@nakedev/go-scaffold 0.5.3 → 0.5.4

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository.go.hbs

@@ -3,6 +3,8 @@ package postgres
 import (
 	"context"
 	"errors"
+	"sort"
+	"strings"
 	"time"
 
 	"{{goModule}}/internal/app/user/domain"
@@ -26,24 +28,52 @@ func NewRepository(db *gorm.DB) *Repository {
 }
 
 func (r *Repository) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
-	var row User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "email = ?", email).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var emailRow UserEmail
+	if err := db.Where("email_normalized = ?", normalizeEmail(email)).First(&emailRow).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainUser(&row), nil
+	return findUserWithEmail(db, emailRow.UserID, &emailRow)
 }
 
 func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
-	var row User
-	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "id = ?", id).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var emailRow UserEmail
+	if err := db.Where("user_id = ? AND is_primary = true", id).First(&emailRow).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainUser(&row), nil
+	return findUserWithEmail(db, id, &emailRow)
 }
 
 func (r *Repository) UpdateUser(ctx context.Context, user *domain.User) error {
-	row := fromDomainUser(user)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+	if user == nil || strings.TrimSpace(user.Email) == "" {
+		return errors.New("user email is required")
+	}
+	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
+		row := fromDomainUser(user)
+		if err := db.Save(&row).Error; err != nil {
+			return err
+		}
+
+		var emailRow UserEmail
+		err := db.Where("user_id = ? AND is_primary = true", user.ID).First(&emailRow).Error
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			emailRow = UserEmail{ID: uuid.New(), UserID: user.ID, IsPrimary: true}
+		} else if err != nil {
+			return err
+		}
+		emailRow.Email = strings.TrimSpace(user.Email)
+		emailRow.EmailNormalized = normalizeEmail(user.Email)
+		if user.EmailVerified {
+			if emailRow.VerifiedAt == nil {
+				now := time.Now()
+				emailRow.VerifiedAt = &now
+			}
+		} else {
+			emailRow.VerifiedAt = nil
+		}
+		return db.Save(&emailRow).Error
+	}))
 }
 
 func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.User, error) {
@@ -53,81 +83,137 @@ func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.U
 	if err != nil {
 		return nil, persistenceError(err)
 	}
+	ids := make([]uuid.UUID, len(rows))
+	for i := range rows {
+		ids[i] = rows[i].ID
+	}
+	var emailRows []UserEmail
+	if len(ids) > 0 {
+		if err := tx.From(ctx, r.db).WithContext(ctx).
+			Where("user_id IN ? AND is_primary = true", ids).Find(&emailRows).Error; err != nil {
+			return nil, persistenceError(err)
+		}
+	}
+	emails := make(map[uuid.UUID]*UserEmail, len(emailRows))
+	for i := range emailRows {
+		emails[emailRows[i].UserID] = &emailRows[i]
+	}
 	items := make([]domain.User, len(rows))
 	for i := range rows {
-		items[i] = *toDomainUser(&rows[i])
+		items[i] = *toDomainUserWithEmail(&rows[i], emails[rows[i].ID])
 	}
 	return items, nil
 }
 
 func (r *Repository) FindIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) (*domain.Identity, error) {
-	var row Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).
-		First(&row, "user_id = ? AND provider = ?", userID, string(provider)).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	if provider == domain.ProviderLocal {
+		var row PasswordCredential
+		if err := db.Where("user_id = ?", userID).First(&row).Error; err != nil {
+			return nil, persistenceError(err)
+		}
+		return toDomainPasswordIdentity(&row), nil
+	}
+	var row ExternalIdentity
+	if err := db.Where("user_id = ? AND provider = ?", userID, string(provider)).First(&row).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainIdentity(&row), nil
+	return toDomainExternalIdentity(&row), nil
 }
 
