febrihidayan/go-architecture-monorepo

This system is a microservices-based platform for user identity management, access control, and digital asset storage. It provides core authentication and authorization capabilities, including a role-based access control (RBAC) system, user lifecycle management, and secure credential handling. The architecture supports asynchronous communication via RabbitMQ and inter-service gRPC calls, while integrating with AWS S3 for file storage and external providers like Firebase and Mailgun for notifications.

47 changes.

The project established a multi-service architecture by introducing dedicated Auth, User, Storage, and Notification services, interconnected via gRPC and RabbitMQ. A comprehensive Role-Based Access Control (RBAC) system was implemented across the domain models and repositories, enabling granular permission management. The period also covered the integration of external providers like AWS S3 and Firebase, alongside extensive unit testing to validate the new service boundaries and data flows.

9 changes.

This period focused on strengthening the Auth and User services by introducing a dedicated ACL layer, centralized dependency injection factories, and a new MongoDB query builder. It also established robust testing coverage through comprehensive unit tests and mocks, while integrating RabbitMQ for structured messaging and providing Firebase configuration templates.

The auth service now implements gRPC-based repositories to communicate with external user and notification services. This introduces a UserRepository that handles user creation and email verification updates, and a NotificationRepository that sends notifications (such as welcome emails) via gRPC clients. Mapper functions are included to convert internal domain entities into the corresponding protobuf messages required for these remote calls.

services/auth/internal/repositories/grpc · high confidence

A new example configuration file (firebase\_key.json.example) has been added to the data/config directory. This file provides a template for Firebase service account credentials, including fields for project ID, private keys, and client email, allowing users to easily set up authentication by filling in their specific details.

data · high confidence

The user service now includes a new gRPC client implementation that establishes connections to the Auth and Storage services. This client initializes connections using configuration values for the Auth and Storage endpoints, allowing the user service to communicate with these downstream dependencies via gRPC.

_services/user/internal/delivery/grpc\client · high confidence

The auth service now includes a gRPC client implementation that establishes connections to the User and Notification services. This new component allows the auth service to communicate with these downstream services over gRPC, facilitating interactions such as user management and notification dispatching.

_services/auth/internal/delivery/grpc\client · high confidence

The auth service now supports creating, updating, finding, and listing roles and permissions. This change introduces the use-case layer for these entities, including validation logic and duplicate-name checks, wired to the MongoDB repository factory.

services/auth/internal/usecases/permission, services/auth/internal/usecases/role · high confidence

The pkg/lang package now includes a new validate.go file that defines a comprehensive set of error variables for user-facing validation scenarios, including requirements for name, user ID, email, password, role, and permission fields, as well as specific errors for email verification status, token validity, and unsupported file types. It also introduces a Trans function that allows these error messages to be localized by replacing placeholders in a basic locale map, enabling the application to display context-aware validation feedback to users.

pkg/lang · high confidence

The authentication service now supports a broader range of user management and security operations. Users can now create or update accounts via a new CreateOrUpdate method, verify email addresses, and reset passwords through dedicated endpoints. Additionally, the service introduces a complete Role-Based Access Control (RBAC) system, allowing administrators to manage roles and permissions, assign permissions to roles, and control access to user login and data via ACL interfaces.

services/auth/domain/usecases · high confidence

The auth service now supports a complete user lifecycle beyond simple login. New users are automatically assigned a default 'member' role upon registration, and a welcome email is sent. The service introduces password reset and email verification flows, allowing users to request and confirm their email addresses. Additionally, user deletion is now synchronized across auth, roles, and permissions, and the login process now returns user roles alongside authentication metadata.

services/auth/internal/usecases/auth · high confidence

The auth service's domain entities have been significantly expanded to support granular access control and improved user lifecycle management. The Auth entity now includes an EmailVerifiedAt field and password hashing logic, while the AuthDto no longer carries a Role field, reflecting a shift to separate role management. New entities have been introduced to support an ACL system, including Role, Permission, and their many-to-many relationships (RoleUser, PermissionRole, PermissionUser), along with DTOs and validation logic for each. Additionally, entities for password resets, user registration validation, and email notification templates (welcome, verified, reset) have been added to support the full authentication and onboarding flow.

services/auth/domain/entities · high confidence

The authentication service's domain layer now exposes broader repository contracts to support granular access control and user lifecycle management. New interfaces have been added for managing roles, permissions, and their associations with users (RoleUser, PermissionUser, PermissionRole), as well as a dedicated NotificationRepository for sending notifications. The existing UserRepository has been extended to support email verification updates, and the AuthRepository now includes methods to find authentication records by email or user ID and to delete them by user ID, enabling more precise user and session handling.

