mirror of
https://github.com/larksuite/cli.git
synced 2026-09-14 18:42:53 +08:00
kiraWangRuilong
7a6a4dbdf5
* fix: preserve credential and config read failures Report corrupt or inaccessible stored credentials as typed errors instead of treating them as missing. Preserve config load failures across auth diagnostics and keep trusted request metadata available when host signal collection is unavailable. Fixes #1925 * fix(auth): attach re-authorization recovery to corrupt stored token errors A stored token that fails to decode or fails semantic validation is now reported as internal/storage but carried no recovery hint, so `api --as user`, `auth check`, `auth status`, and `doctor` all ended in a dead end. A new login overwrites the damaged entry, so attach the canonical user-authorization recovery on the two read-side corruption branches. The write-side validator stays hint-free: a rejected write leaves nothing on disk to re-authorize. `auth status` keeps the storage failure in `note` and appends the recovery instead of replacing it. Tests pin the hint on GetStoredToken, GetValidAccessToken, identitydiag (including reduced-distribution projection when auth login is concealed), auth check, and auth status, and pin that SetStoredToken replaces a corrupt entry. ---------
29 lines
794 B
Go
29 lines
794 B
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package cmdutil
|
|
|
|
import (
|
|
"github.com/larksuite/cli/internal/core"
|
|
"github.com/larksuite/cli/internal/riskcontrol"
|
|
)
|
|
|
|
type workspaceConfigSource interface {
|
|
MultiAppConfig() (*core.MultiAppConfig, error)
|
|
}
|
|
|
|
// resolveSDKHostSignalSource applies workspace policy at the SDK transport
|
|
// boundary.
|
|
func resolveSDKHostSignalSource(config workspaceConfigSource) riskcontrol.Source {
|
|
if config == nil {
|
|
return nil
|
|
}
|
|
workspace, configErr := config.MultiAppConfig()
|
|
// Only an explicit opt-out in a successfully loaded config suppresses
|
|
// collection. A load failure falls through to default-on.
|
|
if configErr == nil && !workspace.RiskControlEnabled() {
|
|
return nil
|
|
}
|
|
return riskcontrol.NewHostSource()
|
|
}
|