@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/errors.go.hbs

@@ -1,43 +0,0 @@
-package user
-
-import (
-	"net/http"
-
-	"{{goModule}}/internal/shared/apperror"
-)
-
-// functions, not vars: the error middleware writes RequestID onto the
-// returned pointer directly — a shared instance would race across
-// concurrent requests.
-
-func errNotFound() *apperror.AppError {
-	return apperror.New(http.StatusNotFound, "USER_NOT_FOUND", "user not found")
-}
-
-func errEmailTaken() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "USER_EMAIL_TAKEN", "email already registered")
-}
-
-// errInvalidCredentials is returned for both "no such user" and "wrong
-// password" — a single generic message so a login attempt can't be used to
-// enumerate which emails have accounts.
-// errTooManyAttempts is the account-level lockout, distinct from the per-IP
-// RATE_LIMITED the middleware returns: this one follows the account wherever
-// the attempts come from.
-func errTooManyAttempts() *apperror.AppError {
-	return apperror.New(http.StatusTooManyRequests, "AUTH_TOO_MANY_ATTEMPTS", "too many failed attempts — try again later")
-}
-
-func errInvalidCredentials() *apperror.AppError {
-	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_CREDENTIALS", "invalid email or password")
-}
-
-func errInvalidToken() *apperror.AppError {
-	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_TOKEN", "invalid or expired refresh token")
-}
-
-func errAlreadyVerified() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "AUTH_ALREADY_VERIFIED", "email is already verified")
-}
-
-// go-scaffold:user-errors

