@nakedev/go-scaffold 0.5.3 → 0.5.4

package/README.md

@@ -478,6 +478,10 @@ Auth adds:
 - JWT access tokens and refresh-token rotation with reuse detection
 - registration, login, logout, refresh, password reset, and email verification
 - generic provider OAuth routes, with Google as the first adapter
+- account identity storage split into `users`, `user_emails`,
+  `password_credentials`, and `external_identities`; a Google-only user can
+  add a password through `POST /users/me/identities/local` without creating a
+  second account
 - failed-login lockout and user-session management
 - MFA endpoints and configuration hooks
 - internal/app/user, auth middleware, cmd/seed, migrations, and OpenAPI

package/dist/commands/auth.js

@@ -35,6 +35,7 @@ const AUTH_OPENAPI_PATHS = [
     { urlPath: "/auth/{provider}/exchange", file: "./auth/provider-exchange.yaml" },
     { urlPath: "/users/me", file: "./auth/users-me.yaml" },
     { urlPath: "/users/me/identities", file: "./auth/users-me-identities.yaml" },
+    { urlPath: "/users/me/identities/local", file: "./auth/users-me-identity-local-link.yaml" },
     { urlPath: "/users/me/identities/{provider}/link", file: "./auth/users-me-identity-link.yaml" },
     { urlPath: "/users/me/identities/{provider}/link/exchange", file: "./auth/users-me-identity-link-exchange.yaml" },
     { urlPath: "/users/me/identities/{provider}", file: "./auth/users-me-identity.yaml" },
@@ -48,8 +49,8 @@ const AUTH_OPENAPI_PATHS = [
     { urlPath: "/users/me/mfa/disable", file: "./auth/users-me-mfa-disable.yaml" },
     { urlPath: "/auth/mfa/verify", file: "./auth/mfa-verify.yaml" },
 ];
-// addAuth scaffolds email/password authentication: a users+identities model
-// pair, JWT access tokens, a selectable refresh token store with
+// addAuth scaffolds email/password authentication: an account plus separate
+// email, password-credential, and external-identity records, JWT access tokens, a selectable refresh token store with
 // rotation + reuse detection, register/login/refresh/logout/me, and
 // per-user session listing/revocation. No RBAC
 // (no roles/permissions) — that's a separate opt-in on top of this, since
@@ -90,20 +91,26 @@ async function addAuth(store = "postgres", projectDir = process.cwd(), browserTo
         { template: "add/auth/migrations/create_users.up.sql.hbs", output: path_1.default.join("migrations", `${usersVersion}_create_users.up.sql`) },
         { template: "add/auth/migrations/create_users.down.sql.hbs", output: path_1.default.join("migrations", `${usersVersion}_create_users.down.sql`) },
     ], {});
+    const emailVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+        { template: "add/auth/migrations/create_user_emails.up.sql.hbs", output: path_1.default.join("migrations", `${emailVersion}_create_user_emails.up.sql`) },
+        { template: "add/auth/migrations/create_user_emails.down.sql.hbs", output: path_1.default.join("migrations", `${emailVersion}_create_user_emails.down.sql`) },
+    ], {});
+    const passwordVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+        { template: "add/auth/migrations/create_password_credentials.up.sql.hbs", output: path_1.default.join("migrations", `${passwordVersion}_create_password_credentials.up.sql`) },
+        { template: "add/auth/migrations/create_password_credentials.down.sql.hbs", output: path_1.default.join("migrations", `${passwordVersion}_create_password_credentials.down.sql`) },
+    ], {});
+    const externalIdentityVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
+    await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
+        { template: "add/auth/migrations/create_external_identities.up.sql.hbs", output: path_1.default.join("migrations", `${externalIdentityVersion}_create_external_identities.up.sql`) },
+        { template: "add/auth/migrations/create_external_identities.down.sql.hbs", output: path_1.default.join("migrations", `${externalIdentityVersion}_create_external_identities.down.sql`) },
+    ], {});
     const mfaVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
     await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
         { template: "add/auth/migrations/create_mfa.up.sql.hbs", output: path_1.default.join("migrations", `${mfaVersion}_create_mfa.up.sql`) },
         { template: "add/auth/migrations/create_mfa.down.sql.hbs", output: path_1.default.join("migrations", `${mfaVersion}_create_mfa.down.sql`) },
     ], {});
-    // identities references users(id) — must apply strictly after it. A
-    // second newMigrationVersion() call, scanning the dir again now that the
-    // users pair is already written, guarantees a later (or same-second,
-    // bumped) timestamp rather than assuming +1 by hand.
-    const identitiesVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
-    await (0, template_renderer_1.applyTemplateEntries)(projectDir, [
-        { template: "add/auth/migrations/create_identities.up.sql.hbs", output: path_1.default.join("migrations", `${identitiesVersion}_create_identities.up.sql`) },
-        { template: "add/auth/migrations/create_identities.down.sql.hbs", output: path_1.default.join("migrations", `${identitiesVersion}_create_identities.down.sql`) },
-    ], {});
     // the failed-attempt counter is not a store choice — lockout has to survive a
     // deploy and mean the same thing on every replica whichever store holds tokens
     const throttleVersion = (0, migrations_1.newMigrationVersion)(migrationsDir);
@@ -185,7 +192,7 @@ async function addAuth(store = "postgres", projectDir = process.cwd(), browserTo
     console.log("registered POST /auth/{register,login,refresh,logout,forgot-password,reset-password,verify-email}, " +
         "GET /auth/{provider}/login, POST /auth/{provider}/exchange, GET /users/me, and " +
         "POST /users/me/{resend-verification,logout-all,mfa/setup,mfa/confirm,mfa/disable}, " +
-        "GET /users/me/{identities,sessions,mfa}, POST /users/me/identities/{provider}/{link,link/exchange}, " +
+        "GET /users/me/{identities,sessions,mfa}, POST /users/me/identities/local, POST /users/me/identities/{provider}/{link,link/exchange}, " +
         "DELETE /users/me/identities/{provider}, DELETE /users/me/sessions/{id}, " +
         "POST /auth/mfa/verify in cmd/api/wiring.go" +
         docsMessage);

