@nakedev/go-scaffold 0.4.3 → 0.5.0

package/templates/add/auth/internal/app/user/dto.go.hbs

@@ -1,134 +0,0 @@
-package user
-
-import (
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-
-	"github.com/google/uuid"
-)
-
-type registerInput struct {
-	Email    string `json:"email" binding:"required,email"`
-	Password string `json:"password" binding:"required,min=8"`
-	Name     string `json:"name" binding:"required"`
-}
-
-type loginInput struct {
-	Email    string `json:"email" binding:"required,email"`
-	Password string `json:"password" binding:"required"`
-}
-
-type forgotPasswordInput struct {
-	Email string `json:"email" binding:"required,email"`
-}
-
-type resetPasswordInput struct {
-	Token       string `json:"token" binding:"required"`
-	NewPassword string `json:"new_password" binding:"required,min=8"`
-}
-
-type verifyEmailInput struct {
-	Token string `json:"token" binding:"required"`
-}
-
-type mfaCodeInput struct {
-	Code string `json:"code" binding:"required"`
-}
-
-type mfaChallengeInput struct {
-	Challenge string `json:"challenge" binding:"required"`
-	Code      string `json:"code" binding:"required"`
-}
-
-// authResponse is what the service returns internally (both tokens); the
-// handler sends the refresh token as an httpOnly cookie instead of echoing
-// it in the body, so meResponse never carries it — see toCookieResponse.
-type authResponse struct {
-	AccessToken  string `json:"access_token"`
-	RefreshToken string `json:"-"`
-	TokenType    string `json:"token_type"`
-	ExpiresIn    int    `json:"expires_in"`
-}
-
-// authResult keeps the normal token shape source-compatible for callers while
-// representing the pre-session state required by MFA. A challenge never
-// carries an access or refresh token.
-type authResult struct {
-	*authResponse
-	MFAChallenge string
-}
-
-func tokenResult(auth *authResponse) *authResult { return &authResult{authResponse: auth} }
-
-func challengeResult(challenge string) *authResult { return &authResult{MFAChallenge: challenge} }
-
-type authCookieResponse struct {
-	AccessToken string `json:"access_token"`
-	TokenType   string `json:"token_type"`
-	ExpiresIn   int    `json:"expires_in"`
-}
-
-type mfaChallengeResponse struct {
-	MFARequired bool   `json:"mfa_required"`
-	Challenge   string `json:"challenge"`
-}
-
-type mfaStatusResponse struct {
-	Available bool `json:"available"`
-	Enabled   bool `json:"enabled"`
-}
-
-type mfaSetupResponse struct {
-	Secret     string `json:"secret"`
-	OTPAuthURI string `json:"otpauth_uri"`
-}
-
-type mfaConfirmResponse struct {
-	RecoveryCodes []string `json:"recovery_codes"`
-}
-
-func toCookieResponse(a *authResponse) authCookieResponse {
-	return authCookieResponse{AccessToken: a.AccessToken, TokenType: a.TokenType, ExpiresIn: a.ExpiresIn}
-}
-
-type meResponse struct {
-	ID            uuid.UUID `json:"id"`
-	Email         string    `json:"email"`
-	Name          string    `json:"name"`
-	AvatarURL     string    `json:"avatar_url"`
-	EmailVerified bool      `json:"email_verified"`
-	// go-scaffold:user-me-fields
-	CreatedAt time.Time `json:"created_at"`
-}
-
-func toMeResponse(u *model.User) meResponse {
-	return meResponse{
-		ID:            u.ID,
-		Email:         u.Email,
-		Name:          u.Name,
-		AvatarURL:     u.AvatarURL,
-		EmailVerified: u.EmailVerified,
-		CreatedAt:     u.CreatedAt,
-		// go-scaffold:user-me-values
-	}
-}
-
-// response is the small public profile DTO used by endpoints added through
-// `generate method user ...`. Auth's built-in /users/me response intentionally
-// stays separate because it has a different contract, but generated admin or
-// support lookups still need the same stable id/timestamp shape as ordinary
-// modules.
-//
-//nolint:unused
-type response struct {
-	ID        uuid.UUID `json:"id"`
-	CreatedAt time.Time `json:"created_at"`
-}
-
-//nolint:unused
-func toResponse(u *model.User) response {
-	return response{ID: u.ID, CreatedAt: u.CreatedAt}
-}
-
-// go-scaffold:user-dto

