@nakedev/go-scaffold 0.5.2 → 0.5.4

package/templates/add/auth/internal/app/user/application/external_login.go.hbs

@@ -12,6 +12,8 @@ import (
 
 	"{{goModule}}/internal/app/user/domain"
 	"{{goModule}}/internal/shared/id"
+
+	"github.com/google/uuid"
 )
 
 // BeginLogin accepts the browser client's state and S256 PKCE challenge and
@@ -19,6 +21,21 @@ import (
 // The server persists a hashed state transaction binding provider, challenge,
 // and OIDC nonce before the callback reaches ExchangeLogin.
 func (s *Service) BeginLogin(ctx context.Context, providerName string, in LoginStartInput) (*Authorization, error) {
+	return s.beginProviderLogin(ctx, providerName, in, uuid.Nil)
+}
+
+// BeginIdentityLink starts an OAuth transaction that is bound to the
+// authenticated user. It is deliberately separate from BeginLogin: the
+// public login flow may resolve any user, while a link flow must never be
+// allowed to attach an identity to whichever account the provider returns.
+func (s *Service) BeginIdentityLink(ctx context.Context, userID uuid.UUID, providerName string, in LoginStartInput) (*Authorization, error) {
+	if userID == uuid.Nil {
+		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("authenticated user is required to link an identity"))
+	}
+	return s.beginProviderLogin(ctx, providerName, in, userID)
+}
+
+func (s *Service) beginProviderLogin(ctx context.Context, providerName string, in LoginStartInput, userID uuid.UUID) (*Authorization, error) {
 	provider, ok := s.providers.Lookup(providerName)
 	if !ok {
 		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
@@ -46,6 +63,7 @@ func (s *Service) BeginLogin(ctx context.Context, providerName string, in LoginS
 	}
 	if err := s.oauthTransactions.SetLoginTransaction(ctx, hashToken(in.State), LoginTransaction{
 		Provider:      providerName,
+		UserID:        userID,
 		CodeChallenge: in.CodeChallenge,
 		Nonce:         nonce,
 		ExpiresAt:     clock().Add(s.config.OAuthStateTTL),
@@ -56,37 +74,48 @@ func (s *Service) BeginLogin(ctx context.Context, providerName string, in LoginS
 }
 
 func (s *Service) ExchangeLogin(ctx context.Context, providerName string, in LoginExchangeInput) (*AuthResult, error) {
+	identity, err := s.exchangeExternalIdentity(ctx, providerName, in, uuid.Nil)
+	if err != nil {
+		return nil, err
+	}
+	u, err := s.findOrCreateExternalUser(ctx, identity)
+	if err != nil {
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("resolve external identity: %w", err))
+	}
+	return s.completeLogin(ctx, u, in.Session)
+}
+
+// exchangeExternalIdentity consumes the one-time transaction before asking
+// the provider to complete the code exchange. The transaction's UserID is
+// zero for public login and is the authenticated caller for identity linking.
+func (s *Service) exchangeExternalIdentity(ctx context.Context, providerName string, in LoginExchangeInput, userID uuid.UUID) (ExternalIdentity, error) {
 	provider, ok := s.providers.Lookup(providerName)
 	if !ok {
-		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
+		return ExternalIdentity{}, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
 	}
 	if !validOAuthValue(in.State) || !validPKCEValue(in.CodeVerifier) {
-		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("state and code verifier are required"))
+		return ExternalIdentity{}, NewOAuthError(OAuthStateInvalid, fmt.Errorf("state and code verifier are required"))
 	}
 	if !validOAuthValue(in.Code) {
-		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("authorization code is missing"))
+		return ExternalIdentity{}, NewOAuthError(OAuthFailed, fmt.Errorf("authorization code is missing"))
 	}
 
 	transaction, ok, err := s.oauthTransactions.ConsumeLoginTransaction(ctx, hashToken(in.State))
 	if err != nil {
-		return nil, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("consume oauth transaction: %w", err))
+		return ExternalIdentity{}, NewOAuthError(OAuthProviderUnavailable, fmt.Errorf("consume oauth transaction: %w", err))
 	}
-	if !ok || transaction.Provider != providerName || !validPKCEVerifier(in.CodeVerifier, transaction.CodeChallenge) {
-		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("oauth state or PKCE verifier is invalid"))
+	if !ok || transaction.Provider != providerName || transaction.UserID != userID || !validPKCEVerifier(in.CodeVerifier, transaction.CodeChallenge) {
+		return ExternalIdentity{}, NewOAuthError(OAuthStateInvalid, fmt.Errorf("oauth state or PKCE verifier is invalid"))
 	}
 