package/dist/commands/method.js

@@ -84,6 +84,8 @@ async function generateHexagonalMethod(config, naming, methodNameArg, opts, proj
             ? {
                 repositoryModelType: "User",
                 repositoryToDomain: "toDomainUser",
+                repositoryToDomainCall: "r.toDomainUser(ctx, &row)",
+                repositoryToDomainCallReturnsError: true,
                 repositoryErrorMapper: "persistenceError",
                 repositoryStubReceiver: "f *fakeRepo",
                 handlerErrorMapper: "toHTTPError",

package/dist/utils/auth-patcher.js

@@ -122,6 +122,9 @@ function patchMainGoForAuth(mainGoPath, w) {
         'if cfg.IsProd() && cfg.JWTSecret == "dev-secret-change-me" {',
         '\treturn errors.New("JWT_SECRET is still the dev default — set a real secret before deploying with APP_ENV=production")',
         "}",
+        'if cfg.IsProd() && len([]byte(cfg.JWTSecret)) < 32 {',
+        '\treturn errors.New("JWT_SECRET must be at least 32 bytes before deploying with APP_ENV=production")',
+        "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, CONFIG_CHECKS_MARKER, checkBlock, "JWT_SECRET is still the dev default");
     // Without SMTP the mail client logs the message instead of sending it — a
@@ -164,7 +167,13 @@ function patchMainGoForAuth(mainGoPath, w) {
         "}",
     ].join("\n");
     content = (0, marker_patch_1.insertBeforeMarkerOnce)(content, SCHEMA_MARKER, schemaBlock, "CREATE SCHEMA IF NOT EXISTS user_svc");
-    const migrateLines = ["&usermodel.User{},", "&usermodel.Identity{},", "&usermodel.LoginThrottle{},"];
+    const migrateLines = [
+        "&usermodel.User{},",
+        "&usermodel.UserEmail{},",
+        "&usermodel.PasswordCredential{},",
+        "&usermodel.ExternalIdentity{},",
+        "&usermodel.LoginThrottle{},",
+    ];
     // Recovery tokens are always durable in Postgres, even when refresh tokens
     // live in Redis, so reset/verification can share the user transaction.
     migrateLines.push("&usermodel.AuthToken{},");

