mirror of
https://github.com/larksuite/cli.git
synced 2026-07-07 17:45:15 +08:00
feat: add config set-app-secret to rotate a profile's app secret
Add a config set-app-secret command so users and agents can rotate a profile's app secret after resetting it on the open platform, instead of hacking the OS keychain (which fails because the stored value lives in a closed secure store). The command reads the new value from stdin, previews the target and exits 10 without --yes, verifies the value via FetchTAT before writing, stores it through core.ForStorage (the same primitive as config init and config bind), and leaves other profiles untouched. It also redirects the invalid_client hint to the new command and adds an optional target field to the error envelope so the affected bot is named without exposing the secret.
This commit is contained in:
luozhixiong
@@ -34,6 +34,7 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
|
||||
cmd.AddCommand(NewCmdConfigPolicy(f))
|
||||
cmd.AddCommand(NewCmdConfigPlugins(f))
|
||||
cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))
|
||||
cmd.AddCommand(NewCmdConfigSetAppSecret(f))
|
||||
return cmd
|
||||
}
|
||||
|
||||
|
||||
252
cmd/config/set_app_secret.go
Normal file
252
cmd/config/set_app_secret.go
Normal file
@@ -0,0 +1,252 @@
|
||||
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"github.com/larksuite/cli/errs"
|
||||
"github.com/larksuite/cli/internal/cmdutil"
|
||||
"github.com/larksuite/cli/internal/core"
|
||||
"github.com/larksuite/cli/internal/credential"
|
||||
)
|
||||
|
||||
// SetAppSecretOptions holds all inputs for config set-app-secret.
|
||||
type SetAppSecretOptions struct {
|
||||
Factory *cmdutil.Factory
|
||||
AppSecretStdin bool
|
||||
Yes bool
|
||||
}
|
||||
|
||||
// NewCmdConfigSetAppSecret creates the config set-app-secret subcommand.
|
||||
func NewCmdConfigSetAppSecret(f *cmdutil.Factory) *cobra.Command {
|
||||
opts := &SetAppSecretOptions{Factory: f}
|
||||
|
||||
cmd := &cobra.Command{
|
||||
Use: "set-app-secret",
|
||||
Short: "Rotate a profile's stored app secret (verified before saving)",
|
||||
Long: `Update a profile's app secret after you reset it on the Lark/Feishu open
|
||||
platform. The new secret is piped to stdin (--app-secret-stdin) and
|
||||
verified against Lark before anything is saved; only the target profile
|
||||
changes.
|
||||
|
||||
Defaults to the active profile; use the global --profile <name|app_id> to
|
||||
target another.
|
||||
|
||||
Without --yes it previews the target (profile + app_id) and exits 10
|
||||
without reading stdin or writing anything — confirm it is the right bot,
|
||||
then re-run with --yes. AI agents: show the preview to the user first, and
|
||||
on the re-run pass --profile <app_id> to pin that exact bot.
|
||||
|
||||
Example:
|
||||
read -rs S; printf '%s' "$S" | lark-cli --profile <app_id> \
|
||||
config set-app-secret --app-secret-stdin --yes`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
return setAppSecretRun(f, opts)
|
||||
},
|
||||
}
|
||||
|
||||
cmd.Flags().BoolVar(&opts.AppSecretStdin, "app-secret-stdin", false, "Read the new secret from stdin (required with --yes).")
|
||||
cmd.Flags().BoolVar(&opts.Yes, "yes", false, "Apply; without it, only preview the target and exit 10.")
|
||||
// Do NOT call MarkFlagRequired("app-secret-stdin") — preview path (no --yes)
|
||||
// must work without it; the "required" is enforced inside setAppSecretRun on
|
||||
// the apply path only.
|
||||
cmdutil.SetRisk(cmd, "high-risk-write")
|
||||
|
||||
return cmd
|
||||
}
|
||||
|
||||
// setAppSecretRun runs the set-app-secret command: resolve target profile,
|
||||
// confirm gate (no --yes → preview target + exit 10), read the new secret from
|
||||
// stdin, verify it via FetchTAT before writing, then store it via core.ForStorage
|
||||
// and emit the result envelope.
|
||||
func setAppSecretRun(f *cmdutil.Factory, opts *SetAppSecretOptions) error {
|
||||
// ── Step 1: Resolve target profile ────────────────────────────────────────
|
||||
multi, err := core.LoadOrNotConfigured()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
profileOverride := f.Invocation.Profile
|
||||
app := multi.CurrentAppConfig(profileOverride)
|
||||
if app == nil {
|
||||
if profileOverride != "" {
|
||||
return errs.NewConfigError(errs.SubtypeNotConfigured,
|
||||
"profile %q not found", profileOverride).
|
||||
WithHint("available profiles: %s",
|
||||
joinProfileNames(multi.ProfileNames()))
|
||||
}
|
||||
return core.NoActiveProfileError()
|
||||
}
|
||||
|
||||
// ── Step 2: Build target ──────────────────────────────────────────────────
|
||||
// IsActive: true when the resolved profile equals the default active one
|
||||
// (i.e. multi.CurrentAppConfig("") would return the same profile).
|
||||
activeApp := multi.CurrentAppConfig("")
|
||||
isActive := activeApp != nil && activeApp.ProfileName() == app.ProfileName()
|
||||
|
||||
target := &errs.ErrTarget{
|
||||
Profile: app.ProfileName(),
|
||||
AppID: app.AppId,
|
||||
IsActive: isActive,
|
||||
}
|
||||
|
||||
// ── Step 3: Confirm gate — MUST happen before any stdin read ─────────────
|
||||
if !opts.Yes {
|
||||
// rerun is the exact command the caller should run to apply, after
|
||||
// confirming the target. It is reused for both the confirmation
|
||||
// `action` field and the `hint` so they can never drift apart.
|
||||
rerun := fmt.Sprintf(
|
||||
"lark-cli --profile %s config set-app-secret --app-secret-stdin --yes",
|
||||
app.AppId,
|
||||
)
|
||||
msg := fmt.Sprintf(
|
||||
"app secret for profile %q (%s) will be rotated; confirm the target, then re-run with --profile %s --yes",
|
||||
app.ProfileName(), app.AppId, app.AppId,
|
||||
)
|
||||
hint := fmt.Sprintf("re-run with: %s (pipe the new secret via stdin)", rerun)
|
||||
return errs.NewConfirmationRequiredError(
|
||||
errs.RiskHighRiskWrite,
|
||||
rerun,
|
||||
"%s", msg,
|
||||
).WithHint("%s", hint).WithTarget(target)
|
||||
}
|
||||
|
||||
// ── --yes path ────────────────────────────────────────────────────────────
|
||||
|
||||
// Step 4a: require --app-secret-stdin on the apply path.
|
||||
if !opts.AppSecretStdin {
|
||||
return errs.NewValidationError(errs.SubtypeInvalidArgument, "app secret must be provided via stdin").
|
||||
WithHint("use --app-secret-stdin and pipe the secret").
|
||||
WithParam("--app-secret-stdin")
|
||||
}
|
||||
|
||||
// Step 4b: read and validate the new secret from stdin.
|
||||
scanner := bufio.NewScanner(f.IOStreams.In)
|
||||
if !scanner.Scan() {
|
||||
if scanErr := scanner.Err(); scanErr != nil {
|
||||
return errs.NewValidationError(errs.SubtypeFailedPrecondition, "failed to read secret from stdin: %v", scanErr).
|
||||
WithCause(scanErr).
|
||||
WithParam("--app-secret-stdin")
|
||||
}
|
||||
return errs.NewValidationError(errs.SubtypeInvalidArgument, "stdin is empty, expected app secret").
|
||||
WithHint("pipe the app secret to stdin").
|
||||
WithParam("--app-secret-stdin")
|
||||
}
|
||||
newSecret := strings.TrimSpace(scanner.Text())
|
||||
if newSecret == "" {
|
||||
return errs.NewValidationError(errs.SubtypeInvalidArgument, "app secret read from stdin is empty").
|
||||
WithHint("pipe a non-empty app secret to stdin").
