@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/mfa_store_test.go.hbs

@@ -0,0 +1,174 @@
+package postgres
+
+import (
+	"context"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	"{{goModule}}/internal/app/user/ports"
+
+	"github.com/google/uuid"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+// mfaStoreDBForTest opens the same versioned-migration database used by
+// production. This is intentionally separate from the unit fake: the
+// one-use guarantees depend on PostgreSQL's row-level atomicity.
+func mfaStoreDBForTest(t *testing.T) *gorm.DB {
+	t.Helper()
+	dsn := os.Getenv("TEST_DB_DSN")
+	if dsn == "" {
+		if os.Getenv("REQUIRE_TEST_DB") == "true" {
+			t.Fatal("TEST_DB_DSN is required when REQUIRE_TEST_DB=true")
+		}
+		t.Skip("MFA store integration test skipped: set TEST_DB_DSN to a migrated PostgreSQL database")
+	}
+
+	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{TranslateError: true})
+	if err != nil {
+		if os.Getenv("REQUIRE_TEST_DB") == "true" {
+			t.Fatalf("open required MFA store database: %v", err)
+		}
+		t.Skipf("MFA store integration test skipped: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get MFA store SQL handle: %v", err)
+	}
+	if err := sqlDB.Ping(); err != nil {
+		if os.Getenv("REQUIRE_TEST_DB") == "true" {
+			t.Fatalf("ping required MFA store database: %v", err)
+		}
+		t.Skipf("MFA store integration test skipped: %v", err)
+	}
+	t.Cleanup(func() { _ = sqlDB.Close() })
+	return db
+}
+
+func TestPostgresMFAStore_ConsumesChallengesAndRecoveryCodesOnce(t *testing.T) {
+	db := mfaStoreDBForTest(t)
+	store := NewPostgresMFAStore(db)
+	ctx := context.Background()
+	userID := uuid.New()
+	if err := db.Create(&User{ID: userID, Email: "mfa-store-" + uuid.NewString() + "@example.com"}).Error; err != nil {
+		t.Fatalf("create test user: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Delete(&User{}, "id = ?", userID).Error })
+
+	if err := store.PutPendingEnrollment(ctx, userID, "encrypted-secret"); err != nil {
+		t.Fatalf("put pending enrollment: %v", err)
+	}
+	enrollment, found, err := store.GetEnrollment(ctx, userID)
+	if err != nil || !found || enrollment.Enabled {
+		t.Fatalf("expected pending enrollment, got found=%t enrollment=%+v err=%v", found, enrollment, err)
+	}
+
+	const recoveryHash = "recovery-hash-real-pg"
+	if err := store.ConfirmEnrollment(ctx, userID, enrollment.EncryptedSecret, []string{recoveryHash}); err != nil {
+		t.Fatalf("confirm enrollment: %v", err)
+	}
+	enrollment, found, err = store.GetEnrollment(ctx, userID)
+	if err != nil || !found || !enrollment.Enabled {
+		t.Fatalf("expected enabled enrollment, got found=%t enrollment=%+v err=%v", found, enrollment, err)
+	}
+
+	challengeHash := "challenge-hash-real-pg-" + uuid.NewString()
+	if err := store.CreateChallenge(ctx, challengeHash, ports.MFAChallenge{UserID: userID, ExpiresAt: time.Now().Add(time.Minute)}); err != nil {
+		t.Fatalf("create challenge: %v", err)
+	}
+	consumeChallengeConcurrently(t, store, challengeHash, userID)
+
+	consumeRecoveryCodeConcurrently(t, store, userID, recoveryHash)
+	if err := store.Disable(ctx, userID); err != nil {
+		t.Fatalf("disable MFA: %v", err)
+	}
+	if _, found, err := store.GetEnrollment(ctx, userID); err != nil || found {
+		t.Fatalf("expected disable to remove enrollment, found=%t err=%v", found, err)
+	}
+}
+
+func consumeChallengeConcurrently(t *testing.T, store *PostgresMFAStore, hash string, wantUser uuid.UUID) {
+	t.Helper()
+	const callers = 16
+	start := make(chan struct{})
+	results := make(chan struct {
+		challenge ports.MFAChallenge
+		found     bool
+		err       error
+	}, callers)
+	var wg sync.WaitGroup
+	for i := 0; i < callers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			challenge, found, err := store.ConsumeChallenge(context.Background(), hash)
+			results <- struct {
+				challenge ports.MFAChallenge
+				found     bool
+				err       error
+			}{challenge: challenge, found: found, err: err}
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(results)
+
+	winners := 0
+	for result := range results {
+		if result.err != nil {
+			t.Fatalf("concurrent challenge consume: %v", result.err)
+		}
+		if result.found {
+			winners++
+			if result.challenge.UserID != wantUser {
+				t.Fatalf("challenge winner returned user %s, want %s", result.challenge.UserID, wantUser)
+			}
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one real-database challenge winner, got %d", winners)
+	}
+}
+
+func consumeRecoveryCodeConcurrently(t *testing.T, store *PostgresMFAStore, userID uuid.UUID, hash string) {
+	t.Helper()
+	const callers = 16
+	start := make(chan struct{})
+	results := make(chan struct {
+		used bool
+		err  error
+	}, callers)
+	var wg sync.WaitGroup
+	for i := 0; i < callers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			used, err := store.ConsumeRecoveryCode(context.Background(), userID, hash)
+			results <- struct {
+				used bool
+				err  error
+			}{used: used, err: err}
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(results)
+
+	winners := 0
+	for result := range results {
+		if result.err != nil {
+			t.Fatalf("concurrent recovery-code consume: %v", result.err)
+		}
+		if result.used {
+			winners++
+		}
+	}
+	if winners != 1 {
+		t.Fatalf("expected exactly one real-database recovery-code winner, got %d", winners)
+	}
+}

