Bind Feishu identity to OpenVPN sessions and refine management UI

backend/internal/service/openvpn/openvpn.go

@@ -969,17 +969,24 @@ func (s *Service) collectTraffic(t *model.Tunnel) (int64, int64) {
 			continue
 		}
 		cn := f[1]
-		username := cn
-		if len(f) > 9 && f[9] != "" && f[9] != "UNDEF" {
-			username = f[9]
-		}
+		username := statusUsername(f)
 		realAddr := f[2]
 		virtualAddr := ""
 		if len(f) > 4 {
 			virtualAddr = f[3]
 		}
-		key := username + "|" + realAddr
-		old := snap[key]
+		keyName := username
+		if keyName == "" {
+			// Preserve the old traffic snapshot key for anonymous OIDC peers.
+			keyName = cn
+		}
+		key := keyName + "|" + realAddr
+		old, found := snap[key]
+		if !found && username != "" {
+			// A WebAuth peer can gain a verified username after its initial
+			// UNDEF snapshot. Keep counting from the same socket's prior value.
+			old = snap["UNDEF|"+realAddr]
+		}
 		deltaRx, deltaTx := rx-old.Rx, tx-old.Tx
 		if deltaRx < 0 {
 			deltaRx = rx
@@ -1015,6 +1022,22 @@ func splitStatusFields(line string) []string {
 	return strings.Split(line, ",")
 }
 
+// OpenVPN writes UNDEF when certificate-free WebAuth has not supplied a
+// username. It is a protocol placeholder, never a verified Feishu identity.
+func statusUsername(fields []string) string {
+	if len(fields) > 9 {
+		if username := strings.TrimSpace(fields[9]); username != "" && !strings.EqualFold(username, "UNDEF") {
+			return username
+		}
+	}
+	if len(fields) > 1 {
+		if cn := strings.TrimSpace(fields[1]); cn != "" && !strings.EqualFold(cn, "UNDEF") {
+			return cn
+		}
+	}
+	return ""
+}
+
 func (s *Service) Delete(t *model.Tunnel) error { return s.Stop(t) }
 
 // RunAuthHelper is called by the same opsx-vpn binary from OpenVPN's