@nakedev/go-scaffold 0.4.3 → 0.5.1

package/dist/utils/rbac-patcher.js

@@ -13,7 +13,6 @@ exports.patchUserServiceTestForRbac = patchUserServiceTestForRbac;
 exports.patchUserDTOForRbac = patchUserDTOForRbac;
 exports.patchUserHandlerForRbac = patchUserHandlerForRbac;
 exports.patchUserErrorsForRbac = patchUserErrorsForRbac;
-exports.userSvcLineFor = userSvcLineFor;
 exports.assertRbacPatchable = assertRbacPatchable;
 exports.patchMainGoForRbac = patchMainGoForRbac;
 exports.patchCmdSeedForRbac = patchCmdSeedForRbac;
@@ -23,13 +22,12 @@ const marker_patch_1 = require("./marker-patch");
 const IMPORT_MARKER = "// go-scaffold:imports";
 const SCHEMA_MARKER = "// go-scaffold:schemas";
 const MODEL_MARKER = "// go-scaffold:models";
-const ROUTE_MARKER = "// go-scaffold:routes";
 const CONFIG_FIELDS_MARKER = "// go-scaffold:config-fields";
 const CONFIG_LOAD_MARKER = "// go-scaffold:config-load";
 // patchAuthDocsForRbac adds `role` to the hand-written MeResponse schema in
 // docs/auth/schemas.yaml — same marker convention as the Go dto.go patch
 // (patchUserDTOForRbac), since GET/PATCH /users(/me) all serialize the same
-// model.User whether or not RBAC is installed.
+// user response whether or not RBAC is installed.
 function patchAuthDocsForRbac(authSchemasYamlPath) {
     if (!fs_extra_1.default.existsSync(authSchemasYamlPath))
         return; // openapi docs feature disabled
@@ -46,15 +44,16 @@ function patchConfigForRbac(configGoPath) {
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_LOAD_MARKER, 'AuthzCacheTTL: time.Duration(envInt("AUTHZ_CACHE_TTL_MIN", 1)) * time.Minute,', "AuthzCacheTTL: time.Duration");
     fs_extra_1.default.writeFileSync(configGoPath, content);
 }
-// patchUserModelForRbac adds the Role column to model.User — default 'staff'
-// at the DB level (via the gorm tag), so every existing user-creation path
-// (Register, Google, cmd/seed) gets a sane role without each one needing to
-// set it explicitly.
+// patchUserModelForRbac verifies the auth template exposes the optional role
+// field in its outbound persistence model. Auth owns the stable user shape;
+// RBAC adds the role catalog and authorization policy on top of it. Keeping
+// this check idempotent lets the command work across scaffold versions
+// without recreating a second model package.
 function patchUserModelForRbac(userModelPath) {
     let content = fs_extra_1.default.readFileSync(userModelPath, "utf8");
-    const field = `Role string \`json:"role" gorm:"type:varchar(20);not null;default:'staff'"\``;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-fields", field, "Role string");
-    fs_extra_1.default.writeFileSync(userModelPath, content);
+    if (/\bRole\s+string\b/.test(content))
+        return;
+    throw new Error(`${userModelPath} does not expose User.Role — the auth module must be regenerated or migrated before adding RBAC`);
 }
 // patchMiddlewareAuthForRbac adds RoleKey + the Role claim to the shared
 // middleware's own accessClaims copy (see auth.go's own comment on why it's
@@ -78,201 +77,78 @@ function patchUserJWTForRbac(jwtGoPath) {
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:jwt-claims-values", "Role: role,", "Role: role,");
     fs_extra_1.default.writeFileSync(jwtGoPath, content);
 }
-// patchUserServiceForRbac adds the RBAC behavior to user.Service. The base
-// auth constructor already exposes Dependencies.Roles, so enabling RBAC does
-// not mutate a positional constructor signature anymore.