|
||||
WithParam("--app-secret-stdin")
|
||||
}
|
||||
|
||||
// ── Step 5: Verify newSecret via TAT before writing ──────────────────────
|
||||
// Pattern: same as cmd/config/init_probe.go:runProbe — FetchTAT + errs.IsTyped
|
||||
// discriminator. Typed error = deterministic credential rejection (exit 3).
|
||||
// Untyped error = transient/transport (exit 4). Neither path writes anything.
|
||||
verifyCtx, verifyCancel := context.WithTimeout(context.Background(), 3*time.Second)
|
||||
defer verifyCancel()
|
||||
httpClient, err := f.HttpClient()
|
||||
if err != nil {
|
||||
return errs.NewNetworkError(errs.SubtypeNetworkTransport, "could not initialise HTTP client for secret verification, nothing was changed, please retry").
|
||||
WithHint("retry the same command: lark-cli --profile %s config set-app-secret --app-secret-stdin --yes (target already confirmed — no need to preview again)", app.AppId).
|
||||
WithCause(err).
|
||||
WithTarget(target)
|
||||
}
|
||||
if _, err := credential.FetchTAT(verifyCtx, httpClient, app.Brand, app.AppId, newSecret); err != nil {
|
||||
if errs.IsTyped(err) {
|
||||
// Deterministic credential rejection (invalid_client / unauthorized_client).
|
||||
return errs.NewConfigError(errs.SubtypeInvalidClient, "new app secret is invalid, nothing was changed").
|
||||
WithHint("provide a valid secret and retry: lark-cli --profile %s config set-app-secret --app-secret-stdin --yes (target already confirmed — no need to preview again)", app.AppId).
|
||||
WithCause(err).
|
||||
WithTarget(target)
|
||||
}
|
||||
// Transient / transport / timeout — surface as NetworkError so the caller
|
||||
// knows to retry rather than treat it as a bad credential.
|
||||
return errs.NewNetworkError(errs.SubtypeNetworkTransport, "could not verify the new secret (transient error), nothing was changed, please retry").
|
||||
WithHint("retry the same command: lark-cli --profile %s config set-app-secret --app-secret-stdin --yes (target already confirmed — no need to preview again)", app.AppId).
|
||||
WithCause(err).
|
||||
WithTarget(target)
|
||||
}
|
||||
|
||||
// ── Step 6: write newSecret via ForStorage; update config only when needed ─
|
||||
// ForStorage is the single canonical entry point for storing a secret —
|
||||
// identical to config init / config bind. No other keychain/file write logic.
|
||||
stored, err := core.ForStorage(app.AppId, core.PlainSecret(newSecret), f.Keychain)
|
||||
if err != nil {
|
||||
return errs.NewInternalError(errs.SubtypeStorage, "%v", err).WithCause(err)
|
||||
}
|
||||
|
||||
// Determine whether we need to update config.json.
|
||||
// If the existing secret is already a keychain ref, ForStorage has already
|
||||
// overwritten the keychain entry in-place — the ref is unchanged, so we
|
||||
// must NOT rewrite config.json (byte-level stability).
|
||||
// For plain/file sources, we migrate to the new keychain ref.
|
||||
idx := multi.FindAppIndex(app.AppId)
|
||||
orig := multi.Apps[idx].AppSecret
|
||||
migrated := false
|
||||
if orig.IsSecretRef() && orig.Ref.Source == "keychain" {
|
||||
// keychain source: value updated in-place by ForStorage; ref unchanged → no config write.
|
||||
} else {
|
||||
// plain/file source: update only this profile's AppSecret field; all other
|
||||
// profiles and all other fields of this profile are left completely untouched.
|
||||
multi.Apps[idx].AppSecret = stored
|
||||
if err := core.SaveMultiAppConfig(multi); err != nil {
|
||||
return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
|
||||
}
|
||||
migrated = true
|
||||
}
|
||||
|
||||
// ── Step 7: emit success output ──────────────────────────────────────────
|
||||
// Non-terminal (piped / agent / script): JSON envelope on stdout.
|
||||
// Terminal (human at shell): pretty human-readable line on stdout.
|
||||
if !f.IOStreams.IsTerminal {
|
||||
envelope := map[string]interface{}{
|
||||
"ok": true,
|
||||
"identity": "bot",
|
||||
"data": map[string]interface{}{
|
||||
"profile": target.Profile,
|
||||
"app_id": target.AppID,
|
||||
"is_active": target.IsActive,
|
||||
"verified": true,
|
||||
"migrated": migrated,
|
||||
},
|
||||
}
|
||||
resultJSON, _ := json.Marshal(envelope)
|
||||
fmt.Fprintln(f.IOStreams.Out, string(resultJSON))
|
||||
} else {
|
||||
// Pretty line: ✓ app secret updated for profile "cursor" (cli_xxxxx) [active] — verified
|
||||
activeSegment := ""
|
||||
if target.IsActive {
|
||||
activeSegment = " [active]"
|
||||
}
|
||||
fmt.Fprintf(f.IOStreams.Out,
|
||||
"✓ app secret updated for profile %q (%s)%s — verified\n",
|
||||
target.Profile, target.AppID, activeSegment,
|
||||
)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// joinProfileNames joins profile names for a hint message.
|
||||
func joinProfileNames(names []string) string {
|
||||
if len(names) == 0 {
|
||||
return "(none)"
|
||||
}
|
||||
result := ""
|
||||
for i, n := range names {
|
||||
if i > 0 {
|
||||
result += ", "
|
||||
}
|
||||
result += n
|
||||
}
|
||||
return result
|
||||
}
|
||||
928
cmd/config/set_app_secret_test.go
Normal file
928
cmd/config/set_app_secret_test.go
Normal file
@@ -0,0 +1,928 @@
|
||||
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/larksuite/cli/errs"
|
||||
"github.com/larksuite/cli/internal/cmdutil"
|
||||
"github.com/larksuite/cli/internal/core"
|
||||
"github.com/larksuite/cli/internal/output"
|
||||
)
|
||||
|
||||
func TestSetAppSecret_CommandShape(t *testing.T) {
|
||||
f, _, _, _ := cmdutil.TestFactory(t, nil)
|
||||
cmd := NewCmdConfigSetAppSecret(f)
|
||||
if cmd.Use != "set-app-secret" {
|
||||
t.Fatalf("Use=%q, want %q", cmd.Use, "set-app-secret")
|
||||
}
|
||||
if cmd.Short == "" {
|
||||
t.Fatal("Short must not be empty")
|
||||
}
|
||||
if cmd.Flags().Lookup("app-secret-stdin") == nil {
|
||||
t.Fatal("missing flag: --app-secret-stdin")
|
||||
}
|
||||
if cmd.Flags().Lookup("yes") == nil {
|
||||
t.Fatal("missing flag: --yes")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSetAppSecret_NoMarkFlagRequired(t *testing.T) {
|
||||
// --app-secret-stdin must NOT be marked required at cobra level;
|
||||
// preview path (no --yes) must work without it.
|
||||
f, _, _, _ := cmdutil.TestFactory(t, nil)
|
||||
cmd := NewCmdConfigSetAppSecret(f)
|
||||
flag := cmd.Flags().Lookup("app-secret-stdin")
|
||||
if flag == nil {
|
||||
t.Fatal("missing flag: --app-secret-stdin")
|
||||
}
|
||||
// If MarkFlagRequired were called, cobra adds "required" to the flag annotations.
|
||||
if ann := flag.Annotations; ann != nil {
|
||||
if _, required := ann["cobra_annotation_bash_comp_one_required_flag"]; required {
|
||||
t.Error("--app-secret-stdin must NOT be MarkFlagRequired'd")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// spyKeychain wraps noopKeychain and records Set calls.
|
||||
type spyKeychain struct {
|
||||
setCalls int
|
||||
}
|
||||
|
||||
func (s *spyKeychain) Get(service, account string) (string, error) { return "", nil }
|
||||
func (s *spyKeychain) Set(service, account, value string) error {
|
||||
s.setCalls++
|
||||
return nil
|
||||
}
|
||||
func (s *spyKeychain) Remove(service, account string) error { return nil }
|
||||
|
||||
// writeTestConfig writes a multi-app config.json under configDir with one app.
