Fetch Feishu tenant identity from app credentials

backend/internal/api/api.go

@@ -312,6 +312,7 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		admin.POST("/system/fix", s.systemFix)
 		admin.GET("/system/tls", s.tlsStatus)
 		admin.GET("/system/identity", idp.Status)
+		admin.POST("/system/identity/tenant", idp.QueryTenant)
 		admin.PUT("/system/identity", idp.Configure)
 		admin.POST("/system/identity/gateway", identityprovider.SecureGateway(), s.identityGateway)
 		admin.PUT("/system/tls/domain", s.setTLSDomain)

backend/internal/identityprovider/admin.go

@@ -1,6 +1,11 @@
 package identityprovider
 
 import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
 	"net"
 	"net/http"
 	"strings"
@@ -11,6 +16,118 @@ import (
 	"vpn-platform/backend/internal/store"
 )
 
+const feishuTenantToken = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
+const feishuTenantQuery = "https://open.feishu.cn/open-apis/tenant/v2/tenant/query"
+
+func secureAdmin(c *gin.Context) bool {
+	if c.Request.TLS != nil {
+		return true
+	}
+	peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
+	return err == nil && net.ParseIP(peer) != nil && net.ParseIP(peer).IsLoopback() && c.GetHeader("X-Forwarded-Proto") == "https"
+}
+
+type tenantCredentials struct {
+	AppID     string `json:"app_id"`
+	AppSecret string `json:"app_secret"`
+}
+
+func resolveTenantCredentials(input tenantCredentials, cfgAppID, encryptedSecret string) (tenantCredentials, error) {
+	input.AppID = strings.TrimSpace(input.AppID)
+	if input.AppID == "" || len(input.AppID) > 128 || strings.ContainsAny(input.AppID, " \r\n\t") || len(input.AppSecret) > 512 {
+		return input, errors.New("请输入有效的飞书 App ID 和 App Secret")
+	}
+	if input.AppSecret == "" && input.AppID == cfgAppID && encryptedSecret != "" {
+		secret, err := store.DecryptSecret(encryptedSecret)
+		if err != nil {
+			return input, errors.New("读取已保存的飞书密钥失败")
+		}
+		input.AppSecret = secret
+	}
+	if input.AppSecret == "" {
+		return input, errors.New("请填写当前 App ID 对应的 App Secret")
+	}
+	return input, nil
+}
+
+// queryFeishuTenant requests app-scoped tenant information without exposing the
+// upstream access token or raw upstream errors to the management UI.
+func queryFeishuTenant(ctx context.Context, creds tenantCredentials) (string, string, error) {
+	payload, _ := json.Marshal(map[string]string{"app_id": creds.AppID, "app_secret": creds.AppSecret})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, feishuTenantToken, bytes.NewReader(payload))
+	if err != nil {
+		return "", "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := upstreamClient.Do(req)
+	if err != nil {
+		return "", "", errors.New("飞书企业信息请求失败，请稍后重试")
+	}
+	defer resp.Body.Close()
+	var token struct {
+		Code              *int   `json:"code"`
+		TenantAccessToken string `json:"tenant_access_token"`
+	}
+	if resp.StatusCode != http.StatusOK || json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&token) != nil || token.Code == nil || *token.Code != 0 || token.TenantAccessToken == "" {
+		return "", "", errors.New("获取飞书访问凭据失败，请检查 App ID 和 App Secret")
+	}
+	req, err = http.NewRequestWithContext(ctx, http.MethodGet, feishuTenantQuery, nil)
+	if err != nil {
+		return "", "", err
+	}
+	req.Header.Set("Authorization", "Bearer "+token.TenantAccessToken)
+	resp, err = upstreamClient.Do(req)
+	if err != nil {
+		return "", "", errors.New("飞书企业信息请求失败，请稍后重试")
+	}
+	defer resp.Body.Close()
+	var result struct {
+		Code *int `json:"code"`
+		Data struct {
+			Tenant struct {
+				TenantKey string `json:"tenant_key"`
+				Name      string `json:"name"`
+			} `json:"tenant"`
+		} `json:"data"`
+	}
+	if resp.StatusCode != http.StatusOK || json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&result) != nil || result.Code == nil || *result.Code != 0 {
+		return "", "", errors.New("查询飞书企业信息失败，请确认应用已开通企业信息读取权限")
+	}
+	if !validTenant(result.Data.Tenant.TenantKey) {
+		return "", "", errors.New("飞书未返回有效的企业标识")
+	}
+	return result.Data.Tenant.TenantKey, result.Data.Tenant.Name, nil
+}
+
+func (p *Provider) QueryTenant(c *gin.Context) {
+	noStore(c)
+	if !secureAdmin(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口查询飞书企业信息"})
+		return
+	}
+	var input tenantCredentials
+	if c.ShouldBindJSON(&input) != nil {
+		c.JSON(400, gin.H{"error": "配置格式错误"})
+		return
+	}
+	cfg, err := current()
+	if err != nil && err != gorm.ErrRecordNotFound {
+		c.JSON(500, gin.H{"error": "读取身份配置失败"})
+		return
+	}
+	input, err = resolveTenantCredentials(input, cfg.AppID, cfg.AppSecret)
+	if err != nil {
+		c.JSON(400, gin.H{"error": err.Error()})
+		return
+	}
+	key, name, err := queryFeishuTenant(c.Request.Context(), input)
+	if err != nil {
+		c.JSON(502, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, gin.H{"tenant_key": key, "name": name})
+}
+
 func (p *Provider) Status(c *gin.Context) {
 	cfg, err := current()
 	if err != nil && err != gorm.ErrRecordNotFound {
@@ -35,13 +152,10 @@ func (p *Provider) Status(c *gin.Context) {
 }
 