-function patchUserServiceForRbac(serviceGoPath, goModule, sessionsGoPath) {
-    let content = fs_extra_1.default.readFileSync(serviceGoPath, "utf8");
-    const roleCheckerInterface = [
-        "// RoleChecker is what the service needs from the role domain to validate a",
-        "// role assignment — declared consumer-side, same convention as repository/mailer.",
-        "type RoleChecker interface {",
-        "\tCodeExists(ctx context.Context, code string) (bool, error)",
-        "}",
-    ].join("\n");
-    if (!content.includes("type RoleChecker interface") && !content.includes("type roleChecker interface")) {
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-interfaces", roleCheckerInterface, "type RoleChecker interface");
-    }
-    // issueTokens moved out of service.go with auth's use-case split. Keep the
-    // patch compatible with both shapes: new projects patch sessions.go, while
-    // older generated projects still have the marker in service.go.
-    const tokenIssuePath = sessionsGoPath && fs_extra_1.default.existsSync(sessionsGoPath) ? sessionsGoPath : serviceGoPath;
-    let tokenIssueContent = tokenIssuePath === serviceGoPath ? content : fs_extra_1.default.readFileSync(tokenIssuePath, "utf8");
-    tokenIssueContent = (0, marker_patch_1.insertBeforeMarkerOnce)(tokenIssueContent, "// go-scaffold:issue-access-token-args", "u.Role,", "u.Role,");
-    if (tokenIssuePath === serviceGoPath) {
-        content = tokenIssueContent;
+// patchUserServiceForRbac verifies the auth application already exposes the
+// optional role capability. The canonical auth template owns this shared user
+// behavior; `add rbac` only supplies the role catalog and authorizer.
+function patchUserServiceForRbac(serviceGoPath, sessionsGoPath) {
+    const content = fs_extra_1.default.readFileSync(serviceGoPath, "utf8");
+    for (const required of ["roles             ports.RoleChecker", "func (s *Service) SetRole(", "// go-scaffold:service-interface"]) {
+        if (!content.includes(required)) {
+            throw new Error(`${serviceGoPath} is missing the canonical auth role capability (${required}); regenerate auth before adding RBAC`);
+        }
     }
-    // Auth keeps its base service focused and therefore does not need RBAC's
-    // error/ORM imports until this optional method is patched in. Add them here
-    // instead of carrying unused imports in every auth-only project. The module
-    // argument is optional for callers that patch legacy projects whose service
-    // already imported apperror; new CLI calls always provide it.
-    if (goModule) {
-        content = (0, marker_patch_1.ensureImport)(content, "errors");
-        content = (0, marker_patch_1.ensureImport)(content, `${goModule}/internal/shared/apperror`);
-        content = (0, marker_patch_1.ensureImport)(content, "gorm.io/gorm");
+    if (sessionsGoPath && fs_extra_1.default.existsSync(sessionsGoPath)) {
+        const sessions = fs_extra_1.default.readFileSync(sessionsGoPath, "utf8");
+        if (!sessions.includes("u.Role,")) {
+            throw new Error(`${sessionsGoPath} does not include the user's role in access-token issuance; regenerate auth before adding RBAC`);
+        }
     }
-    const setRoleMethod = [
-        "// SetRole assigns userID a new role — validated against the role catalog",
-        "// (not just the DB's FK) so a typo'd code fails with a clear 422 here",
-        "// instead of surfacing as an opaque FK-violation, and so AutoMigrate-only",
-        "// test schemas (which never create the FK) still reject it correctly.",
-        "func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string) (*model.User, error) {",
-        "\tu, err := s.repo.FindByID(ctx, userID)",
-        "\tif err != nil {",
-        "\t\tif errors.Is(err, gorm.ErrRecordNotFound) {",
-        "\t\t\treturn nil, errNotFound()",
-        "\t\t}",
-        "\t\treturn nil, apperror.NewInternal(err)",
-        "\t}",
-        "\texists, err := s.roles.CodeExists(ctx, roleCode)",
-        "\tif err != nil {",
-        "\t\treturn nil, apperror.NewInternal(err)",
-        "\t}",
-        "\tif !exists {",
-        "\t\treturn nil, errUnknownRole()",
-        "\t}",
-        "\tu.Role = roleCode",
-        "\tif err := s.repo.UpdateUser(ctx, u); err != nil {",
-        "\t\treturn nil, apperror.NewInternal(err)",
-        "\t}",
-        "\treturn u, nil",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-methods", setRoleMethod, "func (s *Service) SetRole(");
-    fs_extra_1.default.writeFileSync(serviceGoPath, content);
-    if (tokenIssuePath !== serviceGoPath)
-        fs_extra_1.default.writeFileSync(tokenIssuePath, tokenIssueContent);
 }
-// patchUserServiceTestForRbac supplies a fake role capability through the
-// explicit Dependencies literal. The fake itself remains opt-in so auth-only
-// projects do not carry an unused RBAC test double.
