Merge pull request #255 from flashcatcloud/work/sso-network-docs

docs: fix IP whitelist placeholder and document SSO network requirements

Author: ysyneu

en/on-call/integration/webhooks/alert-webhook.mdx

@@ -234,5 +234,13 @@ Click **View Details** on a record to see the complete request and response info
    - Services can filter based on event_time; if a later event has been received, earlier events can be filtered out. Each push carries the latest complete information, so occasional event loss is tolerable
 
 4. **Trusted IP whitelist for push source?**
+   {/* console:
    - {ip_whitelist}
    - May be updated in the future, please check regularly
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`, `123.56.8.183`, `47.94.193.81`, and `1.13.19.96` (SaaS only; in a private deployment, pushes originate from your own environment's egress address — check with your infrastructure team)
+   - May be updated in the future, please check regularly
+
+   </div>

en/on-call/integration/webhooks/custom-actions.mdx

@@ -333,5 +333,13 @@ When an incident is confirmed to impact production services, trigger external st
     - eof
 
 3. **Trusted IP whitelist for push source?**
+   {/* console:
    - {ip_whitelist}
    - May be updated in the future, please check regularly
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`, `123.56.8.183`, `47.94.193.81`, and `1.13.19.96` (SaaS only; in a private deployment, pushes originate from your own environment's egress address — check with your infrastructure team)
+   - May be updated in the future, please check regularly
+
+   </div>

en/on-call/integration/webhooks/incident-webhook.mdx

@@ -350,5 +350,13 @@ Click **View Details** on a record to see the complete request and response info
    - Services can filter based on event_time; if a later event has been received, earlier events can be filtered out. Each push carries the latest complete information, so occasional event loss is tolerable
 
 4. **Trusted IP whitelist for push source?**
+   {/* console:
    - {ip_whitelist}
    - May be updated in the future, please check regularly
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`, `123.56.8.183`, `47.94.193.81`, and `1.13.19.96` (SaaS only; in a private deployment, pushes originate from your own environment's egress address — check with your infrastructure team)
+   - May be updated in the future, please check regularly
+
+   </div>

en/platform/configure-sso.mdx

@@ -5,6 +5,28 @@ description: Sign in once and access multiple connected applications through sin
 
 Flashduty supports Single Sign-On (SSO) via SAML2.0, OIDC, CAS, and LDAP (private deployment only) protocols, helping you easily integrate with various applications and platforms. Users only need to sign in once to access multiple connected applications and services without repeated authentication.
 
+## Network Access Requirements
+
+---
+
+Each protocol has different network reachability requirements for your identity provider (IdP). Confirm this before configuring to avoid sign-in failures caused by network access:
+
+| Protocol | Does Flashduty need to reach the IdP? | Details |
+| --- | --- | --- |
+| SAML 2.0 | No | Sign-in happens entirely through the member's browser: the browser is redirected to the IdP, then posts the signed SAMLResponse back to Flashduty after login. Flashduty's servers never connect to the IdP directly — the signature is validated locally against the metadata you upload |
+| OIDC | Yes | On every sign-in, Flashduty's servers fetch the IdP's discovery document, then call its token endpoint and JWKS endpoint. When the ID Token doesn't carry every mapped field, Flashduty also calls the UserInfo endpoint |
+| CAS | Yes | On every sign-in, Flashduty's servers call the IdP's `/serviceValidate` endpoint to validate the login ticket. The CAS protocol offers no alternative — the ticket carries no signed content, so it can only be validated at the source |
+| LDAP | Not applicable | Available only in the private deployment version, where Flashduty runs inside your own network — public internet reachability doesn't apply |
+
+If your identity provider is on a private network and not reachable from the public internet:
+
+- You can allow Flashduty's egress IPs — `47.94.95.118`, `123.56.8.183`, `47.94.193.81`, and `1.13.19.96` — through your firewall to open access from Flashduty to the IdP
+- If you'd rather not open any public access to your identity provider, **SAML 2.0** is the only protocol that needs none — it's the recommended choice in that case
+
+<Note>
+The egress IPs above apply only to Flashduty's **SaaS (public cloud) service**. If you're using a private (on-premises) deployment, Flashduty runs inside your own network and its egress IP depends on your deployment environment — check with your infrastructure team instead of using the addresses above.
+</Note>
+
 ## Configuring SAML Protocol
 
 ---

integration-docs/scripts/build.mjs

@@ -31,8 +31,14 @@ function getFrontmatterAttr(content, name) {
   return (match?.[1] || match?.[2] || match?.[3] || '').trim();
 }
 
+// The leading `^[ \t]*` matters when the block is indented inside a list item:
+// without it the indentation survives as a stray whitespace-only line, which
+// turns the surrounding tight list loose. Blocks at column zero are unaffected.
 function removeHiddenBlocks(content) {
-  return content.replace(/<div\b(?=[^>]*\bclass(?:Name)?=["'][^"']*\bhide\b[^"']*["'])[^>]*>[\s\S]*?<\/div>/g, '\n');
+  return content.replace(
+    /^[ \t]*<div\b(?=[^>]*\bclass(?:Name)?=["'][^"']*\bhide\b[^"']*["'])[^>]*>[\s\S]*?<\/div>/gm,
+    '\n',
+  );
 }
 
 function convertAnchorSpans(content) {
@@ -268,6 +274,14 @@ function mdxToMarkdown(content) {
   let output = convertAnchorSpans(removeHiddenBlocks(stripFrontmatter(content)));
 