 func (r *Repository) ListIdentities(ctx context.Context, userID uuid.UUID) ([]domain.Identity, error) {
-	var rows []Identity
-	if err := tx.From(ctx, r.db).WithContext(ctx).
-		Where("user_id = ?", userID).
-		Order("created_at ASC, id ASC").Find(&rows).Error; err != nil {
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	var passwordRows []PasswordCredential
+	if err := db.Where("user_id = ?", userID).Find(&passwordRows).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	items := make([]domain.Identity, len(rows))
-	for i := range rows {
-		items[i] = *toDomainIdentity(&rows[i])
+	var externalRows []ExternalIdentity
+	if err := db.Where("user_id = ?", userID).Find(&externalRows).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	items := make([]domain.Identity, 0, len(passwordRows)+len(externalRows))
+	for i := range passwordRows {
+		items = append(items, *toDomainPasswordIdentity(&passwordRows[i]))
 	}
+	for i := range externalRows {
+		items = append(items, *toDomainExternalIdentity(&externalRows[i]))
+	}
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].CreatedAt.Equal(items[j].CreatedAt) {
+			return items[i].ID.String() < items[j].ID.String()
+		}
+		return items[i].CreatedAt.Before(items[j].CreatedAt)
+	})
 	return items, nil
 }
 
-func (r *Repository) FindIdentityByProviderUID(ctx context.Context, provider domain.Provider, providerUID string) (*domain.Identity, error) {
-	var row Identity
+func (r *Repository) FindIdentityByProviderUID(ctx context.Context, issuer, subject string) (*domain.Identity, error) {
+	var row ExternalIdentity
 	if err := tx.From(ctx, r.db).WithContext(ctx).
-		First(&row, "provider = ? AND provider_uid = ?", string(provider), providerUID).Error; err != nil {
+		First(&row, "issuer = ? AND subject = ?", issuer, subject).Error; err != nil {
 		return nil, persistenceError(err)
 	}
-	return toDomainIdentity(&row), nil
+	return toDomainExternalIdentity(&row), nil
 }
 
 // CreateIdentity links a new login method onto an existing user.
 func (r *Repository) CreateIdentity(ctx context.Context, identity *domain.Identity) error {
-	row := fromDomainIdentity(identity)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Create(&row).Error)
+	return persistenceError(createIdentity(tx.From(ctx, r.db).WithContext(ctx), identity))
 }
 
 func (r *Repository) UpdateIdentity(ctx context.Context, identity *domain.Identity) error {
-	row := fromDomainIdentity(identity)
-	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Save(&row).Error)
+	if identity == nil {
+		return errors.New("identity is required")
+	}
+	db := tx.From(ctx, r.db).WithContext(ctx)
+	if identity.Provider == domain.ProviderLocal {
+		if identity.PasswordHash == nil {
+			return errors.New("local identity password is required")
+		}
+		row := PasswordCredential{ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash, HashAlgorithm: "bcrypt", PasswordChangedAt: time.Now(), CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt}
+		return persistenceError(db.Save(&row).Error)
+	}
+	row, err := externalIdentityFromDomain(identity)
+	if err != nil {
+		return err
+	}
+	return persistenceError(db.Save(&row).Error)
 }
 
 // DeleteIdentity locks the user's identity rows before checking the count so
 // two concurrent unlink requests cannot both remove the last login method.
 func (r *Repository) DeleteIdentity(ctx context.Context, userID uuid.UUID, provider domain.Provider) error {
 	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
-		var rows []Identity
-		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).
-			Where("user_id = ?", userID).
-			Order("created_at ASC, id ASC").Find(&rows).Error; err != nil {
+		var user User
+		if err := db.Clauses(clause.Locking{Strength: "UPDATE"}).First(&user, "id = ?", userID).Error; err != nil {
 			return err
 		}
-
-		var target *Identity
-		for i := range rows {
-			if rows[i].Provider == string(provider) {
-				target = &rows[i]
-				break
-			}
+		var passwordCount, externalCount int64
+		if err := db.Model(&PasswordCredential{}).Where("user_id = ?", userID).Count(&passwordCount).Error; err != nil {
+			return err
 		}
-		if target == nil {
+		if err := db.Model(&ExternalIdentity{}).Where("user_id = ?", userID).Count(&externalCount).Error; err != nil {
+			return err
+		}
+		total := passwordCount + externalCount
+		if total == 0 {
 			return domain.ErrNotFound
 		}
-		if len(rows) <= 1 {
+		if total <= 1 {
 			return domain.ErrLastIdentity
 		}
-		return db.Delete(&Identity{}, "id = ? AND user_id = ?", target.ID, userID).Error
+		if provider == domain.ProviderLocal {
+			result := db.Where("user_id = ?", userID).Delete(&PasswordCredential{})
+			if result.Error == nil && result.RowsAffected == 0 {
+				return domain.ErrNotFound
+			}
+			return result.Error
+		}
+		result := db.Where("user_id = ? AND provider = ?", userID, string(provider)).Delete(&ExternalIdentity{})
+		if result.Error == nil && result.RowsAffected == 0 {
+			return domain.ErrNotFound
+		}
+		return result.Error
 	}))
 }
 
