Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/service/openvpn/openvpn_test.go

@@ -235,6 +235,19 @@ func TestOIDCTunnelsNeedDistinctCallbackAndPort(t *testing.T) {
 }
 
 func TestValidateOpenVPNModes(t *testing.T) {
+	feishu := map[string]interface{}{"auth_mode": "oidc", "oidc_provider": "builtin", "oidc_issuer": "https://vpn.example.com/id", "oidc_base_url": "https://vpn.example.com", "oidc_client_id": "opsx-vpn", "feishu_access_mode": "allowlist"}
+	if _, err := New().Validate(feishu); err != nil {
+		t.Fatalf("valid member policy: %v", err)
+	}
+	feishu["feishu_access_mode"] = true
+	if _, err := New().Validate(feishu); err == nil {
+		t.Fatal("non-string member policy accepted")
+	}
+	feishu["feishu_access_mode"] = "allowlist"
+	feishu["oidc_provider"] = "external"
+	if _, err := New().Validate(feishu); err == nil {
+		t.Fatal("external OIDC accepted Feishu member policy")
+	}
 	cfg, err := New().Validate(map[string]interface{}{"auth_mode": "password", "subnet": "10.8.0.0 255.255.255.0"})
 	if err != nil {
 		t.Fatal(err)
@@ -456,9 +469,10 @@ func TestWebAuthSessionIdentityAndTrafficTransition(t *testing.T) {
 	if rx, tx := svc.collectTraffic(tunnel); rx != 150 || tx != 230 {
 		t.Fatalf("initial traffic = %d/%d", rx, tx)
 	}
-	var unknown model.VPNSession
-	if err := store.DB.Where("tunnel_id = ? AND status = ?", tunnel.ID, "active").First(&unknown).Error; err != nil || unknown.Username != "" || unknown.VPNUserID != 0 {
-		t.Fatalf("unknown peer must not be attributed: %+v, %v", unknown, err)
+	var unknownCount int64
+	store.DB.Model(&model.VPNSession{}).Where("tunnel_id = ?", tunnel.ID).Count(&unknownCount)
+	if unknownCount != 0 {
+		t.Fatalf("pre-auth socket created %d audit sessions", unknownCount)
 	}
 	var placeholder model.VPNUser
 	store.DB.Where("tunnel_id = ? AND username = ?", tunnel.ID, "UNDEF").First(&placeholder)