@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler.go.hbs

@@ -0,0 +1,228 @@
+package httpadapter
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+
+	"{{goModule}}/internal/shared/pagination"
+	"github.com/gin-gonic/gin"
+	// go-scaffold:user-handler-imports
+)
+
+const (
+	refreshCookieName = "refresh_token"
+)
+
+const PermUserManageRole = "user:manage-role"
+const PermUserRead = "user:read"
+
+// go-scaffold:user-handler-consts
+
+// authorizer is the optional capability RBAC supplies to protect admin
+// routes. Auth itself does not import the RBAC middleware implementation.
+type authorizer interface {
+	Require(string) gin.HandlerFunc
+}
+
+type Handler struct {
+	svc            application.ServicePort
+	jwtSecret      string
+	refreshTTL     time.Duration
+	cookieSecure   bool
+	cookieSameSite string
+	allowedOrigins []string
+	// limiter, not a *redis.Client: which backing store counts the requests is
+	// decided by `add auth --store`, and this file must not care.
+	limiter middleware.Limiter
+	authz   authorizer
+	// go-scaffold:user-handler-fields
+}
+
+func NewHandler(
+	svc application.ServicePort,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	cookieSameSite string,
+	limiter middleware.Limiter,
+	authz ...authorizer,
+	// go-scaffold:user-handler-params
+) *Handler {
+	return newHandler(svc, jwtSecret, refreshTTL, cookieSecure, cookieSameSite, nil, limiter, authz...)
+}
+
+// NewHandlerWithOrigins is the composition entry point when the application
+// uses cookies across browser origins.
+func NewHandlerWithOrigins(
+	svc application.ServicePort,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	cookieSameSite string,
+	allowedOrigins []string,
+	limiter middleware.Limiter,
+	authz ...authorizer,
+	// go-scaffold:user-handler-with-origins-params
+) *Handler {
+	return newHandler(svc, jwtSecret, refreshTTL, cookieSecure, cookieSameSite, allowedOrigins, limiter, authz...)
+}
+
+func newHandler(
+	svc application.ServicePort,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	cookieSameSite string,
+	allowedOrigins []string,
+	limiter middleware.Limiter,
+	authz ...authorizer,
+) *Handler {
+	var authzMiddleware authorizer
+	if len(authz) > 0 {
+		authzMiddleware = authz[0]
+	}
+	return &Handler{
+		svc:            svc,
+		jwtSecret:      jwtSecret,
+		refreshTTL:     refreshTTL,
+		cookieSecure:   cookieSecure,
+		cookieSameSite: cookieSameSite,
+		allowedOrigins: append([]string(nil), allowedOrigins...),
+		limiter:        limiter,
+		authz:          authzMiddleware,
+		// go-scaffold:user-handler-init
+	}
+}
+
+// Register owns the public/protected route split for the user feature. The
+// endpoint implementations live in focused handler files; this file remains
+// the single route/composition surface that generator patches can target.
+func (h *Handler) Register(rg gin.IRouter) {
+	loginLimit := middleware.RateLimit(h.limiter, "login", 10, time.Minute)
+	registerLimit := middleware.RateLimit(h.limiter, "register", 5, time.Minute)
+	forgotPasswordLimit := middleware.RateLimit(h.limiter, "forgot-password", 5, time.Minute)
+	resetPasswordLimit := middleware.RateLimit(h.limiter, "reset-password", 10, time.Minute)
+	verifyEmailLimit := middleware.RateLimit(h.limiter, "verify-email", 10, time.Minute)
+	resendVerificationLimit := middleware.RateLimit(h.limiter, "resend-verification", 5, time.Minute)
+	mfaVerifyLimit := middleware.RateLimit(h.limiter, "mfa-verify", 5, time.Minute)
+	mfaSetupLimit := middleware.RateLimit(h.limiter, "mfa-setup", 5, time.Minute)
