@nakedev/go-scaffold 0.5.3 → 0.5.5

package/templates/add/auth/internal/app/user/application/recovery.go.hbs

@@ -24,6 +24,9 @@ func NewRecovery(repo ports.UserRepository, tokens ports.RecoveryTokenStore, has
 // ResetPassword consumes the token and updates the local identity in one
 // unit of work. The token adapter owns the transaction boundary.
 func (r *Recovery) ResetPassword(ctx context.Context, tokenHash, newPassword string) (uuid.UUID, error) {
+	if err := validatePassword(newPassword); err != nil {
+		return uuid.Nil, err
+	}
 	hash, err := r.hasher.Hash(newPassword)
 	if err != nil {
 		return uuid.Nil, fmt.Errorf("hash password: %w", err)

package/templates/add/auth/internal/app/user/application/service.go.hbs

@@ -92,6 +92,17 @@ func normalizeEmail(email string) string {
 	return strings.ToLower(strings.TrimSpace(email))
 }
 
+// bcrypt accepts at most 72 bytes. Enforce the same bound in the application
+// layer so every caller (HTTP, seed, jobs, and future transports) gets the
+// same safe contract instead of a provider-specific hashing failure.
+func validatePassword(password string) error {
+	length := len([]byte(password))
+	if length < 8 || length > 72 {
+		return errInvalidPassword()
+	}
+	return nil
+}
+
 // SetRole validates the role against the role catalog before persisting it.
 func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string) (*domain.User, error) {
 	u, err := s.repo.FindByID(ctx, userID)
@@ -119,6 +130,7 @@ func (s *Service) SetRole(ctx context.Context, userID uuid.UUID, roleCode string
 // transports depend on this capability set instead of the concrete service.
 type ServicePort interface {
 	ListIdentities(context.Context, uuid.UUID) ([]IdentityResponse, error)
+	LinkLocalIdentity(context.Context, uuid.UUID, string) error
 	BeginIdentityLink(context.Context, uuid.UUID, string, LoginStartInput) (*Authorization, error)
 	ExchangeIdentityLink(context.Context, uuid.UUID, string, LoginExchangeInput) (*IdentityResponse, error)
 	UnlinkIdentity(context.Context, uuid.UUID, string) error

package/templates/add/auth/internal/app/user/application/service_test.go.hbs

@@ -423,14 +423,14 @@ func (f *fakeRepo) ListIdentities(_ context.Context, userID uuid.UUID) ([]domain
 	}
 	return out, nil
 }
-func (f *fakeRepo) FindIdentityByProviderUID(_ context.Context, provider domain.Provider, providerUID string) (*domain.Identity, error) {
+func (f *fakeRepo) FindIdentityByProviderUID(_ context.Context, issuer, providerUID string) (*domain.Identity, error) {
 	for i := range f.identities {
-		if f.identities[i].Provider == provider && f.identities[i].ProviderUID != nil && *f.identities[i].ProviderUID == providerUID {
+		if f.identities[i].Issuer == issuer && f.identities[i].ProviderUID != nil && *f.identities[i].ProviderUID == providerUID {
 			copy := f.identities[i]
 			return &copy, nil
 		}
 	}
-	if f.identity != nil && f.identity.Provider == provider && f.identity.ProviderUID != nil && *f.identity.ProviderUID == providerUID {
+	if f.identity != nil && f.identity.Issuer == issuer && f.identity.ProviderUID != nil && *f.identity.ProviderUID == providerUID {
 		copy := *f.identity
 		return &copy, nil
 	}

package/templates/add/auth/internal/app/user/application/user_query.go.hbs

@@ -49,6 +49,9 @@ func (s *Service) EnsureUser(ctx context.Context, email, password, name string)
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return nil, fmt.Errorf("find existing user: %w", err)
 	}
+	if err := validatePassword(password); err != nil {
+		return nil, err
+	}
 
 	hash, err := s.passwords.Hash(password)
 	if err != nil {

package/templates/add/auth/internal/app/user/domain/entity.go.hbs

@@ -34,6 +34,7 @@ type Identity struct {
 	ID           uuid.UUID
 	UserID       uuid.UUID
 	Provider     Provider
+	Issuer       string
 	PasswordHash *string
 	ProviderUID  *string
 	CreatedAt    time.Time

package/templates/add/auth/internal/app/user/domain/errors.go.hbs

@@ -6,6 +6,7 @@ var (
 	ErrNotFound          = errors.New("user not found")
 	ErrConflict          = errors.New("user conflict")
 	ErrInvalidCredential = errors.New("invalid credentials")
+	ErrInvalidPassword   = errors.New("password must be between 8 and 72 bytes")
 	ErrInvalidToken      = errors.New("invalid or expired token")
 	ErrEmailTaken        = errors.New("email already registered")
 	ErrTooManyAttempts   = errors.New("too many failed attempts")

