@nakedev/go-scaffold 0.4.3 → 0.5.0

package/templates/add/auth/internal/app/user/composition.go.hbs

@@ -1,89 +1,33 @@
 package user
 
 import (
-	"context"
 	"fmt"
 	"time"
 
+	httpadapter "{{goModule}}/internal/app/user/adapters/inbound/http"
+	userpassword "{{goModule}}/internal/app/user/adapters/outbound/password"
+	userpostgres "{{goModule}}/internal/app/user/adapters/outbound/postgres"
 	"{{goModule}}/internal/app/user/application"
-	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/app/user/ports"
 	googleprovider "{{goModule}}/internal/platform/authprovider/google"
 	"{{goModule}}/internal/platform/mail"
+{{#if worker}}
+	"{{goModule}}/internal/platform/queue"
+{{/if}}
 	"{{goModule}}/internal/shared/config"
 	"{{goModule}}/internal/shared/middleware"
 
-	"github.com/google/uuid"
-	"golang.org/x/crypto/bcrypt"
-	{{#if redis}}
+{{#if redis}}
+	userredis "{{goModule}}/internal/app/user/adapters/outbound/redis"
 	"github.com/redis/go-redis/v9"
-	{{/if}}
-	{{#if worker}}
-	"{{goModule}}/internal/platform/queue"
-	{{/if}}
+{{/if}}
+	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
 )
 
-// recoveryRepositoryAdapter maps persistence models to the plain values used
-// by the application recovery use case. The adapter is the only layer that
-// knows both the GORM model and the application port.
-type recoveryRepositoryAdapter struct {
-	repo repository
-}
-
-func (a recoveryRepositoryAdapter) FindIdentity(ctx context.Context, userID uuid.UUID) (*application.Identity, error) {
-	identity, err := a.repo.FindIdentity(ctx, userID, model.ProviderLocal)
-	if err != nil {
-		return nil, err
-	}
-	if identity.PasswordHash == nil {
-		return nil, fmt.Errorf("local identity has no password")
-	}
-	return &application.Identity{ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash}, nil
-}
-
-func (a recoveryRepositoryAdapter) UpdateIdentity(ctx context.Context, identity *application.Identity) error {
-	current, err := a.repo.FindIdentity(ctx, identity.UserID, model.ProviderLocal)
-	if err != nil {
-		return err
-	}
-	current.PasswordHash = &identity.PasswordHash
-	return a.repo.UpdateIdentity(ctx, current)
-}
-
-func (a recoveryRepositoryAdapter) FindUser(ctx context.Context, userID uuid.UUID) (*application.User, error) {
-	user, err := a.repo.FindByID(ctx, userID)
-	if err != nil {
-		return nil, err
-	}
-	return &application.User{ID: user.ID, EmailVerified: user.EmailVerified}, nil
-}
-
-func (a recoveryRepositoryAdapter) UpdateUser(ctx context.Context, user *application.User) error {
-	current, err := a.repo.FindByID(ctx, user.ID)
-	if err != nil {
-		return err
-	}
-	current.EmailVerified = user.EmailVerified
-	return a.repo.UpdateUser(ctx, current)
-}
-
-type bcryptPasswordHasher struct{}
-
-func (bcryptPasswordHasher) Hash(password string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return "", err
-	}
-	return string(hash), nil
-}
-
-func newRecovery(repo repository, tokens application.RecoveryTokens) *application.Recovery {
-	return application.NewRecovery(recoveryRepositoryAdapter{repo: repo}, tokens, bcryptPasswordHasher{})
-}
-
-// NewHandlerFromDB is auth's local composition root. cmd/api owns shared
-// infrastructure and cross-feature dependencies; repository, token store,
-// mailer, service, limiter, and handler construction stays in this package.
+// NewHandlerFromDB is the user module's composition root. It assembles the
+// application service and adapters here; cmd/api only supplies process-level
+// infrastructure and registers the returned inbound handler.
 func NewHandlerFromDB(
 	db *gorm.DB,
 	cfg config.Config,
@@ -92,23 +36,23 @@ func NewHandlerFromDB(
 {{/if}}
 {{#if worker}}
 	q queue.Enqueuer,
-	{{/if}}
+{{/if}}
 	roleChecker RoleChecker,
-	authz authorizer,
-) *Handler {
+	authz Authorizer,
+) *httpadapter.Handler {
 {{#if redis}}
-tokens := NewRedisTokenStore(rdb, db)
+	tokens := userredis.NewRedisTokenStore(rdb, db)
 {{else}}
-tokens := NewPgTokenStore(db)
+	tokens := userpostgres.NewPgTokenStore(db)
 {{/if}}
 
