refactor: enforce domain validation and VO construction at system boundaries

raphico · raphico · commit 549c4934745c · 2025-08-20T18:42:15.000+01:00
diff --git a/internal/db/device_repository.go b/internal/db/device_repository.go
@@ -98,5 +98,15 @@ func (r *DeviceRepository) FindById(ctx context.Context, id device.DeviceID, use
 		return nil, fmt.Errorf("find device by id failed: %w", err)
 	}
 
-	return device.RehydrateDevice(deviceID, userID, name, deviceType, status, metadata, createdAt, updatedAt)
+	return device.RehydrateDevice(
+		device.DeviceID(deviceID),
+		user.UserID(userID),
+		name,
+		deviceType,
+		status,
+		metadata,
+		createdAt,
+		updatedAt,
+	)
+
 }
diff --git a/internal/db/token_repository.go b/internal/db/token_repository.go
@@ -97,7 +97,7 @@ func (r *TokenRepository) FindValidTokenByHash(ctx context.Context, hash []byte,
 		return nil, fmt.Errorf("failed to find token: %w", err)
 	}
 
-	return token.RehydrateToken(id, dbHash, userID, dbScope, revoked, expiresAt, lastUsedAt, createdAt), nil
+	return token.RehydrateToken(token.TokenID(id), dbHash, userID, dbScope, revoked, expiresAt, lastUsedAt, createdAt), nil
 }
 
 func (r *TokenRepository) Revoke(ctx context.Context, scope string, hash []byte) error {
diff --git a/internal/db/user_repository.go b/internal/db/user_repository.go
@@ -55,7 +55,7 @@ func (r *UserRepository) Create(ctx context.Context, u *user.User) error {
 	return nil
 }
 
-func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*user.User, error) {
+func (r *UserRepository) FindByEmail(ctx context.Context, email user.Email) (*user.User, error) {
 	var (
 		id                   uuid.UUID
 		emailStr             string
@@ -70,7 +70,7 @@ func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*user.U
 		WHERE users.email = $1
 	`
 
-	err := r.db.QueryRow(ctx, query, email).Scan(
+	err := r.db.QueryRow(ctx, query, email.String()).Scan(
 		&id,
 		&emailStr,
 		&usernameStr,
@@ -87,5 +87,5 @@ func (r *UserRepository) FindByEmail(ctx context.Context, email string) (*user.U
 		return nil, fmt.Errorf("failed to find user: %w", err)
 	}
 
-	return user.RehydrateUser(id, emailStr, usernameStr, passwordHash, createdAt, updatedAt)
+	return user.RehydrateUser(user.UserID(id), emailStr, usernameStr, passwordHash, createdAt, updatedAt)
 }
diff --git a/internal/domain/auth/service.go b/internal/domain/auth/service.go
@@ -19,12 +19,17 @@ func NewService(userService *user.Service, tokenService *token.Service) *Service
 	}
 }
 
-func (s *Service) Register(ctx context.Context, username, email, password string) (*user.User, error) {
+func (s *Service) Register(
+	ctx context.Context,
+	username user.Username,
+	email user.Email,
+	password user.Password,
+) (*user.User, error) {
 	return s.user.RegisterUser(ctx, username, email, password)
 }
 
-func (s *Service) Login(ctx context.Context, email, password string) (string, *token.Token, error) {
-	u, err := s.user.AuthenticateUser(ctx, email, password)
+func (s *Service) Login(ctx context.Context, email user.Email, rawPassword string) (string, *token.Token, error) {
+	u, err := s.user.AuthenticateUser(ctx, email, rawPassword)
 	if err != nil {
 		return "", nil, err
 	}
diff --git a/internal/domain/device/device.go b/internal/domain/device/device.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/raphico/go-device-telemetry-api/internal/domain/user"
 )
 
