@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/repository.go.hbs

@@ -1,137 +0,0 @@
-package user
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/tx"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-type Repository struct {
-	db *gorm.DB
-}
-
-func NewRepository(db *gorm.DB) *Repository {
-	return &Repository{db: db}
-}
-
-func (r *Repository) FindByEmail(ctx context.Context, email string) (*model.User, error) {
-	var u model.User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&u, "email = ?", email).Error; err != nil {
-		return nil, err
-	}
-	return &u, nil
-}
-
-func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*model.User, error) {
-	var u model.User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&u, "id = ?", id).Error; err != nil {
-		return nil, err
-	}
-	return &u, nil
-}
-
-func (r *Repository) UpdateUser(ctx context.Context, u *model.User) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Save(u).Error
-}
-
-func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]model.User, error) {
-	var items []model.User
-	err := tx.From(ctx, r.db).WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&items).Error
-	return items, err
-}
-
-func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider model.Provider) (*model.Identity, error) {
-	var i model.Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&i, "user_id = ? AND provider = ?", userID, provider).Error; err != nil {
-		return nil, err
-	}
-	return &i, nil
-}
-
-func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider model.Provider, providerUID string) (*model.Identity, error) {
-	var i model.Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&i, "provider = ? AND provider_uid = ?", provider, providerUID).Error; err != nil {
-		return nil, err
-	}
-	return &i, nil
-}
-
-// CreateIdentity links a new login method onto an EXISTING user (e.g.
-// Google linking onto an account that registered with a password first) —
-// see CreateUserWithIdentity for the "brand new user" case.
-func (r *Repository) CreateIdentity(ctx context.Context, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Create(i).Error
-}
-
-func (r *Repository) UpdateIdentity(ctx context.Context, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Save(i).Error
-}
-
-// CreateUserWithIdentity inserts the profile and its first login method in
-// one transaction — a user with no identity at all can't log in any way, so
-// the two rows always exist together or not at all.
-func (r *Repository) CreateUserWithIdentity(ctx context.Context, u *model.User, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Transaction(func(t *gorm.DB) error {
-		if err := t.Create(u).Error; err != nil {
-			return err
-		}
-		i.UserID = u.ID
-		return t.Create(i).Error
-	})
-}
-
-// --- failed-login throttle -------------------------------------------------
-//
-// Keyed on a caller-supplied hash rather than a user id, because the counter
-// has to work for addresses that have no account — see model.LoginThrottle.
-
-// LoginLockedUntil reports when this key stops being locked out — zero time
-// when it isn't. Read on every login attempt, so it stays a primary-key hit.
-func (r *Repository) LoginLockedUntil(ctx context.Context, key string) (time.Time, error) {
-	var row model.LoginThrottle
-	err := tx.From(ctx, r.db).WithContext(ctx).Where("email_hash = ?", key).Take(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return time.Time{}, nil
-	}
-	if err != nil || row.LockedUntil == nil {
-		return time.Time{}, err
-	}
-	return *row.LockedUntil, nil
-}
-
-// RecordLoginFailure bumps the counter and pushes the lock further out,
-// doubling each time past freeAttempts and never exceeding maxLock.
-//
-// One statement, so two attempts racing cannot both read the same count and
-// write the same lock — which would let an attacker keep the backoff pinned at
-// its first step by running attempts in parallel. Computing the interval in
-// SQL is what buys that; a read-then-write in Go would need a transaction and
-// a row lock to be equally safe.
-func (r *Repository) RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Exec(`
-		INSERT INTO user_svc.login_throttle AS t (email_hash, failures, locked_until, updated_at)
-		VALUES (?, 1, NULL, now())
-		ON CONFLICT (email_hash) DO UPDATE SET
-			failures = t.failures + 1,
-			locked_until = CASE
-				WHEN t.failures + 1 <= ? THEN NULL
-				ELSE now() + make_interval(secs => least(power(2, t.failures + 1 - ?), ?))
