mirror of
https://github.com/larksuite/cli.git
synced 2026-07-05 15:47:54 +08:00
99e314fe0b
Every failure on the authentication, authorization, and configuration
path now surfaces as a typed structured error instead of an ad-hoc
envelope. Users and scripts that consume CLI output get:
- a fixed nine-category taxonomy on the wire, each mapped to a
stable shell exit code (authentication/authorization/config = 3,
network = 4, internal = 5, policy = 6, confirmation = 10)
- identity-aware detail fields (missing_scopes, requested_scopes,
granted_scopes, console_url, log_id, retryable, hint) carried
uniformly on the envelope
- a single canonical policy envelope at exit 6; the legacy
auth_error carve-out is retired
- per-subtype canonical message + hint that preserves Lark's
diagnostic phrasing and routes recovery to the right actor:
app developer (app_scope_not_applied), user (missing_scope,
token_scope_insufficient, user_unauthorized), or tenant admin
(app_unavailable, app_disabled)
- wrong app credentials classify as config/invalid_client whether
surfaced by the Open API endpoint (99991543) or the tenant
access-token mint endpoint (10003 / 10014), instead of
collapsing to a transport error or api/unknown
- local shortcut scope preflight emits the same
authorization/missing_scope envelope (identity + deterministic
missing-scope set) used by the post-call permission path, so AI
consumers read the same structured shape from precheck and from
server-returned permission denial
- streaming download/upload failures keep the same network subtype
split (timeout / TLS / DNS / transport) as the non-stream path
instead of collapsing every cause to a generic transport failure
- console_url is carried only on the bot-perspective
app_scope_not_applied envelope (where the recovery action is
"developer applies the scope at the developer console"); the
user-perspective missing_scope envelope drops the field, since
the only actionable user recovery is `lark-cli auth login --scope`
and pointing an end user at a console they cannot modify is
misleading
- bind workflows (Hermes / OpenClaw / lark-channel) flatten dynamic
Type tags to wire 'config' with the original module name kept
as a metric label
All 10 typed errors are cause-bearing, nil-safe on .Error() and
.Unwrap(), and defensively clone slice setter inputs. Four lint
rules (CheckNilSafeError / CheckBuilderImmutable / CheckUnwrapSymmetry
/ CheckBuildAPIErrorArms) lock these invariants on migrated paths.
86 lines
3.2 KiB
Go
86 lines
3.2 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package credential
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/larksuite/cli/errs"
|
|
)
|
|
|
|
func TestDefaultTokenProvider_Dispatches(t *testing.T) {
|
|
// Just verify the type implements DefaultTokenResolver
|
|
var _ DefaultTokenResolver = &DefaultTokenProvider{}
|
|
}
|
|
|
|
func TestDefaultAccountProvider_Implements(t *testing.T) {
|
|
var _ DefaultAccountResolver = &DefaultAccountProvider{}
|
|
}
|
|
|
|
// TestClassifyTATResponseCode_10003_MapsToInvalidClient pins that the TAT
|
|
// endpoint's "invalid param" code surfaces as CategoryConfig/InvalidClient.
|
|
// Reason: a bad or non-existent app_id triggers 10003 on the TAT mint endpoint,
|
|
// which from the user's perspective is the same actionable failure as 10014
|
|
// ("app secret invalid") — both mean the configured credentials cannot mint a
|
|
// tenant access token. The global codemeta intentionally does not map 10003
|
|
// because in other Lark endpoints 10003 carries unrelated semantics (e.g. task
|
|
// API uses it for permission denied), so the override is local to this site.
|
|
func TestClassifyTATResponseCode_10003_MapsToInvalidClient(t *testing.T) {
|
|
err := classifyTATResponseCode(10003, "invalid param", "feishu", "cli_app_x")
|
|
if err == nil {
|
|
t.Fatal("expected non-nil error for code=10003")
|
|
}
|
|
var cfgErr *errs.ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("expected *errs.ConfigError, got %T: %v", err, err)
|
|
}
|
|
if cfgErr.Category != errs.CategoryConfig {
|
|
t.Errorf("Category = %q, want %q", cfgErr.Category, errs.CategoryConfig)
|
|
}
|
|
if cfgErr.Subtype != errs.SubtypeInvalidClient {
|
|
t.Errorf("Subtype = %q, want %q", cfgErr.Subtype, errs.SubtypeInvalidClient)
|
|
}
|
|
if cfgErr.Code != 10003 {
|
|
t.Errorf("Code = %d, want 10003", cfgErr.Code)
|
|
}
|
|
if cfgErr.Hint == "" {
|
|
t.Error("Hint must be non-empty so the user gets a recovery action")
|
|
}
|
|
}
|
|
|
|
// TestClassifyTATResponseCode_10014_RoutesViaCodeMeta pins that 10014 still
|
|
// goes through the global BuildAPIError path (codemeta entry) so the override
|
|
// for 10003 does not regress the existing mapping.
|
|
func TestClassifyTATResponseCode_10014_RoutesViaCodeMeta(t *testing.T) {
|
|
err := classifyTATResponseCode(10014, "app secret invalid", "feishu", "cli_app_x")
|
|
if err == nil {
|
|
t.Fatal("expected non-nil error for code=10014")
|
|
}
|
|
var cfgErr *errs.ConfigError
|
|
if !errors.As(err, &cfgErr) {
|
|
t.Fatalf("expected *errs.ConfigError, got %T: %v", err, err)
|
|
}
|
|
if cfgErr.Subtype != errs.SubtypeInvalidClient {
|
|
t.Errorf("Subtype = %q, want %q", cfgErr.Subtype, errs.SubtypeInvalidClient)
|
|
}
|
|
if cfgErr.Code != 10014 {
|
|
t.Errorf("Code = %d, want 10014", cfgErr.Code)
|
|
}
|
|
}
|
|
|
|
// TestClassifyTATResponseCode_UnknownCodeFallsThrough pins that codes outside
|
|
// the credential set fall through to the generic BuildAPIError fallback
|
|
// (CategoryAPI/SubtypeUnknown) — the override is narrow and intentional.
|
|
func TestClassifyTATResponseCode_UnknownCodeFallsThrough(t *testing.T) {
|
|
err := classifyTATResponseCode(99999999, "some unknown failure", "feishu", "cli_app_x")
|
|
if err == nil {
|
|
t.Fatal("expected non-nil error for unmapped code")
|
|
}
|
|
var cfgErr *errs.ConfigError
|
|
if errors.As(err, &cfgErr) {
|
|
t.Fatalf("unmapped code must not be classified as ConfigError, got %T", err)
|
|
}
|
|
}
|