package/templates/add/auth/internal/app/user/errors.go.hbs

@@ -1,68 +0,0 @@
-package user
-
-import (
-	"fmt"
-	"net/http"
-
-	"{{goModule}}/internal/shared/apperror"
-)
-
-// functions, not vars: the error middleware writes RequestID onto the
-// returned pointer directly — a shared instance would race across
-// concurrent requests.
-
-func errNotFound() *apperror.AppError {
-	return apperror.New(http.StatusNotFound, "USER_NOT_FOUND", "user not found")
-}
-
-func errEmailTaken() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "USER_EMAIL_TAKEN", "email already registered")
-}
-
-// errInvalidCredentials is returned for both "no such user" and "wrong
-// password" — a single generic message so a login attempt can't be used to
-// enumerate which emails have accounts.
-// errTooManyAttempts is the account-level lockout, distinct from the per-IP
-// RATE_LIMITED the middleware returns: this one follows the account wherever
-// the attempts come from.
-func errTooManyAttempts() *apperror.AppError {
-	return apperror.New(http.StatusTooManyRequests, "AUTH_TOO_MANY_ATTEMPTS", "too many failed attempts — try again later")
-}
-
-func errInvalidCredentials() *apperror.AppError {
-	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_CREDENTIALS", "invalid email or password")
-}
-
-func errInvalidToken() *apperror.AppError {
-	return apperror.New(http.StatusUnauthorized, "AUTH_INVALID_TOKEN", "invalid or expired refresh token")
-}
-
-func errAlreadyVerified() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "AUTH_ALREADY_VERIFIED", "email is already verified")
-}
-
-func errMFAUnavailable() *apperror.AppError {
-	return apperror.New(http.StatusServiceUnavailable, "AUTH_MFA_UNAVAILABLE", "multi-factor authentication is not enabled")
-}
-
-func errMFAInvalid() *apperror.AppError {
-	return apperror.New(http.StatusUnauthorized, "AUTH_MFA_INVALID", "invalid or expired multi-factor authentication code")
-}
-
-func errMFAAlreadyEnabled() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "AUTH_MFA_ALREADY_ENABLED", "multi-factor authentication is already enabled")
-}
-
-func errMFANotEnrolled() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "AUTH_MFA_NOT_ENROLLED", "multi-factor authentication is not enabled for this user")
-}
-
-func errMFASetupRequired() *apperror.AppError {
-	return apperror.New(http.StatusConflict, "AUTH_MFA_SETUP_REQUIRED", "complete multi-factor authentication setup first")
-}
-
-func errMFAConfig() *apperror.AppError {
-	return apperror.NewInternal(fmt.Errorf("multi-factor authentication encryption key is invalid"))
-}
-
-// go-scaffold:user-errors

