@nakedev/go-scaffold 0.4.3 → 0.5.0

package/templates/add/auth/internal/app/user/{service_test.go.hbs → application/service_test.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package application
 
 import (
 	"context"
@@ -9,12 +9,9 @@ import (
 	"testing"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/app/user/application"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
-	"gorm.io/gorm"
 )
 
 // testTokenStore is the deliberately broad test-only composition used to
@@ -29,29 +26,29 @@ type testTokenStore interface {
 // three-map shape (active / used-tombstone / per-user session set) closely
 // enough to exercise rotation + reuse-detection without a real Redis.
 type fakeTokenStore struct {
-	mu          sync.Mutex
-	txMu        sync.Mutex
-	active      map[string]refreshTokenRecord
-	used        map[string]uuid.UUID
-	sessions    map[uuid.UUID]map[string]struct{}
-	transactions map[string]loginTransaction
-	reset       map[string]uuid.UUID
-	verify      map[string]uuid.UUID
+	mu           sync.Mutex
+	txMu         sync.Mutex
+	active       map[string]RefreshTokenRecord
+	used         map[string]uuid.UUID
+	sessions     map[uuid.UUID]map[string]struct{}
+	transactions map[string]LoginTransaction
+	reset        map[string]uuid.UUID
+	verify       map[string]uuid.UUID
 	revokeAllErr error
 }
 
 func newFakeTokenStore() *fakeTokenStore {
 	return &fakeTokenStore{
-		active:       map[string]refreshTokenRecord{},
+		active:       map[string]RefreshTokenRecord{},
 		used:         map[string]uuid.UUID{},
 		sessions:     map[uuid.UUID]map[string]struct{}{},
-		transactions: map[string]loginTransaction{},
+		transactions: map[string]LoginTransaction{},
 		reset:        map[string]uuid.UUID{},
 		verify:       map[string]uuid.UUID{},
 	}
 }
 
-func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, token refreshTokenRecord) error {
+func (f *fakeTokenStore) SetRefreshToken(_ context.Context, hash string, token RefreshTokenRecord) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.active[hash] = token
@@ -71,12 +68,12 @@ func (f *fakeTokenStore) GetRefreshToken(_ context.Context, hash string) (uuid.U
 	return token.UserID, true, nil
 }
 
-func (f *fakeTokenStore) ConsumeRefreshToken(_ context.Context, hash string) (refreshTokenRecord, bool, error) {
+func (f *fakeTokenStore) ConsumeRefreshToken(_ context.Context, hash string) (RefreshTokenRecord, bool, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	token, ok := f.active[hash]
 	if !ok || !token.ExpiresAt.After(time.Now()) {
-		return refreshTokenRecord{}, false, nil
+		return RefreshTokenRecord{}, false, nil
 	}
 	delete(f.active, hash)
 	delete(f.sessions[token.UserID], hash)
@@ -138,8 +135,8 @@ func (f *fakeTokenStore) WithTransaction(ctx context.Context, fn func(context.Co
 	return err
 }
 
-func cloneRefreshTokenMap(in map[string]refreshTokenRecord) map[string]refreshTokenRecord {
-	out := make(map[string]refreshTokenRecord, len(in))
+func cloneRefreshTokenMap(in map[string]RefreshTokenRecord) map[string]RefreshTokenRecord {
+	out := make(map[string]RefreshTokenRecord, len(in))
 	for key, value := range in {
 		out[key] = value
 	}
@@ -154,27 +151,27 @@ func cloneTokenMap(in map[string]uuid.UUID) map[string]uuid.UUID {
 	return out
 }
 
-func cloneLoginTransactions(in map[string]loginTransaction) map[string]loginTransaction {
-	out := make(map[string]loginTransaction, len(in))
+func cloneLoginTransactions(in map[string]LoginTransaction) map[string]LoginTransaction {
+	out := make(map[string]LoginTransaction, len(in))
 	for key, value := range in {
 		out[key] = value
 	}
 	return out
 }
 
-func (f *fakeTokenStore) SetLoginTransaction(_ context.Context, hash string, transaction loginTransaction) error {
+func (f *fakeTokenStore) SetLoginTransaction(_ context.Context, hash string, transaction LoginTransaction) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.transactions[hash] = transaction
 	return nil
 }
 
