@nakedev/go-scaffold 0.5.2 → 0.5.4

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/model.go.hbs

@@ -9,29 +9,52 @@ import (
 )
 
 type User struct {
-	ID            uuid.UUID `gorm:"type:uuid;primaryKey"`
-	Email         string    `gorm:"uniqueIndex:idx_users_email;not null"`
-	Name          string
-	AvatarURL     string
-	EmailVerified bool
-	Role          string `gorm:"type:varchar(20);not null;default:'staff'"`
-	CreatedAt     time.Time
-	UpdatedAt     time.Time
+	ID        uuid.UUID `gorm:"type:uuid;primaryKey"`
+	Name      string
+	AvatarURL string
+	Role      string `gorm:"type:varchar(20);not null;default:'staff'"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 func (User) TableName() string { return "user_svc.users" }
 
-type Identity struct {
-	ID           uuid.UUID `gorm:"type:uuid;primaryKey"`
-	UserID       uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
-	Provider     string    `gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
-	PasswordHash *string
-	ProviderUID  *string `gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
-	CreatedAt    time.Time
-	UpdatedAt    time.Time
+type UserEmail struct {
+	ID              uuid.UUID  `gorm:"type:uuid;primaryKey"`
+	UserID          uuid.UUID  `gorm:"type:uuid;not null;index:idx_user_emails_user;uniqueIndex:idx_user_emails_primary,where:is_primary"`
+	Email           string     `gorm:"type:varchar(255);not null"`
+	EmailNormalized string     `gorm:"type:varchar(255);not null;uniqueIndex:idx_user_emails_normalized"`
+	IsPrimary       bool       `gorm:"not null;default:true"`
+	VerifiedAt      *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+func (UserEmail) TableName() string { return "user_svc.user_emails" }
+
+type PasswordCredential struct {
+	ID                  uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID              uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_password_credentials_user"`
+	PasswordHash        string    `gorm:"column:password_hash;type:text;not null"`
+	HashAlgorithm       string    `gorm:"type:varchar(32);not null;default:'bcrypt'"`
+	PasswordChangedAt   time.Time `gorm:"not null"`
+	CreatedAt           time.Time
+	UpdatedAt           time.Time
+}
+
+func (PasswordCredential) TableName() string { return "user_svc.password_credentials" }
+
+type ExternalIdentity struct {
+	ID        uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID    uuid.UUID `gorm:"type:uuid;not null"`
+	Provider  string    `gorm:"type:varchar(50);not null;uniqueIndex:idx_external_identities_user_provider,priority:2"`
+	Issuer    string    `gorm:"type:text;not null;uniqueIndex:idx_external_identities_issuer_subject,priority:1"`
+	Subject   string    `gorm:"type:text;not null;uniqueIndex:idx_external_identities_issuer_subject,priority:2"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
-func (Identity) TableName() string { return "user_svc.identities" }
+func (ExternalIdentity) TableName() string { return "user_svc.external_identities" }
 
 type AuthToken struct {
 	TokenHash         string     `gorm:"primaryKey;type:text"`

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository.go.hbs

@@ -3,6 +3,8 @@ package postgres
 import (
 	"context"
 	"errors"
+	"sort"
+	"strings"
 	"time"
 
 	"{{goModule}}/internal/app/user/domain"
@@ -12,6 +14,7 @@ import (
 
 	"github.com/google/uuid"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type Repository struct {
@@ -25,24 +28,52 @@ func NewRepository(db *gorm.DB) *Repository {
 }
 
 func (r *Repository) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
-	var row User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "email = ?", email).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var emailRow UserEmail
+	if err := db.Where("email_normalized = ?", normalizeEmail(email)).First(&emailRow).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainUser(&row), nil
+	return findUserWithEmail(db, emailRow.UserID, &emailRow)
 }
 
 func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
-	var row User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "id = ?", id).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var emailRow UserEmail
+	if err := db.Where("user_id = ? AND is_primary = true", id).First(&emailRow).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainUser(&row), nil
+	return findUserWithEmail(db, id, &emailRow)
 }
 
