@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/rbac/internal/app/role/application/service.go.hbs

@@ -0,0 +1,157 @@
+// Package application contains role management use cases. It owns the rules
+// for permission grants and never imports GORM, Gin, or HTTP error types.
+package application
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"slices"
+
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
+)
+
+type ServicePort interface {
+	PermissionsOf(context.Context, string) (map[string]struct{}, error)
+	CodeExists(context.Context, string) (bool, error)
+	List(context.Context, int, int) ([]RoleListItem, error)
+	Create(context.Context, CreateInput) (*RoleListItem, error)
+	SetPermissions(context.Context, string, []string) (*RoleListItem, error)
+	Delete(context.Context, string) error
+	ListPermissions(context.Context, int, int) ([]domain.Permission, error)
+}
+
+type Service struct {
+	repo ports.Repository
+}
+
+func NewService(repo ports.Repository) *Service { return &Service{repo: repo} }
+
+func (s *Service) PermissionsOf(ctx context.Context, roleCode string) (map[string]struct{}, error) {
+	codes, err := s.repo.PermissionCodes(ctx, roleCode)
+	if err != nil {
+		return nil, err
+	}
+	set := make(map[string]struct{}, len(codes))
+	for _, code := range codes {
+		set[code] = struct{}{}
+	}
+	return set, nil
+}
+
+func (s *Service) CodeExists(ctx context.Context, code string) (bool, error) {
+	if _, err := s.repo.FindByCode(ctx, code); err != nil {
+		if errors.Is(err, domain.ErrNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (s *Service) List(ctx context.Context, limit, offset int) ([]RoleListItem, error) {
+	roles, err := s.repo.FindAll(ctx, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]RoleListItem, len(roles))
+	for i, role := range roles {
+		perms, err := s.repo.PermissionCodes(ctx, role.Code)
+		if err != nil {
+			return nil, err
+		}
+		out[i] = RoleListItem{Role: role, Permissions: perms}
+	}
+	return out, nil
+}
+
+var roleCodePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
+
+func (s *Service) Create(ctx context.Context, in CreateInput) (*RoleListItem, error) {
+	if !roleCodePattern.MatchString(in.Code) {
+		return nil, errInvalidCode()
+	}
+	role := &domain.Role{Code: in.Code, Name: in.Name}
+	if err := s.repo.Create(ctx, role); err != nil {
+		return nil, err
+	}
+	return &RoleListItem{Role: *role, Permissions: []string{}}, nil
+}
+
+func (s *Service) SetPermissions(ctx context.Context, code string, permissionCodes []string) (*RoleListItem, error) {
+	role, err := s.repo.FindByCode(ctx, code)
+	if err != nil {
+		return nil, wrapFindErr(err)
+	}
+	if err := s.validatePermissionCodes(ctx, permissionCodes); err != nil {
+		return nil, err
+	}
+	if !slices.Contains(permissionCodes, PermRoleManage) {
+		isLast, err := s.isLastRoleManager(ctx, code)
+		if err != nil {
+			return nil, err
+		}
+		if isLast {
+			return nil, errLastRoleManager()
+		}
+	}
+	if err := s.repo.SetPermissions(ctx, code, permissionCodes); err != nil {
+		return nil, err
+	}
+	return &RoleListItem{Role: *role, Permissions: permissionCodes}, nil
+}
+
+func (s *Service) validatePermissionCodes(ctx context.Context, codes []string) error {
+	all, err := s.repo.AllPermissionCodes(ctx)
+	if err != nil {
+		return err
+	}
+	valid := make(map[string]struct{}, len(all))
+	for _, code := range all {
+		valid[code] = struct{}{}
+	}
+	for _, code := range codes {
+		if _, ok := valid[code]; !ok {
+			return errUnknownPermission()
+		}
+	}
+	return nil
+}
+
+func (s *Service) Delete(ctx context.Context, code string) error {
+	role, err := s.repo.FindByCode(ctx, code)
+	if err != nil {
+		return wrapFindErr(err)
+	}
+	if role.IsSystem {
+		return errSystemRole()
+	}
+	isLast, err := s.isLastRoleManager(ctx, code)
+	if err != nil {
+		return err
+	}
+	if isLast {
+		return errLastRoleManager()
+	}
+	return s.repo.Delete(ctx, code)
+}
+
+func (s *Service) isLastRoleManager(ctx context.Context, code string) (bool, error) {
+	others, err := s.repo.CountRolesWithPermission(ctx, PermRoleManage, code)
+	if err != nil {
+		return false, err
+	}
+	return others == 0, nil
+}
+
+func (s *Service) ListPermissions(ctx context.Context, limit, offset int) ([]domain.Permission, error) {
+	return s.repo.FindAllPermissions(ctx, limit, offset)
+}
+
+func wrapFindErr(err error) error {
+	if errors.Is(err, domain.ErrNotFound) {
+		return domain.ErrNotFound
+	}
+	return err
+}

package/templates/add/rbac/internal/app/role/{service_test.go.hbs → application/service_test.go.hbs}