package/templates/add/auth/internal/app/user/model/authtoken.go.hbs

@@ -1,45 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// AuthToken is one short-lived token — the Postgres equivalent of the keys the
-// Redis store would hold. Only the SHA-256 hash of the raw token is stored, so
-// a database dump never yields a usable token.
-//
-// `Kind` mirrors the Redis key prefixes one-for-one, deliberately:
-//
-//	refresh       an active refresh token
-//	refresh_used  a tombstone left by rotation, so replaying a rotated-out
-//	              token is detectable as reuse rather than merely unknown
-//	pwreset       password reset, consumed once
-//	emailverify   email verification, consumed once
-//
-// Keeping the tombstone a separate row (rather than a used_at column on the
-// refresh row) is what preserves logout's semantics: logout deletes the row
-// outright and leaves no tombstone, so someone replaying a logged-out token
-// gets a plain rejection instead of tripping reuse detection and nuking every
-// session the user has.
-//
-// No foreign key to users on purpose: the development bootstrap wouldn't
-// create one from these tags, and a constraint that exists in production but not in
-// development is the exact mismatch that stops the app booting. A token whose
-// user is gone simply fails the lookup that follows.
-type AuthToken struct {
-	TokenHash string    `gorm:"primaryKey;type:text"`
-	UserID    uuid.UUID `gorm:"type:uuid;not null;index:idx_auth_tokens_user_kind,priority:1"`
-	Kind      string    `gorm:"type:varchar(20);not null;index:idx_auth_tokens_user_kind,priority:2"`
-	ExpiresAt time.Time `gorm:"not null;index:idx_auth_tokens_expires_at"`
-	// AbsoluteExpiresAt is set only for refresh tokens. Recovery tokens and
-	// OAuth transactions have no sliding lifetime, so it remains nil there.
-	AbsoluteExpiresAt *time.Time `gorm:"index:idx_auth_tokens_absolute_expires_at"`
-	Provider          string     `gorm:"type:varchar(20);not null;default:''"`
-	CodeChallenge     string     `gorm:"type:text;not null;default:''"`
-	Nonce             string     `gorm:"type:text;not null;default:''"`
-	CreatedAt time.Time
-}
-
-func (AuthToken) TableName() string { return "user_svc.auth_tokens" }

package/templates/add/auth/internal/app/user/model/identity.go.hbs

@@ -1,32 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type Provider string
-
-const (
-	ProviderLocal  Provider = "local"
-	ProviderGoogle Provider = "google"
-)
-
-// Identity = how you log in (one row per login method). PasswordHash is set
-// for a "local" identity; ProviderUID is set for an external provider (the
-// provider's own stable subject id). Split from User so adding a login method
-// never touches the profile row — one person can have several methods and
-// resolve to the same account.
-type Identity struct {
-	ID           uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
-	UserID       uuid.UUID `json:"user_id" gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
-	Provider     Provider  `json:"provider" gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
-	PasswordHash *string   `json:"-"`
-	ProviderUID  *string   `json:"-" gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
-	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt    time.Time `json:"updated_at"`
-}
-
-// TableName — see User.TableName; same schema, same reasoning.
-func (Identity) TableName() string { return "user_svc.identities" }

package/templates/add/auth/internal/app/user/model/loginthrottle.go.hbs

@@ -1,26 +0,0 @@
-package model
-
-import "time"
-
-// LoginThrottle is the failed-attempt counter that makes lockout survive a
-// deploy and mean the same thing on every replica. It is not the rate limiter
-// — that one counts requests per IP and is allowed to be approximate. This
-// counts failures per account, and per OWASP that is the control that actually
-// stops credential stuffing: an attacker with a proxy pool keeps per-IP volume
-// under any threshold you set, but they cannot spread attempts against one
-// account across accounts.
-//
-// EmailHash, not the address: the counter has to be keyed on what the caller
-// typed whether or not an account exists — otherwise "did this get throttled"
-// answers "does this account exist" — and hashing means this table never
-// becomes a directory of who has signed up.
-type LoginThrottle struct {
-	EmailHash string `gorm:"primaryKey;type:text"`
-	Failures  int    `gorm:"not null;default:0"`
-	// nil until the free attempts are spent; afterwards it moves further out
-	// with each failure.
-	LockedUntil *time.Time
-	UpdatedAt   time.Time
-}
-
-func (LoginThrottle) TableName() string { return "user_svc.login_throttle" }

package/templates/add/auth/internal/app/user/model/mfa_challenge.go.hbs

@@ -1,17 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// MFAChallenge is a one-use pre-session challenge. Only its hash is stored.
-type MFAChallenge struct {
-	ChallengeHash string    `gorm:"type:text;primaryKey"`
-	UserID        uuid.UUID `gorm:"type:uuid;not null;index:idx_mfa_challenges_user"`
-	ExpiresAt     time.Time `gorm:"not null;index:idx_mfa_challenges_expires_at"`
-	CreatedAt     time.Time
-}
-
-func (MFAChallenge) TableName() string { return "user_svc.mfa_challenges" }

