@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/internal/app/user/service_test.go.hbs

@@ -1,316 +0,0 @@
-package user
-
-import (
-	"fmt"
-	"context"
-	"errors"
-	"net/http"
-	"testing"
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
-	"{{goModule}}/internal/shared/config"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-// fakeTokenStore = in-memory mock of tokenStore, mirroring the real store's
-// three-map shape (active / used-tombstone / per-user session set) closely
-// enough to exercise rotation + reuse-detection without a real Redis.
-type fakeTokenStore struct {
-	active   map[string]uuid.UUID
-	used     map[string]uuid.UUID
-	sessions map[uuid.UUID]map[string]struct{}
-}
-
-func newFakeTokenStore() *fakeTokenStore {
-	return &fakeTokenStore{
-		active:   map[string]uuid.UUID{},
-		used:     map[string]uuid.UUID{},
-		sessions: map[uuid.UUID]map[string]struct{}{},
-	}
-}
-
-func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
-	f.active[hash] = userID
-	if f.sessions[userID] == nil {
-		f.sessions[userID] = map[string]struct{}{}
-	}
-	f.sessions[userID][hash] = struct{}{}
-	return nil
-}
-func (f *fakeTokenStore) GetRefreshToken(_ context.Context, hash string) (uuid.UUID, bool, error) {
-	id, ok := f.active[hash]
-	return id, ok, nil
-}
-func (f *fakeTokenStore) DeleteRefreshToken(_ context.Context, hash string, userID uuid.UUID) error {
-	delete(f.active, hash)
-	delete(f.sessions[userID], hash)
-	return nil
-}
-func (f *fakeTokenStore) RevokeAllRefreshTokens(_ context.Context, userID uuid.UUID) error {
-	for h := range f.sessions[userID] {
-		delete(f.active, h)
-	}
-	delete(f.sessions, userID)
-	return nil
-}
-func (f *fakeTokenStore) MarkRefreshTokenUsed(_ context.Context, hash string, userID uuid.UUID, _ time.Duration) error {
-	f.used[hash] = userID
-	return nil
-}
-func (f *fakeTokenStore) IsRefreshTokenUsed(_ context.Context, hash string) (uuid.UUID, bool, error) {
-	id, ok := f.used[hash]
-	return id, ok, nil
-}
-func (f *fakeTokenStore) SetPasswordResetToken(context.Context, string, uuid.UUID, time.Duration) error {
-	return nil
-}
-func (f *fakeTokenStore) ConsumePasswordResetToken(context.Context, string) (uuid.UUID, bool, error) {
-	return uuid.Nil, false, nil
-}
-func (f *fakeTokenStore) SetEmailVerifyToken(context.Context, string, uuid.UUID, time.Duration) error {
-	return nil
-}
-func (f *fakeTokenStore) ConsumeEmailVerifyToken(context.Context, string) (uuid.UUID, bool, error) {
-	return uuid.Nil, false, nil
-}
-
-// fakeRepo = mock of the repository interface — only FindByID is exercised
-// by the tests below (Refresh looks the user up after validating the
-// token), the rest just satisfy the interface.
-type fakeRepo struct {
-	user *model.User
-	failures    map[string]int
-	lockedUntil map[string]time.Time
-}
-
-// throttle: the fake keeps the counter in memory so the lockout path can be
-// exercised without a database. Same shape as the real one — a key, a count,
-// and a time — because what the tests care about is when Service decides to
-// stop asking bcrypt anything.
