chore(cordis): sync Wavelet core/pkg/plugins after W1-W9

backend/plugins/domain/user/handlers.go

@@ -200,6 +200,22 @@ func ChangePassword(c *gin.Context) {
 	c.JSON(http.StatusOK, response.OKNil())
 }
 
+// Self returns the current authenticated user.
+func Self(c *gin.Context) {
+	svc := getAuthService()
+	if svc == nil {
+		response.AbortUnauthorized(c, errUserNotFound)
+		return
+	}
+	user, err := svc.GetCurrentUser(c)
+	if err != nil {
+		logger.ErrorF(c.Request.Context(), "get current user failed: %v", err)
+		response.AbortUnauthorized(c, errUserNotFound)
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(user))
+}
+
 // UpdateProfile updates profile info.
 func UpdateProfile(c *gin.Context) {
 	var req updateProfileRequest

backend/plugins/domain/user/plugin.go

@@ -120,14 +120,29 @@ func (p *Plugin) Apply(ctx *core.Context) error {
 	}
 	core.Provide[contracts.UserService](ctx, p.userSvc)
 
+	passThrough := gin.HandlerFunc(func(c *gin.Context) { c.Next() })
+	loginCap, registerCap, emailCap := passThrough, passThrough, passThrough
+	if capSvc, err := core.Inject[contracts.CaptchaService](ctx); err == nil && capSvc != nil {
+		if mw, ok := capSvc.VerifyMiddleware("login").(gin.HandlerFunc); ok {
+			loginCap = mw
+		}
+		if mw, ok := capSvc.VerifyMiddleware("register").(gin.HandlerFunc); ok {
+			registerCap = mw
+		}
+		if mw, ok := capSvc.VerifyMiddleware("send_email_code").(gin.HandlerFunc); ok {
+			emailCap = mw
+		}
+	}
+
 	// 3. Register HTTP Routes
 	userGroup := ctx.Router().Group("/api/v1/user")
 	{
-		userGroup.POST("/login", Login)
-		userGroup.POST("/register", Register)
+		userGroup.POST("/login", loginCap, Login)
+		userGroup.POST("/register", registerCap, Register)
 		userGroup.GET("/logout", Logout)
-		userGroup.POST("/send-email-code", SendEmailCode)
+		userGroup.POST("/send-email-code", emailCap, SendEmailCode)
 		userGroup.POST("/change-password", loginMW, ChangePassword)
+		userGroup.GET("/self", loginMW, Self)
 		userGroup.PUT("/profile", loginMW, UpdateProfile)
 
 		// Access Tokens

backend/plugins/domain/user/plugin_captcha_test.go

@@ -0,0 +1,74 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package user_test
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"Wavelet/core"
+	"Wavelet/core/contracts"
+	"Wavelet/plugins/domain/user"
+)
+
+func TestApplyWithoutCaptchaServiceKeepsAuthRoutes(t *testing.T) {
+	ctx := core.NewContext(context.Background())
+	if err := user.New().Apply(ctx); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]bool{
+		"POST /api/v1/user/login":           false,
+		"POST /api/v1/user/register":        false,
+		"POST /api/v1/user/send-email-code": false,
+	}
+	for _, rd := range ctx.Router().Routes() {
+		key := rd.Method + " " + rd.Path
+		if _, ok := want[key]; ok {
+			want[key] = true
+		}
+	}
+	for key, ok := range want {
+		if !ok {
+			t.Errorf("missing route %s", key)
+		}
+	}
+}
+
+func TestInjectDoesNotRequireCaptchaService(t *testing.T) {
+	for _, dep := range user.New().Inject() {
+		if dep == reflect.TypeFor[contracts.CaptchaService]() {
+			t.Fatal("CaptchaService must not be a hard Inject() dependency")
+		}
+	}
+}
+
+type fakeCaptchaService struct{}
+
+func (fakeCaptchaService) VerifyMiddleware(scope string) any {
+	return gin.HandlerFunc(func(c *gin.Context) { c.Next() })
+}
+
+func (fakeCaptchaService) ChallengeHandler() any { return gin.HandlerFunc(func(c *gin.Context) {}) }
+
+func (fakeCaptchaService) RedeemHandler() any { return gin.HandlerFunc(func(c *gin.Context) {}) }
+
+func TestApplyWithCaptchaServiceWrapsLogin(t *testing.T) {
+	ctx := core.NewContext(context.Background())
+	core.Provide[contracts.CaptchaService](ctx, fakeCaptchaService{})
+	if err := user.New().Apply(ctx); err != nil {
+		t.Fatal(err)
+	}
+	for _, rd := range ctx.Router().Routes() {
+		if rd.Method == "POST" && rd.Path == "/api/v1/user/login" {
+			if len(rd.Handlers) <= 1 {
+				t.Fatalf("login handler chain length = %d, want > 1", len(rd.Handlers))
+			}
+			return
+		}
+	}
+	t.Fatal("missing POST /api/v1/user/login")
+}

backend/plugins/domain/user/self_route_test.go

@@ -0,0 +1,45 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package user_test
+
+import (
+	"context"
+	"testing"
+
+	"Wavelet/core"
+	"Wavelet/core/extpoints"
+	"Wavelet/plugins/domain/user"
+)
+
+func TestSelfRouteRegisteredWithLoginProtection(t *testing.T) {
+	ctx := core.NewContext(context.Background())
+	if err := user.New().Apply(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	routes := ctx.Router().Routes()
+	self, ok := findRoute(routes, "GET", "/api/v1/user/self")
+	if !ok {
+		t.Fatal("GET /api/v1/user/self missing")
+	}
+	profile, ok := findRoute(routes, "PUT", "/api/v1/user/profile")
+	if !ok {
+		t.Fatal("PUT /api/v1/user/profile missing")
+	}
+
+	selfCount := len(self.Handlers) + len(self.Middlewares)
+	profileCount := len(profile.Handlers) + len(profile.Middlewares)
+	if selfCount < profileCount {
+		t.Fatalf("GET /api/v1/user/self handler/middleware count = %d, want >= %d (profile)", selfCount, profileCount)
+	}
+}
+
+func findRoute(routes []extpoints.RouteDefinition, method, path string) (extpoints.RouteDefinition, bool) {
+	for _, rd := range routes {
+		if rd.Method == method && rd.Path == path {
+			return rd, true
+		}
+	}
+	return extpoints.RouteDefinition{}, false
+}