feat: 对用户登录可以自定义额外的 Checker

[gtn1024]

No description provided.

[Copilot]

Pull Request Overview

This PR introduces a mechanism for custom authentication validation during user login through the IExtraAuthChecker interface, allowing applications to add additional authentication checks beyond standard username/password verification.

• Added IExtraAuthChecker interface for custom authentication validation
• Integrated checker execution into the login flow via CDI Instance injection
• Added comprehensive test coverage with two test checker implementations

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
SsoController.java	Injects and executes extra authentication checkers after successful password validation
IExtraAuthChecker.java	Defines the interface for custom authentication validation logic
TestLogin.java	Adds test cases verifying that custom checkers can block user login and includes two example checker implementations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The check method lacks documentation explaining its contract. Add a JavaDoc comment describing: (1) the method's purpose in the authentication flow, (2) the expected behavior when validation fails (e.g., throwing an exception), and (3) the parameter's meaning.

Suggested change

	void check(IRuntimeUser runtimeUser);
	}
	/**
	* Performs additional authentication checks on the provided runtime user.
	* <p>
	* This method is intended to be called during the authentication flow to validate
	* extra conditions or requirements for the user. If the validation fails,
	* an exception should be thrown to indicate authentication failure.
	*
	* @param runtimeUser the user to be validated by extra authentication checks
	* @throws RuntimeException if the user fails the extra authentication checks
	*/
	void check(IRuntimeUser runtimeUser);

[Copilot]

[nitpick] Using magic string '222' for user name. Consider using a descriptive constant like 'TEST_USER_2_NAME' to improve test readability and maintainability.

[Copilot]

[nitpick] Using magic string '333' for user name. Consider using a descriptive constant like 'TEST_USER_3_NAME' to improve test readability and maintainability.

[aruis]

两个想法：

1. 名字是否叫 IExtraLoginChecker.java 更合适？
2. 是否要求其声明抛出某个登录失败异常，被平台捕获？

[gtn1024]

名字是否叫 IExtraLoginChecker.java 更合适？

done

是否要求其声明抛出某个登录失败异常，被平台捕获？

在 javadoc 还有方法签名上 throws 要求抛出，比如说 MuYunException？这个 checker 我想的使用场景是比如说 2FA 的情况下，错误具体信息需要被用户所看到

[aruis]

要不要声明抛出异常，这样平台会强制捕获，然后再次包装成 muyunException 出去？