package/templates/add/auth/internal/app/user/handler.go.hbs

@@ -1,276 +0,0 @@
-package user
-
-import (
-	"net/http"
-	"strings"
-	"time"
-
-	"{{goModule}}/internal/shared/httpx"
-	"{{goModule}}/internal/shared/middleware"
-	// go-scaffold:user-handler-imports
-
-	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
-)
-
-const (
-	refreshCookieName = "refresh_token"
-	// oauthStateCookieName holds the nonce that binds a Google login to the
-	// browser that started it — see Service.GoogleLoginURL.
-	oauthStateCookieName = "oauth_state"
-)
-
-// go-scaffold:user-handler-consts
-
-type Handler struct {
-	svc            *Service
-	jwtSecret      string
-	refreshTTL     time.Duration
-	cookieSecure   bool
-	cookieSameSite string
-	// limiter, not a *redis.Client: which backing store counts the requests is
-	// decided by `add auth --store`, and this file must not care.
-	limiter middleware.Limiter
-	// go-scaffold:user-handler-fields
-}
-
-func NewHandler(
-	svc *Service,
-	jwtSecret string,
-	refreshTTL time.Duration,
-	cookieSecure bool,
-	cookieSameSite string,
-	limiter middleware.Limiter,
-	// go-scaffold:user-handler-params
-) *Handler {
-	return &Handler{
-		svc:            svc,
-		jwtSecret:      jwtSecret,
-		refreshTTL:     refreshTTL,
-		cookieSecure:   cookieSecure,
-		cookieSameSite: cookieSameSite,
-		limiter:        limiter,
-		// go-scaffold:user-handler-init
-	}
-}
-
-// Register wires both a public /auth group (register/login/refresh/logout)
-// and a /users group gated by RequireAuth — public vs protected is decided
-// here, per domain, not centrally in main.go.
-func (h *Handler) Register(rg gin.IRouter) {
-	// per-IP, per-route budgets — separate names so a burst on one endpoint
-	// doesn't spend another's budget. refresh/logout/google aren't limited:
-	// refresh/logout are gated by possessing a valid cookie already, and the
-	// Google flow's abuse surface lives on Google's side, not ours.
-	loginLimit := middleware.RateLimit(h.limiter, "login", 10, time.Minute)
-	registerLimit := middleware.RateLimit(h.limiter, "register", 5, time.Minute)
-	forgotPasswordLimit := middleware.RateLimit(h.limiter, "forgot-password", 5, time.Minute)
-	resetPasswordLimit := middleware.RateLimit(h.limiter, "reset-password", 10, time.Minute)
-	verifyEmailLimit := middleware.RateLimit(h.limiter, "verify-email", 10, time.Minute)
-	resendVerificationLimit := middleware.RateLimit(h.limiter, "resend-verification", 5, time.Minute)
-
-	authGroup := rg.Group("/auth")
-	authGroup.POST("/register", registerLimit, h.register)
-	authGroup.POST("/login", loginLimit, h.login)
-	authGroup.POST("/refresh", h.refresh)
-	authGroup.POST("/logout", h.logout)
-	authGroup.POST("/forgot-password", forgotPasswordLimit, h.forgotPassword)
-	authGroup.POST("/reset-password", resetPasswordLimit, h.resetPassword)
-	authGroup.POST("/verify-email", verifyEmailLimit, h.verifyEmail)
-	authGroup.GET("/google/login", h.googleLogin)
-	authGroup.GET("/google/callback", h.googleCallback)
-
-	usersGroup := rg.Group("/users", middleware.RequireAuth(h.jwtSecret))
-	usersGroup.GET("/me", h.me)
-	usersGroup.POST("/me/resend-verification", resendVerificationLimit, h.resendVerification)
-	usersGroup.POST("/me/logout-all", h.logoutAll)
-	// go-scaffold:user-routes
-}
-
-func (h *Handler) register(c *gin.Context) {
-	var in registerInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	auth, err := h.svc.Register(c.Request.Context(), in)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusCreated, toCookieResponse(auth))
-}
-
-func (h *Handler) login(c *gin.Context) {
-	var in loginInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	auth, err := h.svc.Login(c.Request.Context(), in)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) refresh(c *gin.Context) {
-	raw, err := c.Cookie(refreshCookieName)
-	if err != nil || raw == "" {
-		c.Error(errInvalidToken())
-		return
-	}
-	auth, err := h.svc.Refresh(c.Request.Context(), raw)
-	if err != nil {
-		h.clearRefreshCookie(c)
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) logout(c *gin.Context) {
-	raw, _ := c.Cookie(refreshCookieName)
-	_ = h.svc.Logout(c.Request.Context(), raw)
-	h.clearRefreshCookie(c)
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) forgotPassword(c *gin.Context) {
-	var in forgotPasswordInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
-		c.Error(err)
-		return
-	}
-	// always the same response, whether or not the email exists — see
-	// Service.ForgotPassword for why.
-	c.JSON(http.StatusOK, gin.H{"message": "if that email exists, a reset link has been sent"})
-}
-
-func (h *Handler) resetPassword(c *gin.Context) {
-	var in resetPasswordInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) verifyEmail(c *gin.Context) {
-	var in verifyEmailInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) resendVerification(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	if err := h.svc.ResendVerificationEmail(c.Request.Context(), userID); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-// logoutAll ends every session for the caller, not just the one making the
-// request — also clears this request's own cookie, since that session is
-// dead too now.
-func (h *Handler) logoutAll(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	if err := h.svc.LogoutAll(c.Request.Context(), userID); err != nil {
-		c.Error(err)
-		return
-	}
-	h.clearRefreshCookie(c)
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) googleLogin(c *gin.Context) {
-	url, nonce, err := h.svc.GoogleLoginURL()
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	// Lax, not Strict, and deliberately not h.cookieSameSite: the callback
-	// arrives as a top-level navigation from Google, i.e. cross-site, and a
-	// Strict cookie is not sent on one — the flow would fail every time.
-	c.SetSameSite(http.SameSiteLaxMode)
-	c.SetCookie(oauthStateCookieName, nonce, int(oauthStateTTL.Seconds()), "/", "", h.cookieSecure, true)
-	c.Redirect(http.StatusFound, url)
-}
-
-func (h *Handler) googleCallback(c *gin.Context) {
-	nonce, _ := c.Cookie(oauthStateCookieName)
-	// One shot, whatever happens next.
-	c.SetSameSite(http.SameSiteLaxMode)
-	c.SetCookie(oauthStateCookieName, "", -1, "/", "", h.cookieSecure, true)
-
-	auth, err := h.svc.GoogleCallback(c.Request.Context(), c.Query("code"), c.Query("state"), nonce)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) me(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	u, err := h.svc.Get(c.Request.Context(), userID)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	c.JSON(http.StatusOK, toMeResponse(u))
-}
-
-// go-scaffold:user-handler-funcs
-
-func (h *Handler) setRefreshCookie(c *gin.Context, token string) {
-	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
-	c.SetCookie(refreshCookieName, token, int(h.refreshTTL.Seconds()), "/", "", h.cookieSecure, true)
-}
-
-func (h *Handler) clearRefreshCookie(c *gin.Context) {
-	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
-	c.SetCookie(refreshCookieName, "", -1, "/", "", h.cookieSecure, true)
-}
-
-// sameSiteFrom maps COOKIE_SAMESITE onto the http constant, defaulting to the
-// strictest option for anything it doesn't recognise.
-//
-// "strict" is right while the frontend and this API are the same site
-// (localhost:3000 -> localhost:8080 is, and so is app.example.com ->
-// api.example.com). A frontend on a genuinely different site — the usual
-// vercel.app-plus-own-API-domain split — needs "none", because the browser
-// will not attach a Strict or Lax cookie to the fetch that calls
-// /auth/refresh: sessions then die at every access-token expiry with no
-// error anywhere to explain it. "none" requires COOKIE_SECURE=true.
-func sameSiteFrom(mode string) http.SameSite {
-	switch strings.ToLower(mode) {
-	case "none":
-		return http.SameSiteNoneMode
-	case "lax":
-		return http.SameSiteLaxMode
-	default:
-		return http.SameSiteStrictMode
-	}
-}

