@nakedev/go-scaffold 0.4.3 → 0.5.1

package/templates/add/auth/internal/app/user/application/errors.go.hbs

@@ -0,0 +1,62 @@
+package application
+
+import (
+	"fmt"
+
+	"{{goModule}}/internal/app/user/domain"
+)
+
+// Use-case errors carry a stable business code and a domain sentinel. The
+// inbound adapter decides how those errors map to HTTP; application code does
+// not know status codes or response envelopes.
+func errNotFound() error {
+	return domain.Rule("USER_NOT_FOUND", "user not found", domain.ErrNotFound)
+}
+
+func errEmailTaken() error {
+	return domain.Rule("USER_EMAIL_TAKEN", "email already registered", domain.ErrEmailTaken)
+}
+
+func errTooManyAttempts() error {
+	return domain.Rule("AUTH_TOO_MANY_ATTEMPTS", "too many failed attempts - try again later", domain.ErrTooManyAttempts)
+}
+
+func errInvalidCredentials() error {
+	return domain.Rule("AUTH_INVALID_CREDENTIALS", "invalid email or password", domain.ErrInvalidCredential)
+}
+
+func errInvalidToken() error {
+	return domain.Rule("AUTH_INVALID_TOKEN", "invalid or expired token", domain.ErrInvalidToken)
+}
+
+func errAlreadyVerified() error {
+	return domain.Rule("AUTH_ALREADY_VERIFIED", "email is already verified", domain.ErrAlreadyVerified)
+}
+
+func errMFAUnavailable() error {
+	return domain.Rule("AUTH_MFA_UNAVAILABLE", "multi-factor authentication is not enabled", domain.ErrMFAUnavailable)
+}
+
+func errMFAInvalid() error {
+	return domain.Rule("AUTH_MFA_INVALID", "invalid or expired multi-factor authentication code", domain.ErrMFAInvalid)
+}
+
+func errMFAAlreadyEnabled() error {
+	return domain.Rule("AUTH_MFA_ALREADY_ENABLED", "multi-factor authentication is already enabled", domain.ErrMFAAlreadyEnabled)
+}
+
+func errMFANotEnrolled() error {
+	return domain.Rule("AUTH_MFA_NOT_ENROLLED", "multi-factor authentication is not enabled for this user", domain.ErrMFANotEnrolled)
+}
+
+func errMFASetupRequired() error {
+	return domain.Rule("AUTH_MFA_SETUP_REQUIRED", "complete multi-factor authentication setup first", domain.ErrMFASetupRequired)
+}
+
+func errMFAConfig() error {
+	return fmt.Errorf("multi-factor authentication encryption key is invalid")
+}
+
+func errUnknownRole() error {
+	return domain.Rule("USER_UNKNOWN_ROLE", "unknown role code", domain.ErrUnknownRole)
+}

package/templates/add/auth/internal/app/user/{external_login.go.hbs → application/external_login.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package application
 
 import (
 	"context"
@@ -10,31 +10,27 @@ import (
 	"strings"
 	"time"
 
-	"{{goModule}}/internal/app/user/application"
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/app/user/domain"
 	"{{goModule}}/internal/shared/id"
-
-	"gorm.io/gorm"
 )
 
