@nakedev/go-scaffold 0.4.3 → 0.5.1

package/templates/add/auth/internal/app/user/{handler.go.hbs → adapters/inbound/http/handler.go.hbs}

@@ -1,10 +1,17 @@
-package user
+package httpadapter
 
 import (
+	"errors"
+	"net/http"
 	"time"
 
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/shared/httpx"
 	"{{goModule}}/internal/shared/middleware"
 
+	"{{goModule}}/internal/shared/pagination"
 	"github.com/gin-gonic/gin"
 	// go-scaffold:user-handler-imports
 )
@@ -13,6 +20,9 @@ const (
 	refreshCookieName = "refresh_token"
 )
 
+const PermUserManageRole = "user:manage-role"
+const PermUserRead = "user:read"
+
 // go-scaffold:user-handler-consts
 
 // authorizer is the optional capability RBAC supplies to protect admin
@@ -22,7 +32,7 @@ type authorizer interface {
 }
 
 type Handler struct {
-	svc            *Service
+	svc            application.ServicePort
 	jwtSecret      string
 	refreshTTL     time.Duration
 	cookieSecure   bool
@@ -36,7 +46,7 @@ type Handler struct {
 }
 
 func NewHandler(
-	svc *Service,
+	svc application.ServicePort,
 	jwtSecret string,
 	refreshTTL time.Duration,
 	cookieSecure bool,
@@ -48,11 +58,10 @@ func NewHandler(
 	return newHandler(svc, jwtSecret, refreshTTL, cookieSecure, cookieSameSite, nil, limiter, authz...)
 }
 
-// NewHandlerWithOrigins is the current composition entry point. Keeping the
-// original NewHandler signature preserves source compatibility for projects
-// generated before the cross-site Origin guard was added.
+// NewHandlerWithOrigins is the composition entry point when the application
+// uses cookies across browser origins.
 func NewHandlerWithOrigins(
-	svc *Service,
+	svc application.ServicePort,
 	jwtSecret string,
 	refreshTTL time.Duration,
 	cookieSecure bool,
@@ -66,7 +75,7 @@ func NewHandlerWithOrigins(
 }
 
 func newHandler(
-	svc *Service,
+	svc application.ServicePort,
 	jwtSecret string,
 	refreshTTL time.Duration,
 	cookieSecure bool,
@@ -127,7 +136,93 @@ func (h *Handler) Register(rg gin.IRouter) {
 	usersGroup.POST("/me/mfa/setup", mfaSetupLimit, h.setupMFA)
 	usersGroup.POST("/me/mfa/confirm", mfaConfirmLimit, h.confirmMFA)
 	usersGroup.POST("/me/mfa/disable", mfaDisableLimit, h.disableMFA)
+	// Admin user routes are enabled only when the optional RBAC authorizer is
+	// supplied by the composition root. Auth-only projects keep the endpoint
+	// surface limited to authentication and the current-user operations.
+	if h.authz != nil {
+		usersGroup.GET("", h.authz.Require(PermUserRead), h.adminListUsers)
+		usersGroup.GET("/:id", h.authz.Require(PermUserRead), h.adminGetUser)
+		usersGroup.PATCH("/:id/set-role", h.authz.Require(PermUserManageRole), h.setRole)
+	}
+	// go-scaffold:handler-routes
 	// go-scaffold:user-routes
 }
 