-func (f *fakeRepo) LoginLockedUntil(_ context.Context, key string) (time.Time, error) {
-	return f.lockedUntil[key], nil
-}
-
-func (f *fakeRepo) RecordLoginFailure(_ context.Context, key string, freeAttempts int, maxLock time.Duration) error {
-	if f.lockedUntil == nil {
-		f.lockedUntil = map[string]time.Time{}
-	}
-	f.failures[key]++
-	if f.failures[key] > freeAttempts {
-		lock := time.Duration(1<<uint(f.failures[key]-freeAttempts-1)) * time.Second
-		if lock > maxLock {
-			lock = maxLock
-		}
-		f.lockedUntil[key] = time.Now().Add(lock)
-	}
-	return nil
-}
-
-func (f *fakeRepo) ClearLoginFailures(_ context.Context, key string) error {
-	delete(f.failures, key)
-	delete(f.lockedUntil, key)
-	return nil
-}
-
-func (f *fakeRepo) FindByEmail(context.Context, string) (*model.User, error) {
-	return nil, gorm.ErrRecordNotFound
-}
-func (f *fakeRepo) FindByID(_ context.Context, id uuid.UUID) (*model.User, error) {
-	if f.user != nil && f.user.ID == id {
-		return f.user, nil
-	}
-	return nil, gorm.ErrRecordNotFound
-}
-func (f *fakeRepo) UpdateUser(context.Context, *model.User) error { return nil }
-func (f *fakeRepo) FindAll(context.Context, int, int) ([]model.User, error) { return nil, nil }
-func (f *fakeRepo) FindIdentity(context.Context, uuid.UUID, model.Provider) (*model.Identity, error) {
-	return nil, gorm.ErrRecordNotFound
-}
-func (f *fakeRepo) FindIdentityByProviderUID(context.Context, model.Provider, string) (*model.Identity, error) {
-	return nil, gorm.ErrRecordNotFound
-}
-func (f *fakeRepo) CreateUserWithIdentity(context.Context, *model.User, *model.Identity) error { return nil }
-func (f *fakeRepo) CreateIdentity(context.Context, *model.Identity) error                      { return nil }
-func (f *fakeRepo) UpdateIdentity(context.Context, *model.Identity) error                      { return nil }
-
-type fakeMailer struct{}
-
-func (fakeMailer) Send(context.Context, string, string, string) error { return nil }
-
-// go-scaffold:user-service-test-types
-
-// newTestService is the one NewService call site every test below shares —
-// keeping it singular means `add rbac`'s marker patch only has one place to
-// add the roleChecker arg it introduces (patching every call site
-// individually would need a marker-per-callsite, easy to miss one).
-func newTestService(repo repository, tokens tokenStore) *Service {
-	return NewService(
-		repo,
-		tokens,
-		fakeMailer{},
-		config.Config{JWTSecret: "test-secret", JWTAccessTTL: time.Minute, JWTRefreshTTL: time.Hour},
-		// go-scaffold:user-service-test-args
-	)
-}
-
-func status(t *testing.T, err error) int {
-	t.Helper()
-	var appErr *apperror.AppError
-	if !errors.As(err, &appErr) {
-		t.Fatalf("expected *apperror.AppError, got %T: %v", err, err)
-	}
-	return appErr.HTTPStatus
-}
-
-func TestService_Refresh_RotatesTheToken(t *testing.T) {
-	ctx := context.Background()
-	userID := uuid.New()
-	tokens := newFakeTokenStore()
-	rawOld := "old-refresh-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOld), userID, time.Hour); err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
-
-	auth, err := svc.Refresh(ctx, rawOld)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if auth.RefreshToken == "" || auth.RefreshToken == rawOld {
-		t.Fatalf("expected a new, different refresh token, got %q", auth.RefreshToken)
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOld)); ok {
-		t.Fatal("expected the old refresh token to be consumed (no longer active) after rotation")
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(auth.RefreshToken)); !ok {
-		t.Fatal("expected the newly rotated refresh token to be active")
-	}
-}
-
-func TestService_Refresh_ReplayingARotatedOutTokenRevokesEverySession(t *testing.T) {
-	ctx := context.Background()
-	userID := uuid.New()
-	tokens := newFakeTokenStore()
-	rawOld := "old-refresh-token"
-	rawOtherSession := "another-devices-refresh-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOld), userID, time.Hour); err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawOtherSession), userID, time.Hour); err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
-
