Resolve Feishu names by verified open ID and scope VPN member access

backend/internal/sessionmgr/sessionmgr_test.go

@@ -36,3 +36,37 @@ func TestDisconnectLoggedOnceWhenTunnelHasNoClients(t *testing.T) {
 		t.Fatalf("expected one connect and one disconnect with stable subject, got %+v", logs)
 	}
 }
+
+func TestOpenVPNPreAuthSocketDoesNotCreateAnonymousAudit(t *testing.T) {
+	previous := store.DB
+	t.Cleanup(func() {
+		if store.DB != nil {
+			if db, err := store.DB.DB(); err == nil {
+				_ = db.Close()
+			}
+		}
+		store.DB = previous
+	})
+	if err := store.Init(t.TempDir()); err != nil {
+		t.Fatal(err)
+	}
+	tunnel := model.Tunnel{Name: "web-auth", Protocol: "openvpn"}
+	if err := store.DB.Create(&tunnel).Error; err != nil {
+		t.Fatal(err)
+	}
+	preAuth := ClientInfo{RealAddress: "203.0.113.1:4321", RxBytes: 100, TxBytes: 200}
+	SyncSessions(tunnel.ID, "openvpn", []ClientInfo{preAuth})
+	var count int64
+	store.DB.Model(&model.ConnectionLog{}).Where("tunnel_id = ?", tunnel.ID).Count(&count)
+	if count != 0 {
+		t.Fatal("pre-auth status created an audit log")
+	}
+	preAuth.Username = "tenant:ou_verified"
+	SyncSessions(tunnel.ID, "openvpn", []ClientInfo{preAuth})
+	SyncSessions(tunnel.ID, "openvpn", nil)
+	var logs []model.ConnectionLog
+	store.DB.Where("tunnel_id = ?", tunnel.ID).Order("id").Find(&logs)
+	if len(logs) != 2 || logs[0].Username != preAuth.Username || logs[1].Username != preAuth.Username {
+		t.Fatalf("unexpected authenticated audit sequence: %+v", logs)
+	}
+}