Correct Feishu login scope for OpenVPN OIDC

backend/internal/identityprovider/handlers.go

@@ -106,13 +106,18 @@ func (p *Provider) Authorize(c *gin.Context) {
 		oidcError(c, 503)
 		return
 	}
-	upstream := feishuAuthorize + "?" + url.Values{
-		"client_id": {cfg.AppID}, "redirect_uri": {base + "/feishu/callback"}, "response_type": {"code"}, "scope": {"user_profile"}, "state": {state},
-	}.Encode()
+	upstream := feishuAuthorizeURL(cfg.AppID, base+"/feishu/callback", state)
 	noStore(c)
 	c.Redirect(http.StatusFound, upstream)
 }
 
+func feishuAuthorizeURL(appID, callback, state string) string {
+	return feishuAuthorize + "?" + url.Values{
+		"client_id": {appID}, "redirect_uri": {callback}, "response_type": {"code"},
+		"scope": {"contact:user.base:readonly"}, "state": {state},
+	}.Encode()
+}
+
 var upstreamClient = &http.Client{Timeout: 8 * time.Second, CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }}
 
 func postFeishuToken(ctx context.Context, appID, appSecret, code, callback string) (string, error) {

backend/internal/identityprovider/provider_test.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"net/url"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -51,6 +52,16 @@ func TestFeishuExchangeUsesJSONAndRejectsUnexpectedIdentity(t *testing.T) {
 	}
 }
 
+func TestFeishuAuthorizationUsesValidUserInfoScope(t *testing.T) {
+	u, err := url.Parse(feishuAuthorizeURL("cli_test", "https://vpn.example.com/id/feishu/callback", "state_test"))
+	if err != nil || u.Scheme != "https" || u.Host != "accounts.feishu.cn" ||
+		u.Query().Get("scope") != "contact:user.base:readonly" ||
+		u.Query().Get("redirect_uri") != "https://vpn.example.com/id/feishu/callback" ||
+		u.Query().Get("state") != "state_test" {
+		t.Fatalf("invalid Feishu authorization request: %v, %v", u, err)
+	}
+}
+
 func TestFeishuExchangeRejectsMalformedSuccess(t *testing.T) {
 	previous := upstreamClient
 	defer func() { upstreamClient = previous }()