@nakedev/go-scaffold 0.4.0 → 0.5.0

package/dist/utils/platform-patcher.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patchComposeForRedis = patchComposeForRedis;
 exports.patchCiForRedis = patchCiForRedis;
+exports.patchCiForRiver = patchCiForRiver;
 exports.patchConfigForRedis = patchConfigForRedis;
 exports.patchConfigForWorker = patchConfigForWorker;
 exports.patchConfigForSMTP = patchConfigForSMTP;
@@ -17,7 +18,6 @@ const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
 const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 const PLATFORM_INIT_MARKER = "// go-scaffold:platform-init";
 const READYZ_MARKER = "// go-scaffold:readyz-checks";
-const SHUTDOWN_MARKER = "// go-scaffold:shutdown";
 // patchComposeForRedis adds a redis service to docker-compose.yml. Whatever
 // pulls Redis in — `add worker --queue redis`, or `add auth`'s refresh-token
 // store on top of a Postgres queue — makes cmd/api call cache.Open and adds a
@@ -55,8 +55,7 @@ function patchCiForRedis(ciPath) {
     if (!fs_extra_1.default.existsSync(ciPath))
         return;
     const content = fs_extra_1.default.readFileSync(ciPath, "utf8");
-    if (/^\s{6}redis:/m.test(content))
-        return;
+    const hasRedisService = /^\s{6}redis:/m.test(content);
     // `steps:` sits one level under the job, so it's the first line that ends
     // the `services:` block — insert the service just above it.
     //
@@ -65,7 +64,7 @@ function patchCiForRedis(ciPath) {
     // means CI runs without Redis and fails on a connection error that says
     // nothing about this — so say it here instead.
     const stepsLine = content.split("\n").find((l) => l.trimEnd() === "    steps:");
-    if (!stepsLine) {
+    if (!hasRedisService && !stepsLine) {
         console.error(picocolors_1.default.yellow(`skipped adding the Redis service to ${ciPath} — no \`steps:\` line at the expected indentation to anchor it to.\n` +
             `Add a redis service to the workflow's \`services:\` block by hand, or CI will run without one.`));
         return;
@@ -82,7 +81,51 @@ function patchCiForRedis(ciPath) {
         "          --health-retries 5",
         "",
     ].join("\n");
-    fs_extra_1.default.writeFileSync(ciPath, content.replace(stepsLine, () => `${service}\n${stepsLine}`));
+    let patched = hasRedisService ? content : content.replace(stepsLine, () => `${service}\n${stepsLine}`);
+    // The service alone is not enough: token-store tests deliberately skip when
+    // TEST_REDIS_URL is absent, so a generated workflow could report green while
+    // never exercising Redis. Add the required test variables alongside the
+    // existing PostgreSQL test variables, anchored on the actual go test line so
+    // we do not accidentally put them in the Postgres container's env block.
+    const testRunLine = "        run: go test ./...";
+    if (!patched.includes("REQUIRE_TEST_REDIS")) {
+        if (!patched.includes(testRunLine)) {
+            console.error(picocolors_1.default.yellow(`skipped requiring Redis integration tests in ${ciPath} — no \`run: go test ./...\` line to anchor the test environment to.\n` +
+                `Add TEST_REDIS_URL and REQUIRE_TEST_REDIS=true to the workflow's test step by hand.`));
+        }
+        else {
+            patched = patched.replace(testRunLine, '          TEST_REDIS_URL: redis://127.0.0.1:6379/0\n' +
+                '          REQUIRE_TEST_REDIS: "true"\n' +
+                testRunLine);
+        }
+    }
+    fs_extra_1.default.writeFileSync(ciPath, patched);
+}
+// patchCiForRiver makes the generated worker round-trip test runnable in CI.
+// River's schema is versioned by River itself, separately from this project's
+// migrations/, so applying only the application migrations leaves the test
+// unable to exercise the worker.
