@nakedev/go-scaffold 0.4.3 → 0.5.0

package/templates/add/auth/internal/app/user/{mfa_store.go.hbs → adapters/outbound/postgres/mfa_store.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package postgres
 
 import (
 	"context"
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/app/user/ports"
 	"{{goModule}}/internal/shared/tx"
 
 	"github.com/google/uuid"
@@ -22,25 +22,27 @@ type PostgresMFAStore struct {
 	db *gorm.DB
 }
 
+var _ ports.MFAStore = (*PostgresMFAStore)(nil)
+
 func NewPostgresMFAStore(db *gorm.DB) *PostgresMFAStore { return &PostgresMFAStore{db: db} }
 
-func (s *PostgresMFAStore) GetEnrollment(ctx context.Context, userID uuid.UUID) (MFAEnrollment, bool, error) {
-	var row model.MFAEnrollment
+func (s *PostgresMFAStore) GetEnrollment(ctx context.Context, userID uuid.UUID) (ports.MFAEnrollment, bool, error) {
+	var row MFAEnrollment
 	err := tx.From(ctx, s.db).WithContext(ctx).First(&row, "user_id = ?", userID).Error
 	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return MFAEnrollment{}, false, nil
+		return ports.MFAEnrollment{}, false, nil
 	}
 	if err != nil {
-		return MFAEnrollment{}, false, err
+		return ports.MFAEnrollment{}, false, err
 	}
-	return MFAEnrollment{EncryptedSecret: row.EncryptedSecret, Enabled: row.Enabled}, true, nil
+	return ports.MFAEnrollment{EncryptedSecret: row.EncryptedSecret, Enabled: row.Enabled}, true, nil
 }
 
 func (s *PostgresMFAStore) PutPendingEnrollment(ctx context.Context, userID uuid.UUID, encryptedSecret string) error {
 	if userID == uuid.Nil || encryptedSecret == "" {
 		return errors.New("MFA enrollment is incomplete")
 	}
-	row := model.MFAEnrollment{UserID: userID, EncryptedSecret: encryptedSecret, Enabled: false}
+	row := MFAEnrollment{UserID: userID, EncryptedSecret: encryptedSecret, Enabled: false}
 	return tx.From(ctx, s.db).WithContext(ctx).
 		Where("user_id = ? AND enabled = ?", userID, false).
 		Assign(map[string]any{"encrypted_secret": encryptedSecret, "enabled": false, "updated_at": time.Now()}).
@@ -52,7 +54,7 @@ func (s *PostgresMFAStore) ConfirmEnrollment(ctx context.Context, userID uuid.UU
 		return errors.New("MFA enrollment confirmation is incomplete")
 	}
 	return tx.From(ctx, s.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
-		var enrollment model.MFAEnrollment
+		var enrollment MFAEnrollment
 		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).Where("user_id = ?", userID).First(&enrollment).Error; err != nil {
 			return err
 		}
@@ -66,12 +68,12 @@ func (s *PostgresMFAStore) ConfirmEnrollment(ctx context.Context, userID uuid.UU
 		}).Error; err != nil {
 			return err
 		}
-		if err := db.Where("user_id = ?", userID).Delete(&model.MFARecoveryCode{}).Error; err != nil {
+		if err := db.Where("user_id = ?", userID).Delete(&MFARecoveryCode{}).Error; err != nil {
 			return err
 		}
-		rows := make([]model.MFARecoveryCode, len(recoveryCodeHashes))
+		rows := make([]MFARecoveryCode, len(recoveryCodeHashes))
 		for i, hash := range recoveryCodeHashes {
-			rows[i] = model.MFARecoveryCode{UserID: userID, CodeHash: hash}
+			rows[i] = MFARecoveryCode{UserID: userID, CodeHash: hash}
 		}
 		return db.Create(&rows).Error
 	})
@@ -79,33 +81,33 @@ func (s *PostgresMFAStore) ConfirmEnrollment(ctx context.Context, userID uuid.UU
 
 func (s *PostgresMFAStore) Disable(ctx context.Context, userID uuid.UUID) error {
 	return tx.From(ctx, s.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
-		if err := db.Where("user_id = ?", userID).Delete(&model.MFARecoveryCode{}).Error; err != nil {
+		if err := db.Where("user_id = ?", userID).Delete(&MFARecoveryCode{}).Error; err != nil {
 			return err
 		}
-		return db.Where("user_id = ?", userID).Delete(&model.MFAEnrollment{}).Error
+		return db.Where("user_id = ?", userID).Delete(&MFAEnrollment{}).Error
 	})
 }
 
