@nakedev/go-scaffold 0.5.1 → 0.5.3

package/dist/commands/auth.js

@@ -34,8 +34,14 @@ const AUTH_OPENAPI_PATHS = [
     { urlPath: "/auth/{provider}/login", file: "./auth/provider-login.yaml" },
     { urlPath: "/auth/{provider}/exchange", file: "./auth/provider-exchange.yaml" },
     { urlPath: "/users/me", file: "./auth/users-me.yaml" },
+    { urlPath: "/users/me/identities", file: "./auth/users-me-identities.yaml" },
+    { urlPath: "/users/me/identities/{provider}/link", file: "./auth/users-me-identity-link.yaml" },
+    { urlPath: "/users/me/identities/{provider}/link/exchange", file: "./auth/users-me-identity-link-exchange.yaml" },
+    { urlPath: "/users/me/identities/{provider}", file: "./auth/users-me-identity.yaml" },
     { urlPath: "/users/me/resend-verification", file: "./auth/users-me-resend-verification.yaml" },
     { urlPath: "/users/me/logout-all", file: "./auth/users-me-logout-all.yaml" },
+    { urlPath: "/users/me/sessions", file: "./auth/users-me-sessions.yaml" },
+    { urlPath: "/users/me/sessions/{id}", file: "./auth/users-me-session.yaml" },
     { urlPath: "/users/me/mfa", file: "./auth/users-me-mfa.yaml" },
     { urlPath: "/users/me/mfa/setup", file: "./auth/users-me-mfa-setup.yaml" },
     { urlPath: "/users/me/mfa/confirm", file: "./auth/users-me-mfa-confirm.yaml" },
@@ -44,7 +50,8 @@ const AUTH_OPENAPI_PATHS = [
 ];
 // addAuth scaffolds email/password authentication: a users+identities model
 // pair, JWT access tokens, a selectable refresh token store with
-// rotation + reuse detection, and register/login/refresh/logout/me. No RBAC
+// rotation + reuse detection, register/login/refresh/logout/me, and
+// per-user session listing/revocation. No RBAC
 // (no roles/permissions) — that's a separate opt-in on top of this, since
 // most projects need "is this caller logged in" long before they need "can
 // this caller do X".
@@ -178,7 +185,9 @@ async function addAuth(store = "postgres", projectDir = process.cwd(), browserTo
     console.log("registered POST /auth/{register,login,refresh,logout,forgot-password,reset-password,verify-email}, " +
         "GET /auth/{provider}/login, POST /auth/{provider}/exchange, GET /users/me, and " +
         "POST /users/me/{resend-verification,logout-all,mfa/setup,mfa/confirm,mfa/disable}, " +
-        "GET /users/me/mfa, and POST /auth/mfa/verify in cmd/api/wiring.go" +
+        "GET /users/me/{identities,sessions,mfa}, POST /users/me/identities/{provider}/{link,link/exchange}, " +
+        "DELETE /users/me/identities/{provider}, DELETE /users/me/sessions/{id}, " +
+        "POST /auth/mfa/verify in cmd/api/wiring.go" +
         docsMessage);
     console.log(picocolors_1.default.dim("\nnext: go mod tidy, then apply the new migrations with `make migrate-up` before production\n" +
         "seed an admin: SEED_ADMIN_EMAIL=... SEED_ADMIN_PASSWORD=... make seed"));

package/dist/index.js

@@ -494,7 +494,7 @@ async function resolveQueueBackend(opts) {
 }
 add
     .command("auth")
-    .description("add email/password auth: JWT access tokens, refresh token rotation, register/login/refresh/logout/me (no prerequisites — without `add worker` the verification/reset mail is sent inline)")
+    .description("add email/password auth: JWT access tokens, refresh rotation, device-session listing/revocation, register/login/refresh/logout/me (no prerequisites — without `add worker` the verification/reset mail is sent inline)")
     .option("--store <store>", 'where tokens and rate-limit counters live: "postgres" (default, no extra service) or "redis" (exact across replicas)')
     .option("--browser-topology <topology>", "browser deployment topology for cookie/CORS policy: same-origin, same-site (different origin), or cross-site (requires HTTPS deployment)")
     .option("--defaults", "skip store, browser-topology, and confirmation prompts; use Postgres plus local same-site defaults")