@@ -20,38 +19,29 @@ type Device struct {
 	UpdatedAt  time.Time
 }
 
-func NewDevice(userId user.UserID, name, status, deviceType string, metadata map[string]any) (*Device, error) {
-	n, err := NewName(name)
-	if err != nil {
-		return nil, err
-	}
-
-	s, err := NewStatus(status)
-	if err != nil {
-		return nil, err
-	}
-
-	dt, err := NewDeviceType(deviceType)
-	if err != nil {
-		return nil, err
-	}
-
+func NewDevice(
+	userId user.UserID,
+	name Name,
+	status Status,
+	deviceType DeviceType,
+	metadata map[string]any,
+) *Device {
 	if metadata == nil {
 		metadata = make(map[string]any)
 	}
 
 	return &Device{
 		UserID:     userId,
-		Name:       n,
-		Status:     s,
-		DeviceType: dt,
+		Name:       name,
+		Status:     status,
+		DeviceType: deviceType,
 		Metadata:   metadata,
-	}, nil
+	}
 }
 
 func RehydrateDevice(
-	id uuid.UUID,
-	userID uuid.UUID,
+	id DeviceID,
+	userID user.UserID,
 	name string,
 	deviceType string,
 	status string,
@@ -85,8 +75,8 @@ func RehydrateDevice(
 	}
 
 	return &Device{
-		ID:         DeviceID(id),
-		UserID:     user.UserID(userID),
+		ID:         id,
+		UserID:     userID,
 		Name:       n,
 		Status:     s,
 		DeviceType: dt,
diff --git a/internal/domain/device/service.go b/internal/domain/device/service.go
@@ -19,21 +19,18 @@ func NewService(repo Repository) *Service {
 func (s *Service) CreateDevice(
 	ctx context.Context,
 	userId user.UserID,
-	name,
-	status,
-	deviceType string,
+	name Name,
+	status Status,
+	deviceType DeviceType,
 	metadata map[string]any,
 ) (*Device, error) {
-	device, err := NewDevice(userId, name, status, deviceType, metadata)
-	if err != nil {
-		return nil, err
-	}
+	dev := NewDevice(userId, name, status, deviceType, metadata)
 
-	if err = s.repo.Create(ctx, device); err != nil {
+	if err := s.repo.Create(ctx, dev); err != nil {
 		return nil, err
 	}
 
-	return device, nil
+	return dev, nil
 }
 
 func (s *Service) GetDevice(ctx context.Context, id DeviceID, userId user.UserID) (*Device, error) {
diff --git a/internal/domain/token/token.go b/internal/domain/token/token.go
@@ -50,7 +50,7 @@ func HashPlaintext(plaintext string) []byte {
 }
 
 func RehydrateToken(
-	id uuid.UUID,
+	id TokenID,
 	hash []byte,
 	userID user.UserID,
 	scope string,
@@ -60,7 +60,7 @@ func RehydrateToken(
 	createdAt time.Time,
 ) *Token {
 	return &Token{
-		ID:         TokenID(id),
+		ID:         id,
 		Hash:       hash,
 		UserID:     userID,
 		Scope:      scope,
diff --git a/internal/domain/user/password.go b/internal/domain/user/password.go
@@ -31,18 +31,15 @@ func validatePassword(pw string) error {
 
 	var (
 		hasMinLen  = len(pw) >= 8
-		hasUpper   bool
-		hasLower   bool
+		hasLetter  bool
 		hasDigit   bool
 		hasSpecial bool
 	)
 
 	for _, c := range pw {
 		switch {
-		case unicode.IsUpper(c):
-			hasUpper = true
-		case unicode.IsLower(c):
-			hasLower = true
+		case unicode.IsLetter(c):
+			hasLetter = true
 		case unicode.IsDigit(c):
 			hasDigit = true
 		case unicode.IsSymbol(c) || unicode.IsPunct(c):
@@ -53,7 +50,7 @@ func validatePassword(pw string) error {
 	if !hasMinLen {
 		return ErrPasswordTooShort
 	}
-	if !hasUpper || !hasLower || !hasDigit || !hasSpecial {
+	if !hasLetter || !hasDigit || !hasSpecial {
 		return ErrPasswordTooWeak
 	}
 