 func (p *Provider) Configure(c *gin.Context) {
-	if c.Request.TLS == nil {
-		peer, _, err := net.SplitHostPort(c.Request.RemoteAddr)
-		if err != nil || net.ParseIP(peer) == nil || !net.ParseIP(peer).IsLoopback() || c.GetHeader("X-Forwarded-Proto") != "https" {
+	if !secureAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "请通过可信 HTTPS 管理入口保存飞书凭据"})
 		return
 	}
-	}
 	var req struct {
 		Enabled   bool   `json:"enabled"`
 		AppID     string `json:"app_id"`
@@ -54,7 +168,7 @@ func (p *Provider) Configure(c *gin.Context) {
 	}
 	req.AppID = strings.TrimSpace(req.AppID)
 	req.TenantKey = strings.TrimSpace(req.TenantKey)
-	if len(req.AppID) > 128 || strings.ContainsAny(req.AppID, " \r\n\t") || (req.Enabled && (req.AppID == "" || !validTenant(req.TenantKey))) {
+	if len(req.AppID) > 128 || strings.ContainsAny(req.AppID, " \r\n\t") || (req.Enabled && req.AppID == "") || (req.TenantKey != "" && !validTenant(req.TenantKey)) {
 		c.JSON(400, gin.H{"error": "请输入有效的飞书 App ID 和租户标识"})
 		return
 	}
@@ -69,6 +183,43 @@ func (p *Provider) Configure(c *gin.Context) {
 		c.JSON(500, gin.H{"error": "读取身份配置失败"})
 		return
 	}
+	if cfg.AppID != "" && cfg.AppID != req.AppID && req.AppSecret == "" {
+		c.JSON(400, gin.H{"error": "更换 App ID 时必须填写对应的 App Secret"})
+		return
+	}
+	if cfg.AppID != "" && cfg.AppID != req.AppID && !req.Enabled {
+		// A disabled replacement must not retain the previous application's tenant.
+		req.TenantKey = ""
+	}
+	autoTenant := req.Enabled && req.TenantKey == ""
+	if req.Enabled && req.TenantKey == "" {
+		creds, err := resolveTenantCredentials(tenantCredentials{req.AppID, req.AppSecret}, cfg.AppID, cfg.AppSecret)
+		if err != nil {
+			c.JSON(400, gin.H{"error": err.Error()})
+			return
+		}
+		req.TenantKey, _, err = queryFeishuTenant(c.Request.Context(), creds)
+		if err != nil {
+			c.JSON(502, gin.H{"error": err.Error()})
+			return
+		}
+	}
+	if cfg.AppID != req.AppID && req.Enabled && !autoTenant {
+		creds, err := resolveTenantCredentials(tenantCredentials{req.AppID, req.AppSecret}, cfg.AppID, cfg.AppSecret)
+		if err != nil {
+			c.JSON(400, gin.H{"error": err.Error()})
+			return
+		}
+		actual, _, err := queryFeishuTenant(c.Request.Context(), creds)
+		if err != nil {
+			c.JSON(502, gin.H{"error": err.Error()})
+			return
+		}
+		if actual != req.TenantKey {
+			c.JSON(400, gin.H{"error": "企业标识与当前飞书应用不一致"})
+			return
+		}
+	}
 	if req.AppSecret != "" {
 		if len(req.AppSecret) > 512 {
 			c.JSON(400, gin.H{"error": "密钥过长"})

backend/internal/identityprovider/admin_test.go

@@ -3,6 +3,7 @@ package identityprovider
 import (
 	"bytes"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -12,6 +13,116 @@ import (
 	"vpn-platform/backend/internal/store"
 )
 