-	// rotate rawOld once — legitimate use, consumes + tombstones it
-	if _, err := svc.Refresh(ctx, rawOld); err != nil {
-		t.Fatalf("first refresh: unexpected error: %v", err)
-	}
-
-	// replay the now-rotated-out raw value — this is what happens if it leaked
-	_, err := svc.Refresh(ctx, rawOld)
-	if got := status(t, err); got != http.StatusUnauthorized {
-		t.Fatalf("want 401 replaying a rotated-out token, got %d", got)
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOtherSession)); ok {
-		t.Fatal("expected reuse of a rotated-out token to revoke every session for that user, but another session's token is still active")
-	}
-}
-
-func TestService_Refresh_UnknownTokenIsRejectedWithoutRevoking(t *testing.T) {
-	ctx := context.Background()
-	userID := uuid.New()
-	tokens := newFakeTokenStore()
-	rawLegit := "a-legit-session-token"
-	if err := tokens.SetRefreshToken(ctx, hashToken(rawLegit), userID, time.Hour); err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
-
-	_, err := svc.Refresh(ctx, "never-issued-token")
-	if got := status(t, err); got != http.StatusUnauthorized {
-		t.Fatalf("want 401 for an unrecognized token, got %d", got)
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawLegit)); !ok {
-		t.Fatal("a never-issued token shouldn't revoke unrelated sessions")
-	}
-}
-
-func TestService_LogoutAll_RevokesEverySessionButLeavesOthersAlone(t *testing.T) {
-	ctx := context.Background()
-	userID := uuid.New()
-	otherUserID := uuid.New()
-	tokens := newFakeTokenStore()
-	rawA := "user-session-a"
-	rawB := "user-session-b"
-	rawOther := "other-users-session"
-	for raw, id := range map[string]uuid.UUID{rawA: userID, rawB: userID, rawOther: otherUserID} {
-		if err := tokens.SetRefreshToken(ctx, hashToken(raw), id, time.Hour); err != nil {
-			t.Fatalf("seed: %v", err)
-		}
-	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
-
-	if err := svc.LogoutAll(ctx, userID); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawA)); ok {
-		t.Fatal("expected session A to be revoked")
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawB)); ok {
-		t.Fatal("expected session B to be revoked")
-	}
-	if _, ok, _ := tokens.GetRefreshToken(ctx, hashToken(rawOther)); !ok {
-		t.Fatal("expected a different user's session to be untouched by LogoutAll")
-	}
-}
-
-// The control that actually stops credential stuffing: the counter follows the
-// account, so spreading attempts across a proxy pool doesn't help.
-func TestService_Login_LocksTheAccountAfterRepeatedFailures(t *testing.T) {
-	repo := &fakeRepo{
-		user:     &model.User{ID: uuid.New(), Email: "a@example.com"},
-		failures: map[string]int{},
-	}
-	svc := newTestService(repo, newFakeTokenStore())
-	in := loginInput{Email: "a@example.com", Password: "wrong"}
-
-	// the free attempts answer "wrong password", not "locked"
-	for i := 0; i < loginFreeAttempts; i++ {
-		if _, err := svc.Login(context.Background(), in); err == nil {
-			t.Fatalf("attempt %d: expected a failure", i+1)
-		} else if code(err) != "AUTH_INVALID_CREDENTIALS" {
-			t.Fatalf("attempt %d: expected AUTH_INVALID_CREDENTIALS, got %s", i+1, code(err))
-		}
-	}
-
-	// the next one trips the lock...
-	if _, err := svc.Login(context.Background(), in); code(err) != "AUTH_INVALID_CREDENTIALS" {
-		t.Fatalf("the attempt that trips the lock still answers as a bad password, got %s", code(err))
-	}
-	// ...and everything after it is refused before any password is checked
-	if _, err := svc.Login(context.Background(), in); code(err) != "AUTH_TOO_MANY_ATTEMPTS" {
-		t.Fatalf("expected AUTH_TOO_MANY_ATTEMPTS once locked, got %s", code(err))
-	}
-}
-
-// A locked login must not lock the reset that fixes it — the person who forgot
-// their password is exactly the person who trips the login counter.
-func TestService_ForgotPassword_HasItsOwnCounter(t *testing.T) {
-	if throttleKey("login", "a@example.com") == throttleKey("pwreset", "a@example.com") {
-		t.Fatal("login and password-reset share a throttle key; a locked login would block recovery")
-	}
-}
-
-// code pulls the AppError code out, so a test asserting on behaviour doesn't
-// have to care how the error is wrapped.