-func (f *fakeTokenStore) ConsumeLoginTransaction(_ context.Context, hash string) (loginTransaction, bool, error) {
+func (f *fakeTokenStore) ConsumeLoginTransaction(_ context.Context, hash string) (LoginTransaction, bool, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	transaction, ok := f.transactions[hash]
 	if !ok || !transaction.ExpiresAt.After(time.Now()) {
-		return loginTransaction{}, false, nil
+		return LoginTransaction{}, false, nil
 	}
 	delete(f.transactions, hash)
 	return transaction, true, nil
@@ -309,12 +306,13 @@ func (f *fakeMFAStore) ConsumeRecoveryCode(_ context.Context, userID uuid.UUID,
 // by the tests below (Refresh looks the user up after validating the
 // token), the rest just satisfy the interface.
 type fakeRepo struct {
-	user              *model.User
-	identity          *model.Identity
+	user              *domain.User
+	identity          *domain.Identity
 	updateIdentityErr error
 	updateUserErr     error
 	failures          map[string]int
 	lockedUntil       map[string]time.Time
+	// go-scaffold:repository-stub-fields
 }
 
 // throttle: the fake keeps the counter in memory so the lockout path can be
@@ -346,36 +344,38 @@ func (f *fakeRepo) ClearLoginFailures(_ context.Context, key string) error {
 	return nil
 }
 
-func (f *fakeRepo) FindByEmail(context.Context, string) (*model.User, error) {
-	return nil, gorm.ErrRecordNotFound
+func (f *fakeRepo) FindByEmail(context.Context, string) (*domain.User, error) {
+	return nil, domain.ErrNotFound
 }
-func (f *fakeRepo) FindByID(_ context.Context, id uuid.UUID) (*model.User, error) {
+func (f *fakeRepo) FindByID(_ context.Context, id uuid.UUID) (*domain.User, error) {
 	if f.user != nil && f.user.ID == id {
 		return f.user, nil
 	}
-	return nil, gorm.ErrRecordNotFound
+	return nil, domain.ErrNotFound
 }
-func (f *fakeRepo) UpdateUser(_ context.Context, u *model.User) error {
+func (f *fakeRepo) UpdateUser(_ context.Context, u *domain.User) error {
 	if f.updateUserErr != nil {
 		return f.updateUserErr
 	}
 	f.user = u
 	return nil
 }
-func (f *fakeRepo) FindAll(context.Context, int, int) ([]model.User, error) { return nil, nil }
-func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, _ model.Provider) (*model.Identity, error) {
+func (f *fakeRepo) FindAll(context.Context, int, int) ([]domain.User, error) { return nil, nil }
+func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, _ domain.Provider) (*domain.Identity, error) {
 	if f.identity != nil && f.identity.UserID == userID {
 		copy := *f.identity
 		return &copy, nil
 	}
-	return nil, gorm.ErrRecordNotFound
+	return nil, domain.ErrNotFound
+}
+func (f *fakeRepo) FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error) {
+	return nil, domain.ErrNotFound
 }
-func (f *fakeRepo) FindIdentityByProviderUID(context.Context, model.Provider, string) (*model.Identity, error) {
-	return nil, gorm.ErrRecordNotFound
+func (f *fakeRepo) CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error {
+	return nil
 }
-func (f *fakeRepo) CreateUserWithIdentity(context.Context, *model.User, *model.Identity) error { return nil }
-func (f *fakeRepo) CreateIdentity(context.Context, *model.Identity) error                      { return nil }
-func (f *fakeRepo) UpdateIdentity(_ context.Context, i *model.Identity) error {
+func (f *fakeRepo) CreateIdentity(context.Context, *domain.Identity) error { return nil }
+func (f *fakeRepo) UpdateIdentity(_ context.Context, i *domain.Identity) error {
 	if f.updateIdentityErr != nil {
 		return f.updateIdentityErr
 	}
@@ -384,11 +384,28 @@ func (f *fakeRepo) UpdateIdentity(_ context.Context, i *model.Identity) error {
 }
 
 // go-scaffold:user-fake-repo-methods
+// go-scaffold:repository-stub-methods
 
 type fakeMailer struct{}
 
 func (fakeMailer) Send(context.Context, string, string, string) error { return nil }
 
+type fakePasswordHasher struct{}
+
+func (fakePasswordHasher) Hash(password string) (string, error) { return "hashed:" + password, nil }
+
+func (fakePasswordHasher) Compare(hash, password string) error {
+	if hash != "hashed:"+password {
+		return errors.New("password does not match")
+	}
+	return nil
+}
+
+// fakeRoles satisfies role's roleChecker interface structurally.
+type fakeRoles struct{}
+
+func (fakeRoles) CodeExists(context.Context, string) (bool, error) { return true, nil }
+
 // go-scaffold:user-service-test-types
 
