Correct Feishu login scope for OpenVPN OIDC

backend/internal/identityprovider/handlers.go

@@ -106,13 +106,18 @@ func (p *Provider) Authorize(c *gin.Context) {
 		oidcError(c, 503)
 		return
 	}
-	upstream := feishuAuthorize + "?" + url.Values{
-		"client_id": {cfg.AppID}, "redirect_uri": {base + "/feishu/callback"}, "response_type": {"code"}, "scope": {"user_profile"}, "state": {state},
-	}.Encode()
+	upstream := feishuAuthorizeURL(cfg.AppID, base+"/feishu/callback", state)
 	noStore(c)
 	c.Redirect(http.StatusFound, upstream)
 }
 
+func feishuAuthorizeURL(appID, callback, state string) string {
+	return feishuAuthorize + "?" + url.Values{
+		"client_id": {appID}, "redirect_uri": {callback}, "response_type": {"code"},
+		"scope": {"contact:user.base:readonly"}, "state": {state},
+	}.Encode()
+}
+
 var upstreamClient = &http.Client{Timeout: 8 * time.Second, CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }}
 
 func postFeishuToken(ctx context.Context, appID, appSecret, code, callback string) (string, error) {