+	mfaConfirmLimit := middleware.RateLimit(h.limiter, "mfa-confirm", 5, time.Minute)
+	mfaDisableLimit := middleware.RateLimit(h.limiter, "mfa-disable", 5, time.Minute)
+
+	authGroup := rg.Group("/auth")
+	authGroup.POST("/register", registerLimit, h.register)
+	authGroup.POST("/login", loginLimit, h.login)
+	authGroup.POST("/refresh", h.refresh)
+	authGroup.POST("/logout", h.logout)
+	authGroup.POST("/forgot-password", forgotPasswordLimit, h.forgotPassword)
+	authGroup.POST("/reset-password", resetPasswordLimit, h.resetPassword)
+	authGroup.POST("/verify-email", verifyEmailLimit, h.verifyEmail)
+	authGroup.POST("/mfa/verify", mfaVerifyLimit, h.verifyMFA)
+	authGroup.GET("/:provider/login", h.providerLogin)
+	authGroup.POST("/:provider/exchange", h.providerExchange)
+
+	usersGroup := rg.Group("/users", middleware.RequireAuth(h.jwtSecret))
+	usersGroup.GET("/me", h.me)
+	usersGroup.POST("/me/resend-verification", resendVerificationLimit, h.resendVerification)
+	usersGroup.POST("/me/logout-all", h.logoutAll)
+	usersGroup.GET("/me/mfa", h.mfaStatus)
+	usersGroup.POST("/me/mfa/setup", mfaSetupLimit, h.setupMFA)
+	usersGroup.POST("/me/mfa/confirm", mfaConfirmLimit, h.confirmMFA)
+	usersGroup.POST("/me/mfa/disable", mfaDisableLimit, h.disableMFA)
+	// Admin user routes are enabled only when the optional RBAC authorizer is
+	// supplied by the composition root. Auth-only projects keep the endpoint
+	// surface limited to authentication and the current-user operations.
+	if h.authz != nil {
+		usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)
+		usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)
+		usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)
+	}
+	// go-scaffold:handler-routes
+	// go-scaffold:user-routes
+}
+
+func (h *Handler) adminListUsers(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]meResponse, len(items))
+	for i := range items {
+		out[i] = toMeResponse(&items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+func (h *Handler) adminGetUser(c *gin.Context) {
+	id, ok := httpx.ParseID(c)
+	if !ok {
+		return
+	}
+	u, err := h.svc.Get(c.Request.Context(), id)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}
+func (h *Handler) setRole(c *gin.Context) {
+	id, ok := httpx.ParseID(c)
+	if !ok {
+		return
+	}
+	var in setRoleInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	u, err := h.svc.SetRole(c.Request.Context(), id, in.Role)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}
+
+func toHTTPError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var appErr *apperror.AppError
+	if errors.As(err, &appErr) {
+		return err
+	}
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		status := http.StatusInternalServerError
+		switch ruleErr.Code {
+		case "USER_NOT_FOUND":
+			status = http.StatusNotFound
+		case "USER_EMAIL_TAKEN", "AUTH_ALREADY_VERIFIED", "AUTH_MFA_ALREADY_ENABLED", "AUTH_MFA_NOT_ENROLLED", "AUTH_MFA_SETUP_REQUIRED":
+			status = http.StatusConflict
+		case "AUTH_INVALID_CREDENTIALS", "AUTH_INVALID_TOKEN", "AUTH_MFA_INVALID":
+			status = http.StatusUnauthorized
+		case "AUTH_MFA_UNAVAILABLE":
+			status = http.StatusServiceUnavailable
+		case "AUTH_TOO_MANY_ATTEMPTS":
+			status = http.StatusTooManyRequests
+		case "USER_UNKNOWN_ROLE":
+			status = http.StatusUnprocessableEntity
+		}
+		return apperror.New(status, ruleErr.Code, ruleErr.Message)
+	}
+	if errors.Is(err, domain.ErrNotFound) {
+		return apperror.NewNotFound("user not found")
+	}
+	return apperror.NewInternal(err)
+}
+
+// go-scaffold:handler-funcs
+// go-scaffold:user-handler-funcs