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/model.go.hbs

@@ -0,0 +1,84 @@
+// Package postgres contains the user module's PostgreSQL adapters and their
+// persistence-only records. These types never cross into application code.
+package postgres
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type User struct {
+	ID            uuid.UUID `gorm:"type:uuid;primaryKey"`
+	Email         string    `gorm:"uniqueIndex:idx_users_email;not null"`
+	Name          string
+	AvatarURL     string
+	EmailVerified bool
+	Role          string `gorm:"type:varchar(20);not null;default:'staff'"`
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+func (User) TableName() string { return "user_svc.users" }
+
+type Identity struct {
+	ID           uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID       uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
+	Provider     string    `gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
+	PasswordHash *string
+	ProviderUID  *string `gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+func (Identity) TableName() string { return "user_svc.identities" }
+
+type AuthToken struct {
+	TokenHash         string     `gorm:"primaryKey;type:text"`
+	UserID            uuid.UUID  `gorm:"type:uuid;not null;index:idx_auth_tokens_user_kind,priority:1"`
+	Kind              string     `gorm:"type:varchar(20);not null;index:idx_auth_tokens_user_kind,priority:2"`
+	ExpiresAt         time.Time  `gorm:"not null;index:idx_auth_tokens_expires_at"`
+	AbsoluteExpiresAt *time.Time `gorm:"index:idx_auth_tokens_absolute_expires_at"`
+	Provider          string     `gorm:"type:varchar(20);not null;default:''"`
+	CodeChallenge     string     `gorm:"type:text;not null;default:''"`
+	Nonce             string     `gorm:"type:text;not null;default:''"`
+	CreatedAt         time.Time
+}
+
+func (AuthToken) TableName() string { return "user_svc.auth_tokens" }
+
+type LoginThrottle struct {
+	EmailHash   string `gorm:"primaryKey;type:text"`
+	Failures    int    `gorm:"not null;default:0"`
+	LockedUntil *time.Time
+	UpdatedAt   time.Time
+}
+
+func (LoginThrottle) TableName() string { return "user_svc.login_throttle" }
+
+type MFAEnrollment struct {
+	UserID          uuid.UUID `gorm:"type:uuid;primaryKey"`
+	EncryptedSecret string    `gorm:"type:text;not null"`
+	Enabled         bool      `gorm:"not null;default:false"`
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+func (MFAEnrollment) TableName() string { return "user_svc.mfa_enrollments" }
+
+type MFAChallenge struct {
+	ChallengeHash string    `gorm:"type:text;primaryKey"`
+	UserID        uuid.UUID `gorm:"type:uuid;not null;index:idx_mfa_challenges_user"`
+	ExpiresAt     time.Time `gorm:"not null;index:idx_mfa_challenges_expires_at"`
+	CreatedAt     time.Time
+}
+
+func (MFAChallenge) TableName() string { return "user_svc.mfa_challenges" }
+
+type MFARecoveryCode struct {
+	UserID    uuid.UUID `gorm:"type:uuid;primaryKey;index:idx_mfa_recovery_codes_user"`
+	CodeHash  string    `gorm:"type:text;primaryKey"`
+	CreatedAt time.Time
+}
+
+func (MFARecoveryCode) TableName() string { return "user_svc.mfa_recovery_codes" }

