KPMGE/go-users-clean-api

This system is a Go-based REST API for managing users, accounts, and books, built using a clean architecture. It exposes HTTP endpoints via the Fiber framework, routing requests through controllers to application services that enforce business logic. The architecture separates concerns into domain, application, and infrastructure layers, supporting both in-memory and PostgreSQL data persistence.

The \src/main/factories\ directory now contains factory methods that wire up the application's controllers with their respective services and repositories. New files have been added to instantiate controllers for adding, listing, retrieving, and removing users, accounts, and books. Each factory method connects the appropriate data repository (e.g., \PostgresUserRepository\) and service layer, ensuring that controllers are properly initialized with the necessary dependencies.

src/main/factories · high confidence

New in-memory repository implementations have been added for accounts, books, and users, providing an in-memory data store for each entity. These repositories support standard CRUD operations (save, list, find/get, delete/remove) and validation checks (e.g., checking for duplicate emails or usernames), enabling the application to function without a persistent database.

src/infrasctructure/repositories · high confidence

A new FiberRouteAdapter has been introduced in the adapters package to bridge the application's controller layer with the Go Fiber web framework. This adapter translates incoming HTTP requests into the internal protocol format, invokes the controller's Handle method, and maps the resulting HTTP response back to the Fiber context, including specific handling for route parameters and error states.

src/main/adapters · high confidence

A new validation framework has been introduced to the application, enabling stricter enforcement of request data integrity. This includes a \RequiredParameterValidator\ that checks for missing or empty fields in request payloads, and a \ValidationComposite\ that allows chaining multiple validators together. These changes support the \CreateAccountController\ in returning a \badRequest\ response when required fields are absent, improving error handling for incomplete user registration data.

src/validation · medium confidence

The application now registers all API endpoints in a single routes configuration file. This includes endpoints for managing accounts, users, and books, each supporting standard HTTP methods (GET, POST, DELETE) and delegating to corresponding controllers via a Fiber route adapter.

src/main/config · high confidence

The application's main entry point (src/main/main.go) has been added, establishing the Go application's startup sequence. It initializes a PostgreSQL database connection using GORM, automatically migrating the Book, Account, and User entities, and configures the Fiber web server to listen on port 3333.

src/main · high confidence

Added new application service implementations for creating, retrieving, listing, and deleting users, accounts, and books. This includes services for adding and removing accounts and books, as well as listing and fetching individual records, enabling the core CRUD operations for these domain entities.

src/application/services · high confidence

The domain layer now exposes explicit interfaces for all primary operations: Add, Get, List, and Remove for users, books, and accounts. Each interface defines the contract for its respective use case (e.g., AddUserUseCase, GetBookByIdUseCase, ListAccountsUseCase), standardizing how these operations are invoked and ensuring consistent input/output structures across the domain.

src/domain/useCases · medium confidence

The application layer now defines explicit repository interfaces for managing accounts, books, and users. New interfaces include AccountRepository (with methods for checking by email/username, saving, and deleting), UserRepository (for saving, checking uniqueness, listing, deleting, and retrieving users), FindBookRepository, GetBookRepository, ListBooksRepository, RemoveBookRepository, and ListAccountsRepository. These interfaces standardize how the application interacts with data storage, enabling clearer separation of concerns and easier testing.

src/application/protocols · high confidence

A new Bcrypt-based implementation for the hasher provider has been added to the infrastructure layer. This introduces a concrete hashing mechanism using the golang.org/x/crypto/bcrypt library, allowing the system to securely hash plain text passwords.

src/infrasctructure/providers · medium confidence

Added new protocol interfaces and HTTP data structures to the presentation layer. The \Controller\ interface defines the standard request handling signature, while the \Validator\ interface introduces a new contract for input validation. Additionally, concrete \HttpRequest\ and \HttpResponse\ structs are introduced to manage HTTP-specific data, providing a structured way to handle request bodies, parameters, status codes, and response bodies.

src/presentation/protocols · high confidence

Added new data transfer objects in the domain layer to support user and book operations. This includes input and output DTOs for adding accounts, users, and books, as well as DTOs for listing users and accounts, and removing books. These structures define the data contracts for use cases, ensuring that operations like creating or retrieving users and books have well-defined input and output shapes.