package/dist/templates/auth-manifest.js

@@ -7,6 +7,7 @@ exports.authFiles = authFiles;
 // must create one canonical implementation tree.
 const SHARED = [
     { template: "add/auth/internal/shared/middleware/auth.go.hbs", output: "internal/shared/middleware/auth.go" },
+    { template: "add/auth/internal/shared/middleware/auth_test.go.hbs", output: "internal/shared/middleware/auth_test.go" },
     { template: "add/auth/internal/shared/middleware/ratelimit.go.hbs", output: "internal/shared/middleware/ratelimit.go" },
     { template: "add/auth/internal/app/user/domain/entity.go.hbs", output: "internal/app/user/domain/entity.go" },
     { template: "add/auth/internal/app/user/domain/errors.go.hbs", output: "internal/app/user/domain/errors.go" },
@@ -16,12 +17,14 @@ const SHARED = [
     { template: "add/auth/internal/app/user/application/dto.go.hbs", output: "internal/app/user/application/dto.go" },
     { template: "add/auth/internal/app/user/application/errors.go.hbs", output: "internal/app/user/application/errors.go" },
     { template: "add/auth/internal/app/user/application/external_login.go.hbs", output: "internal/app/user/application/external_login.go" },
+    { template: "add/auth/internal/app/user/application/identities.go.hbs", output: "internal/app/user/application/identities.go" },
     { template: "add/auth/internal/app/user/application/jwt.go.hbs", output: "internal/app/user/application/jwt.go" },
     { template: "add/auth/internal/app/user/application/local_auth.go.hbs", output: "internal/app/user/application/local_auth.go" },
     { template: "add/auth/internal/app/user/application/mfa_service.go.hbs", output: "internal/app/user/application/mfa_service.go" },
     { template: "add/auth/internal/app/user/application/mfa_service_test.go.hbs", output: "internal/app/user/application/mfa_service_test.go" },
     { template: "add/auth/internal/app/user/application/oauth.go.hbs", output: "internal/app/user/application/oauth.go" },
     { template: "add/auth/internal/app/user/application/provider_test.go.hbs", output: "internal/app/user/application/provider_test.go" },
+    { template: "add/auth/internal/app/user/application/identities_test.go.hbs", output: "internal/app/user/application/identities_test.go" },
     { template: "add/auth/internal/app/user/application/recovery.go.hbs", output: "internal/app/user/application/recovery.go" },
     { template: "add/auth/internal/app/user/application/recovery_service.go.hbs", output: "internal/app/user/application/recovery_service.go" },
     { template: "add/auth/internal/app/user/application/service.go.hbs", output: "internal/app/user/application/service.go" },
@@ -38,6 +41,7 @@ const SHARED = [
     { template: "add/auth/internal/app/user/adapters/inbound/http/handler_recovery.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_recovery.go" },
     { template: "add/auth/internal/app/user/adapters/inbound/http/handler_test.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_test.go" },
     { template: "add/auth/internal/app/user/adapters/inbound/http/handler_user.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_user.go" },
+    { template: "add/auth/internal/app/user/adapters/inbound/http/handler_identity.go.hbs", output: "internal/app/user/adapters/inbound/http/handler_identity.go" },
     { template: "add/auth/internal/app/user/adapters/inbound/http/session_cookie.go.hbs", output: "internal/app/user/adapters/inbound/http/session_cookie.go" },
     { template: "add/auth/internal/app/user/adapters/outbound/password/bcrypt.go.hbs", output: "internal/app/user/adapters/outbound/password/bcrypt.go" },
     { template: "add/auth/internal/app/user/adapters/outbound/password/bcrypt_test.go.hbs", output: "internal/app/user/adapters/outbound/password/bcrypt_test.go" },

