@nakedev/go-scaffold 0.4.3 → 0.5.0

package/templates/add/rbac/internal/app/role/adapters/outbound/postgres/repository.go.hbs

@@ -0,0 +1,127 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
+	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/shared/tx"
+
+	"gorm.io/gorm"
+)
+
+var _ ports.Repository = (*Repository)(nil)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+func NewRepository(db *gorm.DB) *Repository { return &Repository{db: db} }
+
+func (r *Repository) PermissionCodes(ctx context.Context, roleCode string) ([]string, error) {
+	var codes []string
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Model(&RolePermission{}).Where("role_code = ?", roleCode).Pluck("permission_code", &codes).Error
+	return codes, mapDatabaseError(err)
+}
+
+func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.Role, error) {
+	var rows []Role
+	err := tx.From(ctx, r.db).WithContext(ctx).Order("code").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	items := make([]domain.Role, len(rows))
+	for i := range rows {
+		items[i] = toDomainRole(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) FindByCode(ctx context.Context, code string) (*domain.Role, error) {
+	var row Role
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "code = ?", code).Error; err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	value := toDomainRole(&row)
+	return &value, nil
+}
+
+func (r *Repository) Create(ctx context.Context, role *domain.Role) error {
+	return mapDatabaseError(tx.From(ctx, r.db).WithContext(ctx).Create(fromDomainRole(role)).Error)
+}
+
+func (r *Repository) SetPermissions(ctx context.Context, roleCode string, permissionCodes []string) error {
+	return tx.Do(ctx, r.db, func(txctx context.Context) error {
+		db := tx.From(txctx, r.db).WithContext(txctx)
+		if err := db.Where("role_code = ?", roleCode).Delete(&RolePermission{}).Error; err != nil {
+			return mapDatabaseError(err)
+		}
+		if len(permissionCodes) == 0 {
+			return nil
+		}
+		grants := make([]RolePermission, len(permissionCodes))
+		for i, code := range permissionCodes {
+			grants[i] = RolePermission{RoleCode: roleCode, PermissionCode: code}
+		}
+		return mapDatabaseError(db.Create(&grants).Error)
+	})
+}
+
+func (r *Repository) Delete(ctx context.Context, code string) error {
+	result := tx.From(ctx, r.db).WithContext(ctx).Where("code = ?", code).Delete(&Role{})
+	if result.Error != nil {
+		if dberr.IsForeignKey(result.Error) {
+			return domain.ErrHasReferences
+		}
+		return mapDatabaseError(result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return domain.ErrNotFound
+	}
+	return nil
+}
+
+func (r *Repository) FindAllPermissions(ctx context.Context, limit, offset int) ([]domain.Permission, error) {
+	var rows []Permission
+	err := tx.From(ctx, r.db).WithContext(ctx).Order("code").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	items := make([]domain.Permission, len(rows))
+	for i := range rows {
+		items[i] = toDomainPermission(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) AllPermissionCodes(ctx context.Context) ([]string, error) {
+	var codes []string
+	err := tx.From(ctx, r.db).WithContext(ctx).Model(&Permission{}).Pluck("code", &codes).Error
+	return codes, mapDatabaseError(err)
+}
+
+func (r *Repository) CountRolesWithPermission(ctx context.Context, permissionCode, excludeCode string) (int64, error) {
+	var count int64
+	err := tx.From(ctx, r.db).WithContext(ctx).Model(&RolePermission{}).
+		Where("permission_code = ? AND role_code <> ?", permissionCode, excludeCode).Count(&count).Error
+	return count, mapDatabaseError(err)
+}
+
+func mapDatabaseError(err error) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return domain.ErrNotFound
+	}
+	if dberr.IsDuplicate(err) {
+		return domain.ErrConflict
+	}
+	if dberr.IsForeignKey(err) {
+		return domain.ErrUnknownPermission
+	}
+	return err
+}

package/templates/add/rbac/internal/app/role/{repository_test.go.hbs → adapters/outbound/postgres/repository_test.go.hbs}