src/domain/domain-dto · high confidence

The application now supports persistent storage in PostgreSQL, replacing the previous approach. This change introduces a new repository layer built on GORM, providing concrete implementations for managing accounts, books, and users. Users can now have their data persisted and retrieved from a Postgres database, including operations for creating, reading, updating, and deleting user accounts, book records, and user profiles.

src/infrasctructure/repositories/postgres-repository · medium confidence

Domain entities (Account, Book, User) now inherit from a common Base struct containing ID, CreatedAt, and UpdatedAt fields. Each entity includes validation logic using govalidator and initializes slices (like User's Books) as empty rather than nil. This standardizes entity structure and ensures consistent timestamp and ID handling across all domain models.

src/domain/entities · medium confidence

The presentation layer now provides dedicated helper functions (Ok, BadRequest, NotFound, ServerError) that return structured HttpResponse objects with appropriate HTTP status codes. This ensures that API responses, particularly error responses, are consistently formatted and include descriptive error messages, improving the reliability and clarity of error handling across the application.

src/presentation/helpers · high confidence

All controllers in the presentation layer have been refactored to use a consistent structure: they accept an HttpRequest, perform JSON unmarshalling and validation, and return standardized HttpResponse objects. Each controller now validates input fields and returns appropriate HTTP status codes (e.g., BadRequest, NotFound, ServerError) based on the outcome of the underlying use case. This ensures uniform error handling and response formatting across the API.

src/presentation/controllers · high confidence

Added domain entity tests for Account, Book, and User; Added mock implementations for application layer repositories; Added tests for application services; Added unit tests for presentation controllers.

The project now includes a go.mod file defining the module github.com/KPMGE/go-users-clean-api with Go 1.18. This adds several dependencies including the Fiber web framework (v2.31.0), Go validator, UUID generation, and various PostgreSQL client libraries.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 70 → 70 (+0.4)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 100 → 99 (-0.6)
• Architecture 100 → 82 (-18.3)
• Maturity 66 → 66 (+0.0)
• Readiness 58 → 62 (+4.4)
• Security 85 → 84 (-0.4)
• Domain Modelling 100 → 100 (+0.0)

• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (go.mod)
• Critical CVE: [GHSA redacted] (go.mod)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• Medium CVE: [GHSA redacted] (go.mod)
• Medium CVE: GO-2023-1568 (go.mod)
• Medium IaC: CKV_DOCKER_3 (Dockerfile)
• Medium IaC: CKV_DOCKER_4 (Dockerfile)
• Medium IaC: CKV_DOCKER_7 (Dockerfile)
• No exposed public API
• Test reliability not included
• The 'How do i run it?' section is a one-line command ('go run ./src/main/main.go') but the README does not state how to start the Docker container and access the docs. (documentation/README.md)
• The 'main' layer is described as the place where all code is coupled and a connection to a database or external framework lives, but no documentation of what happens in that main layer (coupled code, its own imports) appears in the visible text. (README.md)
• no production source files with tracked history to analyse
• single-maintainer — knowledge-concentration (bus factor) risk

• Critical CVE: [GHSA redacted] (go.mod)
• Critical CVE: [GHSA redacted] (go.mod)
• Dependency hygiene PARTLY measured — Go module pinning and checksums read, no direct requirement to grade for currency
• Documentation: no usage examples (README.md)
• Duplicated block (13 lines × 2) (src/domain/entities/account.go)
• Duplicated block (13 lines × 2) (src/infrasctructure/repositories/postgres-repository/postgres-account.go)
• Duplicated block (13 lines × 2) (src/infrasctructure/repositories/postgres-repository/postgres-account.go)
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• High CVE: [GHSA redacted] (go.mod)
• High IaC: WD-COMPOSE-0002 (docker-compose.yaml)
• High: security finding (details withheld)
• High: security finding (details withheld)
• Medium CVE: [GHSA redacted] (go.mod)
• Medium CVE: GO-2023-1568 (go.mod)
• Medium IaC: WD-DOCKER-0003 (Dockerfile)
• Medium vulnerability: GO-2026-4950 (go.mod)
• Medium: security finding (details withheld)
• Medium: security finding (details withheld)
• …and 4 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

KPMGE/go-users-clean-api was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.