package/dist/utils/rbac-patcher.js

@@ -61,7 +61,7 @@ function patchUserModelForRbac(userModelPath) {
 function patchMiddlewareAuthForRbac(middlewareAuthPath) {
     let content = fs_extra_1.default.readFileSync(middlewareAuthPath, "utf8");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:middleware-auth-keys", 'const RoleKey = "role"', 'RoleKey = "role"');
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:middleware-auth-claims", 'Role string `json:"role,omitempty"`', "Role string");
+    content = insertGoLineBeforeMarkerOnce(content, "// go-scaffold:middleware-auth-claims", 'Role string `json:"role,omitempty"`', /^\s*Role\s+string\s+`json:"role,omitempty"`/m);
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:middleware-auth-context", "c.Set(RoleKey, claims.Role)", "c.Set(RoleKey");
     fs_extra_1.default.writeFileSync(middlewareAuthPath, content);
 }
@@ -72,11 +72,19 @@ function patchMiddlewareAuthForRbac(middlewareAuthPath) {
 // specifically so a marker patch can extend either without reformatting.
 function patchUserJWTForRbac(jwtGoPath) {
     let content = fs_extra_1.default.readFileSync(jwtGoPath, "utf8");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:jwt-claims", 'Role string `json:"role,omitempty"`', "Role string");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:issue-access-token-params", "role string,", "role string,");
-    content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, "// go-scaffold:jwt-claims-values", "Role: role,", "Role: role,");
+    content = insertGoLineBeforeMarkerOnce(content, "// go-scaffold:jwt-claims", 'Role string `json:"role,omitempty"`', /^\s*Role\s+string\s+`json:"role,omitempty"`/m);
+    content = insertGoLineBeforeMarkerOnce(content, "// go-scaffold:issue-access-token-params", "role string,", /^\s*role\s+string\s*,/m);
+    content = insertGoLineBeforeMarkerOnce(content, "// go-scaffold:jwt-claims-values", "Role: role,", /^\s*Role\s*:\s*role\s*,/m);
     fs_extra_1.default.writeFileSync(jwtGoPath, content);
 }
+// Go fmt aligns struct fields and can turn a literal sentinel such as
+// `Role string` into `Role       string`. Match the Go line semantically so a
+// subsequent `add rbac` cannot append a duplicate field after formatting.
+function insertGoLineBeforeMarkerOnce(content, marker, block, line) {
+    if (line.test(content))
+        return content;
+    return (0, marker_patch_1.insertBeforeMarker)(content, marker, block);
+}
 // patchUserServiceForRbac verifies the auth application already exposes the
 // optional role capability. The canonical auth template owns this shared user
 // behavior; `add rbac` only supplies the role catalog and authorizer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nakedev/go-scaffold",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard",
   "repository": {
     "type": "git",

package/templates/add/auth/docs/schemas.yaml.hbs

@@ -114,3 +114,57 @@ MeResponse:
     email_verified: { type: boolean }
     # go-scaffold:me-response-fields
     created_at: { type: string, format: date-time }
+
+SessionResponse:
+  type: object
+  required: [id, user_agent, created_at, last_used_at, expires_at, current]
+  properties:
+    id: { type: string, format: uuid }
+    user_agent: { type: string, description: browser or client User-Agent captured at sign-in }
+    created_at: { type: string, format: date-time }
+    last_used_at: { type: string, format: date-time }
+    expires_at: { type: string, format: date-time }
+    current: { type: boolean, description: true when this session issued the current access token }
+
+SessionsResponse:
+  type: object
+  required: [sessions]
+  properties:
+    sessions:
+      type: array
+      items: { $ref: '#/SessionResponse' }
+
+IdentityResponse:
+  type: object
+  required: [id, provider, created_at]
+  properties:
+    id: { type: string, format: uuid }
+    provider: { type: string, example: google }
+    created_at: { type: string, format: date-time }
+
+IdentitiesResponse:
+  type: object
+  required: [identities]
+  properties:
+    identities:
+      type: array
+      items: { $ref: '#/IdentityResponse' }
+
+IdentityLinkStartInput:
+  type: object
+  required: [state, code_challenge, code_challenge_method]
+  additionalProperties: false
+  properties:
+    state: { type: string, minLength: 1 }
+    code_challenge:
+      type: string
+      minLength: 43
+      maxLength: 128
+      pattern: '^[A-Za-z0-9._~-]+$'
+    code_challenge_method: { type: string, enum: [S256] }
+
+IdentityLinkStartResponse:
+  type: object
+  required: [authorization_url]
+  properties:
+    authorization_url: { type: string, format: uri }