 	identity, err := provider.Complete(ctx, LoginCompleteInput{Code: in.Code, CodeVerifier: in.CodeVerifier, Nonce: transaction.Nonce})
 	if err != nil {
-		return nil, mapProviderError(err)
+		return ExternalIdentity{}, mapProviderError(err)
 	}
 	if identity.Provider != providerName {
-		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("provider identity name does not match the requested provider"))
+		return ExternalIdentity{}, NewOAuthError(OAuthFailed, fmt.Errorf("provider identity name does not match the requested provider"))
 	}
-	u, err := s.findOrCreateExternalUser(ctx, identity)
-	if err != nil {
-		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("resolve external identity: %w", err))
-	}
-	return s.completeLogin(ctx, u, in.Session)
+	return identity, nil
 }
 
 func validPKCEVerifier(verifier, challenge string) bool {
@@ -154,15 +183,15 @@ func mapProviderError(err error) error {
 // provider subject wins; only a verified external email may link to an
 // existing account.
 func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIdentity) (*domain.User, error) {
-	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
-		return nil, fmt.Errorf("external identity is missing provider, subject, or email")
+	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Issuer) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
+		return nil, fmt.Errorf("external identity is missing provider, issuer, subject, or email")
 	}
 	if len(info.Provider) > 20 {
 		return nil, fmt.Errorf("external identity provider name is too long")
 	}
 
 	provider := domain.Provider(info.Provider)
-	if ident, err := s.repo.FindIdentityByProviderUID(ctx, provider, info.Subject); err == nil {
+	if ident, err := s.repo.FindIdentityByProviderUID(ctx, info.Issuer, info.Subject); err == nil {
 		user, findErr := s.repo.FindByID(ctx, ident.UserID)
 		if findErr != nil {
 			return nil, fmt.Errorf("find user for existing identity: %w", findErr)
@@ -176,7 +205,7 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIde
 	email := normalizeEmail(info.Email)
 	if info.EmailVerified {
 		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-			ident := &domain.Identity{ID: id.New(), UserID: u.ID, Provider: provider, ProviderUID: &providerUID}
+			ident := &domain.Identity{ID: id.New(), UserID: u.ID, Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID}
 			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
 				return nil, fmt.Errorf("link external identity: %w", err)
 			}
@@ -187,7 +216,7 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIde
 	}
 
 	u := &domain.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.AvatarURL, EmailVerified: info.EmailVerified, Role: domain.DefaultRole}
-	ident := &domain.Identity{ID: id.New(), Provider: provider, ProviderUID: &providerUID}
+	ident := &domain.Identity{ID: id.New(), Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID}
 	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
 		if errors.Is(err, domain.ErrConflict) {
 			return nil, errEmailTaken()

