feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/service/openvpn/openvpn.go

@@ -134,8 +134,8 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		}
 		for _, key := range []string{"oidc_issuer", "oidc_base_url"} {
 			u, err := url.Parse(service.Str(out, key))
-			if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (key == "oidc_base_url" && u.Path != "" && u.Path != "/") {
-				return nil, fmt.Errorf("%s 必须是无用户信息、查询和片段的 HTTPS 地址；回调地址使用独立公网域名", key)
+			if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (key == "oidc_base_url" && u.Path != "" && u.Path != "/") {
+				return nil, fmt.Errorf("%s 必须是无用户信息、查询和片段的 HTTP(S) 地址；回调地址使用独立公网域名", key)
 			}
 		}
 		if service.Str(out, "oidc_client_id") == "" {

backend/internal/service/openvpn/openvpn_test.go

@@ -144,7 +144,7 @@ func TestOIDCRejectsUnsafeURLs(t *testing.T) {
 		"auth_mode": "oidc", "oidc_issuer": "https://idp.example.com/realms/a",
 		"oidc_base_url": "https://login.example.com", "oidc_client_id": "vpn",
 	}
-	for _, value := range []string{"http://login.example.com", "https://login.example.com/extra", "https://user@login.example.com", "https://login.example.com/?code=abc"} {
+	for _, value := range []string{"https://login.example.com/extra", "https://user@login.example.com", "https://login.example.com/?code=abc", "ftp://login.example.com"} {
 		cfg := service.CloneConfig(base)
 		cfg["oidc_base_url"] = value
 		if _, err := New().Validate(cfg); err == nil {
@@ -154,6 +154,12 @@ func TestOIDCRejectsUnsafeURLs(t *testing.T) {
 	if _, err := New().Validate(base); err != nil {
 		t.Fatal(err)
 	}
+	httpBase := service.CloneConfig(base)
+	httpBase["oidc_base_url"] = "http://login.example.com:8080"
+	httpBase["oidc_issuer"] = "http://login.example.com:8080/id"
+	if _, err := New().Validate(httpBase); err != nil {
+		t.Fatalf("http public base must be allowed: %v", err)
+	}
 	base["auth_mode"] = "password"
 	base["oidc_client_secret"] = "must-not-survive"
 	cfg, err := New().Validate(base)