 {{#if worker}}
-outbound := mail.NewAsyncClient(q)
+	mailer := mail.NewAsyncClient(q)
 {{else}}
-outbound := mail.NewSyncClient(mail.Open(cfg))
+	mailer := mail.NewSyncClient(mail.Open(cfg))
 {{/if}}
 
-	var providers []application.LoginProvider
+	providers := make([]application.LoginProvider, 0, 1)
 	if cfg.GoogleClientID != "" && cfg.GoogleClientSecret != "" && cfg.GoogleOAuthRedirectURI != "" {
 		providers = append(providers, googleprovider.New(googleprovider.Config{
 			ClientID:     cfg.GoogleClientID,
@@ -117,7 +61,7 @@ outbound := mail.NewSyncClient(mail.Open(cfg))
 		}))
 	}
 	providerRegistry := application.NewProviderRegistry(providers...)
-	if err := validateBrowserCookiePolicy(cfg.AuthBrowserTopology, cfg.CookieSameSite, cfg.CookieSecure, cfg.IsProd()); err != nil {
+	if err := httpadapter.ValidateBrowserCookiePolicy(cfg.AuthBrowserTopology, cfg.CookieSameSite, cfg.CookieSecure, cfg.IsProd()); err != nil {
 		panic(err)
 	}
 	if cfg.JWTRefreshTTL <= 0 || cfg.JWTRefreshMaxTTL <= 0 {
@@ -127,17 +71,18 @@ outbound := mail.NewSyncClient(mail.Open(cfg))
 		panic(fmt.Errorf("OAUTH_STATE_TTL_MIN must be positive"))
 	}
 
-	service := NewService(Dependencies{
-		Repository:        NewRepository(db),
+	service := application.NewService(application.Dependencies{
+		Repository:        userpostgres.NewRepository(db),
+		Passwords:         userpassword.NewBCryptHasher(),
 		RefreshTokens:     tokens,
 		OAuthTransactions: tokens,
 		RecoveryTokens:    tokens,
-		MFA:               NewPostgresMFAStore(db),
-		Mailer:            outbound,
+		MFA:               userpostgres.NewPostgresMFAStore(db),
+		Mailer:            mailer,
 		Providers:         providerRegistry,
 		Roles:             roleChecker,
 		Clock:             time.Now,
-	}, AuthConfig{
+	}, application.AuthConfig{
 		JWTSecret:        cfg.JWTSecret,
 		JWTAccessTTL:     cfg.JWTAccessTTL,
 		JWTRefreshTTL:    cfg.JWTRefreshTTL,
@@ -147,7 +92,7 @@ outbound := mail.NewSyncClient(mail.Open(cfg))
 		PasswordResetURL: cfg.PasswordResetURL,
 		EmailVerifyTTL:   cfg.EmailVerifyTTL,
 		EmailVerifyURL:   cfg.EmailVerifyURL,
-		MFA: MFASettings{
+		MFA: application.MFASettings{
 			Enabled:           cfg.AuthMFAEnabled,
 			Issuer:            cfg.MFAIssuer,
 			EncryptionKey:     cfg.MFAEncryptionKey,
@@ -161,5 +106,63 @@ outbound := mail.NewSyncClient(mail.Open(cfg))
 {{else}}
 	limiter := middleware.NewMemoryLimiter()
 {{/if}}
-	return NewHandlerWithOrigins(service, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, cfg.CORSAllowedOrigins, limiter, authz)
+	return httpadapter.NewHandlerWithOrigins(
+		service,
+		cfg.JWTSecret,
+		cfg.JWTRefreshTTL,
+		cfg.CookieSecure,
+		cfg.CookieSameSite,
+		cfg.CORSAllowedOrigins,
+		limiter,
+		authz,
+	)
+}
+
+// Public aliases keep the composition surface small for cmd/seed and for
+// optional RBAC wiring. Consumers do not need to know adapter package names.
+type Dependencies = application.Dependencies
+type AuthConfig = application.AuthConfig
+type MFASettings = application.MFASettings
+type ProviderRegistry = application.ProviderRegistry
+type RoleChecker = ports.RoleChecker
+type Service = application.Service
+type ServicePort = application.ServicePort
+type Repository = userpostgres.Repository
+{{#unless redis}}
+type PgTokenStore = userpostgres.PgTokenStore
+{{/unless}}
+type PostgresMFAStore = userpostgres.PostgresMFAStore
+{{#if redis}}
+type RedisTokenStore = userredis.RedisTokenStore
+{{/if}}
+
+type Authorizer interface {
+	Require(string) gin.HandlerFunc
+}
+
+func NewService(deps Dependencies, cfg AuthConfig) *Service {
+	return application.NewService(deps, cfg)
 }
+
+func ValidateMFASettings(settings MFASettings) error {
+	return application.ValidateMFASettings(settings)
+}
+
+func NewRepository(db *gorm.DB) *Repository {
+	return userpostgres.NewRepository(db)
+}
+
+{{#unless redis}}
+func NewPgTokenStore(db *gorm.DB) *PgTokenStore {
+	return userpostgres.NewPgTokenStore(db)
+}
+{{/unless}}
+
+func NewPostgresMFAStore(db *gorm.DB) *PostgresMFAStore {
+	return userpostgres.NewPostgresMFAStore(db)
+}
+{{#if redis}}
+func NewRedisTokenStore(rdb *redis.Client, db *gorm.DB) *RedisTokenStore {
+	return userredis.NewRedisTokenStore(rdb, db)
+}
+{{/if}}