package/templates/add/auth/internal/app/user/application/identities.go.hbs

@@ -0,0 +1,135 @@
+package application
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+func (s *Service) ListIdentities(ctx context.Context, userID uuid.UUID) ([]IdentityResponse, error) {
+	items, err := s.repo.ListIdentities(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list login identities: %w", err)
+	}
+
+	out := make([]IdentityResponse, len(items))
+	for i := range items {
+		out[i] = ToIdentityResponse(items[i])
+	}
+	return out, nil
+}
+
+// LinkLocalIdentity adds a password credential to an already authenticated
+// account. This is the supported Google/OIDC -> email/password path: it
+// creates a credential for the existing user instead of creating a second
+// account keyed by the same email address.
+func (s *Service) LinkLocalIdentity(ctx context.Context, userID uuid.UUID, password string) error {
+	if userID == uuid.Nil || strings.TrimSpace(password) == "" {
+		return fmt.Errorf("authenticated user and password are required")
+	}
+	if err := validatePassword(password); err != nil {
+		return err
+	}
+	if _, err := s.repo.FindByID(ctx, userID); err != nil {
+		return wrapFindErr(err)
+	}
+	if _, err := s.repo.FindIdentity(ctx, userID, domain.ProviderLocal); err == nil {
+		return errIdentityAlreadyLinked()
+	} else if !errors.Is(err, domain.ErrNotFound) {
+		return fmt.Errorf("check local identity: %w", err)
+	}
+
+	hash, err := s.passwords.Hash(password)
+	if err != nil {
+		return fmt.Errorf("hash password: %w", err)
+	}
+	hashStr := string(hash)
+	identity := &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &hashStr}
+	if err := s.repo.CreateIdentity(ctx, identity); err != nil {
+		if errors.Is(err, domain.ErrConflict) {
+			return errIdentityAlreadyLinked()
+		}
+		return fmt.Errorf("link local identity: %w", err)
+	}
+	return nil
+}
+
+func (s *Service) ExchangeIdentityLink(ctx context.Context, userID uuid.UUID, providerName string, in LoginExchangeInput) (*IdentityResponse, error) {
+	if userID == uuid.Nil {
+		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("authenticated user is required to link an identity"))
+	}
+
+	identity, err := s.exchangeExternalIdentity(ctx, providerName, in, userID)
+	if err != nil {
+		return nil, err
+	}
+	return s.linkExternalIdentity(ctx, userID, identity)
+}
+
+func (s *Service) linkExternalIdentity(ctx context.Context, userID uuid.UUID, info ExternalIdentity) (*IdentityResponse, error) {
+	provider := domain.Provider(strings.TrimSpace(info.Provider))
+	if userID == uuid.Nil || provider == "" || strings.TrimSpace(info.Subject) == "" {
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("external identity is incomplete"))
+	}
+
+	// Replaying the same provider account from the same user is idempotent.
+	// A provider subject already owned by another user is a conflict and must
+	// never be silently moved between accounts.
+	if strings.TrimSpace(info.Issuer) == "" {
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("external identity issuer is missing"))
+	}
+	if existing, err := s.repo.FindIdentityByProviderUID(ctx, info.Issuer, info.Subject); err == nil {
+		if existing.UserID != userID {
+			return nil, errIdentityConflict()
+		}
+		out := ToIdentityResponse(*existing)
+		return &out, nil
+	} else if !errors.Is(err, domain.ErrNotFound) {
+		return nil, fmt.Errorf("find linked identity: %w", err)
+	}
+
+	// The database permits one identity per provider for each user. Return a
+	// controlled conflict instead of exposing a persistence duplicate error.
+	if _, err := s.repo.FindIdentity(ctx, userID, provider); err == nil {
+		return nil, errIdentityAlreadyLinked()
+	} else if !errors.Is(err, domain.ErrNotFound) {
+		return nil, fmt.Errorf("check existing provider identity: %w", err)
+	}
+
+	providerUID := info.Subject
+	identity := &domain.Identity{
+		ID: uuid.New(), UserID: userID, Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID,
+	}
+	if err := s.repo.CreateIdentity(ctx, identity); err != nil {
+		if errors.Is(err, domain.ErrConflict) {
+			return nil, errIdentityAlreadyLinked()
+		}
+		return nil, fmt.Errorf("link identity: %w", err)
+	}
+
+	out := ToIdentityResponse(*identity)
+	return &out, nil
+}
+
+func (s *Service) UnlinkIdentity(ctx context.Context, userID uuid.UUID, providerName string) error {
+	provider := domain.Provider(strings.TrimSpace(providerName))
+	if userID == uuid.Nil || provider == "" {
+		return errIdentityNotFound()
+	}
+	if err := s.repo.DeleteIdentity(ctx, userID, provider); err != nil {
+		switch {
+		case errors.Is(err, domain.ErrLastIdentity):
+			return errLastIdentity()
+		case errors.Is(err, domain.ErrNotFound):
+			return errIdentityNotFound()
+		default:
+			return fmt.Errorf("unlink identity: %w", err)
+		}
+	}
+	return nil
+}