+func (h *Handler) adminListUsers(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]meResponse, len(items))
+	for i := range items {
+		out[i] = toMeResponse(&items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+func (h *Handler) adminGetUser(c *gin.Context) {
+	id, ok := httpx.ParseID(c)
+	if !ok {
+		return
+	}
+	u, err := h.svc.Get(c.Request.Context(), id)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}
+func (h *Handler) setRole(c *gin.Context) {
+	id, ok := httpx.ParseID(c)
+	if !ok {
+		return
+	}
+	var in setRoleInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	u, err := h.svc.SetRole(c.Request.Context(), id, in.Role)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusOK, toMeResponse(u))
+}
+
+func toHTTPError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var appErr *apperror.AppError
+	if errors.As(err, &appErr) {
+		return err
+	}
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		status := http.StatusInternalServerError
+		switch ruleErr.Code {
+		case "USER_NOT_FOUND":
+			status = http.StatusNotFound
+		case "USER_EMAIL_TAKEN", "AUTH_ALREADY_VERIFIED", "AUTH_MFA_ALREADY_ENABLED", "AUTH_MFA_NOT_ENROLLED", "AUTH_MFA_SETUP_REQUIRED":
+			status = http.StatusConflict
+		case "AUTH_INVALID_CREDENTIALS", "AUTH_INVALID_TOKEN", "AUTH_MFA_INVALID":
+			status = http.StatusUnauthorized
+		case "AUTH_MFA_UNAVAILABLE":
+			status = http.StatusServiceUnavailable
+		case "AUTH_TOO_MANY_ATTEMPTS":
+			status = http.StatusTooManyRequests
+		case "USER_UNKNOWN_ROLE":
+			status = http.StatusUnprocessableEntity
+		}
+		return apperror.New(status, ruleErr.Code, ruleErr.Message)
+	}
+	if errors.Is(err, domain.ErrNotFound) {
+		return apperror.NewNotFound("user not found")
+	}
+	return apperror.NewInternal(err)
+}
+
+// go-scaffold:handler-funcs
 // go-scaffold:user-handler-funcs

package/templates/add/auth/internal/app/user/{handler_local.go.hbs → adapters/inbound/http/handler_local.go.hbs}

@@ -1,8 +1,9 @@
-package user
+package httpadapter
 
 import (
 	"net/http"
 
+	"{{goModule}}/internal/app/user/domain"
 	"{{goModule}}/internal/shared/httpx"
 
 	"github.com/gin-gonic/gin"
@@ -18,9 +19,9 @@ func (h *Handler) register(c *gin.Context) {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	auth, err := h.svc.Register(c.Request.Context(), in)
+	auth, err := h.svc.Register(c.Request.Context(), toRegisterInput(in))
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	h.writeAuthResult(c, http.StatusCreated, auth)
@@ -36,9 +37,9 @@ func (h *Handler) login(c *gin.Context) {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	auth, err := h.svc.Login(c.Request.Context(), in)
+	auth, err := h.svc.Login(c.Request.Context(), toLoginInput(in))
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	h.writeAuthResult(c, http.StatusOK, auth)
@@ -51,13 +52,13 @@ func (h *Handler) refresh(c *gin.Context) {
 	}
 	raw, err := c.Cookie(refreshCookieName)
 	if err != nil || raw == "" {
-		c.Error(errInvalidToken())
+		c.Error(toHTTPError(domain.Rule("AUTH_INVALID_TOKEN", "invalid or expired token", domain.ErrInvalidToken)))
 		return
 	}
 	auth, err := h.svc.Refresh(c.Request.Context(), raw)
 	if err != nil {
 		h.clearRefreshCookie(c)
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	h.setRefreshCookie(c, auth.RefreshToken)

package/templates/add/auth/internal/app/user/{handler_mfa.go.hbs → adapters/inbound/http/handler_mfa.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package httpadapter
 
 import (
 	"net/http"
@@ -22,7 +22,7 @@ func (h *Handler) verifyMFA(c *gin.Context) {
 	}
 	auth, err := h.svc.VerifyMFA(c.Request.Context(), in.Challenge, in.Code)
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	h.setRefreshCookie(c, auth.RefreshToken)
@@ -33,7 +33,7 @@ func (h *Handler) mfaStatus(c *gin.Context) {
 	setNoStoreHeaders(c)
 	status, err := h.svc.MFAStatus(c.Request.Context(), currentUserID(c))
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.JSON(http.StatusOK, mfaStatusResponse(status))
@@ -43,7 +43,7 @@ func (h *Handler) setupMFA(c *gin.Context) {
 	setNoStoreHeaders(c)
 	setup, err := h.svc.SetupMFA(c.Request.Context(), currentUserID(c))
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.JSON(http.StatusOK, mfaSetupResponse{Secret: setup.Secret, OTPAuthURI: setup.OTPAuthURI})
@@ -58,7 +58,7 @@ func (h *Handler) confirmMFA(c *gin.Context) {
 	}
 	codes, err := h.svc.ConfirmMFA(c.Request.Context(), currentUserID(c), in.Code)
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.JSON(http.StatusOK, mfaConfirmResponse{RecoveryCodes: codes})
@@ -72,7 +72,7 @@ func (h *Handler) disableMFA(c *gin.Context) {
 		return
 	}
 	if err := h.svc.DisableMFA(c.Request.Context(), currentUserID(c), in.Code); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.Status(http.StatusNoContent)