diff --git a/internal/domain/user/repository.go b/internal/domain/user/repository.go
@@ -4,5 +4,5 @@ import "context"
 
 type Repository interface {
 	Create(ctx context.Context, u *User) error
-	FindByEmail(ctx context.Context, email string) (*User, error)
+	FindByEmail(ctx context.Context, email Email) (*User, error)
 }
diff --git a/internal/domain/user/service.go b/internal/domain/user/service.go
@@ -14,11 +14,13 @@ func NewService(repo Repository) *Service {
 	}
 }
 
-func (s *Service) RegisterUser(ctx context.Context, username, email, password string) (*User, error) {
-	user, err := NewUser(email, username, password)
-	if err != nil {
-		return nil, err
-	}
+func (s *Service) RegisterUser(
+	ctx context.Context,
+	username Username,
+	email Email,
+	password Password,
+) (*User, error) {
+	user := NewUser(email, username, password)
 
 	if err := s.repo.Create(ctx, user); err != nil {
 		return nil, err
@@ -27,13 +29,13 @@ func (s *Service) RegisterUser(ctx context.Context, username, email, password st
 	return user, nil
 }
 
-func (s *Service) AuthenticateUser(ctx context.Context, email, password string) (*User, error) {
+func (s *Service) AuthenticateUser(ctx context.Context, email Email, rawPassword string) (*User, error) {
 	user, err := s.repo.FindByEmail(ctx, email)
 	if err != nil {
 		return nil, ErrInvalidCredentials
 	}
 
-	if matches := user.Password.Matches(password); !matches {
+	if matches := user.Password.Matches(rawPassword); !matches {
 		return nil, ErrInvalidCredentials
 	}
 
diff --git a/internal/domain/user/user.go b/internal/domain/user/user.go
@@ -3,8 +3,6 @@ package user
 import (
 	"fmt"
 	"time"
-
-	"github.com/google/uuid"
 )
 
 type User struct {
@@ -16,31 +14,16 @@ type User struct {
 	UpdatedAt time.Time
 }
 
-func NewUser(email, username, password string) (*User, error) {
-	addr, err := NewEmail(email)
-	if err != nil {
-		return nil, err
-	}
-
-	uname, err := NewUsername(username)
-	if err != nil {
-		return nil, err
-	}
-
-	pass, err := NewPassword(password)
-	if err != nil {
-		return nil, err
-	}
-
+func NewUser(email Email, username Username, password Password) *User {
 	return &User{
-		Email:    addr,
-		Username: uname,
-		Password: pass,
-	}, nil
+		Email:    email,
+		Username: username,
+		Password: password,
+	}
 }
 
 func RehydrateUser(
-	id uuid.UUID,
+	id UserID,
 	emailStr string,
 	usernameStr string,
 	passwordHash []byte,
@@ -56,7 +39,7 @@ func RehydrateUser(
 	}
 