package/templates/add/auth/internal/app/user/application/identities_test.go.hbs

@@ -0,0 +1,102 @@
+package application
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"{{goModule}}/internal/app/user/domain"
+
+	"github.com/google/uuid"
+)
+
+func TestService_IdentityLinkBindsOAuthTransactionToCaller(t *testing.T) {
+	provider, svc := validFakeProvider(t)
+	userID := uuid.New()
+	otherUserID := uuid.New()
+
+	if _, err := svc.BeginIdentityLink(context.Background(), userID, provider.Name(), validLoginStart()); err != nil {
+		t.Fatalf("begin identity link: %v", err)
+	}
+
+	_, err := svc.ExchangeIdentityLink(context.Background(), otherUserID, provider.Name(), validLoginExchange())
+	if got := oauthErrorCode(t, err); got != OAuthStateInvalid {
+		t.Fatalf("oauth code = %q, want %q", got, OAuthStateInvalid)
+	}
+	if provider.completeCnt != 0 {
+		t.Fatal("provider must not receive a transaction bound to another user")
+	}
+}
+
+func TestService_LinkLocalIdentityAddsPasswordToExistingAccount(t *testing.T) {
+	userID := uuid.New()
+	repo := &fakeRepo{user: &domain.User{ID: userID, Email: "google@example.com"}}
+	svc := newTestService(repo, newFakeTokenStore())
+
+	if err := svc.LinkLocalIdentity(context.Background(), userID, "new-password"); err != nil {
+		t.Fatalf("link local identity: %v", err)
+	}
+	identity, err := repo.FindIdentity(context.Background(), userID, domain.ProviderLocal)
+	if err != nil {
+		t.Fatalf("find linked local identity: %v", err)
+	}
+	if identity.PasswordHash == nil || *identity.PasswordHash != "hashed:new-password" {
+		t.Fatalf("password was not hashed through the password port: %+v", identity)
+	}
+}
+
+func TestService_LinkLocalIdentityRejectsSecondPasswordCredential(t *testing.T) {
+	userID := uuid.New()
+	hash := "already-hashed"
+	repo := &fakeRepo{user: &domain.User{ID: userID, Email: "user@example.com"}}
+	repo.identities = append(repo.identities, domain.Identity{
+		ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &hash,
+	})
+	svc := newTestService(repo, newFakeTokenStore())
+
+	err := svc.LinkLocalIdentity(context.Background(), userID, "another-password")
+	var ruleErr *domain.RuleError
+	if !errors.As(err, &ruleErr) || ruleErr.Code != "AUTH_IDENTITY_ALREADY_LINKED" {
+		t.Fatalf("link duplicate local identity error = %v, want AUTH_IDENTITY_ALREADY_LINKED", err)
+	}
+}
+
+func TestService_IdentityLinkIsIdempotentForSameProviderSubject(t *testing.T) {
+	provider, svc := validFakeProvider(t)
+	userID := uuid.New()
+
+	if _, err := svc.BeginIdentityLink(context.Background(), userID, provider.Name(), validLoginStart()); err != nil {
+		t.Fatalf("begin first identity link: %v", err)
+	}
+	first, err := svc.ExchangeIdentityLink(context.Background(), userID, provider.Name(), validLoginExchange())
+	if err != nil {
+		t.Fatalf("exchange first identity link: %v", err)
+	}
+
+	if _, err := svc.BeginIdentityLink(context.Background(), userID, provider.Name(), validLoginStart()); err != nil {
+		t.Fatalf("begin repeated identity link: %v", err)
+	}
+	second, err := svc.ExchangeIdentityLink(context.Background(), userID, provider.Name(), validLoginExchange())
+	if err != nil {
+		t.Fatalf("exchange repeated identity link: %v", err)
+	}
+	if first.ID != second.ID || first.Provider != second.Provider {
+		t.Fatalf("repeated link returned a different identity: first=%+v second=%+v", first, second)
+	}
+}
+
+func TestService_UnlinkIdentityRejectsRemovingLastLoginMethod(t *testing.T) {
+	userID := uuid.New()
+	providerUID := "local-user"
+	repo := &fakeRepo{}
+	repo.identities = append(repo.identities, domain.Identity{
+		ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, ProviderUID: &providerUID,
+	})
+	svc := newTestService(repo, newFakeTokenStore())
+
+	err := svc.UnlinkIdentity(context.Background(), userID, string(domain.ProviderLocal))
+	var ruleErr *domain.RuleError
+	if !errors.As(err, &ruleErr) || ruleErr.Code != "AUTH_LAST_IDENTITY" {
+		t.Fatalf("unlink last identity error = %v, want AUTH_LAST_IDENTITY", err)
+	}
+}

package/templates/add/auth/internal/app/user/application/local_auth.go.hbs

@@ -38,6 +38,9 @@ func (s *Service) throttled(ctx context.Context, key string) bool {
 }
 
 func (s *Service) Register(ctx context.Context, in RegisterInput) (*AuthResult, error) {
+	if err := validatePassword(in.Password); err != nil {
+		return nil, err
+	}
 	hash, err := s.passwords.Hash(in.Password)
 	if err != nil {
 		return nil, fmt.Errorf("hash password: %w", err)