package/templates/add/auth/internal/app/user/{handler_oauth.go.hbs → adapters/inbound/http/handler_oauth.go.hbs}

@@ -1,22 +1,22 @@
-package user
+package httpadapter
 
 import (
 	"errors"
 	"log/slog"
 	"net/http"
 
-	"{{goModule}}/internal/app/user/application"
+	userapp "{{goModule}}/internal/app/user/application"
 	"{{goModule}}/internal/shared/apperror"
 
 	"github.com/gin-gonic/gin"
 )
 
 func (h *Handler) providerLogin(c *gin.Context) {
-	start, err := h.svc.BeginLogin(c.Request.Context(), c.Param("provider"), application.LoginStartInput{
+	start, err := h.svc.BeginLogin(c.Request.Context(), c.Param("provider"), toLoginStartInput(loginStartInput{
 		State:               c.Query("state"),
 		CodeChallenge:       c.Query("code_challenge"),
 		CodeChallengeMethod: c.Query("code_challenge_method"),
-	})
+	}))
 	if err != nil {
 		c.Error(h.oauthAppError(c.Param("provider"), err))
 		return
@@ -31,10 +31,10 @@ func (h *Handler) providerExchange(c *gin.Context) {
 	}
 	var in loginExchangeInput
 	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(h.oauthAppError(c.Param("provider"), application.NewOAuthError(application.OAuthFailed, err)))
+		c.Error(h.oauthAppError(c.Param("provider"), userapp.NewOAuthError(userapp.OAuthFailed, err)))
 		return
 	}
-	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), in)
+	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), toLoginExchangeInput(in))
 	if err != nil {
 		c.Error(h.oauthAppError(c.Param("provider"), err))
 		return
@@ -43,26 +43,26 @@ func (h *Handler) providerExchange(c *gin.Context) {
 }
 
 func (h *Handler) oauthAppError(provider string, err error) *apperror.AppError {
-	code := application.OAuthFailed
+	code := userapp.OAuthFailed
 	status := http.StatusBadRequest
 	message := "external login failed"
-	var oauthErr *application.OAuthError
+	var oauthErr *userapp.OAuthError
 	if errors.As(err, &oauthErr) {
 		switch oauthErr.Code {
-		case application.OAuthDenied:
-			code = application.OAuthDenied
+		case userapp.OAuthDenied:
+			code = userapp.OAuthDenied
 			message = "external login was denied"
-		case application.OAuthStateInvalid:
-			code = application.OAuthStateInvalid
+		case userapp.OAuthStateInvalid:
+			code = userapp.OAuthStateInvalid
 			message = "oauth state or PKCE verifier is invalid"
-		case application.OAuthProviderUnavailable:
-			code = application.OAuthProviderUnavailable
+		case userapp.OAuthProviderUnavailable:
+			code = userapp.OAuthProviderUnavailable
 			status = http.StatusServiceUnavailable
 			message = "external login provider is unavailable"
-		case application.OAuthFailed:
-			code = application.OAuthFailed
+		case userapp.OAuthFailed:
+			code = userapp.OAuthFailed
 		default:
-			code = application.OAuthFailed
+			code = userapp.OAuthFailed
 		}
 	}
 	slog.Warn("oauth request failed", "provider", provider, "code", code, "error", err)

package/templates/add/auth/internal/app/user/{handler_recovery.go.hbs → adapters/inbound/http/handler_recovery.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package httpadapter
 