+func TestQueryTenantUsesAppCredentialsWithoutPersistingOrLeaking(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("VPN_DATA_DIR", dir)
+	if err := store.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	previous := upstreamClient
+	defer func() { upstreamClient = previous }()
+	upstreamClient = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
+		response := `{"code":0,"tenant_access_token":"temporary-token"}`
+		switch req.URL.String() {
+		case feishuTenantToken:
+			if req.Method != http.MethodPost || req.Header.Get("Content-Type") != "application/json" {
+				t.Fatal("invalid token request")
+			}
+			var creds tenantCredentials
+			if json.NewDecoder(req.Body).Decode(&creds) != nil || creds.AppID != "cli_test" || creds.AppSecret != "private-value" {
+				t.Fatal("invalid credentials")
+			}
+		case feishuTenantQuery:
+			if req.Method != http.MethodGet || req.Header.Get("Authorization") != "Bearer temporary-token" {
+				t.Fatal("invalid tenant request")
+			}
+			response = `{"code":0,"data":{"tenant":{"tenant_key":"tenant_123","name":"Example"}}}`
+		default:
+			t.Fatalf("unexpected endpoint: %s", req.URL)
+		}
+		return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(response)), Header: make(http.Header)}, nil
+	})}
+	gin.SetMode(gin.TestMode)
+	server := gin.New()
+	p := New()
+	server.POST("/tenant", p.QueryTenant)
+	server.PUT("/config", p.Configure)
+	query := []byte(`{"app_id":"cli_test","app_secret":"private-value"}`)
+	request := httptest.NewRequest(http.MethodPost, "/tenant", bytes.NewReader(query))
+	request.RemoteAddr = "127.0.0.1:12345"
+	request.Header.Set("X-Forwarded-Proto", "https")
+	resp := httptest.NewRecorder()
+	server.ServeHTTP(resp, request)
+	if resp.Code != 200 || !strings.Contains(resp.Body.String(), `"tenant_key":"tenant_123"`) || strings.Contains(resp.Body.String(), "temporary-token") || strings.Contains(resp.Body.String(), "private-value") {
+		t.Fatalf("unexpected query response: %d %s", resp.Code, resp.Body.String())
+	}
+	if _, err := current(); err == nil {
+		t.Fatal("query unexpectedly persisted configuration")
+	}
+	request = httptest.NewRequest(http.MethodPut, "/config", strings.NewReader(`{"app_id":"cli_test","app_secret":"private-value","enabled":false}`))
+	request.RemoteAddr = "127.0.0.1:12345"
+	request.Header.Set("X-Forwarded-Proto", "https")
+	resp = httptest.NewRecorder()
+	server.ServeHTTP(resp, request)
+	if resp.Code != 200 {
+		t.Fatalf("save failed: %d %s", resp.Code, resp.Body.String())
+	}
+	request = httptest.NewRequest(http.MethodPost, "/tenant", strings.NewReader(`{"app_id":"cli_test"}`))
+	request.RemoteAddr = "127.0.0.1:12345"
+	request.Header.Set("X-Forwarded-Proto", "https")
+	resp = httptest.NewRecorder()
+	server.ServeHTTP(resp, request)
+	if resp.Code != 200 {
+		t.Fatalf("saved credentials not reused: %d %s", resp.Code, resp.Body.String())
+	}
+	request = httptest.NewRequest(http.MethodPut, "/config", strings.NewReader(`{"app_id":"cli_other","tenant_key":"tenant_123","enabled":false}`))
+	request.RemoteAddr = "127.0.0.1:12345"
+	request.Header.Set("X-Forwarded-Proto", "https")
+	resp = httptest.NewRecorder()
+	server.ServeHTTP(resp, request)
+	if resp.Code != 400 {
+		t.Fatalf("new app reused old secret: %d %s", resp.Code, resp.Body.String())
+	}
+	cfg, err := current()
+	if err != nil || cfg.AppID != "cli_test" {
+		t.Fatal("rejected app change modified saved configuration")
+	}
+	request = httptest.NewRequest(http.MethodPost, "/tenant", bytes.NewReader(query))
+	resp = httptest.NewRecorder()
+	server.ServeHTTP(resp, request)
+	if resp.Code != 403 {
+		t.Fatalf("plaintext request accepted: %d", resp.Code)
+	}
+}
+
+func TestQueryTenantRejectsWrongAppAndUpstreamFailure(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("VPN_DATA_DIR", dir)
+	if err := store.Init(dir); err != nil {
+		t.Fatal(err)
+	}
+	secret, err := store.EncryptSecret("private-value")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := resolveTenantCredentials(tenantCredentials{AppID: "cli_other"}, "cli_test", secret); err == nil {
+		t.Fatal("old secret reused for another app")
+	}
+	creds, err := resolveTenantCredentials(tenantCredentials{AppID: "cli_test"}, "cli_test", secret)
+	if err != nil || creds.AppSecret != "private-value" {
+		t.Fatal("saved secret not reused for same app")
+	}
+	previous := upstreamClient
+	defer func() { upstreamClient = previous }()
+	upstreamClient = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
+		return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(`{"code":999,"msg":"private-value"}`)), Header: make(http.Header)}, nil
+	})}
+	_, _, err = queryFeishuTenant(httptest.NewRequest(http.MethodGet, "/", nil).Context(), creds)
+	if err == nil || strings.Contains(err.Error(), "private-value") {
+		t.Fatalf("unsafe upstream error: %v", err)
+	}
+}
+
 func TestAdminNeverEchoesFeishuSecretAndKeepsEncryptedValue(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("VPN_DATA_DIR", dir)

