Suggest configured HTTPS domain for OpenVPN OIDC entry

frontend/src/components/OpenVPNOIDCGuide.vue

@@ -29,7 +29,9 @@
       <div class="field-tip">{{ $t('oidcGuide.secretTip') }}</div>
     </el-form-item>
     <el-form-item :label="$t('oidcGuide.baseUrl')" required>
-      <el-input v-model.trim="config.oidc_base_url" placeholder="https://vpn-login.example.com" />
+      <el-input v-model.trim="config.oidc_base_url" :placeholder="suggestedBaseUrl || 'https://vpn-login.example.com'" />
+      <el-button v-if="suggestedBaseUrl && config.oidc_base_url !== suggestedBaseUrl" class="reuse-domain" link type="primary" @click="config.oidc_base_url = suggestedBaseUrl">{{ $t('oidcGuide.reuseDomain') }}</el-button>
+      <div v-if="suggestedBaseUrl && config.oidc_base_url === suggestedBaseUrl" class="field-tip">{{ $t('oidcGuide.linkedDomain') }}</div>
       <div class="field-tip">{{ $t('oidcGuide.baseTip') }}</div>
     </el-form-item>
     <el-form-item :label="$t('oidcGuide.listenPort')">
@@ -64,8 +66,16 @@ async function loadReadiness() {
   try {
     const { data } = await api.get('/tunnels/openvpn/oidc-readiness')
     readiness.value = data
+    if (!props.editing && !props.config.oidc_base_url && data.https_management_ready && /^[a-z0-9.-]+$/i.test(data.management_domain || '')) {
+      props.config.oidc_base_url = `https://${data.management_domain}`
+    }
   } catch { /* Old servers do not provide a readiness endpoint. */ }
 }
+const suggestedBaseUrl = computed(() => {
+  const status = readiness.value
+  return status?.https_management_ready && /^[a-z0-9.-]+$/i.test(status.management_domain || '')
+    ? `https://${status.management_domain}` : ''
+})
 async function requestPort(from, direction, previous = null) {
   portLoading.value = true
   try {
@@ -105,6 +115,7 @@ const guideStep = computed(() => !props.config.oidc_client_id ? 0
 .guide-alert p { margin: 8px 0 0; line-height: 1.5; }
 .guide-alert ol { padding-left: 20px; line-height: 1.7; }
 .field-tip { margin-top: 4px; color: var(--text-secondary); font-size: 12px; line-height: 1.5; }
+.reuse-domain { margin: 4px 0 0; }
 .port-controls { display: flex; gap: 6px; align-items: center; }
 code { overflow-wrap: anywhere; }
 @media (max-width: 720px) { .guide-steps { overflow-x: auto; justify-content: flex-start; } .guide-steps :deep(.el-step) { min-width: 120px; } }

frontend/src/locales/en-US.json

@@ -229,7 +229,7 @@
     "title": "Feishu / OIDC browser authentication",
     "externalService": "Requires openvpn-auth-oauth2",
     "componentReady": "Authentication component installed v{version}",
-    "authEntryPending": "Management TLS is ready at {domain}; OpenVPN authentication still requires a separate HTTPS hostname and an OIDC issuer.",
+    "authEntryPending": "HTTPS is ready at {domain}; the auth component's public callback route is not yet connected and an OIDC issuer is still needed.",
     "app": "Create app",
     "appShort": "Feishu developer console",
     "identity": "Enter identity settings",
@@ -254,7 +254,8 @@
     "keepSecret": "Leave blank to retain current secret",
     "secretTip": "Encrypted server-side and stored only in the auth service's 0600 configuration file.",
     "baseUrl": "Public sign-in URL",
-    "baseTip": "Use a public HTTPS root URL, not the current HTTP admin address. The auth component handles browser callbacks; its entry site may share the admin server.",
+    "baseTip": "Automatic filling reuses the domain and certificate only. The management site does not yet proxy OAuth2 paths to the auth component. Sign-in needs that Nginx route. Recheck saved tunnel callbacks if the domain changes.",
+    "reuseDomain": "Use current public domain", "linkedDomain": "Using the HTTPS domain from system settings; you can edit it.",
     "listenPort": "Local auth service port",
     "portTip": "Listens only on 127.0.0.1; no public access needed. New tunnels increment from 19090; +/- and manual entry skip configured and locally occupied ports.",
     "portLookupFailed": "Could not find an available port. Retry or enter one manually.",

frontend/src/locales/zh-CN.json

@@ -229,7 +229,7 @@
     "title": "飞书 / OIDC 浏览器认证配置",
     "externalService": "需要 openvpn-auth-oauth2",
     "componentReady": "认证组件已安装 v{version}",
-    "authEntryPending": "管理域名 {domain} 的证书已就绪；OpenVPN 认证入口仍需独立 HTTPS 域名与 OIDC 发行者。",
+    "authEntryPending": "{domain} 的 HTTPS 已就绪；认证组件的公网回调路由尚未接通，仍需配置 OIDC 发行者。",
     "app": "创建应用",
     "appShort": "飞书开放平台",
     "identity": "填写身份信息",
@@ -254,7 +254,8 @@
     "keepSecret": "留空保持原密钥",
     "secretTip": "仅保存在服务端加密存储与 0600 的认证服务配置文件内。",
     "baseUrl": "认证入口公网地址",
-    "baseTip": "填写可公网访问的 HTTPS 域名根地址；不能用当前 HTTP 管理地址。浏览器回调由认证组件处理，入口站点可与管理后台同机部署。",
+    "baseTip": "自动填写仅复用域名和证书；当前管理站点尚未转发认证组件的 OAuth2 路径。接通 Nginx 回调路由前不能完成登录。修改域名后需核对已保存专线的回调地址。",
+    "reuseDomain": "使用当前公网域名", "linkedDomain": "已引用系统设置中的 HTTPS 域名；可手动修改。",
     "listenPort": "本机认证服务端口",
     "portTip": "仅监听本机 127.0.0.1，无需公网开放。新建专线自动从 19090 起递增；加减或手动输入会跳过已配置和本机正在监听的端口。",
     "portLookupFailed": "无法获取可用端口，请稍后重试或手动选择",