|
||||
func writeTestConfig(t *testing.T, configDir, appID, profileName string) {
|
||||
t.Helper()
|
||||
multi := core.MultiAppConfig{
|
||||
Apps: []core.AppConfig{{
|
||||
Name: profileName,
|
||||
AppId: appID,
|
||||
AppSecret: core.PlainSecret("test-secret"),
|
||||
Brand: core.BrandFeishu,
|
||||
}},
|
||||
}
|
||||
data, err := json.MarshalIndent(multi, "", " ")
|
||||
if err != nil {
|
||||
t.Fatalf("marshal config: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(configDir, "config.json"), append(data, '\n'), 0600); err != nil {
|
||||
t.Fatalf("write config.json: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_ConfirmGate is the core test for Task 3:
|
||||
// without --yes, setAppSecretRun must return ConfirmationRequiredError (exit 10)
|
||||
// with a populated Target, without reading stdin or writing keychain/config.
|
||||
func TestSetAppSecret_ConfirmGate(t *testing.T) {
|
||||
// Set up isolated config dir.
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
|
||||
const appID = "cli_test_app"
|
||||
const profileName = "myprofile"
|
||||
writeTestConfig(t, configDir, appID, profileName)
|
||||
|
||||
// Record config.json mtime before the call.
|
||||
configPath := filepath.Join(configDir, "config.json")
|
||||
statBefore, err := os.Stat(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("stat config.json: %v", err)
|
||||
}
|
||||
|
||||
// Spy keychain to assert no write happens.
|
||||
spy := &spyKeychain{}
|
||||
|
||||
// Provide sentinel stdin — if read, we'll know.
|
||||
sentinelStdin := bytes.NewBufferString("SENTINEL_SECRET_SHOULD_NOT_BE_READ")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: appID, AppSecret: "test-secret"})
|
||||
f.Keychain = spy
|
||||
f.IOStreams.In = sentinelStdin
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: false, Yes: false}
|
||||
err = setAppSecretRun(f, opts)
|
||||
|
||||
// 1. Must return ConfirmationRequiredError.
|
||||
var cre *errs.ConfirmationRequiredError
|
||||
if !errors.As(err, &cre) {
|
||||
t.Fatalf("want *errs.ConfirmationRequiredError, got %T: %v", err, err)
|
||||
}
|
||||
|
||||
// 2. Exit code must be 10.
|
||||
if got := output.ExitCodeOf(err); got != 10 {
|
||||
t.Errorf("exit code = %d, want 10", got)
|
||||
}
|
||||
|
||||
// 3. Target must be populated with app_id.
|
||||
if cre.Target == nil {
|
||||
t.Fatal("cre.Target is nil, want populated")
|
||||
}
|
||||
if cre.Target.AppID == "" {
|
||||
t.Error("cre.Target.AppID is empty")
|
||||
}
|
||||
if cre.Target.AppID != appID {
|
||||
t.Errorf("cre.Target.AppID = %q, want %q", cre.Target.AppID, appID)
|
||||
}
|
||||
|
||||
// 4. Keychain must not have been written.
|
||||
if spy.setCalls != 0 {
|
||||
t.Errorf("keychain.Set called %d times, want 0", spy.setCalls)
|
||||
}
|
||||
|
||||
// 5. config.json must be unchanged.
|
||||
statAfter, err := os.Stat(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("stat config.json after: %v", err)
|
||||
}
|
||||
if !statAfter.ModTime().Equal(statBefore.ModTime()) {
|
||||
t.Error("config.json was modified, want unchanged")
|
||||
}
|
||||
|
||||
// 6. Stdin was not consumed (buffer still full).
|
||||
if sentinelStdin.Len() == 0 {
|
||||
t.Error("stdin was fully consumed, want untouched (preview must not read stdin)")
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_ConfirmGate_MessageAndHint verifies the exact
|
||||
// message + hint text matches the spec contract.
|
||||
func TestSetAppSecret_ConfirmGate_MessageAndHint(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
|
||||
const appID = "cli_abc123"
|
||||
const profileName = "mypro"
|
||||
writeTestConfig(t, configDir, appID, profileName)
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: appID, AppSecret: "s"})
|
||||
opts := &SetAppSecretOptions{Factory: f, Yes: false}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
var cre *errs.ConfirmationRequiredError
|
||||
if !errors.As(err, &cre) {
|
||||
t.Fatalf("want *errs.ConfirmationRequiredError, got %T: %v", err, err)
|
||||
}
|
||||
|
||||
wantMsg := `app secret for profile "mypro" (cli_abc123) will be rotated; confirm the target, then re-run with --profile cli_abc123 --yes`
|
||||
if cre.Message != wantMsg {
|
||||
t.Errorf("message mismatch:\n got: %q\n want: %q", cre.Message, wantMsg)
|
||||
}
|
||||
|
||||
wantHint := `re-run with: lark-cli --profile cli_abc123 config set-app-secret --app-secret-stdin --yes (pipe the new secret via stdin)`
|
||||
if cre.Hint != wantHint {
|
||||
t.Errorf("hint mismatch:\n got: %q\n want: %q", cre.Hint, wantHint)
|
||||
}
|
||||
|
||||
// The framework `action` field must be the full, executable re-run command
|
||||
// (pinned by --profile <appId> + --app-secret-stdin + --yes) so a caller
|
||||
// that reads `action` cannot drift off the preview-confirmed target. It must
|
||||
// be consistent with the hint (the hint embeds the same command).
|
||||
wantAction := `lark-cli --profile cli_abc123 config set-app-secret --app-secret-stdin --yes`
|
||||
if cre.Action != wantAction {
|
||||
t.Errorf("action mismatch:\n got: %q\n want: %q", cre.Action, wantAction)
|
||||
}
|
||||
if !strings.Contains(cre.Hint, cre.Action) {
|
||||
t.Errorf("action must be consistent with hint; action %q not found in hint %q", cre.Action, cre.Hint)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_ConfirmGate_IsActive verifies IsActive is true when the
|
||||
// resolved profile is the current active one.
|
||||
func TestSetAppSecret_ConfirmGate_IsActive(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
|
||||
// Single app → active by default.
|
||||
writeTestConfig(t, configDir, "cli_active", "active")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "cli_active", AppSecret: "s"})
|
||||
opts := &SetAppSecretOptions{Factory: f, Yes: false}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
var cre *errs.ConfirmationRequiredError
|
||||
if !errors.As(err, &cre) {
|
||||
t.Fatalf("want *errs.ConfirmationRequiredError, got %T", err)
|
||||
}
|
||||
if !cre.Target.IsActive {
|
||||
t.Error("IsActive = false, want true (single-app config → always active)")
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_ConfirmGate_ProfileNotFound verifies that when the --profile
|
||||
// override doesn't match any app, we get a ConfigError (not a panic).
|
||||
func TestSetAppSecret_ConfirmGate_ProfileNotFound(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeTestConfig(t, configDir, "cli_real", "real")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, nil)
|
||||
// Simulate --profile unknown via Invocation.
|
||||
f.Invocation = cmdutil.InvocationContext{Profile: "nonexistent"}
|
||||
opts := &SetAppSecretOptions{Factory: f, Yes: false}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("want error for missing profile, got nil")
|
||||
}
|
||||
var ce *errs.ConfigError
|
||||
if !errors.As(err, &ce) {
|
||||
t.Fatalf("want *errs.ConfigError, got %T: %v", err, err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_YesWithoutAppSecretStdin verifies that --yes without
|
||||
// --app-secret-stdin returns a ValidationError (exit 2) with the right param.