@@ -1,11 +1,11 @@
-package role
+package postgres
 
 import (
 	"context"
 	"os"
 	"testing"
 
-	"{{goModule}}/internal/app/role/model"
+	"{{goModule}}/internal/app/role/domain"
 
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
@@ -67,11 +67,11 @@ func testCode(t *testing.T) string {
 }
 
 // seedPermission inserts directly rather than through Repository, which has
-// no create method for Permission on purpose (see model/permission.go.hbs:
+// no create method for Permission on purpose (see adapters/outbound/postgres/model.go:
 // "seeded by migration, not admin-created"). Tests still need rows to grant.
 func seedPermission(t *testing.T, tx *gorm.DB, code string) {
 	t.Helper()
-	if err := tx.WithContext(context.Background()).Create(&model.Permission{Code: code, Description: code}).Error; err != nil {
+	if err := tx.WithContext(context.Background()).Create(&Permission{Code: code, Description: code}).Error; err != nil {
 		t.Fatalf("seed permission %s: %v", code, err)
 	}
 }
@@ -87,7 +87,7 @@ func TestRepository_SetPermissions_ReplacesEntireSet(t *testing.T) {
 
 	roleCode := testCode(t)
 	permA, permB, permC := testCode(t), testCode(t), testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleCode, Name: roleCode}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleCode, Name: roleCode}); err != nil {
 		t.Fatalf("seed role: %v", err)
 	}
 	seedPermission(t, tx, permA)
@@ -121,7 +121,7 @@ func TestRepository_Delete_CascadesRolePermissions(t *testing.T) {
 
 	roleCode := testCode(t)
 	permCode := testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleCode, Name: roleCode}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleCode, Name: roleCode}); err != nil {
 		t.Fatalf("seed role: %v", err)
 	}
 	seedPermission(t, tx, permCode)
@@ -152,10 +152,10 @@ func TestRepository_CountRolesWithPermission_ExcludesGivenRole(t *testing.T) {
 
 	roleA, roleB := testCode(t), testCode(t)
 	permCode := testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleA, Name: roleA}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleA, Name: roleA}); err != nil {
 		t.Fatalf("seed role a: %v", err)
 	}
-	if err := repo.Create(ctx, &model.Role{Code: roleB, Name: roleB}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleB, Name: roleB}); err != nil {
 		t.Fatalf("seed role b: %v", err)
 	}
 	seedPermission(t, tx, permCode)

package/templates/add/rbac/internal/app/role/application/dto.go.hbs

@@ -0,0 +1,47 @@
+package application
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+const PermRoleManage = "role:manage"
+
+type CreateInput struct {
+	Code string `json:"code"`
+	Name string `json:"name"`
+}
+
+type SetPermissionsInput struct {
+	PermissionCodes *[]string `json:"permission_codes"`
+}
+
+type RoleListItem struct {
+	Role        domain.Role
+	Permissions []string
+}
+
+type RoleResponse struct {
+	Code        string    `json:"code"`
+	Name        string    `json:"name"`
+	IsSystem    bool      `json:"is_system"`
+	Permissions []string  `json:"permissions"`
+	CreatedAt   time.Time `json:"created_at"`
+}
+
+type PermissionResponse struct {
+	Code        string `json:"code"`
+	Description string `json:"description"`
+}
+
+func ToRoleResponse(item RoleListItem) RoleResponse {
+	return RoleResponse{
+		Code: item.Role.Code, Name: item.Role.Name, IsSystem: item.Role.IsSystem,
+		Permissions: item.Permissions, CreatedAt: item.Role.CreatedAt,
+	}
+}
+
+func ToPermissionResponse(item domain.Permission) PermissionResponse {
+	return PermissionResponse{Code: item.Code, Description: item.Description}
+}

