Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/sessionmgr/sessionmgr.go

@@ -31,6 +31,9 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 	now := time.Now()
 	subjects := make([]string, 0, len(clients))
 	for _, client := range clients {
+		if protocol == "openvpn" && client.Username == "" {
+			continue // WebAuth reports UNDEF until the browser flow supplies a subject.
+		}
 		subjects = append(subjects, client.Username)
 	}
 	var tunnel model.Tunnel
@@ -40,6 +43,9 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 	// 1. 收集当前在线的标识 key（username|realAddress）
 	currentKeys := map[string]bool{}
 	for _, c := range clients {
+		if protocol == "openvpn" && c.Username == "" {
+			continue // Never audit a pre-auth socket as a connected VPN identity.
+		}
 		key := c.Username + "|" + c.RealAddress
 		currentKeys[key] = true
 
@@ -89,8 +95,10 @@ func SyncSessions(tunnelID uint, protocol string, clients []ClientInfo) {
 				"disconnected_at": now,
 			})
 			duration := now.Sub(s.ConnectedAt).Round(time.Second)
-			LogConnection(tunnelID, s.Username, "disconnect", s.RealAddress,
-				fmt.Sprintf("时长 %s, ↓%s ↑%s", duration, fmtBytes(s.RxBytes), fmtBytes(s.TxBytes)))
+			if s.Username != "" {
+				LogConnection(tunnelID, s.Username, "disconnect", s.RealAddress,
+					fmt.Sprintf("时长 %s, ↓%s ↑%s", duration, fmtBytes(s.RxBytes), fmtBytes(s.TxBytes)))
+			}
 		}
 	}