@@ -135,13 +221,23 @@ func (r *Repository) DeleteIdentity(ctx context.Context, userID uuid.UUID, provi
 // one transaction. A user without an identity cannot authenticate.
 func (r *Repository) CreateUserWithIdentity(ctx context.Context, user *domain.User, identity *domain.Identity) error {
 	userRow := fromDomainUser(user)
-	identityRow := fromDomainIdentity(identity)
 	return persistenceError(tx.From(ctx, r.db).WithContext(ctx).Transaction(func(db *gorm.DB) error {
 		if err := db.Create(&userRow).Error; err != nil {
 			return persistenceError(err)
 		}
-		identityRow.UserID = userRow.ID
-		return persistenceError(db.Create(&identityRow).Error)
+		verifiedAt := (*time.Time)(nil)
+		if user.EmailVerified {
+			now := time.Now()
+			verifiedAt = &now
+		}
+		if err := db.Create(&UserEmail{
+			ID: uuid.New(), UserID: userRow.ID, Email: strings.TrimSpace(user.Email),
+			EmailNormalized: normalizeEmail(user.Email), IsPrimary: true, VerifiedAt: verifiedAt,
+		}).Error; err != nil {
+			return persistenceError(err)
+		}
+		identity.UserID = userRow.ID
+		return persistenceError(createIdentity(db, identity))
 	}))
 }
 
@@ -194,16 +290,48 @@ func persistenceError(err error) error {
 	return err
 }
 
-func toDomainUser(row *User) *domain.User {
+func findUserWithEmail(db *gorm.DB, userID uuid.UUID, emailRow *UserEmail) (*domain.User, error) {
+	var row User
+	if err := db.First(&row, "id = ?", userID).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUserWithEmail(&row, emailRow), nil
+}
+
+func normalizeEmail(email string) string {
+	return strings.ToLower(strings.TrimSpace(email))
+}
+
+// toDomainUser is the one-row mapping hook used by generic generated method
+// extensions. It hydrates the primary email because auth stores addresses in
+// user_emails rather than on the profile row.
+//nolint:unused // generate method uses this seam when a custom user lookup is added.
+func (r *Repository) toDomainUser(ctx context.Context, row *User) (*domain.User, error) {
+	var emailRow UserEmail
+	if err := tx.From(ctx, r.db).WithContext(ctx).
+		Where("user_id = ? AND is_primary = true", row.ID).
+		First(&emailRow).Error; err != nil {
+		return nil, persistenceError(err)
+	}
+	return toDomainUserWithEmail(row, &emailRow), nil
+}
+
+func toDomainUserWithEmail(row *User, emailRow *UserEmail) *domain.User {
 	if row == nil {
 		return nil
 	}
+	var email string
+	var verified bool
+	if emailRow != nil {
+		email = emailRow.Email
+		verified = emailRow.VerifiedAt != nil
+	}
 	return &domain.User{
 		ID:            row.ID,
-		Email:         row.Email,
+		Email:         email,
 		Name:          row.Name,
 		AvatarURL:     row.AvatarURL,
-		EmailVerified: row.EmailVerified,
+		EmailVerified: verified,
 		Role:          row.Role,
 		CreatedAt:     row.CreatedAt,
 		UpdatedAt:     row.UpdatedAt,
@@ -212,42 +340,71 @@ func toDomainUser(row *User) *domain.User {
 
 func fromDomainUser(user *domain.User) User {
 	return User{
-		ID:            user.ID,
-		Email:         user.Email,
-		Name:          user.Name,
-		AvatarURL:     user.AvatarURL,
-		EmailVerified: user.EmailVerified,
-		Role:          user.Role,
+		ID:        user.ID,
+		Name:      user.Name,
+		AvatarURL: user.AvatarURL,
+		Role:      user.Role,
 		CreatedAt:     user.CreatedAt,
 		UpdatedAt:     user.UpdatedAt,
 	}
 }
 
