From 0f5ecb609bb990321bfc5a11bdf068eee8fcb6a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=95=BF=E7=9C=9F?= Date: Fri, 14 Aug 2026 11:38:26 +0800 Subject: [PATCH] fix(cli): restore audit join user guard --- .changes/954-chat-im-id-flags.md | 2 +- internal/cli/param_aliases_generated.go | 3 ++- internal/cli/param_aliases_test.go | 12 ++++++++++++ internal/cli/param_concepts.json | 2 ++ 4 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.changes/954-chat-im-id-flags.md b/.changes/954-chat-im-id-flags.md index a64f4369..ae77c7fa 100644 --- a/.changes/954-chat-im-id-flags.md +++ b/.changes/954-chat-im-id-flags.md @@ -4,4 +4,4 @@ category: Changed - **Chat IM ID flags** (#954) — standardizes chat command entry points on `--conversation-id` for conversation IDs and `--message-id` for message IDs, so help, Schema, and Agent recommendations use the same canonical flags. - **Legacy chat flag compatibility** (#954) — keeps older chat IM ID flags such as `--group`, `--id`, `--chat`, `--open-conversation-id`, `--msg-id`, and `--open-message-id` working as compatibility aliases where applicable, while hiding migrated aliases from recommended help and Schema surfaces. -- **Chat group name flags** (#954) — moves chat commands that accept a group name to the explicit `--group-name` flag, removing the public `--group` ambiguity between group names and conversation IDs on migrated command surfaces. +- **Chat group bots target flag** (#954) — keeps `dws chat group bots` on the visible `--group` flag; this command does not register `--group-name`, and `--group` accepts either an openConversationId or a uniquely resolved group name. diff --git a/internal/cli/param_aliases_generated.go b/internal/cli/param_aliases_generated.go index d1511342..c7c33ae3 100644 --- a/internal/cli/param_aliases_generated.go +++ b/internal/cli/param_aliases_generated.go @@ -974,7 +974,8 @@ var generatedParamAliases = []ParamAliasEntry{ Aliases: map[string]string{ "chat-id": "conversation-id", }, - Blocked: []string{"conversation-ids", "dest-conversation-id", "group-id", "group-ids", "group-name", "name", "open-conversation-ids", "source", "src-conversation-id", "target"}, + Blocked: []string{"conversation-ids", "dest-conversation-id", "group-id", "group-ids", "group-name", "name", "open-conversation-ids", "source", "src-conversation-id", "target"}, + Ambiguous: []string{"staff-id", "uid", "user", "user-id", "userid"}, }, { CLIPath: "chat group bots", diff --git a/internal/cli/param_aliases_test.go b/internal/cli/param_aliases_test.go index 950d6ee5..843738f6 100644 --- a/internal/cli/param_aliases_test.go +++ b/internal/cli/param_aliases_test.go @@ -564,6 +564,18 @@ func TestGeneratedParamAliasesBlockPluralListSpellingsOnSingleIDCommands(t *test } } +func TestGeneratedParamAliasesKeepAuditJoinUserRoleAmbiguous(t *testing.T) { + entry, ok := LookupParamAlias("chat group audit-join-validation") + if !ok { + t.Fatal("missing generated alias entry for chat group audit-join-validation") + } + for _, name := range []string{"user", "user-id", "userid", "uid", "staff-id"} { + if !entry.IsAmbiguous(cmdutil.Morph(name)) { + t.Fatalf("%q not ambiguous; entry = %#v", name, entry) + } + } +} + // TestGeneratedParamAliasesAreWellFormed guards the committed generated table // at the Go level, complementing the byte-identity drift gate. func TestGeneratedParamAliasesAreWellFormed(t *testing.T) { diff --git a/internal/cli/param_concepts.json b/internal/cli/param_concepts.json index fb0fa444..f8297b32 100644 --- a/internal/cli/param_concepts.json +++ b/internal/cli/param_concepts.json @@ -146,6 +146,7 @@ "chat +chat-set-admin": {"block": ["user-id", "open-dingtalk-id"], "note": "The real --users is a mixed userId/openDingTalkId list."}, "chat +messages-read-status": {"block": ["user-id", "open-dingtalk-id"], "note": "The real --users is a mixed userId/openDingTalkId list."}, "chat category create-smart": {"bind": {"members": "open_dingtalk_ids"}, "scoped_aliases": {"title": "name"}, "note": "The real --members is an openDingTalkId list; the reviewed title/name alias is exact to the category display name."}, + "chat group audit-join-validation": {"ambiguous": ["user", "user-id", "userid", "uid", "staff-id"], "note": "A role-free user identifier cannot choose between the required --applicant and --inviter roles."}, "chat message reply": {"block": ["user", "user-id", "userid", "uid", "staff-id"], "note": "The required --ref-sender is a role-specific openDingTalkId and must not accept generic userId spellings."}, "chat message send-card": {"block": ["user", "user-id", "userid", "uid", "staff-id"], "ambiguous": ["chat", "chat-id", "open-conversation-id"], "note": "The real --receiver is a role-specific openDingTalkId and must not accept generic userId spellings. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."}, "chat +category-add-conversation": {"block": ["category-id"], "note": "The real --category-ids is a list; a singular category ID is not promoted automatically."}, @@ -471,6 +472,7 @@ {"command": "chat +flag-create", "emitted": "group", "expect": "conversation-id", "via": "concept:open_conversation_id"}, {"command": "chat +chat-add-bot", "emitted": "conversation-id", "expect": "id", "via": "concept:open_conversation_id+bind"}, {"command": "chat +chat-add-bot", "emitted": "robot", "expect": "robot-code", "via": "concept:robot_code"}, + {"command": "chat group audit-join-validation", "emitted": "user", "expect": "did-you-mean:ambiguous", "via": "guard:applicant-vs-inviter-role"}, {"command": "chat +chat-audit-join", "emitted": "applicant-user-id", "expect": "applicant", "via": "override:scoped-user-role"}, {"command": "chat +chat-audit-join", "emitted": "user-id", "expect": "did-you-mean:ambiguous", "via": "guard:applicant-vs-inviter-role"}, {"command": "chat +chat-create", "emitted": "user-id", "expect": "did-you-mean:blocked", "via": "guard:single-vs-list"},