package/templates/add/rbac/internal/app/role/application/errors.go.hbs

@@ -0,0 +1,19 @@
+package application
+
+import "{{goModule}}/internal/app/role/domain"
+
+func errInvalidCode() error {
+	return domain.Rule("ROLE_INVALID_CODE", "code must start with a lowercase letter and contain only lowercase letters, digits, or underscores", domain.ErrInvalidCode)
+}
+
+func errSystemRole() error {
+	return domain.Rule("ROLE_IS_SYSTEM", "staff/admin are system roles and cannot be deleted", domain.ErrSystemRole)
+}
+
+func errUnknownPermission() error {
+	return domain.Rule("ROLE_UNKNOWN_PERMISSION", "one or more permission codes do not exist", domain.ErrUnknownPermission)
+}
+
+func errLastRoleManager() error {
+	return domain.Rule("ROLE_LAST_MANAGER", "this is the only role that can manage roles/permissions — grant "+PermRoleManage+" to another role first", domain.ErrLastRoleManager)
+}

package/templates/add/rbac/internal/app/role/application/service.go.hbs

@@ -0,0 +1,157 @@
+// Package application contains role management use cases. It owns the rules
+// for permission grants and never imports GORM, Gin, or HTTP error types.
+package application
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"slices"
+
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
+)
+
+type ServicePort interface {
+	PermissionsOf(context.Context, string) (map[string]struct{}, error)
+	CodeExists(context.Context, string) (bool, error)
+	List(context.Context, int, int) ([]RoleListItem, error)
+	Create(context.Context, CreateInput) (*RoleListItem, error)
+	SetPermissions(context.Context, string, []string) (*RoleListItem, error)
+	Delete(context.Context, string) error
+	ListPermissions(context.Context, int, int) ([]domain.Permission, error)
+}
+
+type Service struct {
+	repo ports.Repository
+}
+
+func NewService(repo ports.Repository) *Service { return &Service{repo: repo} }
+
+func (s *Service) PermissionsOf(ctx context.Context, roleCode string) (map[string]struct{}, error) {
+	codes, err := s.repo.PermissionCodes(ctx, roleCode)
+	if err != nil {
+		return nil, err
+	}
+	set := make(map[string]struct{}, len(codes))
+	for _, code := range codes {
+		set[code] = struct{}{}
+	}
+	return set, nil
+}
+
+func (s *Service) CodeExists(ctx context.Context, code string) (bool, error) {
+	if _, err := s.repo.FindByCode(ctx, code); err != nil {
+		if errors.Is(err, domain.ErrNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (s *Service) List(ctx context.Context, limit, offset int) ([]RoleListItem, error) {
+	roles, err := s.repo.FindAll(ctx, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]RoleListItem, len(roles))
+	for i, role := range roles {
+		perms, err := s.repo.PermissionCodes(ctx, role.Code)
+		if err != nil {
+			return nil, err
+		}
+		out[i] = RoleListItem{Role: role, Permissions: perms}
+	}
+	return out, nil
+}
+
+var roleCodePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
+
+func (s *Service) Create(ctx context.Context, in CreateInput) (*RoleListItem, error) {
+	if !roleCodePattern.MatchString(in.Code) {
+		return nil, errInvalidCode()
+	}
+	role := &domain.Role{Code: in.Code, Name: in.Name}
+	if err := s.repo.Create(ctx, role); err != nil {
+		return nil, err
+	}
+	return &RoleListItem{Role: *role, Permissions: []string{}}, nil
+}
+
+func (s *Service) SetPermissions(ctx context.Context, code string, permissionCodes []string) (*RoleListItem, error) {
+	role, err := s.repo.FindByCode(ctx, code)
+	if err != nil {
+		return nil, wrapFindErr(err)
+	}
+	if err := s.validatePermissionCodes(ctx, permissionCodes); err != nil {
+		return nil, err
+	}
+	if !slices.Contains(permissionCodes, PermRoleManage) {
+		isLast, err := s.isLastRoleManager(ctx, code)
+		if err != nil {
+			return nil, err
+		}
+		if isLast {
+			return nil, errLastRoleManager()
+		}
+	}
+	if err := s.repo.SetPermissions(ctx, code, permissionCodes); err != nil {
+		return nil, err
+	}
+	return &RoleListItem{Role: *role, Permissions: permissionCodes}, nil
+}
+
+func (s *Service) validatePermissionCodes(ctx context.Context, codes []string) error {
+	all, err := s.repo.AllPermissionCodes(ctx)
+	if err != nil {
+		return err
+	}
+	valid := make(map[string]struct{}, len(all))
+	for _, code := range all {
+		valid[code] = struct{}{}
+	}
+	for _, code := range codes {
+		if _, ok := valid[code]; !ok {
+			return errUnknownPermission()
+		}
+	}
+	return nil
+}
+
+func (s *Service) Delete(ctx context.Context, code string) error {
+	role, err := s.repo.FindByCode(ctx, code)
+	if err != nil {
+		return wrapFindErr(err)
+	}
+	if role.IsSystem {
+		return errSystemRole()
+	}
+	isLast, err := s.isLastRoleManager(ctx, code)
+	if err != nil {
+		return err
+	}
+	if isLast {
+		return errLastRoleManager()
+	}
+	return s.repo.Delete(ctx, code)
+}
+
+func (s *Service) isLastRoleManager(ctx context.Context, code string) (bool, error) {
+	others, err := s.repo.CountRolesWithPermission(ctx, PermRoleManage, code)
+	if err != nil {
+		return false, err
+	}
+	return others == 0, nil
+}
+
+func (s *Service) ListPermissions(ctx context.Context, limit, offset int) ([]domain.Permission, error) {
+	return s.repo.FindAllPermissions(ctx, limit, offset)
+}
+
+func wrapFindErr(err error) error {
+	if errors.Is(err, domain.ErrNotFound) {
+		return domain.ErrNotFound
+	}
+	return err
+}

