Show OpenVPN OIDC prerequisites and exposed management port

backend/internal/api/api.go

@@ -285,6 +285,7 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		ops.POST("/binaries/install/:name", s.installBinary)
 		ops.GET("/binaries/install-hint/:name", s.binaryInstallHint)
 		ops.PUT("/tunnels/:id/policy", s.saveTrafficPolicy)
+		ops.GET("/tunnels/openvpn/oidc-readiness", s.openvpnOIDCReadiness)
 
 		// 批量操作 & 任务管理
 		ops.POST("/tunnels/batch/start", s.batchTunnels(taskmgr.ActionStart))

backend/internal/api/openvpn_oidc_readiness.go

@@ -0,0 +1,46 @@
+package api
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"vpn-platform/backend/internal/nginxgateway"
+	"vpn-platform/backend/internal/service"
+	"vpn-platform/backend/internal/tlsservice"
+)
+
+var oidcVersionPattern = regexp.MustCompile(`(?m)^version: ([0-9][0-9A-Za-z.+-]{1,32})\s*$`)
+
+// This checks local prerequisites only. It never tests credentials or claims
+// that an OIDC issuer, callback domain or user authorization is configured.
+func (s *Server) openvpnOIDCReadiness(c *gin.Context) {
+	path := filepath.Join(service.BaseDir(), "bin", "openvpn-auth-oauth2")
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+		path, _ = service.LookBin("openvpn-auth-oauth2")
+	}
+	version := ""
+	if path != "" {
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Second)
+		defer cancel()
+		if output, err := exec.CommandContext(ctx, path, "--version").Output(); err == nil {
+			if match := oidcVersionPattern.FindSubmatch(output); len(match) == 2 {
+				version = strings.TrimSpace(string(match[1]))
+			}
+		}
+	}
+	tls := tlsservice.Status()
+	c.JSON(http.StatusOK, gin.H{
+		"component_installed": path != "", "component_version": version,
+		"https_management_ready":     tls.Mode == "nginx" && tls.Valid && nginxgateway.Stage() == "https",
+		"management_domain":          tls.Domain,
+		"authentication_entry_ready": false, // Depends on a distinct callback site and a configured provider.
+	})
+}