- 
+ 
@@ -28,6 +28,7 @@
- [Why dws?](#why-dws)
- [Installation](#installation)
+- [Upgrade](#upgrade)
- [Getting Started](#getting-started)
- [Quick Start](#quick-start)
- [Using with Agents](#using-with-agents)
@@ -65,6 +66,12 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma
- 
-
- 
+ 
- 
+ 
@@ -28,6 +28,7 @@
- [为什么选择 dws？](#why-dws)
- [安装](#安装)
+- [升级](#升级)
- [开始使用](#开始使用)
- [快速开始](#快速开始)
- [在 Agent 中使用](#在-agent-中使用)
@@ -65,6 +66,12 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma
-
-
-
+
-
+
请返回终端继续操作。此页面可以关闭。
+ 请返回终端继续操作。此页面可以关闭。
+
+
+ 你所选择的组织管理员尚未开启
「允许成员通过 CLI
+ 访问其个人数据」的权限。
+
正在处理授权，请稍候...
`) + return + } + + // Case 3: No code but we have a processed token - show cached page + if code == "" && hasToken { + callbackTokenMu.Unlock() + w.Header().Set("Content-Type", "text/html; charset=utf-8") + if processedAuthDisabled { + _, _ = fmt.Fprint(w, notEnabledHTML) + } else { + _, _ = fmt.Fprint(w, successHTML) + } + return + } + + // Case 4: New code - mark as in-progress and process + if code != "" { + callbackCodeInProgress = code + } + callbackTokenMu.Unlock() + if code == "" { select { case errCh <- errors.New(i18n.T("回调中未收到授权码")): @@ -118,24 +201,151 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro _, _ = fmt.Fprint(w, i18n.T("授权失败：未收到授权码")) return } - // Write response FIRST before notifying main goroutine - // This prevents race condition where server.Shutdown is called - // before response is fully sent + + // Exchange code for token + tokenData, exchangeErr := p.exchangeCode(ctx, code) + if exchangeErr != nil { + // Clear in-progress state on error + callbackTokenMu.Lock() + if callbackCodeInProgress == code { + callbackCodeInProgress = "" + } + callbackTokenMu.Unlock() + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + _, _ = fmt.Fprintf(w, "%s
", exchangeErr.Error()) + select { + case resultCh <- callbackResult{err: exchangeErr}: + default: + } + return + } + + // Mark as processed immediately after successful exchange + callbackTokenMu.Lock() + previouslyProcessed := callbackProcessedCode != "" + callbackToken = tokenData + callbackProcessedCode = code // Remember this code was successfully processed + callbackCodeInProgress = "" // Clear in-progress state + // Reset apply state for new authorization (user switched org) + if previouslyProcessed { + callbackApplySent = false + callbackSelectedAdminId = "" + } + callbackTokenMu.Unlock() + + // Check CLI auth enabled status (fail-closed: treat errors as disabled) + authStatus, statusErr := p.CheckCLIAuthEnabled(ctx, tokenData.AccessToken) + cliAuthEnabled := statusErr == nil && authStatus.Success && authStatus.Result.CLIAuthEnabled + + // Update CLI auth disabled state + callbackTokenMu.Lock() + callbackAuthDisabled = !cliAuthEnabled + callbackTokenMu.Unlock() + + // Display appropriate HTML based on CLI auth status w.Header().Set("Content-Type", "text/html; charset=utf-8") - _, _ = fmt.Fprint(w, successHTML) + if !cliAuthEnabled { + _, _ = fmt.Fprint(w, notEnabledHTML) + } else { + _, _ = fmt.Fprint(w, successHTML) + } // Ensure response is flushed to client if f, ok := w.(http.Flusher); ok { f.Flush() } - // Now notify main goroutine (non-blocking) + // Notify main goroutine with full result select { - case codeCh <- code: - // Success + case resultCh <- callbackResult{token: tokenData, cliAuthDisabled: !cliAuthEnabled}: default: - // Select already exited (timeout/cancel); code discarded but response already sent } }) + // API endpoint: get super admins + mux.HandleFunc("/api/superAdmin", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + callbackTokenMu.Lock() + token := callbackToken + callbackTokenMu.Unlock() + if token == nil { + _, _ = w.Write([]byte(`{"success":false,"errorMsg":"授权尚未完成"}`)) + return + } + result, err := GetSuperAdmins(ctx, token.AccessToken) + if