Clarify Feishu app setup and OpenVPN OIDC source

frontend/src/locales/en-US.json

@@ -229,23 +229,27 @@
     "title": "Feishu / OIDC browser authentication",
     "externalService": "Requires openvpn-auth-oauth2",
     "componentReady": "Authentication component installed v{version}",
-    "authEntryPending": "HTTPS is ready at {domain}; the auth component's public callback route is not yet connected and an OIDC issuer is still needed.",
+    "authEntryPending": "HTTPS is ready at {domain}; sync the authentication route in Settings → Feishu Identity after starting the tunnel.",
     "app": "Create app",
     "appShort": "Feishu developer console",
     "identity": "Enter identity settings",
     "identityShort": "OIDC and credentials",
+    "builtinIdentityShort": "Enter Feishu credentials in Settings",
     "callback": "Set public callback",
     "callbackShort": "HTTPS reverse proxy",
     "test": "Test client",
     "testShort": "Browser sign-in",
     "appTip": "Ask a Feishu administrator to create and publish an app with the appropriate sign-in capability.",
+    "builtinAppTip": "Manage Feishu App ID and App Secret in Settings → Feishu Identity, not in each tunnel.",
     "openConsole": "Open Feishu app console",
     "appInstruction1": "Create an enterprise app, obtain its credentials, and enable the web sign-in capability.",
     "appInstruction2": "Register a redirect URL under the app's security/redirect settings. If using a broker, use the broker's upstream callback here.",
+    "builtinAppInstruction2": "Register the Feishu app callback shown below in the app's redirect settings, not the VPN client callback.",
     "appInstruction3": "Publish the app and restrict its available users to people allowed to access this VPN.",
     "scopeTip": "Restrict who can use the Feishu app. LDAP dial-in users are not automatically linked to Feishu identities.",
     "providerTip": "Use the built-in Feishu issuer configured in Settings, or provide an external issuer with OIDC discovery and ID tokens. A Feishu app URL alone is not an issuer.",
-    "useBuiltIn": "Use built-in Feishu issuer", "builtInSecret": "The VPN client secret is supplied internally by the server and never returned on this page.", "builtInGatewayPending": "The public Nginx route for the built-in issuer is pending; sync it in Settings before testing.",
+    "source": "Identity source", "builtinSource": "Built-in Feishu", "externalSource": "External OIDC", "configureBuiltIn": "The built-in Feishu issuer is not enabled. Save app credentials and enable it in Settings first.", "manageFeishu": "Open Settings → Feishu Identity", "builtinSummary": "The Feishu App ID, App Secret, and tenant are managed in Settings; this tunnel references the issuer and its own public authentication entry.",
+    "useBuiltIn": "Use built-in Feishu issuer", "builtInSecret": "The server supplies the VPN Client Secret. Do not enter the Feishu App Secret here.", "builtInGatewayPending": "The public Nginx route for the built-in issuer is pending; sync it in Settings before testing.",
     "issuer": "OIDC issuer URL",
     "issuerTip": "Use an HTTPS issuer that provides standard discovery (/.well-known/openid-configuration) and ID tokens, not an authorization page URL.",
     "clientId": "OIDC Client ID",
@@ -256,15 +260,17 @@
     "secretTip": "Encrypted server-side and stored only in the auth service's 0600 configuration file.",
     "baseUrl": "Public sign-in URL",
     "baseTip": "Automatic filling reuses the domain and certificate only. The management site does not yet proxy OAuth2 paths to the auth component. Sign-in needs that Nginx route. Recheck saved tunnel callbacks if the domain changes.",
+    "builtinBaseTip": "Uses the system HTTPS domain automatically. The auth component listens locally; sync public routes in Settings after starting the tunnel.",