-func code(err error) string {
-	var appErr *apperror.AppError
-	if errors.As(err, &appErr) {
-		return appErr.Code
-	}
-	return fmt.Sprintf("%v", err)
-}

package/templates/add/auth/internal/app/user/tokenstore.go.hbs

@@ -1,30 +0,0 @@
-package user
-
-import (
-	"context"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// tokenStore is the short-lived-token surface Service needs — declared
-// consumer-side so it can be faked in tests, and so the backing store is a
-// choice rather than a hard dependency. Two implementations ship with the
-// scaffold and exactly one is written into a project:
-//
-//   `add auth --store postgres`  ->  tokenstore_pg.go     (default, no extra service)
-//   `add auth --store redis`     ->  tokenstore_redis.go  (exact across pods)
-//
-// Service never learns which one it got.
-type tokenStore interface {
-	SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
-	GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
-	DeleteRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID) error
-	RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error
-	MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
-	IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
-	SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
-	ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
-	SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error
-	ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error)
-}

package/templates/add/auth/internal/app/user/tokenstore_pg.go.hbs

@@ -1,144 +0,0 @@
-// Postgres-backed tokenStore — installed by `add auth --store postgres` (the
-// default). The Redis-backed alternative lives in tokenstore_redis.go; only
-// one of the two is ever written into a project.
-//
-// Everything Redis needed two keys for collapses into one table here: the
-// per-user session set is just a WHERE clause, and expiry is a column every
-// read filters on rather than a TTL the store enforces. What that costs is a
-// sweep to keep the table from growing — see DeleteExpired.
-package user
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/tx"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-const (
-	kindRefresh     = "refresh"
-	kindRefreshUsed = "refresh_used"
-	kindPasswordSet = "pwreset"
-	kindEmailVerify = "emailverify"
-)
-
-type pgTokenStore struct {
-	db *gorm.DB
-}
-
-func NewPgTokenStore(db *gorm.DB) *pgTokenStore { return &pgTokenStore{db: db} }
-
-// put writes a token row, replacing any row that already carries the same
-// hash — a collision is astronomically unlikely, but "upsert" is the right
-// semantic for "this hash now means this" either way.
-func (s *pgTokenStore) put(ctx context.Context, hash, kind string, userID uuid.UUID, ttl time.Duration) error {
-	row := model.AuthToken{TokenHash: hash, UserID: userID, Kind: kind, ExpiresAt: time.Now().Add(ttl)}
-	return tx.From(ctx, s.db).WithContext(ctx).
-		Where("token_hash = ?", hash).
-		Assign(map[string]any{"user_id": userID, "kind": kind, "expires_at": row.ExpiresAt}).
-		FirstOrCreate(&row).Error
-}
-
-// lookup finds a live token of the given kind. Expiry is enforced here rather
-// than by a sweep, so a row that outlived its TTL is already invisible.
-func (s *pgTokenStore) lookup(ctx context.Context, hash, kind string) (uuid.UUID, bool, error) {
-	var row model.AuthToken
-	err := tx.From(ctx, s.db).WithContext(ctx).
-		Where("token_hash = ? AND kind = ? AND expires_at > now()", hash, kind).
-		Take(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return row.UserID, true, nil
-}
-
-// consume deletes and returns in one statement, which is what makes a
-// one-time token actually one-time: two requests racing on the same token
-// cannot both come away with a user id.
-func (s *pgTokenStore) consume(ctx context.Context, hash, kind string) (uuid.UUID, bool, error) {
-	var userID uuid.UUID
-	err := tx.From(ctx, s.db).WithContext(ctx).Raw(
-		`DELETE FROM user_svc.auth_tokens
-		 WHERE token_hash = ? AND kind = ? AND expires_at > now()
-		 RETURNING user_id`, hash, kind).Row().Scan(&userID)
-	if errors.Is(err, sql.ErrNoRows) {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return userID, true, nil
-}
-
-func (s *pgTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.put(ctx, tokenHash, kindRefresh, userID, ttl)
-}
-
-func (s *pgTokenStore) GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	return s.lookup(ctx, tokenHash, kindRefresh)
-}
-
-// DeleteRefreshToken removes the row outright and leaves nothing behind — see
-// the AuthToken doc comment for why logout must not leave a tombstone.
-func (s *pgTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, _ uuid.UUID) error {
-	return tx.From(ctx, s.db).WithContext(ctx).