package/templates/add/auth/internal/app/user/domain/entity.go.hbs

@@ -0,0 +1,41 @@
+// Package domain contains transport- and persistence-neutral user values.
+package domain
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type User struct {
+	ID            uuid.UUID
+	Email         string
+	Name          string
+	AvatarURL     string
+	EmailVerified bool
+	Role          string
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+// DefaultRole is part of auth's persisted user contract. RBAC may add the
+// role catalog later, but every newly issued access token must carry the same
+// default that the users migration applies at the database boundary.
+const DefaultRole = "staff"
+
+type Provider string
+
+const (
+	ProviderLocal  Provider = "local"
+	ProviderGoogle Provider = "google"
+)
+
+type Identity struct {
+	ID           uuid.UUID
+	UserID       uuid.UUID
+	Provider     Provider
+	PasswordHash *string
+	ProviderUID  *string
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}

package/templates/add/auth/internal/app/user/domain/errors.go.hbs

@@ -0,0 +1,32 @@
+package domain
+
+import "errors"
+
+var (
+	ErrNotFound          = errors.New("user not found")
+	ErrConflict          = errors.New("user conflict")
+	ErrInvalidCredential = errors.New("invalid credentials")
+	ErrInvalidToken      = errors.New("invalid or expired token")
+	ErrEmailTaken        = errors.New("email already registered")
+	ErrTooManyAttempts   = errors.New("too many failed attempts")
+	ErrAlreadyVerified   = errors.New("email already verified")
+	ErrMFAUnavailable    = errors.New("MFA is unavailable")
+	ErrMFAInvalid        = errors.New("invalid or expired MFA code")
+	ErrMFAAlreadyEnabled = errors.New("MFA is already enabled")
+	ErrMFANotEnrolled    = errors.New("MFA is not enrolled")
+	ErrMFASetupRequired  = errors.New("MFA setup is required")
+	ErrUnknownRole       = errors.New("unknown role")
+)
+
+type RuleError struct {
+	Code    string
+	Message string
+	Cause   error
+}
+
+func (e *RuleError) Error() string { return e.Message }
+func (e *RuleError) Unwrap() error { return e.Cause }
+
+func Rule(code, message string, cause error) error {
+	return &RuleError{Code: code, Message: message, Cause: cause}
+}