-func toDomainIdentity(row *Identity) *domain.Identity {
+func toDomainPasswordIdentity(row *PasswordCredential) *domain.Identity {
 	if row == nil {
 		return nil
 	}
+	hash := row.PasswordHash
 	return &domain.Identity{
-		ID:           row.ID,
-		UserID:       row.UserID,
-		Provider:     domain.Provider(row.Provider),
-		PasswordHash: row.PasswordHash,
-		ProviderUID:  row.ProviderUID,
-		CreatedAt:    row.CreatedAt,
-		UpdatedAt:    row.UpdatedAt,
-	}
-}
-
-func fromDomainIdentity(identity *domain.Identity) Identity {
-	return Identity{
-		ID:           identity.ID,
-		UserID:       identity.UserID,
-		Provider:     string(identity.Provider),
-		PasswordHash: identity.PasswordHash,
-		ProviderUID:  identity.ProviderUID,
-		CreatedAt:    identity.CreatedAt,
-		UpdatedAt:    identity.UpdatedAt,
+		ID: row.ID, UserID: row.UserID, Provider: domain.ProviderLocal,
+		PasswordHash: &hash, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt,
+	}
+}
+
+
+func toDomainExternalIdentity(row *ExternalIdentity) *domain.Identity {
+	if row == nil {
+		return nil
+	}
+	subject := row.Subject
+	return &domain.Identity{
+		ID: row.ID, UserID: row.UserID, Provider: domain.Provider(row.Provider),
+		Issuer: row.Issuer, ProviderUID: &subject, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt,
+	}
+}
+
+func createIdentity(db *gorm.DB, identity *domain.Identity) error {
+	if identity == nil || identity.UserID == uuid.Nil || identity.ID == uuid.Nil {
+		return errors.New("identity id and user id are required")
+	}
+	if identity.Provider == domain.ProviderLocal {
+		if identity.PasswordHash == nil {
+			return errors.New("local identity password is required")
+		}
+		return db.Create(&PasswordCredential{
+			ID: identity.ID, UserID: identity.UserID, PasswordHash: *identity.PasswordHash,
+			HashAlgorithm: "bcrypt", PasswordChangedAt: time.Now(),
+			CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt,
+		}).Error
+	}
+	row, err := externalIdentityFromDomain(identity)
+	if err != nil {
+		return err
+	}
+	return db.Create(&row).Error
+}
+
+func externalIdentityFromDomain(identity *domain.Identity) (ExternalIdentity, error) {
+	if identity == nil || identity.ID == uuid.Nil || identity.UserID == uuid.Nil {
+		return ExternalIdentity{}, errors.New("identity id and user id are required")
+	}
+	if strings.TrimSpace(identity.Issuer) == "" || identity.ProviderUID == nil || strings.TrimSpace(*identity.ProviderUID) == "" {
+		return ExternalIdentity{}, errors.New("external identity issuer and subject are required")
 	}
+	return ExternalIdentity{
+		ID: identity.ID, UserID: identity.UserID, Provider: string(identity.Provider),
+		Issuer: identity.Issuer, Subject: *identity.ProviderUID,
+		CreatedAt: identity.CreatedAt, UpdatedAt: identity.UpdatedAt,
+	}, nil
 }
 
 // go-scaffold:repository-methods

package/templates/add/auth/internal/app/user/adapters/outbound/postgres/repository_test.go.hbs

@@ -60,31 +60,34 @@ func repositoryDBForTest(t *testing.T) *gorm.DB {
 	return tx
 }
 
