Add opt-in built-in Feishu OIDC issuer for OpenVPN

backend/internal/api/api.go

@@ -22,6 +22,7 @@ import (
 
 	"vpn-platform/backend/internal/binmgr"
 	"vpn-platform/backend/internal/core"
+	"vpn-platform/backend/internal/identityprovider"
 	"vpn-platform/backend/internal/model"
 	"vpn-platform/backend/internal/service"
 	"vpn-platform/backend/internal/service/custom"
@@ -213,6 +214,14 @@ func requirePasswordChanged() gin.HandlerFunc {
 func (s *Server) RegisterRoutes(r *gin.Engine) {
 	s.router = r
 	r.Use(securityHeaders())
+	idp := identityprovider.New()
+	id := r.Group("/id", identityprovider.SecureGateway(), identityprovider.RateLimit())
+	id.GET("/.well-known/openid-configuration", idp.Discovery)
+	id.GET("/jwks", idp.JWKS)
+	id.GET("/authorize", idp.Authorize)
+	id.GET("/feishu/callback", idp.FeishuCallback)
+	id.POST("/token", idp.Token)
+	id.GET("/userinfo", idp.UserInfo)
 	api := r.Group("/api")
 	api.POST("/login", s.login)
 	api.GET("/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
@@ -302,6 +311,9 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		admin.GET("/system/env", s.systemEnv)
 		admin.POST("/system/fix", s.systemFix)
 		admin.GET("/system/tls", s.tlsStatus)
+		admin.GET("/system/identity", idp.Status)
+		admin.PUT("/system/identity", idp.Configure)
+		admin.POST("/system/identity/gateway", identityprovider.SecureGateway(), s.identityGateway)
 		admin.PUT("/system/tls/domain", s.setTLSDomain)
 		admin.PUT("/system/tls/mode", s.setTLSMode)
 		admin.GET("/system/tls/nginx-preview", s.nginxPreview)