Add opt-in built-in Feishu OIDC issuer for OpenVPN

backend/internal/nginxconfig/nginxconfig_test.go

@@ -64,3 +64,25 @@ func TestRenderRejectsInjectedDomainAndRoute(t *testing.T) {
 		t.Fatal("injected route accepted")
 	}
 }
+
+func TestRenderIdentityAndSingleAuthPort(t *testing.T) {
+	_, site, err := RenderWithAuth("vpn.example.com", gin.RoutesInfo{{Method: "GET", Path: "/api/health"}}, 19090)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, route := range []string{"location = /id/.well-known/openid-configuration", "location = /id/feishu/callback", "location = /id/token", "location ^~ /oauth2/", "proxy_pass http://127.0.0.1:19090;", "location / { return 444; }"} {
+		if !strings.Contains(site, route) {
+			t.Errorf("identity route missing: %s", route)
+		}
+	}
+	if strings.Contains(site, "location ^~ /id/") || strings.Contains(site, "location ^~ /.well-known/") {
+		t.Fatal("identity routes must stay allowlisted")
+	}
+	if _, _, err := RenderWithAuth("vpn.example.com", nil, 80); err == nil {
+		t.Fatal("invalid auth port accepted")
+	}
+	_, withoutAuth, err := Render("vpn.example.com", nil)
+	if err != nil || strings.Contains(withoutAuth, "location ^~ /oauth2/") {
+		t.Fatal("auth component exposed without a configured port")
+	}
+}