services/auth/domain/repositories · high confidence

The user repository interface has been extended to support additional user management operations. Specifically, the UserRepository now includes methods for finding users by email, retrieving a paginated list of all users, and deleting users. Additionally, new repository interfaces have been introduced to handle authentication operations (CreateOrUpdate), RabbitMQ-based cloud approval and authentication deletion, and storage-based cloud approval updates and deletions, enabling broader integration with external services and asynchronous workflows.

services/user/domain/repositories · high confidence

New HTTP handlers have been added to expose user profile management capabilities. Users can now retrieve their profile details via a GET request to /v1/user/profile and update their profile information (including name, email, avatar, and language code) via a PUT request to the same endpoint. Both endpoints require a valid JWT token in the Authorization header and validate the request payload before processing.

services/user/internal/delivery/http/delivery/profile · high confidence

The HTTP delivery layer for the user service has been updated to expose a full set of CRUD operations: creating, retrieving (by ID and list with pagination), updating, and deleting users. The handler implementation was refactored to use a factory-based dependency injection pattern, replacing direct repository instantiation with MongoFactory, GrpcClientFactory, and a RabbitMQ publisher, and the HTTP routes are now registered under /v1/users and /v1/user.

services/user/internal/delivery/http/delivery/user · high confidence

The user service now exposes a gRPC interface to handle user registration, profile retrieval, and email verification. This delivery layer registers the user and profile services with the gRPC server, mapping protobuf requests to domain use cases for creating users, finding user profiles, and updating email verification status.

_services/user/internal/delivery/grpc\server · high confidence

This change introduces the foundational API contracts and generated Go code for the system's core microservices. It defines the Auth service for managing authentication credentials, the User service for user profiles and email verification, the Notification service for handling device tokens and sending alerts, and the Storage service for managing cloud file approvals. These proto definitions and their corresponding gRPC server/client stubs establish the communication layer for these domains.

proto · high confidence

This change establishes the core domain layer for a new cloud storage service. It defines the \Cloud\ and \File\ entities to represent stored assets and their metadata, along with a \FileType\ value object that validates allowed MIME types (such as PDF, images, and Office documents). The diff also introduces the \AwsService\ interface for S3 operations (upload, delete, read), a \CloudRepository\ interface for persistence, and a \CloudUsecase\ interface exposing create, status update, and delete capabilities. Additionally, RabbitMQ event constants are defined to support asynchronous storage status updates.

services/storage/domain · high confidence

A new notification service has been added to the system, providing endpoints to manage device tokens, view notification history, and create email templates. The service exposes HTTP routes for creating device tokens (POST /v1/notification/device-token), listing user notifications (GET /v1/notifications), and creating templates (POST /v1/notification/template), alongside gRPC methods for sending notifications and managing device tokens. It integrates with MongoDB for persistent storage of tokens, notifications, and templates, and utilizes Firebase for push notifications and Mailgun for email delivery.

services/notification · high confidence

The application now includes a new middleware package defining role constants (superadministrator, administrator, member) and a validator package providing struct validation and JSON error response formatting. These components establish the foundational definitions and helper utilities required for implementing role-based access control and input validation in the system.

pkg/middleware · high confidence

The auth service now supports a full role-based access control (RBAC) system and enhanced user authentication via MongoDB. This change introduces new data models and repositories for managing Roles, Permissions, and their associations with Users (RoleUser, PermissionRole, PermissionUser), enabling granular permission checks. Additionally, the existing Auth repository has been updated to support email verification (adding an EmailVerifiedAt field) and user deletion, while migrating to a MongoQueryBuilder for consistent database operations.

services/auth/internal/repositories/mongo · high confidence

The auth service now includes a dedicated ACL use-case layer that provides specific operations for managing access control. This adds the ability to retrieve ACL metadata for a user login context (distinct from general user lookups), fetch all roles and permissions, and retrieve permissions filtered by role. It also introduces logic to update a user's assigned roles and permissions, as well as to update the permissions associated with a specific role, allowing administrators to modify access rights through these new service methods.

services/auth/internal/usecases/acl · high confidence

The auth service now exposes new HTTP endpoints for managing access control lists, roles, and permissions, including creating, finding, updating, and listing roles and permissions, as well as assigning permissions to roles and users. Existing authentication endpoints have been updated: login and register now return structured access and refresh tokens in the response body, and new endpoints have been added for sending email verification, verifying email via token, and requesting password reset emails.