+function patchCiForRiver(ciPath) {
+    if (!fs_extra_1.default.existsSync(ciPath))
+        return;
+    const content = fs_extra_1.default.readFileSync(ciPath, "utf8");
+    if (content.includes("river-migrate-test") || content.includes("Apply River migrations"))
+        return;
+    const testStep = content.split("\n").find((line) => line.trimStart().startsWith("- name: Test (required PostgreSQL integration tests cannot skip)"));
+    const dsn = content.match(/^\s+DB_DSN:\s+(.+)$/m)?.[1]?.trim();
+    if (!testStep || !dsn) {
+        console.error(picocolors_1.default.yellow(`skipped adding River migrations to ${ciPath} — the generated migration DSN or PostgreSQL test step is missing.\n` +
+            `Add a River migration step before the required PostgreSQL test step by hand.`));
+        return;
+    }
+    const step = [
+        "      - name: Apply River migrations to the test database",
+        "        env:",
+        `          TEST_DB_DSN: ${dsn}`,
+        '        run: go run github.com/riverqueue/river/cmd/river@v0.43.0 migrate-up --line main --database-url "$TEST_DB_DSN"',
+        "",
+    ].join("\n");
+    fs_extra_1.default.writeFileSync(ciPath, content.replace(testStep, `${step}${testStep}`));
 }
 // patchConfigForRedis adds RedisURL to Config and its env() load to Load().
 // Split out from the worker patch because Redis is no longer the worker's
@@ -141,6 +184,14 @@ function patchMainGoForWorker(mainGoPath, goModule) {
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, cacheImport, cacheImport);
     const initBlock = ["rdb, err := cache.Open(cfg)", "if err != nil {", '\treturn fmt.Errorf("open redis: %w", err)', "}"].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, initBlock, "rdb, err := cache.Open(cfg)");
+    const cleanupBlock = [
+        "defer func() {",
+        '\tif err := rdb.Close(); err != nil {',
+        '\t\tlogger.Error("close redis", "error", err)',
+        "\t}",
+        "}()",
+    ].join("\n");
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, PLATFORM_INIT_MARKER, cleanupBlock, "defer func() {\n\tif err := rdb.Close()");
     const readyzBlock = [
         "if err := rdb.Ping(c.Request.Context()).Err(); err != nil {",
         '\tc.JSON(http.StatusServiceUnavailable, gin.H{"status": "unavailable"})',
@@ -148,7 +199,5 @@ function patchMainGoForWorker(mainGoPath, goModule) {
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, READYZ_MARKER, readyzBlock, "if err := rdb.Ping(");
-    const shutdownBlock = ["if err := rdb.Close(); err != nil {", '\tlogger.Error("close redis", "error", err)', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SHUTDOWN_MARKER, shutdownBlock, "if err := rdb.Close()");
     fs_extra_1.default.writeFileSync(mainGoPath, content);
 }

package/dist/utils/rbac-patcher.js

@@ -13,7 +13,6 @@ exports.patchUserServiceTestForRbac = patchUserServiceTestForRbac;
 exports.patchUserDTOForRbac = patchUserDTOForRbac;
 exports.patchUserHandlerForRbac = patchUserHandlerForRbac;
 exports.patchUserErrorsForRbac = patchUserErrorsForRbac;
-exports.userSvcLineFor = userSvcLineFor;
 exports.assertRbacPatchable = assertRbacPatchable;
 exports.patchMainGoForRbac = patchMainGoForRbac;
 exports.patchCmdSeedForRbac = patchCmdSeedForRbac;
@@ -23,13 +22,12 @@ const marker_patch_1 = require("./marker-patch");
 const IMPORT_MARKER = "// go-scaffold:imports";
 const SCHEMA_MARKER = "// go-scaffold:schemas";
 const MODEL_MARKER = "// go-scaffold:models";
-const ROUTE_MARKER = "// go-scaffold:routes";
 const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
 const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 // patchAuthDocsForRbac adds `role` to the hand-written MeResponse schema in
 // docs/auth/schemas.yaml — same marker convention as the Go dto.go patch
 // (patchUserDTOForRbac), since GET/PATCH /users(/me) all serialize the same
-// model.User whether or not RBAC is installed.