 func (r *Repository) UpdateUser(ctx context.Context, user *domain.User) error {
-	row := fromDomainUser(user)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+	if user == nil || strings.TrimSpace(user.Email) == "" {
+		return errors.New("user email is required")
+	}
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
+		row := fromDomainUser(user)
+		if err := db.Save(&row).Error; err != nil {
+			return err
+		}
+
+		var emailRow UserEmail
+		err := db.Where("user_id = ? AND is_primary = true", user.ID).First(&emailRow).Error
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			emailRow = UserEmail{ID: uuid.New(), UserID: user.ID, IsPrimary: true}
+		} else if err != nil {
+			return err
+		}
+		emailRow.Email = strings.TrimSpace(user.Email)
+		emailRow.EmailNormalized = normalizeEmail(user.Email)
+		if user.EmailVerified {
+			if emailRow.VerifiedAt == nil {
+				now := time.Now()
+				emailRow.VerifiedAt = &now
+			}
+		} else {
+			emailRow.VerifiedAt = nil
+		}
+		return db.Save(&emailRow).Error
+	}))
 }
 
 func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.User, error) {
@@ -52,53 +83,161 @@ func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.U
 	if err != nil {
 		return nil, persistenceError(err)
 	}
+	ids := make([]uuid.UUID, len(rows))
+	for i := range rows {
+		ids[i] = rows[i].ID
+	}
+	var emailRows []UserEmail
+	if len(ids) > 0 {
+		if err := tx.From(ctx, r.db).WithContext(ctx).
+			Where("user_id IN ? AND is_primary = true", ids).Find(&emailRows).Error; err != nil {
+			return nil, persistenceError(err)
+		}
+	}
+	emails := make(map[uuid.UUID]*UserEmail, len(emailRows))
+	for i := range emailRows {
+		emails[emailRows[i].UserID] = &emailRows[i]
+	}
 	items := make([]domain.User, len(rows))
 	for i := range rows {
-		items[i] = *toDomainUser(&rows[i])
+		items[i] = *toDomainUserWithEmail(&rows[i], emails[rows[i].ID])
 	}
 	return items, nil
 }
 
 func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) (*domain.Identity, error) {
-	var row Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).
-		First(&row, "user_id = ? AND provider = ?", userID, string(provider)).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	if provider == domain.ProviderLocal {
+		var row PasswordCredential
+		if err := db.Where("user_id = ?", userID).First(&row).Error; err != nil {
+			return nil, persistenceError(err)
+		}
+		return toDomainPasswordIdentity(&row), nil
+	}
+	var row ExternalIdentity
+	if err := db.Where("user_id = ? AND provider = ?", userID, string(provider)).First(&row).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainIdentity(&row), nil
+	return toDomainExternalIdentity(&row), nil
 }
 
-func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider domain.Provider, providerUID string) (*domain.Identity, error) {
-	var row Identity
+func (r *Repository) ListIdentities(ctx context.Context, userID uuid.UUID) ([]domain.Identity, error) {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var passwordRows []PasswordCredential
+	if err := db.Where("user_id = ?", userID).Find(&passwordRows).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	var externalRows []ExternalIdentity
+	if err := db.Where("user_id = ?", userID).Find(&externalRows).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	items := make([]domain.Identity, 0, len(passwordRows)+len(externalRows))
+	for i := range passwordRows {
+		items = append(items, *toDomainPasswordIdentity(&passwordRows[i]))
+	}
+	for i := range externalRows {
+		items = append(items, *toDomainExternalIdentity(&externalRows[i]))
+	}
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].CreatedAt.Equal(items[j].CreatedAt) {
+			return items[i].ID.String() < items[j].ID.String()
+		}
+		return items[i].CreatedAt.Before(items[j].CreatedAt)
+	})
+	return items, nil
+}
+
+func (r *Repository) FindIdentityByProviderUID(ctx context.Context, issuer, subject string) (*domain.Identity, error) {
+	var row ExternalIdentity
 	if err := tx.From(ctx, r.db).WithContext(ctx).
-		First(&row, "provider = ? AND provider_uid = ?", string(provider), providerUID).Error; err != nil {
+		First(&row, "issuer = ? AND subject = ?", issuer, subject).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainIdentity(&row), nil
+	return toDomainExternalIdentity(&row), nil
 }
 