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository.go.hbs

@@ -0,0 +1,211 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/app/user/ports"
+	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/shared/tx"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+var _ ports.UserRepository = (*Repository)(nil)
+
+func NewRepository(db *gorm.DB) *Repository {
+	return &Repository{db: db}
+}
+
+func (r *Repository) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
+	var row User
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "email = ?", email).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUser(&row), nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
+	var row User
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "id = ?", id).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUser(&row), nil
+}
+
+func (r *Repository) UpdateUser(ctx context.Context, user *domain.User) error {
+	row := fromDomainUser(user)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+}
+
+func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.User, error) {
+	var rows []User
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Order("created_at desc").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, persistenceError(err)
+	}
+	items := make([]domain.User, len(rows))
+	for i := range rows {
+		items[i] = *toDomainUser(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) (*domain.Identity, error) {
+	var row Identity
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		First(&row, "user_id = ? AND provider = ?", userID, string(provider)).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainIdentity(&row), nil
+}
+
+func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider domain.Provider, providerUID string) (*domain.Identity, error) {
+	var row Identity
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		First(&row, "provider = ? AND provider_uid = ?", string(provider), providerUID).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainIdentity(&row), nil
+}
+
+// CreateIdentity links a new login method onto an existing user.
+func (r *Repository) CreateIdentity(ctx context.Context, identity *domain.Identity) error {
+	row := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Create(&row).Error)
+}
+
+func (r *Repository) UpdateIdentity(ctx context.Context, identity *domain.Identity) error {
+	row := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+}
+
+// CreateUserWithIdentity inserts the profile and its first login method in
+// one transaction. A user without an identity cannot authenticate.
+func (r *Repository) CreateUserWithIdentity(ctx context.Context, user *domain.User, identity *domain.Identity) error {
+	userRow := fromDomainUser(user)
+	identityRow := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
+		if err := db.Create(&userRow).Error; err != nil {
+			return persistenceError(err)
+		}
+		identityRow.UserID = userRow.ID
+		return persistenceError(db.Create(&identityRow).Error)
+	}))
+}
+
+func (r *Repository) LoginLockedUntil(ctx context.Context, key string) (time.Time, error) {
+	var row LoginThrottle
+	err := tx.From(ctx, r.db).WithContext(ctx).Where("email_hash = ?", key).Take(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return time.Time{}, nil
+	}
+	if err != nil || row.LockedUntil == nil {
+		return time.Time{}, persistenceError(err)
+	}
+	return *row.LockedUntil, nil
+}
+
+// RecordLoginFailure uses one SQL statement so concurrent attempts cannot
+// both read and write the same backoff value.
+func (r *Repository) RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error {
+	err := tx.From(ctx, r.db).WithContext(ctx).Exec(`
+		INSERT INTO user_svc.login_throttle AS t (email_hash, failures, locked_until, updated_at)
+		VALUES (?, 1, NULL, now())
+		ON CONFLICT (email_hash) DO UPDATE SET
+			failures = t.failures + 1,
+			locked_until = CASE
+				WHEN t.failures + 1 <= ? THEN NULL
+				ELSE now() + make_interval(secs => least(power(2, t.failures + 1 - ?), ?))
+			END,
+			updated_at = now()`,
+		key, freeAttempts, freeAttempts, maxLock.Seconds()).Error
+	return persistenceError(err)
+}
+
+func (r *Repository) ClearLoginFailures(ctx context.Context, key string) error {
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Where("email_hash = ?", key).
+		Delete(&LoginThrottle{}).Error
+	return persistenceError(err)
+}
+
+func persistenceError(err error) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return domain.ErrNotFound
+	}
+	if dberr.IsDuplicate(err) {
+		return domain.ErrConflict
+	}
+	return err
+}
+
+func toDomainUser(row *User) *domain.User {
+	if row == nil {
+		return nil
+	}
+	return &domain.User{
+		ID:            row.ID,
+		Email:         row.Email,
+		Name:          row.Name,
+		AvatarURL:     row.AvatarURL,
+		EmailVerified: row.EmailVerified,
+		Role:          row.Role,
+		CreatedAt:     row.CreatedAt,
+		UpdatedAt:     row.UpdatedAt,
+	}
+}
+
+func fromDomainUser(user *domain.User) User {
+	return User{
+		ID:            user.ID,
+		Email:         user.Email,
+		Name:          user.Name,
+		AvatarURL:     user.AvatarURL,
+		EmailVerified: user.EmailVerified,
+		Role:          user.Role,
+		CreatedAt:     user.CreatedAt,
+		UpdatedAt:     user.UpdatedAt,
+	}
+}
+
+func toDomainIdentity(row *Identity) *domain.Identity {
+	if row == nil {
+		return nil
+	}
+	return &domain.Identity{
+		ID:           row.ID,
+		UserID:       row.UserID,
+		Provider:     domain.Provider(row.Provider),
+		PasswordHash: row.PasswordHash,
+		ProviderUID:  row.ProviderUID,
+		CreatedAt:    row.CreatedAt,
+		UpdatedAt:    row.UpdatedAt,
+	}
+}
+
+func fromDomainIdentity(identity *domain.Identity) Identity {
+	return Identity{
+		ID:           identity.ID,
+		UserID:       identity.UserID,
+		Provider:     string(identity.Provider),
+		PasswordHash: identity.PasswordHash,
+		ProviderUID:  identity.ProviderUID,
+		CreatedAt:    identity.CreatedAt,
+		UpdatedAt:    identity.UpdatedAt,
+	}
+}
+
+// go-scaffold:repository-methods
+// go-scaffold:user-repository-methods