-func (s *PostgresMFAStore) CreateChallenge(ctx context.Context, hash string, challenge MFAChallenge) error {
+func (s *PostgresMFAStore) CreateChallenge(ctx context.Context, hash string, challenge ports.MFAChallenge) error {
 	if hash == "" || challenge.UserID == uuid.Nil || !challenge.ExpiresAt.After(time.Now()) {
 		return fmt.Errorf("MFA challenge is invalid")
 	}
-	row := model.MFAChallenge{ChallengeHash: hash, UserID: challenge.UserID, ExpiresAt: challenge.ExpiresAt}
+	row := MFAChallenge{ChallengeHash: hash, UserID: challenge.UserID, ExpiresAt: challenge.ExpiresAt}
 	return tx.From(ctx, s.db).WithContext(ctx).Create(&row).Error
 }
 
-func (s *PostgresMFAStore) ConsumeChallenge(ctx context.Context, hash string) (MFAChallenge, bool, error) {
-	var challenge MFAChallenge
+func (s *PostgresMFAStore) ConsumeChallenge(ctx context.Context, hash string) (ports.MFAChallenge, bool, error) {
+	var challenge ports.MFAChallenge
 	err := tx.From(ctx, s.db).WithContext(ctx).Raw(
 		`DELETE FROM user_svc.mfa_challenges
 		 WHERE challenge_hash = ? AND expires_at > now()
 		 RETURNING user_id, expires_at`, hash,
 	).Row().Scan(&challenge.UserID, &challenge.ExpiresAt)
 	if errors.Is(err, sql.ErrNoRows) {
-		return MFAChallenge{}, false, nil
+		return ports.MFAChallenge{}, false, nil
 	}
 	if err != nil {
-		return MFAChallenge{}, false, err
+		return ports.MFAChallenge{}, false, err
 	}
 	return challenge, true, nil
 }

package/templates/add/auth/internal/app/user/{mfa_store_test.go.hbs → adapters/outbound/postgres/mfa_store_test.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package postgres
 
 import (
 	"context"
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/app/user/ports"
 
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
@@ -53,10 +53,10 @@ func TestPostgresMFAStore_ConsumesChallengesAndRecoveryCodesOnce(t *testing.T) {
 	store := NewPostgresMFAStore(db)
 	ctx := context.Background()
 	userID := uuid.New()
-	if err := db.Create(&model.User{ID: userID, Email: "mfa-store-" + uuid.NewString() + "@example.com"}).Error; err != nil {
+	if err := db.Create(&User{ID: userID, Email: "mfa-store-" + uuid.NewString() + "@example.com"}).Error; err != nil {
 		t.Fatalf("create test user: %v", err)
 	}
-	t.Cleanup(func() { _ = db.Delete(&model.User{}, "id = ?", userID).Error })
+	t.Cleanup(func() { _ = db.Delete(&User{}, "id = ?", userID).Error })
 
 	if err := store.PutPendingEnrollment(ctx, userID, "encrypted-secret"); err != nil {
 		t.Fatalf("put pending enrollment: %v", err)
@@ -76,7 +76,7 @@ func TestPostgresMFAStore_ConsumesChallengesAndRecoveryCodesOnce(t *testing.T) {
 	}
 
