Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/service/openvpn/openvpn.go

@@ -115,6 +115,18 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		return nil, fmt.Errorf("auth_mode 必须为 certificate、password、certificate+password 或 oidc")
 	}
 	if service.Str(out, "auth_mode") == "oidc" {
+		if raw, present := out["feishu_access_mode"]; present {
+			if _, ok := raw.(string); !ok {
+				return nil, fmt.Errorf("feishu_access_mode 必须为字符串")
+			}
+		}
+		mode := service.Str(out, "feishu_access_mode")
+		if mode != "" && mode != "all" && mode != "allowlist" {
+			return nil, fmt.Errorf("feishu_access_mode 必须为 all 或 allowlist")
+		}
+		if mode == "allowlist" && service.Str(out, "oidc_provider") != "builtin" {
+			return nil, fmt.Errorf("指定飞书成员仅适用于内置飞书身份服务")
+		}
 		switch service.Str(out, "oidc_provider") {
 		case "", "external", "builtin":
 		default:
@@ -138,6 +150,7 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		}
 		out["mfa_mode"] = "off" // 飞书 MFA 由身份提供方负责
 	} else {
+		delete(out, "feishu_access_mode")
 		for _, key := range []string{"oidc_provider", "oidc_issuer", "oidc_base_url", "oidc_client_id", "oidc_client_secret", "oidc_http_port", "oidc_http_secret", "oidc_management_password"} {
 			delete(out, key)
 		}