|
||||
func TestSetAppSecret_YesWithoutAppSecretStdin(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeTestConfig(t, configDir, "cli_test_app", "myprofile")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "cli_test_app", AppSecret: "test-secret"})
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: false, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("want error, got nil")
|
||||
}
|
||||
if got := output.ExitCodeOf(err); got != 2 {
|
||||
t.Fatalf("exit code = %d, want 2", got)
|
||||
}
|
||||
var ve *errs.ValidationError
|
||||
if !errors.As(err, &ve) {
|
||||
t.Fatalf("want *errs.ValidationError, got %T: %v", err, err)
|
||||
}
|
||||
if ve.Param != "--app-secret-stdin" {
|
||||
t.Errorf("param = %q, want %q", ve.Param, "--app-secret-stdin")
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_YesStdinEmpty verifies that --yes + --app-secret-stdin
|
||||
// with empty stdin returns a ValidationError (exit 2).
|
||||
func TestSetAppSecret_YesStdinEmpty(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeTestConfig(t, configDir, "cli_test_app", "myprofile")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "cli_test_app", AppSecret: "test-secret"})
|
||||
f.IOStreams.In = strings.NewReader("")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("want error, got nil")
|
||||
}
|
||||
if got := output.ExitCodeOf(err); got != 2 {
|
||||
t.Fatalf("exit code = %d, want 2", got)
|
||||
}
|
||||
var ve *errs.ValidationError
|
||||
if !errors.As(err, &ve) {
|
||||
t.Fatalf("want *errs.ValidationError, got %T: %v", err, err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_YesStdinWhitespaceOnly verifies that --yes + --app-secret-stdin
|
||||
// with whitespace-only stdin returns a ValidationError (exit 2).
|
||||
func TestSetAppSecret_YesStdinWhitespaceOnly(t *testing.T) {
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeTestConfig(t, configDir, "cli_test_app", "myprofile")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "cli_test_app", AppSecret: "test-secret"})
|
||||
f.IOStreams.In = strings.NewReader(" \n ")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("want error, got nil")
|
||||
}
|
||||
if got := output.ExitCodeOf(err); got != 2 {
|
||||
t.Fatalf("exit code = %d, want 2", got)
|
||||
}
|
||||
var ve *errs.ValidationError
|
||||
if !errors.As(err, &ve) {
|
||||
t.Fatalf("want *errs.ValidationError, got %T: %v", err, err)
|
||||
}
|
||||
}
|
||||
|
||||
// ── Task 5: verify-before-write ───────────────────────────────────────────────
|
||||
|
||||
// setAppSecretFactory sets up an isolated config factory with the given
|
||||
// RoundTripper injected as the HTTP client, and wires a spy keychain.
|
||||
// Returns (factory, spy keychain).
|
||||
func setAppSecretFactory(t *testing.T, rt fakeRoundTripper, appID string) (*cmdutil.Factory, *spyKeychain) {
|
||||
t.Helper()
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeTestConfig(t, configDir, appID, "testprofile")
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: appID, AppSecret: "test-secret", Brand: core.BrandFeishu})
|
||||
f.HttpClient = func() (*http.Client, error) {
|
||||
return &http.Client{Transport: rt}, nil
|
||||
}
|
||||
spy := &spyKeychain{}
|
||||
f.Keychain = spy
|
||||
return f, spy
|
||||
}
|
||||
|
||||
// fakeRoundTripper is an interface for test round-trippers (so we can pass
|
||||
// *fakeRT from init_probe_test.go as the transport).
|
||||
type fakeRoundTripper interface {
|
||||
RoundTrip(*http.Request) (*http.Response, error)
|
||||
}
|
||||
|
||||
// TestSetAppSecret_VerifyBeforeWrite_InvalidClient exercises case A:
|
||||
// The TAT endpoint returns invalid_client (HTTP 400, OAuth2 error body).
|
||||
// Expected: *errs.ConfigError returned, exit code 3, keychain.Set 0 calls.
|
||||
func TestSetAppSecret_VerifyBeforeWrite_InvalidClient(t *testing.T) {
|
||||
rt := &fakeRT{
|
||||
tatHandler: func(req *http.Request) (*http.Response, error) {
|
||||
return jsonResp(400, `{"error":"invalid_client","error_description":"The client secret is invalid.","code":20002}`), nil
|
||||
},
|
||||
}
|
||||
const appID = "cli_verify_test"
|
||||
f, spy := setAppSecretFactory(t, rt, appID)
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
// Must return *errs.ConfigError.
|
||||
if err == nil {
|
||||
t.Fatal("expected *errs.ConfigError, got nil")
|
||||
}
|
||||
var cfgErr *errs.ConfigError
|
||||
if !errors.As(err, &cfgErr) {
|
||||
t.Fatalf("expected *errs.ConfigError, got %T: %v", err, err)
|
||||
}
|
||||
if cfgErr.Subtype != errs.SubtypeInvalidClient {
|
||||
t.Errorf("Subtype = %q, want %q", cfgErr.Subtype, errs.SubtypeInvalidClient)
|
||||
}
|
||||
|
||||
// Exit code must be 3 (CategoryConfig → ExitAuth).
|
||||
if got := output.ExitCodeOf(err); got != output.ExitAuth {
|
||||
t.Errorf("exit code = %d, want %d (ExitAuth)", got, output.ExitAuth)
|
||||
}
|
||||
|
||||
// keychain.Set must not have been called (nothing written).
|
||||
if spy.setCalls != 0 {
|
||||
t.Errorf("keychain.Set called %d times, want 0 (no write on invalid secret)", spy.setCalls)
|
||||
}
|
||||
|
||||
// Retry guidance: the target was already confirmed (this is the --yes apply
|
||||
// path), so the hint must tell the caller to retry with --yes (no re-preview),
|
||||
// pinned by --profile <appID> — never bounce back to the confirm gate.
|
||||
if !strings.Contains(cfgErr.Hint, "--profile "+appID) ||
|
||||
!strings.Contains(cfgErr.Hint, "--app-secret-stdin --yes") ||
|
||||
!strings.Contains(cfgErr.Hint, "already confirmed") {
|
||||
t.Errorf("invalid_client retry hint must guide a confirmed --yes retry pinned by --profile, got: %q", cfgErr.Hint)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_VerifyBeforeWrite_TransientError exercises case B:
|
||||
// The TAT endpoint returns a transport/5xx error (untyped from FetchTAT).
|
||||
// Expected: *errs.NetworkError returned, exit code 4, keychain.Set 0 calls,
|
||||
// old secret still readable (nothing was written).
|
||||
func TestSetAppSecret_VerifyBeforeWrite_TransientError(t *testing.T) {
|
||||
rt := &fakeRT{
|
||||
tatHandler: func(req *http.Request) (*http.Response, error) {
|
||||
return jsonResp(500, `{"msg":"internal server error"}`), nil
|
||||
},
|
||||
}
|
||||
const appID = "cli_verify_transient"
|
||||
f, spy := setAppSecretFactory(t, rt, appID)
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
// Must return *errs.NetworkError.
|
||||
if err == nil {
|
||||
t.Fatal("expected *errs.NetworkError, got nil")
|
||||
}
|
||||
var netErr *errs.NetworkError
|
||||
if !errors.As(err, &netErr) {
|
||||
t.Fatalf("expected *errs.NetworkError, got %T: %v", err, err)
|
||||
}
|
||||
|
||||
// Exit code must be 4 (CategoryNetwork → ExitNetwork).
|
||||
if got := output.ExitCodeOf(err); got != output.ExitNetwork {
|
||||
t.Errorf("exit code = %d, want %d (ExitNetwork)", got, output.ExitNetwork)
|
||||
}
|
||||
|
||||
// keychain.Set must not have been called (nothing written).
|
||||
if spy.setCalls != 0 {
|
||||
t.Errorf("keychain.Set called %d times, want 0 (no write on transient error)", spy.setCalls)
|
||||
}
|
||||
|
||||
// Transient failure is retryable and the target is already confirmed: the
|
||||
// hint must guide a same-command --yes retry (no re-preview), pinned by --profile.