 	challengeHash := "challenge-hash-real-pg-" + uuid.NewString()
-	if err := store.CreateChallenge(ctx, challengeHash, MFAChallenge{UserID: userID, ExpiresAt: time.Now().Add(time.Minute)}); err != nil {
+	if err := store.CreateChallenge(ctx, challengeHash, ports.MFAChallenge{UserID: userID, ExpiresAt: time.Now().Add(time.Minute)}); err != nil {
 		t.Fatalf("create challenge: %v", err)
 	}
 	consumeChallengeConcurrently(t, store, challengeHash, userID)
@@ -95,7 +95,7 @@ func consumeChallengeConcurrently(t *testing.T, store *PostgresMFAStore, hash st
 	const callers = 16
 	start := make(chan struct{})
 	results := make(chan struct {
-		challenge MFAChallenge
+		challenge ports.MFAChallenge
 		found     bool
 		err       error
 	}, callers)
@@ -107,7 +107,7 @@ func consumeChallengeConcurrently(t *testing.T, store *PostgresMFAStore, hash st
 			<-start
 			challenge, found, err := store.ConsumeChallenge(context.Background(), hash)
 			results <- struct {
-				challenge MFAChallenge
+				challenge ports.MFAChallenge
 				found     bool
 				err       error
 			}{challenge: challenge, found: found, err: err}

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/model.go.hbs

@@ -0,0 +1,84 @@
+// Package postgres contains the user module's PostgreSQL adapters and their
+// persistence-only records. These types never cross into application code.
+package postgres
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type User struct {
+	ID            uuid.UUID `gorm:"type:uuid;primaryKey"`
+	Email         string    `gorm:"uniqueIndex:idx_users_email;not null"`
+	Name          string
+	AvatarURL     string
+	EmailVerified bool
+	Role          string `gorm:"type:varchar(20);not null;default:'staff'"`
+	CreatedAt     time.Time
+	UpdatedAt     time.Time
+}
+
+func (User) TableName() string { return "user_svc.users" }
+
+type Identity struct {
+	ID           uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID       uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
+	Provider     string    `gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
+	PasswordHash *string
+	ProviderUID  *string `gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+func (Identity) TableName() string { return "user_svc.identities" }
+
+type AuthToken struct {
+	TokenHash         string     `gorm:"primaryKey;type:text"`
+	UserID            uuid.UUID  `gorm:"type:uuid;not null;index:idx_auth_tokens_user_kind,priority:1"`
+	Kind              string     `gorm:"type:varchar(20);not null;index:idx_auth_tokens_user_kind,priority:2"`
+	ExpiresAt         time.Time  `gorm:"not null;index:idx_auth_tokens_expires_at"`
+	AbsoluteExpiresAt *time.Time `gorm:"index:idx_auth_tokens_absolute_expires_at"`
+	Provider          string     `gorm:"type:varchar(20);not null;default:''"`
+	CodeChallenge     string     `gorm:"type:text;not null;default:''"`
+	Nonce             string     `gorm:"type:text;not null;default:''"`
+	CreatedAt         time.Time
+}
+
+func (AuthToken) TableName() string { return "user_svc.auth_tokens" }
+
+type LoginThrottle struct {
+	EmailHash   string `gorm:"primaryKey;type:text"`
+	Failures    int    `gorm:"not null;default:0"`
+	LockedUntil *time.Time
+	UpdatedAt   time.Time
+}
+
+func (LoginThrottle) TableName() string { return "user_svc.login_throttle" }
+
+type MFAEnrollment struct {
+	UserID          uuid.UUID `gorm:"type:uuid;primaryKey"`
+	EncryptedSecret string    `gorm:"type:text;not null"`
+	Enabled         bool      `gorm:"not null;default:false"`
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+func (MFAEnrollment) TableName() string { return "user_svc.mfa_enrollments" }
+
+type MFAChallenge struct {
+	ChallengeHash string    `gorm:"type:text;primaryKey"`
+	UserID        uuid.UUID `gorm:"type:uuid;not null;index:idx_mfa_challenges_user"`
+	ExpiresAt     time.Time `gorm:"not null;index:idx_mfa_challenges_expires_at"`
+	CreatedAt     time.Time
+}
+
+func (MFAChallenge) TableName() string { return "user_svc.mfa_challenges" }
+
+type MFARecoveryCode struct {
+	UserID    uuid.UUID `gorm:"type:uuid;primaryKey;index:idx_mfa_recovery_codes_user"`
+	CodeHash  string    `gorm:"type:text;primaryKey"`
+	CreatedAt time.Time
+}
+
+func (MFARecoveryCode) TableName() string { return "user_svc.mfa_recovery_codes" }