+func stringPtr(value string) *string { return &value }
+
 // CreateUserWithIdentity's whole reason to be a transaction: a user that
 // exists with no way to log in is unreachable. If the identity insert fails,
 // the user it was meant to arrive with must vanish too — a function-backed
 // stub can't prove this, since it never runs a real insert against a real
 // constraint. This forces exactly that: the user insert succeeds (it's a
-// brand new row), but the identity insert collides with an existing Google
-// identity's provider_uid.
+// brand new row), but the identity insert collides with an existing external
+// identity's issuer/subject.
 func TestRepository_CreateUserWithIdentity_RollsBackBothOnIdentityConflict(t *testing.T) {
 	repo := NewRepository(repositoryDBForTest(t))
 	ctx := context.Background()
 
-	providerUID := "conflicting-provider-uid"
+	issuer := "https://accounts.google.com"
+	providerUID := "conflicting-provider-subject"
 	existing := &domain.User{ID: uuid.New(), Email: "first@example.com"}
 	if err := repo.CreateUserWithIdentity(ctx, existing, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
+		ID: uuid.New(), Provider: domain.ProviderGoogle, Issuer: issuer, ProviderUID: &providerUID,
 	}); err != nil {
 		t.Fatalf("seed existing user+identity: %v", err)
 	}
 
 	blocked := &domain.User{ID: uuid.New(), Email: "second@example.com"}
 	err := repo.CreateUserWithIdentity(ctx, blocked, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderGoogle, ProviderUID: &providerUID,
+		ID: uuid.New(), Provider: domain.ProviderGoogle, Issuer: issuer, ProviderUID: &providerUID,
 	})
 	if !errors.Is(err, domain.ErrConflict) {
-		t.Fatalf("want a mapped user conflict from the conflicting provider_uid, got %v", err)
+		t.Fatalf("want a mapped user conflict from the conflicting issuer/subject, got %v", err)
 	}
 
 	if _, findErr := repo.FindByID(ctx, blocked.ID); !errors.Is(findErr, domain.ErrNotFound) {
@@ -103,13 +106,13 @@ func TestRepository_CreateUserWithIdentity_DuplicateEmailIsDetectable(t *testing
 
 	email := "dup@example.com"
 	if err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderLocal,
+		ID: uuid.New(), Provider: domain.ProviderLocal, PasswordHash: stringPtr("hash-one"),
 	}); err != nil {
 		t.Fatalf("seed first user: %v", err)
 	}
 
 	err := repo.CreateUserWithIdentity(ctx, &domain.User{ID: uuid.New(), Email: email}, &domain.Identity{
-		ID: uuid.New(), Provider: domain.ProviderLocal,
+		ID: uuid.New(), Provider: domain.ProviderLocal, PasswordHash: stringPtr("hash-two"),
 	})
 	if !errors.Is(err, domain.ErrConflict) {
 		t.Fatalf("want a mapped user conflict for the reused email, got %v", err)

package/templates/add/auth/internal/app/user/application/errors.go.hbs

@@ -25,6 +25,10 @@ func errInvalidCredentials() error {
 	return domain.Rule("AUTH_INVALID_CREDENTIALS", "invalid email or password", domain.ErrInvalidCredential)
 }
 
+func errInvalidPassword() error {
+	return domain.Rule("AUTH_INVALID_PASSWORD", "password must be between 8 and 72 bytes", domain.ErrInvalidPassword)
+}
+
 func errInvalidToken() error {
 	return domain.Rule("AUTH_INVALID_TOKEN", "invalid or expired token", domain.ErrInvalidToken)
 }

package/templates/add/auth/internal/app/user/application/external_login.go.hbs

@@ -183,15 +183,15 @@ func mapProviderError(err error) error {
 // provider subject wins; only a verified external email may link to an
 // existing account.
 func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIdentity) (*domain.User, error) {
-	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
-		return nil, fmt.Errorf("external identity is missing provider, subject, or email")
+	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Issuer) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
+		return nil, fmt.Errorf("external identity is missing provider, issuer, subject, or email")
 	}
 	if len(info.Provider) > 20 {
 		return nil, fmt.Errorf("external identity provider name is too long")
 	}
 