     "reuseDomain": "Use current public domain", "linkedDomain": "Using the HTTPS domain from system settings; you can edit it.",
     "listenPort": "Local auth service port",
     "portTip": "Listens only on 127.0.0.1; no public access needed. New tunnels increment from 19090; +/- and manual entry skip configured and locally occupied ports.",
     "portLookupFailed": "Could not find an available port. Retry or enter one manually.",
     "callbackTitle": "Register this callback with the final OIDC provider",
     "callbackTip": "With an identity broker, register this URL in the broker's OIDC client, and register the broker's upstream callback in Feishu. Reverse proxy the public endpoint to 127.0.0.1:{port}; :18080 does not handle this callback.",
+    "builtinCallbackTitle": "The VPN client and Feishu app use different callbacks", "builtinCallbackTip": "The VPN client callback above is handled by openvpn-auth-oauth2. Register only the Feishu app callback below in Feishu. After starting the tunnel, sync /oauth2/ to local port 127.0.0.1:{port} in Settings.", "feishuCallbackLabel": "Feishu app callback",
     "testTip": "Install openvpn-auth-oauth2 and OpenVPN ≥ 2.6.2, then test with a WebAuth-capable client (e.g. OpenVPN Community for Windows or Tunnelblick/Viscosity for macOS). OpenVPN Connect v3 needs individual testing.",
     "startFailed": "Configuration generated, but the tunnel did not start. Resolve the error below and retry from the tunnel list.",
-    "fillRequired": "Enter the OIDC issuer, app credentials, and public sign-in URL"
+    "fillRequired": "Configure an identity source, OIDC issuer, VPN client credentials, and public sign-in URL"
   },
   "tunnelEditor": {
     "title": "Edit Tunnel",
@@ -569,7 +575,7 @@
   },
   "identity": {
     "tab": "Feishu identity", "title": "Built-in Feishu identity service", "description": "Issue OIDC identities for VPN using your existing HTTPS domain. Feishu app credentials stay upstream; this platform creates separate VPN client credentials.",
-    "appId": "Feishu App ID", "appSecret": "Feishu App Secret", "secretPlaceholder": "Leave blank to retain the secret; use a rotated secret for new setup", "tenant": "Allowed Feishu tenant_key", "tenantPlaceholder": "Verify the enterprise tenant_key from Feishu user info", "enabled": "Enable built-in issuer",
+    "appId": "Feishu App ID", "appSecret": "Feishu App Secret", "secretPlaceholder": "Leave blank to retain the secret; use a rotated secret for new setup", "tenant": "Allowed Feishu tenant_key", "tenantPlaceholder": "Verify the enterprise tenant_key from Feishu user info", "enabled": "Enable built-in issuer", "httpsOnly": "Enter app credentials only through the HTTPS management site. Switch to its secure address.", "openHttps": "Open HTTPS management site",
     "httpsRequired": "Configure and activate your public HTTPS site and certificate first.", "gatewayPending": "The identity provider is saved but Nginx does not yet route /id/; sync the gateway.",
     "addresses": "Addresses and client credentials", "issuer": "OIDC issuer", "feishuCallback": "Callback registered in Feishu", "vpnCallback": "VPN client callback", "clientId": "VPN Client ID",
     "oneTimeSecret": "New VPN Client Secret is displayed only once. Store it safely; rotation of active tunnel credentials requires separate planning.", "routeHint": "Sync identity routes first. After starting the one OpenVPN OIDC tunnel using this domain, sync again to route /oauth2/ to its local auth component.",

frontend/src/locales/zh-CN.json

@@ -229,23 +229,27 @@
     "title": "飞书 / OIDC 浏览器认证配置",
     "externalService": "需要 openvpn-auth-oauth2",
     "componentReady": "认证组件已安装 v{version}",
-    "authEntryPending": "{domain} 的 HTTPS 已就绪；认证组件的公网回调路由尚未接通，仍需配置 OIDC 发行者。",
+    "authEntryPending": "{domain} 的 HTTPS 已就绪；专线启动后还需在“设置 → 飞书身份”同步认证入口路由。",
     "app": "创建应用",
     "appShort": "飞书开放平台",