+// user response whether or not RBAC is installed.
 function patchAuthDocsForRbac(authSchemasYamlPath) {
     if (!fs_extra_1.default.existsSync(authSchemasYamlPath))
         return; // openapi docs feature disabled
@@ -46,15 +44,16 @@ function patchConfigForRbac(configGoPath) {
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, 'AuthzCacheTTL: time.Duration(envInt("AUTHZ_CACHE_TTL_MIN", 1)) * time.Minute,', "AuthzCacheTTL: time.Duration");
     fs_extra_1.default.writeFileSync(configGoPath, content);
 }
-// patchUserModelForRbac adds the Role column to model.User — default 'staff'
-// at the DB level (via the gorm tag), so every existing user-creation path
-// (Register, Google, cmd/seed) gets a sane role without each one needing to
-// set it explicitly.
+// patchUserModelForRbac verifies the auth template exposes the optional role
+// field in its outbound persistence model. Auth owns the stable user shape;
+// RBAC adds the role catalog and authorization policy on top of it. Keeping
+// this check idempotent lets the command work across scaffold versions
+// without recreating a second model package.
 function patchUserModelForRbac(userModelPath) {
     let content = fs_extra_1.default.readFileSync(userModelPath, "utf8");
-    const field = `Role string \`json:"role" gorm:"type:varchar(20);not null;default:'staff'"\``;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-fields", field, "Role string");
-    fs_extra_1.default.writeFileSync(userModelPath, content);
+    if (/\bRole\s+string\b/.test(content))
+        return;
+    throw new Error(`${userModelPath} does not expose User.Role — the auth module must be regenerated or migrated before adding RBAC`);
 }
 // patchMiddlewareAuthForRbac adds RoleKey + the Role claim to the shared
 // middleware's own accessClaims copy (see auth.go's own comment on why it's
@@ -78,189 +77,88 @@ function patchUserJWTForRbac(jwtGoPath) {
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:jwt-claims-values", "Role: role,", "Role: role,");
     fs_extra_1.default.writeFileSync(jwtGoPath, content);
 }
-// patchUserServiceForRbac wires a role.Service dependency into user.Service
-// (via a consumer-side roleChecker interface, same convention as
-// repository/mailer/tokenStore) and adds SetRole, the one place a user's
-// role actually changes after creation.
-function patchUserServiceForRbac(serviceGoPath) {
-    let content = fs_extra_1.default.readFileSync(serviceGoPath, "utf8");
-    const roleCheckerInterface = [
-        "// roleChecker = what the service needs from the role domain to validate a",
-        "// role assignment — declared consumer-side, same convention as repository/mailer.",
-        "type roleChecker interface {",
-        "\tCodeExists(ctx context.Context, code string) (bool, error)",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-interfaces", roleCheckerInterface, "type roleChecker interface");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-fields", "roles roleChecker", "roles roleChecker");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-params", "roles roleChecker,", "roles roleChecker,");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-init", "roles: roles,", "roles: roles,");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:issue-access-token-args", "u.Role,", "u.Role,");
-    const setRoleMethod = [
-        "// SetRole assigns userID a new role — validated against the role catalog",
-        "// (not just the DB's FK) so a typo'd code fails with a clear 422 here",
-        "// instead of surfacing as an opaque FK-violation, and so AutoMigrate-only",
-        "// test schemas (which never create the FK) still reject it correctly.",
-        "func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string) (*model.User, error) {",
-        "\tu, err := s.repo.FindByID(ctx, userID)",
-        "\tif err != nil {",
-        "\t\tif errors.Is(err, gorm.ErrRecordNotFound) {",
-        "\t\t\treturn nil, errNotFound()",
-        "\t\t}",
-        "\t\treturn nil, apperror.NewInternal()",
-        "\t}",
-        "\texists, err := s.roles.CodeExists(ctx, roleCode)",
-        "\tif err != nil {",
-        "\t\treturn nil, apperror.NewInternal()",
-        "\t}",
-        "\tif !exists {",
-        "\t\treturn nil, errUnknownRole()",
-        "\t}",
-        "\tu.Role = roleCode",
-        "\tif err := s.repo.UpdateUser(ctx, u); err != nil {",
-        "\t\treturn nil, apperror.NewInternal()",
-        "\t}",
-        "\treturn u, nil",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-methods", setRoleMethod, "func (s *Service) SetRole(");
-    fs_extra_1.default.writeFileSync(serviceGoPath, content);
+// patchUserServiceForRbac verifies the auth application already exposes the
+// optional role capability. The canonical auth template owns this shared user
+// behavior; `add rbac` only supplies the role catalog and authorizer.
