@nakedev/go-scaffold 0.5.1 → 0.5.3

package/templates/create/base/AGENTS.md.hbs

@@ -180,6 +180,20 @@ approval before changing their contract.
   tombstone. Its inactivity expiry may move on rotation, but its persisted
   absolute expiry never moves. Never replace it with a read-then-delete
   sequence.
+- Authenticated users can inspect active refresh sessions through
+  `GET /users/me/sessions` and revoke one with
+  `DELETE /users/me/sessions/:id`. Session IDs remain stable through refresh
+  rotation; responses expose only User-Agent and lifecycle timestamps, never
+  refresh tokens or token hashes. The current access token carries the session
+  ID as `sid` so the adapter can mark the current device.
+- Authenticated users can manage login identities through
+  `GET /users/me/identities`, `POST /users/me/identities/:provider/link`,
+  `POST /users/me/identities/:provider/link/exchange`, and
+  `DELETE /users/me/identities/:provider`. The link transaction is bound to
+  the current user as well as provider/state/PKCE/nonce; it can never create a
+  session or silently move a provider account between users. Return only safe
+  provider metadata, allow at most one identity per provider per user, and
+  refuse to unlink the last remaining login method.
 - Password reset and email verification consume a one-time token in the same
   retry-safe transaction as the user/identity update. A failed post-commit
   session revocation must not make a successful reset impossible to retry.

package/templates/create/base/README.md.hbs

@@ -194,6 +194,15 @@ nonce; the frontend still owns the callback route and sends the code to the
 exchange endpoint. The provider redirect URI is separate from
 `CORS_ALLOWED_ORIGINS`; the latter remains an exact-origin credentialed API
 policy. Token responses use `Cache-Control: no-store` and `Pragma: no-cache`.
+Authenticated users can list active device sessions with
+`GET /users/me/sessions` and revoke an individual session with
+`DELETE /users/me/sessions/:id`; only User-Agent and session lifecycle
+timestamps are returned.
+They can also list safe login-provider metadata with
+`GET /users/me/identities`, link a provider through the authenticated
+`/users/me/identities/:provider/link` start/exchange flow, and unlink a
+provider with `DELETE /users/me/identities/:provider`; the last login method
+cannot be removed.
 For `cross-site`, configure HTTPS origins, `COOKIE_SAMESITE=none`,
 `COOKIE_SECURE=true`, and an exact allowed Origin; the API applies an Origin
 guard independently of CORS.

package/templates/create/features/docs/architecture.md.hbs

@@ -60,7 +60,7 @@ internal/
 ```
 
 Installed process and platform additions:
-{{#if auth}}- `cmd/seed` and `platform/authprovider/google/` for user bootstrap and Google OAuth/OIDC
+{{#if auth}}- `cmd/seed` and `platform/authprovider/google/` for user bootstrap, Google OAuth/OIDC login, and authenticated identity linking
 {{/if}}{{#if worker}}- `cmd/worker` and `platform/{mail,queue}/` for queue/SMTP jobs{{#if (eq queue "asynq")}}, plus `platform/cache/` for Redis{{/if}}
 {{/if}}{{#if observability}}- `platform/telemetry/` for the OTLP exporter
 {{/if}}{{#if rbac}}- `shared/middleware/authz.go` and `app/role/` for RBAC policy
@@ -73,10 +73,10 @@ a real external system.
 add a `shared/utils` or similarly generic package — name it after what it
 actually does.
 
-Optional feature boundaries are explicit: auth owns user authentication and
-provider ports; RBAC owns role policy and authorization; worker owns queue and
-mail adapters; observability owns metrics/tracing setup. They do not create a
-second domain architecture.
+Optional feature boundaries are explicit: auth owns user authentication,
+identity linking, and provider ports; RBAC owns role policy and authorization;
+worker owns queue and mail adapters; observability owns metrics/tracing setup.
+They do not create a second domain architecture.
 
 ## 3. API Style
 

package/templates/create/features/docs/techstack.md.hbs

@@ -15,7 +15,7 @@
 | Logging | `log/slog`, JSON handler |
 | Migrations | [golang-migrate](https://github.com/golang-migrate/migrate) |
 | Testing | stdlib `testing`, real Postgres for integration tests |
-| Authentication | {{#if auth}}JWT access/refresh sessions, password recovery, email verification, provider login, and MFA{{else}}optional via `go-scaffold add auth`{{/if}} |
+| Authentication | {{#if auth}}JWT access/refresh sessions, password recovery, email verification, provider login/linking, and MFA{{else}}optional via `go-scaffold add auth`{{/if}} |
 | Authorization | {{#if rbac}}RBAC role/permission middleware{{else}}optional RBAC via `go-scaffold add rbac`{{/if}} |
 | Background jobs | {{#if worker}}{{queue}} queue backend with SMTP mail and `cmd/worker`{{else}}optional via `go-scaffold add worker`{{/if}} |