+// patchUserServiceTestForRbac verifies the canonical auth test seam already
+// supplies the optional role capability. It is part of the auth contract so
+// adding RBAC does not rewrite every test call site.
 function patchUserServiceTestForRbac(serviceTestGoPath) {
-    let content = fs_extra_1.default.readFileSync(serviceTestGoPath, "utf8");
-    const fakeRoles = [
-        "// fakeRoles satisfies role's roleChecker interface structurally.",
-        "type fakeRoles struct{}",
-        "",
-        "func (fakeRoles) CodeExists(context.Context, string) (bool, error) { return true, nil }",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-test-types", fakeRoles, "type fakeRoles struct{}");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-service-test-deps", "Roles: fakeRoles{},", "Roles: fakeRoles{},");
-    fs_extra_1.default.writeFileSync(serviceTestGoPath, content);
+    const content = fs_extra_1.default.readFileSync(serviceTestGoPath, "utf8");
+    for (const required of ["type fakeRoles struct{}", "Roles:             fakeRoles{},", "// go-scaffold:user-service-test-deps"]) {
+        if (!content.includes(required)) {
+            throw new Error(`${serviceTestGoPath} is missing the canonical auth role test seam (${required}); regenerate auth before adding RBAC`);
+        }
+    }
 }
-// patchUserDTOForRbac adds the request DTO for PATCH /users/:id/set-role and
-// surfaces Role on the /me response — both gated behind RBAC since
-// model.User has no Role field at all without it.
+// patchUserDTOForRbac verifies the role DTOs owned by the canonical auth
+// inbound adapter. The routes remain inactive until an Authz is composed.
 function patchUserDTOForRbac(dtoGoPath) {
-    let content = fs_extra_1.default.readFileSync(dtoGoPath, "utf8");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-me-fields", 'Role string `json:"role"`', "Role string");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-me-values", "Role: u.Role,", "Role: u.Role,");
-    const setRoleInput = ["type setRoleInput struct {", '\tRole string `json:"role" binding:"required"`', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-dto", setRoleInput, "type setRoleInput struct");
-    fs_extra_1.default.writeFileSync(dtoGoPath, content);
-}
-// patchUserHandlerForRbac wires an *middleware.Authz into Handler and adds
-// the admin routes this PR ships: listing/viewing other users (PermUserRead)
-// and changing a user's role (PermUserManageRole). Suspending a user is a
-// separate concern, not RBAC's — see the role domain's own /roles,
-// /permissions for the actual role/permission management API.
-function patchUserHandlerForRbac(handlerGoPath, goModule) {
-    let content = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
-    // The base auth handler is intentionally only the route/composition surface;
-    // its endpoint implementations now live in sibling files. RBAC still
-    // patches its admin handlers into handler.go for marker compatibility, so
-    // make the imports required by those injected handlers explicit here rather
-    // than relying on imports that used to come from the old monolithic file.
