authsys

##the_problem

Learning Go. Not a product: the fastest way to separate what is the language from what is the problem is to rewrite a domain you already understand, so I picked the auth work I had already taken to production in .NET on Telas Paraná.

##what_it_does

• The community-standard Go layout with clean layering (handler, service, repository, model) plus DTOs, JWT, response and configuration packages, and manual dependency injection with no container.
• The user model embeds an account structure carrying the security vocabulary: online state, last login and logout, failed attempt count, lock expiry and disabled flag. The structure for lockout and disabled accounts exists in the schema.
• The password field is tagged so it can never appear in a response.
• Three routes: create user, login, logout.

##stack

##how_it_was_built

Six commits over five days, reading as what it is: a language exercise against a familiar domain, not an attempt at a shippable service.

The value is in the comparison. Having built and hardened this exact domain in .NET (Argon2id, refresh-token rotation with reuse detection, timing-attack mitigation), rewriting the skeleton in Go isolates the language from the problem.

##known_limitations

• This is a skeleton, not a system. Saying so plainly is the point of the entry.
• The authentication middleware file contains only its package declaration. The middleware does not exist, and no route is protected.
• The Makefile is empty.
• There are no tests.
• The lockout and disabled-account fields exist in the model, but nothing reads or writes them yet: the schema anticipates behaviour that is not implemented.

##tracked coding time

20 hrs 42 mins Source: WakaTime · tracked 2026-03-17 to current