 	provider := domain.Provider(info.Provider)
-	if ident, err := s.repo.FindIdentityByProviderUID(ctx, provider, info.Subject); err == nil {
+	if ident, err := s.repo.FindIdentityByProviderUID(ctx, info.Issuer, info.Subject); err == nil {
 		user, findErr := s.repo.FindByID(ctx, ident.UserID)
 		if findErr != nil {
 			return nil, fmt.Errorf("find user for existing identity: %w", findErr)
@@ -205,7 +205,7 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIde
 	email := normalizeEmail(info.Email)
 	if info.EmailVerified {
 		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
-			ident := &domain.Identity{ID: id.New(), UserID: u.ID, Provider: provider, ProviderUID: &providerUID}
+			ident := &domain.Identity{ID: id.New(), UserID: u.ID, Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID}
 			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
 				return nil, fmt.Errorf("link external identity: %w", err)
 			}
@@ -216,7 +216,7 @@ func (s *Service) findOrCreateExternalUser(ctx context.Context, info ExternalIde
 	}
 
 	u := &domain.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.AvatarURL, EmailVerified: info.EmailVerified, Role: domain.DefaultRole}
-	ident := &domain.Identity{ID: id.New(), Provider: provider, ProviderUID: &providerUID}
+	ident := &domain.Identity{ID: id.New(), Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID}
 	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
 		if errors.Is(err, domain.ErrConflict) {
 			return nil, errEmailTaken()

package/templates/add/auth/internal/app/user/application/identities.go.hbs

@@ -24,6 +24,41 @@ func (s *Service) ListIdentities(ctx context.Context, userID uuid.UUID) ([]Ident
 	return out, nil
 }
 
+// LinkLocalIdentity adds a password credential to an already authenticated
+// account. This is the supported Google/OIDC -> email/password path: it
+// creates a credential for the existing user instead of creating a second
+// account keyed by the same email address.
+func (s *Service) LinkLocalIdentity(ctx context.Context, userID uuid.UUID, password string) error {
+	if userID == uuid.Nil || strings.TrimSpace(password) == "" {
+		return fmt.Errorf("authenticated user and password are required")
+	}
+	if err := validatePassword(password); err != nil {
+		return err
+	}
+	if _, err := s.repo.FindByID(ctx, userID); err != nil {
+		return wrapFindErr(err)
+	}
+	if _, err := s.repo.FindIdentity(ctx, userID, domain.ProviderLocal); err == nil {
+		return errIdentityAlreadyLinked()
+	} else if !errors.Is(err, domain.ErrNotFound) {
+		return fmt.Errorf("check local identity: %w", err)
+	}
+
+	hash, err := s.passwords.Hash(password)
+	if err != nil {
+		return fmt.Errorf("hash password: %w", err)
+	}
+	hashStr := string(hash)
+	identity := &domain.Identity{ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &hashStr}
+	if err := s.repo.CreateIdentity(ctx, identity); err != nil {
+		if errors.Is(err, domain.ErrConflict) {
+			return errIdentityAlreadyLinked()
+		}
+		return fmt.Errorf("link local identity: %w", err)
+	}
+	return nil
+}
+
 func (s *Service) ExchangeIdentityLink(ctx context.Context, userID uuid.UUID, providerName string, in LoginExchangeInput) (*IdentityResponse, error) {
 	if userID == uuid.Nil {
 		return nil, NewOAuthError(OAuthStateInvalid, fmt.Errorf("authenticated user is required to link an identity"))
@@ -45,7 +80,10 @@ func (s *Service) linkExternalIdentity(ctx context.Context, userID uuid.UUID, in
 	// Replaying the same provider account from the same user is idempotent.
 	// A provider subject already owned by another user is a conflict and must
 	// never be silently moved between accounts.
-	if existing, err := s.repo.FindIdentityByProviderUID(ctx, provider, info.Subject); err == nil {
+	if strings.TrimSpace(info.Issuer) == "" {
+		return nil, NewOAuthError(OAuthFailed, fmt.Errorf("external identity issuer is missing"))
+	}
+	if existing, err := s.repo.FindIdentityByProviderUID(ctx, info.Issuer, info.Subject); err == nil {
 		if existing.UserID != userID {
 			return nil, errIdentityConflict()
 		}
@@ -65,7 +103,7 @@ func (s *Service) linkExternalIdentity(ctx context.Context, userID uuid.UUID, in
 
 	providerUID := info.Subject
 	identity := &domain.Identity{
-		ID: uuid.New(), UserID: userID, Provider: provider, ProviderUID: &providerUID,
+		ID: uuid.New(), UserID: userID, Provider: provider, Issuer: info.Issuer, ProviderUID: &providerUID,
 	}
 	if err := s.repo.CreateIdentity(ctx, identity); err != nil {
 		if errors.Is(err, domain.ErrConflict) {

package/templates/add/auth/internal/app/user/application/identities_test.go.hbs

@@ -28,6 +28,39 @@ func TestService_IdentityLinkBindsOAuthTransactionToCaller(t *testing.T) {
 	}
 }
 