 // CreateIdentity links a new login method onto an existing user.
 func (r *Repository) CreateIdentity(ctx context.Context, identity *domain.Identity) error {
-	row := fromDomainIdentity(identity)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Create(&row).Error)
+	return persistenceError(createIdentity(tx.From(ctx, r.db).WithContext(ctx), identity))
 }
 
 func (r *Repository) UpdateIdentity(ctx context.Context, identity *domain.Identity) error {
-	row := fromDomainIdentity(identity)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+	if identity == nil {
+		return errors.New("identity is required")
+	}
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	if identity.Provider == domain.ProviderLocal {
+		if identity.PasswordHash == nil {
+			return errors.New("local identity password is required")
+		}
+		row := PasswordCredential{ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash, HashAlgorithm: "bcrypt", PasswordChangedAt: time.Now(), CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt}
+		return persistenceError(db.Save(&row).Error)
+	}
+	row, err := externalIdentityFromDomain(identity)
+	if err != nil {
+		return err
+	}
+	return persistenceError(db.Save(&row).Error)
+}
+
+// DeleteIdentity locks the user's identity rows before checking the count so
+// two concurrent unlink requests cannot both remove the last login method.
+func (r *Repository) DeleteIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) error {
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
+		var user User
+		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).First(&user, "id = ?", userID).Error; err != nil {
+			return err
+		}
+		var passwordCount, externalCount int64
+		if err := db.Model(&PasswordCredential{}).Where("user_id = ?", userID).Count(&passwordCount).Error; err != nil {
+			return err
+		}
+		if err := db.Model(&ExternalIdentity{}).Where("user_id = ?", userID).Count(&externalCount).Error; err != nil {
+			return err
+		}
+		total := passwordCount + externalCount
+		if total == 0 {
+			return domain.ErrNotFound
+		}
+		if total <= 1 {
+			return domain.ErrLastIdentity
+		}
+		if provider == domain.ProviderLocal {
+			result := db.Where("user_id = ?", userID).Delete(&PasswordCredential{})
+			if result.Error == nil && result.RowsAffected == 0 {
+				return domain.ErrNotFound
+			}
+			return result.Error
+		}
+		result := db.Where("user_id = ? AND provider = ?", userID, string(provider)).Delete(&ExternalIdentity{})
+		if result.Error == nil && result.RowsAffected == 0 {
+			return domain.ErrNotFound
+		}
+		return result.Error
+	}))
 }
 
 // CreateUserWithIdentity inserts the profile and its first login method in
 // one transaction. A user without an identity cannot authenticate.
 func (r *Repository) CreateUserWithIdentity(ctx context.Context, user *domain.User, identity *domain.Identity) error {
 	userRow := fromDomainUser(user)
-	identityRow := fromDomainIdentity(identity)
 	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
 		if err := db.Create(&userRow).Error; err != nil {
 			return persistenceError(err)
 		}
-		identityRow.UserID = userRow.ID
-		return persistenceError(db.Create(&identityRow).Error)
+		verifiedAt := (*time.Time)(nil)
+		if user.EmailVerified {
+			now := time.Now()
+			verifiedAt = &now
+		}
+		if err := db.Create(&UserEmail{
+			ID: uuid.New(), UserID: userRow.ID, Email: strings.TrimSpace(user.Email),
+			EmailNormalized: normalizeEmail(user.Email), IsPrimary: true, VerifiedAt: verifiedAt,
+		}).Error; err != nil {
+			return persistenceError(err)
+		}
+		identity.UserID = userRow.ID
+		return persistenceError(createIdentity(db, identity))
 	}))
 }
 
