@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/application/recovery_service.go.hbs

@@ -0,0 +1,112 @@
+package application
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+// ForgotPassword always returns success from the caller's perspective. Only a
+// local password identity gets a token, so this endpoint cannot enumerate
+// accounts or issue a reset for an external-only account.
+func (s *Service) ForgotPassword(ctx context.Context, email string) error {
+	key := throttleKey("pwreset", email)
+	if s.throttled(ctx, key) {
+		return nil
+	}
+	if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
+		slog.Error("record password reset attempt", "error", err)
+	}
+
+	u, err := s.repo.FindByEmail(ctx, normalizeEmail(email))
+	if err != nil {
+		return nil
+	}
+	ident, err := s.repo.FindIdentity(ctx, u.ID, domain.ProviderLocal)
+	if err != nil || ident.PasswordHash == nil {
+		return nil
+	}
+
+	raw, err := randomToken()
+	if err != nil {
+		return fmt.Errorf("generate password reset token: %w", err)
+	}
+	if err := s.recoveryTokens.SetPasswordResetToken(ctx, hashToken(raw), u.ID, s.config.PasswordResetTTL); err != nil {
+		return fmt.Errorf("store password reset token: %w", err)
+	}
+
+	link := s.config.PasswordResetURL + "?token=" + raw
+	if err := s.mailer.Send(ctx, u.Email, "Reset your password", "Reset your password: "+link); err != nil {
+		// The token is stored already. Log the delivery failure so it is visible
+		// operationally while preserving the anti-enumeration response.
+		slog.Error("send password reset email", "error", err)
+	}
+	return nil
+}
+
+// ResetPassword consumes a one-time token and updates the local identity in
+// one transaction, then revokes all sessions. If the cross-store revoke fails,
+// restoring the token lets the caller retry the complete operation.
+func (s *Service) ResetPassword(ctx context.Context, rawToken, newPassword string) error {
+	tokenHash := hashToken(rawToken)
+	userID, err := s.recovery.ResetPassword(ctx, tokenHash, newPassword)
+	if err != nil {
+		if errors.Is(err, domain.ErrInvalidToken) {
+			return errInvalidToken()
+		}
+		return fmt.Errorf("reset password: %w", err)
+	}
+	if err := s.refreshTokens.RevokeAllRefreshTokens(ctx, userID); err != nil {
+		if restoreErr := s.recoveryTokens.SetPasswordResetToken(ctx, tokenHash, userID, s.config.PasswordResetTTL); restoreErr != nil {
+			return fmt.Errorf("revoke sessions after password reset: %w; restore reset token for retry: %v", err, restoreErr)
+		}
+		return fmt.Errorf("revoke sessions after password reset (reset token restored for retry): %w", err)
+	}
+	return nil
+}
+
+// sendVerificationEmail issues a one-time token and sends its link. It is
+// shared by registration and the authenticated resend flow.
+func (s *Service) sendVerificationEmail(ctx context.Context, u *domain.User) {
+	raw, err := randomToken()
+	if err != nil {
+		slog.Error("generate email verification token", "error", err)
+		return
+	}
+	if err := s.recoveryTokens.SetEmailVerifyToken(ctx, hashToken(raw), u.ID, s.config.EmailVerifyTTL); err != nil {
+		slog.Error("store email verification token", "error", err)
+		return
+	}
+	link := s.config.EmailVerifyURL + "?token=" + raw
+	if err := s.mailer.Send(ctx, u.Email, "Verify your email", "Verify your email: "+link); err != nil {
+		slog.Error("send email verification email", "error", err)
+	}
+}
+
+func (s *Service) ResendVerificationEmail(ctx context.Context, userID uuid.UUID) error {
+	u, err := s.repo.FindByID(ctx, userID)
+	if err != nil {
+		return wrapFindErr(err)
+	}
+	if u.EmailVerified {
+		return errAlreadyVerified()
+	}
+	s.sendVerificationEmail(ctx, u)
+	return nil
+}
+
+func (s *Service) VerifyEmail(ctx context.Context, rawToken string) error {
+	_, err := s.recovery.VerifyEmail(ctx, hashToken(rawToken))
+	if err != nil {
+		if errors.Is(err, domain.ErrInvalidToken) {
+			return errInvalidToken()
+		}
+		return fmt.Errorf("verify email: %w", err)
+	}
+	return nil
+}