package/templates/add/auth/internal/app/user/model/mfa_enrollment.go.hbs

@@ -1,20 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// MFAEnrollment stores one user's TOTP enrollment. The secret is encrypted by
-// the application before it reaches this model; plaintext secrets never live
-// in the database.
-type MFAEnrollment struct {
-	UserID          uuid.UUID `gorm:"type:uuid;primaryKey"`
-	EncryptedSecret string    `gorm:"type:text;not null"`
-	Enabled         bool      `gorm:"not null;default:false"`
-	CreatedAt       time.Time
-	UpdatedAt       time.Time
-}
-
-func (MFAEnrollment) TableName() string { return "user_svc.mfa_enrollments" }

package/templates/add/auth/internal/app/user/model/mfa_recovery_code.go.hbs

@@ -1,17 +0,0 @@
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// MFARecoveryCode stores a hash only. A consumed code is deleted atomically,
-// so the table never becomes a second mutable session state machine.
-type MFARecoveryCode struct {
-	UserID    uuid.UUID `gorm:"type:uuid;primaryKey;index:idx_mfa_recovery_codes_user"`
-	CodeHash  string    `gorm:"type:text;primaryKey"`
-	CreatedAt time.Time
-}
-
-func (MFARecoveryCode) TableName() string { return "user_svc.mfa_recovery_codes" }

package/templates/add/auth/internal/app/user/model/user.go.hbs

@@ -1,31 +0,0 @@
-// Package model holds this domain's GORM tables.
-package model
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// User = who you are (profile). How you log in is a separate concept — see
-// Identity — so the same person can have both a password and a Google login
-// resolving to one account.
-type User struct {
-	ID            uuid.UUID `json:"id" gorm:"type:uuid;primaryKey"`
-	// index named explicitly, and named the same in create_users.up.sql: an
-	// anonymous `uniqueIndex` makes GORM invent one, and the development
-	// bootstrap then tries to DROP the differently-named constraint the
-	// migration created.
-	Email         string    `json:"email" gorm:"uniqueIndex:idx_users_email;not null"`
-	Name          string    `json:"name"`
-	AvatarURL     string    `json:"avatar_url"`
-	EmailVerified bool      `json:"email_verified"`
-	// go-scaffold:user-fields
-	CreatedAt time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
-}
-
-// TableName pins this to user_svc rather than GORM's default inflection
-// ("users", schema-less) — every domain gets its own schema, see
-// docs/architect/patterns.md.
-func (User) TableName() string { return "user_svc.users" }