+func TestService_LinkLocalIdentityAddsPasswordToExistingAccount(t *testing.T) {
+	userID := uuid.New()
+	repo := &fakeRepo{user: &domain.User{ID: userID, Email: "google@example.com"}}
+	svc := newTestService(repo, newFakeTokenStore())
+
+	if err := svc.LinkLocalIdentity(context.Background(), userID, "new-password"); err != nil {
+		t.Fatalf("link local identity: %v", err)
+	}
+	identity, err := repo.FindIdentity(context.Background(), userID, domain.ProviderLocal)
+	if err != nil {
+		t.Fatalf("find linked local identity: %v", err)
+	}
+	if identity.PasswordHash == nil || *identity.PasswordHash != "hashed:new-password" {
+		t.Fatalf("password was not hashed through the password port: %+v", identity)
+	}
+}
+
+func TestService_LinkLocalIdentityRejectsSecondPasswordCredential(t *testing.T) {
+	userID := uuid.New()
+	hash := "already-hashed"
+	repo := &fakeRepo{user: &domain.User{ID: userID, Email: "user@example.com"}}
+	repo.identities = append(repo.identities, domain.Identity{
+		ID: uuid.New(), UserID: userID, Provider: domain.ProviderLocal, PasswordHash: &hash,
+	})
+	svc := newTestService(repo, newFakeTokenStore())
+
+	err := svc.LinkLocalIdentity(context.Background(), userID, "another-password")
+	var ruleErr *domain.RuleError
+	if !errors.As(err, &ruleErr) || ruleErr.Code != "AUTH_IDENTITY_ALREADY_LINKED" {
+		t.Fatalf("link duplicate local identity error = %v, want AUTH_IDENTITY_ALREADY_LINKED", err)
+	}
+}
+
 func TestService_IdentityLinkIsIdempotentForSameProviderSubject(t *testing.T) {
 	provider, svc := validFakeProvider(t)
 	userID := uuid.New()

package/templates/add/auth/internal/app/user/application/local_auth.go.hbs

@@ -38,6 +38,9 @@ func (s *Service) throttled(ctx context.Context, key string) bool {
 }
 
 func (s *Service) Register(ctx context.Context, in RegisterInput) (*AuthResult, error) {
+	if err := validatePassword(in.Password); err != nil {
+		return nil, err
+	}
 	hash, err := s.passwords.Hash(in.Password)
 	if err != nil {
 		return nil, fmt.Errorf("hash password: %w", err)

package/templates/add/auth/internal/app/user/application/oauth.go.hbs

@@ -40,6 +40,7 @@ type LoginCompleteInput struct {
 // provider's stable subject identifier, never an email address.
 type ExternalIdentity struct {
 	Provider      string
+	Issuer        string
 	Subject       string
 	Email         string
 	EmailVerified bool

package/templates/add/auth/internal/app/user/application/provider_test.go.hbs

@@ -90,6 +90,7 @@ func validFakeProvider(t *testing.T) (*fakeLoginProvider, *Service) {
 		}
 		return ExternalIdentity{
 			Provider:      "fake",
+			Issuer:        "https://provider.example.test",
 			Subject:       "subject-1",
 			Email:         "user@example.com",
 			EmailVerified: true,
@@ -165,6 +166,7 @@ func TestService_ExchangeLoginRejectsIdentityFromAnotherProvider(t *testing.T) {
 	provider.completeFn = func(LoginCompleteInput) (ExternalIdentity, error) {
 		return ExternalIdentity{
 			Provider:      "another-provider",
+			Issuer:        "https://provider.example.test",
 			Subject:       "subject-1",
 			Email:         "user@example.com",
 			EmailVerified: true,