+function patchUserServiceForRbac(serviceGoPath, sessionsGoPath) {
+    const content = fs_extra_1.default.readFileSync(serviceGoPath, "utf8");
+    for (const required of ["roles             ports.RoleChecker", "func (s *Service) SetRole(", "// go-scaffold:service-interface"]) {
+        if (!content.includes(required)) {
+            throw new Error(`${serviceGoPath} is missing the canonical auth role capability (${required}); regenerate auth before adding RBAC`);
+        }
+    }
+    if (sessionsGoPath && fs_extra_1.default.existsSync(sessionsGoPath)) {
+        const sessions = fs_extra_1.default.readFileSync(sessionsGoPath, "utf8");
+        if (!sessions.includes("u.Role,")) {
+            throw new Error(`${sessionsGoPath} does not include the user's role in access-token issuance; regenerate auth before adding RBAC`);
+        }
+    }
 }
-// patchUserServiceTestForRbac keeps service_test.go's single NewService call
-// site (newTestService) compiling once patchUserServiceForRbac adds the
-// roleChecker param above — same drift risk the handoff notes called out for
-// middleware.NewAuthz's call sites, just for this signature instead. The fake
-// itself is added here too, not pre-declared unconditionally in the
-// template: golangci-lint's unused check flags an unreferenced type+method
-// pair in the auth-only (pre-rbac) state, since nothing there yet implements
-// or needs a roleChecker.
+// patchUserServiceTestForRbac verifies the canonical auth test seam already
+// supplies the optional role capability. It is part of the auth contract so
+// adding RBAC does not rewrite every test call site.
 function patchUserServiceTestForRbac(serviceTestGoPath) {
-    let content = fs_extra_1.default.readFileSync(serviceTestGoPath, "utf8");
-    const fakeRoles = [
-        "// fakeRoles satisfies role's roleChecker interface structurally.",
-        "type fakeRoles struct{}",
-        "",
-        "func (fakeRoles) CodeExists(context.Context, string) (bool, error) { return true, nil }",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-test-types", fakeRoles, "type fakeRoles struct{}");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-test-args", "fakeRoles{},", "fakeRoles{},");
-    fs_extra_1.default.writeFileSync(serviceTestGoPath, content);
+    const content = fs_extra_1.default.readFileSync(serviceTestGoPath, "utf8");
+    for (const required of ["type fakeRoles struct{}", "Roles:             fakeRoles{},", "// go-scaffold:user-service-test-deps"]) {
+        if (!content.includes(required)) {
+            throw new Error(`${serviceTestGoPath} is missing the canonical auth role test seam (${required}); regenerate auth before adding RBAC`);
+        }
+    }
 }
-// patchUserDTOForRbac adds the request DTO for PATCH /users/:id/set-role and
-// surfaces Role on the /me response — both gated behind RBAC since
-// model.User has no Role field at all without it.
+// patchUserDTOForRbac verifies the role DTOs owned by the canonical auth
+// inbound adapter. The routes remain inactive until an Authz is composed.