package/templates/add/auth/internal/app/user/ports/repository.go.hbs

@@ -17,7 +17,7 @@ type UserRepository interface {
 	FindAll(context.Context, int, int) ([]domain.User, error)
 	FindIdentity(context.Context, uuid.UUID, domain.Provider) (*domain.Identity, error)
 	ListIdentities(context.Context, uuid.UUID) ([]domain.Identity, error)
-	FindIdentityByProviderUID(context.Context, domain.Provider, string) (*domain.Identity, error)
+	FindIdentityByProviderUID(context.Context, string, string) (*domain.Identity, error)
 	CreateUserWithIdentity(context.Context, *domain.User, *domain.Identity) error
 	CreateIdentity(context.Context, *domain.Identity) error
 	UpdateIdentity(context.Context, *domain.Identity) error

package/templates/add/auth/internal/platform/authprovider/google/google.go.hbs

@@ -217,6 +217,7 @@ func (p *Provider) Complete(ctx context.Context, in application.LoginCompleteInp
 	}
 	return application.ExternalIdentity{
 		Provider:      p.Name(),
+		Issuer:        p.issuer,
 		Subject:       claims.Subject,
 		Email:         email,
 		EmailVerified: info.EmailVerified || claims.EmailVerified,

package/templates/add/auth/internal/shared/middleware/ratelimit_redis.go.hbs

@@ -26,7 +26,13 @@ func (r *RedisLimiter) Allow(ctx context.Context, key string, limit int, window
 		return true
 	}
 	if count == 1 {
-		r.rdb.Expire(ctx, redisKey, window)
+		if err := r.rdb.Expire(ctx, redisKey, window).Err(); err != nil {
+			// Never leave a counter without a TTL: an expired window must not
+			// become a permanent lockout after a transient Redis failure. The
+			// limiter is intentionally fail-open, so discard this best-effort
+			// counter and let the endpoint's own controls handle the request.
+			_ = r.rdb.Del(ctx, redisKey).Err()
+		}
 	}
 	return count <= int64(limit)
 }

package/templates/add/auth/migrations/create_external_identities.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.external_identities;

package/templates/add/auth/migrations/create_external_identities.up.sql.hbs

@@ -0,0 +1,12 @@
+CREATE TABLE user_svc.external_identities (
+    id          UUID PRIMARY KEY,
+    user_id     UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    provider    VARCHAR(50) NOT NULL,
+    issuer      TEXT NOT NULL,
+    subject     TEXT NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_external_identities_issuer_subject ON user_svc.external_identities (issuer, subject);
+CREATE UNIQUE INDEX idx_external_identities_user_provider ON user_svc.external_identities (user_id, provider);

package/templates/add/auth/migrations/create_password_credentials.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.password_credentials;

package/templates/add/auth/migrations/create_password_credentials.up.sql.hbs

@@ -0,0 +1,11 @@
+CREATE TABLE user_svc.password_credentials (
+    id                   UUID PRIMARY KEY,
+    user_id              UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    password_hash        TEXT NOT NULL,
+    hash_algorithm       VARCHAR(32) NOT NULL DEFAULT 'bcrypt',
+    password_changed_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    created_at           TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at           TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_password_credentials_user ON user_svc.password_credentials (user_id);

package/templates/add/auth/migrations/create_user_emails.down.sql.hbs

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS user_svc.user_emails;

package/templates/add/auth/migrations/create_user_emails.up.sql.hbs

@@ -0,0 +1,14 @@
+CREATE TABLE user_svc.user_emails (
+    id              UUID PRIMARY KEY,
+    user_id         UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    email           VARCHAR(255) NOT NULL,
+    email_normalized VARCHAR(255) NOT NULL,
+    is_primary      BOOLEAN NOT NULL DEFAULT true,
+    verified_at     TIMESTAMPTZ,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX idx_user_emails_normalized ON user_svc.user_emails (email_normalized);
+CREATE UNIQUE INDEX idx_user_emails_primary ON user_svc.user_emails (user_id) WHERE is_primary;
+CREATE INDEX idx_user_emails_user ON user_svc.user_emails (user_id);

package/templates/add/auth/migrations/create_users.up.sql.hbs

@@ -2,20 +2,9 @@ CREATE SCHEMA IF NOT EXISTS user_svc;
 
