Refine WireGuard client routing and authentication UI

backend/internal/service/wireguard/device.go

@@ -265,6 +265,7 @@ func (s *Service) DeviceConnectionParams(t *model.Tunnel, peerID string) (map[st
 			"endpoint":          service.StrOr(cfg, "public_endpoint", fmt.Sprintf("your-server-ip:%d", int(service.Num(cfg, "listen_port", defaultPort)))),
 			"listen_port":       int(service.Num(cfg, "listen_port", defaultPort)),
 			"allowed_ips":       allowed,
+			"latency_probe":    service.Str(cfg, "latency_probe"),
 			"dns":               service.StrOr(cfg, "dns", service.DefaultDNS()),
 			"mtu":               int(service.Num(cfg, "mtu", 0)),
 			"keepalive":         int(service.Num(cfg, "keepalive", 25)),

backend/internal/service/wireguard/wireguard.go

@@ -106,6 +106,11 @@ func isWireGuardKey(key string) bool {
 }
 
 func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{}, error) {
+	// Static peers still authenticate by their key; this setting only describes
+	// how the managed desktop client obtains its device grant.
+	if mode := service.Str(cfg, "auth_mode"); mode != "" && mode != "password" {
+		return nil, fmt.Errorf("WireGuard 尚不支持第三方 OAuth2/OIDC 登录，请使用客户端账号与设备密钥")
+	}
 	if err := service.MustValidate(cfg, "address"); err != nil {
 		return nil, err
 	}
@@ -127,6 +132,13 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 	if err := validateCIDRList(service.Str(out, "allowed_ips")); err != nil {
 		return nil, fmt.Errorf("allowed_ips: %w", err)
 	}
+	if target := service.Str(out, "latency_probe"); target != "" {
+		host, port, err := net.SplitHostPort(target)
+		probePort, parseErr := strconv.Atoi(port)
+		if err != nil || parseErr != nil || net.ParseIP(host) == nil || probePort < 1 || probePort > 65535 {
+			return nil, fmt.Errorf("latency_probe 必须是可经 VPN 访问的 IP:端口")
+		}
+	}
 	if service.Str(out, "dns") == "" {
 		out["dns"] = service.DefaultDNS()
 	}

backend/internal/service/wireguard/wireguard_test.go

@@ -83,6 +83,32 @@ func TestValidateRejectsUnsafeNATAndInvalidPeerAddress(t *testing.T) {
 	}
 }
 
+func TestValidateWireGuardAuthMode(t *testing.T) {
+	for _, mode := range []string{"", "password"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "auth_mode": mode}); err != nil {
+			t.Fatalf("legacy/password mode %q rejected: %v", mode, err)
+		}
+	}
+	for _, mode := range []string{"oidc", "unknown"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "auth_mode": mode}); err == nil {
+			t.Fatalf("unsupported authentication mode %q accepted", mode)
+		}
+	}
+}
+
+func TestValidateLatencyProbeTarget(t *testing.T) {
+	for _, target := range []string{"10.88.0.1:22", "[2001:db8::1]:443", ""} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "latency_probe": target}); err != nil {
+			t.Fatalf("valid target %q rejected: %v", target, err)
+		}
+	}
+	for _, target := range []string{"example.com:443", "10.88.0.1:0", "10.88.0.1:65536", "invalid"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "latency_probe": target}); err == nil {
+			t.Fatalf("invalid target %q accepted", target)
+		}
+	}
+}
+
 func TestNATOnlyAppliesToWireGuardSubnet(t *testing.T) {
 	conf := renderServerConfig(map[string]interface{}{
 		"address": "10.88.0.1/24", "listen_port": 51820,