package/templates/add/auth/internal/app/user/jwt.go.hbs

@@ -1,108 +0,0 @@
-package user
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"crypto/subtle"
-	"encoding/hex"
-	"time"
-
-	"github.com/golang-jwt/jwt/v5"
-	"github.com/google/uuid"
-)
-
-const (
-	tokenTypeAccess     = "access"
-	tokenTypeOAuthState = "oauth_state"
-	oauthStateTTL       = 10 * time.Minute
-)
-
-// accessClaims — see internal/shared/middleware/auth.go for why this struct
-// is duplicated there instead of imported. Also reused (with no Subject) for
-// the Google OAuth CSRF state token below — Typ is what stops one kind being
-// presented where the other is expected.
-type accessClaims struct {
-	Typ string `json:"typ"`
-	// Nonce is only set on the OAuth state token — see issueOAuthState.
-	Nonce string `json:"nonce,omitempty"`
-	// go-scaffold:jwt-claims
-	jwt.RegisteredClaims
-}
-
-func (s *Service) issueAccessToken(
-	userID uuid.UUID,
-	// go-scaffold:issue-access-token-params
-) (string, error) {
-	claims := accessClaims{
-		Typ: tokenTypeAccess,
-		// go-scaffold:jwt-claims-values
-		RegisteredClaims: jwt.RegisteredClaims{
-			Subject:   userID.String(),
-			IssuedAt:  jwt.NewNumericDate(time.Now()),
-			ExpiresAt: jwt.NewNumericDate(time.Now().Add(s.accessTTL)),
-		},
-	}
-	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
-}
-
-// issueOAuthState / verifyOAuthState round-trip a short-lived CSRF token
-// through Google's own redirect. The signature and TTL are not the whole
-// protection: a signed-but-unbound state is one anyone can fetch from
-// GET /auth/google/login and then replay in a victim's browser, which is
-// exactly the login-CSRF the state parameter exists to stop. So the token
-// carries a nonce that the handler also drops in a short-lived httpOnly
-// cookie, and the callback only proceeds when the two agree — the state is
-// then usable in one browser only, the one that started the flow.
-//
-// Returns the state and the nonce to put in that cookie.
-func (s *Service) issueOAuthState() (string, string, error) {
-	nonce, err := randomToken()
-	if err != nil {
-		return "", "", err
-	}
-	claims := accessClaims{
-		Typ:   tokenTypeOAuthState,
-		Nonce: nonce,
-		RegisteredClaims: jwt.RegisteredClaims{
-			IssuedAt:  jwt.NewNumericDate(time.Now()),
-			ExpiresAt: jwt.NewNumericDate(time.Now().Add(oauthStateTTL)),
-		},
-	}
-	state, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(s.jwtSecret))
-	if err != nil {
-		return "", "", err
-	}
-	return state, nonce, nil
-}
-
-func (s *Service) verifyOAuthState(raw, nonce string) error {
-	var claims accessClaims
-	_, err := jwt.ParseWithClaims(raw, &claims, func(*jwt.Token) (any, error) {
-		return []byte(s.jwtSecret), nil
-	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Name}))
-	if err != nil || claims.Typ != tokenTypeOAuthState {
-		return errInvalidToken()
-	}
-	// A missing cookie is a mismatch, not a pass — otherwise stripping the
-	// cookie is all it takes to get the old, unbound behavior back.
-	if nonce == "" || subtle.ConstantTimeCompare([]byte(claims.Nonce), []byte(nonce)) != 1 {
-		return errInvalidToken()
-	}
-	return nil
-}
-
-// randomToken generates an opaque refresh token — deliberately not a JWT:
-// nothing needs to read claims out of it, and only its hash (see hashToken)
-// is ever stored, so a leaked server-side store never exposes usable tokens.
-func randomToken() (string, error) {
-	b := make([]byte, 32)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(b), nil
-}
-
-func hashToken(raw string) string {
-	sum := sha256.Sum256([]byte(raw))
-	return hex.EncodeToString(sum[:])
-}