 CREATE TABLE user_svc.users (
     id             UUID PRIMARY KEY,
-    email          VARCHAR(255) NOT NULL,
     name           VARCHAR(255) NOT NULL DEFAULT '',
     avatar_url     TEXT NOT NULL DEFAULT '',
-    email_verified BOOLEAN NOT NULL DEFAULT false,
     role           VARCHAR(20) NOT NULL DEFAULT 'staff',
     created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
 );
-
--- A unique INDEX, not an inline UNIQUE constraint, and named to match the
--- `uniqueIndex:idx_users_email` tag on the outbound persistence model exactly. Postgres names an
--- inline UNIQUE "users_email_key"; the development bootstrap then sees
--- uniqueness it didn't create and tries to drop it under its own
--- name, which fails the boot with
---   constraint "uni_users_email" of relation "users" does not exist
--- for anyone who ran `make migrate-up` first — which `add rbac` tells you to.
-CREATE UNIQUE INDEX idx_users_email ON user_svc.users (email);

package/templates/add/rbac/internal/app/role/adapters/inbound/http/dto.go.hbs

@@ -0,0 +1,52 @@
+package httpadapter
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/role/application"
+)
+
+// Request DTOs belong to the inbound adapter. Keep JSON names and binding
+// tags out of application inputs so role use cases remain transport-neutral.
+type createInput struct {
+	Code string `json:"code"`
+	Name string `json:"name"`
+}
+
+func toCreateInput(in createInput) application.CreateInput {
+	return application.CreateInput{Code: in.Code, Name: in.Name}
+}
+
+type setPermissionsInput struct {
+	PermissionCodes *[]string `json:"permission_codes"`
+}
+
+func toSetPermissionsInput(in setPermissionsInput) application.SetPermissionsInput {
+	return application.SetPermissionsInput{PermissionCodes: in.PermissionCodes}
+}
+
+// Response DTOs belong to the inbound adapter too. Application responses are
+// deliberately free of JSON tags and are mapped explicitly before encoding.
+type roleResponse struct {
+	Code        string    `json:"code"`
+	Name        string    `json:"name"`
+	IsSystem    bool      `json:"is_system"`
+	Permissions []string  `json:"permissions"`
+	CreatedAt   time.Time `json:"created_at"`
+}
+
+func toRoleResponse(out application.RoleResponse) roleResponse {
+	return roleResponse{
+		Code: out.Code, Name: out.Name, IsSystem: out.IsSystem,
+		Permissions: out.Permissions, CreatedAt: out.CreatedAt,
+	}
+}
+
+type permissionResponse struct {
+	Code        string `json:"code"`
+	Description string `json:"description"`
+}
+
+func toPermissionResponse(out application.PermissionResponse) permissionResponse {
+	return permissionResponse{Code: out.Code, Description: out.Description}
+}

package/templates/add/rbac/internal/app/role/adapters/inbound/http/handler.go.hbs

@@ -45,44 +45,45 @@ func (h *Handler) list(c *gin.Context) {
 		c.Error(toHTTPError(err))
 		return
 	}
-	out := make([]application.RoleResponse, len(items))
+	out := make([]roleResponse, len(items))
 	for i := range items {
-		out[i] = application.ToRoleResponse(items[i])
+		out[i] = toRoleResponse(application.ToRoleResponse(items[i]))
 	}
 	c.JSON(http.StatusOK, p.Response(out))
 }
 
 func (h *Handler) create(c *gin.Context) {
-	var in application.CreateInput
+	var in createInput
 	if err := c.ShouldBindJSON(&in); err != nil {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	item, err := h.svc.Create(c.Request.Context(), in)
+	item, err := h.svc.Create(c.Request.Context(), toCreateInput(in))
 	if err != nil {
 		c.Error(toHTTPError(err))
 		return
 	}
-	c.JSON(http.StatusCreated, application.ToRoleResponse(*item))
+	c.JSON(http.StatusCreated, toRoleResponse(application.ToRoleResponse(*item)))
 }
 
 func (h *Handler) setPermissions(c *gin.Context) {
-	var in application.SetPermissionsInput
+	var in setPermissionsInput
 	if err := c.ShouldBindJSON(&in); err != nil {
 		c.Error(httpx.BindErr(err))
 		return
 	}
-	if in.PermissionCodes == nil {
+	appInput := toSetPermissionsInput(in)
+	if appInput.PermissionCodes == nil {
 		c.Error(apperror.NewValidation("invalid role input", map[string]string{"permission_codes": "is required"}))
 		return
 	}
-	item, err := h.svc.SetPermissions(c.Request.Context(), c.Param("code"), *in.PermissionCodes)
+	item, err := h.svc.SetPermissions(c.Request.Context(), c.Param("code"), *appInput.PermissionCodes)
 	if err != nil {
 		c.Error(toHTTPError(err))
 		return
 	}
 	h.authz.Invalidate(item.Role.Code)
-	c.JSON(http.StatusOK, application.ToRoleResponse(*item))
+	c.JSON(http.StatusOK, toRoleResponse(application.ToRoleResponse(*item)))
 }
 