package/templates/add/auth/internal/app/user/repository.go.hbs

@@ -1,139 +0,0 @@
-package user
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/tx"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-type Repository struct {
-	db *gorm.DB
-}
-
-func NewRepository(db *gorm.DB) *Repository {
-	return &Repository{db: db}
-}
-
-func (r *Repository) FindByEmail(ctx context.Context, email string) (*model.User, error) {
-	var u model.User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&u, "email = ?", email).Error; err != nil {
-		return nil, err
-	}
-	return &u, nil
-}
-
-func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*model.User, error) {
-	var u model.User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&u, "id = ?", id).Error; err != nil {
-		return nil, err
-	}
-	return &u, nil
-}
-
-func (r *Repository) UpdateUser(ctx context.Context, u *model.User) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Save(u).Error
-}
-
-func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]model.User, error) {
-	var items []model.User
-	err := tx.From(ctx, r.db).WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&items).Error
-	return items, err
-}
-
-func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider model.Provider) (*model.Identity, error) {
-	var i model.Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&i, "user_id = ? AND provider = ?", userID, provider).Error; err != nil {
-		return nil, err
-	}
-	return &i, nil
-}
-
-func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider model.Provider, providerUID string) (*model.Identity, error) {
-	var i model.Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&i, "provider = ? AND provider_uid = ?", provider, providerUID).Error; err != nil {
-		return nil, err
-	}
-	return &i, nil
-}
-
-// CreateIdentity links a new login method onto an EXISTING user (e.g.
-// Google linking onto an account that registered with a password first) —
-// see CreateUserWithIdentity for the "brand new user" case.
-func (r *Repository) CreateIdentity(ctx context.Context, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Create(i).Error
-}
-
-func (r *Repository) UpdateIdentity(ctx context.Context, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Save(i).Error
-}
-
-// CreateUserWithIdentity inserts the profile and its first login method in
-// one transaction — a user with no identity at all can't log in any way, so
-// the two rows always exist together or not at all.
-func (r *Repository) CreateUserWithIdentity(ctx context.Context, u *model.User, i *model.Identity) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Transaction(func(t *gorm.DB) error {
-		if err := t.Create(u).Error; err != nil {
-			return err
-		}
-		i.UserID = u.ID
-		return t.Create(i).Error
-	})
-}
-
-// --- failed-login throttle -------------------------------------------------
-//
-// Keyed on a caller-supplied hash rather than a user id, because the counter
-// has to work for addresses that have no account — see model.LoginThrottle.
-
-// LoginLockedUntil reports when this key stops being locked out — zero time
-// when it isn't. Read on every login attempt, so it stays a primary-key hit.
-func (r *Repository) LoginLockedUntil(ctx context.Context, key string) (time.Time, error) {
-	var row model.LoginThrottle
-	err := tx.From(ctx, r.db).WithContext(ctx).Where("email_hash = ?", key).Take(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return time.Time{}, nil
-	}
-	if err != nil || row.LockedUntil == nil {
-		return time.Time{}, err
-	}
-	return *row.LockedUntil, nil
-}
-
-// RecordLoginFailure bumps the counter and pushes the lock further out,
-// doubling each time past freeAttempts and never exceeding maxLock.
-//
-// One statement, so two attempts racing cannot both read the same count and
-// write the same lock — which would let an attacker keep the backoff pinned at
-// its first step by running attempts in parallel. Computing the interval in
-// SQL is what buys that; a read-then-write in Go would need a transaction and
-// a row lock to be equally safe.
-func (r *Repository) RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error {
-	return tx.From(ctx, r.db).WithContext(ctx).Exec(`
-		INSERT INTO user_svc.login_throttle AS t (email_hash, failures, locked_until, updated_at)
-		VALUES (?, 1, NULL, now())
-		ON CONFLICT (email_hash) DO UPDATE SET
-			failures = t.failures + 1,
-			locked_until = CASE
-				WHEN t.failures + 1 <= ? THEN NULL
-				ELSE now() + make_interval(secs => least(power(2, t.failures + 1 - ?), ?))
-			END,
-			updated_at = now()`,
-		key, freeAttempts, freeAttempts, maxLock.Seconds()).Error
-}
-
-// ClearLoginFailures drops the row on a successful login, so someone who
-// mistypes twice and then gets in starts clean rather than creeping toward a
-// lockout over weeks.
-func (r *Repository) ClearLoginFailures(ctx context.Context, key string) error {
-	return tx.From(ctx, r.db).WithContext(ctx).
-		Where("email_hash = ?", key).
-		Delete(&model.LoginThrottle{}).Error
-}
-
-// go-scaffold:user-repository-methods