 function patchUserDTOForRbac(dtoGoPath) {
-    let content = fs_extra_1.default.readFileSync(dtoGoPath, "utf8");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-me-fields", 'Role string `json:"role"`', "Role string");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-me-values", "Role: u.Role,", "Role: u.Role,");
-    const setRoleInput = ["type setRoleInput struct {", '\tRole string `json:"role" binding:"required"`', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-dto", setRoleInput, "type setRoleInput struct");
-    fs_extra_1.default.writeFileSync(dtoGoPath, content);
+    const content = fs_extra_1.default.readFileSync(dtoGoPath, "utf8");
+    if (!/\bRole\s+string\s+`json:"role"`/.test(content)) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO; regenerate auth before adding RBAC`);
+    }
+    if (!/Role:\s+user\.Role,/.test(content)) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO mapping; regenerate auth before adding RBAC`);
+    }
+    if (!content.includes("type setRoleInput struct")) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO (type setRoleInput struct); regenerate auth before adding RBAC`);
+    }
 }
-// patchUserHandlerForRbac wires an *middleware.Authz into Handler and adds
-// the admin routes this PR ships: listing/viewing other users (PermUserRead)
-// and changing a user's role (PermUserManageRole). Suspending a user is a
-// separate concern, not RBAC's — see the role domain's own /roles,
-// /permissions for the actual role/permission management API.
-function patchUserHandlerForRbac(handlerGoPath, goModule) {
-    let content = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-consts", 'const PermUserManageRole = "user:manage-role"', "PermUserManageRole");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-consts", 'const PermUserRead = "user:read"', "PermUserRead");
-    const paginationImport = `"${goModule}/internal/shared/pagination"`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-imports", paginationImport, "internal/shared/pagination");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-fields", "authz *middleware.Authz", "authz *middleware.Authz");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-params", "authz *middleware.Authz,", "authz *middleware.Authz,");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-init", "authz: authz,", "authz: authz,");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)', 'usersGroup.GET("", h.authz.Require(PermUserRead)');
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)', 'usersGroup.GET("/:id", h.authz.Require(PermUserRead)');
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)', 'usersGroup.PATCH("/:id/set-role"');
-    const adminListHandler = [
-        "func (h *Handler) adminListUsers(c *gin.Context) {",
-        "\tp := pagination.Parse(c)",
-        "\titems, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tout := make([]meResponse, len(items))",
-        "\tfor i := range items {",
-        "\t\tout[i] = toMeResponse(&items[i])",
-        "\t}",
-        "\tc.JSON(http.StatusOK, p.Response(out))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", adminListHandler, "func (h *Handler) adminListUsers(");
-    const adminGetHandler = [
-        "func (h *Handler) adminGetUser(c *gin.Context) {",
-        "\tid, ok := httpx.ParseID(c)",
-        "\tif !ok {",
-        "\t\treturn",
-        "\t}",
-        "\tu, err := h.svc.Get(c.Request.Context(), id)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tc.JSON(http.StatusOK, toMeResponse(u))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", adminGetHandler, "func (h *Handler) adminGetUser(");
-    const setRoleHandler = [
-        "func (h *Handler) setRole(c *gin.Context) {",
-        "\tid, ok := httpx.ParseID(c)",
-        "\tif !ok {",
-        "\t\treturn",
-        "\t}",
-        "\tvar in setRoleInput",
-        "\tif err := c.ShouldBindJSON(&in); err != nil {",
-        "\t\tc.Error(httpx.BindErr(err))",
-        "\t\treturn",
-        "\t}",
-        "\tu, err := h.svc.SetRole(c.Request.Context(), id, in.Role)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tc.JSON(http.StatusOK, toMeResponse(u))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", setRoleHandler, "func (h *Handler) setRole(");
-    fs_extra_1.default.writeFileSync(handlerGoPath, content);
+// patchUserHandlerForRbac verifies that auth owns the role-aware admin route
+// surface. The routes are guarded by the optional authorizer, so adding RBAC
+// composes the guard; it does not copy or rewrite handler code.