package/templates/add/auth/internal/app/user/{repository_test.go.hbs → adapters/outbound/postgres/repository_test.go.hbs}

@@ -1,14 +1,13 @@
-package user
+package postgres
 
 import (
-	"time"
 	"context"
 	"errors"
 	"os"
 	"testing"
+	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
@@ -73,22 +72,22 @@ func TestRepository_CreateUserWithIdentity_RollsBackBothOnIdentityConflict(t *te
 	ctx := context.Background()
 
 	providerUID := "conflicting-provider-uid"
-	existing := &model.User{ID: uuid.New(), Email: "first@example.com"}
-	if err := repo.CreateUserWithIdentity(ctx, existing, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID,
+	existing := &domain.User{ID: uuid.New(), Email: "first@example.com"}
+	if err := repo.CreateUserWithIdentity(ctx, existing, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
 	}); err != nil {
 		t.Fatalf("seed existing user+identity: %v", err)
 	}
 
-	blocked := &model.User{ID: uuid.New(), Email: "second@example.com"}
-	err := repo.CreateUserWithIdentity(ctx, blocked, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID,
+	blocked := &domain.User{ID: uuid.New(), Email: "second@example.com"}
+	err := repo.CreateUserWithIdentity(ctx, blocked, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
 	})
-	if !dberr.IsDuplicate(err) {
-		t.Fatalf("want a duplicate-key error from the conflicting provider_uid, got %v", err)
+	if !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("want a mapped user conflict from the conflicting provider_uid, got %v", err)
 	}
 
-	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, gorm.ErrRecordNotFound) {
+	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, domain.ErrNotFound) {
 		t.Fatalf("the new user must not survive a transaction whose identity insert failed, got %v", findErr)
 	}
 }
@@ -103,17 +102,17 @@ func TestRepository_CreateUserWithIdentity_DuplicateEmailIsDetectable(t *testing
 	ctx := context.Background()
 
 	email := "dup@example.com"
-	if err := repo.CreateUserWithIdentity(ctx, &model.User{ID: uuid.New(), Email: email}, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderLocal,
+	if err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderLocal,
 	}); err != nil {
 		t.Fatalf("seed first user: %v", err)
 	}
 
-	err := repo.CreateUserWithIdentity(ctx, &model.User{ID: uuid.New(), Email: email}, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderLocal,
+	err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderLocal,
 	})
-	if !dberr.IsDuplicate(err) {
-		t.Fatalf("want a duplicate-key error for the reused email, got %v", err)
+	if !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("want a mapped user conflict for the reused email, got %v", err)
 	}
 }