 import (
 	"net/http"
@@ -15,7 +15,7 @@ func (h *Handler) forgotPassword(c *gin.Context) {
 		return
 	}
 	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	// Always the same response, whether or not the email exists.
@@ -29,7 +29,7 @@ func (h *Handler) resetPassword(c *gin.Context) {
 		return
 	}
 	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.Status(http.StatusNoContent)
@@ -42,7 +42,7 @@ func (h *Handler) verifyEmail(c *gin.Context) {
 		return
 	}
 	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.Status(http.StatusNoContent)

package/templates/add/auth/internal/app/user/{handler_test.go.hbs → adapters/inbound/http/handler_test.go.hbs}

@@ -1,7 +1,9 @@
-package user
+package httpadapter
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/base64"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -27,38 +29,60 @@ func (allowAllAuthorizer) Require(_ string) gin.HandlerFunc {
 
 const handlerOAuthVerifier = "client-code-verifier-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 
-func newOAuthTestRouter(t *testing.T) (*gin.Engine, *fakeLoginProvider) {
-	t.Helper()
-	provider := &fakeLoginProvider{name: "fake"}
-	provider.beginFn = func(in application.LoginStartInput) (application.Authorization, error) {
-		return application.Authorization{URL: "https://provider.example.test/authorize?" + url.Values{
-			"state":                 {in.State},
-			"code_challenge":        {in.CodeChallenge},
-			"code_challenge_method": {in.CodeChallengeMethod},
-		}.Encode()}, nil
+type stubService struct {
+	application.ServicePort
+}
+
+func (stubService) BeginLogin(_ context.Context, provider string, in application.LoginStartInput) (*application.Authorization, error) {
+	if provider != "fake" {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, nil)
 	}
-	provider.completeFn = func(application.LoginCompleteInput) (application.ExternalIdentity, error) {
-		return application.ExternalIdentity{Provider: "fake", Subject: "subject", Email: "user@example.com", EmailVerified: true, Name: "User"}, nil
+	return &application.Authorization{URL: "https://provider.example.test/authorize?" + url.Values{
+		"state":                 {in.State},
+		"code_challenge":        {in.CodeChallenge},
+		"code_challenge_method": {in.CodeChallengeMethod},
+	}.Encode()}, nil
+}
+
+func (stubService) ExchangeLogin(_ context.Context, provider string, in application.LoginExchangeInput) (*application.AuthResult, error) {
+	if provider != "fake" {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, nil)
 	}
-	svc := newTestServiceWithProviders(&fakeRepo{}, newFakeTokenStore(), provider)
+	if in.State == "" || in.CodeVerifier == "" {
+		return nil, application.NewOAuthError(application.OAuthStateInvalid, nil)
+	}
+	if in.Code == "" {
+		return nil, application.NewOAuthError(application.OAuthFailed, nil)
+	}
+	return application.TokenResult(&application.AuthResponse{
+		AccessToken:  "access-token",
+		RefreshToken: "refresh-token",
+		TokenType:    "Bearer",
+		ExpiresIn:    900,
+	}), nil
+}
+
+func (stubService) Logout(context.Context, string) error { return nil }
+
+func pkceChallenge(verifier string) string {
+	sum := sha256.Sum256([]byte(verifier))
+	return base64.RawURLEncoding.EncodeToString(sum[:])
+}
+
+func newOAuthTestRouter(t *testing.T) *gin.Engine {
+	t.Helper()
+	svc := stubService{}
 	h := NewHandler(svc, "test-secret", time.Hour, true, "strict", allowAllLimiter{}, allowAllAuthorizer{})
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
 	router.Use(middleware.Error(false))
 	h.Register(router)
-	return router, provider
+	return router
 }
 