-			END,
-			updated_at = now()`,
-		key, freeAttempts, freeAttempts, maxLock.Seconds()).Error
-}
-
-// ClearLoginFailures drops the row on a successful login, so someone who
-// mistypes twice and then gets in starts clean rather than creeping toward a
-// lockout over weeks.
-func (r *Repository) ClearLoginFailures(ctx context.Context, key string) error {
-	return tx.From(ctx, r.db).WithContext(ctx).
-		Where("email_hash = ?", key).
-		Delete(&model.LoginThrottle{}).Error
-}

package/templates/add/auth/internal/app/user/service.go.hbs

@@ -1,531 +0,0 @@
-package user
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"log/slog"
-	"net/http"
-	"strings"
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
-	"{{goModule}}/internal/shared/config"
-	"{{goModule}}/internal/shared/dberr"
-	"{{goModule}}/internal/shared/id"
-
-	"github.com/google/uuid"
-	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/google"
-	"gorm.io/gorm"
-)
-
-// repository = what the service needs from the data layer (declared on the
-// consumer side, so it can be faked in tests).
-type repository interface {
-	FindByEmail(ctx context.Context, email string) (*model.User, error)
-	FindByID(ctx context.Context, id uuid.UUID) (*model.User, error)
-	UpdateUser(ctx context.Context, u *model.User) error
-	FindAll(ctx context.Context, limit, offset int) ([]model.User, error)
-	FindIdentity(ctx context.Context, userID uuid.UUID, provider model.Provider) (*model.Identity, error)
-	FindIdentityByProviderUID(ctx context.Context, provider model.Provider, providerUID string) (*model.Identity, error)
-	CreateUserWithIdentity(ctx context.Context, u *model.User, i *model.Identity) error
-	CreateIdentity(ctx context.Context, i *model.Identity) error
-	UpdateIdentity(ctx context.Context, i *model.Identity) error
-	LoginLockedUntil(ctx context.Context, key string) (time.Time, error)
-	RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error
-	ClearLoginFailures(ctx context.Context, key string) error
-	// go-scaffold:user-repository-interface
-}
-
-// mailer = what the service needs to send an email — satisfied by
-// platform/mail's AsyncClient (enqueues onto cmd/worker instead of blocking
-// the request on SMTP). Takes ctx so the enqueue can join the caller's
-// transaction where the queue backend supports it.
-type mailer interface {
-	Send(ctx context.Context, to, subject, body string) error
-}
-
-// go-scaffold:user-interfaces
-
-type Service struct {
-	repo       repository
-	tokens     tokenStore
-	mailer     mailer
-	jwtSecret  string
-	accessTTL  time.Duration
-	refreshTTL time.Duration
-	resetTTL   time.Duration
-	resetURL   string
-	verifyTTL  time.Duration
-	verifyURL  string
-	googleOAuth *oauth2.Config
-	// go-scaffold:user-service-fields
-}
-
-func NewService(
-	repo repository,
-	tokens tokenStore,
-	mailer mailer,
-	cfg config.Config,
-	// go-scaffold:user-service-params
-) *Service {
-	return &Service{
-		repo:       repo,
-		tokens:     tokens,
-		mailer:     mailer,
-		jwtSecret:  cfg.JWTSecret,
-		accessTTL:  cfg.JWTAccessTTL,
-		refreshTTL: cfg.JWTRefreshTTL,
-		resetTTL:   cfg.PasswordResetTTL,
-		resetURL:   cfg.PasswordResetURL,
-		verifyTTL:  cfg.EmailVerifyTTL,
-		verifyURL:  cfg.EmailVerifyURL,
-		googleOAuth: &oauth2.Config{
-			ClientID:     cfg.GoogleClientID,
-			ClientSecret: cfg.GoogleClientSecret,
-			RedirectURL:  cfg.GoogleRedirectURL,
-			Scopes:       []string{"openid", "email", "profile"},
-			Endpoint:     google.Endpoint,
-		},
-		// go-scaffold:user-service-init
-	}
-}
-
-// normalizeEmail is applied at every boundary an address enters the service
-// through. The column is a plain case-sensitive UNIQUE, so without this
-// "Foo@x.com" and "foo@x.com" are two accounts that never collide — and a
-// Google login (Google always reports lowercase) fails to find the local
-// account it should have linked to, silently creating a second user for the
-// same person.
