Add opt-in built-in Feishu OIDC issuer for OpenVPN

backend/internal/model/model.go

@@ -3,6 +3,30 @@ package model
 
 import "time"
 
+// IdentityProvider is the opt-in, single-tenant Feishu OIDC issuer configuration.
+// Credentials are encrypted with the platform key and never serialized in API responses.
+type IdentityProvider struct {
+	ID           uint      `gorm:"primaryKey" json:"-"`
+	Enabled      bool      `json:"enabled"`
+	AppID        string    `gorm:"size:128" json:"app_id"`
+	AppSecret    string    `gorm:"type:text" json:"-"`
+	TenantKey    string    `gorm:"size:128" json:"tenant_key"`
+	ClientID     string    `gorm:"size:128" json:"client_id"`
+	ClientSecret string    `gorm:"type:text" json:"-"`
+	UpdatedAt    time.Time `json:"updated_at"`
+}
+
+// IdentityGrant stores only a hash of each browser state, authorization code,
+// or access token. A consumed code cannot be exchanged a second time.
+type IdentityGrant struct {
+	ID        uint      `gorm:"primaryKey"`
+	Kind      string    `gorm:"size:12;index"`
+	Digest    string    `gorm:"size:64;uniqueIndex"`
+	Payload   string    `gorm:"type:text"`
+	ExpiresAt time.Time `gorm:"index"`
+	Consumed  bool      `gorm:"default:false"`
+}
+
 // TrafficSample 流量时间序列采样（每 60 秒一次，用于趋势图） // Logan.Li
 type TrafficSample struct {
 	ID        uint      `gorm:"primaryKey" json:"id"`