package/templates/add/auth/internal/app/user/application/service.go.hbs

@@ -0,0 +1,145 @@
+package application
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/app/user/ports"
+
+	"github.com/google/uuid"
+)
+
+// repository is a package-local name used by focused application tests and
+// generated method extensions. The actual contract is owned by ports.
+type repository = ports.UserRepository
+
+// Service coordinates user authentication use cases. Transport concerns stay
+// in the inbound adapter and persistence concerns stay in outbound adapters.
+type Service struct {
+	repo              ports.UserRepository
+	passwords         ports.PasswordHasher
+	refreshTokens     ports.RefreshTokenStore
+	oauthTransactions ports.OAuthTransactionStore
+	recoveryTokens    ports.RecoveryTokenStore
+	mfa               ports.MFAStore
+	mailer            ports.AuthMailer
+	providers         ProviderRegistry
+	recovery          *Recovery
+	config            AuthConfig
+	roles             ports.RoleChecker
+	now               func() time.Time
+	// go-scaffold:user-service-fields
+}
+
+// NewService is the application composition constructor. It accepts explicit
+// ports and policy rather than a framework or catch-all infrastructure object.
+func NewService(deps Dependencies, cfg AuthConfig) *Service {
+	if deps.Passwords == nil {
+		panic("user application: password hasher is required")
+	}
+	if cfg.JWTAccessTTL <= 0 {
+		cfg.JWTAccessTTL = 15 * time.Minute
+	}
+	if cfg.JWTRefreshTTL <= 0 {
+		cfg.JWTRefreshTTL = 12 * time.Hour
+	}
+	cfg.JWTRefreshMaxTTL = defaultDuration(cfg.JWTRefreshMaxTTL, cfg.JWTRefreshTTL)
+	cfg.OAuthStateTTL = defaultDuration(cfg.OAuthStateTTL, 10*time.Minute)
+	if cfg.MFA.RecoveryCodeCount == 0 {
+		cfg.MFA.RecoveryCodeCount = defaultMFACodes
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	return &Service{
+		repo:              deps.Repository,
+		passwords:         deps.Passwords,
+		refreshTokens:     deps.RefreshTokens,
+		oauthTransactions: deps.OAuthTransactions,
+		recoveryTokens:    deps.RecoveryTokens,
+		mfa:               deps.MFA,
+		mailer:            deps.Mailer,
+		providers:         deps.Providers,
+		recovery:          NewRecovery(deps.Repository, deps.RecoveryTokens, deps.Passwords),
+		config:            cfg,
+		roles:             deps.Roles,
+		now:               clock,
+		// go-scaffold:user-service-init
+	}
+}
+
+func defaultDuration(value, fallback time.Duration) time.Duration {
+	if value > 0 {
+		return value
+	}
+	return fallback
+}
+
+func (s *Service) clock() time.Time {
+	if s.now == nil {
+		return time.Now()
+	}
+	return s.now()
+}
+
+// normalizeEmail is applied at every boundary an address enters the service
+// through. The database stores the canonical lower-case representation.
+func normalizeEmail(email string) string {
+	return strings.ToLower(strings.TrimSpace(email))
+}
+
+// SetRole validates the role against the role catalog before persisting it.
+func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string) (*domain.User, error) {
+	u, err := s.repo.FindByID(ctx, userID)
+	if err != nil {
+		return nil, wrapFindErr(err)
+	}
+	if s.roles == nil {
+		return nil, fmt.Errorf("role checker is not configured")
+	}
+	exists, err := s.roles.CodeExists(ctx, roleCode)
+	if err != nil {
+		return nil, fmt.Errorf("check role code: %w", err)
+	}
+	if !exists {
+		return nil, errUnknownRole()
+	}
+	u.Role = roleCode
+	if err := s.repo.UpdateUser(ctx, u); err != nil {
+		return nil, fmt.Errorf("update user role: %w", err)
+	}
+	return u, nil
+}
+
+// ServicePort is the inbound application boundary. HTTP, jobs, and future
+// transports depend on this capability set instead of the concrete service.
+type ServicePort interface {
+	// go-scaffold:service-interface
+	Register(context.Context, RegisterInput) (*AuthResult, error)
+	Login(context.Context, LoginInput) (*AuthResult, error)
+	Refresh(context.Context, string) (*AuthResponse, error)
+	Logout(context.Context, string) error
+	LogoutAll(context.Context, uuid.UUID) error
+	ForgotPassword(context.Context, string) error
+	ResetPassword(context.Context, string, string) error
+	VerifyEmail(context.Context, string) error
+	ResendVerificationEmail(context.Context, uuid.UUID) error
+	BeginLogin(context.Context, string, LoginStartInput) (*Authorization, error)
+	ExchangeLogin(context.Context, string, LoginExchangeInput) (*AuthResult, error)
+	VerifyMFA(context.Context, string, string) (*AuthResponse, error)
+	MFAStatus(context.Context, uuid.UUID) (MFAStatus, error)
+	SetupMFA(context.Context, uuid.UUID) (*MFASetup, error)
+	ConfirmMFA(context.Context, uuid.UUID, string) ([]string, error)
+	DisableMFA(context.Context, uuid.UUID, string) error
+	Get(context.Context, uuid.UUID) (*domain.User, error)
+	List(context.Context, int, int) ([]domain.User, error)
+	SetRole(context.Context, uuid.UUID, string) (*domain.User, error)
+}
+
+var _ ServicePort = (*Service)(nil)
+
+// go-scaffold:service-methods