-		Where("token_hash = ? AND kind = ?", tokenHash, kindRefresh).
-		Delete(&model.AuthToken{}).Error
-}
-
-// RevokeAllRefreshTokens is one statement here because Postgres can query by
-// value — the Redis store has to keep a separate per-user set to answer this,
-// and that set accumulates stale members its own comment calls out.
-// Tombstones are left in place so reuse detection still works afterwards.
-func (s *pgTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
-	return tx.From(ctx, s.db).WithContext(ctx).
-		Where("user_id = ? AND kind = ?", userID, kindRefresh).
-		Delete(&model.AuthToken{}).Error
-}
-
-func (s *pgTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.put(ctx, tokenHash, kindRefreshUsed, userID, ttl)
-}
-
-func (s *pgTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	return s.lookup(ctx, tokenHash, kindRefreshUsed)
-}
-
-func (s *pgTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.put(ctx, tokenHash, kindPasswordSet, userID, ttl)
-}
-
-func (s *pgTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	return s.consume(ctx, tokenHash, kindPasswordSet)
-}
-
-func (s *pgTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.put(ctx, tokenHash, kindEmailVerify, userID, ttl)
-}
-
-func (s *pgTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	return s.consume(ctx, tokenHash, kindEmailVerify)
-}
-
-// DeleteExpired drops rows nothing can use any more. Correctness never depends
-// on it — every read already filters on expires_at — so it is purely about
-// table size, and calling it on a timer from cmd/worker (or a cron) is enough.
-//
-// ponytail: not scheduled for you. Wire it up the day the table is big enough
-// to notice; a scaffold that silently runs background sweeps nobody asked for
-// is harder to reason about than one line you add when it matters.
-func (s *pgTokenStore) DeleteExpired(ctx context.Context) (int64, error) {
-	res := tx.From(ctx, s.db).WithContext(ctx).
-		Where("expires_at <= now()").
-		Delete(&model.AuthToken{})
-	return res.RowsAffected, res.Error
-}

package/templates/add/auth/internal/app/user/tokenstore_redis.go.hbs

@@ -1,147 +0,0 @@
-// Redis-backed tokenStore — installed by `add auth --store redis`.
-// The Postgres-backed alternative lives in tokenstore_pg.go; only one of the
-// two is ever written into a project, and Service never learns which.
-package user
-
-import (
-	"context"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/redis/go-redis/v9"
-)
-
-const (
-	refreshKeyPrefix     = "user:refresh:"      // +hash -> userID, TTL = refreshTTL
-	refreshUserKeyPrefix = "user:refresh:user:" // +userID -> SET of active token hashes
-	refreshUsedKeyPrefix = "user:refresh:used:" // +hash -> userID, TTL = refreshTTL, reuse-detection tombstone
-	pwresetKeyPrefix     = "user:pwreset:"      // +hash -> userID, TTL = resetTTL, GETDEL on consume
-	emailVerifyKeyPrefix = "user:emailverify:"  // +hash -> userID, TTL = emailVerifyTTL, GETDEL on consume
-)
-
-type redisTokenStore struct {
-	rdb *redis.Client
-}
-
-func NewRedisTokenStore(rdb *redis.Client) *redisTokenStore {
-	return &redisTokenStore{rdb: rdb}
-}
-
-func (s *redisTokenStore) SetRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	pipe := s.rdb.TxPipeline()
-	pipe.Set(ctx, refreshKeyPrefix+tokenHash, userID.String(), ttl)
-	pipe.SAdd(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
-	_, err := pipe.Exec(ctx)
-	return err
-}
-
-func (s *redisTokenStore) GetRefreshToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.Get(ctx, refreshKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) DeleteRefreshToken(ctx context.Context, tokenHash string, userID uuid.UUID) error {
-	pipe := s.rdb.TxPipeline()
-	pipe.Del(ctx, refreshKeyPrefix+tokenHash)
-	pipe.SRem(ctx, refreshUserKeyPrefix+userID.String(), tokenHash)
-	_, err := pipe.Exec(ctx)
-	return err
-}
-
-// RevokeAllRefreshTokens walks the per-user session set and deletes every
-// active refresh token for that user — used when reuse of an already-rotated
-// token is detected (see Service.Refresh): that means the raw token leaked,
-// so every session, not just the replayed one, is treated as compromised.
