Proto

Internal calls between the services use Connect, defined in Protocol Buffers under proto/ and generated with buf into gen/. None of these services is reachable through the gateway.

LoginService

user.v1.LoginService is called only by auth, with its own token: client_id auth, carrying the login-codes:redeem scope. Any other token gets PERMISSION_DENIED, even one with the scope. It listens on the user service’s RPC_ADDR.

proto/user/v1/login.proto

syntax = "proto3";

package user.v1;

// LoginService turns one-time login codes into the users they sign in. Only
// the auth service calls it, with a token carrying the login-codes:redeem
// scope; it isn't reachable through the gateway.
service LoginService {
  // RedeemLoginCode consumes a login code and returns the user it signs in,
  // registering them first when the code was sent to a new email. A code
  // works once: an unknown, used or expired code fails with UNAUTHENTICATED.
  rpc RedeemLoginCode(RedeemLoginCodeRequest) returns (RedeemLoginCodeResponse);
}

message RedeemLoginCodeRequest {
  // The code from the sign-in link, as the browser sent it.
  string code = 1;
}

message RedeemLoginCodeResponse {
  string user_id = 1;
  string email = 2;
}

Method	Request	Response	Errors
RedeemLoginCode	code: the code from the sign-in link	user_id, email	UNAUTHENTICATED for an unknown, used or expired code; PERMISSION_DENIED for a token not issued to auth

Generated code:

• gen/user/v1/login.pb.go: the messages.
• gen/user/v1/userv1connect/login.connect.go: the Connect client and server interfaces.

buf

buf.yaml

version: v2
modules:
  - path: proto
lint:
  use:
    - STANDARD
breaking:
  use:
    - FILE

buf.gen.yaml

version: v2
managed:
  enabled: true
  override:
    - file_option: go_package_prefix
      value: github.com/vardius/go-api-boilerplate/gen
plugins:
  - local: [go, tool, protoc-gen-go]
    out: gen
    opt: paths=source_relative
  - local: [go, tool, protoc-gen-connect-go]
    out: gen
    opt: paths=source_relative
clean: true

The generators run through go tool, at the versions pinned in go.mod. To add a method, see Add an RPC.