-    content = (0, marker_patch_1.ensureImport)(content, "net/http");
-    content = (0, marker_patch_1.ensureImport)(content, `${goModule}/internal/shared/httpx`);
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-consts", 'const PermUserManageRole = "user:manage-role"', "PermUserManageRole");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-consts", 'const PermUserRead = "user:read"', "PermUserRead");
-    const paginationImport = `"${goModule}/internal/shared/pagination"`;
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-imports", paginationImport, "internal/shared/pagination");
-    if (!/\bauthz\s+(?:\*middleware\.Authz|authorizer)\b/.test(content)) {
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-fields", "authz *middleware.Authz", "authz *middleware.Authz");
+    const content = fs_extra_1.default.readFileSync(dtoGoPath, "utf8");
+    if (!/\bRole\s+string\s+`json:"role"`/.test(content)) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO; regenerate auth before adding RBAC`);
     }
-    if (!/\bauthz\s+\.\.\.(?:\*middleware\.Authz|authorizer)\s*,/.test(content) && !/\bauthz\s+\*middleware\.Authz\s*,/.test(content)) {
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-params", "authz *middleware.Authz,", "authz *middleware.Authz,");
+    if (!/Role:\s+user\.Role,/.test(content)) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO mapping; regenerate auth before adding RBAC`);
     }
-    if (!/authz:\s+authzMiddleware,/.test(content) && !/authz:\s+authz,/.test(content)) {
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-init", "authz: authz,", "authz: authz,");
+    if (!content.includes("type setRoleInput struct")) {
+        throw new Error(`${dtoGoPath} is missing the canonical auth role DTO (type setRoleInput struct); regenerate auth before adding RBAC`);
     }
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)', 'usersGroup.GET("", h.authz.Require(PermUserRead)');
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)', 'usersGroup.GET("/:id", h.authz.Require(PermUserRead)');
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-routes", 'usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)', 'usersGroup.PATCH("/:id/set-role"');
-    const adminListHandler = [
-        "func (h *Handler) adminListUsers(c *gin.Context) {",
-        "\tp := pagination.Parse(c)",
-        "\titems, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tout := make([]meResponse, len(items))",
-        "\tfor i := range items {",
-        "\t\tout[i] = toMeResponse(&items[i])",
-        "\t}",
-        "\tc.JSON(http.StatusOK, p.Response(out))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", adminListHandler, "func (h *Handler) adminListUsers(");
-    const adminGetHandler = [
-        "func (h *Handler) adminGetUser(c *gin.Context) {",
-        "\tid, ok := httpx.ParseID(c)",
-        "\tif !ok {",
-        "\t\treturn",
-        "\t}",
-        "\tu, err := h.svc.Get(c.Request.Context(), id)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tc.JSON(http.StatusOK, toMeResponse(u))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", adminGetHandler, "func (h *Handler) adminGetUser(");
-    const setRoleHandler = [
-        "func (h *Handler) setRole(c *gin.Context) {",
-        "\tid, ok := httpx.ParseID(c)",
-        "\tif !ok {",
-        "\t\treturn",
-        "\t}",
-        "\tvar in setRoleInput",
-        "\tif err := c.ShouldBindJSON(&in); err != nil {",
-        "\t\tc.Error(httpx.BindErr(err))",
-        "\t\treturn",
-        "\t}",
-        "\tu, err := h.svc.SetRole(c.Request.Context(), id, in.Role)",
-        "\tif err != nil {",
-        "\t\tc.Error(err)",
-        "\t\treturn",
-        "\t}",
-        "\tc.JSON(http.StatusOK, toMeResponse(u))",
-        "}",
-    ].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-handler-funcs", setRoleHandler, "func (h *Handler) setRole(");
-    fs_extra_1.default.writeFileSync(handlerGoPath, content);
 }
-function patchUserErrorsForRbac(errorsGoPath) {
-    let content = fs_extra_1.default.readFileSync(errorsGoPath, "utf8");
-    const errFn = ["func errUnknownRole() *apperror.AppError {", '\treturn apperror.New(http.StatusUnprocessableEntity, "USER_UNKNOWN_ROLE", "unknown role code")', "}"].join("\n");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:user-errors", errFn, "func errUnknownRole(");
-    fs_extra_1.default.writeFileSync(errorsGoPath, content);
+// patchUserHandlerForRbac verifies that auth owns the role-aware admin route
+// surface. The routes are guarded by the optional authorizer, so adding RBAC
+// composes the guard; it does not copy or rewrite handler code.
+function patchUserHandlerForRbac(handlerGoPath) {
+    const content = fs_extra_1.default.readFileSync(handlerGoPath, "utf8");
+    for (const required of [
+        "authz   authorizer",
+        "func (h *Handler) adminListUsers(",
+        "func (h *Handler) adminGetUser(",
+        "func (h *Handler) setRole(",
+        'usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)',
+        'usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)',
+        'usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)',
+    ]) {
+        if (!content.includes(required)) {
+            throw new Error(`${handlerGoPath} is missing the canonical auth role route (${required}); regenerate auth before adding RBAC`);
+        }
+    }
 }
-// userSvcLineFor rebuilds the legacy line `add auth` wrote before auth got a
-// feature-local composition root. It remains here so `add rbac` can upgrade an
-// older generated project without pulling the old construction shape into new
-// output.
