Bind Feishu identity to OpenVPN sessions and refine management UI

backend/internal/identityprovider/profile.go

@@ -0,0 +1,40 @@
+package identityprovider
+
+import (
+	"gorm.io/gorm/clause"
+	"vpn-platform/backend/internal/model"
+	"vpn-platform/backend/internal/service"
+	"vpn-platform/backend/internal/store"
+)
+
+func saveProfile(base string, cfg model.IdentityProvider, user accessData) error {
+	return store.DB.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "issuer"}, {Name: "app_id"}, {Name: "subject"}},
+		DoUpdates: clause.AssignmentColumns([]string{"name", "updated_at"}),
+	}).Create(&model.IdentityProfile{Issuer: base, AppID: cfg.AppID, Subject: user.Subject, Name: user.Name}).Error
+}
+
+// ProfileNames returns verified display names only for the current built-in
+// application and exact issuer. Never resolve an identity by IP or name.
+func ProfileNames(tunnel *model.Tunnel, subjects []string) map[string]string {
+	names := map[string]string{}
+	if store.DB == nil || len(subjects) == 0 || tunnel.Protocol != "openvpn" {
+		return names
+	}
+	cfg, err := store.TunnelConfig(tunnel)
+	if err != nil || service.Str(cfg, "auth_mode") != "oidc" || service.Str(cfg, "oidc_provider") != "builtin" {
+		return names
+	}
+	idp, err := current()
+	if err != nil || !idp.Enabled {
+		return names
+	}
+	var profiles []model.IdentityProfile
+	if store.DB.Where("issuer = ? AND app_id = ? AND subject IN ?", service.Str(cfg, "oidc_issuer"), idp.AppID, subjects).Find(&profiles).Error != nil {
+		return names
+	}
+	for _, profile := range profiles {
+		names[profile.Subject] = profile.Name
+	}
+	return names
+}