@@ -151,16 +290,48 @@ func persistenceError(err error) error {
 	return err
 }
 
-func toDomainUser(row *User) *domain.User {
+func findUserWithEmail(db *gorm.DB, userID uuid.UUID, emailRow *UserEmail) (*domain.User, error) {
+	var row User
+	if err := db.First(&row, "id = ?", userID).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUserWithEmail(&row, emailRow), nil
+}
+
+func normalizeEmail(email string) string {
+	return strings.ToLower(strings.TrimSpace(email))
+}
+
+// toDomainUser is the one-row mapping hook used by generic generated method
+// extensions. It hydrates the primary email because auth stores addresses in
+// user_emails rather than on the profile row.
+//nolint:unused // generate method uses this seam when a custom user lookup is added.
+func (r *Repository) toDomainUser(ctx context.Context, row *User) (*domain.User, error) {
+	var emailRow UserEmail
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		Where("user_id = ? AND is_primary = true", row.ID).
+		First(&emailRow).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUserWithEmail(row, &emailRow), nil
+}
+
+func toDomainUserWithEmail(row *User, emailRow *UserEmail) *domain.User {
 	if row == nil {
 		return nil
 	}
+	var email string
+	var verified bool
+	if emailRow != nil {
+		email = emailRow.Email
+		verified = emailRow.VerifiedAt != nil
+	}
 	return &domain.User{
 		ID:            row.ID,
-		Email:         row.Email,
+		Email:         email,
 		Name:          row.Name,
 		AvatarURL:     row.AvatarURL,
-		EmailVerified: row.EmailVerified,
+		EmailVerified: verified,
 		Role:          row.Role,
 		CreatedAt:     row.CreatedAt,
 		UpdatedAt:     row.UpdatedAt,
@@ -169,42 +340,71 @@ func toDomainUser(row *User) *domain.User {
 
 func fromDomainUser(user *domain.User) User {
 	return User{
-		ID:            user.ID,
-		Email:         user.Email,
-		Name:          user.Name,
-		AvatarURL:     user.AvatarURL,
-		EmailVerified: user.EmailVerified,
-		Role:          user.Role,
+		ID:        user.ID,
+		Name:      user.Name,
+		AvatarURL: user.AvatarURL,
+		Role:      user.Role,
 		CreatedAt:     user.CreatedAt,
 		UpdatedAt:     user.UpdatedAt,
 	}
 }
 
-func toDomainIdentity(row *Identity) *domain.Identity {
+func toDomainPasswordIdentity(row *PasswordCredential) *domain.Identity {
 	if row == nil {
 		return nil
 	}
+	hash := row.PasswordHash
 	return &domain.Identity{
-		ID:           row.ID,
-		UserID:       row.UserID,
-		Provider:     domain.Provider(row.Provider),
-		PasswordHash: row.PasswordHash,
-		ProviderUID:  row.ProviderUID,
-		CreatedAt:    row.CreatedAt,
-		UpdatedAt:    row.UpdatedAt,
-	}
-}
-
-func fromDomainIdentity(identity *domain.Identity) Identity {
-	return Identity{
-		ID:           identity.ID,
-		UserID:       identity.UserID,
-		Provider:     string(identity.Provider),
-		PasswordHash: identity.PasswordHash,
-		ProviderUID:  identity.ProviderUID,
-		CreatedAt:    identity.CreatedAt,
-		UpdatedAt:    identity.UpdatedAt,
+		ID: row.ID, UserID: row.UserID, Provider: domain.ProviderLocal,
+		PasswordHash: &hash, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt,
+	}
+}
+
+
+func toDomainExternalIdentity(row *ExternalIdentity) *domain.Identity {
+	if row == nil {
+		return nil
+	}
+	subject := row.Subject
+	return &domain.Identity{
+		ID: row.ID, UserID: row.UserID, Provider: domain.Provider(row.Provider),
+		Issuer: row.Issuer, ProviderUID: &subject, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt,
+	}
+}
+
+func createIdentity(db *gorm.DB, identity *domain.Identity) error {
+	if identity == nil || identity.UserID == uuid.Nil || identity.ID == uuid.Nil {
+		return errors.New("identity id and user id are required")
+	}
+	if identity.Provider == domain.ProviderLocal {
+		if identity.PasswordHash == nil {
+			return errors.New("local identity password is required")
+		}
+		return db.Create(&PasswordCredential{
+			ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash,
+			HashAlgorithm: "bcrypt", PasswordChangedAt: time.Now(),
+			CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt,
+		}).Error
+	}
+	row, err := externalIdentityFromDomain(identity)
+	if err != nil {
+		return err
+	}
+	return db.Create(&row).Error
+}
+
+func externalIdentityFromDomain(identity *domain.Identity) (ExternalIdentity, error) {
+	if identity == nil || identity.ID == uuid.Nil || identity.UserID == uuid.Nil {
+		return ExternalIdentity{}, errors.New("identity id and user id are required")
+	}
+	if strings.TrimSpace(identity.Issuer) == "" || identity.ProviderUID == nil || strings.TrimSpace(*identity.ProviderUID) == "" {
+		return ExternalIdentity{}, errors.New("external identity issuer and subject are required")
 	}
+	return ExternalIdentity{
+		ID: identity.ID, UserID: identity.UserID, Provider: string(identity.Provider),
+		Issuer: identity.Issuer, Subject: *identity.ProviderUID,
+		CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt,
+	}, nil
 }
 