package/dist/utils/hexagonal-method-patcher.js

@@ -299,14 +299,25 @@ function patchHexagonalMethod(paths, naming, method, opts, goModule) {
         const column = (0, naming_1.toDbName)(opts.field);
         const modelType = paths.repositoryModelType ?? `${naming.pascalName}Model`;
         const toDomain = paths.repositoryToDomain ?? "toDomain";
+        const toDomainCall = paths.repositoryToDomainCall ?? `${toDomain}(&row)`;
+        const toDomainCallReturnsError = paths.repositoryToDomainCallReturnsError ?? false;
         const errorMapper = paths.repositoryErrorMapper ?? "mapDatabaseError";
+        const mapping = toDomainCallReturnsError
+            ? [
+                `\tm, err := ${toDomainCall}`,
+                `\tif err != nil {`,
+                `\t\treturn nil, ${errorMapper}(err)`,
+                `\t}`,
+                `\treturn m, nil`,
+            ]
+            : [`\treturn ${toDomainCall}, nil`];
         adapter = insert(adapter, REPOSITORY_METHODS_MARKER, [
             `func (r *Repository) FindBy${fieldPascal}(ctx context.Context, ${fieldParam} string) (*domain.${naming.pascalName}, error) {`,
             `\tvar row ${modelType}`,
             `\tif err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "${column} = ?", ${fieldParam}).Error; err != nil {`,
             `\t\treturn nil, ${errorMapper}(err)`,
             `\t}`,
-            `\treturn ${toDomain}(&row), nil`,
+            ...mapping,
             `}`,
             "",
         ].join("\n"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nakedev/go-scaffold",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Scaffold Gin + GORM + Postgres Go backend projects with a consistent domain-module standard",
   "repository": {
     "type": "git",

package/templates/add/auth/docs/schemas.yaml.hbs

@@ -3,7 +3,7 @@ RegisterInput:
   required: [email, password, name]
   properties:
     email: { type: string, format: email }
-    password: { type: string, format: password, minLength: 8 }
+    password: { type: string, format: password, minLength: 8, maxLength: 72 }
     name: { type: string }
 
 LoginInput:
@@ -11,7 +11,7 @@ LoginInput:
   required: [email, password]
   properties:
     email: { type: string, format: email }
-    password: { type: string, format: password }
+    password: { type: string, format: password, maxLength: 72 }
 
 ForgotPasswordInput:
   type: object
@@ -24,7 +24,7 @@ ResetPasswordInput:
   required: [token, new_password]
   properties:
     token: { type: string }
-    new_password: { type: string, format: password, minLength: 8 }
+    new_password: { type: string, format: password, minLength: 8, maxLength: 72 }
 
 VerifyEmailInput:
   type: object
@@ -168,3 +168,10 @@ IdentityLinkStartResponse:
   required: [authorization_url]
   properties:
     authorization_url: { type: string, format: uri }
+
+LocalIdentityLinkInput:
+  type: object
+  required: [password]
+  additionalProperties: false
+  properties:
+    password: { type: string, format: password, minLength: 8, maxLength: 72 }

package/templates/add/auth/docs/users-me-identity-local-link.yaml.hbs

@@ -0,0 +1,16 @@
+post:
+  summary: Add an email/password login to the current user
+  description: Creates a password credential for the authenticated account. It does not create another account, even when the account originally signed in with Google.
+  operationId: linkMyLocalIdentity
+  tags: [users]
+  security: [{ bearerAuth: [] }]
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema: { $ref: './schemas.yaml#/LocalIdentityLinkInput' }
+  responses:
+    "204": { description: email/password login linked }
+    "400": { $ref: '../common/responses.yaml#/ValidationError' }
+    "401": { $ref: '../common/responses.yaml#/UnauthorizedError' }
+    "409": { description: email/password login is already linked }

package/templates/add/auth/internal/app/user/adapters/inbound/http/dto.go.hbs

@@ -13,13 +13,13 @@ import (
 // transport-neutral inputs from handler mapping code.
 type registerInput struct {
 	Email    string `json:"email" binding:"required,email"`
-	Password string `json:"password" binding:"required,min=8"`
+	Password string `json:"password" binding:"required,min=8,max=72"`
 	Name     string `json:"name" binding:"required"`
 }
 
