Sync OpenVPN OAuth gateway routes on tunnel changes

backend/internal/api/api.go

@@ -38,9 +38,10 @@ import (
 
 // Server API 服务器
 type Server struct {
-	mgr     *core.Manager
-	taskMgr *taskmgr.Manager
-	router  *gin.Engine
+	mgr       *core.Manager
+	taskMgr   *taskmgr.Manager
+	router    *gin.Engine
+	gatewayMu sync.Mutex
 }
 
 func NewServer(mgr *core.Manager) *Server { return &Server{mgr: mgr, taskMgr: taskmgr.NewManager()} }
@@ -887,6 +888,12 @@ func (s *Server) createTunnel(c *gin.Context) {
 			t.State = "running"
 		}
 		store.DB.Save(&t)
+		if t.State == "running" {
+			if err := s.syncAuthGatewayForTunnel(&t); err != nil {
+				c.Header("X-Opsx-Gateway-Warning", "route-sync-failed")
+				log.Printf("专线 %d 已启动但认证入口同步失败: %v", t.ID, err)
+			}
+		}
 	}
 	c.JSON(200, t)
 }
@@ -1007,6 +1014,12 @@ func (s *Server) updateTunnel(c *gin.Context) {
 		}
 	}
 	*t = candidate
+	if wasRunning {
+		if err := s.syncAuthGatewayForTunnel(t); err != nil {
+			c.Header("X-Opsx-Gateway-Warning", "route-sync-failed")
+			log.Printf("专线 %d 已更新但认证入口同步失败: %v", t.ID, err)
+		}
+	}
 	store.Audit(c.GetString("username"), "update_tunnel", t.Name, "")
 	c.JSON(200, t)
 }
@@ -1027,6 +1040,10 @@ func (s *Server) deleteTunnel(c *gin.Context) {
 	}
 	s.mgr.RemoveStatus(t.ID)
 	store.DB.Delete(t)
+	if err := s.syncAuthGatewayForTunnel(t); err != nil {
+		c.Header("X-Opsx-Gateway-Warning", "route-sync-failed")
+		log.Printf("专线 %d 已删除但认证入口同步失败: %v", t.ID, err)
+	}
 	store.Audit(c.GetString("username"), "delete_tunnel", t.Name, "")
 	c.JSON(200, gin.H{"ok": true})
 }
@@ -1048,6 +1065,10 @@ func (s *Server) startTunnel(c *gin.Context) {
 		return
 	}
 	if t.State == "running" {
+		if err := s.syncAuthGatewayForTunnel(t); err != nil {
+			c.JSON(200, gin.H{"ok": true, "state": "running", "warning": "专线运行中，但公网认证入口同步失败：" + err.Error()})
+			return
+		}
 		c.JSON(200, gin.H{"ok": true, "state": "running", "message": "专线已在运行"})
 		return
 	}
@@ -1064,6 +1085,10 @@ func (s *Server) startTunnel(c *gin.Context) {
 	store.DB.Save(t)
 	s.mgr.RemoveStatus(t.ID) // the monitor's previous snapshot can lag behind this transition
 	store.Audit(c.GetString("username"), "start_tunnel", t.Name, "")
+	if err := s.syncAuthGatewayForTunnel(t); err != nil {
+		c.JSON(200, gin.H{"ok": true, "state": "running", "warning": "专线已启动，但公网认证入口同步失败：" + err.Error()})
+		return
+	}
 	c.JSON(200, gin.H{"ok": true, "state": "running"})
 }
 
@@ -1087,6 +1112,10 @@ func (s *Server) stopTunnel(c *gin.Context) {
 	store.DB.Save(t)
 	s.mgr.RemoveStatus(t.ID)
 	store.Audit(c.GetString("username"), "stop_tunnel", t.Name, "")
+	if err := s.syncAuthGatewayForTunnel(t); err != nil {
+		c.JSON(200, gin.H{"ok": true, "state": "stopped", "warning": "专线已停止，但公网认证入口同步失败：" + err.Error()})
+		return
+	}
 	c.JSON(200, gin.H{"ok": true, "state": "stopped"})
 }