package/templates/add/auth/docs/users-me-identities.yaml.hbs

@@ -0,0 +1,13 @@
+get:
+  summary: List login identities for the current user
+  description: Returns safe provider metadata only; provider subjects and password hashes are never exposed.
+  operationId: listMyIdentities
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  responses:
+    "200":
+      description: linked login identities
+      content:
+        application/json:
+          schema: { $ref: './schemas.yaml#/IdentitiesResponse' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }

package/templates/add/auth/docs/users-me-identity-link-exchange.yaml.hbs

@@ -0,0 +1,26 @@
+post:
+  summary: Complete linking a provider identity to the current user
+  description: Consumes the one-time OAuth transaction and links the provider subject to the caller. It never creates or switches a session.
+  operationId: exchangeIdentityLink
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  parameters:
+    - name: provider
+      in: path
+      required: true
+      schema: { type: string, example: google }
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema: { $ref: './schemas.yaml#/OAuthExchangeInput' }
+  responses:
+    "200":
+      description: linked identity
+      content:
+        application/json:
+          schema: { $ref: './schemas.yaml#/IdentityResponse' }
+    "400": { description: invalid OAuth state or provider response }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
+    "409": { description: provider identity is already linked or owned by another user }
+    "503": { description: provider unavailable }

package/templates/add/auth/docs/users-me-identity-link.yaml.hbs

@@ -0,0 +1,25 @@
+post:
+  summary: Start linking a provider identity to the current user
+  description: Creates a one-time OAuth transaction bound to the authenticated user and returns the provider authorization URL.
+  operationId: startIdentityLink
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  parameters:
+    - name: provider
+      in: path
+      required: true
+      schema: { type: string, example: google }
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema: { $ref: './schemas.yaml#/IdentityLinkStartInput' }
+  responses:
+    "200":
+      description: provider authorization URL
+      content:
+        application/json:
+          schema: { $ref: './schemas.yaml#/IdentityLinkStartResponse' }
+    "400": { $ref: '../common/responses.yaml#/ValidationError' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
+    "503": { description: provider unavailable }

package/templates/add/auth/docs/users-me-identity.yaml.hbs

@@ -0,0 +1,15 @@
+delete:
+  summary: Unlink a login identity from the current user
+  operationId: unlinkMyIdentity
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  parameters:
+    - name: provider
+      in: path
+      required: true
+      schema: { type: string, example: google }
+  responses:
+    "204": { description: login identity unlinked }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
+    "404": { description: login identity not found }
+    "409": { description: cannot remove the last login identity }

package/templates/add/auth/docs/users-me-session.yaml.hbs

@@ -0,0 +1,14 @@
+delete:
+  summary: Revoke one session for the current user
+  operationId: revokeMySession
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  parameters:
+    - name: id
+      in: path
+      required: true
+      schema: { type: string, format: uuid }
+  responses:
+    "204": { description: session revoked }
+    "400": { $ref: '../common/responses.yaml#/ValidationError' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }

package/templates/add/auth/docs/users-me-sessions.yaml.hbs

@@ -0,0 +1,13 @@
+get:
+  summary: List active sessions for the current user
+  description: Returns active refresh-token sessions with safe device metadata. Raw refresh tokens and token hashes are never returned.
+  operationId: listMySessions
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  responses:
+    "200":
+      description: active sessions
+      content:
+        application/json:
+          schema: { $ref: './schemas.yaml#/SessionsResponse' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }

package/templates/add/auth/internal/app/user/adapters/inbound/http/dto.go.hbs

@@ -52,6 +52,10 @@ func toLoginExchangeInput(in loginExchangeInput) userapp.LoginExchangeInput {
 	return userapp.LoginExchangeInput{Code: in.Code, State: in.State, CodeVerifier: in.CodeVerifier}
 }
 
+func sessionContext(userAgent string) userapp.SessionContext {
+	return userapp.SessionContext{UserAgent: userAgent}
+}
+
 type forgotPasswordInput struct {
 	Email string `json:"email" binding:"required,email"`
 }
@@ -99,6 +103,64 @@ type mfaConfirmResponse struct {
 	RecoveryCodes []string `json:"recovery_codes"`
 }
 
+type sessionResponse struct {
+	ID         uuid.UUID `json:"id"`
+	UserAgent  string    `json:"user_agent"`
+	CreatedAt  time.Time `json:"created_at"`
+	LastUsedAt time.Time `json:"last_used_at"`
+	ExpiresAt  time.Time `json:"expires_at"`
+	Current    bool      `json:"current"`
+}
+
+type sessionsResponse struct {
+	Sessions []sessionResponse `json:"sessions"`
+}
+
+type identityLinkStartInput struct {
+	State               string `json:"state" binding:"required"`
+	CodeChallenge       string `json:"code_challenge" binding:"required"`
+	CodeChallengeMethod string `json:"code_challenge_method" binding:"required"`
+}
+
+type identityLinkExchangeInput struct {
+	Code         string `json:"code" binding:"required"`
+	State        string `json:"state" binding:"required"`
+	CodeVerifier string `json:"code_verifier" binding:"required"`
+}
+
+type identityLinkStartResponse struct {
+	AuthorizationURL string `json:"authorization_url"`
+}
+
+type identityResponse struct {
+	ID        uuid.UUID `json:"id"`
+	Provider  string    `json:"provider"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+type identitiesResponse struct {
+	Identities []identityResponse `json:"identities"`
+}
+
+func toSessionResponse(session userapp.Session) sessionResponse {
+	return sessionResponse{
+		ID: session.ID, UserAgent: session.UserAgent, CreatedAt: session.CreatedAt,
+		LastUsedAt: session.LastUsedAt, ExpiresAt: session.ExpiresAt, Current: session.Current,
+	}
+}
+
+func toIdentityLinkStartInput(in identityLinkStartInput) userapp.LoginStartInput {
+	return userapp.LoginStartInput{State: in.State, CodeChallenge: in.CodeChallenge, CodeChallengeMethod: in.CodeChallengeMethod}
+}
+
+func toIdentityLinkExchangeInput(in identityLinkExchangeInput) userapp.LoginExchangeInput {
+	return userapp.LoginExchangeInput{Code: in.Code, State: in.State, CodeVerifier: in.CodeVerifier}
+}
+
+func toIdentityResponse(identity userapp.IdentityResponse) identityResponse {
+	return identityResponse{ID: identity.ID, Provider: identity.Provider, CreatedAt: identity.CreatedAt}
+}
+
 func toCookieResponse(auth *userapp.AuthResponse) authCookieResponse {
 	return authCookieResponse{AccessToken: auth.AccessToken, TokenType: auth.TokenType, ExpiresIn: auth.ExpiresIn}
 }