 // BeginLogin accepts the browser client's state and S256 PKCE challenge and
 // asks the registered provider adapter to construct its authorization URL.
 // The server persists a hashed state transaction binding provider, challenge,
 // and OIDC nonce before the callback reaches ExchangeLogin.
-func (s *Service) BeginLogin(ctx context.Context, providerName string, in application.LoginStartInput) (*application.Authorization, error) {
+func (s *Service) BeginLogin(ctx context.Context, providerName string, in LoginStartInput) (*Authorization, error) {
 	provider, ok := s.providers.Lookup(providerName)
 	if !ok {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
 	}
 	// OAuth values are opaque: validate their wire-safe shape without trimming
 	// or rewriting what the frontend and provider saw.
 	if !validOAuthValue(in.State) || !validPKCEChallenge(in.CodeChallenge) || in.CodeChallengeMethod != "S256" {
-		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("state and S256 code challenge are required"))
+		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("state and S256 code challenge are required"))
 	}
 	nonce, err := randomToken()
 	if err != nil {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("create oauth transaction: %w", err))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("create oauth transaction: %w", err))
 	}
 	in.Nonce = nonce
 	authorization, err := provider.Begin(ctx, in)
@@ -42,59 +38,53 @@ func (s *Service) BeginLogin(ctx context.Context, providerName string, in applic
 		return nil, mapProviderError(err)
 	}
 	if strings.TrimSpace(authorization.URL) == "" {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider returned an empty authorization URL"))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider returned an empty authorization URL"))
 	}
 	clock := s.now
 	if clock == nil {
 		clock = time.Now
 	}
-	if err := s.oauthTransactions.SetLoginTransaction(ctx, hashToken(in.State), loginTransaction{
+	if err := s.oauthTransactions.SetLoginTransaction(ctx, hashToken(in.State), LoginTransaction{
 		Provider:      providerName,
 		CodeChallenge: in.CodeChallenge,
 		Nonce:         nonce,
 		ExpiresAt:     clock().Add(s.config.OAuthStateTTL),
 	}); err != nil {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("store oauth transaction: %w", err))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("store oauth transaction: %w", err))
 	}
 	return &authorization, nil
 }
 
-type loginExchangeInput struct {
-	Code         string `json:"code"`
-	State        string `json:"state"`
-	CodeVerifier string `json:"code_verifier"`
-}
-
-func (s *Service) ExchangeLogin(ctx context.Context, providerName string, in loginExchangeInput) (*authResult, error) {
+func (s *Service) ExchangeLogin(ctx context.Context, providerName string, in LoginExchangeInput) (*AuthResult, error) {
 	provider, ok := s.providers.Lookup(providerName)
 	if !ok {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
 	}
 	if !validOAuthValue(in.State) || !validPKCEValue(in.CodeVerifier) {
-		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("state and code verifier are required"))
+		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("state and code verifier are required"))
 	}
 	if !validOAuthValue(in.Code) {
-		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("authorization code is missing"))
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("authorization code is missing"))
 	}
 
 	transaction, ok, err := s.oauthTransactions.ConsumeLoginTransaction(ctx, hashToken(in.State))
 	if err != nil {
-		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("consume oauth transaction: %w", err))
+		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("consume oauth transaction: %w", err))
 	}
 	if !ok || transaction.Provider != providerName || !validPKCEVerifier(in.CodeVerifier, transaction.CodeChallenge) {
-		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("oauth state or PKCE verifier is invalid"))
+		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("oauth state or PKCE verifier is invalid"))
 	}
 
-	identity, err := provider.Complete(ctx, application.LoginCompleteInput{Code: in.Code, CodeVerifier: in.CodeVerifier, Nonce: transaction.Nonce})
+	identity, err := provider.Complete(ctx, LoginCompleteInput{Code: in.Code, CodeVerifier: in.CodeVerifier, Nonce: transaction.Nonce})
 	if err != nil {
 		return nil, mapProviderError(err)
 	}
 	if identity.Provider != providerName {
-		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("provider identity name does not match the requested provider"))
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("provider identity name does not match the requested provider"))
 	}
 	u, err := s.findOrCreateExternalUser(ctx, identity)
 	if err != nil {
-		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("resolve external identity: %w", err))
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("resolve external identity: %w", err))
 	}
 	return s.completeLogin(ctx, u)
 }
@@ -150,20 +140,20 @@ func pkceChallenge(verifier string) string {
 }
 
 func mapProviderError(err error) error {
-	var oauthErr *application.OAuthError
+	var oauthErr *OAuthError
 	if errors.As(err, &oauthErr) {
 		return oauthErr
 	}
-	if application.IsProviderUnavailable(err) {
-		return application.NewOAuthError(application.OAuthProviderUnavailable, err)
+	if IsProviderUnavailable(err) {
+		return NewOAuthError(OAuthProviderUnavailable, err)
 	}
-	return application.NewOAuthError(application.OAuthFailed, err)
+	return NewOAuthError(OAuthFailed, err)
 }
 