 type loginInput struct {
 	Email    string `json:"email" binding:"required,email"`
-	Password string `json:"password" binding:"required"`
+	Password string `json:"password" binding:"required,max=72"`
 }
 
 type loginExchangeInput struct {
@@ -62,7 +62,7 @@ type forgotPasswordInput struct {
 
 type resetPasswordInput struct {
 	Token       string `json:"token" binding:"required"`
-	NewPassword string `json:"new_password" binding:"required,min=8"`
+	NewPassword string `json:"new_password" binding:"required,min=8,max=72"`
 }
 
 type verifyEmailInput struct {
@@ -128,6 +128,10 @@ type identityLinkExchangeInput struct {
 	CodeVerifier string `json:"code_verifier" binding:"required"`
 }
 
+type localIdentityLinkInput struct {
+	Password string `json:"password" binding:"required,min=8,max=72"`
+}
+
 type identityLinkStartResponse struct {
 	AuthorizationURL string `json:"authorization_url"`
 }

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler.go.hbs

@@ -215,6 +215,8 @@ func toHTTPError(err error) error {
 			status = http.StatusNotFound
 		case "AUTH_INVALID_CREDENTIALS", "AUTH_INVALID_TOKEN", "AUTH_MFA_INVALID":
 			status = http.StatusUnauthorized
+		case "AUTH_INVALID_PASSWORD":
+			status = http.StatusBadRequest
 		case "AUTH_MFA_UNAVAILABLE":
 			status = http.StatusServiceUnavailable
 		case "AUTH_TOO_MANY_ATTEMPTS":

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_identity.go.hbs

@@ -14,11 +14,29 @@ import (
 // route file while the handler remains in the same inbound adapter package.
 func (h *Handler) registerIdentityRoutes(usersGroup gin.IRouter, linkLimiter gin.HandlerFunc) {
 	usersGroup.GET("/me/identities", h.listIdentities)
+	usersGroup.POST("/me/identities/local", linkLimiter, h.linkLocalIdentity)
 	usersGroup.POST("/me/identities/:provider/link", linkLimiter, h.beginIdentityLink)
 	usersGroup.POST("/me/identities/:provider/link/exchange", linkLimiter, h.exchangeIdentityLink)
 	usersGroup.DELETE("/me/identities/:provider", h.unlinkIdentity)
 }
 
+func (h *Handler) linkLocalIdentity(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in localIdentityLinkInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if err := h.svc.LinkLocalIdentity(c.Request.Context(), currentUserID(c), in.Password); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
 func (h *Handler) listIdentities(c *gin.Context) {
 	setNoStoreHeaders(c)
 	items, err := h.svc.ListIdentities(c.Request.Context(), currentUserID(c))
@@ -35,6 +53,9 @@ func (h *Handler) listIdentities(c *gin.Context) {
 
 func (h *Handler) beginIdentityLink(c *gin.Context) {
 	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
 	var in identityLinkStartInput
 	if err := c.ShouldBindJSON(&in); err != nil {
 		c.Error(httpx.BindErr(err))
@@ -50,6 +71,9 @@ func (h *Handler) beginIdentityLink(c *gin.Context) {
 
 func (h *Handler) exchangeIdentityLink(c *gin.Context) {
 	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
 	var in identityLinkExchangeInput
 	if err := c.ShouldBindJSON(&in); err != nil {
 		c.Error(h.oauthAppError(c.Param("provider"), userapp.NewOAuthError(userapp.OAuthFailed, err)))
@@ -72,6 +96,9 @@ func (h *Handler) identityLinkError(provider string, err error) error {
 }
 
 func (h *Handler) unlinkIdentity(c *gin.Context) {
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
 	if err := h.svc.UnlinkIdentity(c.Request.Context(), currentUserID(c), c.Param("provider")); err != nil {
 		c.Error(toHTTPError(err))
 		return

package/templates/add/auth/internal/app/user/adapters/inbound/http/handler_test.go.hbs

@@ -158,6 +158,7 @@ func TestHandler_SessionRoutesAreProtected(t *testing.T) {
 	router := newOAuthTestRouter(t)
 	for _, route := range []struct{ method, path string }{
 		{http.MethodGet, "/users/me/identities"},
+		{http.MethodPost, "/users/me/identities/local"},
 		{http.MethodPost, "/users/me/identities/fake/link"},
 		{http.MethodPost, "/users/me/identities/fake/link/exchange"},
 		{http.MethodDelete, "/users/me/identities/fake"},