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_local.go.hbs

@@ -0,0 +1,76 @@
+package httpadapter
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/shared/httpx"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) register(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in registerInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Register(c.Request.Context(), toRegisterInput(in))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.writeAuthResult(c, http.StatusCreated, auth)
+}
+
+func (h *Handler) login(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in loginInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Login(c.Request.Context(), toLoginInput(in))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.writeAuthResult(c, http.StatusOK, auth)
+}
+
+func (h *Handler) refresh(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	raw, err := c.Cookie(refreshCookieName)
+	if err != nil || raw == "" {
+		c.Error(toHTTPError(domain.Rule("AUTH_INVALID_TOKEN", "invalid or expired token", domain.ErrInvalidToken)))
+		return
+	}
+	auth, err := h.svc.Refresh(c.Request.Context(), raw)
+	if err != nil {
+		h.clearRefreshCookie(c)
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) logout(c *gin.Context) {
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	raw, _ := c.Cookie(refreshCookieName)
+	_ = h.svc.Logout(c.Request.Context(), raw)
+	h.clearRefreshCookie(c)
+	c.Status(http.StatusNoContent)
+}

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_mfa.go.hbs

@@ -0,0 +1,83 @@
+package httpadapter
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+func (h *Handler) verifyMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in mfaChallengeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.VerifyMFA(c.Request.Context(), in.Challenge, in.Code)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) mfaStatus(c *gin.Context) {
+	setNoStoreHeaders(c)
+	status, err := h.svc.MFAStatus(c.Request.Context(), currentUserID(c))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, mfaStatusResponse(status))
+}
+
+func (h *Handler) setupMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	setup, err := h.svc.SetupMFA(c.Request.Context(), currentUserID(c))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, mfaSetupResponse{Secret: setup.Secret, OTPAuthURI: setup.OTPAuthURI})
+}
+
+func (h *Handler) confirmMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in mfaCodeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	codes, err := h.svc.ConfirmMFA(c.Request.Context(), currentUserID(c), in.Code)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, mfaConfirmResponse{RecoveryCodes: codes})
+}
+
+func (h *Handler) disableMFA(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in mfaCodeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.DisableMFA(c.Request.Context(), currentUserID(c), in.Code); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func currentUserID(c *gin.Context) uuid.UUID {
+	return c.MustGet(middleware.UserIDKey).(uuid.UUID)
+}

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_oauth.go.hbs

@@ -0,0 +1,70 @@
+package httpadapter
+
+import (
+	"errors"
+	"log/slog"
+	"net/http"
+
+	userapp "{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/shared/apperror"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) providerLogin(c *gin.Context) {
+	start, err := h.svc.BeginLogin(c.Request.Context(), c.Param("provider"), toLoginStartInput(loginStartInput{
+		State:               c.Query("state"),
+		CodeChallenge:       c.Query("code_challenge"),
+		CodeChallengeMethod: c.Query("code_challenge_method"),
+	}))
+	if err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), err))
+		return
+	}
+	c.Redirect(http.StatusFound, start.URL)
+}
+
+func (h *Handler) providerExchange(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in loginExchangeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), userapp.NewOAuthError(userapp.OAuthFailed, err)))
+		return
+	}
+	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), toLoginExchangeInput(in))
+	if err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), err))
+		return
+	}
+	h.writeAuthResult(c, http.StatusOK, auth)
+}
+
+func (h *Handler) oauthAppError(provider string, err error) *apperror.AppError {
+	code := userapp.OAuthFailed
+	status := http.StatusBadRequest
+	message := "external login failed"
+	var oauthErr *userapp.OAuthError
+	if errors.As(err, &oauthErr) {
+		switch oauthErr.Code {
+		case userapp.OAuthDenied:
+			code = userapp.OAuthDenied
+			message = "external login was denied"
+		case userapp.OAuthStateInvalid:
+			code = userapp.OAuthStateInvalid
+			message = "oauth state or PKCE verifier is invalid"
+		case userapp.OAuthProviderUnavailable:
+			code = userapp.OAuthProviderUnavailable
+			status = http.StatusServiceUnavailable
+			message = "external login provider is unavailable"
+		case userapp.OAuthFailed:
+			code = userapp.OAuthFailed
+		default:
+			code = userapp.OAuthFailed
+		}
+	}
+	slog.Warn("oauth request failed", "provider", provider, "code", code, "error", err)
+	return apperror.New(status, string(code), message)
+}

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_recovery.go.hbs

@@ -0,0 +1,49 @@
+package httpadapter
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/httpx"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) forgotPassword(c *gin.Context) {
+	var in forgotPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	// Always the same response, whether or not the email exists.
+	c.JSON(http.StatusOK, gin.H{"message": "if that email exists, a reset link has been sent"})
+}
+
+func (h *Handler) resetPassword(c *gin.Context) {
+	var in resetPasswordInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) verifyEmail(c *gin.Context) {
+	var in verifyEmailInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.Status(http.StatusNoContent)
+}