   output = convertDirectiveContainers(convertCallouts(convertCards(convertAccordions(output))))
+    // Counterpart to removeHiddenBlocks: a `{/* console: ... */}` block is an MDX
+    // comment, so the docs site renders nothing, while the console gets its
+    // contents. Use it for text that only makes sense inside the product, such
+    // as a value the console substitutes per deployment. The opening and closing
+    // lines are consumed whole so the captured lines land at the same
+    // indentation they were written at, with no blank line on either side.
+    // Must run before the generic comment strip below, which would discard it.
+    .replace(/^[ \t]*{[ \t]*\/\*[ \t]*console:[ \t]*\r?\n([\s\S]*?)\r?\n[ \t]*\*\/[ \t]*}[ \t]*(\r?\n)/gm, '$1$2')
     .replace(/{\s*\/\*[\s\S]*?\*\/\s*}/g, '')
     .replace(/^\s*import\s+.*$/gm, '')
     .replace(/^\s*export\s+.*$/gm, '')

zh/on-call/integration/webhooks/alert-webhook.mdx

@@ -234,5 +234,13 @@ curl -X POST 'https://example.com/alert/webhook?a=a' \
    - 服务可以根据 event_time 进行过滤，如果已经收到了更晚的事件，可以直接过滤掉更早的事件，每一次推送都会携带最新的、完整的信息，偶尔丢失事件是可以容忍的
 
 4. **推送来源可信 IP 白名单？**
+   {/* console:
    - {ip_whitelist}
    - 未来可能会更新，请定期查验
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`、`123.56.8.183`、`47.94.193.81` 和 `1.13.19.96`（SaaS 版本；私有化部署的推送来源为您自有环境的出口地址，请向您的基础设施团队确认）
+   - 未来可能会更新，请定期查验
+
+   </div>

zh/on-call/integration/webhooks/custom-actions.mdx

@@ -321,5 +321,13 @@ curl -X POST 'https://example.com/incident/action?a=a' \
     - eof
 
 2. **推送来源可信 IP 白名单？**
+   {/* console:
    - {ip_whitelist}
    - 未来可能会更新，请定期查验
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`、`123.56.8.183`、`47.94.193.81` 和 `1.13.19.96`（SaaS 版本；私有化部署的推送来源为您自有环境的出口地址，请向您的基础设施团队确认）
+   - 未来可能会更新，请定期查验
+
+   </div>

zh/on-call/integration/webhooks/incident-webhook.mdx

@@ -350,5 +350,13 @@ curl -X POST 'https://example.com/incident/webhook?a=a' \
    - 服务可以根据 event_time 进行过滤，如果已经收到了更晚的事件，可以直接过滤掉更早的事件，每一次推送都会携带最新的、完整的信息，偶尔丢失事件是可以容忍的
 
 4. **推送来源可信 IP 白名单？**
+   {/* console:
    - {ip_whitelist}
    - 未来可能会更新，请定期查验
+   */}
+   <div className="hide">
+
+   - `47.94.95.118`、`123.56.8.183`、`47.94.193.81` 和 `1.13.19.96`（SaaS 版本；私有化部署的推送来源为您自有环境的出口地址，请向您的基础设施团队确认）
+   - 未来可能会更新，请定期查验
+
+   </div>

zh/platform/configure-sso.mdx

@@ -6,6 +6,28 @@ keywords: ["单点登录", "SSO", "SAML", "OIDC", "LDAP"]
 
 Flashduty 支持 SAML2.0、OIDC、CAS 和 LDAP（仅私有化版本）协议的单点登录（SSO）接入，帮助您轻松集成到各种应用和平台中。用户只需登录一次，便可访问多个关联的应用程序和服务，无需重复身份验证。
 
+## 网络访问要求
+
+---
+
+不同协议对身份提供商（IdP）的网络可达性要求不同，配置前建议先确认，避免因网络不通导致登录失败：
+
+| 协议 | 是否需要 Flashduty 访问身份提供商 | 说明 |
+| --- | --- | --- |
+| SAML 2.0 | 不需要 | 登录全程通过成员的浏览器完成：浏览器被重定向到身份提供商，登录后再把签名的 SAMLResponse 回传给 Flashduty。Flashduty 服务端不会主动连接身份提供商，签名基于您上传的元数据在本地校验 |
+| OIDC | 需要 | 每次登录，Flashduty 服务端都需要访问身份提供商的 Discovery 文档、Token 端点和 JWKS 端点；当 ID Token 未携带完整的映射字段时，还会额外访问 UserInfo 端点 |
+| CAS | 需要 | 每次登录，Flashduty 服务端都需要调用身份提供商的 `/serviceValidate` 接口校验登录票据。CAS 协议本身不提供其他校验方式——票据不携带签名信息，只能回源验证 |
+| LDAP | 不涉及公网访问 | 仅私有化版本支持，Flashduty 部署在您自有网络内，不存在公网可达性问题 |
+
+如果您的身份提供商部署在内网、无法从公网访问：
+
+- 可以将 Flashduty 的出口 IP `47.94.95.118`、`123.56.8.183`、`47.94.193.81` 和 `1.13.19.96` 加入防火墙白名单，放通 Flashduty 到身份提供商的访问
+- 如果不希望为身份提供商开放任何公网访问，**SAML 2.0** 是唯一无需 Flashduty 访问身份提供商的协议，推荐优先选择
+
+<Note>
+以上出口 IP 仅适用于 Flashduty **SaaS（公有云）服务**。如果您使用的是私有化部署版本，Flashduty 运行在您自己的网络中，出口 IP 由您自身的部署环境决定，请向您的基础设施团队确认，不要使用上述地址。
+</Note>
+
 ## 配置 SAML 协议
 
 ---