fix(api): align upload permissions and mount robots and swagger routes

backend/plugins/drivers/driver_http/engine_slash_test.go

@@ -4,9 +4,12 @@
 package driver_http
 
 import (
-	"testing"
-
+	"Wavelet/core"
 	"Wavelet/core/extpoints"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
 )
 
 func TestBuildEngineDefaultRedirectsTrailingSlash(t *testing.T) {
@@ -111,3 +114,29 @@ func bindAppConfig(t *testing.T, values map[string]any, env map[string]string) h
 }
 
 func boolPtr(v bool) *bool { return &v }
+
+func TestDriverHTTPSwaggerMount(t *testing.T) {
+	ctx := core.NewContext(t.Context())
+	ctx.Config().SetSource(core.NewMapSource(map[string]any{"app.env": "development"}))
+	if err := ctx.Config().Resolve(); err != nil {
+		t.Fatal(err)
+	}
+	p := New(WithAddr("127.0.0.1:0"))
+	if err := p.Apply(ctx); err != nil {
+		t.Fatal(err)
+	}
+	startCtx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	if err := p.Start(startCtx); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = p.Stop(t.Context()) }()
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequestWithContext(t.Context(), http.MethodGet, "/swagger/index.html", nil)
+	req.RequestURI = "/swagger/index.html"
+	p.Engine().ServeHTTP(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200 for /swagger/index.html, got %d (body: %s)", w.Code, w.Body.String())
+	}
+}

backend/plugins/drivers/driver_http/frontend.go

@@ -17,7 +17,7 @@ const indexFile = "index.html"
 
 // serverOwnedPrefixes are backend-owned namespaces. A miss there must keep Gin's default
 // 404 instead of silently returning the frontend shell, which would mask broken API links.
-var serverOwnedPrefixes = []string{"/api/", "/f/"}
+var serverOwnedPrefixes = []string{"/api/", "/f/", "/swagger/"}
 
 // registerFrontend mounts assets as the NoRoute fallback so client-side routes resolve.
 // It is a no-op when assets is nil, i.e. the binary was built without the embed_frontend tag.

backend/plugins/drivers/driver_http/plugin.go

@@ -7,6 +7,7 @@ package driver_http
 import (
 	"Wavelet/core"
 	"Wavelet/core/contracts"
+	_ "Wavelet/docs" // swagger documentation registration
 	"Wavelet/pkg/util"
 	"context"
 	"errors"
@@ -17,6 +18,8 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	swaggerFiles "github.com/swaggo/files"
+	ginSwagger "github.com/swaggo/gin-swagger"
 )
 
 const (
@@ -207,6 +210,19 @@ func (p *Plugin) Start(ctx context.Context) error {
 		}
 	}
 
+	// Mount Swagger in non-production environments
+	if p.coreCtx != nil {
+		var appCfg httpAppConfig
+		_ = p.coreCtx.Config().Bind("app", &appCfg)
+		if appCfg.Env != "production" && appCfg.Env != "prod" {
+			swaggerHandler := ginSwagger.WrapHandler(swaggerFiles.Handler)
+			p.engine.GET("/swagger/*any", swaggerHandler)
+			if appCfg.APIPrefix != "" {
+				p.engine.GET(appCfg.APIPrefix+"/swagger/*any", swaggerHandler)
+			}
+		}
+	}
+
 	registerFrontend(p.engine, frontendAssets())
 
 	p.server = &http.Server{