 // findOrCreateExternalUser is provider-neutral identity resolution. A stable
 // provider subject wins; only a verified external email may link to an
 // existing account.
-func (s *Service) findOrCreateExternalUser(ctx context.Context, info application.ExternalIdentity) (*model.User, error) {
+func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIdentity) (*domain.User, error) {
 	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
 		return nil, fmt.Errorf("external identity is missing provider, subject, or email")
 	}
@@ -171,14 +161,14 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info application
 		return nil, fmt.Errorf("external identity provider name is too long")
 	}
 
-	provider := model.Provider(info.Provider)
+	provider := domain.Provider(info.Provider)
 	if ident, err := s.repo.FindIdentityByProviderUID(ctx, provider, info.Subject); err == nil {
 		user, findErr := s.repo.FindByID(ctx, ident.UserID)
 		if findErr != nil {
 			return nil, fmt.Errorf("find user for existing identity: %w", findErr)
 		}
 		return user, nil
-	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+	} else if !errors.Is(err, domain.ErrNotFound) {
 		return nil, fmt.Errorf("find external identity: %w", err)
 	}
 
@@ -186,20 +176,20 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info application
 	email := normalizeEmail(info.Email)
 	if info.EmailVerified {
 		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-			ident := &model.Identity{ID: id.New(), UserID: u.ID, Provider: provider, ProviderUID: &providerUID}
+			ident := &domain.Identity{ID: id.New(), UserID: u.ID, Provider: provider, ProviderUID: &providerUID}
 			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
 				return nil, fmt.Errorf("link external identity: %w", err)
 			}
 			return u, nil
-		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		} else if !errors.Is(err, domain.ErrNotFound) {
 			return nil, fmt.Errorf("find user by verified external email: %w", err)
 		}
 	}
 
-	u := &model.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.AvatarURL, EmailVerified: info.EmailVerified}
-	ident := &model.Identity{ID: id.New(), Provider: provider, ProviderUID: &providerUID}
+	u := &domain.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.AvatarURL, EmailVerified: info.EmailVerified, Role: domain.DefaultRole}
+	ident := &domain.Identity{ID: id.New(), Provider: provider, ProviderUID: &providerUID}
 	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
-		if dberr.IsDuplicate(err) {
+		if errors.Is(err, domain.ErrConflict) {
 			return nil, errEmailTaken()
 		}
 		return nil, fmt.Errorf("create external user: %w", err)

package/templates/add/auth/internal/app/user/{jwt.go.hbs → application/jwt.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package application
 
 import (
 	"crypto/rand"
@@ -16,18 +16,21 @@ const (
 // accessClaims — see internal/shared/middleware/auth.go for why this struct
 // is duplicated there instead of imported.
 type accessClaims struct {
-	Typ string `json:"typ"`
+	Typ  string `json:"typ"`
+	Role string `json:"role,omitempty"`
 	// go-scaffold:jwt-claims
 	jwt.RegisteredClaims
 }
 
 func (s *Service) issueAccessToken(
 	userID uuid.UUID,
+	role string,
 	// go-scaffold:issue-access-token-params
 ) (string, error) {
 	now := s.clock()
 	claims := accessClaims{
-		Typ: tokenTypeAccess,
+		Typ:  tokenTypeAccess,
+		Role: role,
 		// go-scaffold:jwt-claims-values
 		RegisteredClaims: jwt.RegisteredClaims{
 			Subject:   userID.String(),

package/templates/add/auth/internal/app/user/{local_auth.go.hbs → application/local_auth.go.hbs}

