feat(drive): add +public-permission-update shortcut#1593
Open
zhaojiaxing-coding wants to merge 1 commit into
Open
feat(drive): add +public-permission-update shortcut#1593zhaojiaxing-coding wants to merge 1 commit into
zhaojiaxing-coding wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughAdds a new drive shortcut for updating public permissions, with token/type resolution, permission-field validation, shortcut registration, tests, and drive guidance updates. ChangesDrive public permission update
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
domain/ccm
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1593 +/- ##
==========================================
+ Coverage 74.72% 74.76% +0.04%
==========================================
Files 799 800 +1
Lines 80274 80518 +244
==========================================
+ Hits 59983 60200 +217
- Misses 15846 15862 +16
- Partials 4445 4456 +11 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@6fbd0d08e3565a7e464d9f616d1e82b82b2161a7🧩 Skill updatenpx skills add larksuite/cli#feat/open_rest_create_permission_member_support_single_page -y -g |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@shortcuts/drive/drive_public_permission_test.go`:
- Around line 258-260: The confirmation-error check in the drive permission test
is only matching the error string, so it should be updated to assert the typed
error contract instead. In the test around the err check, use
errs.ProblemOf(err) and/or errors.As to verify the error is a
*errs.ConfirmationRequiredError, and assert the expected metadata fields
(category, subtype, param) and cause preservation rather than relying on the
"requires confirmation" message substring.
In `@shortcuts/drive/drive_public_permission.go`:
- Around line 149-160: The URL parsing flow in drive_public_permission.go is
accepting any host as long as the path matches, which can misclassify
unsupported domains as valid document targets. In the URL handling branch that
uses url.Parse and parseDrivePublicPermissionURLPath, add host validation for
the public-permission shortcut so only https URLs with supported Feishu/Lark
host suffixes are accepted; otherwise return a validation error and require
unknown hosts to be provided as bare tokens with --type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ae913c35-6bc1-4046-a208-bfce76270e7c
📒 Files selected for processing (7)
shortcuts/drive/drive_public_permission.goshortcuts/drive/drive_public_permission_test.goshortcuts/drive/shortcuts.goshortcuts/drive/shortcuts_test.goskills/lark-drive/SKILL.mdskills/lark-drive/references/lark-drive-public-permission-update.mdtests/cli_e2e/drive/drive_public_permission_dryrun_test.go
Comment on lines
+258
to
+260
| if err == nil || !strings.Contains(err.Error(), "requires confirmation") { | ||
| t.Fatalf("expected confirmation error, got: %v", err) | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the typed confirmation error, not just the message.
This would pass if the high-risk path regressed to an untyped string error. Use errs.ProblemOf(err) and/or errors.As for *errs.ConfirmationRequiredError so the test locks the metadata contract. As per coding guidelines, “Error-path tests must assert typed metadata via errs.ProblemOf (category / subtype / param) and cause preservation, not message substrings alone.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@shortcuts/drive/drive_public_permission_test.go` around lines 258 - 260, The
confirmation-error check in the drive permission test is only matching the error
string, so it should be updated to assert the typed error contract instead. In
the test around the err check, use errs.ProblemOf(err) and/or errors.As to
verify the error is a *errs.ConfirmationRequiredError, and assert the expected
metadata fields (category, subtype, param) and cause preservation rather than
relying on the "requires confirmation" message substring.
Source: Coding guidelines
Comment on lines
+149
to
+160
| if strings.Contains(raw, "://") { | ||
| parsed, parseErr := url.Parse(raw) | ||
| if parseErr != nil { | ||
| return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, | ||
| "invalid URL %q: %v", | ||
| raw, | ||
| parseErr, | ||
| ).WithParam("--token").WithCause(parseErr) | ||
| } | ||
| var urlType string | ||
| var ok bool | ||
| token, urlType, ok = parseDrivePublicPermissionURLPath(parsed.Path) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Reject unsupported URL hosts before inferring a high-risk target.
This currently accepts any URL with a supported path shape, so https://not-lark.example/docx/<valid-token> is treated as a Lark document URL and can drive a public-permission update. For this high-risk shortcut, validate https plus supported Feishu/Lark host suffixes, or require unknown hosts to be passed as bare tokens with --type.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@shortcuts/drive/drive_public_permission.go` around lines 149 - 160, The URL
parsing flow in drive_public_permission.go is accepting any host as long as the
path matches, which can misclassify unsupported domains as valid document
targets. In the URL handling branch that uses url.Parse and
parseDrivePublicPermissionURLPath, add host validation for the public-permission
shortcut so only https URLs with supported Feishu/Lark host suffixes are
accepted; otherwise return a validation error and require unknown hosts to be
provided as bare tokens with --type.
Add drive +public-permission-update for high-risk Drive public permission updates. The shortcut keeps request bodies flat, validates target and field combinations before API calls, and documents safer agent usage for public access changes. Key features: - Add URL and bare-token target handling for Drive public permission updates - Validate single-page and external/link-share field combinations with typed errors - Cover shortcut behavior with unit tests and dry-run E2E coverage - Document shortcut-first skill guidance with safe default examples
zhaojiaxing-coding
force-pushed
the
feat/open_rest_create_permission_member_support_single_page
branch
from
e5a0c25 to
6fbd0d0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add drive +public-permission-update for high-risk Drive public permission updates. The shortcut keeps request bodies flat, validates target and field combinations before API calls, and documents safer agent usage for public access changes.
Key features:
Add URL and bare-token target handling for Drive public permission updates
Validate single-page and external/link-share field combinations with typed errors
Cover shortcut behavior with unit tests and dry-run E2E coverage
Document shortcut-first skill guidance with safe default examples
Summary
Changes
Test Plan
lark-cli <domain> <command>flow works as expectedRelated Issues
Summary by CodeRabbit
New Features
drive +public-permission-updateshortcut to update Drive public permission settings (supports token or URL targets).--dry-runpreviews, and requires confirmation for high-risk writes; supports--perm-type.Bug Fixes
--type, supported--perm-type single_pagefield combinations, and compatibility rules between link-sharing and external-access entities.Documentation
Tests