-func normalizeEmail(email string) string {
-	return strings.ToLower(strings.TrimSpace(email))
-}
-
-// Failed-attempt policy. Constants rather than config: these are a security
-// posture, not something to tune per environment, and every knob added here is
-// a knob someone can quietly widen until the control stops working. Change the
-// numbers if your threat model differs.
-//
-// The first loginFreeAttempts failures cost nothing — a typo shouldn't lock
-// anyone out. After that each failure doubles the wait (1s, 2s, 4s, ...) up to
-// loginMaxLock, which is the shape OWASP's Authentication Cheat Sheet asks for.
-const (
-	loginFreeAttempts = 3
-	loginMaxLock      = 15 * time.Minute
-)
-
-// throttleKey namespaces the counter by what is being attempted, so a locked
-// login never blocks the password-reset that would fix it — someone who forgot
-// their password is exactly the person who trips the login counter.
-//
-// Hashed, because the counter must exist for addresses that have no account
-// (otherwise "was I throttled" answers "does this account exist"), and a table
-// of plain addresses that anyone has ever typed is a user list.
-func throttleKey(purpose, email string) string {
-	return hashToken(purpose + ":" + normalizeEmail(email))
-}
-
-// throttled reports whether this key is inside its lockout window. A failure
-// to read the counter is treated as not-throttled: this is a brake, and it
-// should not be able to lock everybody out on its own.
-func (s *Service) throttled(ctx context.Context, key string) bool {
-	until, err := s.repo.LoginLockedUntil(ctx, key)
-	if err != nil {
-		slog.Error("read login throttle", "error", err)
-		return false
-	}
-	return !until.IsZero() && time.Now().Before(until)
-}
-
-func (s *Service) Register(ctx context.Context, in registerInput) (*authResponse, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	u := &model.User{ID: id.New(), Email: normalizeEmail(in.Email), Name: in.Name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		if dberr.IsDuplicate(err) {
-			return nil, errEmailTaken()
-		}
-		return nil, apperror.NewInternal()
-	}
-	// best-effort: a mail failure shouldn't block registration — the user can
-	// always ask for another link via ResendVerificationEmail.
-	s.sendVerificationEmail(ctx, u)
-	return s.issueTokens(ctx, u)
-}
-
-func (s *Service) Login(ctx context.Context, in loginInput) (*authResponse, error) {
-	key := throttleKey("login", in.Email)
-	if s.throttled(ctx, key) {
-		return nil, errTooManyAttempts()
-	}
-
-	// Every failure below is recorded against the same key whether or not the
-	// account exists, and answers with the same error — so the counter cannot
-	// be used to enumerate accounts either.
-	fail := func() (*authResponse, error) {
-		if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
-			slog.Error("record login failure", "error", err)
-		}
-		return nil, errInvalidCredentials()
-	}
-
-	u, err := s.repo.FindByEmail(ctx, normalizeEmail(in.Email))
-	if err != nil {
-		return fail()
-	}
-	ident, err := s.repo.FindIdentity(ctx, u.ID, model.ProviderLocal)
-	if err != nil || ident.PasswordHash == nil {
-		return fail()
-	}
-	if err := bcrypt.CompareHashAndPassword([]byte(*ident.PasswordHash), []byte(in.Password)); err != nil {
-		return fail()
-	}
-
-	if err := s.repo.ClearLoginFailures(ctx, key); err != nil {
-		slog.Error("clear login failures", "error", err)
-	}
-	return s.issueTokens(ctx, u)
-}
-
-// Refresh rotates a refresh token: the presented one is consumed (deleted +
-// tombstoned as "used") and a fresh pair is issued. If the presented token
-// isn't active but WAS already used, that means this exact raw value got
-// replayed after rotation — i.e. it leaked — so every session for that user
-// is revoked, not just this one.
