fix(outlink): bump pro submodule for the Feishu challenge fix

[FinleyGe]

What this is

Draft on purpose. It is the one-line pro submodule bump that ships the Feishu Encrypt Key fix:

-Subproject commit 8814100bdd6052dd991cb5d887788f0cf8eafb87
+Subproject commit f2b0ee98e8387c7b68d38cb1ee0388155d6e878f

The fix is proposed to labring/fastgpt-pro as labring/fastgpt-pro#1154. That PR is based on pro main (26cb5a5f), but this branch tracks pro 8814100b — the head of the open labring/fastgpt-pro#1086 (codex/app-permission) — and the two lines are siblings off daa1a890, so a bump to #1154's merge commit would revert #1086's 4 commits. f2b0ee98 is therefore the fix cherry-picked onto 8814100b; its admin/src/service/support/outLink/feishu/ tree is identical to 8985f757 (the #1154 head), and it is a descendant of the pro revision this branch already tracks.

Draft because the hash will change once labring's pro lines reconcile; I will repoint it at a commit on labring/fastgpt-pro main (or at the then-current tracked pro revision) before this leaves draft.

The pointer is resolvable today — verified by reproducing the CI step in a scratch clone of this exact branch:

git clone --depth 1 -b fix/feishu-outlink https://github.com/FinleyGe/FastGPT.git
git config --global url."https://x-access-token:$PRO_SUBMODULE_TOKEN@github.com/".insteadOf "https://github.com/"
git submodule update --init --depth 1 pro
# -> Submodule path 'pro': checked out 'f2b0ee98...'

labring/fastgpt-pro serves the object by SHA (it is in that repository's store; git fetch labring/fastgpt-pro f2b0ee98 also succeeds), the same way it serves 8814100b today. PR CI is green as well.

What it ships

With an Encrypt Key configured on both the Feishu app and the FastGPT Feishu publish channel, saving the event subscription request URL failed with "the response is not valid JSON"; leaving Encrypt Key empty on both sides worked.

admin/src/service/support/outLink/feishu/provider.ts handled the URL verification challenge after signature verification. Encrypt Key makes the request body {"encrypt": "..."}, so the plaintext challenge branch never matched, and the request hit the signature check, which requires x-lark-request-timestamp / x-lark-request-nonce / x-lark-signature and answered 400 Signature headers are invalid. Feishu signs event pushes only, not the callback URL verification request ("Security verification" in the encrypt key doc; the official Node SDK also returns the challenge before checkIsEventValidated). The request URL exposed by the publish channel goes through the app edge into pro via plusRequest, whose checkRes rejects code >= 400, so the app route threw without a body and Feishu received a non-JSON response.

The fix decrypts and returns the challenge before the signature check and keeps the signature check for event pushes. An encrypted challenge still must decrypt with the configured Encrypt Key and pass FeishuPayloadSchema (challenge + type: 'url_verification'), so the branch stays closed to callers without the key; response envelope, error codes and event-push verification are unchanged.

Verification (run on f2b0ee98, the bump target)

• pnpm test pro/admin/test/service/support/outLink/feishu/provider.test.ts — 8 passed, including 3 new cases (unsigned encrypted challenge; encrypted challenge when signature verification would fail; event push with no signature headers still 400). The 2 encrypted-challenge cases fail on the pre-fix code.
• End-to-end smoke through the real createApiEntry pipeline with a real aes-256-cbc + sha256(encryptKey) + random IV payload: 200 {"code":200,"statusText":"","message":"","data":{"challenge":"smoke-challenge-123"}} (pre-fix: 400). The app edge unwraps data, so Feishu receives {"challenge":"smoke-challenge-123"}.
• pnpm --dir pro/admin typecheck — clean.

[github-actions]

✅ Admin Preview Image Ready!

ghcr.io/labring/fastgpt-pr:admin_3a4e4bc1beff4e6a6ccc4ce0d3381cd05cf7bfbf

🕒 Time: 2026-09-17 23:41:41 (UTC+8)

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	41.53%	4396 / 10583
🔵	Statements	41.38%	4657 / 11254
🔵	Functions	34.85%	869 / 2493
🔵	Branches	34.87%	2247 / 6443

File Coverage

No changed files found.

Generated in workflow #3496 for commit 3a4e4bc by the Vitest Coverage Report Action