package/templates/add/auth/internal/app/user/ports/password.go.hbs

@@ -0,0 +1,9 @@
+package ports
+
+// PasswordHasher is the application-owned outbound contract for password
+// storage and verification. The algorithm and cost policy belong to an
+// adapter, not to the auth use cases.
+type PasswordHasher interface {
+	Hash(string) (string, error)
+	Compare(hash, password string) error
+}

package/templates/add/auth/internal/app/user/ports/repository.go.hbs

@@ -0,0 +1,90 @@
+// Package ports contains user auth's application-owned outbound contracts.
+package ports
+
+import (
+	"context"
+	"time"
+
+	"{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+type UserRepository interface {
+	FindByEmail(context.Context, string) (*domain.User, error)
+	FindByID(context.Context, uuid.UUID) (*domain.User, error)
+	UpdateUser(context.Context, *domain.User) error
+	FindAll(context.Context, int, int) ([]domain.User, error)
+	FindIdentity(context.Context, uuid.UUID, domain.Provider) (*domain.Identity, error)
+	FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error)
+	CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error
+	CreateIdentity(context.Context, *domain.Identity) error
+	UpdateIdentity(context.Context, *domain.Identity) error
+	LoginLockedUntil(context.Context, string) (time.Time, error)
+	RecordLoginFailure(context.Context, string, int, time.Duration) error
+	ClearLoginFailures(context.Context, string) error
+	// go-scaffold:repository-interface
+}
+
+type AuthMailer interface {
+	Send(context.Context, string, string, string) error
+}
+
+type RoleChecker interface {
+	CodeExists(context.Context, string) (bool, error)
+}
+
+type RefreshTokenRecord struct {
+	UserID            uuid.UUID `json:"user_id"`
+	ExpiresAt         time.Time `json:"expires_at"`
+	AbsoluteExpiresAt time.Time `json:"absolute_expires_at"`
+}
+
+type RefreshTokenStore interface {
+	SetRefreshToken(context.Context, string, RefreshTokenRecord) error
+	GetRefreshToken(context.Context, string) (uuid.UUID, bool, error)
+	ConsumeRefreshToken(context.Context, string) (RefreshTokenRecord, bool, error)
+	DeleteRefreshToken(context.Context, string, uuid.UUID) error
+	RevokeAllRefreshTokens(context.Context, uuid.UUID) error
+	IsRefreshTokenUsed(context.Context, string) (uuid.UUID, bool, error)
+}
+
+type LoginTransaction struct {
+	Provider      string    `json:"provider"`
+	CodeChallenge string    `json:"code_challenge"`
+	Nonce         string    `json:"nonce"`
+	ExpiresAt     time.Time `json:"expires_at"`
+}
+
+type OAuthTransactionStore interface {
+	SetLoginTransaction(context.Context, string, LoginTransaction) error
+	ConsumeLoginTransaction(context.Context, string) (LoginTransaction, bool, error)
+}
+
+type RecoveryTokenStore interface {
+	WithTransaction(context.Context, func(context.Context) error) error
+	ConsumePasswordResetToken(context.Context, string) (uuid.UUID, bool, error)
+	ConsumeEmailVerifyToken(context.Context, string) (uuid.UUID, bool, error)
+	SetPasswordResetToken(context.Context, string, uuid.UUID, time.Duration) error
+	SetEmailVerifyToken(context.Context, string, uuid.UUID, time.Duration) error
+}
+
+type MFAEnrollment struct {
+	EncryptedSecret string
+	Enabled         bool
+}
+
+type MFAChallenge struct {
+	UserID    uuid.UUID
+	ExpiresAt time.Time
+}
+
+type MFAStore interface {
+	GetEnrollment(context.Context, uuid.UUID) (MFAEnrollment, bool, error)
+	PutPendingEnrollment(context.Context, uuid.UUID, string) error
+	ConfirmEnrollment(context.Context, uuid.UUID, string, []string) error
+	Disable(context.Context, uuid.UUID) error
+	CreateChallenge(context.Context, string, MFAChallenge) error
+	ConsumeChallenge(context.Context, string) (MFAChallenge, bool, error)
+	ConsumeRecoveryCode(context.Context, uuid.UUID, string) (bool, error)
+}