package/templates/add/rbac/internal/app/role/{service_test.go.hbs → application/service_test.go.hbs}

@@ -1,4 +1,4 @@
-package role
+package application
 
 import (
 	"context"
@@ -6,8 +6,7 @@ import (
 	"net/http"
 	"testing"
 
-	"{{goModule}}/internal/app/role/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/role/domain"
 )
 
 // fakeRepo = mock of the repository interface, so the service can be tested
@@ -15,7 +14,7 @@ import (
 // than the one being edited currently grant PermRoleManage", exactly what
 // CountRolesWithPermission's excludeCode param means.
 type fakeRepo struct {
-	role                *model.Role
+	role                *domain.Role
 	findErr             error
 	allPermissionCodes  []string
 	countWithPermission int64
@@ -24,38 +23,46 @@ type fakeRepo struct {
 }
 
 func (f *fakeRepo) PermissionCodes(context.Context, string) ([]string, error) { return nil, nil }
-func (f *fakeRepo) FindAll(context.Context, int, int) ([]model.Role, error)   { return nil, nil }
-func (f *fakeRepo) FindByCode(context.Context, string) (*model.Role, error) {
+func (f *fakeRepo) FindAll(context.Context, int, int) ([]domain.Role, error)  { return nil, nil }
+func (f *fakeRepo) FindByCode(context.Context, string) (*domain.Role, error) {
 	if f.findErr != nil {
 		return nil, f.findErr
 	}
 	return f.role, nil
 }
-func (f *fakeRepo) Create(context.Context, *model.Role) error { return nil }
+func (f *fakeRepo) Create(context.Context, *domain.Role) error { return nil }
 func (f *fakeRepo) SetPermissions(context.Context, string, []string) error {
 	return f.setPermissionsErr
 }
 func (f *fakeRepo) Delete(context.Context, string) error { return f.deleteErr }
-func (f *fakeRepo) FindAllPermissions(context.Context, int, int) ([]model.Permission, error) {
+func (f *fakeRepo) FindAllPermissions(context.Context, int, int) ([]domain.Permission, error) {
 	return nil, nil
 }
-func (f *fakeRepo) AllPermissionCodes(context.Context) ([]string, error) { return f.allPermissionCodes, nil }
+func (f *fakeRepo) AllPermissionCodes(context.Context) ([]string, error) {
+	return f.allPermissionCodes, nil
+}
 func (f *fakeRepo) CountRolesWithPermission(context.Context, string, string) (int64, error) {
 	return f.countWithPermission, nil
 }
 
