mirror of
https://github.com/larksuite/cli.git
synced 2026-07-06 00:06:28 +08:00
99e314fe0b
Every failure on the authentication, authorization, and configuration
path now surfaces as a typed structured error instead of an ad-hoc
envelope. Users and scripts that consume CLI output get:
- a fixed nine-category taxonomy on the wire, each mapped to a
stable shell exit code (authentication/authorization/config = 3,
network = 4, internal = 5, policy = 6, confirmation = 10)
- identity-aware detail fields (missing_scopes, requested_scopes,
granted_scopes, console_url, log_id, retryable, hint) carried
uniformly on the envelope
- a single canonical policy envelope at exit 6; the legacy
auth_error carve-out is retired
- per-subtype canonical message + hint that preserves Lark's
diagnostic phrasing and routes recovery to the right actor:
app developer (app_scope_not_applied), user (missing_scope,
token_scope_insufficient, user_unauthorized), or tenant admin
(app_unavailable, app_disabled)
- wrong app credentials classify as config/invalid_client whether
surfaced by the Open API endpoint (99991543) or the tenant
access-token mint endpoint (10003 / 10014), instead of
collapsing to a transport error or api/unknown
- local shortcut scope preflight emits the same
authorization/missing_scope envelope (identity + deterministic
missing-scope set) used by the post-call permission path, so AI
consumers read the same structured shape from precheck and from
server-returned permission denial
- streaming download/upload failures keep the same network subtype
split (timeout / TLS / DNS / transport) as the non-stream path
instead of collapsing every cause to a generic transport failure
- console_url is carried only on the bot-perspective
app_scope_not_applied envelope (where the recovery action is
"developer applies the scope at the developer console"); the
user-perspective missing_scope envelope drops the field, since
the only actionable user recovery is `lark-cli auth login --scope`
and pointing an end user at a console they cannot modify is
misleading
- bind workflows (Hermes / OpenClaw / lark-channel) flatten dynamic
Type tags to wire 'config' with the original module name kept
as a metric label
All 10 typed errors are cause-bearing, nil-safe on .Error() and
.Unwrap(), and defensively clone slice setter inputs. Four lint
rules (CheckNilSafeError / CheckBuilderImmutable / CheckUnwrapSymmetry
/ CheckBuildAPIErrorArms) lock these invariants on migrated paths.
106 lines
3.1 KiB
Go
106 lines
3.1 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package errcompat_test
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/larksuite/cli/errs"
|
|
"github.com/larksuite/cli/internal/core"
|
|
"github.com/larksuite/cli/internal/errcompat"
|
|
)
|
|
|
|
func TestPromoteConfigError_TypeAuth_PromotesToAuthenticationError(t *testing.T) {
|
|
cfg := &core.ConfigError{
|
|
Type: "auth",
|
|
Code: 3,
|
|
Message: "not logged in",
|
|
Hint: "run: lark-cli auth login",
|
|
}
|
|
got := errcompat.PromoteConfigError(cfg)
|
|
|
|
var authErr *errs.AuthenticationError
|
|
if !errors.As(got, &authErr) {
|
|
t.Fatalf("expected *errs.AuthenticationError, got %T", got)
|
|
}
|
|
if authErr.Subtype != errs.SubtypeTokenMissing {
|
|
t.Errorf("subtype = %v, want %v", authErr.Subtype, errs.SubtypeTokenMissing)
|
|
}
|
|
// Cause chain must preserve original *core.ConfigError for errors.As compat.
|
|
var cfgPreserved *core.ConfigError
|
|
if !errors.As(got, &cfgPreserved) {
|
|
t.Error("Unwrap chain lost *core.ConfigError — breaks cmd/auth/list.go consumer")
|
|
}
|
|
}
|
|
|
|
func TestPromoteConfigError_TypeConfig_PromotesToConfigError(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
msg string
|
|
wantSubtype errs.Subtype
|
|
}{
|
|
{"not_configured", "not configured", errs.SubtypeNotConfigured},
|
|
{"invalid_config_parse", "failed to parse config", errs.SubtypeInvalidConfig},
|
|
{"invalid_config_keyword", "invalid config file", errs.SubtypeInvalidConfig},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
cfg := &core.ConfigError{Type: "config", Code: 3, Message: tc.msg}
|
|
got := errcompat.PromoteConfigError(cfg)
|
|
|
|
var ce *errs.ConfigError
|
|
if !errors.As(got, &ce) {
|
|
t.Fatalf("expected *errs.ConfigError, got %T", got)
|
|
}
|
|
if ce.Subtype != tc.wantSubtype {
|
|
t.Errorf("subtype = %v, want %v", ce.Subtype, tc.wantSubtype)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPromoteConfigError_TypeDynamic_PromotesToConfigError(t *testing.T) {
|
|
for _, wsName := range []string{"openclaw", "hermes", "bind"} {
|
|
t.Run(wsName, func(t *testing.T) {
|
|
cfg := &core.ConfigError{Type: wsName, Code: 3, Message: "not configured"}
|
|
got := errcompat.PromoteConfigError(cfg)
|
|
|
|
var ce *errs.ConfigError
|
|
if !errors.As(got, &ce) {
|
|
t.Fatalf("expected *errs.ConfigError, got %T", got)
|
|
}
|
|
if ce.Subtype != errs.SubtypeNotConfigured {
|
|
t.Errorf("subtype = %v, want %v", ce.Subtype, errs.SubtypeNotConfigured)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPromoteConfigError_Nil_ReturnsNil(t *testing.T) {
|
|
if got := errcompat.PromoteConfigError(nil); got != nil {
|
|
t.Errorf("nil input should return nil, got %v", got)
|
|
}
|
|
}
|
|
|
|
func TestPromoteConfigError_PreservesMessageHint(t *testing.T) {
|
|
cfg := &core.ConfigError{
|
|
Type: "auth",
|
|
Message: "session expired (user: u_xxx)",
|
|
Hint: "re-authenticate",
|
|
}
|
|
got := errcompat.PromoteConfigError(cfg)
|
|
if !strings.Contains(got.Error(), "session expired") {
|
|
t.Errorf("message lost in promotion: %v", got)
|
|
}
|
|
var authErr *errs.AuthenticationError
|
|
if !errors.As(got, &authErr) {
|
|
t.Fatalf("expected *errs.AuthenticationError, got %T", got)
|
|
}
|
|
if authErr.Hint != "re-authenticate" {
|
|
t.Errorf("hint = %q, want preserved", authErr.Hint)
|
|
}
|
|
}
|