+function patchUserHandlerForRbac(handlerGoPath) {
+    const content = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
+    for (const required of [
+        "authz   authorizer",
+        "func (h *Handler) adminListUsers(",
+        "func (h *Handler) adminGetUser(",
+        "func (h *Handler) setRole(",
+        'usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)',
+        'usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)',
+        'usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)',
+    ]) {
+        if (!content.includes(required)) {
+            throw new Error(`${handlerGoPath} is missing the canonical auth role route (${required}); regenerate auth before adding RBAC`);
+        }
+    }
 }
 function patchUserErrorsForRbac(errorsGoPath) {
-    let content = fs_extra_1.default.readFileSync(errorsGoPath, "utf8");
-    const errFn = ["func errUnknownRole() *apperror.AppError {", '\treturn apperror.New(http.StatusUnprocessableEntity, "USER_UNKNOWN_ROLE", "unknown role code")', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-errors", errFn, "func errUnknownRole(");
-    fs_extra_1.default.writeFileSync(errorsGoPath, content);
-}
-// patchMainGoForRbac wires the role domain into cmd/api: its import, its
-// three models in the AutoMigrate call, and — the one place a plain insert
-// isn't enough — REPLACES the `add auth` PR's user.NewHandler(...) call with
-// a version that also builds roleSvc/authz and passes them through, plus
-// registers role's own routes right after it.
-// userSvcLineFor rebuilds the exact line `add auth` wrote, from the same
-// helper it used. Exported so the command can check for it *before* it starts
-// patching: every other file rbac touches is edited first, and until this
-// existed a mismatch here threw after user.NewService had already grown a
-// roleChecker parameter — leaving a project that no longer compiled and an
-// error telling you to restore a line that wouldn't have fixed it.
-function userSvcLineFor(goModule, store, worker) {
-    const { tokenStore, mailer } = (0, auth_patcher_1.authWiringLines)({ goModule, queueBackend: "river", store, worker });
-    return `userSvc := user.NewService(user.NewRepository(db), ${tokenStore}, ${mailer}, cfg)`;
+    const content = fs_extra_1.default.readFileSync(errorsGoPath, "utf8");
+    if (!content.includes("func errUnknownRole(")) {
+        throw new Error(`${errorsGoPath} is missing the canonical unknown-role error; regenerate auth before adding RBAC`);
+    }
 }
 function assertRbacPatchable(mainGoPath, goModule, store, worker) {
-    const expected = userSvcLineFor(goModule, store, worker);
-    if (fs_extra_1.default.readFileSync(mainGoPath, "utf8").includes(expected))
+    const wiring = { goModule, queueBackend: "river", store, worker };
+    const content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
+    const expected = (0, auth_patcher_1.authHandlerLineFor)(wiring);
+    if (content.includes(expected))
         return;
-    throw new Error("cmd/api/wiring.go's userSvc line doesn't match what `add auth` wrote, so `add rbac` can't extend it.\n" +
+    throw new Error("cmd/api/wiring.go's auth route doesn't match what `add auth` wrote, so `add rbac` can't extend it.\n" +
         `Expected to find:\n  ${expected}\n\n` +
-        "It was probably hand-edited. Restore that line and re-run — nothing has been changed yet.");
+        "It was probably hand-edited. Restore that route and re-run — nothing has been changed yet.");
 }
 function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/role"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
-    const modelImportLine = `rolemodel "${goModule}/internal/app/role/model"`;
+    const modelImportLine = `rolepostgres "${goModule}/internal/app/role/adapters/outbound/postgres"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
     const schemaBlock = [
         'if err := db.Exec("CREATE SCHEMA IF NOT EXISTS role_svc").Error; err != nil {',
@@ -268,41 +166,21 @@ function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS role_svc");
-    const migrateLines = ["&rolemodel.Role{},", "&rolemodel.Permission{},", "&rolemodel.RolePermission{},"];
+    const migrateLines = ["&rolepostgres.Role{},", "&rolepostgres.Permission{},", "&rolepostgres.RolePermission{},"];
     for (const line of migrateLines) {
         content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, line, line);
     }
-    // roleSvc and authz have to be declared *above* userSvc, which now takes
-    // roleSvc — so this rewrites the service line in place rather than
-    // appending at the marker (which would land below it).
-    // Rebuilt from the same helper `add auth` used, so a project on either store
-    // gets its own line matched rather than a hardcoded guess at one of them.