-function userSvcLineFor(goModule, store, worker) {
-    const { tokenStore, mailer } = (0, auth_patcher_1.authWiringLines)({ goModule, queueBackend: "river", store, worker });
-    return `userSvc := user.NewService(user.NewRepository(db), ${tokenStore}, ${mailer}, cfg, application.NewProviderRegistry())`;
+function patchUserErrorsForRbac(errorsGoPath) {
+    const content = fs_extra_1.default.readFileSync(errorsGoPath, "utf8");
+    if (!content.includes("func errUnknownRole(")) {
+        throw new Error(`${errorsGoPath} is missing the canonical unknown-role error; regenerate auth before adding RBAC`);
+    }
 }
 function assertRbacPatchable(mainGoPath, goModule, store, worker) {
     const wiring = { goModule, queueBackend: "river", store, worker };
     const content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const expected = (0, auth_patcher_1.authHandlerLineFor)(wiring);
-    const legacyRoute = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${(0, auth_patcher_1.authWiringLines)(wiring).limiter}).Register(api)`;
-    if (content.includes(expected) || content.includes(userSvcLineFor(goModule, store, worker)) || content.includes(legacyRoute))
+    if (content.includes(expected))
         return;
     throw new Error("cmd/api/wiring.go's auth route doesn't match what `add auth` wrote, so `add rbac` can't extend it.\n" +
         `Expected to find:\n  ${expected}\n\n` +
@@ -282,7 +158,7 @@ function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
     let content = fs_extra_1.default.readFileSync(mainGoPath, "utf8");
     const importLine = `"${goModule}/internal/app/role"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, importLine, importLine);
-    const modelImportLine = `rolemodel "${goModule}/internal/app/role/model"`;
+    const modelImportLine = `rolepostgres "${goModule}/internal/app/role/adapters/outbound/postgres"`;
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, modelImportLine, modelImportLine);
     const schemaBlock = [
         'if err := db.Exec("CREATE SCHEMA IF NOT EXISTS role_svc").Error; err != nil {',
@@ -290,7 +166,7 @@ function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS role_svc");
-    const migrateLines = ["&rolemodel.Role{},", "&rolemodel.Permission{},", "&rolemodel.RolePermission{},"];
+    const migrateLines = ["&rolepostgres.Role{},", "&rolepostgres.Permission{},", "&rolepostgres.RolePermission{},"];
     for (const line of migrateLines) {
         content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, MODEL_MARKER, line, line);
     }
@@ -298,32 +174,13 @@ function patchMainGoForRbac(mainGoPath, goModule, store, worker) {
     const authRouteLine = (0, auth_patcher_1.authHandlerLineFor)(wiring);
     const roleCompositionLine = "roleComposition := role.NewCompositionFromDB(db, cfg.JWTSecret, cfg.AuthzCacheTTL)";
     const roleHandlerLine = "roleComposition.Handler.Register(api)";
-    if (content.includes(authRouteLine)) {
-        const authWithRoleLine = (0, auth_patcher_1.authHandlerLineFor)(wiring, ["roleComposition.Service", "roleComposition.Authz"]);
-        content = content.replace(authRouteLine, [roleCompositionLine, authWithRoleLine, roleHandlerLine].join("\n"));
-    }
-    else {
-        // Upgrade projects generated before auth's local composition root. The
-        // role feature is still constructed locally; only the legacy user service
-        // call needs an adapter until that project is regenerated.