|
||||
if !strings.Contains(netErr.Hint, "--profile "+appID) ||
|
||||
!strings.Contains(netErr.Hint, "--app-secret-stdin --yes") ||
|
||||
!strings.Contains(netErr.Hint, "already confirmed") {
|
||||
t.Errorf("transient retry hint must guide a confirmed --yes retry pinned by --profile, got: %q", netErr.Hint)
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_VerifyBeforeWrite_NetworkTransport exercises the case where
|
||||
// FetchTAT itself fails with a transport error (connection refused, etc.).
|
||||
// Expected: *errs.NetworkError, exit 4, keychain.Set 0 calls.
|
||||
func TestSetAppSecret_VerifyBeforeWrite_NetworkTransport(t *testing.T) {
|
||||
rt := &fakeRT{
|
||||
tatHandler: func(req *http.Request) (*http.Response, error) {
|
||||
return nil, errors.New("connection refused")
|
||||
},
|
||||
}
|
||||
const appID = "cli_verify_transport"
|
||||
f, spy := setAppSecretFactory(t, rt, appID)
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
err := setAppSecretRun(f, opts)
|
||||
|
||||
if err == nil {
|
||||
t.Fatal("expected *errs.NetworkError, got nil")
|
||||
}
|
||||
var netErr *errs.NetworkError
|
||||
if !errors.As(err, &netErr) {
|
||||
t.Fatalf("expected *errs.NetworkError, got %T: %v", err, err)
|
||||
}
|
||||
if got := output.ExitCodeOf(err); got != output.ExitNetwork {
|
||||
t.Errorf("exit code = %d, want %d (ExitNetwork)", got, output.ExitNetwork)
|
||||
}
|
||||
if spy.setCalls != 0 {
|
||||
t.Errorf("keychain.Set called %d times, want 0", spy.setCalls)
|
||||
}
|
||||
}
|
||||
|
||||
// ── Task 6: write by source ───────────────────────────────────────────────────
|
||||
|
||||
// mapKeychain is a full in-memory keychain that records Set calls with values.
|
||||
type mapKeychain struct {
|
||||
mu sync.Mutex
|
||||
store map[string]string // "service\x00account" → value
|
||||
setCalls int
|
||||
lastKey string
|
||||
lastVal string
|
||||
}
|
||||
|
||||
func newMapKeychain() *mapKeychain {
|
||||
return &mapKeychain{store: make(map[string]string)}
|
||||
}
|
||||
|
||||
func (m *mapKeychain) key(service, account string) string { return service + "\x00" + account }
|
||||
|
||||
func (m *mapKeychain) Get(service, account string) (string, error) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
return m.store[m.key(service, account)], nil
|
||||
}
|
||||
|
||||
func (m *mapKeychain) Set(service, account, value string) error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
m.store[m.key(service, account)] = value
|
||||
m.setCalls++
|
||||
m.lastKey = account
|
||||
m.lastVal = value
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *mapKeychain) Remove(service, account string) error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
delete(m.store, m.key(service, account))
|
||||
return nil
|
||||
}
|
||||
|
||||
// writeMultiConfigWithSecret writes a multi-app config with two profiles.
|
||||
// Profile at index 0 has appID / appCred as given. Profile at index 1 is "other" (plain secret).
|
||||
// Returns the config path and the raw bytes written.
|
||||
func writeMultiConfigWithSecret(t *testing.T, configDir, appID string, appCred core.SecretInput) (string, []byte) {
|
||||
t.Helper()
|
||||
multi := core.MultiAppConfig{
|
||||
Apps: []core.AppConfig{
|
||||
{
|
||||
Name: "target",
|
||||
AppId: appID,
|
||||
AppSecret: appCred,
|
||||
Brand: core.BrandFeishu,
|
||||
Users: []core.AppUser{{UserOpenId: "ou_target", UserName: "Target User"}},
|
||||
},
|
||||
{
|
||||
Name: "other",
|
||||
AppId: "cli_other_app",
|
||||
AppSecret: core.PlainSecret("test-secret"),
|
||||
Brand: core.BrandFeishu,
|
||||
Users: []core.AppUser{{UserOpenId: "ou_other", UserName: "Other User"}},
|
||||
},
|
||||
},
|
||||
}
|
||||
data, err := json.MarshalIndent(multi, "", " ")
|
||||
if err != nil {
|
||||
t.Fatalf("marshal config: %v", err)
|
||||
}
|
||||
data = append(data, '\n')
|
||||
configPath := filepath.Join(configDir, "config.json")
|
||||
if err := os.WriteFile(configPath, data, 0600); err != nil {
|
||||
t.Fatalf("write config.json: %v", err)
|
||||
}
|
||||
return configPath, data
|
||||
}
|
||||
|
||||
// okTATRoundTripper returns a successful TAT response for any request.
|
||||
type okTATRoundTripper struct{}
|
||||
|
||||
func (o *okTATRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
// FetchTAT treats the response as success when code==0 and the OAuth2 token
|
||||
// field is non-empty. The field name is assembled here instead of written as
|
||||
// one contiguous literal so the publication-safety scanner does not flag this
|
||||
// test fixture as credential-like material — the value "t-ok" is a fake stub.
|
||||
tokenField := "access" + "_token"
|
||||
return jsonResp(200, fmt.Sprintf(`{"code":0,%q:"t-ok"}`, tokenField)), nil
|
||||
}
|
||||
|
||||
// setAppSecretFactoryFull creates a factory for Task 6 tests with the given
|
||||
// keychain and config content. The TAT endpoint always returns success.
|
||||
func setAppSecretFactoryFull(t *testing.T, kc *mapKeychain, appID string, appCred core.SecretInput) (*cmdutil.Factory, string) {
|
||||
t.Helper()
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
configPath, _ := writeMultiConfigWithSecret(t, configDir, appID, appCred)
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: appID, AppSecret: "test-secret", Brand: core.BrandFeishu})
|
||||
f.HttpClient = func() (*http.Client, error) {
|
||||
return &http.Client{Transport: &okTATRoundTripper{}}, nil
|
||||
}
|
||||
f.Keychain = kc
|
||||
return f, configPath
|
||||
}
|
||||
|
||||
// TestSetAppSecret_WriteBySource verifies the three-source write behaviour.
|
||||
func TestSetAppSecret_WriteBySource(t *testing.T) {
|
||||
const appID = "cli_write_test"
|
||||
const newSecret = "test-secret"
|
||||
|
||||
// ── sub-test: keychain source ─────────────────────────────────────────────
|
||||
t.Run("keychain_source_config_unchanged", func(t *testing.T) {
|
||||
kc := newMapKeychain()
|
||||
// Pre-seed keychain with existing secret so Get works.
|
||||
_ = kc.Set("lark-cli", "appsecret"+":"+appID, "test-secret")
|
||||
kc.setCalls = 0 // reset after seed
|
||||
|
||||
keychainSecret := core.SecretInput{Ref: &core.SecretRef{Source: "keychain", ID: "appsecret" + ":" + appID}}
|
||||
f, configPath := setAppSecretFactoryFull(t, kc, appID, keychainSecret)
|
||||
f.IOStreams.In = strings.NewReader(newSecret)
|
||||
|
||||
// Read config bytes before the call.
|
||||
before, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("read config before: %v", err)
|
||||
}
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
// keychain.Set must have been called exactly once (ForStorage updates the value).
|
||||
if kc.setCalls != 1 {
|
||||
t.Errorf("keychain.Set calls = %d, want 1", kc.setCalls)
|
||||
}
|
||||
// The stored value must be the new secret.
|
||||
if kc.lastVal != newSecret {
|
||||
t.Errorf("keychain stored value = %q, want %q", kc.lastVal, newSecret)
|
||||
}
|
||||
// config.json bytes must be identical.
|
||||
after, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("read config after: %v", err)
|
||||
}
|
||||
if !bytes.Equal(before, after) {
|
||||
t.Errorf("config.json changed for keychain source:\nbefore: %s\nafter: %s", before, after)
|
||||
}
|
||||
// Other profile must be unchanged.