@@ -1,4 +1,4 @@
-package role
+package application
 
 import (
 	"context"
@@ -6,8 +6,7 @@ import (
 	"net/http"
 	"testing"
 
-	"{{goModule}}/internal/app/role/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/role/domain"
 )
 
 // fakeRepo = mock of the repository interface, so the service can be tested
@@ -15,7 +14,7 @@ import (
 // than the one being edited currently grant PermRoleManage", exactly what
 // CountRolesWithPermission's excludeCode param means.
 type fakeRepo struct {
-	role                *model.Role
+	role                *domain.Role
 	findErr             error
 	allPermissionCodes  []string
 	countWithPermission int64
@@ -24,38 +23,46 @@ type fakeRepo struct {
 }
 
 func (f *fakeRepo) PermissionCodes(context.Context, string) ([]string, error) { return nil, nil }
-func (f *fakeRepo) FindAll(context.Context, int, int) ([]model.Role, error)   { return nil, nil }
-func (f *fakeRepo) FindByCode(context.Context, string) (*model.Role, error) {
+func (f *fakeRepo) FindAll(context.Context, int, int) ([]domain.Role, error)  { return nil, nil }
+func (f *fakeRepo) FindByCode(context.Context, string) (*domain.Role, error) {
 	if f.findErr != nil {
 		return nil, f.findErr
 	}
 	return f.role, nil
 }
-func (f *fakeRepo) Create(context.Context, *model.Role) error { return nil }
+func (f *fakeRepo) Create(context.Context, *domain.Role) error { return nil }
 func (f *fakeRepo) SetPermissions(context.Context, string, []string) error {
 	return f.setPermissionsErr
 }
 func (f *fakeRepo) Delete(context.Context, string) error { return f.deleteErr }
-func (f *fakeRepo) FindAllPermissions(context.Context, int, int) ([]model.Permission, error) {
+func (f *fakeRepo) FindAllPermissions(context.Context, int, int) ([]domain.Permission, error) {
 	return nil, nil
 }
-func (f *fakeRepo) AllPermissionCodes(context.Context) ([]string, error) { return f.allPermissionCodes, nil }
+func (f *fakeRepo) AllPermissionCodes(context.Context) ([]string, error) {
+	return f.allPermissionCodes, nil
+}
 func (f *fakeRepo) CountRolesWithPermission(context.Context, string, string) (int64, error) {
 	return f.countWithPermission, nil
 }
 
 func status(t *testing.T, err error) int {
 	t.Helper()
-	var appErr *apperror.AppError
-	if !errors.As(err, &appErr) {
-		t.Fatalf("expected *apperror.AppError, got %T: %v", err, err)
+	if errors.Is(err, domain.ErrConflict) || errors.Is(err, domain.ErrSystemRole) || errors.Is(err, domain.ErrLastRoleManager) {
+		return http.StatusConflict
+	}
+	if errors.Is(err, domain.ErrInvalidCode) || errors.Is(err, domain.ErrUnknownPermission) {
+		return http.StatusUnprocessableEntity
+	}
+	if errors.Is(err, domain.ErrNotFound) {
+		return http.StatusNotFound
 	}
-	return appErr.HTTPStatus
+	t.Fatalf("unexpected role error %T: %v", err, err)
+	return 0
 }
 
 func TestService_SetPermissions_LastRoleManagerLockout(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage, "user:read"},
 		countWithPermission: 0, // no OTHER role grants PermRoleManage
 	}
@@ -69,7 +76,7 @@ func TestService_SetPermissions_LastRoleManagerLockout(t *testing.T) {
 
 func TestService_SetPermissions_AllowedWhenAnotherRoleStillManages(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage, "user:read"},
 		countWithPermission: 1, // another role still grants PermRoleManage
 	}
@@ -81,7 +88,7 @@ func TestService_SetPermissions_AllowedWhenAnotherRoleStillManages(t *testing.T)
 
 func TestService_SetPermissions_KeepingRoleManageNeverLocksOut(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage},
 		countWithPermission: 0,
 	}
@@ -93,7 +100,7 @@ func TestService_SetPermissions_KeepingRoleManageNeverLocksOut(t *testing.T) {
 }
 
 func TestService_Delete_LastRoleManagerLockout(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "ops"}, countWithPermission: 0}
+	repo := &fakeRepo{role: &domain.Role{Code: "ops"}, countWithPermission: 0}
 	svc := NewService(repo)
 	err := svc.Delete(context.Background(), "ops")
 	if got := status(t, err); got != http.StatusConflict {
@@ -102,7 +109,7 @@ func TestService_Delete_LastRoleManagerLockout(t *testing.T) {
 }
 
