mirror of
https://github.com/larksuite/cli.git
synced 2026-07-06 00:06:28 +08:00
Every failure on the authentication, authorization, and configuration
path now surfaces as a typed structured error instead of an ad-hoc
envelope. Users and scripts that consume CLI output get:
- a fixed nine-category taxonomy on the wire, each mapped to a
stable shell exit code (authentication/authorization/config = 3,
network = 4, internal = 5, policy = 6, confirmation = 10)
- identity-aware detail fields (missing_scopes, requested_scopes,
granted_scopes, console_url, log_id, retryable, hint) carried
uniformly on the envelope
- a single canonical policy envelope at exit 6; the legacy
auth_error carve-out is retired
- per-subtype canonical message + hint that preserves Lark's
diagnostic phrasing and routes recovery to the right actor:
app developer (app_scope_not_applied), user (missing_scope,
token_scope_insufficient, user_unauthorized), or tenant admin
(app_unavailable, app_disabled)
- wrong app credentials classify as config/invalid_client whether
surfaced by the Open API endpoint (99991543) or the tenant
access-token mint endpoint (10003 / 10014), instead of
collapsing to a transport error or api/unknown
- local shortcut scope preflight emits the same
authorization/missing_scope envelope (identity + deterministic
missing-scope set) used by the post-call permission path, so AI
consumers read the same structured shape from precheck and from
server-returned permission denial
- streaming download/upload failures keep the same network subtype
split (timeout / TLS / DNS / transport) as the non-stream path
instead of collapsing every cause to a generic transport failure
- console_url is carried only on the bot-perspective
app_scope_not_applied envelope (where the recovery action is
"developer applies the scope at the developer console"); the
user-perspective missing_scope envelope drops the field, since
the only actionable user recovery is `lark-cli auth login --scope`
and pointing an end user at a console they cannot modify is
misleading
- bind workflows (Hermes / OpenClaw / lark-channel) flatten dynamic
Type tags to wire 'config' with the original module name kept
as a metric label
All 10 typed errors are cause-bearing, nil-safe on .Error() and
.Unwrap(), and defensively clone slice setter inputs. Four lint
rules (CheckNilSafeError / CheckBuilderImmutable / CheckUnwrapSymmetry
/ CheckBuildAPIErrorArms) lock these invariants on migrated paths.
186 lines
4.8 KiB
Go
186 lines
4.8 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package common
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/larksuite/cli/errs"
|
|
"github.com/larksuite/cli/internal/output"
|
|
)
|
|
|
|
type roundTripFunc func(*http.Request) (*http.Response, error)
|
|
|
|
func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
|
|
return f(req)
|
|
}
|
|
|
|
func TestDoMCPCallUnauthorizedHTTPError(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
client := &http.Client{
|
|
Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
|
|
return &http.Response{
|
|
StatusCode: http.StatusUnauthorized,
|
|
Status: "401 Unauthorized",
|
|
Body: io.NopCloser(strings.NewReader("unauthorized")),
|
|
}, nil
|
|
}),
|
|
}
|
|
|
|
_, err := DoMCPCall(context.Background(), client, "fetch-doc", map[string]interface{}{"doc_id": "doc_1"}, "uat-token", "https://example.com/mcp", false)
|
|
if got := output.ExitCodeOf(err); got != output.ExitAuth {
|
|
t.Fatalf("expected auth exit code (%d), got %d", output.ExitAuth, got)
|
|
}
|
|
}
|
|
|
|
func TestDoMCPCallJSONRPCErrorUsesLarkClassification(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
client := &http.Client{
|
|
Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Status: "200 OK",
