Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/identityprovider/handlers.go

@@ -212,6 +212,25 @@ func (p *Provider) FeishuCallback(c *gin.Context) {
 		oidcError(c, 403)
 		return
 	}
+	allowed, err := admitted(state.Redirect, base, cfg, user.Subject)
+	if err != nil {
+		oidcError(c, 503)
+		return
+	}
+	if !allowed {
+		oidcError(c, 403)
+		return
+	}
+	directoryContext, cancelDirectory := context.WithTimeout(c.Request.Context(), 4*time.Second)
+	defer cancelDirectory()
+	openID := strings.TrimPrefix(user.Subject, tenant+":")
+	// The browser grant can have user-level contact permission even when the
+	// application's tenant token lacks basic_batch permission.
+	if name, err := fetchBasicName(directoryContext, token, openID); err == nil {
+		user.Name = name
+	} else if name, err := fetchDirectoryName(directoryContext, cfg.AppID, secret, openID); err == nil {
+		user.Name = name
+	}
 	if err := saveProfile(base, cfg, user); err != nil {
 		oidcError(c, 503)
 		return