 func (h *Handler) delete(c *gin.Context) {
@@ -101,9 +102,9 @@ func (h *Handler) listPermissions(c *gin.Context) {
 		c.Error(toHTTPError(err))
 		return
 	}
-	out := make([]application.PermissionResponse, len(items))
+	out := make([]permissionResponse, len(items))
 	for i := range items {
-		out[i] = application.ToPermissionResponse(items[i])
+		out[i] = toPermissionResponse(application.ToPermissionResponse(items[i]))
 	}
 	c.JSON(http.StatusOK, p.Response(out))
 }

package/templates/add/rbac/internal/app/role/application/dto.go.hbs

@@ -9,12 +9,12 @@ import (
 const PermRoleManage = "role:manage"
 
 type CreateInput struct {
-	Code string `json:"code"`
-	Name string `json:"name"`
+	Code string
+	Name string
 }
 
 type SetPermissionsInput struct {
-	PermissionCodes *[]string `json:"permission_codes"`
+	PermissionCodes *[]string
 }
 
 type RoleListItem struct {
@@ -23,16 +23,16 @@ type RoleListItem struct {
 }
 
 type RoleResponse struct {
-	Code        string    `json:"code"`
-	Name        string    `json:"name"`
-	IsSystem    bool      `json:"is_system"`
-	Permissions []string  `json:"permissions"`
-	CreatedAt   time.Time `json:"created_at"`
+	Code        string
+	Name        string
+	IsSystem    bool
+	Permissions []string
+	CreatedAt   time.Time
 }
 
 type PermissionResponse struct {
-	Code        string `json:"code"`
-	Description string `json:"description"`
+	Code        string
+	Description string
 }
 
 func ToRoleResponse(item RoleListItem) RoleResponse {

package/templates/create/base/AGENTS.md.hbs

@@ -187,13 +187,19 @@ approval before changing their contract.
   refresh tokens or token hashes. The current access token carries the session
   ID as `sid` so the adapter can mark the current device.
 - Authenticated users can manage login identities through
-  `GET /users/me/identities`, `POST /users/me/identities/:provider/link`,
+  `GET /users/me/identities`, `POST /users/me/identities/local`, and
+  `POST /users/me/identities/:provider/link`,
   `POST /users/me/identities/:provider/link/exchange`, and
   `DELETE /users/me/identities/:provider`. The link transaction is bound to
   the current user as well as provider/state/PKCE/nonce; it can never create a
   session or silently move a provider account between users. Return only safe
   provider metadata, allow at most one identity per provider per user, and
   refuse to unlink the last remaining login method.
+- Auth persistence keeps account profile, email addresses, password
+  credentials, and external provider identities in separate tables. Resolve an
+  external login by `(issuer, subject)`; never use an email address as the
+  provider identity key. Adding a password to a Google/OIDC account must write
+  a password credential for that existing user.
 - Password reset and email verification consume a one-time token in the same
   retry-safe transaction as the user/identity update. A failed post-commit
   session revocation must not make a successful reset impossible to retry.

package/templates/create/base/README.md.hbs

@@ -201,7 +201,9 @@ timestamps are returned.
 They can also list safe login-provider metadata with
 `GET /users/me/identities`, link a provider through the authenticated
 `/users/me/identities/:provider/link` start/exchange flow, and unlink a
-provider with `DELETE /users/me/identities/:provider`; the last login method
+provider with `DELETE /users/me/identities/:provider`. For a Google/OIDC-only
+account, `POST /users/me/identities/local` adds an email/password credential to
+the same account; it does not create a second user. The last login method
 cannot be removed.
 For `cross-site`, configure HTTPS origins, `COOKIE_SAMESITE=none`,
 `COOKIE_SECURE=true`, and an exact allowed Origin; the API applies an Origin

package/templates/add/auth/migrations/create_identities.down.sql.hbs

@@ -1 +0,0 @@
-DROP TABLE IF EXISTS user_svc.identities;

package/templates/add/auth/migrations/create_identities.up.sql.hbs

@@ -1,15 +0,0 @@
-CREATE TABLE user_svc.identities (
-    id            UUID PRIMARY KEY,
-    user_id       UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
-    provider      VARCHAR(20) NOT NULL,
-    password_hash TEXT,
-    provider_uid  TEXT,
-    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
--- Named unique indexes matching model.Identity's own
--- `uniqueIndex:idx_identities_*` tags — see create_users.up.sql for why an
--- anonymous UNIQUE constraint breaks schema parity.
-CREATE UNIQUE INDEX idx_identities_user_provider ON user_svc.identities (user_id, provider);
-CREATE UNIQUE INDEX idx_identities_provider_uid ON user_svc.identities (provider, provider_uid);