-    const { limiter } = (0, auth_patcher_1.authWiringLines)({ goModule, queueBackend: "river", store, worker });
-    const userSvcLine = userSvcLineFor(goModule, store, worker);
-    // Throw rather than skip: the roleSvc/authz declarations this rewrite adds
-    // are what the unconditional patches below refer to. Skipping quietly still
-    // emits `roleSvc`/`authz` references with nothing declaring them, so the
-    // command reports success over a main.go that doesn't compile.
-    if (!content.includes(userSvcLine)) {
-        throw new Error(`cmd/api/wiring.go's userSvc line doesn't match what \`add auth\` wrote, so \`add rbac\` can't extend it.\n` +
-            `Expected to find:\n  ${userSvcLine}\n\n` +
-            `It was probably hand-edited. Restore that line (add rbac will re-extend it), or apply the rbac wiring by hand:\n` +
-            `  roleSvc := role.NewService(role.NewRepository(db))\n` +
-            `  authz := middleware.NewAuthz(roleSvc.PermissionsOf, cfg.AuthzCacheTTL)\n` +
-            `  ...then pass roleSvc as user.NewService's last argument.`);
+    const wiring = { goModule, queueBackend: "river", store, worker };
+    const authRouteLine = (0, auth_patcher_1.authHandlerLineFor)(wiring);
+    const roleCompositionLine = "roleComposition := role.NewCompositionFromDB(db, cfg.JWTSecret, cfg.AuthzCacheTTL)";
+    const roleHandlerLine = "roleComposition.Handler.Register(api)";
+    if (!content.includes(authRouteLine)) {
+        throw new Error(`cmd/api/wiring.go's auth route doesn't match what \`add auth\` wrote, so \`add rbac\` can't extend it.\n` +
+            `Expected to find:\n  ${authRouteLine}\n\n` +
+            "It was probably hand-edited. Restore that route and re-run — nothing has been changed yet.");
     }
-    content = content.replace(userSvcLine, [
-        "roleSvc := role.NewService(role.NewRepository(db))",
-        "authz := middleware.NewAuthz(roleSvc.PermissionsOf, cfg.AuthzCacheTTL)",
-        `${userSvcLine.slice(0, -1)}, roleSvc)`,
-    ].join("\n"));
-    const userRouteLine = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${limiter}).Register(api)`;
-    // strip the trailing `).Register(api)` — not just `.Register(api)` — so authz
-    // lands inside NewHandler's argument list rather than after its closing paren
-    const tail = ").Register(api)";
-    content = content.replace(userRouteLine, `${userRouteLine.slice(0, -tail.length)}, authz${tail}`);
-    const roleRouteLine = "role.NewHandler(roleSvc, cfg.JWTSecret, authz).Register(api)";
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, roleRouteLine, roleRouteLine);
+    const authWithRoleLine = (0, auth_patcher_1.authHandlerLineFor)(wiring, ["roleComposition.Service", "roleComposition.Authz"]);
+    content = content.replace(authRouteLine, [roleCompositionLine, authWithRoleLine, roleHandlerLine].join("\n"));
     fs_extra_1.default.writeFileSync(mainGoPath, content);
 }
 // patchCmdSeedForRbac makes the seeded admin actually an admin: wires a
@@ -313,9 +191,10 @@ function patchCmdSeedForRbac(seedMainGoPath, goModule) {
     let content = fs_extra_1.default.readFileSync(seedMainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/role"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:seed-imports", importLine, importLine);
-    const roleSvcLine = "roleSvc := role.NewService(role.NewRepository(db))";
+    const roleSvcLine = "roleSvc := role.NewServiceFromDB(db)";
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:seed-services", roleSvcLine, roleSvcLine);
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:seed-user-service-args", "roleSvc,", "roleSvc,");
+    const seedRoleDependency = content.includes("user.Dependencies{") ? "Roles: roleSvc," : "roleSvc,";
+    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:seed-user-service-args", seedRoleDependency, seedRoleDependency);
     const setRoleCall = [