package/templates/add/auth/internal/app/user/model/authtoken.go.hbs

@@ -1,39 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// AuthToken is one short-lived token — the Postgres equivalent of the keys the
-// Redis store would hold. Only the SHA-256 hash of the raw token is stored, so
-// a database dump never yields a usable token.
-//
-// `Kind` mirrors the Redis key prefixes one-for-one, deliberately:
-//
-//	refresh       an active refresh token
-//	refresh_used  a tombstone left by rotation, so replaying a rotated-out
-//	              token is detectable as reuse rather than merely unknown
-//	pwreset       password reset, consumed once
-//	emailverify   email verification, consumed once
-//
-// Keeping the tombstone a separate row (rather than a used_at column on the
-// refresh row) is what preserves logout's semantics: logout deletes the row
-// outright and leaves no tombstone, so someone replaying a logged-out token
-// gets a plain rejection instead of tripping reuse detection and nuking every
-// session the user has.
-//
-// No foreign key to users on purpose: GORM's AutoMigrate (dev) wouldn't create
-// one from these tags, and a constraint that exists in production but not in
-// development is the exact mismatch that stops the app booting. A token whose
-// user is gone simply fails the lookup that follows.
-type AuthToken struct {
-	TokenHash string    `gorm:"primaryKey;type:text"`
-	UserID    uuid.UUID `gorm:"type:uuid;not null;index:idx_auth_tokens_user_kind,priority:1"`
-	Kind      string    `gorm:"type:varchar(20);not null;index:idx_auth_tokens_user_kind,priority:2"`
-	ExpiresAt time.Time `gorm:"not null;index:idx_auth_tokens_expires_at"`
-	CreatedAt time.Time
-}
-
-func (AuthToken) TableName() string { return "user_svc.auth_tokens" }

package/templates/add/auth/internal/app/user/model/identity.go.hbs

@@ -1,31 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type Provider string
-
-const (
-	ProviderLocal  Provider = "local"
-	ProviderGoogle Provider = "google"
-)
-
-// Identity = how you log in (one row per login method). PasswordHash is set
-// for a "local" identity; ProviderUID is set for "google" (the provider's own
-// subject id). Split from User so adding a login method never touches the
-// profile row — one person can have both and resolve to the same account.
-type Identity struct {
-	ID           uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
-	UserID       uuid.UUID `json:"user_id" gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
-	Provider     Provider  `json:"provider" gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
-	PasswordHash *string   `json:"-"`
-	ProviderUID  *string   `json:"-" gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
-	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt    time.Time `json:"updated_at"`
-}
-
-// TableName — see User.TableName; same schema, same reasoning.
-func (Identity) TableName() string { return "user_svc.identities" }

package/templates/add/auth/internal/app/user/model/loginthrottle.go.hbs

@@ -1,26 +0,0 @@
-package model
-
-import "time"
-
-// LoginThrottle is the failed-attempt counter that makes lockout survive a
-// deploy and mean the same thing on every replica. It is not the rate limiter
-// — that one counts requests per IP and is allowed to be approximate. This
-// counts failures per account, and per OWASP that is the control that actually
-// stops credential stuffing: an attacker with a proxy pool keeps per-IP volume
-// under any threshold you set, but they cannot spread attempts against one
-// account across accounts.
-//
-// EmailHash, not the address: the counter has to be keyed on what the caller
-// typed whether or not an account exists — otherwise "did this get throttled"
-// answers "does this account exist" — and hashing means this table never
-// becomes a directory of who has signed up.
-type LoginThrottle struct {
-	EmailHash string `gorm:"primaryKey;type:text"`
-	Failures  int    `gorm:"not null;default:0"`
-	// nil until the free attempts are spent; afterwards it moves further out
-	// with each failure.
-	LockedUntil *time.Time
-	UpdatedAt   time.Time
-}
-
-func (LoginThrottle) TableName() string { return "user_svc.login_throttle" }

package/templates/add/auth/internal/app/user/model/user.go.hbs

@@ -1,30 +0,0 @@
-// Package model holds this domain's GORM tables.
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// User = who you are (profile). How you log in is a separate concept — see
-// Identity — so the same person can have both a password and a Google login
-// resolving to one account.
-type User struct {
-	ID            uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
-	// index named explicitly, and named the same in create_users.up.sql: an
-	// anonymous `uniqueIndex` makes GORM invent one, and AutoMigrate then
-	// tries to DROP the differently-named constraint the migration created.
-	Email         string    `json:"email" gorm:"uniqueIndex:idx_users_email;not null"`
-	Name          string    `json:"name"`
-	AvatarURL     string    `json:"avatar_url"`
-	EmailVerified bool      `json:"email_verified"`
-	// go-scaffold:user-fields
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
-}
-
-// TableName pins this to user_svc rather than GORM's default inflection
-// ("users", schema-less) — every domain gets its own schema, see
-// docs/architect/patterns.md.
-func (User) TableName() string { return "user_svc.users" }