 // newTestService is the one NewService call site every test below shares —
@@ -398,12 +415,14 @@ func (fakeMailer) Send(context.Context, string, string, string) error { return n
 func newTestService(repo repository, tokens testTokenStore) *Service {
 	return NewService(Dependencies{
 		Repository:        repo,
+		Passwords:         fakePasswordHasher{},
 		RefreshTokens:     tokens,
 		OAuthTransactions: tokens,
 		RecoveryTokens:    tokens,
 		MFA:               newFakeMFAStore(),
 		Mailer:            fakeMailer{},
-		Providers:         application.NewProviderRegistry(),
+		Providers:         NewProviderRegistry(),
+		Roles:             fakeRoles{},
 		// go-scaffold:user-service-test-deps
 	}, AuthConfig{
 		JWTSecret:        "test-secret",
@@ -416,25 +435,25 @@ func newTestService(repo repository, tokens testTokenStore) *Service {
 
 func seedRefreshToken(ctx context.Context, tokens *fakeTokenStore, raw string, userID uuid.UUID, ttl time.Duration) error {
 	now := time.Now()
-	return tokens.SetRefreshToken(ctx, hashToken(raw), refreshTokenRecord{
+	return tokens.SetRefreshToken(ctx, hashToken(raw), RefreshTokenRecord{
 		UserID:            userID,
 		ExpiresAt:         now.Add(ttl),
 		AbsoluteExpiresAt: now.Add(24 * time.Hour),
 	})
 }
 
-func testRefreshTokenRecord(userID uuid.UUID) refreshTokenRecord {
-	now := time.Now()
-	return refreshTokenRecord{UserID: userID, ExpiresAt: now.Add(time.Hour), AbsoluteExpiresAt: now.Add(24 * time.Hour)}
-}
-
 func status(t *testing.T, err error) int {
 	t.Helper()
-	var appErr *apperror.AppError
-	if !errors.As(err, &appErr) {
-		t.Fatalf("expected *apperror.AppError, got %T: %v", err, err)
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		switch ruleErr.Code {
+		case "AUTH_INVALID_TOKEN", "AUTH_INVALID_CREDENTIALS":
+			return http.StatusUnauthorized
+		case "AUTH_TOO_MANY_ATTEMPTS":
+			return http.StatusTooManyRequests
+		}
 	}
-	return appErr.HTTPStatus
+	return http.StatusInternalServerError
 }
 
 func TestService_Refresh_RotatesTheToken(t *testing.T) {
@@ -445,7 +464,7 @@ func TestService_Refresh_RotatesTheToken(t *testing.T) {
 	if err := seedRefreshToken(ctx, tokens, rawOld, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
 
 	auth, err := svc.Refresh(ctx, rawOld)
 	if err != nil {
@@ -470,7 +489,7 @@ func TestService_Refresh_ConcurrentPresentationHasOneWinner(t *testing.T) {
 	if err := seedRefreshToken(ctx, tokens, raw, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
 
 	const callers = 32
 	start := make(chan struct{})
@@ -509,7 +528,7 @@ func TestService_Refresh_ReplayingARotatedOutTokenRevokesEverySession(t *testing
 	if err := seedRefreshToken(ctx, tokens, rawOtherSession, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "a@example.com"}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "a@example.com"}}, tokens)
 
 	// rotate rawOld once — legitimate use, consumes + tombstones it
 	if _, err := svc.Refresh(ctx, rawOld); err != nil {
@@ -533,14 +552,14 @@ func TestService_Refresh_DoesNotExtendTheAbsoluteLifetime(t *testing.T) {
 	raw := "bounded-refresh-token"
 	issuedAt := time.Now()
 	absoluteExpiry := issuedAt.Add(2 * time.Hour)
-	if err := tokens.SetRefreshToken(ctx, hashToken(raw), refreshTokenRecord{
+	if err := tokens.SetRefreshToken(ctx, hashToken(raw), RefreshTokenRecord{
 		UserID:            userID,
 		ExpiresAt:         issuedAt.Add(time.Hour),
 		AbsoluteExpiresAt: absoluteExpiry,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
 	rotationTime := issuedAt.Add(90 * time.Minute)
 	svc.now = func() time.Time { return rotationTime }
 