 // go-scaffold:repository-methods

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository_test.go.hbs

@@ -60,31 +60,34 @@ func repositoryDBForTest(t *testing.T) *gorm.DB {
 	return tx
 }
 
+func stringPtr(value string) *string { return &value }
+
 // CreateUserWithIdentity's whole reason to be a transaction: a user that
 // exists with no way to log in is unreachable. If the identity insert fails,
 // the user it was meant to arrive with must vanish too — a function-backed
 // stub can't prove this, since it never runs a real insert against a real
 // constraint. This forces exactly that: the user insert succeeds (it's a
-// brand new row), but the identity insert collides with an existing Google
-// identity's provider_uid.
+// brand new row), but the identity insert collides with an existing external
+// identity's issuer/subject.
 func TestRepository_CreateUserWithIdentity_RollsBackBothOnIdentityConflict(t *testing.T) {
 	repo := NewRepository(repositoryDBForTest(t))
 	ctx := context.Background()
 
-	providerUID := "conflicting-provider-uid"
+	issuer := "https://accounts.google.com"
+	providerUID := "conflicting-provider-subject"
 	existing := &domain.User{ID: uuid.New(), Email: "first@example.com"}
 	if err := repo.CreateUserWithIdentity(ctx, existing, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
+		ID: uuid.New(), Provider: domain.ProviderGoogle, Issuer: issuer, ProviderUID: &providerUID,
 	}); err != nil {
 		t.Fatalf("seed existing user+identity: %v", err)
 	}
 
 	blocked := &domain.User{ID: uuid.New(), Email: "second@example.com"}
 	err := repo.CreateUserWithIdentity(ctx, blocked, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
+		ID: uuid.New(), Provider: domain.ProviderGoogle, Issuer: issuer, ProviderUID: &providerUID,
 	})
 	if !errors.Is(err, domain.ErrConflict) {
-		t.Fatalf("want a mapped user conflict from the conflicting provider_uid, got %v", err)
+		t.Fatalf("want a mapped user conflict from the conflicting issuer/subject, got %v", err)
 	}
 
 	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, domain.ErrNotFound) {
@@ -103,13 +106,13 @@ func TestRepository_CreateUserWithIdentity_DuplicateEmailIsDetectable(t *testing
 
 	email := "dup@example.com"
 	if err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderLocal,
+		ID: uuid.New(), Provider: domain.ProviderLocal, PasswordHash: stringPtr("hash-one"),
 	}); err != nil {
 		t.Fatalf("seed first user: %v", err)
 	}
 
 	err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderLocal,
+		ID: uuid.New(), Provider: domain.ProviderLocal, PasswordHash: stringPtr("hash-two"),
 	})
 	if !errors.Is(err, domain.ErrConflict) {
 		t.Fatalf("want a mapped user conflict for the reused email, got %v", err)