-func (s *Service) Refresh(ctx context.Context, rawRefreshToken string) (*authResponse, error) {
-	hash := hashToken(rawRefreshToken)
-	userID, ok, err := s.tokens.GetRefreshToken(ctx, hash)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if !ok {
-		if reusedBy, used, uerr := s.tokens.IsRefreshTokenUsed(ctx, hash); uerr == nil && used {
-			_ = s.tokens.RevokeAllRefreshTokens(ctx, reusedBy)
-		}
-		return nil, errInvalidToken()
-	}
-
-	if err := s.tokens.DeleteRefreshToken(ctx, hash, userID); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if err := s.tokens.MarkRefreshTokenUsed(ctx, hash, userID, s.refreshTTL); err != nil {
-		return nil, apperror.NewInternal()
-	}
-
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return nil, errInvalidToken()
-	}
-	return s.issueTokens(ctx, u)
-}
-
-// Logout is intentional, not reuse — no tombstoning, and idempotent (a
-// missing/already-gone token still succeeds).
-func (s *Service) Logout(ctx context.Context, rawRefreshToken string) error {
-	if rawRefreshToken == "" {
-		return nil
-	}
-	hash := hashToken(rawRefreshToken)
-	userID, ok, err := s.tokens.GetRefreshToken(ctx, hash)
-	if err != nil || !ok {
-		return nil
-	}
-	return s.tokens.DeleteRefreshToken(ctx, hash, userID)
-}
-
-// LogoutAll is the authenticated, self-service version of what ResetPassword
-// already does automatically: end every session for this user, not just the
-// one making the request — e.g. "log out everywhere" after a lost device.
-func (s *Service) LogoutAll(ctx context.Context, userID uuid.UUID) error {
-	return s.tokens.RevokeAllRefreshTokens(ctx, userID)
-}
-
-func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*model.User, error) {
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, errNotFound()
-		}
-		return nil, apperror.NewInternal()
-	}
-	return u, nil
-}
-
-// List is unused until an admin-facing route calls it (see `add rbac`'s
-// GET /users) — kept here rather than gated behind a patch since it's a
-// generically useful piece of data access, same as UpdateUser.
-func (s *Service) List(ctx context.Context, limit, offset int) ([]model.User, error) {
-	items, err := s.repo.FindAll(ctx, limit, offset)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return items, nil
-}
-
-// ForgotPassword always succeeds from the caller's point of view — whether
-// the email exists or not — so a login-attempt-shaped probe can't be used to
-// enumerate registered accounts. Only if the email resolves to a local
-// (password-based) identity does it actually issue+email a reset token.
-func (s *Service) ForgotPassword(ctx context.Context, email string) error {
-	// Its own counter, so hammering this endpoint cannot lock anyone out of
-	// logging in, and a locked-out login cannot block the reset that fixes it.
-	// Every request counts here, not just failures: what this throttles is
-	// using someone else's address as a mail-bomb target.
-	key := throttleKey("pwreset", email)
-	if s.throttled(ctx, key) {
-		return nil // same answer as always — silence is the whole design here
-	}
-	if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
-		slog.Error("record password reset attempt", "error", err)
-	}
-
-	u, err := s.repo.FindByEmail(ctx, normalizeEmail(email))
-	if err != nil {
-		return nil
-	}
-	ident, err := s.repo.FindIdentity(ctx, u.ID, model.ProviderLocal)
-	if err != nil || ident.PasswordHash == nil {
-		return nil // google-only account has no password to reset
-	}
-
-	raw, err := randomToken()
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if err := s.tokens.SetPasswordResetToken(ctx, hashToken(raw), u.ID, s.resetTTL); err != nil {
-		return apperror.NewInternal()
-	}
-
-	link := s.resetURL + "?token=" + raw
-	if err := s.mailer.Send(ctx, u.Email, "Reset your password", "Reset your password: "+link); err != nil {
-		// token's already stored — a mail failure shouldn't fail the request,
-		// just get logged so it's visible operationally.