     "identity": "填写身份信息",
     "identityShort": "OIDC 和应用凭据",
+    "builtinIdentityShort": "在系统设置中填写飞书凭据",
     "callback": "设置公网回调",
     "callbackShort": "HTTPS 与反向代理",
     "test": "客户端试连",
     "testShort": "浏览器登录验证",
     "appTip": "先由飞书管理员在开放平台创建应用，启用身份登录所需能力，并发布应用。",
+    "builtinAppTip": "飞书 App ID 和 App Secret 统一在“设置 → 飞书身份”填写，不在专线里填写。",
     "openConsole": "打开飞书开放平台的应用管理",
     "appInstruction1": "创建企业自建应用，获取应用凭据，并启用登录所需的网页授权能力。",
     "appInstruction2": "在应用的安全/重定向地址设置中登记回调；若使用身份代理，这里应填代理给飞书的上游回调地址。",
+    "builtinAppInstruction2": "在飞书应用的安全/重定向地址中登记下方“飞书应用回调”，不要登记 VPN 客户端回调。",
     "appInstruction3": "发布应用，并在可用范围中只授权允许使用此 VPN 的人员。",
     "scopeTip": "在飞书侧限定应用可用人员。现有 LDAP 拨号用户不会自动关联飞书身份。",
     "providerTip": "可使用设置页配置的内置飞书身份服务；使用外部发行者时仍需标准 OIDC discovery 与 ID Token。飞书应用地址本身不是发行者。",
-    "useBuiltIn": "使用内置飞书身份服务", "builtInSecret": "内置 VPN 客户端密钥由服务端自动提供，不在页面回显。", "builtInGatewayPending": "内置发行者尚未更新公网 Nginx 路由；到设置页“飞书身份”同步入口后再联调。",
+    "source": "身份来源", "builtinSource": "内置飞书身份", "externalSource": "外部 OIDC", "configureBuiltIn": "尚未启用内置飞书身份服务；请先到设置页保存应用凭据并启用。", "manageFeishu": "前往设置 → 飞书身份", "builtinSummary": "飞书 App ID、App Secret 与租户标识在设置页统一管理；专线只引用 OIDC 发行者和专属认证入口。",
+    "useBuiltIn": "使用内置飞书身份服务", "builtInSecret": "VPN Client Secret 由服务端自动关联，无需复制或填写飞书 App Secret。", "builtInGatewayPending": "内置身份入口尚未同步 Nginx；到“设置 → 飞书身份”同步后再联调。",
     "issuer": "OIDC 发行者地址",
     "issuerTip": "填写能提供标准 OIDC discovery（/.well-known/openid-configuration）和 ID Token 的 HTTPS 地址；不要填写飞书授权页面地址。",
     "clientId": "OIDC Client ID",
@@ -256,15 +260,17 @@
     "secretTip": "仅保存在服务端加密存储与 0600 的认证服务配置文件内。",
     "baseUrl": "认证入口公网地址",
     "baseTip": "自动填写仅复用域名和证书；当前管理站点尚未转发认证组件的 OAuth2 路径。接通 Nginx 回调路由前不能完成登录。修改域名后需核对已保存专线的回调地址。",
+    "builtinBaseTip": "自动使用系统 HTTPS 域名；认证组件仅监听本机，启动专线后到设置页同步公网路由。",
     "reuseDomain": "使用当前公网域名", "linkedDomain": "已引用系统设置中的 HTTPS 域名；可手动修改。",
     "listenPort": "本机认证服务端口",
     "portTip": "仅监听本机 127.0.0.1，无需公网开放。新建专线自动从 19090 起递增；加减或手动输入会跳过已配置和本机正在监听的端口。",
     "portLookupFailed": "无法获取可用端口，请稍后重试或手动选择",
     "callbackTitle": "在最终 OIDC 身份提供方的客户端中登记此回调地址",
     "callbackTip": "如果通过身份代理接入飞书，本地址登记在代理的 OIDC 客户端中，飞书应用应登记代理的上游回调。将公网入口的所有路径反向代理至本机 127.0.0.1:{port}；不由 :18080 处理。",
+    "builtinCallbackTitle": "专线与飞书使用不同的回调地址", "builtinCallbackTip": "上方是 VPN 客户端回调，由 openvpn-auth-oauth2 处理；飞书应用中只登记下方的飞书应用回调。启动专线后在设置页同步 /oauth2/ 路由至本机 127.0.0.1:{port}。", "feishuCallbackLabel": "飞书应用回调",
     "testTip": "安装 openvpn-auth-oauth2 与 OpenVPN ≥ 2.6.2 后启动专线；使用支持 WebAuth 的客户端试连（如 Windows OpenVPN Community、macOS Tunnelblick/Viscosity）。OpenVPN Connect v3 部分兼容，须实测。",
     "startFailed": "配置已生成，但专线未成功启动；处理下方错误后从专线列表重新启动",
-    "fillRequired": "请填写 OIDC 地址、应用凭据和公网认证入口"
+    "fillRequired": "请先配置身份来源，并填写 OIDC 地址、VPN 客户端凭据和公网认证入口"
   },
   "tunnelEditor": {
     "title": "编辑专线",
@@ -569,7 +575,7 @@
   },
   "identity": {
     "tab": "飞书身份", "title": "内置飞书身份服务", "description": "使用现有 HTTPS 域名签发 VPN 所需 OIDC 身份令牌。飞书 App 凭据仅用于飞书上游，VPN 客户端凭据由本平台生成。",
-    "appId": "飞书 App ID", "appSecret": "飞书 App Secret", "secretPlaceholder": "留空保持当前密钥；新配置请输入轮换后的密钥", "tenant": "允许的飞书 tenant_key", "tenantPlaceholder": "从飞书用户信息确认企业 tenant_key", "enabled": "启用内置发行者",
+    "appId": "飞书 App ID", "appSecret": "飞书 App Secret", "secretPlaceholder": "留空保持当前密钥；新配置请输入轮换后的密钥", "tenant": "允许的飞书 tenant_key", "tenantPlaceholder": "从飞书用户信息确认企业 tenant_key", "enabled": "启用内置发行者", "httpsOnly": "应用密钥只能通过 HTTPS 管理入口填写；请切换到安全地址。", "openHttps": "打开 HTTPS 管理入口",
     "httpsRequired": "请先完成公网域名 HTTPS 证书和站点配置，再启用身份服务。", "gatewayPending": "身份服务已保存，但 Nginx 尚未转发 /id/；请同步公网入口。",
     "addresses": "接入地址与客户端凭据", "issuer": "OIDC 发行者", "feishuCallback": "登记到飞书应用的回调", "vpnCallback": "VPN 客户端回调", "clientId": "VPN Client ID",
     "oneTimeSecret": "新 VPN Client Secret 只显示这一次，请立即妥善保存；现有专线的密钥轮换需另行安排。", "routeHint": "先同步身份路由；启动唯一一条使用当前域名的 OpenVPN OIDC 专线后，再同步一次以转发 /oauth2/ 到本机认证组件。",