Add opt-in built-in Feishu OIDC issuer for OpenVPN

backend/internal/nginxgateway/gateway.go

@@ -46,6 +46,58 @@ func Stage() string {
 	return "http"
 }
 
+// AuthRouteReady reflects the installed managed site, not actual Feishu reachability.
+func AuthRouteReady(port int) (bool, bool) {
+	data, err := os.ReadFile(sitePath)
+	if err != nil {
+		return false, false
+	}
+	return strings.Contains(string(data), "location = /id/.well-known/openid-configuration"),
+		port > 0 && strings.Contains(string(data), fmt.Sprintf("proxy_pass http://127.0.0.1:%d;", port))
+}
+
+// RefreshAuth updates only the managed site after validation; a bad config is
+// rolled back before returning. It never provisions a certificate or domain.
+func RefreshAuth(domain string, routes gin.RoutesInfo, authPort int) error {
+	if Running() {
+		return errors.New("公网入口操作正在进行")
+	}
+	if err := checkSites(); err != nil {
+		return err
+	}
+	if Stage() != "https" {
+		return errors.New("请先启用 HTTPS 站点")
+	}
+	previous, err := os.ReadFile(sitePath)
+	if err != nil {
+		return err
+	}
+	if !strings.Contains(string(previous), "server_name "+domain+";") {
+		return errors.New("现有站点域名与配置不匹配")
+	}
+	httpSite, httpsSite, err := nginxconfig.RenderWithAuth(domain, routes, authPort)
+	if err != nil {
+		return err
+	}
+	if err := writeSite(httpSite + httpsSite); err != nil {
+		return err
+	}
+	rollback := func() {
+		_ = writeSite(string(previous))
+		_ = command(func(string) {}, 15*time.Second, "nginx", "-t")
+		_ = command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx")
+	}
+	if err := command(func(string) {}, 15*time.Second, "nginx", "-t"); err != nil {
+		rollback()
+		return err
+	}
+	if err := command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx"); err != nil {
+		rollback()
+		return err
+	}
+	return nil
+}
+
 func command(emit func(string), timeout time.Duration, name string, args ...string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()