-		slog.Error("send password reset email", "error", err)
-	}
-	return nil
-}
-
-// ResetPassword consumes a one-time reset token (GETDEL — see
-// tokenStore.ConsumePasswordResetToken), sets the new password, and revokes
-// every existing session for that user: a password reset should end every
-// session an attacker (or the legitimate user on another device) still holds.
-func (s *Service) ResetPassword(ctx context.Context, rawToken, newPassword string) error {
-	userID, ok, err := s.tokens.ConsumePasswordResetToken(ctx, hashToken(rawToken))
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if !ok {
-		return errInvalidToken()
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	ident, err := s.repo.FindIdentity(ctx, userID, model.ProviderLocal)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	ident.PasswordHash = &hashStr
-	if err := s.repo.UpdateIdentity(ctx, ident); err != nil {
-		return apperror.NewInternal()
-	}
-	return s.tokens.RevokeAllRefreshTokens(ctx, userID)
-}
-
-// sendVerificationEmail issues a one-time token and emails the link — called
-// from Register (best-effort) and ResendVerificationEmail. Not exported:
-// callers that want to send one go through one of those two, which decide
-// whether it's appropriate to (e.g. ResendVerificationEmail checks the user
-// isn't already verified first).
-func (s *Service) sendVerificationEmail(ctx context.Context, u *model.User) {
-	raw, err := randomToken()
-	if err != nil {
-		slog.Error("generate email verification token", "error", err)
-		return
-	}
-	if err := s.tokens.SetEmailVerifyToken(ctx, hashToken(raw), u.ID, s.verifyTTL); err != nil {
-		slog.Error("store email verification token", "error", err)
-		return
-	}
-	link := s.verifyURL + "?token=" + raw
-	if err := s.mailer.Send(ctx, u.Email, "Verify your email", "Verify your email: "+link); err != nil {
-		slog.Error("send email verification email", "error", err)
-	}
-}
-
-// ResendVerificationEmail is the authenticated counterpart to the automatic
-// send in Register — for when the first email never arrived or its token
-// expired. Rejects an already-verified user instead of silently no-op'ing:
-// unlike ForgotPassword this is authenticated, so there's no enumeration
-// concern in telling the caller their own account's real state.
-func (s *Service) ResendVerificationEmail(ctx context.Context, userID uuid.UUID) error {
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if u.EmailVerified {
-		return errAlreadyVerified()
-	}
-	s.sendVerificationEmail(ctx, u)
-	return nil
-}
-
-// VerifyEmail consumes a one-time verification token (GETDEL — see
-// tokenStore.ConsumeEmailVerifyToken) and marks the user verified.
-func (s *Service) VerifyEmail(ctx context.Context, rawToken string) error {
-	userID, ok, err := s.tokens.ConsumeEmailVerifyToken(ctx, hashToken(rawToken))
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	if !ok {
-		return errInvalidToken()
-	}
-	u, err := s.repo.FindByID(ctx, userID)
-	if err != nil {
-		return apperror.NewInternal()
-	}
-	u.EmailVerified = true
-	return s.repo.UpdateUser(ctx, u)
-}
-
-// GoogleLoginURL signs a short-lived CSRF state token and builds the redirect
-// URL. The second return value is the nonce the caller must set as a cookie:
-// the callback checks it against the one inside the state (see jwt.go), which
-// is what binds the flow to this one browser.