services/auth/internal/delivery/http · high confidence

A new \mongoqb\ package has been added to provide a fluent builder for MongoDB operations. It supports building aggregation pipelines with stages like \$lookup\ and regex-based searches, as well as standard CRUD operations including find, insert, update, delete, and count. This allows developers to construct complex MongoDB queries and data manipulations using a chainable API.

pkg/mongoqb · high confidence

The user service now includes a dedicated RabbitMQ client library (\pkg/rabbitmq\) that supports Protobuf serialization, enabling structured message passing. This change introduces a new \rabbitmq\_server\ delivery layer in the user service, featuring a publisher component that sends Protobuf-encoded messages (such as \AuthDelete\ and \CloudApprove\) to RabbitMQ exchanges. The underlying client handles connection management, exchange/queue declaration, and message publishing with \application/protobuf\ content types, while also providing a mock implementation for testing.

_pkg/rabbitmq, services/user/internal/delivery/rabbitmq\server · high confidence

The cloud storage service now includes a new interactor that handles file creation by uploading to AWS S3 when a URL is not provided, setting the initial status to 'pending', and cleaning up local temporary files. A new background job automatically deletes files that remain in the 'pending' status for more than one day, addressing the issue of stuck pending uploads. Additionally, the service supports batch deletion of files by URL and batch updating of file statuses.

services/storage/internal/usecases/cloud · high confidence

The auth service now exposes new delivery layers to handle user creation, updates, and deletion. A new gRPC server implementation adds a \CreateOrUpdateAuth\ RPC method, allowing clients to create or update authentication records via the standard gRPC interface. Additionally, a RabbitMQ consumer layer has been introduced to handle asynchronous user deletion; it listens on the \auth.queue\ for \auth.auth\_delete\ events and triggers the corresponding use-case logic. These changes expand the service's input channels beyond its previous scope, supporting both synchronous API calls and asynchronous event-driven workflows for user management.

_services/auth/internal/delivery/grpc\server · high confidence

The user service now includes dedicated gRPC repository implementations for interacting with external services. The new AuthRepository enables asynchronous creation or update of user authentication data via the auth service, while the StorageRepository provides methods to approve and delete cloud storage URLs via the storage service, supporting the updated user avatar workflow.

services/user/internal/repositories/grpc · high confidence

A new storage service has been introduced to handle cloud file operations. Users can now upload files via an HTTP POST endpoint at /v1/storage/cloud, which validates file size and MIME type before storing metadata in MongoDB and the file content in an AWS S3 bucket. The service also supports managing file lifecycle through gRPC and RabbitMQ interfaces, allowing for the approval and deletion of cloud files. Additionally, a background cron job automatically processes status updates for stored files every 24 hours.

services/storage/internal · high confidence

The pkg/utils package now includes new capabilities to support core application features. It introduces JWT token decoding via a new jwt.go file, allowing the system to parse standard JWT claims. Password security is enhanced with helper functions to hash and verify passwords using bcrypt. Data protection is added through AES-GCM encryption and decryption utilities. Additionally, request handling is improved with a function to automatically map HTTP query parameters to struct fields, and a new MetaResponse struct is defined to standardize pagination metadata in API responses.

pkg/utils · high confidence

The user service has been expanded to support asynchronous messaging and remote procedure calls in addition to its existing HTTP interface. It now runs a gRPC server on a configurable RPC port and connects to a RabbitMQ broker for message publishing. HTTP handlers for user profiles and user management have been updated to utilize these new infrastructure components via factory patterns, enabling richer interaction patterns for clients.

services/user/cmd · high confidence

The Auth and User services now use a unified dependency injection pattern to manage shared infrastructure. New factory packages consolidate the initialization of MongoDB connections, gRPC clients, and RabbitMQ connections into single, thread-safe dependency containers. This replaces scattered setup logic with a centralized \InitializeDependencies\ function that provides ready-to-use repository factories (Mongo and gRPC) to the rest of the service, ensuring consistent configuration and lifecycle management for database and messaging connections.

services/auth/internal/factories, services/user/internal/factories · high confidence

The authentication service has been refactored to support multiple communication protocols and a unified dependency injection system. Instead of a single HTTP server, the application now concurrently runs an HTTP server (handling auth, permission, role, and ACL endpoints), a gRPC server for internal service communication, and a RabbitMQ worker for asynchronous tasks. All components share a centralized dependency graph initialized via the new factories package, replacing the previous direct database and configuration initialization. Graceful shutdown is now handled by canceling a shared context to ensure all servers and workers stop cleanly.

