github/larksuite-cli
1
0
Fork 0
mirror of https://github.com/larksuite/cli.git synced 2026-08-03 08:32:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(im): narrow chat-members-add scope to avoid over-restrictive AND-check

Browse Source 
chat.members.create raw meta lists ["im:chat", "im:chat.members:write_only"]
as OR alternatives, but the local scope precheck (MissingScopes) treats every
entry in Scopes as required (AND), so declaring both wrongly rejected tokens
holding only the narrower write_only scope. Declare only that narrow scope,
matching the chat-members-list shortcut pattern, and update the doc
troubleshooting row/login example to match.
This commit is contained in:
zhangheng.023
2026-07-21 18:26:41 +08:00
parent 93aa355365
commit cdb5343bd4
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
shortcuts/im/im_chat_members_add.go
View File

@@ -177,9 +177,16 @@ var ImChatMembersAdd = common.Shortcut{
Command: "+chat-members-add",
Description: "Add users and/or bots to a group chat; user/bot; batches --users (open_id) and --bots (app_id) into up to 2 API calls under best-effort semantics; returns a merged succeeded/invalid/not_existed/pending_approval ledger",
Risk: "write",
Scopes: []string{"im:chat", "im:chat.members:write_only"},
AuthTypes: []string{"user", "bot"},
HasFormat: true,
// Declare the narrowest scope the API accepts so tokens carrying only
// im:chat.members:write_only are honored (same rationale as
// +chat-members-list): chat.members.create's raw meta lists
// ["im:chat", "im:chat.members:write_only"] as OR alternatives, but the
// local scope precheck (internal/auth/scope.go's MissingScopes) treats
// every entry in Scopes as required (AND semantics), so listing both here
// would wrongly reject a token that only carries the narrow scope.
Scopes: []string{"im:chat.members:write_only"},
AuthTypes: []string{"user", "bot"},
HasFormat: true,
Flags: []common.Flag{
{Name: "chat-id", Required: true, Desc: "chat ID to add members to (oc_xxx)"},
{Name: "users", Type: "string_slice", Desc: "user open_ids to invite (ou_xxx); comma-separated or repeat the flag; max 50"},

2
skills/lark-im/references/lark-im-chat-members-add.md
View File

@@ -68,4 +68,4 @@ This only applies when **both** `--users` and `--bots` were supplied (so both ca
| `invalid --users value ...: must start with "ou_"` | Wrong ID type in `--users` | Use `open_id` (`ou_xxx`), not `union_id`/`user_id`/`app_id` |
| `invalid --bots value ...: must start with "cli_"` | Wrong ID type in `--bots` | Use the app's `app_id` (`cli_xxx`) |
| `--users exceeds the maximum of 50` / `--bots exceeds the maximum of 5` | Batch too large | Split into multiple calls |
| Permission denied | Missing `im:chat` or `im:chat.members:write_only`, or caller not in the chat / not owner-admin when restricted | Bot: enable both scopes in the console. User: `lark-cli auth login --scope "im:chat,im:chat.members:write_only"`; confirm the caller is in the chat |
| Permission denied | Missing `im:chat.members:write_only`, or caller not in the chat / not owner-admin when restricted | Bot: enable the scope in the console. User: `lark-cli auth login --scope "im:chat.members:write_only"`; confirm the caller is in the chat |