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler.go.hbs

@@ -115,6 +115,7 @@ func (h *Handler) Register(rg gin.IRouter) {
 	mfaSetupLimit := middleware.RateLimit(h.limiter, "mfa-setup", 5, time.Minute)
 	mfaConfirmLimit := middleware.RateLimit(h.limiter, "mfa-confirm", 5, time.Minute)
 	mfaDisableLimit := middleware.RateLimit(h.limiter, "mfa-disable", 5, time.Minute)
+	identityLinkLimit := middleware.RateLimit(h.limiter, "identity-link", 10, time.Minute)
 
 	authGroup := rg.Group("/auth")
 	authGroup.POST("/register", registerLimit, h.register)
@@ -132,10 +133,13 @@ func (h *Handler) Register(rg gin.IRouter) {
 	usersGroup.GET("/me", h.me)
 	usersGroup.POST("/me/resend-verification", resendVerificationLimit, h.resendVerification)
 	usersGroup.POST("/me/logout-all", h.logoutAll)
+	usersGroup.GET("/me/sessions", h.sessions)
+	usersGroup.DELETE("/me/sessions/:id", h.revokeSession)
 	usersGroup.GET("/me/mfa", h.mfaStatus)
 	usersGroup.POST("/me/mfa/setup", mfaSetupLimit, h.setupMFA)
 	usersGroup.POST("/me/mfa/confirm", mfaConfirmLimit, h.confirmMFA)
 	usersGroup.POST("/me/mfa/disable", mfaDisableLimit, h.disableMFA)
+	h.registerIdentityRoutes(usersGroup, identityLinkLimit)
 	// Admin user routes are enabled only when the optional RBAC authorizer is
 	// supplied by the composition root. Auth-only projects keep the endpoint
 	// surface limited to authentication and the current-user operations.
@@ -205,8 +209,10 @@ func toHTTPError(err error) error {
 		switch ruleErr.Code {
 		case "USER_NOT_FOUND":
 			status = http.StatusNotFound
-		case "USER_EMAIL_TAKEN", "AUTH_ALREADY_VERIFIED", "AUTH_MFA_ALREADY_ENABLED", "AUTH_MFA_NOT_ENROLLED", "AUTH_MFA_SETUP_REQUIRED":
+		case "USER_EMAIL_TAKEN", "AUTH_ALREADY_VERIFIED", "AUTH_MFA_ALREADY_ENABLED", "AUTH_MFA_NOT_ENROLLED", "AUTH_MFA_SETUP_REQUIRED", "AUTH_IDENTITY_ALREADY_LINKED", "AUTH_IDENTITY_CONFLICT", "AUTH_LAST_IDENTITY":
 			status = http.StatusConflict
+		case "AUTH_IDENTITY_NOT_FOUND":
+			status = http.StatusNotFound
 		case "AUTH_INVALID_CREDENTIALS", "AUTH_INVALID_TOKEN", "AUTH_MFA_INVALID":
 			status = http.StatusUnauthorized
 		case "AUTH_MFA_UNAVAILABLE":