@@ -1,16 +1,14 @@
-package user
+package application
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log/slog"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
-	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/app/user/domain"
 	"{{goModule}}/internal/shared/id"
-
-	"golang.org/x/crypto/bcrypt"
 )
 
 // Failed-attempt policy. These values are security posture rather than
@@ -36,23 +34,23 @@ func (s *Service) throttled(ctx context.Context, key string) bool {
 		slog.Error("read login throttle", "error", err)
 		return false
 	}
-	return !until.IsZero() && time.Now().Before(until)
+	return !until.IsZero() && s.clock().Before(until)
 }
 
-func (s *Service) Register(ctx context.Context, in registerInput) (*authResult, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)
+func (s *Service) Register(ctx context.Context, in RegisterInput) (*AuthResult, error) {
+	hash, err := s.passwords.Hash(in.Password)
 	if err != nil {
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("hash password: %w", err)
 	}
 	hashStr := string(hash)
 
-	u := &model.User{ID: id.New(), Email: normalizeEmail(in.Email), Name: in.Name}
-	i := &model.Identity{ID: id.New(), Provider: model.ProviderLocal, PasswordHash: &hashStr}
+	u := &domain.User{ID: id.New(), Email: normalizeEmail(in.Email), Name: in.Name, Role: domain.DefaultRole}
+	i := &domain.Identity{ID: id.New(), Provider: domain.ProviderLocal, PasswordHash: &hashStr}
 	if err := s.repo.CreateUserWithIdentity(ctx, u, i); err != nil {
-		if dberr.IsDuplicate(err) {
+		if errors.Is(err, domain.ErrConflict) {
 			return nil, errEmailTaken()
 		}
-		return nil, apperror.NewInternal(err)
+		return nil, fmt.Errorf("create user: %w", err)
 	}
 	// Best-effort: a mail failure should not block registration. The user can
 	// request another link through ResendVerificationEmail.
@@ -61,10 +59,10 @@ func (s *Service) Register(ctx context.Context, in registerInput) (*authResult,
 	if err != nil {
 		return nil, err
 	}
-	return tokenResult(auth), nil
+	return TokenResult(auth), nil
 }
 
-func (s *Service) Login(ctx context.Context, in loginInput) (*authResult, error) {
+func (s *Service) Login(ctx context.Context, in LoginInput) (*AuthResult, error) {
 	key := throttleKey("login", in.Email)
 	if s.throttled(ctx, key) {
 		return nil, errTooManyAttempts()
@@ -72,7 +70,7 @@ func (s *Service) Login(ctx context.Context, in loginInput) (*authResult, error)
 
 	// Every failure records the same key and returns the same error whether or
 	// not the account exists, preventing account enumeration through the counter.
-	fail := func() (*authResult, error) {
+	fail := func() (*AuthResult, error) {
 		if err := s.repo.RecordLoginFailure(ctx, key, loginFreeAttempts, loginMaxLock); err != nil {
 			slog.Error("record login failure", "error", err)
 		}
@@ -83,11 +81,11 @@ func (s *Service) Login(ctx context.Context, in loginInput) (*authResult, error)
 	if err != nil {
 		return fail()
 	}
-	ident, err := s.repo.FindIdentity(ctx, u.ID, model.ProviderLocal)
+	ident, err := s.repo.FindIdentity(ctx, u.ID, domain.ProviderLocal)
 	if err != nil || ident.PasswordHash == nil {
 		return fail()
 	}
-	if err := bcrypt.CompareHashAndPassword([]byte(*ident.PasswordHash), []byte(in.Password)); err != nil {
+	if err := s.passwords.Compare(*ident.PasswordHash, in.Password); err != nil {
 		return fail()
 	}
 

package/templates/add/auth/internal/app/user/{mfa_service.go.hbs → application/mfa_service.go.hbs}

@@ -1,4 +1,4 @@
-package user
+package application
 
 import (
 	"context"
@@ -18,8 +18,7 @@ import (
 	"strings"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
 )
@@ -87,41 +86,41 @@ func ValidateMFASettings(settings MFASettings) error {
 	return nil
 }
 