@@ -571,7 +590,7 @@ func TestService_Refresh_ReuseRevokeFailureFailsClosed(t *testing.T) {
 	if err := seedRefreshToken(ctx, tokens, rawOther, userID, time.Hour); err != nil {
 		t.Fatalf("seed other token: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
 	if _, err := svc.Refresh(ctx, rawOld); err != nil {
 		t.Fatalf("initial rotation: %v", err)
 	}
@@ -592,7 +611,7 @@ func TestService_Refresh_UnknownTokenIsRejectedWithoutRevoking(t *testing.T) {
 	if err := seedRefreshToken(ctx, tokens, rawLegit, userID, time.Hour); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
 
 	_, err := svc.Refresh(ctx, "never-issued-token")
 	if got := status(t, err); got != http.StatusUnauthorized {
@@ -616,7 +635,7 @@ func TestService_LogoutAll_RevokesEverySessionButLeavesOthersAlone(t *testing.T)
 			t.Fatalf("seed: %v", err)
 		}
 	}
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID}}, tokens)
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID}}, tokens)
 
 	if err := svc.LogoutAll(ctx, userID); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -637,8 +656,8 @@ func TestService_ResetPassword_DBFailureAllowsRetry(t *testing.T) {
 	userID := uuid.New()
 	passwordHash := "old-hash"
 	repo := &fakeRepo{
-		user:     &model.User{ID: userID},
-		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+		user:              &domain.User{ID: userID},
+		identity:          &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
 		updateIdentityErr: errors.New("database unavailable"),
 	}
 	tokens := newFakeTokenStore()
@@ -662,8 +681,8 @@ func TestService_ResetPassword_SessionRevokeFailureRestoresTokenForRetry(t *test
 	userID := uuid.New()
 	passwordHash := "old-hash"
 	repo := &fakeRepo{
-		user:     &model.User{ID: userID},
-		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
 	}
 	tokens := newFakeTokenStore()
 	raw := "reset-token-session-store-outage"
@@ -691,7 +710,7 @@ func TestService_VerifyEmail_DBFailureAllowsRetry(t *testing.T) {
 	ctx := context.Background()
 	userID := uuid.New()
 	repo := &fakeRepo{
-		user:          &model.User{ID: userID},
+		user:          &domain.User{ID: userID},
 		updateUserErr: errors.New("database unavailable"),
 	}
 	tokens := newFakeTokenStore()
@@ -715,8 +734,8 @@ func TestService_ResetPassword_DuplicateTokenIsRejected(t *testing.T) {
 	userID := uuid.New()
 	passwordHash := "old-hash"
 	repo := &fakeRepo{
-		user:     &model.User{ID: userID},
-		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
 	}
 	tokens := newFakeTokenStore()
 	raw := "one-time-reset-token"
@@ -737,8 +756,8 @@ func TestService_ResetPassword_ConcurrentPresentationHasOneWinner(t *testing.T)
 	userID := uuid.New()
 	passwordHash := "old-hash"
 	repo := &fakeRepo{
-		user:     &model.User{ID: userID},
-		identity: &model.Identity{ID: uuid.New(), UserID: userID, Provider: model.ProviderLocal, PasswordHash: &passwordHash},
+		user:     &domain.User{ID: userID},
+		identity: &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &passwordHash},
 	}
 	tokens := newFakeTokenStore()
 	raw := "concurrent-reset-token"
@@ -774,7 +793,7 @@ func TestService_ResetPassword_ConcurrentPresentationHasOneWinner(t *testing.T)
 func TestService_VerifyEmail_DuplicateTokenIsRejected(t *testing.T) {
 	ctx := context.Background()
 	userID := uuid.New()
-	repo := &fakeRepo{user: &model.User{ID: userID}}
+	repo := &fakeRepo{user: &domain.User{ID: userID}}
 	tokens := newFakeTokenStore()
 	raw := "one-time-verification-token"
 	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
@@ -792,7 +811,7 @@ func TestService_VerifyEmail_DuplicateTokenIsRejected(t *testing.T) {
 func TestService_VerifyEmail_ConcurrentPresentationHasOneWinner(t *testing.T) {
 	ctx := context.Background()
 	userID := uuid.New()
-	repo := &fakeRepo{user: &model.User{ID: userID}}
+	repo := &fakeRepo{user: &domain.User{ID: userID}}
 	tokens := newFakeTokenStore()
 	raw := "concurrent-verification-token"
 	if err := tokens.SetEmailVerifyToken(ctx, hashToken(raw), userID, time.Hour); err != nil {
@@ -828,11 +847,11 @@ func TestService_VerifyEmail_ConcurrentPresentationHasOneWinner(t *testing.T) {
 // account, so spreading attempts across a proxy pool doesn't help.
 func TestService_Login_LocksTheAccountAfterRepeatedFailures(t *testing.T) {
 	repo := &fakeRepo{
-		user:     &model.User{ID: uuid.New(), Email: "a@example.com"},
+		user:     &domain.User{ID: uuid.New(), Email: "a@example.com"},
 		failures: map[string]int{},
 	}
 	svc := newTestService(repo, newFakeTokenStore())
-	in := loginInput{Email: "a@example.com", Password: "wrong"}
+	in := LoginInput{Email: "a@example.com", Password: "wrong"}
 