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository.go.hbs

@@ -0,0 +1,211 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/app/user/ports"
+	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/shared/tx"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+var _ ports.UserRepository = (*Repository)(nil)
+
+func NewRepository(db *gorm.DB) *Repository {
+	return &Repository{db: db}
+}
+
+func (r *Repository) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
+	var row User
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "email = ?", email).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUser(&row), nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
+	var row User
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "id = ?", id).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUser(&row), nil
+}
+
+func (r *Repository) UpdateUser(ctx context.Context, user *domain.User) error {
+	row := fromDomainUser(user)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+}
+
+func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.User, error) {
+	var rows []User
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Order("created_at desc").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, persistenceError(err)
+	}
+	items := make([]domain.User, len(rows))
+	for i := range rows {
+		items[i] = *toDomainUser(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) (*domain.Identity, error) {
+	var row Identity
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		First(&row, "user_id = ? AND provider = ?", userID, string(provider)).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainIdentity(&row), nil
+}
+
+func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider domain.Provider, providerUID string) (*domain.Identity, error) {
+	var row Identity
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		First(&row, "provider = ? AND provider_uid = ?", string(provider), providerUID).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainIdentity(&row), nil
+}
+
+// CreateIdentity links a new login method onto an existing user.
+func (r *Repository) CreateIdentity(ctx context.Context, identity *domain.Identity) error {
+	row := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Create(&row).Error)
+}
+
+func (r *Repository) UpdateIdentity(ctx context.Context, identity *domain.Identity) error {
+	row := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+}
+
+// CreateUserWithIdentity inserts the profile and its first login method in
+// one transaction. A user without an identity cannot authenticate.
+func (r *Repository) CreateUserWithIdentity(ctx context.Context, user *domain.User, identity *domain.Identity) error {
+	userRow := fromDomainUser(user)
+	identityRow := fromDomainIdentity(identity)
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
+		if err := db.Create(&userRow).Error; err != nil {
+			return persistenceError(err)
+		}
+		identityRow.UserID = userRow.ID
+		return persistenceError(db.Create(&identityRow).Error)
+	}))
+}
+
+func (r *Repository) LoginLockedUntil(ctx context.Context, key string) (time.Time, error) {
+	var row LoginThrottle
+	err := tx.From(ctx, r.db).WithContext(ctx).Where("email_hash = ?", key).Take(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return time.Time{}, nil
+	}
+	if err != nil || row.LockedUntil == nil {
+		return time.Time{}, persistenceError(err)
+	}
+	return *row.LockedUntil, nil
+}
+
+// RecordLoginFailure uses one SQL statement so concurrent attempts cannot
+// both read and write the same backoff value.
+func (r *Repository) RecordLoginFailure(ctx context.Context, key string, freeAttempts int, maxLock time.Duration) error {
+	err := tx.From(ctx, r.db).WithContext(ctx).Exec(`
+		INSERT INTO user_svc.login_throttle AS t (email_hash, failures, locked_until, updated_at)
+		VALUES (?, 1, NULL, now())
+		ON CONFLICT (email_hash) DO UPDATE SET
+			failures = t.failures + 1,
+			locked_until = CASE
+				WHEN t.failures + 1 <= ? THEN NULL
+				ELSE now() + make_interval(secs => least(power(2, t.failures + 1 - ?), ?))
+			END,
+			updated_at = now()`,
+		key, freeAttempts, freeAttempts, maxLock.Seconds()).Error
+	return persistenceError(err)
+}
+
+func (r *Repository) ClearLoginFailures(ctx context.Context, key string) error {
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Where("email_hash = ?", key).
+		Delete(&LoginThrottle{}).Error
+	return persistenceError(err)
+}
+
+func persistenceError(err error) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return domain.ErrNotFound
+	}
+	if dberr.IsDuplicate(err) {
+		return domain.ErrConflict
+	}
+	return err
+}
+
+func toDomainUser(row *User) *domain.User {
+	if row == nil {
+		return nil
+	}
+	return &domain.User{
+		ID:            row.ID,
+		Email:         row.Email,
+		Name:          row.Name,
+		AvatarURL:     row.AvatarURL,
+		EmailVerified: row.EmailVerified,
+		Role:          row.Role,
+		CreatedAt:     row.CreatedAt,
+		UpdatedAt:     row.UpdatedAt,
+	}
+}
+
+func fromDomainUser(user *domain.User) User {
+	return User{
+		ID:            user.ID,
+		Email:         user.Email,
+		Name:          user.Name,
+		AvatarURL:     user.AvatarURL,
+		EmailVerified: user.EmailVerified,
+		Role:          user.Role,
+		CreatedAt:     user.CreatedAt,
+		UpdatedAt:     user.UpdatedAt,
+	}
+}
+
+func toDomainIdentity(row *Identity) *domain.Identity {
+	if row == nil {
+		return nil
+	}
+	return &domain.Identity{
+		ID:           row.ID,
+		UserID:       row.UserID,
+		Provider:     domain.Provider(row.Provider),
+		PasswordHash: row.PasswordHash,
+		ProviderUID:  row.ProviderUID,
+		CreatedAt:    row.CreatedAt,
+		UpdatedAt:    row.UpdatedAt,
+	}
+}
+
+func fromDomainIdentity(identity *domain.Identity) Identity {
+	return Identity{
+		ID:           identity.ID,
+		UserID:       identity.UserID,
+		Provider:     string(identity.Provider),
+		PasswordHash: identity.PasswordHash,
+		ProviderUID:  identity.ProviderUID,
+		CreatedAt:    identity.CreatedAt,
+		UpdatedAt:    identity.UpdatedAt,
+	}
+}
+
+// go-scaffold:repository-methods
+// go-scaffold:user-repository-methods

