refactor(auth): modularize auth plugin with physical subpackages and decoupled services

backend/plugins/domain/auth/controller/controller.go

@@ -0,0 +1,109 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package controller provides HTTP handlers and middlewares for the auth plugin.
+package controller
+
+import (
+	"Wavelet/core/extpoints"
+	"Wavelet/plugins/domain/auth/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Controller aggregates all HTTP handlers and middlewares for the auth plugin.
+type Controller struct {
+	svc       *service.Service
+	whitelist *extpoints.PathWhitelist
+
+	OAuth    *OAuthHandler
+	UserInfo *UserInfoHandler
+	Captcha  *CaptchaHandler
+}
+
+// New creates a new Controller instance.
+func New(svc *service.Service) *Controller {
+	wl := extpoints.NewPathWhitelist()
+	oauthHandler := NewOAuthHandler(svc.OAuth, svc.Session, svc.DAO)
+	userInfoHandler := NewUserInfoHandler()
+	captchaHandler := NewCaptchaHandler(svc.CapManager)
+
+	c := &Controller{
+		svc:       svc,
+		whitelist: wl,
+		OAuth:     oauthHandler,
+		UserInfo:  userInfoHandler,
+		Captcha:   captchaHandler,
+	}
+
+	// Wire middlewares into AuthService
+	svc.AuthSvc.SetMiddlewareHandlers(
+		c.LoginRequired(),
+		c.AdminRequired(),
+		DisallowTokenAuth(),
+		CurrentUserIDFromRequestContext,
+	)
+
+	return c
+}
+
+// Whitelist returns the whitelist tracker.
+func (c *Controller) Whitelist() *extpoints.PathWhitelist {
+	return c.whitelist
+}
+
+// RegisterWhitelist adds path patterns that bypass authentication.
+func (c *Controller) RegisterWhitelist(patterns ...string) {
+	if c.whitelist != nil {
+		c.whitelist.Add(patterns...)
+	}
+}
+
+// LoginRequired returns the authentication middleware.
+func (c *Controller) LoginRequired() gin.HandlerFunc {
+	return LoginRequiredMiddleware(c.whitelist, c.svc.DAO)
+}
+
+// AdminRequired returns the admin authorization middleware.
+func (c *Controller) AdminRequired() gin.HandlerFunc {
+	return AdminRequiredMiddleware(c.svc.DAO)
+}
+
+// DisallowTokenAuth returns the token rejection middleware.
+func (c *Controller) DisallowTokenAuth() gin.HandlerFunc {
+	return DisallowTokenAuth()
+}
+
+// VerifyCaptcha returns the captcha challenge verification middleware.
+func (c *Controller) VerifyCaptcha(scope string) gin.HandlerFunc {
+	return VerifyCaptchaMiddleware(c.svc.CapManager, c.svc.CapSettings, scope)
+}
+
+// RegisterRoutes mounts all auth endpoints onto the router.
+func (c *Controller) RegisterRoutes(router extpoints.RouterExtension) {
+	loginReq := c.LoginRequired()
+
+	// 1. OAuth endpoints
+	oauthGroup := router.Group("/api/v1/oauth")
+	{
+		oauthGroup.GET("/sources", c.OAuth.GetLoginSources)
+		oauthGroup.GET("/login", c.OAuth.GetLoginURL)
+		oauthGroup.GET("/:source/authorize", c.OAuth.Authorize)
+		oauthGroup.GET("/logout", c.OAuth.Logout)
+		oauthGroup.POST("/callback", c.OAuth.Callback)
+		oauthGroup.GET("/user-info", loginReq, c.UserInfo.UserInfo)
+		oauthGroup.GET("/external-accounts", loginReq, c.OAuth.ListExternalAccounts)
+		oauthGroup.POST("/external-accounts/:id/delete", loginReq, c.OAuth.DeleteExternalAccount)
+	}
+
+	// 2. Global user-info route alias
+	router.GET("/api/v1/user-info", loginReq, c.UserInfo.UserInfo)
+
+	// 3. CAPTCHA endpoints
+	capGroup := router.Group("/api/v1/cap")
+	{
+		capGroup.GET("/challenge", c.Captcha.Challenge)
+		capGroup.POST("/challenge", c.Captcha.Challenge)
+		capGroup.POST("/redeem", c.Captcha.Redeem)
+	}
+}