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/mfa_store_test.go.hbs

@@ -53,7 +53,7 @@ func TestPostgresMFAStore_ConsumesChallengesAndRecoveryCodesOnce(t *testing.T) {
 	store := NewPostgresMFAStore(db)
 	ctx := context.Background()
 	userID := uuid.New()
-	if err := db.Create(&User{ID: userID, Email: "mfa-store-" + uuid.NewString() + "@example.com"}).Error; err != nil {
+	if err := db.Create(&User{ID: userID}).Error; err != nil {
 		t.Fatalf("create test user: %v", err)
 	}
 	t.Cleanup(func() { _ = db.Delete(&User{}, "id = ?", userID).Error })

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/model.go.hbs

@@ -9,29 +9,52 @@ import (
 )
 
 type User struct {
-	ID            uuid.UUID `gorm:"type:uuid;primaryKey"`
-	Email         string    `gorm:"uniqueIndex:idx_users_email;not null"`
-	Name          string
-	AvatarURL     string
-	EmailVerified bool
-	Role          string `gorm:"type:varchar(20);not null;default:'staff'"`
-	CreatedAt     time.Time
-	UpdatedAt     time.Time
+	ID        uuid.UUID `gorm:"type:uuid;primaryKey"`
+	Name      string
+	AvatarURL string
+	Role      string `gorm:"type:varchar(20);not null;default:'staff'"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 func (User) TableName() string { return "user_svc.users" }
 
-type Identity struct {
-	ID           uuid.UUID `gorm:"type:uuid;primaryKey"`
-	UserID       uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_identities_user_provider,priority:1"`
-	Provider     string    `gorm:"type:varchar(20);not null;uniqueIndex:idx_identities_user_provider,priority:2;uniqueIndex:idx_identities_provider_uid,priority:1"`
-	PasswordHash *string
-	ProviderUID  *string `gorm:"column:provider_uid;uniqueIndex:idx_identities_provider_uid,priority:2"`
-	CreatedAt    time.Time
-	UpdatedAt    time.Time
+type UserEmail struct {
+	ID              uuid.UUID  `gorm:"type:uuid;primaryKey"`
+	UserID          uuid.UUID  `gorm:"type:uuid;not null;index:idx_user_emails_user;uniqueIndex:idx_user_emails_primary,where:is_primary"`
+	Email           string     `gorm:"type:varchar(255);not null"`
+	EmailNormalized string     `gorm:"type:varchar(255);not null;uniqueIndex:idx_user_emails_normalized"`
+	IsPrimary       bool       `gorm:"not null;default:true"`
+	VerifiedAt      *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+func (UserEmail) TableName() string { return "user_svc.user_emails" }
+
+type PasswordCredential struct {
+	ID                  uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID              uuid.UUID `gorm:"type:uuid;not null;uniqueIndex:idx_password_credentials_user"`
+	PasswordHash        string    `gorm:"column:password_hash;type:text;not null"`
+	HashAlgorithm       string    `gorm:"type:varchar(32);not null;default:'bcrypt'"`
+	PasswordChangedAt   time.Time `gorm:"not null"`
+	CreatedAt           time.Time
+	UpdatedAt           time.Time
+}
+
+func (PasswordCredential) TableName() string { return "user_svc.password_credentials" }
+
+type ExternalIdentity struct {
+	ID        uuid.UUID `gorm:"type:uuid;primaryKey"`
+	UserID    uuid.UUID `gorm:"type:uuid;not null"`
+	Provider  string    `gorm:"type:varchar(50);not null;uniqueIndex:idx_external_identities_user_provider,priority:2"`
+	Issuer    string    `gorm:"type:text;not null;uniqueIndex:idx_external_identities_issuer_subject,priority:1"`
+	Subject   string    `gorm:"type:text;not null;uniqueIndex:idx_external_identities_issuer_subject,priority:2"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
-func (Identity) TableName() string { return "user_svc.identities" }
+func (ExternalIdentity) TableName() string { return "user_svc.external_identities" }
 
 type AuthToken struct {
 	TokenHash         string     `gorm:"primaryKey;type:text"`