 func newCrossSiteTestRouter(t *testing.T) *gin.Engine {
 	t.Helper()
-	provider := &fakeLoginProvider{name: "fake"}
-	provider.beginFn = func(in application.LoginStartInput) (application.Authorization, error) {
-		return application.Authorization{URL: "https://provider.example.test/authorize?state=" + url.QueryEscape(in.State)}, nil
-	}
-	provider.completeFn = func(application.LoginCompleteInput) (application.ExternalIdentity, error) {
-		return application.ExternalIdentity{Provider: "fake", Subject: "subject", Email: "user@example.com", EmailVerified: true}, nil
-	}
-	svc := newTestServiceWithProviders(&fakeRepo{}, newFakeTokenStore(), provider)
+	svc := stubService{}
 	h := NewHandlerWithOrigins(svc, "test-secret", time.Hour, true, "none", []string{"https://app.example.test"}, allowAllLimiter{}, allowAllAuthorizer{})
 	router := gin.New()
 	router.Use(middleware.Error(false))
@@ -94,10 +118,10 @@ func beginOAuthFlow(t *testing.T, router *gin.Engine) (string, string) {
 }
 
 func TestHandler_ProviderExchangeReturnsJSONAndSetsRefreshCookie(t *testing.T) {
-	router, _ := newOAuthTestRouter(t)
+	router := newOAuthTestRouter(t)
 	state, verifier := beginOAuthFlow(t, router)
 	request := httptest.NewRequest(http.MethodPost, "/auth/fake/exchange", strings.NewReader(
-		"{\"code\":\"code\",\"state\":\"" + state + "\",\"code_verifier\":\"" + verifier + "\"}",
+		"{\"code\":\"code\",\"state\":\""+state+"\",\"code_verifier\":\""+verifier+"\"}",
 	))
 	request.Header.Set("Content-Type", "application/json")
 	response := httptest.NewRecorder()
@@ -128,16 +152,13 @@ func TestHandler_ProviderExchangeReturnsJSONAndSetsRefreshCookie(t *testing.T) {
 }
 
 func TestHandler_ProviderCallbackIsFrontendOwnedAndErrorsDoNotRedirect(t *testing.T) {
-	router, provider := newOAuthTestRouter(t)
+	router := newOAuthTestRouter(t)
 	callback := httptest.NewRequest(http.MethodGet, "/auth/fake/callback?error=access_denied&error_description=do-not-leak", nil)
 	callbackResponse := httptest.NewRecorder()
 	router.ServeHTTP(callbackResponse, callback)
 	if callbackResponse.Code != http.StatusNotFound {
 		t.Fatalf("API callback status = %d, want 404 for frontend-owned callback", callbackResponse.Code)
 	}
-	if provider.completeCnt != 0 {
-		t.Fatal("provider must not exchange a frontend callback error")
-	}
 
 	invalid := httptest.NewRequest(http.MethodPost, "/auth/fake/exchange?return_to=https%3A%2F%2Fevil.example", strings.NewReader(
 		"{\"code\":\"code\",\"state\":\"\",\"code_verifier\":\""+handlerOAuthVerifier+"\",\"error_description\":\"do-not-leak\"}",
@@ -154,7 +175,7 @@ func TestHandler_ProviderCallbackIsFrontendOwnedAndErrorsDoNotRedirect(t *testin
 }
 
 func TestHandler_ProviderLoginAndExchangeUnconfiguredProviderUseControlledJSON(t *testing.T) {
-	router, _ := newOAuthTestRouter(t)
+	router := newOAuthTestRouter(t)
 	login := httptest.NewRequest(http.MethodGet, "/auth/google/login?"+url.Values{
 		"state":                 {"client-state"},
 		"code_challenge":        {"client-code-challenge"},
@@ -184,7 +205,7 @@ func TestHandler_ProviderLoginAndExchangeUnconfiguredProviderUseControlledJSON(t
 }
 
 func TestHandler_ProviderExchangeRejectsMissingStatePKCEAndCode(t *testing.T) {
-	router, _ := newOAuthTestRouter(t)
+	router := newOAuthTestRouter(t)
 	tests := []struct {
 		name string
 		body string
@@ -231,7 +252,7 @@ func TestHandler_ValidateBrowserCookiePolicy(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := validateBrowserCookiePolicy(tt.topology, tt.sameSite, tt.secure, tt.production)
+			err := ValidateBrowserCookiePolicy(tt.topology, tt.sameSite, tt.secure, tt.production)
 			if (err != nil) != tt.wantErr {
 				t.Fatalf("validateBrowserCookiePolicy() error = %v, wantErr %v", err, tt.wantErr)
 			}

