Improve Feishu permission checks and OpenVPN auth result page

backend/internal/model/model.go

@@ -6,14 +6,15 @@ import "time"
 // IdentityProvider is the opt-in, single-tenant Feishu OIDC issuer configuration.
 // Credentials are encrypted with the platform key and never serialized in API responses.
 type IdentityProvider struct {
-	ID           uint      `gorm:"primaryKey" json:"-"`
-	Enabled      bool      `json:"enabled"`
-	AppID        string    `gorm:"size:128" json:"app_id"`
-	AppSecret    string    `gorm:"type:text" json:"-"`
-	TenantKey    string    `gorm:"size:128" json:"tenant_key"`
-	ClientID     string    `gorm:"size:128" json:"client_id"`
-	ClientSecret string    `gorm:"type:text" json:"-"`
-	UpdatedAt    time.Time `json:"updated_at"`
+	ID                  uint       `gorm:"primaryKey" json:"-"`
+	Enabled             bool       `json:"enabled"`
+	AppID               string     `gorm:"size:128" json:"app_id"`
+	AppSecret           string     `gorm:"type:text" json:"-"`
+	TenantKey           string     `gorm:"size:128" json:"tenant_key"`
+	ClientID            string     `gorm:"size:128" json:"client_id"`
+	ClientSecret        string     `gorm:"type:text" json:"-"`
+	UserScopeVerifiedAt *time.Time `json:"-"` // Set only after a successful Feishu user-info callback.
+	UpdatedAt           time.Time  `json:"updated_at"`
 }
 
 // IdentityGrant stores only a hash of each browser state, authorization code,