-//
-// ponytail: the per-user set has no per-member TTL cleanup of its own — a
-// member outlives its key's TTL as a stale entry until the next revoke or
-// rotation touches it. Self-heals over time; revisit if a single user's
-// session count grows large enough to matter.
-func (s *redisTokenStore) RevokeAllRefreshTokens(ctx context.Context, userID uuid.UUID) error {
-	setKey := refreshUserKeyPrefix + userID.String()
-	hashes, err := s.rdb.SMembers(ctx, setKey).Result()
-	if err != nil {
-		return err
-	}
-	if len(hashes) == 0 {
-		return nil
-	}
-	pipe := s.rdb.TxPipeline()
-	for _, h := range hashes {
-		pipe.Del(ctx, refreshKeyPrefix+h)
-	}
-	pipe.Del(ctx, setKey)
-	_, err = pipe.Exec(ctx)
-	return err
-}
-
-func (s *redisTokenStore) MarkRefreshTokenUsed(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, refreshUsedKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-func (s *redisTokenStore) IsRefreshTokenUsed(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.Get(ctx, refreshUsedKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) SetPasswordResetToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, pwresetKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-// ConsumePasswordResetToken is one-time-use by construction: GETDEL is
-// atomic, so a token can't be raced into being consumed twice.
-func (s *redisTokenStore) ConsumePasswordResetToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, pwresetKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}
-
-func (s *redisTokenStore) SetEmailVerifyToken(ctx context.Context, tokenHash string, userID uuid.UUID, ttl time.Duration) error {
-	return s.rdb.Set(ctx, emailVerifyKeyPrefix+tokenHash, userID.String(), ttl).Err()
-}
-
-// ConsumeEmailVerifyToken is one-time-use by construction, same as
-// ConsumePasswordResetToken — GETDEL is atomic.
-func (s *redisTokenStore) ConsumeEmailVerifyToken(ctx context.Context, tokenHash string) (uuid.UUID, bool, error) {
-	raw, err := s.rdb.GetDel(ctx, emailVerifyKeyPrefix+tokenHash).Result()
-	if err == redis.Nil {
-		return uuid.Nil, false, nil
-	}
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	id, err := uuid.Parse(raw)
-	if err != nil {
-		return uuid.Nil, false, err
-	}
-	return id, true, nil
-}

package/templates/add/rbac/internal/app/role/dto.go.hbs

@@ -1,45 +0,0 @@
-package role
-
-import (
-	"time"
-
-	"{{goModule}}/internal/app/role/model"
-)
-
-// response = the DTO sent out (kept separate from the model so a later DB column doesn't leak automatically)
-type response struct {
-	Code        string    `json:"code"`
-	Name        string    `json:"name"`
-	IsSystem    bool      `json:"is_system"`
-	Permissions []string  `json:"permissions"`
-	CreatedAt   time.Time `json:"created_at"`
-}
-
-func toResponse(m *model.Role, perms []string) response {
-	return response{Code: m.Code, Name: m.Name, IsSystem: m.IsSystem, Permissions: perms, CreatedAt: m.CreatedAt}
-}
-
-type CreateInput struct {
-	Code string `json:"code" binding:"required,max=20"`
-	Name string `json:"name" binding:"required"`
-}
-
-// SetPermissionsInput.PermissionCodes is a *pointer* so that "field absent"
-// and "field present but empty" stay different things. An empty list is a
-// valid request — it revokes every permission the role had — but with a plain
-// []string a body that simply misspells the key (say `{"permissions": [...]}`)
-// binds to nil, reads as that same "revoke everything", and answers 200 having
-// silently stripped the role. `required` on the pointer rejects the absent
-// case with a 400 while still allowing an explicit [].
-type SetPermissionsInput struct {
-	PermissionCodes *[]string `json:"permission_codes" binding:"required"`
-}
-
-type permissionResponse struct {
-	Code        string `json:"code"`
-	Description string `json:"description"`
-}
-
-func toPermissionResponse(m *model.Permission) permissionResponse {
-	return permissionResponse{Code: m.Code, Description: m.Description}
-}