package/templates/add/auth/internal/app/user/application/oauth.go.hbs

@@ -40,6 +40,7 @@ type LoginCompleteInput struct {
 // provider's stable subject identifier, never an email address.
 type ExternalIdentity struct {
 	Provider      string
+	Issuer        string
 	Subject       string
 	Email         string
 	EmailVerified bool

package/templates/add/auth/internal/app/user/application/provider_test.go.hbs

@@ -90,6 +90,7 @@ func validFakeProvider(t *testing.T) (*fakeLoginProvider, *Service) {
 		}
 		return ExternalIdentity{
 			Provider:      "fake",
+			Issuer:        "https://provider.example.test",
 			Subject:       "subject-1",
 			Email:         "user@example.com",
 			EmailVerified: true,
@@ -165,6 +166,7 @@ func TestService_ExchangeLoginRejectsIdentityFromAnotherProvider(t *testing.T) {
 	provider.completeFn = func(LoginCompleteInput) (ExternalIdentity, error) {
 		return ExternalIdentity{
 			Provider:      "another-provider",
+			Issuer:        "https://provider.example.test",
 			Subject:       "subject-1",
 			Email:         "user@example.com",
 			EmailVerified: true,

package/templates/add/auth/internal/app/user/application/recovery.go.hbs

@@ -24,6 +24,9 @@ func NewRecovery(repo ports.UserRepository, tokens ports.RecoveryTokenStore, has
 // ResetPassword consumes the token and updates the local identity in one
 // unit of work. The token adapter owns the transaction boundary.
 func (r *Recovery) ResetPassword(ctx context.Context, tokenHash, newPassword string) (uuid.UUID, error) {
+	if err := validatePassword(newPassword); err != nil {
+		return uuid.Nil, err
+	}
 	hash, err := r.hasher.Hash(newPassword)
 	if err != nil {
 		return uuid.Nil, fmt.Errorf("hash password: %w", err)

package/templates/add/auth/internal/app/user/application/service.go.hbs

@@ -92,6 +92,17 @@ func normalizeEmail(email string) string {
 	return strings.ToLower(strings.TrimSpace(email))
 }
 
+// bcrypt accepts at most 72 bytes. Enforce the same bound in the application
+// layer so every caller (HTTP, seed, jobs, and future transports) gets the
+// same safe contract instead of a provider-specific hashing failure.
+func validatePassword(password string) error {
+	length := len([]byte(password))
+	if length < 8 || length > 72 {
+		return errInvalidPassword()
+	}
+	return nil
+}
+
 // SetRole validates the role against the role catalog before persisting it.
 func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string) (*domain.User, error) {
 	u, err := s.repo.FindByID(ctx, userID)
@@ -118,6 +129,11 @@ func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string
 // ServicePort is the inbound application boundary. HTTP, jobs, and future
 // transports depend on this capability set instead of the concrete service.
 type ServicePort interface {
+	ListIdentities(context.Context, uuid.UUID) ([]IdentityResponse, error)
+	LinkLocalIdentity(context.Context, uuid.UUID, string) error
+	BeginIdentityLink(context.Context, uuid.UUID, string, LoginStartInput) (*Authorization, error)
+	ExchangeIdentityLink(context.Context, uuid.UUID, string, LoginExchangeInput) (*IdentityResponse, error)
+	UnlinkIdentity(context.Context, uuid.UUID, string) error
 	// go-scaffold:service-interface
 	Register(context.Context, RegisterInput) (*AuthResult, error)
 	Login(context.Context, LoginInput) (*AuthResult, error)

