Bind Feishu identity to OpenVPN sessions and refine management UI

backend/internal/identityprovider/handlers.go

@@ -212,6 +212,10 @@ func (p *Provider) FeishuCallback(c *gin.Context) {
 		oidcError(c, 403)
 		return
 	}
+	if err := saveProfile(base, cfg, user); err != nil {
+		oidcError(c, 503)
+		return
+	}
 	code, err := randomToken()
 	if err != nil {
 		oidcError(c, 503)
@@ -223,7 +227,8 @@ func (p *Provider) FeishuCallback(c *gin.Context) {
 		return
 	}
 	// A successful user-info lookup confirms this application's browser scope.
-	// Do not store user identifiers; reset this evidence when credentials change.
+	// This timestamp contains no identity; the verified subject and display name
+	// are stored separately in IdentityProfile. Reset the evidence when credentials change.
 	_ = store.DB.Model(&model.IdentityProvider{}).Where("id = ? AND app_id = ? AND tenant_key = ?", cfg.ID, cfg.AppID, cfg.TenantKey).Update("user_scope_verified_at", time.Now()).Error
 	u, _ := url.Parse(state.Redirect)
 	q := u.Query()
@@ -249,6 +254,9 @@ func signIDToken(key *rsa.PrivateKey, kid, base string, cfg model.IdentityProvid
 	now := time.Now().Unix()
 	header, _ := json.Marshal(gin.H{"alg": "RS256", "typ": "JWT", "kid": kid})
 	claims := gin.H{"iss": base, "aud": cfg.ClientID, "sub": grant.Subject, "iat": now, "exp": now + 600, "auth_time": now}
+	if grant.Name != "" {
+		claims["name"] = grant.Name
+	}
 	if grant.Nonce != "" {
 		claims["nonce"] = grant.Nonce
 	}