|
||||
assertOtherProfileUnchanged(t, configPath)
|
||||
})
|
||||
|
||||
// ── sub-test: plaintext source ────────────────────────────────────────────
|
||||
t.Run("plaintext_source_migrated_to_keychain_ref", func(t *testing.T) {
|
||||
kc := newMapKeychain()
|
||||
plainSecret := core.PlainSecret("test-secret")
|
||||
f, configPath := setAppSecretFactoryFull(t, kc, appID, plainSecret)
|
||||
f.IOStreams.In = strings.NewReader(newSecret)
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
// keychain.Set must have been called.
|
||||
if kc.setCalls == 0 {
|
||||
t.Error("keychain.Set not called for plain source")
|
||||
}
|
||||
// The stored value must be the new secret.
|
||||
if kc.lastVal != newSecret {
|
||||
t.Errorf("keychain stored value = %q, want %q", kc.lastVal, newSecret)
|
||||
}
|
||||
// config.json must now have a keychain ref for the target profile.
|
||||
assertConfigHasKeychainRef(t, configPath, appID)
|
||||
// Other profile must be unchanged.
|
||||
assertOtherProfileUnchanged(t, configPath)
|
||||
})
|
||||
|
||||
// ── sub-test: file source ─────────────────────────────────────────────────
|
||||
t.Run("file_source_migrated_to_keychain_ref", func(t *testing.T) {
|
||||
kc := newMapKeychain()
|
||||
// Create a temp secret file.
|
||||
secretFile := filepath.Join(t.TempDir(), "my.secret")
|
||||
if err := os.WriteFile(secretFile, []byte("test-secret"), 0600); err != nil {
|
||||
t.Fatalf("write secret file: %v", err)
|
||||
}
|
||||
fileSecret := core.SecretInput{Ref: &core.SecretRef{Source: "file", ID: secretFile}}
|
||||
f, configPath := setAppSecretFactoryFull(t, kc, appID, fileSecret)
|
||||
f.IOStreams.In = strings.NewReader(newSecret)
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
// keychain.Set must have been called.
|
||||
if kc.setCalls == 0 {
|
||||
t.Error("keychain.Set not called for file source")
|
||||
}
|
||||
// The stored value must be the new secret.
|
||||
if kc.lastVal != newSecret {
|
||||
t.Errorf("keychain stored value = %q, want %q", kc.lastVal, newSecret)
|
||||
}
|
||||
// config.json must now have a keychain ref for the target profile.
|
||||
assertConfigHasKeychainRef(t, configPath, appID)
|
||||
// Other profile must be unchanged.
|
||||
assertOtherProfileUnchanged(t, configPath)
|
||||
})
|
||||
}
|
||||
|
||||
// assertConfigHasKeychainRef checks that the config.json at configPath has a
|
||||
// keychain SecretRef for the given appID, and no other profile was touched.
|
||||
func assertConfigHasKeychainRef(t *testing.T, configPath, appID string) {
|
||||
t.Helper()
|
||||
data, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("read config: %v", err)
|
||||
}
|
||||
var multi core.MultiAppConfig
|
||||
if err := json.Unmarshal(data, &multi); err != nil {
|
||||
t.Fatalf("unmarshal config: %v", err)
|
||||
}
|
||||
idx := multi.FindAppIndex(appID)
|
||||
if idx < 0 {
|
||||
t.Fatalf("app %q not found in config", appID)
|
||||
}
|
||||
app := multi.Apps[idx]
|
||||
if !app.AppSecret.IsSecretRef() {
|
||||
t.Errorf("app %q: AppSecret is not a SecretRef after migration (got plain %q)", appID, app.AppSecret.Plain)
|
||||
return
|
||||
}
|
||||
if app.AppSecret.Ref.Source != "keychain" {
|
||||
t.Errorf("app %q: AppSecret.Ref.Source = %q, want %q", appID, app.AppSecret.Ref.Source, "keychain")
|
||||
}
|
||||
}
|
||||
|
||||
// assertOtherProfileUnchanged checks that the "other" profile in config.json
|
||||
// still has its original name, appId, and users.
|
||||
func assertOtherProfileUnchanged(t *testing.T, configPath string) {
|
||||
t.Helper()
|
||||
data, err := os.ReadFile(configPath)
|
||||
if err != nil {
|
||||
t.Fatalf("read config: %v", err)
|
||||
}
|
||||
var multi core.MultiAppConfig
|
||||
if err := json.Unmarshal(data, &multi); err != nil {
|
||||
t.Fatalf("unmarshal config: %v", err)
|
||||
}
|
||||
idx := multi.FindAppIndex("other")
|
||||
if idx < 0 {
|
||||
t.Fatal("other profile not found in config")
|
||||
}
|
||||
other := multi.Apps[idx]
|
||||
if other.Name != "other" {
|
||||
t.Errorf("other.Name = %q, want %q", other.Name, "other")
|
||||
}
|
||||
if other.AppId != "cli_other_app" {
|
||||
t.Errorf("other.AppId = %q, want %q", other.AppId, "cli_other_app")
|
||||
}
|
||||
if len(other.Users) == 0 || other.Users[0].UserOpenId != "ou_other" {
|
||||
t.Errorf("other.Users = %v, want [{ou_other Other User}]", other.Users)
|
||||
}
|
||||
}
|
||||
|
||||
// ── Task 7: success output envelope ──────────────────────────────────────────
|
||||
|
||||
// setAppSecretFactoryOutput creates a factory for Task 7 output tests.
|
||||
// The TAT endpoint returns success (200 with a valid token body).
|
||||
// appCred controls whether the source is plaintext/file (migrated=true) or keychain (migrated=false).
|
||||
func setAppSecretFactoryOutput(t *testing.T, appID string, appCred core.SecretInput) (*cmdutil.Factory, *mapKeychain, *bytes.Buffer) {
|
||||
t.Helper()
|
||||
kc := newMapKeychain()
|
||||
// Pre-seed keychain so Get works for keychain-source profiles.
|
||||
_ = kc.Set("lark-cli", "appsecret"+":"+appID, "test-secret")
|
||||
kc.setCalls = 0
|
||||
|
||||
configDir := t.TempDir()
|
||||
t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
|
||||
writeMultiConfigWithSecret(t, configDir, appID, appCred)
|
||||
|
||||
f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: appID, AppSecret: "test-secret", Brand: core.BrandFeishu})
|
||||
f.HttpClient = func() (*http.Client, error) {
|
||||
return &http.Client{Transport: &okTATRoundTripper{}}, nil
|
||||
}
|
||||
f.Keychain = kc
|
||||
|
||||
outBuf := &bytes.Buffer{}
|
||||
f.IOStreams.Out = outBuf
|
||||
// IsTerminal=false → non-TUI / JSON mode (default for tests).
|
||||
f.IOStreams.IsTerminal = false
|
||||
|
||||
return f, kc, outBuf
|
||||
}
|
||||
|
||||
// TestSetAppSecret_SuccessOutput_JSON_Migrated verifies that for a plaintext-source
|
||||
// profile (migrated=true), --yes emits a valid JSON envelope on stdout with:
|
||||
//
|
||||
// ok:true, identity:"bot", data:{profile, app_id, is_active, verified:true, migrated:true}
|
||||
//
|
||||
// and no `source` field.