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_identity.go.hbs

@@ -0,0 +1,80 @@
+package httpadapter
+
+import (
+	"errors"
+	"net/http"
+
+	userapp "{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/shared/httpx"
+
+	"github.com/gin-gonic/gin"
+)
+
+// registerIdentityRoutes keeps account-linking routes out of the main auth
+// route file while the handler remains in the same inbound adapter package.
+func (h *Handler) registerIdentityRoutes(usersGroup gin.IRouter, linkLimiter gin.HandlerFunc) {
+	usersGroup.GET("/me/identities", h.listIdentities)
+	usersGroup.POST("/me/identities/:provider/link", linkLimiter, h.beginIdentityLink)
+	usersGroup.POST("/me/identities/:provider/link/exchange", linkLimiter, h.exchangeIdentityLink)
+	usersGroup.DELETE("/me/identities/:provider", h.unlinkIdentity)
+}
+
+func (h *Handler) listIdentities(c *gin.Context) {
+	setNoStoreHeaders(c)
+	items, err := h.svc.ListIdentities(c.Request.Context(), currentUserID(c))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]identityResponse, len(items))
+	for i := range items {
+		out[i] = toIdentityResponse(items[i])
+	}
+	c.JSON(http.StatusOK, identitiesResponse{Identities: out})
+}
+
+func (h *Handler) beginIdentityLink(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in identityLinkStartInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	authorization, err := h.svc.BeginIdentityLink(c.Request.Context(), currentUserID(c), c.Param("provider"), toIdentityLinkStartInput(in))
+	if err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), err))
+		return
+	}
+	c.JSON(http.StatusOK, identityLinkStartResponse{AuthorizationURL: authorization.URL})
+}
+
+func (h *Handler) exchangeIdentityLink(c *gin.Context) {
+	setNoStoreHeaders(c)
+	var in identityLinkExchangeInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(h.oauthAppError(c.Param("provider"), userapp.NewOAuthError(userapp.OAuthFailed, err)))
+		return
+	}
+	identity, err := h.svc.ExchangeIdentityLink(c.Request.Context(), currentUserID(c), c.Param("provider"), toIdentityLinkExchangeInput(in))
+	if err != nil {
+		c.Error(h.identityLinkError(c.Param("provider"), err))
+		return
+	}
+	c.JSON(http.StatusOK, toIdentityResponse(*identity))
+}
+
+func (h *Handler) identityLinkError(provider string, err error) error {
+	var oauthErr *userapp.OAuthError
+	if errors.As(err, &oauthErr) {
+		return h.oauthAppError(provider, err)
+	}
+	return toHTTPError(err)
+}
+
+func (h *Handler) unlinkIdentity(c *gin.Context) {
+	if err := h.svc.UnlinkIdentity(c.Request.Context(), currentUserID(c), c.Param("provider")); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.Status(http.StatusNoContent)
+}

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_local.go.hbs

@@ -19,7 +19,9 @@ func (h *Handler) register(c *gin.Context) {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	auth, err := h.svc.Register(c.Request.Context(), toRegisterInput(in))
+	input := toRegisterInput(in)
+	input.Session = sessionContext(c.GetHeader("User-Agent"))
+	auth, err := h.svc.Register(c.Request.Context(), input)
 	if err != nil {
 		c.Error(toHTTPError(err))
 		return
@@ -37,7 +39,9 @@ func (h *Handler) login(c *gin.Context) {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	auth, err := h.svc.Login(c.Request.Context(), toLoginInput(in))
+	input := toLoginInput(in)
+	input.Session = sessionContext(c.GetHeader("User-Agent"))
+	auth, err := h.svc.Login(c.Request.Context(), input)
 	if err != nil {
 		c.Error(toHTTPError(err))
 		return

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_mfa.go.hbs

@@ -81,3 +81,12 @@ func (h *Handler) disableMFA(c *gin.Context) {
 func currentUserID(c *gin.Context) uuid.UUID {
 	return c.MustGet(middleware.UserIDKey).(uuid.UUID)
 }
+
+func currentSessionID(c *gin.Context) uuid.UUID {
+	if value, ok := c.Get(middleware.SessionIDKey); ok {
+		if sessionID, ok := value.(uuid.UUID); ok {
+			return sessionID
+		}
+	}
+	return uuid.Nil
+}

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_oauth.go.hbs

@@ -34,7 +34,9 @@ func (h *Handler) providerExchange(c *gin.Context) {
 		c.Error(h.oauthAppError(c.Param("provider"), userapp.NewOAuthError(userapp.OAuthFailed, err)))
 		return
 	}
-	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), toLoginExchangeInput(in))
+	input := toLoginExchangeInput(in)
+	input.Session = sessionContext(c.GetHeader("User-Agent"))
+	auth, err := h.svc.ExchangeLogin(c.Request.Context(), c.Param("provider"), input)
 	if err != nil {
 		c.Error(h.oauthAppError(c.Param("provider"), err))
 		return