package/templates/add/auth/internal/app/user/application/service_test.go.hbs

@@ -334,6 +334,7 @@ func (f *fakeMFAStore) ConsumeRecoveryCode(_ context.Context, userID uuid.UUID,
 type fakeRepo struct {
 	user              *domain.User
 	identity          *domain.Identity
+	identities        []domain.Identity
 	updateIdentityErr error
 	updateUserErr     error
 	failures          map[string]int
@@ -387,20 +388,61 @@ func (f *fakeRepo) UpdateUser(_ context.Context, u *domain.User) error {
 	return nil
 }
 func (f *fakeRepo) FindAll(context.Context, int, int) ([]domain.User, error) { return nil, nil }
-func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, _ domain.Provider) (*domain.Identity, error) {
-	if f.identity != nil && f.identity.UserID == userID {
+
+func (f *fakeRepo) FindIdentity(_ context.Context, userID uuid.UUID, provider domain.Provider) (*domain.Identity, error) {
+	for i := range f.identities {
+		if f.identities[i].UserID == userID && f.identities[i].Provider == provider {
+			copy := f.identities[i]
+			return &copy, nil
+		}
+	}
+	if f.identity != nil && f.identity.UserID == userID && f.identity.Provider == provider {
 		copy := *f.identity
 		return &copy, nil
 	}
 	return nil, domain.ErrNotFound
 }
-func (f *fakeRepo) FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error) {
+func (f *fakeRepo) ListIdentities(_ context.Context, userID uuid.UUID) ([]domain.Identity, error) {
+	out := make([]domain.Identity, 0, len(f.identities)+1)
+	for _, identity := range f.identities {
+		if identity.UserID == userID {
+			out = append(out, identity)
+		}
+	}
+	if f.identity != nil && f.identity.UserID == userID {
+		found := false
+		for _, identity := range out {
+			if identity.ID == f.identity.ID {
+				found = true
+				break
+			}
+		}
+		if !found {
+			out = append(out, *f.identity)
+		}
+	}
+	return out, nil
+}
+func (f *fakeRepo) FindIdentityByProviderUID(_ context.Context, issuer, providerUID string) (*domain.Identity, error) {
+	for i := range f.identities {
+		if f.identities[i].Issuer == issuer && f.identities[i].ProviderUID != nil && *f.identities[i].ProviderUID == providerUID {
+			copy := f.identities[i]
+			return &copy, nil
+		}
+	}
+	if f.identity != nil && f.identity.Issuer == issuer && f.identity.ProviderUID != nil && *f.identity.ProviderUID == providerUID {
+		copy := *f.identity
+		return &copy, nil
+	}
 	return nil, domain.ErrNotFound
 }
 func (f *fakeRepo) CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error {
 	return nil
 }
-func (f *fakeRepo) CreateIdentity(context.Context, *domain.Identity) error { return nil }
+func (f *fakeRepo) CreateIdentity(_ context.Context, identity *domain.Identity) error {
+	f.identities = append(f.identities, *identity)
+	return nil
+}
 func (f *fakeRepo) UpdateIdentity(_ context.Context, i *domain.Identity) error {
 	if f.updateIdentityErr != nil {
 		return f.updateIdentityErr
@@ -408,6 +450,35 @@ func (f *fakeRepo) UpdateIdentity(_ context.Context, i *domain.Identity) error {
 	f.identity = i
 	return nil
 }
+func (f *fakeRepo) DeleteIdentity(_ context.Context, userID uuid.UUID, provider domain.Provider) error {
+	count := 0
+	target := -1
+	for i := range f.identities {
+		if f.identities[i].UserID != userID {
+			continue
+		}
+		count++
+		if f.identities[i].Provider == provider {
+			target = i
+		}
+	}
+	legacyTarget := f.identity != nil && f.identity.UserID == userID && f.identity.Provider == provider
+	if legacyTarget {
+		count++
+	}
+	if target < 0 && !legacyTarget {
+		return domain.ErrNotFound
+	}
+	if count <= 1 {
+		return domain.ErrLastIdentity
+	}
+	if target >= 0 {
+		f.identities = append(f.identities[:target], f.identities[target+1:]...)
+	} else {
+		f.identity = nil
+	}
+	return nil
+}
 
 // go-scaffold:user-fake-repo-methods
 // go-scaffold:repository-stub-methods

package/templates/add/auth/internal/app/user/application/user_query.go.hbs

@@ -49,6 +49,9 @@ func (s *Service) EnsureUser(ctx context.Context, email, password, name string)
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return nil, fmt.Errorf("find existing user: %w", err)
 	}
+	if err := validatePassword(password); err != nil {
+		return nil, err
+	}
 
 	hash, err := s.passwords.Hash(password)
 	if err != nil {

package/templates/add/auth/internal/app/user/domain/entity.go.hbs

@@ -34,6 +34,7 @@ type Identity struct {
 	ID           uuid.UUID
 	UserID       uuid.UUID
 	Provider     Provider
+	Issuer       string
 	PasswordHash *string
 	ProviderUID  *string
 	CreatedAt    time.Time