package/templates/add/auth/migrations/create_auth_tokens.up.sql.hbs

@@ -1,6 +1,6 @@
 -- Durable recovery tokens for both refresh-store choices. Refresh rotation may
 -- use Redis, but password reset and email verification share this DB contract.
--- Only the SHA-256 hash is stored; see model/authtoken.go for what `kind`
+-- Only the SHA-256 hash is stored; see adapters/outbound/postgres/model.go for what `kind`
 -- means and why the rotation tombstone is a separate row.
 CREATE TABLE user_svc.auth_tokens (
     token_hash TEXT PRIMARY KEY,

package/templates/add/auth/migrations/create_login_throttle.up.sql.hbs

@@ -1,7 +1,7 @@
 -- Failed-attempt counter per account. Keyed on a hash of the submitted email
 -- so it works for addresses that have no account (otherwise throttling itself
 -- leaks which addresses are registered) and so this table is not a user list.
--- See model/loginthrottle.go for why this exists separately from the rate limiter.
+-- See adapters/outbound/postgres/model.go for why this exists separately from the rate limiter.
 CREATE TABLE user_svc.login_throttle (
     email_hash   TEXT PRIMARY KEY,
     failures     INTEGER NOT NULL DEFAULT 0,

package/templates/add/auth/migrations/create_users.up.sql.hbs

@@ -6,12 +6,13 @@ CREATE TABLE user_svc.users (
     name           VARCHAR(255) NOT NULL DEFAULT '',
     avatar_url     TEXT NOT NULL DEFAULT '',
     email_verified BOOLEAN NOT NULL DEFAULT false,
+    role           VARCHAR(20) NOT NULL DEFAULT 'staff',
     created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
 );
 
 -- A unique INDEX, not an inline UNIQUE constraint, and named to match the
--- `uniqueIndex:idx_users_email` tag on model.User exactly. Postgres names an
+-- `uniqueIndex:idx_users_email` tag on the outbound persistence model exactly. Postgres names an
 -- inline UNIQUE "users_email_key"; the development bootstrap then sees
 -- uniqueness it didn't create and tries to drop it under its own
 -- name, which fails the boot with

package/templates/add/rbac/internal/app/role/adapters/inbound/http/handler.go.hbs