package/templates/add/auth/internal/app/user/{handler_user.go.hbs → adapters/inbound/http/handler_user.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package httpadapter
 
 import (
 	"net/http"
@@ -12,7 +12,7 @@ import (
 func (h *Handler) resendVerification(c *gin.Context) {
 	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
 	if err := h.svc.ResendVerificationEmail(c.Request.Context(), userID); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.Status(http.StatusNoContent)
@@ -23,7 +23,7 @@ func (h *Handler) resendVerification(c *gin.Context) {
 func (h *Handler) logoutAll(c *gin.Context) {
 	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
 	if err := h.svc.LogoutAll(c.Request.Context(), userID); err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	h.clearRefreshCookie(c)
@@ -34,7 +34,7 @@ func (h *Handler) me(c *gin.Context) {
 	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
 	u, err := h.svc.Get(c.Request.Context(), userID)
 	if err != nil {
-		c.Error(err)
+		c.Error(toHTTPError(err))
 		return
 	}
 	c.JSON(http.StatusOK, toMeResponse(u))

package/templates/add/auth/internal/app/user/{session_cookie.go.hbs → adapters/inbound/http/session_cookie.go.hbs}

@@ -1,8 +1,10 @@
-package user
+package httpadapter
 
 import (
 	"net/http"
 
+	"{{goModule}}/internal/app/user/application"
+
 	"github.com/gin-gonic/gin"
 )
 
@@ -23,11 +25,11 @@ func setNoStoreHeaders(c *gin.Context) {
 	c.Header("Pragma", "no-cache")
 }
 
-func (h *Handler) writeAuthResult(c *gin.Context, status int, result *authResult) {
+func (h *Handler) writeAuthResult(c *gin.Context, status int, result *application.AuthResult) {
 	if result.MFAChallenge != "" {
 		c.JSON(http.StatusOK, mfaChallengeResponse{MFARequired: true, Challenge: result.MFAChallenge})
 		return
 	}
 	h.setRefreshCookie(c, result.RefreshToken)
-	c.JSON(status, toCookieResponse(result.authResponse))
+	c.JSON(status, toCookieResponse(result.AuthResponse))
 }

package/templates/add/auth/internal/app/user/adapters/outbound/password/bcrypt.go.hbs

@@ -0,0 +1,35 @@
+package password
+
+import (
+	userports "{{goModule}}/internal/app/user/ports"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// BCryptHasher is the production password adapter. Keeping bcrypt here means
+// register, login, reset, and seed all share one algorithm boundary.
+type BCryptHasher struct {
+	cost int
+}
+
+func NewBCryptHasher() *BCryptHasher {
+	return &BCryptHasher{cost: bcrypt.DefaultCost}
+}
+
+func (h *BCryptHasher) Hash(password string) (string, error) {
+	cost := h.cost
+	if cost <= 0 {
+		cost = bcrypt.DefaultCost
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), cost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+func (*BCryptHasher) Compare(hash, password string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+}
+
+var _ userports.PasswordHasher = (*BCryptHasher)(nil)

package/templates/add/auth/internal/app/user/adapters/outbound/password/bcrypt_test.go.hbs

@@ -0,0 +1,20 @@
+package password
+
+import "testing"
+
+func TestBCryptHasherRoundTrip(t *testing.T) {
+	hasher := NewBCryptHasher()
+	hash, err := hasher.Hash("correct horse battery staple")
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	if hash == "" {
+		t.Fatal("expected a password hash")
+	}
+	if err := hasher.Compare(hash, "correct horse battery staple"); err != nil {
+		t.Fatalf("compare matching password: %v", err)
+	}
+	if err := hasher.Compare(hash, "wrong password"); err == nil {
+		t.Fatal("expected a mismatched password to be rejected")
+	}
+}