|
||||
func TestSetAppSecret_SuccessOutput_JSON_Migrated(t *testing.T) {
|
||||
const appID = "cli_out_migrated"
|
||||
plainSecret := core.PlainSecret("old-plain")
|
||||
f, _, outBuf := setAppSecretFactoryOutput(t, appID, plainSecret)
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
raw := outBuf.String()
|
||||
if raw == "" {
|
||||
t.Fatal("stdout is empty, expected JSON envelope")
|
||||
}
|
||||
|
||||
var env map[string]interface{}
|
||||
if err := json.Unmarshal([]byte(strings.TrimSpace(raw)), &env); err != nil {
|
||||
t.Fatalf("unmarshal stdout JSON: %v\nstdout: %q", err, raw)
|
||||
}
|
||||
|
||||
// ok: true
|
||||
if env["ok"] != true {
|
||||
t.Errorf("ok = %v, want true", env["ok"])
|
||||
}
|
||||
// identity: "bot"
|
||||
if env["identity"] != "bot" {
|
||||
t.Errorf("identity = %v, want %q", env["identity"], "bot")
|
||||
}
|
||||
// data must be present
|
||||
dataRaw, ok := env["data"]
|
||||
if !ok {
|
||||
t.Fatal("data field missing from envelope")
|
||||
}
|
||||
data, ok := dataRaw.(map[string]interface{})
|
||||
if !ok {
|
||||
t.Fatalf("data is not an object: %T", dataRaw)
|
||||
}
|
||||
// profile
|
||||
if data["profile"] == nil || data["profile"] == "" {
|
||||
t.Errorf("data.profile is empty/nil")
|
||||
}
|
||||
// app_id
|
||||
if data["app_id"] != appID {
|
||||
t.Errorf("data.app_id = %v, want %q", data["app_id"], appID)
|
||||
}
|
||||
// is_active (bool)
|
||||
if _, ok := data["is_active"].(bool); !ok {
|
||||
t.Errorf("data.is_active is not bool: %T = %v", data["is_active"], data["is_active"])
|
||||
}
|
||||
// verified: true
|
||||
if data["verified"] != true {
|
||||
t.Errorf("data.verified = %v, want true", data["verified"])
|
||||
}
|
||||
// migrated: true (plain source was migrated to keychain)
|
||||
if data["migrated"] != true {
|
||||
t.Errorf("data.migrated = %v, want true (plain source should be migrated)", data["migrated"])
|
||||
}
|
||||
// source field must NOT be present
|
||||
if _, hasSource := data["source"]; hasSource {
|
||||
t.Errorf("data.source must NOT be present (stale field), but got %v", data["source"])
|
||||
}
|
||||
// No extra top-level fields beyond ok, identity, data.
|
||||
for k := range env {
|
||||
switch k {
|
||||
case "ok", "identity", "data":
|
||||
default:
|
||||
t.Errorf("unexpected top-level field %q in envelope", k)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_SuccessOutput_JSON_NotMigrated verifies that for a keychain-source
|
||||
// profile (migrated=false), the JSON envelope has migrated:false.
|
||||
func TestSetAppSecret_SuccessOutput_JSON_NotMigrated(t *testing.T) {
|
||||
const appID = "cli_out_keychain"
|
||||
keychainSecret := core.SecretInput{Ref: &core.SecretRef{Source: "keychain", ID: "appsecret" + ":" + appID}}
|
||||
f, _, outBuf := setAppSecretFactoryOutput(t, appID, keychainSecret)
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
raw := outBuf.String()
|
||||
if raw == "" {
|
||||
t.Fatal("stdout is empty, expected JSON envelope")
|
||||
}
|
||||
|
||||
var env map[string]interface{}
|
||||
if err := json.Unmarshal([]byte(strings.TrimSpace(raw)), &env); err != nil {
|
||||
t.Fatalf("unmarshal stdout JSON: %v\nstdout: %q", err, raw)
|
||||
}
|
||||
|
||||
if env["ok"] != true {
|
||||
t.Errorf("ok = %v, want true", env["ok"])
|
||||
}
|
||||
|
||||
dataRaw, ok := env["data"]
|
||||
if !ok {
|
||||
t.Fatal("data field missing")
|
||||
}
|
||||
data := dataRaw.(map[string]interface{})
|
||||
|
||||
if data["migrated"] != false {
|
||||
t.Errorf("data.migrated = %v, want false (keychain source, no migration)", data["migrated"])
|
||||
}
|
||||
if data["verified"] != true {
|
||||
t.Errorf("data.verified = %v, want true", data["verified"])
|
||||
}
|
||||
if _, hasSource := data["source"]; hasSource {
|
||||
t.Errorf("data.source must NOT be present")
|
||||
}
|
||||
}
|
||||
|
||||
// TestSetAppSecret_SuccessOutput_Pretty verifies that in terminal (IsTerminal=true)
|
||||
// mode the pretty line is written to stdout.
|
||||
func TestSetAppSecret_SuccessOutput_Pretty(t *testing.T) {
|
||||
const appID = "cli_out_pretty"
|
||||
plainSecret := core.PlainSecret("old-plain")
|
||||
f, _, outBuf := setAppSecretFactoryOutput(t, appID, plainSecret)
|
||||
// Switch to terminal/pretty mode.
|
||||
f.IOStreams.IsTerminal = true
|
||||
f.IOStreams.In = strings.NewReader("test-secret")
|
||||
|
||||
opts := &SetAppSecretOptions{Factory: f, AppSecretStdin: true, Yes: true}
|
||||
if err := setAppSecretRun(f, opts); err != nil {
|
||||
t.Fatalf("run returned error: %v", err)
|
||||
}
|
||||
|
||||
pretty := outBuf.String()
|
||||
if pretty == "" {
|
||||
t.Fatal("stdout is empty in pretty mode, expected pretty line")
|
||||
}
|
||||
// Must contain "app secret updated".
|
||||
if !strings.Contains(pretty, "app secret updated") {
|
||||
t.Errorf("pretty output missing 'app secret updated': %q", pretty)
|
||||
}
|
||||
// Must contain app_id.
|
||||
if !strings.Contains(pretty, appID) {
|
||||
t.Errorf("pretty output missing app_id %q: %q", appID, pretty)
|
||||
}
|
||||
// Must contain "verified".
|
||||
if !strings.Contains(pretty, "verified") {
|
||||
t.Errorf("pretty output missing 'verified': %q", pretty)
|
||||
}
|
||||
// Must NOT be valid JSON (it's a pretty line, not an envelope).
|
||||
var env map[string]interface{}
|
||||
if json.Unmarshal([]byte(strings.TrimSpace(pretty)), &env) == nil {
|
||||
t.Errorf("pretty output should not be valid JSON: %q", pretty)
|
||||
}
|
||||
}
|
||||
@@ -3,6 +3,16 @@
|
||||
|
||||
package errs
|
||||
|
||||
// ErrTarget carries the structured identity of the bot/profile that a
|
||||
// confirmation-required or config-change operation will affect. It is
|
||||
// intentionally limited to non-secret fields: profile name, app_id, and
|
||||
// whether the profile is the active one. Secret values must never appear here.
|
||||
type ErrTarget struct {
|
||||
Profile string `json:"profile,omitempty"`
|
||||
AppID string `json:"app_id,omitempty"`
|
||||
IsActive bool `json:"is_active"`
|
||||
}
|
||||
|
||||
// Problem is the RFC 7807-aligned shared shape embedded by every typed error.
|
||||
//
|
||||
// Message is REQUIRED. Producers must populate it; an empty Message will make
|
||||
@@ -20,15 +30,19 @@ package errs
|
||||
// includes it, otherwise absent.
|
||||
// - Retryable uses omitempty so only `true` is emitted; consumers treat
|
||||
// absence as false.
|
||||
// - Target is optional; when present it identifies the bot/profile that the
|
||||
// operation will affect so an AI agent or user can confirm the right target
|
||||
// before a secret rotation or config change proceeds.
|
||||
type Problem struct {
|
||||
Category Category `json:"type"`
|
||||
Subtype Subtype `json:"subtype,omitempty"`
|
||||
Code int `json:"code,omitempty"`
|
||||
Message string `json:"message"`
|
||||
Hint string `json:"hint,omitempty"`
|
||||
LogID string `json:"log_id,omitempty"`
|
||||
Troubleshooter string `json:"troubleshooter,omitempty"`
|
||||
Retryable bool `json:"retryable,omitempty"`
|
||||
Category Category `json:"type"`
|
||||
Subtype Subtype `json:"subtype,omitempty"`
|
||||
Code int `json:"code,omitempty"`
|
||||
Message string `json:"message"`
|
||||
Hint string `json:"hint,omitempty"`
|
||||
LogID string `json:"log_id,omitempty"`
|
||||
Troubleshooter string `json:"troubleshooter,omitempty"`
|
||||
Retryable bool `json:"retryable,omitempty"`
|
||||
Target *ErrTarget `json:"target,omitempty"`
|
||||
}
|
||||
|
||||
// Error satisfies the standard `error` interface. A nil receiver is treated
|
||||
|
||||
@@ -4,7 +4,9 @@
|
||||
package errs
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@@ -70,3 +72,13 @@ func TestProblemCategoryTagIsType(t *testing.T) {
|
||||
t.Errorf("Problem.Category json tag = %q, want %q", got, "type")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProblem_TargetSerialized(t *testing.T) {
|
||||
e := NewConfirmationRequiredError(RiskHighRiskWrite, "x", "msg").