docs/specs/SDD-007-built-in-feishu-issuer.md

@@ -52,3 +52,18 @@
 线上新增 `/api/system/identity` 后托管 Nginx 仍使用旧白名单，浏览器看到 `ERR_EMPTY_RESPONSE`（Nginx 444）；本机管理进程可正常返回 401。已有 `/api/system/tls/domain` 路由在无凭据时返回 401，不能把用户同时报告的域名保存失败归结于同一缺失路由。Vue 侧栏在 `route` 创建前注册 watch，导致初始化时引用尚未声明的变量；WireGuard SVG 含截断的路径数据。
 
 每次启动且确认当前是有效 Nginx HTTPS 托管站点时，按已注册 Gin 路由重建站点白名单；文件内容相同则不重载，冲突或 `nginx -t` 失败时保留旧站点并记录日志，不阻止本机服务启动。公网只同步已注册 API、固定身份端点与当前单条运行的同域认证组件，未知路径仍 444。验收：新身份管理 API 不再返回空连接，未经认证返回 401；既有域名 PUT 也仍返回 401，授权后的保存需单独实测；设置和编辑页无布局初始化异常；SVG 路径有效；Nginx 测试通过。恢复时使用 `/tmp` 的上一版二进制和原 Nginx 站点快照重新加载，不修改专线或飞书凭据。
+
+## 7. 自动读取飞书企业标识（2026-10-22，S3）
+
+当前管理员必须手填 `tenant_key` 才能启用身份服务；用户提供的飞书 SDK `tenant.v2.tenant.query` 可通过应用凭据获取企业信息。新增仅管理员可调用的 `POST /api/system/identity/tenant`：沿用 HTTPS 管理入口限制，使用表单中 App ID/Secret 或同一 App ID 已保存的加密 Secret，向飞书换取 tenant access token 后查询企业名称和 tenant_key。仅返回这两个字段，不保存临时输入的凭据、令牌或查询结果；响应禁止缓存。页面提供「自动获取」并回填可编辑字段；保存启用配置且企业标识为空时也尝试自动获取。更换 App ID 时绝不复用原 App Secret 或旧企业标识；查询失败时不启用或改变已保存的配置。
+
+接口限定固定飞书域名、短超时、受限响应体和无重定向；错误不回显密钥或 token。飞书授权需要应用具备企业信息读取权限（按飞书后台实际授权提示配置）。管理员仍可手填企业标识以兼容既有配置；真实飞书 API 联调在获得轮换后的凭据时进行。
+
+| 验收 | 操作与预期 | 验证 |
+|---|---|---|
+| AC-07-01 | HTTPS 管理员查询正确凭据，返回企业标识与名称；未保存凭据不落库 | 模拟上游请求/响应 |
+| AC-07-02 | 同一 App ID 可复用加密 Secret；换 App ID 不复用旧密钥或旧租户 | 管理接口测试 |
+| AC-07-03 | 飞书拒绝授权、响应异常、无标识或 HTTP 管理请求时，安全失败且不泄露凭据 | 负向测试 |
+| AC-07-04 | 启用时企业标识留空可自动获取；查询失败不保存；手工输入兼容 | 管理接口测试与前端构建 |
+
+发布前完成 Go 测试与前端构建；部署后检查新路由被托管 Nginx 白名单接受、未授权返回 401，并在轮换飞书 Secret 后进行真实查询。恢复可回退二进制与前端资源；不需要数据迁移，也不修改已运行专线。