 func status(t *testing.T, err error) int {
 	t.Helper()
-	var appErr *apperror.AppError
-	if !errors.As(err, &appErr) {
-		t.Fatalf("expected *apperror.AppError, got %T: %v", err, err)
+	if errors.Is(err, domain.ErrConflict) || errors.Is(err, domain.ErrSystemRole) || errors.Is(err, domain.ErrLastRoleManager) {
+		return http.StatusConflict
+	}
+	if errors.Is(err, domain.ErrInvalidCode) || errors.Is(err, domain.ErrUnknownPermission) {
+		return http.StatusUnprocessableEntity
+	}
+	if errors.Is(err, domain.ErrNotFound) {
+		return http.StatusNotFound
 	}
-	return appErr.HTTPStatus
+	t.Fatalf("unexpected role error %T: %v", err, err)
+	return 0
 }
 
 func TestService_SetPermissions_LastRoleManagerLockout(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage, "user:read"},
 		countWithPermission: 0, // no OTHER role grants PermRoleManage
 	}
@@ -69,7 +76,7 @@ func TestService_SetPermissions_LastRoleManagerLockout(t *testing.T) {
 
 func TestService_SetPermissions_AllowedWhenAnotherRoleStillManages(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage, "user:read"},
 		countWithPermission: 1, // another role still grants PermRoleManage
 	}
@@ -81,7 +88,7 @@ func TestService_SetPermissions_AllowedWhenAnotherRoleStillManages(t *testing.T)
 
 func TestService_SetPermissions_KeepingRoleManageNeverLocksOut(t *testing.T) {
 	repo := &fakeRepo{
-		role:                &model.Role{Code: "ops", Name: "Ops"},
+		role:                &domain.Role{Code: "ops", Name: "Ops"},
 		allPermissionCodes:  []string{PermRoleManage},
 		countWithPermission: 0,
 	}
@@ -93,7 +100,7 @@ func TestService_SetPermissions_KeepingRoleManageNeverLocksOut(t *testing.T) {
 }
 
 func TestService_Delete_LastRoleManagerLockout(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "ops"}, countWithPermission: 0}
+	repo := &fakeRepo{role: &domain.Role{Code: "ops"}, countWithPermission: 0}
 	svc := NewService(repo)
 	err := svc.Delete(context.Background(), "ops")
 	if got := status(t, err); got != http.StatusConflict {
@@ -102,7 +109,7 @@ func TestService_Delete_LastRoleManagerLockout(t *testing.T) {
 }
 
 func TestService_Delete_AllowedWhenAnotherRoleStillManages(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "ops"}, countWithPermission: 1}
+	repo := &fakeRepo{role: &domain.Role{Code: "ops"}, countWithPermission: 1}
 	svc := NewService(repo)
 	if err := svc.Delete(context.Background(), "ops"); err != nil {
 		t.Fatalf("expected delete to succeed when another role still manages roles, got %v", err)
@@ -110,7 +117,7 @@ func TestService_Delete_AllowedWhenAnotherRoleStillManages(t *testing.T) {
 }
 
 func TestService_Delete_SystemRoleRejected(t *testing.T) {
-	repo := &fakeRepo{role: &model.Role{Code: "admin", IsSystem: true}}
+	repo := &fakeRepo{role: &domain.Role{Code: "admin", IsSystem: true}}
 	svc := NewService(repo)
 	err := svc.Delete(context.Background(), "admin")
 	if got := status(t, err); got != http.StatusConflict {

package/templates/add/rbac/internal/app/role/composition.go.hbs

@@ -3,33 +3,46 @@ package role
 import (
 	"time"
 
+	httpadapter "{{goModule}}/internal/app/role/adapters/inbound/http"
+	"{{goModule}}/internal/app/role/adapters/outbound/postgres"
+	"{{goModule}}/internal/app/role/application"
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
 	"{{goModule}}/internal/shared/middleware"
 
 	"gorm.io/gorm"
 )
 