 	return &User{
-		ID:        UserID(id),
+		ID:        id,
 		Email:     e,
 		Username:  uname,
 		Password:  PasswordFromHash(passwordHash),
diff --git a/internal/http/auth_handler.go b/internal/http/auth_handler.go
@@ -51,21 +51,24 @@ func (h *AuthHandler) RegisterUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	u, err := h.auth.Register(r.Context(), req.Username, req.Email, req.Password)
+	username, err := user.NewUsername(req.Username)
 	if err != nil {
-		switch {
-		case errors.Is(err, user.ErrUsernameRequired),
-			errors.Is(err, user.ErrUsernameTooShort),
-			errors.Is(err, user.ErrUsernameTooLong),
-			errors.Is(err, user.ErrEmailInvalid),
-			errors.Is(err, user.ErrEmailRequired),
-			errors.Is(err, user.ErrPasswordRequired),
-			errors.Is(err, user.ErrPasswordTooShort),
-			errors.Is(err, user.ErrPasswordTooWeak),
-			errors.Is(err, user.ErrUsernameInvalidChars):
-			WriteJSONError(w, http.StatusBadRequest, invalidRequest, err.Error())
-			return
+		WriteJSONError(w, http.StatusBadRequest, invalidRequest, err.Error())
+	}
+
+	email, err := user.NewEmail(req.Email)
+	if err != nil {
+		WriteJSONError(w, http.StatusBadRequest, invalidRequest, err.Error())
+	}
+
+	password, err := user.NewPassword(req.Password)
+	if err != nil {
+		WriteJSONError(w, http.StatusBadRequest, invalidRequest, err.Error())
+	}
 
+	u, err := h.auth.Register(r.Context(), username, email, password)
+	if err != nil {
+		switch {
 		case errors.Is(err, user.ErrEmailAlreadyExists),
 			errors.Is(err, user.ErrUsernameTaken):
 			WriteJSONError(w, http.StatusConflict, conflict, err.Error())
@@ -104,7 +107,12 @@ func (h *AuthHandler) LoginUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accessToken, refreshToken, err := h.auth.Login(r.Context(), req.Email, req.Password)
+	email, err := user.NewEmail(req.Email)
+	if err != nil {
+		WriteJSONError(w, http.StatusBadRequest, invalidRequest, err.Error())
+	}
+
+	accessToken, refreshToken, err := h.auth.Login(r.Context(), email, req.Password)
 	if err != nil {
 		if errors.Is(err, user.ErrInvalidCredentials) {
 			WriteJSONError(w, http.StatusUnauthorized, invalidRequest, "Invalid credentials")
diff --git a/internal/http/device_handler.go b/internal/http/device_handler.go

