mirror of
https://github.com/larksuite/cli.git
synced 2026-07-03 14:02:43 +08:00
Every failure on the authentication, authorization, and configuration
path now surfaces as a typed structured error instead of an ad-hoc
envelope. Users and scripts that consume CLI output get:
- a fixed nine-category taxonomy on the wire, each mapped to a
stable shell exit code (authentication/authorization/config = 3,
network = 4, internal = 5, policy = 6, confirmation = 10)
- identity-aware detail fields (missing_scopes, requested_scopes,
granted_scopes, console_url, log_id, retryable, hint) carried
uniformly on the envelope
- a single canonical policy envelope at exit 6; the legacy
auth_error carve-out is retired
- per-subtype canonical message + hint that preserves Lark's
diagnostic phrasing and routes recovery to the right actor:
app developer (app_scope_not_applied), user (missing_scope,
token_scope_insufficient, user_unauthorized), or tenant admin
(app_unavailable, app_disabled)
- wrong app credentials classify as config/invalid_client whether
surfaced by the Open API endpoint (99991543) or the tenant
access-token mint endpoint (10003 / 10014), instead of
collapsing to a transport error or api/unknown
- local shortcut scope preflight emits the same
authorization/missing_scope envelope (identity + deterministic
missing-scope set) used by the post-call permission path, so AI
consumers read the same structured shape from precheck and from
server-returned permission denial
- streaming download/upload failures keep the same network subtype
split (timeout / TLS / DNS / transport) as the non-stream path
instead of collapsing every cause to a generic transport failure
- console_url is carried only on the bot-perspective
app_scope_not_applied envelope (where the recovery action is
"developer applies the scope at the developer console"); the
user-perspective missing_scope envelope drops the field, since
the only actionable user recovery is `lark-cli auth login --scope`
and pointing an end user at a console they cannot modify is
misleading
- bind workflows (Hermes / OpenClaw / lark-channel) flatten dynamic
Type tags to wire 'config' with the original module name kept
as a metric label
All 10 typed errors are cause-bearing, nil-safe on .Error() and
.Unwrap(), and defensively clone slice setter inputs. Four lint
rules (CheckNilSafeError / CheckBuilderImmutable / CheckUnwrapSymmetry
/ CheckBuildAPIErrorArms) lock these invariants on migrated paths.
98 lines
3.4 KiB
Go
98 lines
3.4 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package errs
|
|
|
|
import (
|
|
"errors"
|
|
)
|
|
|
|
// ProblemOf extracts the embedded Problem via the non-exported problemCarrier interface.
|
|
// This is the supported way to read shared fields without depending on a specific typed error.
|
|
//
|
|
// A typed error whose embedded *Problem is nil is treated as "not a problem
|
|
// carrier" — returning (nil, true) here would cause CategoryOf / IsRetryable
|
|
// and other downstream readers to dereference nil.
|
|
func ProblemOf(err error) (*Problem, bool) {
|
|
var c problemCarrier
|
|
if errors.As(err, &c) {
|
|
if p := c.ProblemDetail(); p != nil {
|
|
return p, true
|
|
}
|
|
}
|
|
return nil, false
|
|
}
|
|
|
|
// UnwrapTypedError walks the wrap chain and returns the first error that
|
|
// embeds Problem (i.e. any typed error in this package). Returns the typed
|
|
// error itself (as error) so callers — notably JSON marshaling — see the
|
|
// concrete value's own struct tags rather than an opaque wrapper.
|
|
func UnwrapTypedError(err error) (error, bool) {
|
|
var c problemCarrier
|
|
if errors.As(err, &c) {
|
|
if e, ok := c.(error); ok {
|
|
return e, true
|
|
}
|
|
}
|
|
return nil, false
|
|
}
|
|
|
|
// CategoryOf returns the error's Category for metrics/logging/dispatch routing.
|
|
// Falls back to CategoryInternal for non-typed errors.
|
|
func CategoryOf(err error) Category {
|
|
if p, ok := ProblemOf(err); ok {
|
|
return p.Category
|
|
}
|
|
return CategoryInternal
|
|
}
|
|
|
|
// IsRetryable reads Problem.Retryable; non-typed errors are non-retryable by default.
|
|
func IsRetryable(err error) bool {
|
|
if p, ok := ProblemOf(err); ok {
|
|
return p.Retryable
|
|
}
|
|
return false
|
|
}
|
|
|
|
// IsValidation reports whether err is a *ValidationError.
|
|
func IsValidation(err error) bool { var x *ValidationError; return errors.As(err, &x) }
|
|
|
|
// IsPermission reports whether err is a *PermissionError.
|
|
func IsPermission(err error) bool { var x *PermissionError; return errors.As(err, &x) }
|
|
|
|
// IsNetwork reports whether err is a *NetworkError.
|
|
func IsNetwork(err error) bool { var x *NetworkError; return errors.As(err, &x) }
|
|
|
|
// IsAPI reports whether err is an *APIError.
|
|
func IsAPI(err error) bool { var x *APIError; return errors.As(err, &x) }
|
|
|
|
// IsSecurityPolicy reports whether err is a *SecurityPolicyError.
|
|
func IsSecurityPolicy(err error) bool { var x *SecurityPolicyError; return errors.As(err, &x) }
|
|
|
|
// IsContentSafety reports whether err is a *ContentSafetyError.
|
|
func IsContentSafety(err error) bool { var x *ContentSafetyError; return errors.As(err, &x) }
|
|
|
|
// IsInternal reports whether err is an *InternalError.
|
|
func IsInternal(err error) bool { var x *InternalError; return errors.As(err, &x) }
|
|
|
|
// IsConfirmationRequired reports whether err is a *ConfirmationRequiredError.
|
|
func IsConfirmationRequired(err error) bool {
|
|
var x *ConfirmationRequiredError
|
|
return errors.As(err, &x)
|
|
}
|
|
|
|
// IsAuthentication reports whether err is an *AuthenticationError.
|
|
func IsAuthentication(err error) bool { var x *AuthenticationError; return errors.As(err, &x) }
|
|
|
|
// IsConfig reports whether err is a *ConfigError.
|
|
func IsConfig(err error) bool { var x *ConfigError; return errors.As(err, &x) }
|
|
|
|
// IsTyped reports whether err is or wraps any of the typed *errs.* errors
|
|
// in this package (i.e. implements the TypedError interface). Used by call
|
|
// sites that need to pass already-classified errors through unchanged
|
|
// instead of blanket-rewrapping them as a different category.
|
|
func IsTyped(err error) bool {
|
|
var t TypedError
|
|
return errors.As(err, &t)
|
|
}
|