-// Composition groups role's service, authorization adapter, and HTTP handler
-// so cmd/api can register the feature without constructing its internals.
+// Composition is the only public graph exposed to cmd/api. The feature root
+// owns the role repository, application service, permission cache, and HTTP
+// adapter; process wiring does not construct any of those internals.
 type Composition struct {
-	Service *Service
+	Service *application.Service
 	Authz   *middleware.Authz
-	Handler *Handler
+	Handler *httpadapter.Handler
 }
 
-// NewServiceFromDB is the role feature's persistence composition boundary.
+type Service = application.Service
+type ServicePort = application.ServicePort
+type Repository = postgres.Repository
+type CreateInput = application.CreateInput
+type SetPermissionsInput = application.SetPermissionsInput
+type Role = domain.Role
+type Permission = domain.Permission
+type AuthorizationPort = ports.AuthorizationPort
+
+const PermRoleManage = application.PermRoleManage
+
 func NewServiceFromDB(db *gorm.DB) *Service {
-	return NewService(NewRepository(db))
+	return application.NewService(postgres.NewRepository(db))
 }
 
-// NewCompositionFromDB builds role and its authorization middleware locally.
-// The API binary supplies the shared DB/config values and only registers the
-// returned handlers.
 func NewCompositionFromDB(db *gorm.DB, jwtSecret string, cacheTTL time.Duration) *Composition {
 	service := NewServiceFromDB(db)
 	authz := middleware.NewAuthz(service.PermissionsOf, cacheTTL)
 	return &Composition{
 		Service: service,
 		Authz:   authz,
-		Handler: NewHandler(service, jwtSecret, authz),
+		Handler: httpadapter.NewHandler(service, jwtSecret, authz),
 	}
 }

package/templates/add/rbac/internal/app/role/domain/entity.go.hbs

@@ -0,0 +1,23 @@
+// Package domain contains role and permission state without GORM or HTTP
+// concerns.
+package domain
+
+import "time"
+
+type Role struct {
+	Code      string
+	Name      string
+	IsSystem  bool
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+type Permission struct {
+	Code        string
+	Description string
+}
+
+type RolePermission struct {
+	RoleCode       string
+	PermissionCode string
+}

package/templates/add/rbac/internal/app/role/domain/errors.go.hbs

@@ -0,0 +1,26 @@
+package domain
+
+import "errors"
+
+var (
+	ErrNotFound          = errors.New("role not found")
+	ErrConflict          = errors.New("role conflict")
+	ErrHasReferences     = errors.New("role has references")
+	ErrInvalidCode       = errors.New("role code is invalid")
+	ErrSystemRole        = errors.New("system role cannot be changed")
+	ErrUnknownPermission = errors.New("permission does not exist")
+	ErrLastRoleManager   = errors.New("last role manager cannot be removed")
+)
+
+type RuleError struct {
+	Code    string
+	Message string
+	Cause   error
+}
+
+func (e *RuleError) Error() string { return e.Message }
+func (e *RuleError) Unwrap() error { return e.Cause }
+
+func Rule(code, message string, cause error) error {
+	return &RuleError{Code: code, Message: message, Cause: cause}
+}

package/templates/add/rbac/internal/app/role/ports/repository.go.hbs

@@ -0,0 +1,25 @@
+// Package ports contains role's application-owned repository contracts.
+package ports
+
+import (
+	"context"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+type Repository interface {
+	PermissionCodes(context.Context, string) ([]string, error)
+	FindAll(context.Context, int, int) ([]domain.Role, error)
+	FindByCode(context.Context, string) (*domain.Role, error)
+	Create(context.Context, *domain.Role) error
+	SetPermissions(context.Context, string, []string) error
+	Delete(context.Context, string) error
+	FindAllPermissions(context.Context, int, int) ([]domain.Permission, error)
+	AllPermissionCodes(context.Context) ([]string, error)
+	CountRolesWithPermission(context.Context, string, string) (int64, error)
+}
+
+type AuthorizationPort interface {
+	PermissionsOf(context.Context, string) (map[string]struct{}, error)
+	CodeExists(context.Context, string) (bool, error)
+}