-func (s *Service) completeLogin(ctx context.Context, u *model.User) (*authResult, error) {
+func (s *Service) completeLogin(ctx context.Context, u *domain.User) (*AuthResult, error) {
 	settings := s.mfaSettings()
 	if !settings.Enabled {
 		auth, err := s.issueTokens(ctx, u)
 		if err != nil {
 			return nil, err
 		}
-		return tokenResult(auth), nil
+		return TokenResult(auth), nil
 	}
 	if s.mfa == nil {
-		return nil, apperror.NewInternal(errors.New("MFA is enabled but no MFA store was configured"))
+		return nil, errors.New("MFA is enabled but no MFA store was configured")
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, u.ID)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return nil, fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	if !found || !enrollment.Enabled {
 		auth, err := s.issueTokens(ctx, u)
 		if err != nil {
 			return nil, err
 		}
-		return tokenResult(auth), nil
+		return TokenResult(auth), nil
 	}
 
 	rawChallenge, err := randomToken()
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("create MFA challenge: %w", err))
+		return nil, fmt.Errorf("create MFA challenge: %w", err)
 	}
 	if err := s.mfa.CreateChallenge(ctx, hashToken(rawChallenge), MFAChallenge{
 		UserID:    u.ID,
 		ExpiresAt: s.clock().Add(settings.ChallengeTTL),
 	}); err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("store MFA challenge: %w", err))
+		return nil, fmt.Errorf("store MFA challenge: %w", err)
 	}
-	return challengeResult(rawChallenge), nil
+	return ChallengeResult(rawChallenge), nil
 }
 
 func (s *Service) MFAStatus(ctx context.Context, userID uuid.UUID) (MFAStatus, error) {
@@ -131,7 +130,7 @@ func (s *Service) MFAStatus(ctx context.Context, userID uuid.UUID) (MFAStatus, e
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, userID)
 	if err != nil {
-		return MFAStatus{}, apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return MFAStatus{}, fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	return MFAStatus{Available: true, Enabled: found && enrollment.Enabled}, nil
 }
@@ -142,11 +141,11 @@ func (s *Service) SetupMFA(ctx context.Context, userID uuid.UUID) (*MFASetup, er
 		return nil, err
 	}
 	if s.mfa == nil {
-		return nil, apperror.NewInternal(errors.New("MFA store is not configured"))
+		return nil, errors.New("MFA store is not configured")
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, userID)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return nil, fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	if found && enrollment.Enabled {
 		return nil, errMFAAlreadyEnabled()
@@ -157,14 +156,14 @@ func (s *Service) SetupMFA(ctx context.Context, userID uuid.UUID) (*MFASetup, er
 	}
 	secret, err := newTOTPSecret()
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("generate MFA secret: %w", err))
+		return nil, fmt.Errorf("generate MFA secret: %w", err)
 	}
 	encrypted, err := encryptMFASecret(settings.EncryptionKey, secret)
 	if err != nil {
 		return nil, errMFAConfig()
 	}
 	if err := s.mfa.PutPendingEnrollment(ctx, userID, encrypted); err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("store MFA enrollment: %w", err))
+		return nil, fmt.Errorf("store MFA enrollment: %w", err)
 	}
 	return &MFASetup{
 		Secret:     secret,
@@ -178,11 +177,11 @@ func (s *Service) ConfirmMFA(ctx context.Context, userID uuid.UUID, code string)
 		return nil, err
 	}
 	if s.mfa == nil {
-		return nil, apperror.NewInternal(errors.New("MFA store is not configured"))
+		return nil, errors.New("MFA store is not configured")
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, userID)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return nil, fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	if !found {
 		return nil, errMFASetupRequired()
@@ -200,10 +199,10 @@ func (s *Service) ConfirmMFA(ctx context.Context, userID uuid.UUID, code string)
 
