feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/identityprovider/admin.go

@@ -15,6 +15,7 @@ import (
 	"gorm.io/gorm"
 	"vpn-platform/backend/internal/nginxgateway"
 	"vpn-platform/backend/internal/store"
+	"vpn-platform/backend/internal/tlsservice"
 )
 
 const feishuTenantToken = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
@@ -33,7 +34,14 @@ func secureAdmin(c *gin.Context) bool {
 		return true
 	}
 	peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
-	return err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() && c.GetHeader("X-Forwarded-Proto") == "https"
+	if err != nil || net.ParseIP(peer) == nil || !net.ParseIP(peer).IsLoopback() {
+		return false
+	}
+	scheme := tlsservice.Status().Scheme
+	if scheme == "" {
+		scheme = "https"
+	}
+	return c.GetHeader("X-Forwarded-Proto") == scheme
 }
 
 type tenantCredentials struct {
@@ -116,7 +124,7 @@ func queryFeishuTenant(ctx context.Context, creds tenantCredentials) (string, st
 func (p *Provider) QueryTenant(c *gin.Context) {
 	noStore(c)
 	if !secureAdmin(c) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口查询飞书企业信息"})
+		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信公网管理入口查询飞书企业信息"})
 		return
 	}
 	var input tenantCredentials
@@ -168,7 +176,7 @@ func (p *Provider) Status(c *gin.Context) {
 
 func (p *Provider) Configure(c *gin.Context) {
 	if !secureAdmin(c) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口保存飞书凭据"})
+		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信公网管理入口保存飞书凭据"})
 		return
 	}
 	var req struct {