@@ -0,0 +1,142 @@
+// Package httpadapter is role's inbound HTTP boundary. It owns route,
+// authentication middleware, request binding, response DTOs, and translation
+// from application errors to the API error envelope.
+package httpadapter
+
+import (
+	"errors"
+	"net/http"
+
+	"{{goModule}}/internal/app/role/application"
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+	"{{goModule}}/internal/shared/pagination"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	svc       application.ServicePort
+	jwtSecret string
+	authz     *middleware.Authz
+}
+
+func NewHandler(svc application.ServicePort, jwtSecret string, authz *middleware.Authz) *Handler {
+	return &Handler{svc: svc, jwtSecret: jwtSecret, authz: authz}
+}
+
+func (h *Handler) Register(rg gin.IRouter) {
+	roles := rg.Group("/roles", middleware.RequireAuth(h.jwtSecret), h.authz.Require(application.PermRoleManage))
+	roles.GET("", h.list)
+	roles.POST("", h.create)
+	roles.PATCH("/:code/permissions", h.setPermissions)
+	roles.DELETE("/:code", h.delete)
+
+	perms := rg.Group("/permissions", middleware.RequireAuth(h.jwtSecret), h.authz.Require(application.PermRoleManage))
+	perms.GET("", h.listPermissions)
+}
+
+func (h *Handler) list(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]application.RoleResponse, len(items))
+	for i := range items {
+		out[i] = application.ToRoleResponse(items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+
+func (h *Handler) create(c *gin.Context) {
+	var in application.CreateInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	item, err := h.svc.Create(c.Request.Context(), in)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusCreated, application.ToRoleResponse(*item))
+}
+
+func (h *Handler) setPermissions(c *gin.Context) {
+	var in application.SetPermissionsInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if in.PermissionCodes == nil {
+		c.Error(apperror.NewValidation("invalid role input", map[string]string{"permission_codes": "is required"}))
+		return
+	}
+	item, err := h.svc.SetPermissions(c.Request.Context(), c.Param("code"), *in.PermissionCodes)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.authz.Invalidate(item.Role.Code)
+	c.JSON(http.StatusOK, application.ToRoleResponse(*item))
+}
+
+func (h *Handler) delete(c *gin.Context) {
+	if err := h.svc.Delete(c.Request.Context(), c.Param("code")); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.authz.Invalidate(c.Param("code"))
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) listPermissions(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.ListPermissions(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]application.PermissionResponse, len(items))
+	for i := range items {
+		out[i] = application.ToPermissionResponse(items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+
+func toHTTPError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var appErr *apperror.AppError
+	if errors.As(err, &appErr) {
+		return err
+	}
+	var rule *domain.RuleError
+	if errors.As(err, &rule) {
+		status := http.StatusUnprocessableEntity
+		switch {
+		case errors.Is(err, domain.ErrNotFound):
+			status = http.StatusNotFound
+		case errors.Is(err, domain.ErrConflict), errors.Is(err, domain.ErrHasReferences), errors.Is(err, domain.ErrSystemRole), errors.Is(err, domain.ErrLastRoleManager):
+			status = http.StatusConflict
+		}
+		return apperror.New(status, rule.Code, rule.Message)
+	}
+	switch {
+	case errors.Is(err, domain.ErrNotFound):
+		return apperror.New(http.StatusNotFound, "ROLE_NOT_FOUND", "role not found")
+	case errors.Is(err, domain.ErrConflict):
+		return apperror.New(http.StatusConflict, "ROLE_CONFLICT", "role conflict")
+	case errors.Is(err, domain.ErrHasReferences):
+		return apperror.New(http.StatusConflict, "ROLE_HAS_REFERENCES", "role still has users assigned to it")
+	case errors.Is(err, domain.ErrUnknownPermission):
+		return apperror.New(http.StatusUnprocessableEntity, "ROLE_UNKNOWN_PERMISSION", "one or more permission codes do not exist")
+	default:
+		return apperror.NewInternal(err)
+	}
+}

package/templates/add/rbac/internal/app/role/adapters/inbound/http/handler_test.go.hbs

@@ -0,0 +1,19 @@
+package httpadapter
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestHandler_Register(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	authz := middleware.NewAuthz(func(context.Context, string) (map[string]struct{}, error) {
+		return map[string]struct{}{}, nil
+	}, time.Minute)
+	NewHandler(nil, "", authz).Register(gin.New())
+}

package/templates/add/rbac/internal/app/role/adapters/outbound/postgres/model.go.hbs

@@ -0,0 +1,48 @@
+// Package postgres contains role persistence records. They are deliberately
+// separate from role/domain so schema tags cannot leak into use cases.
+package postgres
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+type Role struct {
+	Code      string `gorm:"type:varchar(20);primaryKey"`
+	Name      string `gorm:"not null"`
+	IsSystem  bool   `gorm:"not null;default:false"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+func (Role) TableName() string { return "role_svc.roles" }
+
+type Permission struct {
+	Code        string `gorm:"type:varchar(50);primaryKey"`
+	Description string `gorm:"not null"`
+}
+
+func (Permission) TableName() string { return "role_svc.permissions" }
+
+type RolePermission struct {
+	RoleCode       string `gorm:"primaryKey;type:varchar(20)"`
+	PermissionCode string `gorm:"primaryKey;type:varchar(50)"`
+}
+
+func (RolePermission) TableName() string { return "role_svc.role_permissions" }
+
+func toDomainRole(row *Role) domain.Role {
+	return domain.Role{Code: row.Code, Name: row.Name, IsSystem: row.IsSystem, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt}
+}
+
+func fromDomainRole(value *domain.Role) *Role {
+	if value == nil {
+		return nil
+	}
+	return &Role{Code: value.Code, Name: value.Name, IsSystem: value.IsSystem, CreatedAt: value.CreatedAt, UpdatedAt: value.UpdatedAt}
+}
+
+func toDomainPermission(row *Permission) domain.Permission {
+	return domain.Permission{Code: row.Code, Description: row.Description}
+}