package/templates/add/auth/internal/app/user/domain/errors.go.hbs

@@ -6,6 +6,7 @@ var (
 	ErrNotFound          = errors.New("user not found")
 	ErrConflict          = errors.New("user conflict")
 	ErrInvalidCredential = errors.New("invalid credentials")
+	ErrInvalidPassword   = errors.New("password must be between 8 and 72 bytes")
 	ErrInvalidToken      = errors.New("invalid or expired token")
 	ErrEmailTaken        = errors.New("email already registered")
 	ErrTooManyAttempts   = errors.New("too many failed attempts")
@@ -15,7 +16,9 @@ var (
 	ErrMFAAlreadyEnabled = errors.New("MFA is already enabled")
 	ErrMFANotEnrolled    = errors.New("MFA is not enrolled")
 	ErrMFASetupRequired  = errors.New("MFA setup is required")
-	ErrUnknownRole       = errors.New("unknown role")
+	ErrUnknownRole           = errors.New("unknown role")
+	ErrIdentityAlreadyLinked = errors.New("login identity is already linked")
+	ErrLastIdentity          = errors.New("cannot remove the last login identity")
 )
 
 type RuleError struct {

package/templates/add/auth/internal/app/user/ports/repository.go.hbs

@@ -16,10 +16,12 @@ type UserRepository interface {
 	UpdateUser(context.Context, *domain.User) error
 	FindAll(context.Context, int, int) ([]domain.User, error)
 	FindIdentity(context.Context, uuid.UUID, domain.Provider) (*domain.Identity, error)
-	FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error)
+	ListIdentities(context.Context, uuid.UUID) ([]domain.Identity, error)
+	FindIdentityByProviderUID(context.Context, string, string) (*domain.Identity, error)
 	CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error
 	CreateIdentity(context.Context, *domain.Identity) error
 	UpdateIdentity(context.Context, *domain.Identity) error
+	DeleteIdentity(context.Context, uuid.UUID, domain.Provider) error
 	LoginLockedUntil(context.Context, string) (time.Time, error)
 	RecordLoginFailure(context.Context, string, int, time.Duration) error
 	ClearLoginFailures(context.Context, string) error
@@ -65,6 +67,7 @@ type RefreshTokenStore interface {
 
 type LoginTransaction struct {
 	Provider      string    `json:"provider"`
+	UserID        uuid.UUID `json:"user_id"`
 	CodeChallenge string    `json:"code_challenge"`
 	Nonce         string    `json:"nonce"`
 	ExpiresAt     time.Time `json:"expires_at"`

package/templates/add/auth/internal/platform/authprovider/google/google.go.hbs

@@ -217,6 +217,7 @@ func (p *Provider) Complete(ctx context.Context, in application.LoginCompleteInp
 	}
 	return application.ExternalIdentity{
 		Provider:      p.Name(),
+		Issuer:        p.issuer,
 		Subject:       claims.Subject,
 		Email:         email,
 		EmailVerified: info.EmailVerified || claims.EmailVerified,

package/templates/add/auth/internal/shared/middleware/ratelimit_redis.go.hbs

@@ -26,7 +26,13 @@ func (r *RedisLimiter) Allow(ctx context.Context, key string, limit int, window
 		return true
 	}
 	if count == 1 {
-		r.rdb.Expire(ctx, redisKey, window)
+		if err := r.rdb.Expire(ctx, redisKey, window).Err(); err != nil {
+			// Never leave a counter without a TTL: an expired window must not
+			// become a permanent lockout after a transient Redis failure. The
+			// limiter is intentionally fail-open, so discard this best-effort
+			// counter and let the endpoint's own controls handle the request.
+			_ = r.rdb.Del(ctx, redisKey).Err()
+		}
 	}
 	return count <= int64(limit)
 }

package/templates/add/auth/migrations/create_external_identities.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.external_identities;

package/templates/add/auth/migrations/create_external_identities.up.sql.hbs

@@ -0,0 +1,12 @@
+CREATE TABLE user_svc.external_identities (
+    id          UUID PRIMARY KEY,
+    user_id     UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    provider    VARCHAR(50) NOT NULL,
+    issuer      TEXT NOT NULL,
+    subject     TEXT NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_external_identities_issuer_subject ON user_svc.external_identities (issuer, subject);
+CREATE UNIQUE INDEX idx_external_identities_user_provider ON user_svc.external_identities (user_id, provider);

package/templates/add/auth/migrations/create_password_credentials.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.password_credentials;