-func (s *Service) GoogleLoginURL() (string, string, error) {
-	state, nonce, err := s.issueOAuthState()
-	if err != nil {
-		return "", "", apperror.NewInternal()
-	}
-	return s.googleOAuth.AuthCodeURL(state), nonce, nil
-}
-
-type googleUserInfo struct {
-	Sub           string `json:"sub"`
-	Email         string `json:"email"`
-	EmailVerified bool   `json:"email_verified"`
-	Name          string `json:"name"`
-	Picture       string `json:"picture"`
-}
-
-func (s *Service) GoogleCallback(ctx context.Context, code, state, nonce string) (*authResponse, error) {
-	if err := s.verifyOAuthState(state, nonce); err != nil {
-		return nil, err
-	}
-	tok, err := s.googleOAuth.Exchange(ctx, code)
-	if err != nil {
-		return nil, errInvalidToken()
-	}
-
-	resp, err := s.googleOAuth.Client(ctx, tok).Get("https://openidconnect.googleapis.com/v1/userinfo")
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusOK {
-		return nil, apperror.NewInternal()
-	}
-	var info googleUserInfo
-	if err := json.NewDecoder(resp.Body).Decode(&info); err != nil {
-		return nil, apperror.NewInternal()
-	}
-
-	u, err := s.findOrCreateGoogleUser(ctx, info)
-	if err != nil {
-		return nil, err
-	}
-	return s.issueTokens(ctx, u)
-}
-
-// findOrCreateGoogleUser: (1) an existing google identity for this sub wins
-// outright; (2) failing that, ONLY if Google says the email is verified, link
-// a new google identity onto an existing local account with that email — an
-// unverified email can't be used to take over someone else's account; (3)
-// otherwise, brand new user + identity.
-func (s *Service) findOrCreateGoogleUser(ctx context.Context, info googleUserInfo) (*model.User, error) {
-	if ident, err := s.repo.FindIdentityByProviderUID(ctx, model.ProviderGoogle, info.Sub); err == nil {
-		return s.repo.FindByID(ctx, ident.UserID)
-	}
-
-	providerUID := info.Sub
-	email := normalizeEmail(info.Email)
-	if info.EmailVerified {
-		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-			ident := &model.Identity{ID: id.New(), UserID: u.ID, Provider: model.ProviderGoogle, ProviderUID: &providerUID}
-			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
-				return nil, apperror.NewInternal()
-			}
-			return u, nil
-		}
-	}
-
-	u := &model.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.Picture, EmailVerified: info.EmailVerified}
-	ident := &model.Identity{ID: id.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
-		if dberr.IsDuplicate(err) {
-			return nil, errEmailTaken()
-		}
-		return nil, apperror.NewInternal()
-	}
-	return u, nil
-}
-
-// EnsureUser is idempotent: an existing user with this email is returned
-// as-is (password untouched — cmd/seed shouldn't silently reset a real
-// password on every deploy), otherwise a new local user+identity is
-// created. Used by cmd/seed only — nothing in the HTTP API calls this.
-func (s *Service) EnsureUser(ctx context.Context, email, password, name string) (*model.User, error) {
-	email = normalizeEmail(email)
-	if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-		return u, nil
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	hashStr := string(hash)
-
-	u := &model.User{ID: id.New(), Email: email, Name: name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
-	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return u, nil
-}
-
-// go-scaffold:user-service-methods
-
-func (s *Service) issueTokens(ctx context.Context, u *model.User) (*authResponse, error) {
-	access, err := s.issueAccessToken(
-		u.ID,
-		// go-scaffold:issue-access-token-args
-	)
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	refresh, err := randomToken()
-	if err != nil {
-		return nil, apperror.NewInternal()
-	}
-	if err := s.tokens.SetRefreshToken(ctx, hashToken(refresh), u.ID, s.refreshTTL); err != nil {
-		return nil, apperror.NewInternal()
-	}
-	return &authResponse{
-		AccessToken:  access,
-		RefreshToken: refresh,
-		TokenType:    "Bearer",
-		ExpiresIn:    int(s.accessTTL.Seconds()),
-	}, nil
-}