Improve Feishu permission checks and OpenVPN auth result page

backend/internal/identityprovider/admin.go

@@ -162,6 +162,7 @@ func (p *Provider) Status(c *gin.Context) {
 		"tenant_key": cfg.TenantKey, "client_id": cfg.ClientID, "client_secret_configured": cfg.ClientSecret != "",
 		"issuer": base, "feishu_callback": callback, "vpn_callback": vpnCallback,
 		"tls_ready": tlsError == nil, "gateway_ready": issuerRoute,
+		"user_scope_verified": cfg.UserScopeVerifiedAt != nil,
 	})
 }
 
@@ -218,7 +219,7 @@ func (p *Provider) Configure(c *gin.Context) {
 			return
 		}
 	}
-	if cfg.AppID != req.AppID && req.Enabled && !autoTenant {
+	if (cfg.AppID != req.AppID || req.AppSecret != "") && req.Enabled && !autoTenant {
 		creds, err := resolveTenantCredentials(tenantCredentials{req.AppID, req.AppSecret}, cfg.AppID, cfg.AppSecret)
 		if err != nil {
 			c.JSON(400, gin.H{"error": err.Error()})
@@ -245,6 +246,9 @@ func (p *Provider) Configure(c *gin.Context) {
 			return
 		}
 	}
+	if cfg.AppID != req.AppID || req.AppSecret != "" || cfg.TenantKey != req.TenantKey {
+		cfg.UserScopeVerifiedAt = nil
+	}
 	if req.Enabled && cfg.AppSecret == "" {
 		c.JSON(400, gin.H{"error": "飞书 App Secret 未配置"})
 		return

backend/internal/identityprovider/handlers.go

@@ -222,6 +222,9 @@ func (p *Provider) FeishuCallback(c *gin.Context) {
 		oidcError(c, 503)
 		return
 	}
+	// A successful user-info lookup confirms this application's browser scope.
+	// Do not store user identifiers; reset this evidence when credentials change.
+	_ = store.DB.Model(&model.IdentityProvider{}).Where("id = ? AND app_id = ? AND tenant_key = ?", cfg.ID, cfg.AppID, cfg.TenantKey).Update("user_scope_verified_at", time.Now()).Error
 	u, _ := url.Parse(state.Redirect)
 	q := u.Query()
 	q.Set("code", code)