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/tokenstore_pg.go.hbs

@@ -176,6 +176,7 @@ func (s *PgTokenStore) SetLoginTransaction(ctx context.Context, stateHash string
 	}
 	row := AuthToken{
 		TokenHash:     stateHash,
+		UserID:        transaction.UserID,
 		Kind:          kindOAuthState,
 		ExpiresAt:     transaction.ExpiresAt,
 		Provider:      transaction.Provider,
@@ -185,7 +186,7 @@ func (s *PgTokenStore) SetLoginTransaction(ctx context.Context, stateHash string
 	return tx.From(ctx, s.db).WithContext(ctx).
 		Where("token_hash = ?", stateHash).
 		Assign(map[string]any{
-			"user_id":        uuid.Nil,
+			"user_id":        transaction.UserID,
 			"kind":           kindOAuthState,
 			"expires_at":     transaction.ExpiresAt,
 			"provider":       transaction.Provider,
@@ -199,8 +200,9 @@ func (s *PgTokenStore) ConsumeLoginTransaction(ctx context.Context, stateHash st
 	err := tx.From(ctx, s.db).WithContext(ctx).Raw(
 		`DELETE FROM user_svc.auth_tokens
 		 WHERE token_hash = ? AND kind = ? AND expires_at > now()
-		 RETURNING provider, code_challenge, nonce, expires_at`,
+		 RETURNING user_id, provider, code_challenge, nonce, expires_at`,
 		stateHash, kindOAuthState).Row().Scan(
+		&transaction.UserID,
 		&transaction.Provider,
 		&transaction.CodeChallenge,
 		&transaction.Nonce,

package/templates/add/auth/internal/app/user/application/dto.go.hbs

@@ -43,6 +43,20 @@ type Session struct {
 	Current    bool
 }
 
+// IdentityResponse is the safe public view of a login identity. Provider
+// subjects and password hashes never cross the application/HTTP boundary.
+type IdentityResponse struct {
+	ID        uuid.UUID
+	Provider  string
+	CreatedAt time.Time
+}
+
+func ToIdentityResponse(identity domain.Identity) IdentityResponse {
+	return IdentityResponse{
+		ID: identity.ID, Provider: string(identity.Provider), CreatedAt: identity.CreatedAt,
+	}
+}
+
 type AuthResponse struct {
 	AccessToken  string
 	RefreshToken string

package/templates/add/auth/internal/app/user/application/errors.go.hbs

@@ -25,6 +25,10 @@ func errInvalidCredentials() error {
 	return domain.Rule("AUTH_INVALID_CREDENTIALS", "invalid email or password", domain.ErrInvalidCredential)
 }
 
+func errInvalidPassword() error {
+	return domain.Rule("AUTH_INVALID_PASSWORD", "password must be between 8 and 72 bytes", domain.ErrInvalidPassword)
+}
+
 func errInvalidToken() error {
 	return domain.Rule("AUTH_INVALID_TOKEN", "invalid or expired token", domain.ErrInvalidToken)
 }
@@ -60,3 +64,19 @@ func errMFAConfig() error {
 func errUnknownRole() error {
 	return domain.Rule("USER_UNKNOWN_ROLE", "unknown role code", domain.ErrUnknownRole)
 }
+
+func errIdentityAlreadyLinked() error {
+	return domain.Rule("AUTH_IDENTITY_ALREADY_LINKED", "this login method is already linked", domain.ErrIdentityAlreadyLinked)
+}
+
+func errIdentityConflict() error {
+	return domain.Rule("AUTH_IDENTITY_CONFLICT", "this provider account is linked to another user", domain.ErrConflict)
+}
+
+func errIdentityNotFound() error {
+	return domain.Rule("AUTH_IDENTITY_NOT_FOUND", "login method not found", domain.ErrNotFound)
+}
+
+func errLastIdentity() error {
+	return domain.Rule("AUTH_LAST_IDENTITY", "you cannot remove your last login method", domain.ErrLastIdentity)
+}