|
|
Body: io.NopCloser(strings.NewReader(`{"error":{"code":99991668,"message":"user_access_token invalid"}}`)),
|
|
}, nil
|
|
}),
|
|
}
|
|
|
|
_, err := DoMCPCall(context.Background(), client, "fetch-doc", map[string]interface{}{"doc_id": "doc_1"}, "uat-token", "https://example.com/mcp", false)
|
|
if err == nil {
|
|
t.Fatal("expected error, got nil")
|
|
}
|
|
if got := output.ExitCodeOf(err); got != output.ExitAuth {
|
|
t.Fatalf("expected auth exit code (%d), got %d", output.ExitAuth, got)
|
|
}
|
|
var authErr *errs.AuthenticationError
|
|
if !errors.As(err, &authErr) {
|
|
t.Fatalf("expected *errs.AuthenticationError, got %T: %v", err, err)
|
|
}
|
|
}
|
|
|
|
func TestDoMCPCallSetsHeadersAndUnwrapsResult(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var seen *http.Request
|
|
client := &http.Client{
|
|
Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
|
|
seen = req
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Status: "200 OK",
|
|
Body: io.NopCloser(strings.NewReader(`{"result":{"jsonrpc":"2.0","result":{"ok":true}}}`)),
|
|
}, nil
|
|
}),
|
|
}
|
|
|
|
got, err := DoMCPCall(context.Background(), client, "fetch-doc", map[string]interface{}{"doc_id": "doc_1"}, "tat-token", "https://example.com/mcp", true)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
result, ok := got.(map[string]interface{})
|
|
if !ok || result["ok"] != true {
|
|
t.Fatalf("unexpected result: %#v", got)
|
|
}
|
|
if seen == nil {
|
|
t.Fatalf("expected request to be captured")
|
|
}
|
|
if seen.Header.Get("X-Lark-MCP-TAT") != "tat-token" {
|
|
t.Fatalf("expected bot token header, got %q", seen.Header.Get("X-Lark-MCP-TAT"))
|
|
}
|
|
if seen.Header.Get("X-Lark-MCP-Allowed-Tools") != "fetch-doc" {
|
|
t.Fatalf("expected allowed tools header, got %q", seen.Header.Get("X-Lark-MCP-Allowed-Tools"))
|
|
}
|
|
}
|
|
|
|
func TestNormalizeMCPToolResult(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
raw interface{}
|
|
wantKey string
|
|
wantVal interface{}
|
|
wantErr string
|
|
}{
|
|
{
|
|
name: "map result",
|
|
raw: map[string]interface{}{"ok": true},
|
|
wantKey: "ok",
|
|
wantVal: true,
|
|
},
|
|
{
|
|
name: "text result",
|
|
raw: "plain text",
|
|
wantKey: "message",
|
|
wantVal: "plain text",
|
|
},
|
|
{
|
|
name: "scalar result",
|
|
raw: 42,
|
|
wantKey: "result",
|
|
wantVal: 42,
|
|
},
|
|
{
|
|
name: "map error field",
|
|
raw: map[string]interface{}{"error": "permission denied"},
|
|
wantErr: "MCP: permission denied",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
got, err := normalizeMCPToolResult(tt.raw)
|
|
if tt.wantErr != "" {
|
|
if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
|
|
t.Fatalf("expected error containing %q, got %v", tt.wantErr, err)
|
|
}
|
|
return
|
|
}
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if got[tt.wantKey] != tt.wantVal {
|
|
t.Fatalf("unexpected result: %#v", got)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractMCPResult(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
jsonResult := ExtractMCPResult(map[string]interface{}{
|
|
"content": []interface{}{
|
|
map[string]interface{}{
|
|
"type": "text",
|
|
"text": `{"doc_id":"doc_1"}`,
|
|
},
|
|
},
|
|
})
|
|
resultMap, ok := jsonResult.(map[string]interface{})
|
|
if !ok || resultMap["doc_id"] != "doc_1" {
|
|
t.Fatalf("unexpected parsed json result: %#v", jsonResult)
|
|
}
|
|
|
|
textResult := ExtractMCPResult(map[string]interface{}{
|
|
"content": []interface{}{
|
|
map[string]interface{}{"type": "text", "text": "line1"},
|
|
map[string]interface{}{"type": "text", "text": "line2"},
|
|
},
|
|
})
|
|
if textResult != "line1\nline2" {
|
|
t.Fatalf("unexpected text result: %#v", textResult)
|
|
}
|
|
}
|