 	codes, hashes, err := newRecoveryCodes(settings.RecoveryCodeCount)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("generate MFA recovery codes: %w", err))
+		return nil, fmt.Errorf("generate MFA recovery codes: %w", err)
 	}
 	if err := s.mfa.ConfirmEnrollment(ctx, userID, enrollment.EncryptedSecret, hashes); err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("confirm MFA enrollment: %w", err))
+		return nil, fmt.Errorf("confirm MFA enrollment: %w", err)
 	}
 	return codes, nil
 }
@@ -217,11 +216,11 @@ func (s *Service) DisableMFA(ctx context.Context, userID uuid.UUID, code string)
 		return err
 	}
 	if s.mfa == nil {
-		return apperror.NewInternal(errors.New("MFA store is not configured"))
+		return errors.New("MFA store is not configured")
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, userID)
 	if err != nil {
-		return apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	if !found || !enrollment.Enabled {
 		return errMFANotEnrolled()
@@ -234,7 +233,7 @@ func (s *Service) DisableMFA(ctx context.Context, userID uuid.UUID, code string)
 		return errMFAInvalid()
 	}
 	if err := s.mfa.Disable(ctx, userID); err != nil {
-		return apperror.NewInternal(fmt.Errorf("disable MFA: %w", err))
+		return fmt.Errorf("disable MFA: %w", err)
 	}
 	return nil
 }
@@ -242,24 +241,24 @@ func (s *Service) DisableMFA(ctx context.Context, userID uuid.UUID, code string)
 // VerifyMFA consumes the challenge before checking the code. This makes every
 // challenge single-use, including a failed attempt, and prevents an attacker
 // from turning a leaked challenge into an unlimited six-digit guessing oracle.
-func (s *Service) VerifyMFA(ctx context.Context, rawChallenge, code string) (*authResponse, error) {
+func (s *Service) VerifyMFA(ctx context.Context, rawChallenge, code string) (*AuthResponse, error) {
 	settings, err := s.requireMFA()
 	if err != nil {
 		return nil, err
 	}
 	if s.mfa == nil {
-		return nil, apperror.NewInternal(errors.New("MFA store is not configured"))
+		return nil, errors.New("MFA store is not configured")
 	}
 	challenge, found, err := s.mfa.ConsumeChallenge(ctx, hashToken(rawChallenge))
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("consume MFA challenge: %w", err))
+		return nil, fmt.Errorf("consume MFA challenge: %w", err)
 	}
 	if !found {
 		return nil, errMFAInvalid()
 	}
 	enrollment, found, err := s.mfa.GetEnrollment(ctx, challenge.UserID)
 	if err != nil {
-		return nil, apperror.NewInternal(fmt.Errorf("read MFA enrollment: %w", err))
+		return nil, fmt.Errorf("read MFA enrollment: %w", err)
 	}
 	if !found || !enrollment.Enabled {
 		return nil, errMFAInvalid()
@@ -275,7 +274,7 @@ func (s *Service) VerifyMFA(ctx context.Context, rawChallenge, code string) (*au
 		}
 		used, err := s.mfa.ConsumeRecoveryCode(ctx, challenge.UserID, recoveryHash)
 		if err != nil {
-			return nil, apperror.NewInternal(fmt.Errorf("consume MFA recovery code: %w", err))
+			return nil, fmt.Errorf("consume MFA recovery code: %w", err)
 		}
 		if !used {
 			return nil, errMFAInvalid()

package/templates/add/auth/internal/app/user/{mfa_service_test.go.hbs → application/mfa_service_test.go.hbs}

@@ -1,13 +1,13 @@
-package user
+package application
 
 import (
 	"context"
+	"errors"
 	"strings"
 	"testing"
 	"time"
 
-	"{{goModule}}/internal/app/user/model"
-	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/app/user/domain"
 
