Correct Feishu login scope for OpenVPN OIDC

backend/internal/identityprovider/provider_test.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"net/url"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -51,6 +52,16 @@ func TestFeishuExchangeUsesJSONAndRejectsUnexpectedIdentity(t *testing.T) {
 	}
 }
 
+func TestFeishuAuthorizationUsesValidUserInfoScope(t *testing.T) {
+	u, err := url.Parse(feishuAuthorizeURL("cli_test", "https://vpn.example.com/id/feishu/callback", "state_test"))
+	if err != nil || u.Scheme != "https" || u.Host != "accounts.feishu.cn" ||
+		u.Query().Get("scope") != "contact:user.base:readonly" ||
+		u.Query().Get("redirect_uri") != "https://vpn.example.com/id/feishu/callback" ||
+		u.Query().Get("state") != "state_test" {
+		t.Fatalf("invalid Feishu authorization request: %v, %v", u, err)
+	}
+}
+
 func TestFeishuExchangeRejectsMalformedSuccess(t *testing.T) {
 	previous := upstreamClient
 	defer func() { upstreamClient = previous }()