frontend/src/locales/en-US.json

@@ -575,7 +575,7 @@
   },
   "identity": {
     "tab": "Feishu identity", "title": "Built-in Feishu identity service", "description": "Issue OIDC identities for VPN using your existing HTTPS domain. Feishu app credentials stay upstream; this platform creates separate VPN client credentials.",
-    "appId": "Feishu App ID", "appSecret": "Feishu App Secret", "secretPlaceholder": "Leave blank to retain the secret; use a rotated secret for new setup", "tenant": "Allowed Feishu tenant_key", "tenantPlaceholder": "Verify the enterprise tenant_key from Feishu user info", "enabled": "Enable built-in issuer", "httpsOnly": "Enter app credentials only through the HTTPS management site. Switch to its secure address.", "openHttps": "Open HTTPS management site",
+    "appId": "Feishu App ID", "appSecret": "Feishu App Secret", "secretPlaceholder": "Leave blank to retain the secret; use a rotated secret for new setup", "tenant": "Allowed Feishu tenant_key", "tenantPlaceholder": "Fetch automatically or enter manually", "fetchTenant": "Fetch tenant ID", "tenantFetched": "Feishu tenant ID retrieved", "tenantFailed": "Could not fetch Feishu tenant", "enabled": "Enable built-in issuer", "httpsOnly": "Enter app credentials only through the HTTPS management site. Switch to its secure address.", "openHttps": "Open HTTPS management site",
     "httpsRequired": "Configure and activate your public HTTPS site and certificate first.", "gatewayPending": "The identity provider is saved but Nginx does not yet route /id/; sync the gateway.",
     "addresses": "Addresses and client credentials", "issuer": "OIDC issuer", "feishuCallback": "Callback registered in Feishu", "vpnCallback": "VPN client callback", "clientId": "VPN Client ID",
     "oneTimeSecret": "New VPN Client Secret is displayed only once. Store it safely; rotation of active tunnel credentials requires separate planning.", "routeHint": "Sync identity routes first. After starting the one OpenVPN OIDC tunnel using this domain, sync again to route /oauth2/ to its local auth component.",

frontend/src/locales/zh-CN.json

@@ -575,7 +575,7 @@
   },
   "identity": {
     "tab": "飞书身份", "title": "内置飞书身份服务", "description": "使用现有 HTTPS 域名签发 VPN 所需 OIDC 身份令牌。飞书 App 凭据仅用于飞书上游，VPN 客户端凭据由本平台生成。",
-    "appId": "飞书 App ID", "appSecret": "飞书 App Secret", "secretPlaceholder": "留空保持当前密钥；新配置请输入轮换后的密钥", "tenant": "允许的飞书 tenant_key", "tenantPlaceholder": "从飞书用户信息确认企业 tenant_key", "enabled": "启用内置发行者", "httpsOnly": "应用密钥只能通过 HTTPS 管理入口填写；请切换到安全地址。", "openHttps": "打开 HTTPS 管理入口",
+    "appId": "飞书 App ID", "appSecret": "飞书 App Secret", "secretPlaceholder": "留空保持当前密钥；新配置请输入轮换后的密钥", "tenant": "允许的飞书 tenant_key", "tenantPlaceholder": "可自动获取，也可手动填写", "fetchTenant": "自动获取企业标识", "tenantFetched": "已读取飞书企业标识", "tenantFailed": "读取飞书企业信息失败", "enabled": "启用内置发行者", "httpsOnly": "应用密钥只能通过 HTTPS 管理入口填写；请切换到安全地址。", "openHttps": "打开 HTTPS 管理入口",
     "httpsRequired": "请先完成公网域名 HTTPS 证书和站点配置，再启用身份服务。", "gatewayPending": "身份服务已保存，但 Nginx 尚未转发 /id/；请同步公网入口。",
     "addresses": "接入地址与客户端凭据", "issuer": "OIDC 发行者", "feishuCallback": "登记到飞书应用的回调", "vpnCallback": "VPN 客户端回调", "clientId": "VPN Client ID",
     "oneTimeSecret": "新 VPN Client Secret 只显示这一次，请立即妥善保存；现有专线的密钥轮换需另行安排。", "routeHint": "先同步身份路由；启动唯一一条使用当前域名的 OpenVPN OIDC 专线后，再同步一次以转发 /oauth2/ 到本机认证组件。",