 	// the free attempts answer "wrong password", not "locked"
 	for i := 0; i < loginFreeAttempts; i++ {
@@ -864,9 +883,9 @@ func TestService_ForgotPassword_HasItsOwnCounter(t *testing.T) {
 // code pulls the AppError code out, so a test asserting on behaviour doesn't
 // have to care how the error is wrapped.
 func code(err error) string {
-	var appErr *apperror.AppError
-	if errors.As(err, &appErr) {
-		return appErr.Code
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		return ruleErr.Code
 	}
 	return fmt.Sprintf("%v", err)
 }

package/templates/add/auth/internal/app/user/{sessions.go.hbs → application/sessions.go.hbs}

@@ -1,12 +1,11 @@
-package user
+package application
 
 import (
 	"context"
 	"fmt"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
 )
@@ -14,20 +13,20 @@ import (
 // Refresh rotates a refresh token. A replayed, already-used token revokes
 // every session for that user; an intentionally logged-out token is rejected
 // without triggering reuse detection.
-func (s *Service) Refresh(ctx context.Context, rawRefreshToken string) (*authResponse, error) {
+func (s *Service) Refresh(ctx context.Context, rawRefreshToken string) (*AuthResponse, error) {
 	hash := hashToken(rawRefreshToken)
 	token, ok, err := s.refreshTokens.ConsumeRefreshToken(ctx, hash)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("consume refresh token: %w", err))
+		return nil, fmt.Errorf("consume refresh token: %w", err)
 	}
 	if !ok {
 		reusedBy, used, reuseErr := s.refreshTokens.IsRefreshTokenUsed(ctx, hash)
 		if reuseErr != nil {
-			return nil, apperror.NewInternal(fmt.Errorf("check refresh token reuse: %w", reuseErr))
+			return nil, fmt.Errorf("check refresh token reuse: %w", reuseErr)
 		}
 		if used {
 			if revokeErr := s.refreshTokens.RevokeAllRefreshTokens(ctx, reusedBy); revokeErr != nil {
-				return nil, apperror.NewInternal(fmt.Errorf("revoke sessions after refresh token reuse: %w", revokeErr))
+				return nil, fmt.Errorf("revoke sessions after refresh token reuse: %w", revokeErr)
 			}
 		}
 		return nil, errInvalidToken()
@@ -59,17 +58,18 @@ func (s *Service) LogoutAll(ctx context.Context, userID uuid.UUID) error {
 	return s.refreshTokens.RevokeAllRefreshTokens(ctx, userID)
 }
 
-func (s *Service) issueTokens(ctx context.Context, u *model.User, absoluteExpiresAt ...time.Time) (*authResponse, error) {
+func (s *Service) issueTokens(ctx context.Context, u *domain.User, absoluteExpiresAt ...time.Time) (*AuthResponse, error) {
 	access, err := s.issueAccessToken(
 		u.ID,
+		u.Role,
 		// go-scaffold:issue-access-token-args
 	)
 	if err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("issue access token: %w", err)
 	}
 	refresh, err := randomToken()
 	if err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("generate refresh token: %w", err)
 	}
 	clock := s.now
 	if clock == nil {
@@ -85,12 +85,12 @@ func (s *Service) issueTokens(ctx context.Context, u *model.User, absoluteExpire
 		expiresAt = abs
 	}
 	if !expiresAt.After(now) || !abs.After(now) {
-		return nil, apperror.NewInternal(fmt.Errorf("refresh token lifetime is exhausted"))
+		return nil, fmt.Errorf("refresh token lifetime is exhausted")
 	}
-	if err := s.refreshTokens.SetRefreshToken(ctx, hashToken(refresh), refreshTokenRecord{UserID: u.ID, ExpiresAt: expiresAt, AbsoluteExpiresAt: abs}); err != nil {
-		return nil, apperror.NewInternal(err)
+	if err := s.refreshTokens.SetRefreshToken(ctx, hashToken(refresh), RefreshTokenRecord{UserID: u.ID, ExpiresAt: expiresAt, AbsoluteExpiresAt: abs}); err != nil {
+		return nil, fmt.Errorf("store refresh token: %w", err)
 	}
-	return &authResponse{
+	return &AuthResponse{
 		AccessToken:  access,
 		RefreshToken: refresh,
 		TokenType:    "Bearer",

