@nakedev/go-scaffold 0.5.2 → 0.5.4

package/templates/add/auth/migrations/create_password_credentials.up.sql.hbs

@@ -0,0 +1,11 @@
+CREATE TABLE user_svc.password_credentials (
+    id                   UUID PRIMARY KEY,
+    user_id              UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    password_hash        TEXT NOT NULL,
+    hash_algorithm       VARCHAR(32) NOT NULL DEFAULT 'bcrypt',
+    password_changed_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    created_at           TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at           TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_password_credentials_user ON user_svc.password_credentials (user_id);

package/templates/add/auth/migrations/create_user_emails.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.user_emails;

package/templates/add/auth/migrations/create_user_emails.up.sql.hbs

@@ -0,0 +1,14 @@
+CREATE TABLE user_svc.user_emails (
+    id              UUID PRIMARY KEY,
+    user_id         UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    email           VARCHAR(255) NOT NULL,
+    email_normalized VARCHAR(255) NOT NULL,
+    is_primary      BOOLEAN NOT NULL DEFAULT true,
+    verified_at     TIMESTAMPTZ,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_user_emails_normalized ON user_svc.user_emails (email_normalized);
+CREATE UNIQUE INDEX idx_user_emails_primary ON user_svc.user_emails (user_id) WHERE is_primary;
+CREATE INDEX idx_user_emails_user ON user_svc.user_emails (user_id);

package/templates/add/auth/migrations/create_users.up.sql.hbs

@@ -2,20 +2,9 @@ CREATE SCHEMA IF NOT EXISTS user_svc;
 
 CREATE TABLE user_svc.users (
     id             UUID PRIMARY KEY,
-    email          VARCHAR(255) NOT NULL,
     name           VARCHAR(255) NOT NULL DEFAULT '',
     avatar_url     TEXT NOT NULL DEFAULT '',
-    email_verified BOOLEAN NOT NULL DEFAULT false,
     role           VARCHAR(20) NOT NULL DEFAULT 'staff',
     created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
 );
-
--- A unique INDEX, not an inline UNIQUE constraint, and named to match the
--- `uniqueIndex:idx_users_email` tag on the outbound persistence model exactly. Postgres names an
--- inline UNIQUE "users_email_key"; the development bootstrap then sees
--- uniqueness it didn't create and tries to drop it under its own
--- name, which fails the boot with
---   constraint "uni_users_email" of relation "users" does not exist
--- for anyone who ran `make migrate-up` first — which `add rbac` tells you to.
-CREATE UNIQUE INDEX idx_users_email ON user_svc.users (email);

package/templates/create/base/.claude/skills/go-scaffold/SKILL.md.hbs

@@ -260,6 +260,15 @@ boundary. For browser OAuth, preserve this client-owned callback contract:
   `Pragma: no-cache`.
   Never accept a request-supplied redirect destination or place an access token,
   refresh token, authorization code, or state in a URI.
+- Authenticated identity management is a separate account flow, not another
+  login endpoint: list safe metadata at `GET /users/me/identities`, start and
+  finish linking at `POST /users/me/identities/:provider/link` and
+  `POST /users/me/identities/:provider/link/exchange`, and unlink with
+  `DELETE /users/me/identities/:provider`. Bind the server-side transaction to
+  the caller's user ID, never issue or replace a session during link exchange,
+  keep one identity per provider per user, and reject unlinking the last login
+  method. Provider subjects and password hashes must never cross the HTTP
+  boundary.
 - Map provider and validation failures to controlled public codes only:
   `oauth_denied`, `oauth_state_invalid`, `oauth_provider_unavailable`, and
   `oauth_failed`. Do not expose raw provider descriptions or technical causes.

package/templates/create/base/AGENTS.md.hbs

@@ -186,6 +186,20 @@ approval before changing their contract.
   rotation; responses expose only User-Agent and lifecycle timestamps, never
   refresh tokens or token hashes. The current access token carries the session
   ID as `sid` so the adapter can mark the current device.
+- Authenticated users can manage login identities through
+  `GET /users/me/identities`, `POST /users/me/identities/local`, and
+  `POST /users/me/identities/:provider/link`,
+  `POST /users/me/identities/:provider/link/exchange`, and
+  `DELETE /users/me/identities/:provider`. The link transaction is bound to
+  the current user as well as provider/state/PKCE/nonce; it can never create a
+  session or silently move a provider account between users. Return only safe
+  provider metadata, allow at most one identity per provider per user, and
+  refuse to unlink the last remaining login method.
+- Auth persistence keeps account profile, email addresses, password
+  credentials, and external provider identities in separate tables. Resolve an
+  external login by `(issuer, subject)`; never use an email address as the
+  provider identity key. Adding a password to a Google/OIDC account must write
+  a password credential for that existing user.
 - Password reset and email verification consume a one-time token in the same
   retry-safe transaction as the user/identity update. A failed post-commit
   session revocation must not make a successful reset impossible to retry.

