Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/sessionmgr/sessionmgr.go

@@ -31,6 +31,9 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 	now := time.Now()
 	subjects := make([]string, 0, len(clients))
 	for _, client := range clients {
+		if protocol == "openvpn" && client.Username == "" {
+			continue // WebAuth reports UNDEF until the browser flow supplies a subject.
+		}
 		subjects = append(subjects, client.Username)
 	}
 	var tunnel model.Tunnel
@@ -40,6 +43,9 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 	// 1. 收集当前在线的标识 key（username|realAddress）
 	currentKeys := map[string]bool{}
 	for _, c := range clients {
+		if protocol == "openvpn" && c.Username == "" {
+			continue // Never audit a pre-auth socket as a connected VPN identity.
+		}
 		key := c.Username + "|" + c.RealAddress
 		currentKeys[key] = true
 
@@ -89,8 +95,10 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 				"disconnected_at": now,
 			})
 			duration := now.Sub(s.ConnectedAt).Round(time.Second)
-			LogConnection(tunnelID, s.Username, "disconnect", s.RealAddress,
-				fmt.Sprintf("时长 %s, ↓%s ↑%s", duration, fmtBytes(s.RxBytes), fmtBytes(s.TxBytes)))
+			if s.Username != "" {
+				LogConnection(tunnelID, s.Username, "disconnect", s.RealAddress,
+					fmt.Sprintf("时长 %s, ↓%s ↑%s", duration, fmtBytes(s.RxBytes), fmtBytes(s.TxBytes)))
+			}
 		}
 	}
 

backend/internal/sessionmgr/sessionmgr_test.go

@@ -36,3 +36,37 @@ func TestDisconnectLoggedOnceWhenTunnelHasNoClients(t *testing.T) {
 		t.Fatalf("expected one connect and one disconnect with stable subject, got %+v", logs)
 	}
 }
+
+func TestOpenVPNPreAuthSocketDoesNotCreateAnonymousAudit(t *testing.T) {
+	previous := store.DB
+	t.Cleanup(func() {
+		if store.DB != nil {
+			if db, err := store.DB.DB(); err == nil {
+				_ = db.Close()
+			}
+		}
+		store.DB = previous
+	})
+	if err := store.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	tunnel := model.Tunnel{Name: "web-auth", Protocol: "openvpn"}
+	if err := store.DB.Create(&tunnel).Error; err != nil {
+		t.Fatal(err)
+	}
+	preAuth := ClientInfo{RealAddress: "203.0.113.1:4321", RxBytes: 100, TxBytes: 200}
+	SyncSessions(tunnel.ID, "openvpn", []ClientInfo{preAuth})
+	var count int64
+	store.DB.Model(&model.ConnectionLog{}).Where("tunnel_id = ?", tunnel.ID).Count(&count)
+	if count != 0 {
+		t.Fatal("pre-auth status created an audit log")
+	}
+	preAuth.Username = "tenant:ou_verified"
+	SyncSessions(tunnel.ID, "openvpn", []ClientInfo{preAuth})
+	SyncSessions(tunnel.ID, "openvpn", nil)
+	var logs []model.ConnectionLog
+	store.DB.Where("tunnel_id = ?", tunnel.ID).Order("id").Find(&logs)
+	if len(logs) != 2 || logs[0].Username != preAuth.Username || logs[1].Username != preAuth.Username {
+		t.Fatalf("unexpected authenticated audit sequence: %+v", logs)
+	}
+}