 func TestService_Delete_AllowedWhenAnotherRoleStillManages(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "ops"}, countWithPermission: 1}
+	repo := &fakeRepo{role: &domain.Role{Code: "ops"}, countWithPermission: 1}
 	svc := NewService(repo)
 	if err := svc.Delete(context.Background(), "ops"); err != nil {
 		t.Fatalf("expected delete to succeed when another role still manages roles, got %v", err)
@@ -110,7 +117,7 @@ func TestService_Delete_AllowedWhenAnotherRoleStillManages(t *testing.T) {
 }
 
 func TestService_Delete_SystemRoleRejected(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "admin", IsSystem: true}}
+	repo := &fakeRepo{role: &domain.Role{Code: "admin", IsSystem: true}}
 	svc := NewService(repo)
 	err := svc.Delete(context.Background(), "admin")
 	if got := status(t, err); got != http.StatusConflict {

package/templates/add/rbac/internal/app/role/composition.go.hbs

@@ -0,0 +1,48 @@
+package role
+
+import (
+	"time"
+
+	httpadapter "{{goModule}}/internal/app/role/adapters/inbound/http"
+	"{{goModule}}/internal/app/role/adapters/outbound/postgres"
+	"{{goModule}}/internal/app/role/application"
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
+	"{{goModule}}/internal/shared/middleware"
+
+	"gorm.io/gorm"
+)
+
+// Composition is the only public graph exposed to cmd/api. The feature root
+// owns the role repository, application service, permission cache, and HTTP
+// adapter; process wiring does not construct any of those internals.
+type Composition struct {
+	Service *application.Service
+	Authz   *middleware.Authz
+	Handler *httpadapter.Handler
+}
+
+type Service = application.Service
+type ServicePort = application.ServicePort
+type Repository = postgres.Repository
+type CreateInput = application.CreateInput
+type SetPermissionsInput = application.SetPermissionsInput
+type Role = domain.Role
+type Permission = domain.Permission
+type AuthorizationPort = ports.AuthorizationPort
+
+const PermRoleManage = application.PermRoleManage
+
+func NewServiceFromDB(db *gorm.DB) *Service {
+	return application.NewService(postgres.NewRepository(db))
+}
+
+func NewCompositionFromDB(db *gorm.DB, jwtSecret string, cacheTTL time.Duration) *Composition {
+	service := NewServiceFromDB(db)
+	authz := middleware.NewAuthz(service.PermissionsOf, cacheTTL)
+	return &Composition{
+		Service: service,
+		Authz:   authz,
+		Handler: httpadapter.NewHandler(service, jwtSecret, authz),
+	}
+}

package/templates/add/rbac/internal/app/role/domain/entity.go.hbs

@@ -0,0 +1,23 @@
+// Package domain contains role and permission state without GORM or HTTP
+// concerns.
+package domain
+
+import "time"
+
+type Role struct {
+	Code      string
+	Name      string
+	IsSystem  bool
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+type Permission struct {
+	Code        string
+	Description string
+}
+
+type RolePermission struct {
+	RoleCode       string
+	PermissionCode string
+}

package/templates/add/rbac/internal/app/role/domain/errors.go.hbs

@@ -0,0 +1,26 @@
+package domain
+
+import "errors"
+
+var (
+	ErrNotFound          = errors.New("role not found")
+	ErrConflict          = errors.New("role conflict")
+	ErrHasReferences     = errors.New("role has references")
+	ErrInvalidCode       = errors.New("role code is invalid")
+	ErrSystemRole        = errors.New("system role cannot be changed")
+	ErrUnknownPermission = errors.New("permission does not exist")
+	ErrLastRoleManager   = errors.New("last role manager cannot be removed")
+)
+
+type RuleError struct {
+	Code    string
+	Message string
+	Cause   error
+}
+
+func (e *RuleError) Error() string { return e.Message }
+func (e *RuleError) Unwrap() error { return e.Cause }
+
+func Rule(code, message string, cause error) error {
+	return &RuleError{Code: code, Message: message, Cause: cause}
+}

package/templates/add/rbac/internal/app/role/ports/repository.go.hbs

@@ -0,0 +1,25 @@
+// Package ports contains role's application-owned repository contracts.
+package ports
+
+import (
+	"context"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+type Repository interface {
+	PermissionCodes(context.Context, string) ([]string, error)
+	FindAll(context.Context, int, int) ([]domain.Role, error)
+	FindByCode(context.Context, string) (*domain.Role, error)
+	Create(context.Context, *domain.Role) error
+	SetPermissions(context.Context, string, []string) error
+	Delete(context.Context, string) error
+	FindAllPermissions(context.Context, int, int) ([]domain.Permission, error)
+	AllPermissionCodes(context.Context) ([]string, error)
+	CountRolesWithPermission(context.Context, string, string) (int64, error)
+}
+
+type AuthorizationPort interface {
+	PermissionsOf(context.Context, string) (map[string]struct{}, error)
+	CodeExists(context.Context, string) (bool, error)
+}