package/templates/create/base/README.md.hbs

@@ -198,6 +198,13 @@ Authenticated users can list active device sessions with
 `GET /users/me/sessions` and revoke an individual session with
 `DELETE /users/me/sessions/:id`; only User-Agent and session lifecycle
 timestamps are returned.
+They can also list safe login-provider metadata with
+`GET /users/me/identities`, link a provider through the authenticated
+`/users/me/identities/:provider/link` start/exchange flow, and unlink a
+provider with `DELETE /users/me/identities/:provider`. For a Google/OIDC-only
+account, `POST /users/me/identities/local` adds an email/password credential to
+the same account; it does not create a second user. The last login method
+cannot be removed.
 For `cross-site`, configure HTTPS origins, `COOKIE_SAMESITE=none`,
 `COOKIE_SECURE=true`, and an exact allowed Origin; the API applies an Origin
 guard independently of CORS.

package/templates/create/features/docs/architecture.md.hbs

@@ -60,7 +60,7 @@ internal/
 ```
 
 Installed process and platform additions:
-{{#if auth}}- `cmd/seed` and `platform/authprovider/google/` for user bootstrap and Google OAuth/OIDC
+{{#if auth}}- `cmd/seed` and `platform/authprovider/google/` for user bootstrap, Google OAuth/OIDC login, and authenticated identity linking
 {{/if}}{{#if worker}}- `cmd/worker` and `platform/{mail,queue}/` for queue/SMTP jobs{{#if (eq queue "asynq")}}, plus `platform/cache/` for Redis{{/if}}
 {{/if}}{{#if observability}}- `platform/telemetry/` for the OTLP exporter
 {{/if}}{{#if rbac}}- `shared/middleware/authz.go` and `app/role/` for RBAC policy
@@ -73,10 +73,10 @@ a real external system.
 add a `shared/utils` or similarly generic package — name it after what it
 actually does.
 
-Optional feature boundaries are explicit: auth owns user authentication and
-provider ports; RBAC owns role policy and authorization; worker owns queue and
-mail adapters; observability owns metrics/tracing setup. They do not create a
-second domain architecture.
+Optional feature boundaries are explicit: auth owns user authentication,
+identity linking, and provider ports; RBAC owns role policy and authorization;
+worker owns queue and mail adapters; observability owns metrics/tracing setup.
+They do not create a second domain architecture.
 
 ## 3. API Style
 

package/templates/create/features/docs/techstack.md.hbs

@@ -15,7 +15,7 @@
 | Logging | `log/slog`, JSON handler |
 | Migrations | [golang-migrate](https://github.com/golang-migrate/migrate) |
 | Testing | stdlib `testing`, real Postgres for integration tests |
-| Authentication | {{#if auth}}JWT access/refresh sessions, password recovery, email verification, provider login, and MFA{{else}}optional via `go-scaffold add auth`{{/if}} |
+| Authentication | {{#if auth}}JWT access/refresh sessions, password recovery, email verification, provider login/linking, and MFA{{else}}optional via `go-scaffold add auth`{{/if}} |
 | Authorization | {{#if rbac}}RBAC role/permission middleware{{else}}optional RBAC via `go-scaffold add rbac`{{/if}} |
 | Background jobs | {{#if worker}}{{queue}} queue backend with SMTP mail and `cmd/worker`{{else}}optional via `go-scaffold add worker`{{/if}} |
 

package/templates/add/auth/migrations/create_identities.down.sql.hbs

@@ -1 +0,0 @@
-DROP TABLE IF EXISTS user_svc.identities;

package/templates/add/auth/migrations/create_identities.up.sql.hbs

@@ -1,15 +0,0 @@
-CREATE TABLE user_svc.identities (
-    id            UUID PRIMARY KEY,
-    user_id       UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
-    provider      VARCHAR(20) NOT NULL,
-    password_hash TEXT,
-    provider_uid  TEXT,
-    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
--- Named unique indexes matching model.Identity's own
--- `uniqueIndex:idx_identities_*` tags — see create_users.up.sql for why an
--- anonymous UNIQUE constraint breaks schema parity.
-CREATE UNIQUE INDEX idx_identities_user_provider ON user_svc.identities (user_id, provider);
-CREATE UNIQUE INDEX idx_identities_provider_uid ON user_svc.identities (provider, provider_uid);