services/auth/cmd · high confidence

The user service configuration now includes dedicated settings for gRPC client endpoints (Auth and Storage) and RabbitMQ connection details (Host, Port, User, Password, and Exchange). These new fields are populated via environment variables, enabling the service to connect to external gRPC services and the RabbitMQ message broker.

services/user/internal/config · high confidence

The authentication service configuration now supports additional environment variables for JWT token management (JTI, expiration, secret key), application URL, and integration with external services via gRPC (user and notification clients) and RabbitMQ (host, port, credentials, exchange). This enables the service to handle token validation, communicate with other microservices, and publish events, moving beyond the previous basic HTTP/RPC port and timeout settings.

services/auth/internal/config · high confidence

The user service now supports a broader range of user lifecycle operations. The interface has been refactored to replace the single Profile method with distinct Find, Update, and Delete methods, enabling full CRUD functionality for user records. Additionally, a new CreateAuth method handles user registration, GetAll allows listing users with query parameters, and a new UpdateEmailVerified method facilitates marking user accounts as verified.

services/user/domain/usecases · high confidence

The user profile logic has been reorganized from the general user use-case package into a dedicated \profile\ package. This change introduces a new \profileInteractor\ that consolidates configuration and repository dependencies (MongoDB and RabbitMQ) via a factory pattern. The previous \Profile\ method on the user interactor has been replaced by a \Find\ method in the new profile interactor, and a new \Update\ method has been added to handle profile updates, including logic to publish avatar change events to RabbitMQ for cloud storage synchronization.

services/user/internal/usecases/profile · high confidence

The user service now uses dedicated request structures for creating and updating users, introducing specific validation rules such as minimum length requirements for names and passwords, and adding a required language code field to user updates. The previous generic AuthRequest structure has been removed, streamlining the API input definitions for user management operations.

services/user/internal/delivery/http/request · high confidence

The User and UserDto entities now include new fields for avatar, language code (LangCode), and email verification status (EmailVerifiedAt), while the Role field has been removed from the core user model. Validation logic has been updated to require a language code instead of a role, and a new Auth entity has been introduced to handle authentication-specific data. Additionally, RabbitMQ constants for storage and auth deletion events have been added to support asynchronous operations.

services/user/domain/entities · high confidence

The user service's internal use cases have been expanded to provide complete user lifecycle management. Users can now be created, retrieved, listed, updated, and deleted. The creation and update flows now synchronize user data with an external authentication service via gRPC and handle avatar storage updates. Additionally, the service supports marking user accounts as email-verified and performs synchronized deletion of associated authentication records when a user is removed.

services/user/internal/usecases/user · high confidence

The MongoDB user repository now maps additional user attributes (avatar, language code, and email verification timestamp) and switches from direct MongoDB driver calls to a MongoQueryBuilder wrapper for cleaner query construction. This change introduces paginated listing of users with optional name search, adds a dedicated lookup by email address, and implements user deletion, while the internal ID representation is converted to and from strings for storage.

services/user/internal/repositories/mongo · high confidence

The HTTP response structure for user data now includes a \lang\_code\ field, allowing clients to retrieve the user's preferred language setting. This change is implemented by adding the \LangCode\ property to the \UserListResponse\ struct and mapping it from the domain entity. Additionally, the previous \auth.go\ response file, which contained an empty login response mapper, has been removed as part of this adjustment.

services/user/internal/delivery/http/response · high confidence

Added HTTP handler tests and use-case mocks for the User service; Added HTTP handler tests for Auth, ACL, Role, and Permission services; Added MongoDB repository mocks for auth service testing; Added domain entity validation tests for the auth service; Added mock for user repository in gRPC tests; Added mock implementations for auth service use cases; Added mock implementations for user service repositories; Added unit tests and mocks for the cloud storage service; Added unit tests for ACL usecase methods; Added unit tests for cloud storage use cases; Added unit tests for the authentication use case; Added unit tests for the device token creation use case; Added unit tests for user entity validation; Added unit tests for user profile use case; Added unit tests for user use case operations.