-        const applicationImportLine = `"${goModule}/internal/app/user/application"`;
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, IMPORT_MARKER, applicationImportLine, applicationImportLine);
-        const userSvcLine = userSvcLineFor(goModule, store, worker);
-        if (!content.includes(userSvcLine)) {
-            throw new Error(`cmd/api/wiring.go's auth route doesn't match what \`add auth\` wrote, so \`add rbac\` can't extend it.\n` +
-                `Expected to find:\n  ${authRouteLine}\n\n` +
-                "It was probably hand-edited. Restore that route and re-run — nothing has been changed yet.");
-        }
-        content = content.replace(userSvcLine, [roleCompositionLine, `${userSvcLine.slice(0, -1)}, roleComposition.Service)`].join("\n"));
-        const limiter = (0, auth_patcher_1.authWiringLines)(wiring).limiter;
-        const legacyRoute = `user.NewHandler(userSvc, cfg.JWTSecret, cfg.JWTRefreshTTL, cfg.CookieSecure, cfg.CookieSameSite, ${limiter}).Register(api)`;
-        const tail = ").Register(api)";
-        if (!content.includes(legacyRoute)) {
-            throw new Error("cmd/api/wiring.go is missing auth's legacy handler route while adding RBAC");
-        }
-        content = content.replace(legacyRoute, `${legacyRoute.slice(0, -tail.length)}, roleComposition.Authz${tail}`);
-        content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, ROUTE_MARKER, roleHandlerLine, roleHandlerLine);
+    if (!content.includes(authRouteLine)) {
+        throw new Error(`cmd/api/wiring.go's auth route doesn't match what \`add auth\` wrote, so \`add rbac\` can't extend it.\n` +
+            `Expected to find:\n  ${authRouteLine}\n\n` +
+            "It was probably hand-edited. Restore that route and re-run — nothing has been changed yet.");
     }
+    const authWithRoleLine = (0, auth_patcher_1.authHandlerLineFor)(wiring, ["roleComposition.Service", "roleComposition.Authz"]);
+    content = content.replace(authRouteLine, [roleCompositionLine, authWithRoleLine, roleHandlerLine].join("\n"));
     fs_extra_1.default.writeFileSync(mainGoPath, content);
 }
 // patchCmdSeedForRbac makes the seeded admin actually an admin: wires a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nakedev/go-scaffold",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "description": "Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard",
   "repository": {
     "type": "git",

package/templates/add/auth/cmd/seed/main.go.hbs

@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"{{goModule}}/internal/app/user"
+	userpassword "{{goModule}}/internal/app/user/adapters/outbound/password"
 	"{{goModule}}/internal/platform/database"
 	"{{goModule}}/internal/shared/config"
 	// go-scaffold:seed-imports
@@ -32,6 +33,7 @@ func main() {
 	// go-scaffold:seed-services
 	svc := user.NewService(user.Dependencies{
 		Repository: user.NewRepository(db),
+		Passwords:  userpassword.NewBCryptHasher(),
 		// go-scaffold:seed-user-service-args
 	}, user.AuthConfig{
 		JWTSecret:        cfg.JWTSecret,

package/templates/add/auth/internal/app/user/{browser_policy.go.hbs → adapters/inbound/http/browser_policy.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package httpadapter
 
 import (
 	"fmt"
@@ -61,10 +61,10 @@ func canonicalBrowserOrigin(value string) (string, bool) {
 	return parsed.Scheme + "://" + parsed.Host, true
 }
 
-// validateBrowserCookiePolicy ties deployment topology to the attributes used
+// ValidateBrowserCookiePolicy ties deployment topology to the attributes used
 // by /auth/refresh. Same-site is the safe local default; cross-site must opt
 // into None + Secure, and production always requires Secure.
-func validateBrowserCookiePolicy(topology, sameSite string, secure, production bool) error {
+func ValidateBrowserCookiePolicy(topology, sameSite string, secure, production bool) error {
 	if production && !secure {
 		return fmt.Errorf("production browser cookies require COOKIE_SECURE=true")
 	}

package/templates/add/auth/internal/app/user/adapters/inbound/http/dto.go.hbs

@@ -0,0 +1,159 @@
+package httpadapter
+
+import (
+	"time"
+
+	userapp "{{goModule}}/internal/app/user/application"
+	userdomain "{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+// Request DTOs belong to the HTTP adapter. The application receives the
+// transport-neutral inputs from handler mapping code.