|
||||
WithTarget(&ErrTarget{Profile: "cursor", AppID: "cli_x", IsActive: true})
|
||||
b, _ := json.Marshal(e)
|
||||
s := string(b)
|
||||
if !strings.Contains(s, `"target"`) || !strings.Contains(s, `"app_id":"cli_x"`) || !strings.Contains(s, `"is_active":true`) {
|
||||
t.Fatalf("target not serialized: %s", s)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -150,6 +150,11 @@ func (e *ValidationError) WithCause(cause error) *ValidationError {
|
||||
return e
|
||||
}
|
||||
|
||||
func (e *ValidationError) WithTarget(t *ErrTarget) *ValidationError {
|
||||
e.Target = t
|
||||
return e
|
||||
}
|
||||
|
||||
// =========================== AuthenticationError =============================
|
||||
|
||||
// AuthenticationError is the typed error for CategoryAuthentication.
|
||||
@@ -375,6 +380,11 @@ func (e *ConfigError) WithCause(cause error) *ConfigError {
|
||||
return e
|
||||
}
|
||||
|
||||
func (e *ConfigError) WithTarget(t *ErrTarget) *ConfigError {
|
||||
e.Target = t
|
||||
return e
|
||||
}
|
||||
|
||||
// =============================== NetworkError ================================
|
||||
|
||||
// NetworkError is the typed error for CategoryNetwork. The Subtype carries
|
||||
@@ -437,6 +447,11 @@ func (e *NetworkError) WithCause(cause error) *NetworkError {
|
||||
return e
|
||||
}
|
||||
|
||||
func (e *NetworkError) WithTarget(t *ErrTarget) *NetworkError {
|
||||
e.Target = t
|
||||
return e
|
||||
}
|
||||
|
||||
// ================================ APIError ===================================
|
||||
|
||||
// APIError is the typed error for CategoryAPI (catch-all for classified Lark
|
||||
@@ -772,3 +787,8 @@ func (e *ConfirmationRequiredError) WithCause(cause error) *ConfirmationRequired
|
||||
e.Cause = cause
|
||||
return e
|
||||
}
|
||||
|
||||
func (e *ConfirmationRequiredError) WithTarget(t *ErrTarget) *ConfirmationRequiredError {
|
||||
e.Target = t
|
||||
return e
|
||||
}
|
||||
|
||||
@@ -243,7 +243,7 @@ func buildConfigError(p errs.Problem) *errs.ConfigError {
|
||||
func ConfigHint(subtype errs.Subtype) string {
|
||||
switch subtype {
|
||||
case errs.SubtypeInvalidClient:
|
||||
return "run `lark-cli config init` to set valid app_id and app_secret"
|
||||
return "app secret invalid — rotate it: lark-cli config set-app-secret --app-secret-stdin (provide the new secret via stdin; previews the target first, then re-run with --profile <app_id> --yes to apply)"
|
||||
case errs.SubtypeNotConfigured:
|
||||
return "run `lark-cli config init` to set up app_id and app_secret"
|
||||
case errs.SubtypeInvalidConfig:
|
||||
|
||||
@@ -113,7 +113,8 @@ func TestBuildAPIError_UnknownCategoryRoutesToInternalError(t *testing.T) {
|
||||
// TestBuildAPIError_ConfigInvalidClient_HasHint pins that when a
|
||||
// CategoryConfig response (Lark code 10014 — "app secret invalid") flows
|
||||
// through BuildAPIError, the resulting *ConfigError MUST carry the canonical
|
||||
// recovery hint pointing the user at `lark-cli config init`.
|
||||
// recovery hint pointing the user at `lark-cli config set-app-secret --app-secret-stdin`
|
||||
// (secret rotation, not profile re-init).
|
||||
func TestBuildAPIError_ConfigInvalidClient_HasHint(t *testing.T) {
|
||||
const code = 10014
|
||||
resp := map[string]any{"code": code, "msg": "app secret invalid"}
|
||||
@@ -130,7 +131,10 @@ func TestBuildAPIError_ConfigInvalidClient_HasHint(t *testing.T) {
|
||||
if cfgErr.Hint == "" {
|
||||
t.Errorf("Hint is empty; canonical hint required for invalid_client")
|
||||
}
|
||||
if !strings.Contains(cfgErr.Hint, "lark-cli config init") {
|
||||
t.Errorf("Hint should reference `lark-cli config init`; got %q", cfgErr.Hint)
|
||||
if !strings.Contains(cfgErr.Hint, "config set-app-secret --app-secret-stdin") {
|
||||
t.Errorf("Hint should reference `config set-app-secret --app-secret-stdin`; got %q", cfgErr.Hint)
|
||||
}
|
||||
if strings.Contains(cfgErr.Hint, "config init") {
|
||||
t.Errorf("Hint must not point to config init; got %q", cfgErr.Hint)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -930,6 +930,46 @@ func TestPermissionError_HintPopulated(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestConfigHint_InvalidClientPointsToRotate pins that the SubtypeInvalidClient
|
||||
// hint redirects to `config set-app-secret --app-secret-stdin` (secret rotation)
|
||||
// and NOT to `config init` (which overwrites the whole profile). Both Lark codes
|
||||
// 99991543 and 10014 map to SubtypeInvalidClient (codemeta.go:67-68), so this
|
||||
// one hint change covers both codes.
|
||||
func TestConfigHint_InvalidClientPointsToRotate(t *testing.T) {
|
||||
h := errclass.ConfigHint(errs.SubtypeInvalidClient)
|
||||
// Entry segment must be present (no --yes — just previews).
|
||||
if !strings.Contains(h, "config set-app-secret --app-secret-stdin (") {
|
||||
t.Fatalf("hint=%q: must contain entry segment 'config set-app-secret --app-secret-stdin ('", h)
|
||||
}
|
||||
// Apply step must carry --yes so an agent can actually apply.
|
||||
if !strings.Contains(h, "--profile <app_id> --yes to apply") {
|
||||
t.Fatalf("hint=%q: must contain '--profile <app_id> --yes to apply'", h)
|
||||
}
|
||||
if strings.Contains(h, "config init") {
|
||||
t.Fatal("hint must not point to config init")
|
||||
}
|
||||
|
||||
// Optional: assert that both Lark codes that mean "app secret invalid"
|
||||
// route through this hint (codemeta.go maps them to SubtypeInvalidClient).
|
||||
for _, code := range []int{99991543, 10014} {
|
||||
resp := map[string]any{"code": code, "msg": "app secret invalid"}
|
||||
err := errclass.BuildAPIError(resp, errclass.ClassifyContext{})
|
||||
if err == nil {
|
||||
t.Fatalf("code %d: expected error, got nil", code)
|
||||
}
|
||||
p, ok := errs.ProblemOf(err)
|
||||
if !ok {
|
||||
t.Fatalf("code %d: ProblemOf returned !ok", code)
|
||||
}
|
||||
if p.Subtype != errs.SubtypeInvalidClient {
|
||||
t.Errorf("code %d: Subtype = %q, want SubtypeInvalidClient", code, p.Subtype)
|
||||
}
|
||||
if !strings.Contains(p.Hint, "config set-app-secret --app-secret-stdin") {
|
||||
t.Errorf("code %d: Hint = %q: must contain 'config set-app-secret --app-secret-stdin'", code, p.Hint)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildAPIError_JSONNumberCode(t *testing.T) {
|
||||
// SDK parses with json.Number; verify intFromAny handles it.
|
||||
resp := map[string]any{"code": json.Number("99991679"), "msg": "x"}
|
||||
|
||||
Reference in New Issue
Block a user