frontend/src/views/Settings.vue

@@ -45,9 +45,13 @@
             <el-alert v-if="!identitySecure" type="warning" :closable="false" :title="$t('identity.httpsOnly')" style="margin-bottom:16px" />
             <el-button v-if="!identitySecure && identityHttpsUrl" type="primary" tag="a" :href="identityHttpsUrl" style="margin-bottom:16px">{{ $t('identity.openHttps') }}</el-button>
             <el-form v-if="identitySecure" label-position="top" @submit.prevent="saveIdentity">
-              <el-form-item :label="$t('identity.appId')"><el-input v-model.trim="identityForm.app_id" placeholder="cli_..." maxlength="128" /></el-form-item>
+              <el-form-item :label="$t('identity.appId')"><el-input v-model.trim="identityForm.app_id" placeholder="cli_..." maxlength="128" @change="onIdentityAppChange" /></el-form-item>
               <el-form-item :label="$t('identity.appSecret')"><el-input v-model="identityForm.app_secret" type="password" show-password autocomplete="new-password" :placeholder="$t('identity.secretPlaceholder')" /></el-form-item>
-              <el-form-item :label="$t('identity.tenant')"><el-input v-model.trim="identityForm.tenant_key" :placeholder="$t('identity.tenantPlaceholder')" maxlength="128" /></el-form-item>
+              <el-form-item :label="$t('identity.tenant')">
+                <el-input v-model.trim="identityForm.tenant_key" :placeholder="$t('identity.tenantPlaceholder')" maxlength="128" />
+                <el-button :loading="tenantLoading" :disabled="!identityForm.app_id" style="margin-top:8px" @click="fetchIdentityTenant">{{ $t('identity.fetchTenant') }}</el-button>
+                <span v-if="tenantName" class="tls-hint" style="margin-left:10px">{{ tenantName }}</span>
+              </el-form-item>
               <el-form-item :label="$t('identity.enabled')"><el-switch v-model="identityForm.enabled" :disabled="!identityStatus?.tls_ready" /></el-form-item>
               <el-button type="primary" :loading="identitySaving" @click="saveIdentity">{{ $t('common.save') }}</el-button>
               <el-button :loading="identityLoading" @click="loadIdentity">{{ $t('tls.refresh') }}</el-button>
@@ -206,12 +210,35 @@ const identityHttpsUrl = computed(() => identityStatus.value?.issuer ? `${identi
 const identityLoading = ref(false)
 const identitySaving = ref(false)
 const identityGatewayLoading = ref(false)
+const tenantLoading = ref(false)
+const tenantName = ref('')
+function onIdentityAppChange() {
+  if (identityForm.value.app_id !== identityStatus.value?.app_id) {
+    identityForm.value.tenant_key = ''
+    tenantName.value = ''
+  }
+}
+async function fetchIdentityTenant() {
+  if (!identitySecure) return ElMessage.warning(t('identity.httpsOnly'))
+  tenantLoading.value = true
+  try {
+    const appId = identityForm.value.app_id
+    const { data } = await api.post('/system/identity/tenant', { app_id: appId, app_secret: identityForm.value.app_secret })
+    if (identityForm.value.app_id === appId) {
+      identityForm.value.tenant_key = data.tenant_key
+      tenantName.value = data.name || ''
+      ElMessage.success(t('identity.tenantFetched'))
+    }
+  } catch (e) { ElMessage.error(e.response?.data?.error || t('identity.tenantFailed')) }
+  finally { tenantLoading.value = false }
+}
 async function loadIdentity() {
   identityLoading.value = true
   try {
     const { data } = await api.get('/system/identity')
     identityStatus.value = data
     identityForm.value = { enabled: data.enabled, app_id: data.app_id || '', app_secret: '', tenant_key: data.tenant_key || '' }
+    tenantName.value = ''
   } catch (e) { ElMessage.error(e.response?.data?.error || t('identity.loadFailed')) }
   finally { identityLoading.value = false }
 }