+type registerInput struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required,min=8"`
+	Name     string `json:"name" binding:"required"`
+}
+
+type loginInput struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required"`
+}
+
+type loginExchangeInput struct {
+	Code         string `json:"code"`
+	State        string `json:"state"`
+	CodeVerifier string `json:"code_verifier"`
+}
+
+type loginStartInput struct {
+	State               string
+	CodeChallenge       string
+	CodeChallengeMethod string
+}
+
+func toRegisterInput(in registerInput) userapp.RegisterInput {
+	return userapp.RegisterInput{Email: in.Email, Password: in.Password, Name: in.Name}
+}
+
+func toLoginInput(in loginInput) userapp.LoginInput {
+	return userapp.LoginInput{Email: in.Email, Password: in.Password}
+}
+
+func toLoginStartInput(in loginStartInput) userapp.LoginStartInput {
+	return userapp.LoginStartInput{
+		State: in.State, CodeChallenge: in.CodeChallenge, CodeChallengeMethod: in.CodeChallengeMethod,
+	}
+}
+
+func toLoginExchangeInput(in loginExchangeInput) userapp.LoginExchangeInput {
+	return userapp.LoginExchangeInput{Code: in.Code, State: in.State, CodeVerifier: in.CodeVerifier}
+}
+
+type forgotPasswordInput struct {
+	Email string `json:"email" binding:"required,email"`
+}
+
+type resetPasswordInput struct {
+	Token       string `json:"token" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required,min=8"`
+}
+
+type verifyEmailInput struct {
+	Token string `json:"token" binding:"required"`
+}
+
+type mfaCodeInput struct {
+	Code string `json:"code" binding:"required"`
+}
+
+type mfaChallengeInput struct {
+	Challenge string `json:"challenge" binding:"required"`
+	Code      string `json:"code" binding:"required"`
+}
+
+type authCookieResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int    `json:"expires_in"`
+}
+
+type mfaChallengeResponse struct {
+	MFARequired bool   `json:"mfa_required"`
+	Challenge   string `json:"challenge"`
+}
+
+type mfaStatusResponse struct {
+	Available bool `json:"available"`
+	Enabled   bool `json:"enabled"`
+}
+
+type mfaSetupResponse struct {
+	Secret     string `json:"secret"`
+	OTPAuthURI string `json:"otpauth_uri"`
+}
+
+type mfaConfirmResponse struct {
+	RecoveryCodes []string `json:"recovery_codes"`
+}
+
+func toCookieResponse(auth *userapp.AuthResponse) authCookieResponse {
+	return authCookieResponse{AccessToken: auth.AccessToken, TokenType: auth.TokenType, ExpiresIn: auth.ExpiresIn}
+}
+
+type meResponse struct {
+	ID            uuid.UUID `json:"id"`
+	Email         string    `json:"email"`
+	Name          string    `json:"name"`
+	AvatarURL     string    `json:"avatar_url"`
+	EmailVerified bool      `json:"email_verified"`
+	Role          string    `json:"role"`
+	// go-scaffold:user-me-fields
+	CreatedAt time.Time `json:"created_at"`
+}
+
+func toMeResponse(user *userdomain.User) meResponse {
+	return meResponse{
+		ID:            user.ID,
+		Email:         user.Email,
+		Name:          user.Name,
+		AvatarURL:     user.AvatarURL,
+		EmailVerified: user.EmailVerified,
+		CreatedAt:     user.CreatedAt,
+		Role:          user.Role,
+		// go-scaffold:user-me-values
+	}
+}
+
+// response is the HTTP representation used by generated methods. It is kept
+// separate from application.Response so JSON naming remains an adapter detail.
+//
+//nolint:unused
+type response struct {
+	ID            uuid.UUID `json:"id"`
+	Email         string    `json:"email"`
+	Name          string    `json:"name"`
+	AvatarURL     string    `json:"avatar_url"`
+	EmailVerified bool      `json:"email_verified"`
+	Role          string    `json:"role"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+//nolint:unused
+func toResponse(out userapp.Response) response {
+	return response{
+		ID: out.ID, Email: out.Email, Name: out.Name, AvatarURL: out.AvatarURL,
+		EmailVerified: out.EmailVerified, Role: out.Role, CreatedAt: out.CreatedAt,
+		UpdatedAt: out.UpdatedAt,
+	}
+}
+
+type setRoleInput struct {
+	Role string `json:"role" binding:"required"`
+}
+
+// go-scaffold:dto
+// go-scaffold:user-dto