package/templates/add/rbac/migrations/add_roles.down.sql.hbs

@@ -1,14 +1,6 @@
--- if an admin created a custom role after this migration and it's still
--- assigned to any user, dropping the roles table would orphan that value —
--- raise a clear, actionable error instead of a raw FK-violation.
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM user_svc.users WHERE role NOT IN ('staff', 'admin')) THEN
-        RAISE EXCEPTION 'cannot roll back add_roles: users still have a role other than staff/admin — reassign them to staff/admin first';
-    END IF;
-END $$;
-
-ALTER TABLE user_svc.users DROP COLUMN role;
+-- Auth owns users.role, so RBAC removes only the constraint it added. The
+-- column and existing assignments remain valid for auth-only operation.
+ALTER TABLE user_svc.users DROP CONSTRAINT IF EXISTS users_role_fkey;
 
 DROP TABLE role_svc.role_permissions;
 DROP TABLE role_svc.permissions;

package/templates/add/rbac/migrations/add_roles.up.sql.hbs

@@ -33,9 +33,20 @@ INSERT INTO role_svc.permissions (code, description) VALUES
 INSERT INTO role_svc.role_permissions (role_code, permission_code)
 SELECT 'admin', code FROM role_svc.permissions;
 
--- cross-schema FK: role_svc's migration is the one place allowed to alter
--- user_svc's table, because this feature's whole point is "give users a
--- role" — see docs/architect/patterns.md's FK rules for why a plain FK, not
--- an app-level existence check, is the right way to enforce this.
-ALTER TABLE user_svc.users
-    ADD COLUMN role VARCHAR(20) NOT NULL DEFAULT 'staff' REFERENCES role_svc.roles(code);
+-- Auth owns the stable users.role column. RBAC owns the role catalog and adds
+-- only the cross-schema constraint after that catalog exists. This keeps each
+-- migration aligned with its module instead of making RBAC recreate auth's
+-- persistence shape.
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint
+        WHERE conname = 'users_role_fkey'
+          AND conrelid = 'user_svc.users'::regclass
+    ) THEN
+        ALTER TABLE user_svc.users
+            ADD CONSTRAINT users_role_fkey
+            FOREIGN KEY (role) REFERENCES role_svc.roles(code);
+    END IF;
+END $$;

package/templates/add/worker/internal/platform/queue/river_test.go.hbs

@@ -0,0 +1,84 @@
+package queue
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+type riverRoundTripJob struct {
+	Marker string `json:"marker"`
+}
+
+func (riverRoundTripJob) Kind() string { return "queue-test-round-trip" }
+
+// TestRiverEnqueueAndWorkerProcess proves the Postgres queue path beyond
+// client construction: a job is written, picked up by the worker adapter,
+// decoded, and handed to the registered backend-neutral handler.
+func TestRiverEnqueueAndWorkerProcess(t *testing.T) {
+	dsn := os.Getenv("TEST_DB_DSN")
+	if dsn == "" {
+		if os.Getenv("REQUIRE_TEST_DB") == "true" {
+			t.Fatal("TEST_DB_DSN is required when REQUIRE_TEST_DB=true")
+		}
+		t.Skip("River integration test skipped: set TEST_DB_DSN to a database with River migrations")
+	}
+
+	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open test database: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get test database handle: %v", err)
+	}
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	worker, err := NewRiverWorker(db, 1)
+	if err != nil {
+		t.Fatalf("create River worker: %v", err)
+	}
+
+	received := make(chan string, 1)
+	worker.Handle((riverRoundTripJob{}).Kind(), func(_ context.Context, raw []byte) error {
+		var job riverRoundTripJob
+		if err := json.Unmarshal(raw, &job); err != nil {
+			return err
+		}
+		received <- job.Marker
+		return nil
+	})
+
+	workerCtx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		cancel()
+		stopCtx, stopCancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer stopCancel()
+		if err := worker.Stop(stopCtx); err != nil {
+			t.Errorf("stop River worker: %v", err)
+		}
+	})
+	if err := worker.Start(workerCtx); err != nil {
+		t.Fatalf("start River worker: %v", err)
+	}
+
+	expected := uuid.NewString()
+	if err := worker.Enqueue(context.Background(), riverRoundTripJob{Marker: expected}, nil); err != nil {
+		t.Fatalf("enqueue River job: %v", err)
+	}
+
+	select {
+	case actual := <-received:
+		if actual != expected {
+			t.Fatalf("worker received marker %q, want %q", actual, expected)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("River worker did not process the enqueued job within 10s")
+	}
+}