool
+}
+
+// MFAChallenge is a short-lived, one-use pre-session challenge. The raw
+// challenge is returned only to the client; stores receive its hash.
+type MFAChallenge struct {
+	UserID    uuid.UUID
+	ExpiresAt time.Time
+}
+
+// MFAStore owns durable MFA state. Implementations must make challenge and
+// recovery-code consumption atomic so concurrent requests cannot reuse them.
+type MFAStore interface {
+	GetEnrollment(ctx context.Context, userID uuid.UUID) (MFAEnrollment, bool, error)
+	PutPendingEnrollment(ctx context.Context, userID uuid.UUID, encryptedSecret string) error
+	ConfirmEnrollment(ctx context.Context, userID uuid.UUID, encryptedSecret string, recoveryCodeHashes []string) error
+	Disable(ctx context.Context, userID uuid.UUID) error
+	CreateChallenge(ctx context.Context, hash string, challenge MFAChallenge) error
+	ConsumeChallenge(ctx context.Context, hash string) (MFAChallenge, bool, error)
+	ConsumeRecoveryCode(ctx context.Context, userID uuid.UUID, hash string) (bool, error)
+}

package/templates/add/auth/internal/app/user/dto.go.hbs

@@ -32,6 +32,15 @@ type verifyEmailInput struct {
 	Token string `json:"token" binding:"required"`
 }
 
+type mfaCodeInput struct {
+	Code string `json:"code" binding:"required"`
+}
+
+type mfaChallengeInput struct {
+	Challenge string `json:"challenge" binding:"required"`
+	Code      string `json:"code" binding:"required"`
+}
+
 // authResponse is what the service returns internally (both tokens); the
 // handler sends the refresh token as an httpOnly cookie instead of echoing
 // it in the body, so meResponse never carries it — see toCookieResponse.
@@ -42,12 +51,43 @@ type authResponse struct {
 	ExpiresIn    int    `json:"expires_in"`
 }
 
+// authResult keeps the normal token shape source-compatible for callers while
+// representing the pre-session state required by MFA. A challenge never
+// carries an access or refresh token.
+type authResult struct {
+	*authResponse
+	MFAChallenge string
+}
+
+func tokenResult(auth *authResponse) *authResult { return &authResult{authResponse: auth} }
+
+func challengeResult(challenge string) *authResult { return &authResult{MFAChallenge: challenge} }
+
 type authCookieResponse struct {
 	AccessToken string `json:"access_token"`
 	TokenType   string `json:"token_type"`
 	ExpiresIn   int    `json:"expires_in"`
 }
 
+type mfaChallengeResponse struct {
+	MFARequired bool   `json:"mfa_required"`
+	Challenge   string `json:"challenge"`
+}
+
+type mfaStatusResponse struct {
+	Available bool `json:"available"`
+	Enabled   bool `json:"enabled"`
+}
+
+type mfaSetupResponse struct {
+	Secret     string `json:"secret"`
+	OTPAuthURI string `json:"otpauth_uri"`
+}
+
+type mfaConfirmResponse struct {
+	RecoveryCodes []string `json:"recovery_codes"`
+}
+
 func toCookieResponse(a *authResponse) authCookieResponse {
 	return authCookieResponse{AccessToken: a.AccessToken, TokenType: a.TokenType, ExpiresIn: a.ExpiresIn}
 }
@@ -74,4 +114,21 @@ func toMeResponse(u *model.User) meResponse {
 	}
 }
 
+// response is the small public profile DTO used by endpoints added through
+// `generate method user ...`. Auth's built-in /users/me response intentionally
+// stays separate because it has a different contract, but generated admin or
+// support lookups still need the same stable id/timestamp shape as ordinary
+// modules.
+//
+//nolint:unused
+type response struct {
+	ID        uuid.UUID `json:"id"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+//nolint:unused
+func toResponse(u *model.User) response {
+	return response{ID: u.ID, CreatedAt: u.CreatedAt}
+}
+
 // go-scaffold:user-dto