 	"github.com/google/uuid"
 )
@@ -18,7 +18,7 @@ func configuredMFATestService(t *testing.T) (*Service, *fakeMFAStore, uuid.UUID,
 	t.Helper()
 	userID := uuid.New()
 	mfa := newFakeMFAStore()
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "mfa@example.com"}}, newFakeTokenStore())
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "mfa@example.com"}}, newFakeTokenStore())
 	now := time.Now()
 	svc.mfa = mfa
 	svc.now = func() time.Time { return now }
@@ -46,7 +46,7 @@ func TestTOTPCodeMatchesRFC6238SHA1Vector(t *testing.T) {
 
 func TestMFADefaultIsDisabled(t *testing.T) {
 	userID := uuid.New()
-	svc := newTestService(&fakeRepo{user: &model.User{ID: userID, Email: "default@example.com"}}, newFakeTokenStore())
+	svc := newTestService(&fakeRepo{user: &domain.User{ID: userID, Email: "default@example.com"}}, newFakeTokenStore())
 
 	status, err := svc.MFAStatus(context.Background(), userID)
 	if err != nil {
@@ -147,8 +147,8 @@ func TestMFAChallengeIsRequiredAndOneUse(t *testing.T) {
 		t.Fatalf("confirm: %v", err)
 	}
 
-	result, err := svc.completeLogin(ctx, &model.User{ID: userID, Email: "mfa@example.com"})
-	if err != nil || result.MFAChallenge == "" || result.authResponse != nil {
+	result, err := svc.completeLogin(ctx, &domain.User{ID: userID, Email: "mfa@example.com"})
+	if err != nil || result.MFAChallenge == "" || result.AuthResponse != nil {
 		t.Fatalf("expected pre-session MFA challenge: %+v, %v", result, err)
 	}
 	auth, err := svc.VerifyMFA(ctx, result.MFAChallenge, code)
@@ -172,14 +172,14 @@ func TestMFARecoveryCodeIsOneUse(t *testing.T) {
 	if err != nil {
 		t.Fatalf("confirm: %v", err)
 	}
-	result, err := svc.completeLogin(ctx, &model.User{ID: userID, Email: "mfa@example.com"})
+	result, err := svc.completeLogin(ctx, &domain.User{ID: userID, Email: "mfa@example.com"})
 	if err != nil {
 		t.Fatalf("login challenge: %v", err)
 	}
 	if _, err := svc.VerifyMFA(ctx, result.MFAChallenge, recoveryCodes[0]); err != nil {
 		t.Fatalf("verify with recovery code: %v", err)
 	}
-	result, err = svc.completeLogin(ctx, &model.User{ID: userID, Email: "mfa@example.com"})
+	result, err = svc.completeLogin(ctx, &domain.User{ID: userID, Email: "mfa@example.com"})
 	if err != nil {
 		t.Fatalf("second login challenge: %v", err)
 	}
@@ -192,8 +192,9 @@ func codeOfMFAError(err error) string {
 	if err == nil {
 		return ""
 	}
-	if appErr, ok := err.(*apperror.AppError); ok {
-		return appErr.Code
+	var ruleErr *domain.RuleError
+	if errors.As(err, &ruleErr) {
+		return ruleErr.Code
 	}
 	return ""
 }

package/templates/add/auth/internal/app/user/application/oauth.go.hbs

@@ -74,10 +74,10 @@ func (r ProviderRegistry) Lookup(name string) (LoginProvider, bool) {
 type OAuthErrorCode string
 
 const (
-	OAuthDenied             OAuthErrorCode = "oauth_denied"
-	OAuthStateInvalid       OAuthErrorCode = "oauth_state_invalid"
+	OAuthDenied              OAuthErrorCode = "oauth_denied"
+	OAuthStateInvalid        OAuthErrorCode = "oauth_state_invalid"
 	OAuthProviderUnavailable OAuthErrorCode = "oauth_provider_unavailable"
-	OAuthFailed             OAuthErrorCode = "oauth_failed"
+	OAuthFailed              OAuthErrorCode = "oauth_failed"
 )
 
 // OAuthError is the public, controlled error contract for the browser login