Clarify Feishu app setup and OpenVPN OIDC source

backend/internal/service/openvpn/openvpn_test.go

@@ -105,6 +105,31 @@ func TestOIDCRejectsUnsafeURLs(t *testing.T) {
 	}
 }
 
+func TestSwitchingAwayFromBuiltInCannotReuseItsClientSecret(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("VPN_DATA_DIR", dir)
+	if err := store.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	secret, err := store.EncryptSecret(`{"oidc_client_secret":"old-built-in-secret"}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tunnel := &model.Tunnel{ID: 43, Protocol: "openvpn", Config: `{"oidc_provider":"builtin"}`, Secrets: secret}
+	cfg := map[string]interface{}{
+		"oidc_provider": "external", "oidc_issuer": "https://external.example.com/id",
+		"oidc_base_url": "https://login.example.com", "oidc_client_id": "external-client",
+	}
+	if err := prepareOIDC(tunnel, cfg); err == nil {
+		t.Fatal("external provider reused a built-in client secret")
+	}
+	cfg["oidc_provider"] = "builtin"
+	cfg["oidc_client_secret"] = "forged"
+	if err := prepareOIDC(tunnel, cfg); err == nil {
+		t.Fatal("built-in provider accepted an unregistered issuer and client")
+	}
+}
+
 func TestOIDCRequiresOpenVPN262(t *testing.T) {
 	for _, version := range []string{"OpenVPN 2.5.11 x86_64", "OpenVPN 2.6.1 x86_64", "unknown"} {
 		if err := validateOIDCOpenVPNVersion([]byte(version)); err == nil {