package/templates/add/auth/internal/app/user/application/tokenstore_ports.go.hbs

@@ -0,0 +1,14 @@
+package application
+
+import "{{goModule}}/internal/app/user/ports"
+
+// These aliases keep the use-case files readable while the actual outbound
+// contracts remain owned by the user module's ports package.
+type RefreshTokenStore = ports.RefreshTokenStore
+type OAuthTransactionStore = ports.OAuthTransactionStore
+type RecoveryTokenStore = ports.RecoveryTokenStore
+type RefreshTokenRecord = ports.RefreshTokenRecord
+type LoginTransaction = ports.LoginTransaction
+type MFAEnrollment = ports.MFAEnrollment
+type MFAChallenge = ports.MFAChallenge
+type MFAStore = ports.MFAStore

package/templates/add/auth/internal/app/user/{user_query.go.hbs → application/user_query.go.hbs}

@@ -1,16 +1,14 @@
-package user
+package application
 
 import (
 	"context"
 	"errors"
+	"fmt"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/user/domain"
 	"{{goModule}}/internal/shared/id"
 
 	"github.com/google/uuid"
-	"golang.org/x/crypto/bcrypt"
-	"gorm.io/gorm"
 )
 
 // wrapFindErr is shared by methods added through `generate method`. Keeping
@@ -18,13 +16,13 @@ import (
 // does not need to import database-specific error packages just because a
 // later method was generated.
 func wrapFindErr(err error) error {
-	if errors.Is(err, gorm.ErrRecordNotFound) {
+	if errors.Is(err, domain.ErrNotFound) {
 		return errNotFound()
 	}
-	return apperror.NewInternal(err)
+	return fmt.Errorf("find user: %w", err)
 }
 
-func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*model.User, error) {
+func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*domain.User, error) {
 	u, err := s.repo.FindByID(ctx, userID)
 	if err != nil {
 		return nil, wrapFindErr(err)
@@ -34,32 +32,34 @@ func (s *Service) Get(ctx context.Context, userID uuid.UUID) (*model.User, error
 
 // List is kept for the optional RBAC admin routes. It is not part of the
 // public self-service auth surface until that feature is installed.
-func (s *Service) List(ctx context.Context, limit, offset int) ([]model.User, error) {
+func (s *Service) List(ctx context.Context, limit, offset int) ([]domain.User, error) {
 	items, err := s.repo.FindAll(ctx, limit, offset)
 	if err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("list users: %w", err)
 	}
 	return items, nil
 }
 
 // EnsureUser is idempotent and used only by cmd/seed. It never resets an
 // existing user's password as a side effect of a later deployment.
-func (s *Service) EnsureUser(ctx context.Context, email, password, name string) (*model.User, error) {
+func (s *Service) EnsureUser(ctx context.Context, email, password, name string) (*domain.User, error) {
 	email = normalizeEmail(email)
 	if u, err := s.repo.FindByEmail(ctx, email); err == nil {
 		return u, nil
+	} else if !errors.Is(err, domain.ErrNotFound) {
+		return nil, fmt.Errorf("find existing user: %w", err)
 	}
 
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	hash, err := s.passwords.Hash(password)
 	if err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("hash password: %w", err)
 	}
 	hashStr := string(hash)
 
-	u := &model.User{ID: id.New(), Email: email, Name: name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
+	u := &domain.User{ID: id.New(), Email: email, Name: name, Role: domain.DefaultRole}
+	i := &domain.Identity{ID: id.New(), Provider: domain.ProviderLocal, PasswordHash: &hashStr}
 	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("create user: %w", err)
 	}
 	return u, nil
 }