The project has upgraded the Go language version from 1.18 to 1.26.5 and performed a comprehensive update of its dependencies. This includes adding new libraries for AWS S3 storage, RabbitMQ messaging, Google Firebase, Mailgun email services, and background job scheduling, while updating core packages like gRPC, protobuf, and testing frameworks to their latest versions.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 56 → 59 (+3.9)
• Rubric changed (rubric-2026.08.18 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 91 → 93 (+2.1)
• Architecture 100 → 85 (-14.5)
• Maturity 57 → 67 (+10.6)
• Readiness 50 → 54 (+4.7)
• Security 75 → 72 (-3.3)
• Domain Modelling 57 → 61 (+4.8)
• Accessibility 57 → 59 (+2.0)

• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (go.mod)
• Critical CVE: [GHSA redacted] (go.mod)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• Duplicated block (10 lines × 2) (services/auth/cmd/main.go)
• Duplicated block (10 lines × 7) (services/auth/internal/delivery/http/delivery/auth/login.go)
• Duplicated block (11 lines × 2) (services/auth/internal/delivery/http/delivery/permission/create.go)
• Duplicated block (11 lines × 2) (services/auth/internal/delivery/http/delivery/role/create.go)
• Duplicated block (11 lines × 2) (services/auth/internal/usecases/permission/update.go)
• Duplicated block (11 lines × 2) (services/notification/internal/services/firebase_google.go)
• Duplicated block (11 lines × 2) (services/storage/internal/delivery/grpc_server/delete_cloud_approve.go)
• Duplicated block (11 lines × 2) (services/storage/internal/delivery/grpc_server/update_cloud_approve.go)
• Duplicated block (11 lines × 4) (services/auth/internal/delivery/http/delivery/permission/update.go)
• Duplicated block (12 lines × 2) (services/auth/internal/delivery/http/delivery/role/update.go)
• Duplicated block (13 lines × 2) (services/auth/internal/delivery/http/delivery/auth/password_email.go)
• Duplicated block (13 lines × 2) (services/auth/internal/usecases/acl/update_permission_by_role.go)
• Duplicated block (13 lines × 2) (services/auth/internal/usecases/auth/create_or_update.go)
• Duplicated block (13 lines × 2) (services/user/internal/usecases/profile/find.go)
• Duplicated block (13 lines × 4) (services/auth/internal/delivery/http/delivery/acl/get_all_permission_by_role.go)
• Duplicated block (14 lines × 2) (services/auth/internal/delivery/grpc_client/handler.go)
• …and 34 more

• Critical CVE: [GHSA redacted] (go.mod)
• Critical CVE: [GHSA redacted] (go.mod)
• Critical CVE: [GHSA redacted] (go.mod)
• Dependency pinned to a stale untagged commit: github.com/kmacute/golvalidator
• Deprecated module: go.mongodb.org/mongo-driver
• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)
• Duplicated block (10 lines × 12) (services/auth/internal/delivery/http/delivery/acl/update_permission_by_role.go)
• Duplicated block (10 lines × 2) (services/auth/cmd/main.go)
• Duplicated block (10 lines × 2) (services/auth/domain/entities/permission.go)
• Duplicated block (10 lines × 2) (services/auth/internal/delivery/http/delivery/permission/create.go)
• Duplicated block (10 lines × 2) (services/auth/internal/delivery/http/response/permission.go)
• Duplicated block (10 lines × 2) (services/auth/internal/usecases/auth/email_verified.go)
• Duplicated block (10 lines × 2) (services/storage/internal/delivery/grpc_server/delete_cloud_approve.go)
• Duplicated block (10 lines × 2) (services/storage/internal/delivery/grpc_server/update_cloud_approve.go)
• Duplicated block (10 lines × 3) (services/auth/internal/config/server.go)
• Duplicated block (10 lines × 3) (services/auth/internal/repositories/mongo/permission_repository.go)
• Duplicated block (10 lines × 3) (services/auth/internal/usecases/acl/update_permission_by_role.go)
• Duplicated block (10 lines × 3) (services/auth/internal/usecases/acl/update_permission_by_role.go)
• Duplicated block (10 lines × 3) (services/user/internal/delivery/http/delivery/profile/update.go)
• …and 99 more

• 3 commits — 2 feature/other, 1 fixes

• (root) — 1 commit
• proto/_generated — 1 commit
• services/user — 1 commit

• fix: fix: update schema URL in krakend configuration to use HTTPS
• change: refactor: update AwsService interface and improve test setup for user use cases
• change: update Go version to 1.26 across documentation and Dockerfiles; upgrade protoc-gen-go and protoc-gen-go-grpc versions

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

febrihidayan/go-architecture-monorepo was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.