package/templates/add/auth/internal/app/user/{repository_test.go.hbs → adapters/outbound/postgres/repository_test.go.hbs}

@@ -1,14 +1,13 @@
-package user
+package postgres
 
 import (
-	"time"
 	"context"
 	"errors"
 	"os"
 	"testing"
+	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
@@ -73,22 +72,22 @@ func TestRepository_CreateUserWithIdentity_RollsBackBothOnIdentityConflict(t *te
 	ctx := context.Background()
 
 	providerUID := "conflicting-provider-uid"
-	existing := &model.User{ID: uuid.New(), Email: "first@example.com"}
-	if err := repo.CreateUserWithIdentity(ctx, existing, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID,
+	existing := &domain.User{ID: uuid.New(), Email: "first@example.com"}
+	if err := repo.CreateUserWithIdentity(ctx, existing, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
 	}); err != nil {
 		t.Fatalf("seed existing user+identity: %v", err)
 	}
 
-	blocked := &model.User{ID: uuid.New(), Email: "second@example.com"}
-	err := repo.CreateUserWithIdentity(ctx, blocked, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderGoogle, ProviderUID: &providerUID,
+	blocked := &domain.User{ID: uuid.New(), Email: "second@example.com"}
+	err := repo.CreateUserWithIdentity(ctx, blocked, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
 	})
-	if !dberr.IsDuplicate(err) {
-		t.Fatalf("want a duplicate-key error from the conflicting provider_uid, got %v", err)
+	if !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("want a mapped user conflict from the conflicting provider_uid, got %v", err)
 	}
 
-	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, gorm.ErrRecordNotFound) {
+	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, domain.ErrNotFound) {
 		t.Fatalf("the new user must not survive a transaction whose identity insert failed, got %v", findErr)
 	}
 }
@@ -103,17 +102,17 @@ func TestRepository_CreateUserWithIdentity_DuplicateEmailIsDetectable(t *testing
 	ctx := context.Background()
 
 	email := "dup@example.com"
-	if err := repo.CreateUserWithIdentity(ctx, &model.User{ID: uuid.New(), Email: email}, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderLocal,
+	if err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderLocal,
 	}); err != nil {
 		t.Fatalf("seed first user: %v", err)
 	}
 
-	err := repo.CreateUserWithIdentity(ctx, &model.User{ID: uuid.New(), Email: email}, &model.Identity{
-		ID: uuid.New(), Provider: model.ProviderLocal,
+	err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
+		ID: uuid.New(), Provider: domain.ProviderLocal,
 	})
-	if !dberr.IsDuplicate(err) {
-		t.Fatalf("want a duplicate-key error for the reused email, got %v", err)
+	if !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("want a mapped user conflict for the reused email, got %v", err)
 	}
 }