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_test.go.hbs

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -12,6 +13,8 @@ import (
 	"time"
 
 	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/app/user/domain"
+	"{{goModule}}/internal/shared/apperror"
 	"{{goModule}}/internal/shared/middleware"
 
 	"github.com/gin-gonic/gin"
@@ -151,6 +154,37 @@ func TestHandler_ProviderExchangeReturnsJSONAndSetsRefreshCookie(t *testing.T) {
 	}
 }
 
+func TestHandler_SessionRoutesAreProtected(t *testing.T) {
+	router := newOAuthTestRouter(t)
+	for _, route := range []struct{ method, path string }{
+		{http.MethodGet, "/users/me/identities"},
+		{http.MethodPost, "/users/me/identities/fake/link"},
+		{http.MethodPost, "/users/me/identities/fake/link/exchange"},
+		{http.MethodDelete, "/users/me/identities/fake"},
+		{http.MethodGet, "/users/me/sessions"},
+		{http.MethodDelete, "/users/me/sessions/00000000-0000-0000-0000-000000000001"},
+	} {
+		response := httptest.NewRecorder()
+		router.ServeHTTP(response, httptest.NewRequest(route.method, route.path, nil))
+		if response.Code != http.StatusUnauthorized {
+			t.Fatalf("%s %s status = %d, want 401", route.method, route.path, response.Code)
+		}
+	}
+}
+
+func TestHandler_IdentityLinkErrorPreservesConflictStatus(t *testing.T) {
+	h := NewHandler(stubService{}, "test-secret", time.Hour, true, "strict", allowAllLimiter{})
+	mapped := h.identityLinkError("fake", domain.Rule("AUTH_IDENTITY_CONFLICT", "identity conflict", domain.ErrConflict))
+
+	var appErr *apperror.AppError
+	if !errors.As(mapped, &appErr) {
+		t.Fatalf("mapped error = %T, want *apperror.AppError", mapped)
+	}
+	if appErr.HTTPStatus != http.StatusConflict || appErr.Code != "AUTH_IDENTITY_CONFLICT" {
+		t.Fatalf("mapped error = status %d code %q, want 409 AUTH_IDENTITY_CONFLICT", appErr.HTTPStatus, appErr.Code)
+	}
+}
+
 func TestHandler_ProviderCallbackIsFrontendOwnedAndErrorsDoNotRedirect(t *testing.T) {
 	router := newOAuthTestRouter(t)
 	callback := httptest.NewRequest(http.MethodGet, "/auth/fake/callback?error=access_denied&error_description=do-not-leak", nil)

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_user.go.hbs

@@ -3,6 +3,7 @@ package httpadapter
 import (
 	"net/http"
 
+	"{{goModule}}/internal/shared/httpx"
 	"{{goModule}}/internal/shared/middleware"
 
 	"github.com/gin-gonic/gin"
@@ -30,6 +31,35 @@ func (h *Handler) logoutAll(c *gin.Context) {
 	c.Status(http.StatusNoContent)
 }
 
+func (h *Handler) sessions(c *gin.Context) {
+	setNoStoreHeaders(c)
+	items, err := h.svc.ListSessions(c.Request.Context(), currentUserID(c), currentSessionID(c))
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]sessionResponse, len(items))
+	for i := range items {
+		out[i] = toSessionResponse(items[i])
+	}
+	c.JSON(http.StatusOK, sessionsResponse{Sessions: out})
+}
+
+func (h *Handler) revokeSession(c *gin.Context) {
+	sessionID, ok := httpx.ParseID(c)
+	if !ok {
+		return
+	}
+	if err := h.svc.RevokeSession(c.Request.Context(), currentUserID(c), sessionID); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	if sessionID == currentSessionID(c) {
+		h.clearRefreshCookie(c)
+	}
+	c.Status(http.StatusNoContent)
+}
+
 func (h *Handler) me(c *gin.Context) {
 	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
 	u, err := h.svc.Get(c.Request.Context(), userID)