chore: update pro submodule for WeCom sync

document/content/guide/admin/sso.en.mdx

@@ -32,7 +32,7 @@ Deploy using docker-compose:
 
 ```yaml
 fastgpt-sso:
-  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0 # This version must match the FastGPT image version
+  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest
   container_name: fastgpt-sso
   restart: always
   networks:
@@ -258,6 +258,11 @@ fastgpt-sso:
 
 ### WeCom
 
+<Alert context="warning">
+  After the WeCom member sync logic is updated, redeploy the `fastgpt-sso-service` relay service
+  using the published `latest` image.
+</Alert>
+
 #### 1. Get Parameters
 
 1.  Enterprise CorpID
@@ -272,7 +277,7 @@ fastgpt-sso:
 
     a. Get the app's AgentID and Secret
 
-    b. Ensure the app's visibility scope is set to all (i.e., root department)
+    b. The app's visibility scope determines the WeCom member sync scope. Include at least the departments that should be synchronized; to synchronize the entire enterprise, select the root department (all visible).
 
     ![](/imgs/sso8.png)
 
@@ -310,11 +315,22 @@ fastgpt-sso:
 
     ![](/imgs/sso14.png)
 
-#### 2. yml Configuration Example
+#### 2. Use the latest image to deploy the fastgpt-sso relay service
+
+WeCom SSO login uses the app Secret, while member synchronization uses the Contact Sync Assistant Secret. Pull the published `latest` image and recreate the service:
+
+```bash
+docker compose pull fastgpt-sso
+docker compose up -d --force-recreate fastgpt-sso
+```
+
+#### 3. yml Configuration Example
+
+#### 3. yml Configuration Example
 
 ```yaml
 fastgpt-sso:
-  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.9.0
+  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest
   container_name: fastgpt-sso
   restart: always
   networks:
@@ -346,6 +362,13 @@ fastgpt-sso:
     - WECOM_SYNC_SECRET=
 ```
 
+#### 4. WeCom member sync rules
+
+- `/org/list` returns departments visible to the WeCom app.
+- `/user/list` still retrieves members through the Contact Sync Assistant, but keeps only members who belong to at least one department visible to the app.
+- A member's department list is filtered to visible departments; a member who belongs only to invisible departments is not synchronized to FastGPT.
+- After changing the app visibility scope or image version, run member synchronization again. You can also call the endpoints below to verify the result first.
+
 ### Standard OAuth 2.0
 
 We provide OAuth 2.0 integration support using the authorization code grant from RFC 6749.
@@ -501,10 +524,10 @@ LDAP_MEMBERSHIP_MODE supports four modes:
 
 | Mode             | Relationship                                                    | Main configuration       |
 | ---------------- | --------------------------------------------------------------- | ------------------------ |
-| user_attribute   | A user attribute, usually ou, points to an organization         | LDAP_USER_ATTRIBUTE_*    |
-| group_member_dn  | A group attribute, usually member, contains user DNs            | LDAP_GROUP_MEMBER_DN_*   |
-| user_member_of   | A user attribute, usually memberOf, contains group DNs          | LDAP_USER_MEMBER_OF_*    |
-| posix_member_uid | A group attribute, usually memberUid, contains user identifiers | LDAP_POSIX_MEMBER_UID_*  |
+| user_attribute   | A user attribute, usually ou, points to an organization         | LDAP*USER_ATTRIBUTE*\*   |
+| group_member_dn  | A group attribute, usually member, contains user DNs            | LDAP*GROUP_MEMBER_DN*\*  |
+| user_member_of   | A user attribute, usually memberOf, contains group DNs          | LDAP*USER_MEMBER_OF*\*   |
+| posix_member_uid | A group attribute, usually memberUid, contains user identifiers | LDAP*POSIX_MEMBER_UID*\* |
 
 **1. user_attribute: user attribute points to an organization**
 

document/content/guide/admin/sso.mdx

@@ -32,7 +32,7 @@ FastGPT-SSO-Service 是为了聚合不同来源的 SSO 和成员同步接口，
 
 ```yaml
 fastgpt-sso:
-  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.14.16 # 目前sso最新版本，可直接使用当前版本
+  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest
   container_name: fastgpt-sso
   restart: always
   networks:
@@ -256,6 +256,11 @@ fastgpt-sso:
 
 ### 企业微信
 
+<Alert context="warning">
+  企微成员同步逻辑更新后，必须重新部署 `fastgpt-sso-service` 中转服务，并使用已发布的 `latest`
+  镜像。
+</Alert>
+
 #### 1. 参数获取
 
 1.  企业的 CorpID
@@ -270,7 +275,7 @@ fastgpt-sso:
 
     a. 获取应用的 AgentID 和 Secret
 
-    b. 保证这个应用的可见范围为全部（也就是根部门）
+    b. 应用的可见范围决定企微成员同步范围。请至少覆盖需要同步的部门；如果需要同步整个企业，请设置为根部门（全部可见）。
 
     ![](/imgs/sso8.png)
 
@@ -308,11 +313,20 @@ fastgpt-sso:
 
     ![](/imgs/sso14.png)
 
-#### 2. yml 配置示例
+#### 2. 使用 latest 镜像部署 fastgpt-sso 中转服务
+
+企微 SSO 登录使用应用的 Secret，成员同步使用“通讯录同步助手”的 Secret。请拉取已发布的 `latest` 镜像并重新创建服务：
+
+```bash
+docker compose pull fastgpt-sso
+docker compose up -d --force-recreate fastgpt-sso
+```
+
+#### 3. yml 配置示例
 
 ```yaml
 fastgpt-sso:
-  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:v4.14.16
+  image: registry.cn-hangzhou.aliyuncs.com/fastgpt/fastgpt-sso-service:latest
   container_name: fastgpt-sso
   restart: always
   networks:
@@ -344,6 +358,13 @@ fastgpt-sso:
     - WECOM_SYNC_SECRET=
 ```
 
+#### 4. 企微成员同步规则
+
+- `/org/list` 返回企微应用可见范围内的部门。
+- `/user/list` 仍通过“通讯录同步助手”获取成员，但只保留至少属于一个应用可见部门的成员。
+- 成员所属部门会同步过滤为应用可见部门；只属于不可见部门的成员不会同步到 FastGPT。
+- 修改企微应用可见范围或镜像版本后，请重新执行一次成员同步；也可以先调用下方接口检查返回结果。
+
 ### 标准 OAuth2.0
 
 我们提供一套 RFC 6749 中鉴权码模式的 OAuth2.0 接入支持。参考：