         'if _, err := svc.SetRole(ctx, u.ID, "admin"); err != nil {',
         '\tlogger.Error("promote seed admin to admin role", "error", err)',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nakedev/go-scaffold",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard",
   "repository": {
     "type": "git",
@@ -23,9 +23,13 @@
     "test:unit": "node --test tests/unit/*.test.mjs",
     "test:integration": "node --test tests/integration/*.test.mjs",
     "test:smoke": "node scripts/smoke-test.mjs",
+    "test:e2e": "playwright test --config=playwright.config.mjs",
+    "test:e2e:install": "playwright install chromium",
     "verify": "pnpm run build && pnpm run test",
+    "release:check": "node scripts/check-release.mjs",
+    "policy:main": "node scripts/check-main-merge.mjs",
     "prepack": "rm -rf dist && pnpm run build",
-    "prepublishOnly": "pnpm run verify"
+    "prepublishOnly": "pnpm run release:check && pnpm run verify"
   },
   "keywords": [
     "go",
@@ -49,6 +53,7 @@
     "pluralize": "^8.0.0"
   },
   "devDependencies": {
+    "@playwright/test": "1.55.0",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^24.0.0",
     "@types/pluralize": "^0.0.33",

package/templates/add/auth/cmd/seed/main.go.hbs

@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"{{goModule}}/internal/app/user"
+	userpassword "{{goModule}}/internal/app/user/adapters/outbound/password"
 	"{{goModule}}/internal/platform/database"
 	"{{goModule}}/internal/shared/config"
 	// go-scaffold:seed-imports
@@ -30,10 +31,21 @@ func main() {
 	}
 
 	// go-scaffold:seed-services
-	svc := user.NewService(
-		user.NewRepository(db), nil, nil, cfg,
+	svc := user.NewService(user.Dependencies{
+		Repository: user.NewRepository(db),
+		Passwords:  userpassword.NewBCryptHasher(),
 		// go-scaffold:seed-user-service-args
-	)
+	}, user.AuthConfig{
+		JWTSecret:        cfg.JWTSecret,
+		JWTAccessTTL:     cfg.JWTAccessTTL,
+		JWTRefreshTTL:    cfg.JWTRefreshTTL,
+		JWTRefreshMaxTTL: cfg.JWTRefreshMaxTTL,
+		OAuthStateTTL:    cfg.OAuthStateTTL,
+		PasswordResetTTL: cfg.PasswordResetTTL,
+		PasswordResetURL: cfg.PasswordResetURL,
+		EmailVerifyTTL:   cfg.EmailVerifyTTL,
+		EmailVerifyURL:   cfg.EmailVerifyURL,
+	})
 	ctx := context.Background()
 
 	if email := os.Getenv("SEED_ADMIN_EMAIL"); email != "" {

package/templates/add/auth/docs/login.yaml.hbs

@@ -11,9 +11,19 @@ post:
   responses:
     "200":
       description: ok, refresh_token set as an httpOnly cookie
+      headers:
+        Cache-Control:
+          description: token responses are never cacheable
+          schema: { type: string, example: no-store }
+        Pragma:
+          description: legacy cache prevention for token responses
+          schema: { type: string, example: no-cache }
       content:
         application/json:
-          schema: { $ref: './schemas.yaml#/AuthResponse' }
+          schema:
+            oneOf:
+              - { $ref: './schemas.yaml#/AuthResponse' }
+              - { $ref: './schemas.yaml#/MFAChallengeResponse' }
     "400": { $ref: '../common/responses.yaml#/ValidationError' }
     "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
     "429": { $ref: '../common/responses.yaml#/TooManyRequestsError' }

package/templates/add/auth/docs/mfa-verify.yaml.hbs

@@ -0,0 +1,19 @@
+post:
+  summary: Complete a login with a TOTP or recovery code
+  operationId: verifyMFA
+  tags: [auth]
+  security: []
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema: { $ref: './schemas.yaml#/MFAChallengeInput' }
+  responses:
+    "200":
+      description: authenticated; refresh_token set as an httpOnly cookie
+      content:
+        application/json:
+          schema: { $ref: './schemas.yaml#/AuthResponse' }
+    "400": { $ref: '../common/responses.yaml#/ValidationError' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
+    "429": { $ref: '../common/responses.yaml#/TooManyRequestsError' }