仓库自包含化：Docker/CI/文档/规范入库，路由分组拆分

internal/api/routes_auth.go

@@ -0,0 +1,38 @@
+package api
+
+import (
+	"github.com/gin-gonic/gin"
+
+	"oci-portal/internal/service"
+)
+
+// registerAuthPublic 公开登录/OAuth 路由(不经 JWT)。
+func registerAuthPublic(v1 *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, systemLogs *service.SystemLogService) {
+	ah := &authHandler{svc: auth, logs: systemLogs}
+	v1.POST("/auth/login", ah.login)
+
+	// 外部身份登录:provider 列表 / 授权跳转(bind 模式 handler 内校验 JWT)/ 回调
+	ax := &authxHandler{auth: auth, oauth: oauth}
+	v1.GET("/auth/oauth/providers", ax.oauthProviders)
+	v1.GET("/auth/oauth/:provider/authorize", ax.oauthAuthorize)
+	v1.GET("/auth/oauth/:provider/callback", ax.oauthCallback)
+}
+
+// registerAuthSecured 登出、两步验证、外部身份管理(JWT 组内)。
+func registerAuthSecured(secured *gin.RouterGroup, auth *service.AuthService, oauth *service.OAuthService, settings *service.SettingService, systemLogs *service.SystemLogService) {
+	ah := &authHandler{svc: auth, logs: systemLogs}
+	secured.POST("/auth/logout", ah.logout)
+
+	ax := &authxHandler{auth: auth, oauth: oauth}
+	secured.GET("/auth/totp", ax.totpStatus)
+	secured.POST("/auth/totp/setup", ax.totpSetup)
+	secured.POST("/auth/totp/activate", ax.totpActivate)
+	secured.POST("/auth/totp/disable", ax.totpDisable)
+	secured.GET("/auth/credentials", ax.getCredentials)
+	secured.PUT("/auth/credentials", ax.updateCredentials)
+	secured.PUT("/auth/password-login", ax.updatePasswordLogin)
+	secured.GET("/auth/identities", ax.identities)
+	secured.DELETE("/auth/identities/:id", ax.unbindIdentity)
+	secured.GET("/settings/oauth", func(c *gin.Context) { ax.getOAuthSettings(c, settings) })
+	secured.PUT("/settings/oauth", func(c *gin.Context) { ax.updateOAuthSettings(c, settings) })
+}