Original file line number	Diff line number	Diff line change
`@@ -97,7 +97,7 @@ func (r *TokenRepository) FindValidTokenByHash(ctx context.Context, hash []byte,`
`97`	`97`	`return nil, fmt.Errorf("failed to find token: %w", err)`
`98`	`98`	`}`
`99`	`99`
`100`		`- return token.RehydrateToken(id, dbHash, userID, dbScope, revoked, expiresAt, lastUsedAt, createdAt), nil`
	`100`	`+ return token.RehydrateToken(token.TokenID(id), dbHash, userID, dbScope, revoked, expiresAt, lastUsedAt, createdAt), nil`
`101`	`101`	`}`
`102`	`102`
`103`	`103`	`func (r *TokenRepository) Revoke(ctx context.Context, scope string, hash []byte) error {`
Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ func (r UserRepository) Create(ctx context.Context, u user.User) error {`
`55`	`55`	`return nil`
`56`	`56`	`}`
`57`	`57`
`58`		`-func (r UserRepository) FindByEmail(ctx context.Context, email string) (user.User, error) {`
	`58`	`+func (r UserRepository) FindByEmail(ctx context.Context, email user.Email) (user.User, error) {`
`59`	`59`	`var (`
`60`	`60`	`id uuid.UUID`
`61`	`61`	`emailStr string`
`@@ -70,7 +70,7 @@ func (r UserRepository) FindByEmail(ctx context.Context, email string) (user.U`
`70`	`70`	`WHERE users.email = $1`
`71`	`71`	`
`72`	`72`
`73`		`- err := r.db.QueryRow(ctx, query, email).Scan(`
	`73`	`+ err := r.db.QueryRow(ctx, query, email.String()).Scan(`
`74`	`74`	`&id,`
`75`	`75`	`&emailStr,`
`76`	`76`	`&usernameStr,`
`@@ -87,5 +87,5 @@ func (r UserRepository) FindByEmail(ctx context.Context, email string) (user.U`
`87`	`87`	`return nil, fmt.Errorf("failed to find user: %w", err)`
`88`	`88`	`}`
`89`	`89`
`90`		`- return user.RehydrateUser(id, emailStr, usernameStr, passwordHash, createdAt, updatedAt)`
	`90`	`+ return user.RehydrateUser(user.UserID(id), emailStr, usernameStr, passwordHash, createdAt, updatedAt)`
`91`	`91`	`}`
Original file line number	Diff line number	Diff line change
`@@ -19,12 +19,17 @@ func NewService(userService user.Service, tokenService token.Service) *Service`
`19`	`19`	`}`
`20`	`20`	`}`
`21`	`21`
`22`		`-func (s Service) Register(ctx context.Context, username, email, password string) (user.User, error) {`
	`22`	`+func (s *Service) Register(`
	`23`	`+ ctx context.Context,`
	`24`	`+ username user.Username,`
	`25`	`+ email user.Email,`
	`26`	`+ password user.Password,`
	`27`	`+) (*user.User, error) {`
`23`	`28`	`return s.user.RegisterUser(ctx, username, email, password)`
`24`	`29`	`}`
`25`	`30`
`26`		`-func (s Service) Login(ctx context.Context, email, password string) (string, token.Token, error) {`
`27`		`- u, err := s.user.AuthenticateUser(ctx, email, password)`
	`31`	`+func (s Service) Login(ctx context.Context, email user.Email, rawPassword string) (string, token.Token, error) {`
	`32`	`+ u, err := s.user.AuthenticateUser(ctx, email, rawPassword)`
`28`	`33`	`if err != nil {`
`29`	`34`	`return "", nil, err`
`30`	`35`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,5 +4,5 @@ import "context"`
`4`	`4`
`5`	`5`	`type Repository interface {`
`6`	`6`	`Create(ctx context.Context, u *User) error`
`7`		`- FindByEmail(ctx context.Context, email string) (*User, error)`
	`7`	`+ FindByEmail(ctx context.Context, email Email) (*User, error)`
`8`	`8`	`}`
Original file line number	Diff line number	Diff line change
`@@ -14,11 +14,13 @@ func NewService(repo Repository) *Service {`
`14`	`14`	`}`
`15`	`15`	`}`
`16`	`16`
`17`		`-func (s Service) RegisterUser(ctx context.Context, username, email, password string) (User, error) {`
`18`		`- user, err := NewUser(email, username, password)`
`19`		`- if err != nil {`
`20`		`- return nil, err`
`21`		`- }`
	`17`	`+func (s *Service) RegisterUser(`
	`18`	`+ ctx context.Context,`
	`19`	`+ username Username,`
	`20`	`+ email Email,`
	`21`	`+ password Password,`
	`22`	`+) (*User, error) {`
	`23`	`+ user := NewUser(email, username, password)`
`22`	`24`
`23`	`25`	`if err := s.repo.Create(ctx, user); err != nil {`
`24`	`26`	`return nil, err`
`@@ -27,13 +29,13 @@ func (s *Service) RegisterUser(ctx context.Context, username, email, password st`
`27`	`29`	`return user, nil`
`28`	`30`	`}`
`29`	`31`
`30`		`-func (s Service) AuthenticateUser(ctx context.Context, email, password string) (User, error) {`
	`32`	`+func (s Service) AuthenticateUser(ctx context.Context, email Email, rawPassword string) (User, error) {`
`31`	`33`	`user, err := s.repo.FindByEmail(ctx, email)`
`32`	`34`	`if err != nil {`
`33`	`35`	`return nil, ErrInvalidCredentials`
`34`	`36`	`}`
`35`	`37`
`36`		`- if matches := user.Password.Matches(password); !matches {`
	`38`	`+ if matches := user.Password.Matches(rawPassword); !matches {`
`37`	`39`	`return nil, ErrInvalidCredentials`
`38`	`40`	`}`
`39`	`41`