credential

type Account ¶

type Account struct {
	AppID               string
	AppSecret           string   // real app secret; empty or NoAppSecret means unavailable
	Brand               Brand    // BrandLark or BrandFeishu
	DefaultAs           Identity // IdentityUser / IdentityBot / IdentityAuto; empty = not set
	ProfileName         string
	OpenID              string          // optional; if UAT is available, API result takes precedence
	SupportedIdentities IdentitySupport // zero = provider did not declare; treat as no restriction
}

Account holds resolved app credentials and configuration.

type BlockError ¶

type BlockError struct {
	Provider string
	Reason   string
}

BlockError is returned by a Provider to actively reject a request and prevent subsequent providers in the chain from being consulted.

func (e *BlockError) Error() string

type Brand ¶

type Brand string

Brand represents the Lark platform brand.

const (
	BrandLark   Brand = "lark"
	BrandFeishu Brand = "feishu"
)

type Identity ¶

type Identity string

Identity represents the caller identity type.

const (
	IdentityUser Identity = "user"
	IdentityBot  Identity = "bot"
	IdentityAuto Identity = "auto"
)

type IdentitySupport ¶

type IdentitySupport uint8

IdentitySupport declares which identities a credential source can provide.

const (
	SupportsUser IdentitySupport = 1 << iota
	SupportsBot
	SupportsAll = SupportsUser | SupportsBot
)

func (s IdentitySupport) BotOnly() bool

func (s IdentitySupport) Has(flag IdentitySupport) bool

func (s IdentitySupport) UserOnly() bool

type Provider ¶

type Provider interface {
	Name() string
	ResolveAccount(ctx context.Context) (*Account, error)
	ResolveToken(ctx context.Context, req TokenSpec) (*Token, error)
}

Provider is the unified interface for credential resolution.

Flow control uses Go's native mechanisms:

• Handle: return &Account{...}, nil or return &Token{...}, nil
• Skip: return nil, nil
• Block: return nil, &BlockError{...}

func Providers() []Provider

type Token ¶

type Token struct {
	Value  string
	Scopes string // space-separated; empty = skip scope pre-check
	Source string // e.g. "env:LARKSUITE_CLI_USER_ACCESS_TOKEN", "vault:addr"
}

Token holds a resolved access token and optional metadata.

type TokenSpec ¶

type TokenSpec struct {
	Type  TokenType
	AppID string
}

TokenSpec describes what token is needed.

type TokenType ¶

type TokenType string

TokenType represents the kind of access token.

const (
	TokenTypeUAT TokenType = "uat"
	TokenTypeTAT TokenType = "tat"
)