package/templates/add/auth/internal/app/user/service.go.hbs

@@ -1,135 +0,0 @@
-package user
-
-import (
-	"context"
-	"strings"
-	"time"
-
-	"{{goModule}}/internal/app/user/application"
-	"{{goModule}}/internal/app/user/model"
-
-	"github.com/google/uuid"
-)
-
-// repository = what the user application needs from the data layer. The
-// interface stays consumer-owned so every use case can be tested without a
-// database, while the concrete GORM implementation remains in repository.go.
-type UserRepository interface {
-	FindByEmail(ctx context.Context, email string) (*model.User, error)
-	FindByID(ctx context.Context, id uuid.UUID) (*model.User, error)
-	UpdateUser(ctx context.Context, u *model.User) error
-	FindAll(ctx context.Context, limit, offset int) ([]model.User, error)
-	FindIdentity(ctx context.Context, userID uuid.UUID, provider model.Provider) (*model.Identity, error)
-	FindIdentityByProviderUID(ctx context.Context, provider model.Provider, providerUID string) (*model.Identity, error)
-	CreateUserWithIdentity(ctx context.Context, u *model.User, i *model.Identity) error
-	CreateIdentity(ctx context.Context, i *model.Identity) error
-	UpdateIdentity(ctx context.Context, i *model.Identity) error
-	LoginLockedUntil(ctx context.Context, key string) (time.Time, error)
-	RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error
-	ClearLoginFailures(ctx context.Context, key string) error
-	// go-scaffold:user-repository-interface
-}
-
-// repository is kept as a package-local alias so generated method extensions
-// and focused tests can use the short consumer-side name without hiding the
-// public Dependencies contract from callers outside this package.
-type repository = UserRepository
-
-// mailer = what the service needs to send an email. The concrete client may
-// send inline or enqueue onto cmd/worker; auth only depends on this port.
-type AuthMailer interface {
-	Send(ctx context.Context, to, subject, body string) error
-}
-
-// go-scaffold:user-interfaces
-
-// RoleChecker is the narrow capability the user domain needs when RBAC is
-// installed. Keeping the interface here means auth can be generated on its
-// own; the role domain satisfies it structurally when the optional feature is
-// added.
-type RoleChecker interface {
-	CodeExists(ctx context.Context, code string) (bool, error)
-}
-
-// Service is the stable facade exposed to handlers, cmd/seed, and generated
-// extensions. The behavior is implemented in focused files by use-case area:
-// local_auth.go, sessions.go, recovery_service.go, external_login.go, and
-// user_query.go. Keeping the facade avoids route and generator compatibility
-// churn while preventing one 600-line service file from becoming the place
-// where every auth concern must be edited.
-type Service struct {
-	repo              UserRepository
-	refreshTokens     RefreshTokenStore
-	oauthTransactions OAuthTransactionStore
-	recoveryTokens    RecoveryTokenStore
-	mfa               MFAStore
-	mailer            AuthMailer
-	providers         ProviderRegistry
-	recovery          *application.Recovery
-	config            AuthConfig
-	roles             RoleChecker
-	now               func() time.Time
-	// go-scaffold:user-service-fields
-}
-
-// NewService is deliberately explicit: infrastructure dependencies and auth
-// policy are separate values, so the application layer never receives the
-// generated project's catch-all shared configuration object.
-func NewService(deps Dependencies, cfg AuthConfig) *Service {
-	if cfg.JWTAccessTTL <= 0 {
-		cfg.JWTAccessTTL = 15 * time.Minute
-	}
-	if cfg.JWTRefreshTTL <= 0 {
-		cfg.JWTRefreshTTL = 12 * time.Hour
-	}
-	cfg.JWTRefreshMaxTTL = defaultDuration(cfg.JWTRefreshMaxTTL, cfg.JWTRefreshTTL)
-	cfg.OAuthStateTTL = defaultDuration(cfg.OAuthStateTTL, 10*time.Minute)
-	if cfg.MFA.RecoveryCodeCount == 0 {
-		cfg.MFA.RecoveryCodeCount = defaultMFACodes
-	}
-	clock := deps.Clock
-	if clock == nil {
-		clock = time.Now
-	}
-	providers := deps.Providers
-	if providers == nil {
-		providers = application.NewProviderRegistry()
-	}
-	return &Service{
-		repo:              deps.Repository,
-		refreshTokens:     deps.RefreshTokens,
-		oauthTransactions: deps.OAuthTransactions,
-		recoveryTokens:    deps.RecoveryTokens,
-		mfa:               deps.MFA,
-		mailer:            deps.Mailer,
-		providers:         providers,
-		recovery:          newRecovery(deps.Repository, deps.RecoveryTokens),
-		config:            cfg,
-		roles:             deps.Roles,
-		now:               clock,
-		// go-scaffold:user-service-init
-	}
-}
-
-func defaultDuration(value, fallback time.Duration) time.Duration {
-	if value > 0 {
-		return value
-	}
-	return fallback
-}
-
-func (s *Service) clock() time.Time {
-	if s.now == nil {
-		return time.Now()
-	}
-	return s.now()
-}
-
-// normalizeEmail is applied at every boundary an address enters the service
-// through. The column is a plain case-sensitive UNIQUE, so without this
-// "Foo@x.com" and "foo@x.com" could become two accounts.
-func normalizeEmail(email string) string {
-	return strings.ToLower(strings.TrimSpace(email))
-}
-
-// go-scaffold:user-service-methods