err != nil { + _, _ = fmt.Fprintf(w, `{"success":false,"errorMsg":"%s"}`, err.Error()) + return + } + data, _ := json.Marshal(result) + _, _ = w.Write(data) + }) + + // API endpoint: send CLI auth apply + mux.HandleFunc("/api/sendApply", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + adminStaffID := r.URL.Query().Get("adminStaffId") + if adminStaffID == "" { + _, _ = w.Write([]byte(`{"success":false,"errorMsg":"缺少 adminStaffId 参数"}`)) + return + } + callbackTokenMu.Lock() + token := callbackToken + callbackTokenMu.Unlock() + if token == nil { + _, _ = w.Write([]byte(`{"success":false,"errorMsg":"授权尚未完成"}`)) + return + } + result, err := SendCliAuthApply(ctx, token.AccessToken, adminStaffID) + if err != nil { + _, _ = fmt.Fprintf(w, `{"success":false,"errorMsg":"%s"}`, err.Error()) + return + } + // Mark apply as sent and save selected admin on success + if result.Success && result.Result { + callbackTokenMu.Lock() + callbackApplySent = true + callbackSelectedAdminId = adminStaffID + callbackTokenMu.Unlock() + } + data, _ := json.Marshal(result) + _, _ = w.Write(data) + }) + + // API endpoint: get current status (clientId, applySent, selectedAdminId) + mux.HandleFunc("/api/status", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + callbackTokenMu.Lock() + applySent := callbackApplySent + selectedAdminId := callbackSelectedAdminId + callbackTokenMu.Unlock() + _, _ = fmt.Fprintf(w, `{"clientId":"%s","applySent":%t,"selectedAdminId":"%s"}`, p.clientID, applySent, selectedAdminId) + }) + + // API endpoint: check CLI auth enabled status + mux.HandleFunc("/api/cliAuthEnabled", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + callbackTokenMu.Lock() + token := callbackToken + callbackTokenMu.Unlock() + if token == nil { + _, _ = w.Write([]byte(`{"success":false,"errorMsg":"授权尚未完成"}`)) + return + } + result, err := p.CheckCLIAuthEnabled(ctx, token.AccessToken) + if err != nil { + _, _ = fmt.Fprintf(w, `{"success":false,"errorMsg":"%s"}`, err.Error()) + return + } + data, _ := json.Marshal(result) + _, _ = w.Write(data) + }) + + // Success page endpoint + mux.HandleFunc("/success", func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + _, _ = fmt.Fprint(w, successHTML) + }) + server := &http.Server{Handler: mux} go func() { if serveErr := server.Serve(listener); !errors.Is(serveErr, http.ErrServerClosed) { @@ -169,9 +379,9 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro timeout := time.NewTimer(5 * time.Minute) defer timeout.Stop() - var authCode string + var result callbackResult select { - case authCode = <-codeCh: + case result = <-resultCh: case err := <-errCh: return nil, err case <-timeout.C: @@ -180,11 +390,73 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro return nil, ctx.Err() } - tokenData, err := p.exchangeCode(ctx, authCode) - if err != nil { - return nil, fmt.Errorf("%s: %w", i18n.T("换取 token 失败"), err) + // Handle callback errors + if result.err != nil { + return nil, fmt.Errorf("%s: %w", i18n.T("换取 token 失败"), result.err) } + // Handle CLI auth disabled - keep server running for user to apply + if result.cliAuthDisabled { + _, _ = fmt.Fprintln(p.output(), "") + _, _ = fmt.Fprintln(p.output(), i18n.T("⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...")) + + // Poll for CLI auth status while waiting + applyTimeout := time.NewTimer(10 * time.Minute) + defer applyTimeout.Stop() + pollTicker := time.NewTicker(5 * time.Second) + defer pollTicker.Stop() + + elapsedSeconds := 0 + for { + select { + case <-applyTimeout.C: + return nil, errors.New(i18n.T("操作超时，请重新登录")) + case <-ctx.Done(): + return nil, ctx.Err() + case <-pollTicker.C: + elapsedSeconds += 5 + + // Get latest token and state (user may have switched org) + callbackTokenMu.Lock() + currentToken := callbackToken + currentAuthDisabled := callbackAuthDisabled + applySent := callbackApplySent + callbackTokenMu.Unlock() + + // Check if user switched to an org with CLI auth enabled + if currentToken != nil && !currentAuthDisabled { + _, _ = fmt.Fprintf(p.output(), "\r%s\n", i18n.T("✅ 权限已开启，继续登录...")) + time.Sleep(2 * time.Second) + result.token = currentToken + result.cliAuthDisabled = false + goto continueLogin + } + + // Check if CLI auth is now enabled (admin approved) + if currentToken != nil { + authStatus, err := p.CheckCLIAuthEnabled(ctx, currentToken.AccessToken) + if err == nil && authStatus.Success && authStatus.Result.CLIAuthEnabled { + _, _ = fmt.Fprintf(p.output(), "\r%s\n", i18n.T("✅ 权限已开启，继续登录...")) + time.Sleep(2 * time.Second) + result.token = currentToken + result.cliAuthDisabled = false + goto continueLogin + } + } + + // Show polling status based on apply state + if applySent { + _, _ = fmt.Fprintf(p.output(), "\r⏳ %s (%ds/600s) ", i18n.T("等待管理员审批中"), elapsedSeconds) + } else { + _, _ = fmt.Fprintf(p.output(), "\r⏳ %s (%ds/600s) ", i18n.T("等待提交申请中"), elapsedSeconds) + } + } + } + } + +continueLogin: + tokenData := result.token + // Save token data with associated client ID for refresh tokenData.ClientID = p.clientID if err := SaveTokenData(p.configDir, tokenData); err != nil { diff --git a/internal/auth/secure_store.go b/internal/auth/secure_store.go index addecc33..89af75ab 100644 --- a/internal/auth/secure_store.go +++ b/internal/auth/secure_store.go @@ -21,8 +21,8 @@ import ( "path/filepath" "sync" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/security" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" ) const secureDataFile = ".data" diff --git a/internal/auth/token.go b/internal/auth/token.go index 644eb638..4b7f9472 100644 --- a/internal/auth/token.go +++ b/internal/auth/token.go @@ -14,7 +14,9 @@ package auth import ( + "bytes" "context" + "encoding/json" "fmt" "net/http" "net/url" @@ -103,10 +105,16 @@ func DeleteTokenData(configDir string) error { return legacyErr } -// RevokeTokenRemote calls the DingTalk logout endpoint to invalidate the access token. +// RevokeTokenRemote calls the appropriate logout/revoke endpoint to invalidate the access token. +// Uses MCP revoke endpoint when clientID is from MCP, otherwise uses DingTalk logout. // This should be called before deleting local token data. // The function is best-effort: errors are returned but callers may choose to ignore them. func RevokeTokenRemote(ctx context.Context) error { + // Use MCP revoke endpoint when clientID is from MCP + if IsClientIDFromMCP() { + return revokeTokenViaMCP(ctx) + } + // Direct mode: use DingTalk logout endpoint logoutURL, err := url.Parse(LogoutURL) if err != nil { return fmt.Errorf("parsing logout URL: %w", err) @@ -143,3 +151,45 @@ func RevokeTokenRemote(ctx context.Context) error { return nil } + +// revokeTokenViaMCP revokes token via MCP endpoint. +func revokeTokenViaMCP(ctx context.Context) error { + revokeURL := GetRevokeTokenURL() + if revokeURL == "" { + return nil // No revoke endpoint available + } + + // Load current token to get accessToken + tokenData, err := LoadTokenData(getDefaultConfigDir()) + if err != nil || tokenData == nil { + return nil // No token to revoke + } + + body := map[string]string{ + "clientId": ClientID(), + "accessToken": tokenData.AccessToken, + } + bodyBytes, err := json.Marshal(body) + if err != nil { + return fmt.Errorf("marshaling revoke request: %w", err) + } + + req, err := http.NewRequestWithContext(ctx, http.MethodPost, revokeURL, bytes.NewReader(bodyBytes)) + if err != nil { + return fmt.Errorf("creating revoke request: %w", err) + } + req.Header.Set("Content-Type", "application/json") + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + if err != nil { + return fmt.Errorf("calling revoke endpoint: %w", err) + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("revoke endpoint returned status %d", resp.StatusCode) + } + + return nil +} diff --git a/internal/cli/canonical.go b/internal/cli/canonical.go index 01e1fc41..60caea9b 100644 --- a/internal/cli/canonical.go +++ b/internal/cli/canonical.go @@ -25,12 +25,12 @@ import ( "strings" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/convert" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/ir" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/convert" "github.com/spf13/cobra" ) diff --git a/internal/cli/loader.go b/internal/cli/loader.go index c05439b8..085a3c78 100644 --- a/internal/cli/loader.go +++ b/internal/cli/loader.go @@ -22,11 +22,11 @@ import ( "time" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/discovery" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/ir" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" ) const ( diff --git a/internal/compat/registry.go b/internal/compat/registry.go index cf6a40e7..3d47da67 100644 --- a/internal/compat/registry.go +++ b/internal/compat/registry.go @@ -26,10 +26,10 @@ import ( "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/convert" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/convert" "github.com/spf13/cobra" ) diff --git a/internal/errors/errors.go b/internal/errors/errors.go index 9ba0a6a0..38e90ac2 100644 --- a/internal/errors/errors.go +++ b/internal/errors/errors.go @@ -253,6 +253,12 @@ func PrintJSON(w io.Writer, err error) error { } if typed.ServerDiag.ServerErrorCode != "" { errorPayload["server_error_code"] = typed.ServerDiag.ServerErrorCode + // Add user-friendly hint for specific server error codes + switch typed.ServerDiag.ServerErrorCode { + case "TOKEN_VERIFIED_FAILED", "CLI_ORG_NOT_AUTHORIZED": + errorPayload["friendly_hint"] = "该组织尚未开启 CLI 数据访问权限，请联系组织主管理员开启。" + errorPayload["action_url"] = "https://open-dev.dingtalk.com/fe/old#/developerSettings" + } } if typed.ServerDiag.TechnicalDetail != "" { errorPayload["technical_detail"] = typed.ServerDiag.TechnicalDetail @@ -312,6 +318,14 @@ func PrintHumanAt(w io.Writer, err error, v Verbosity) error { if typed.Hint != "" { lines = append(lines, fmt.Sprintf("Hint: %s", typed.Hint)) } + + // Add user-friendly hint for specific server error codes + switch typed.ServerDiag.ServerErrorCode { + case "TOKEN_VERIFIED_FAILED", "CLI_ORG_NOT_AUTHORIZED": + lines = append(lines, "Hint: 该组织尚未开启 CLI 数据访问权限，请联系组织主管理员开启。") + lines = append(lines, "Action: 开启地址: https://open-dev.dingtalk.com/fe/old#/developerSettings") + } + if len(typed.Actions) > 0 { for _, action := range typed.Actions { if strings.TrimSpace(action) == "" { diff --git a/internal/helpers/aitable.go b/internal/helpers/aitable.go index 0489bc54..c315037d 100644 --- a/internal/helpers/aitable.go +++ b/internal/helpers/aitable.go @@ -26,9 +26,9 @@ import ( "time" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" "github.com/spf13/cobra" ) diff --git a/internal/helpers/todo.go b/internal/helpers/todo.go index d42d5e25..5d578e40 100644 --- a/internal/helpers/todo.go +++ b/internal/helpers/todo.go @@ -14,15 +14,14 @@ package helpers import ( - "fmt" "strconv" "strings" - "time" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil" "github.com/spf13/cobra" ) @@ -88,7 +87,7 @@ func newTodoTaskCreateCommand(runner executor.Runner) *cobra.Command { Args: cobra.NoArgs, DisableAutoGenTag: true, RunE: func(cmd *cobra.Command, args []string) error { - title := flagOrFallback(cmd, "title", "subject", "content") + title := cmdutil.FlagOrFallback(cmd, "title", "subject", "content") if strings.TrimSpace(title) == "" { return apperrors.NewValidation("--title is required") } @@ -103,7 +102,7 @@ func newTodoTaskCreateCommand(runner executor.Runner) *cobra.Command { "executorIds": executorIds, } if v, _ := cmd.Flags().GetString("due"); v != "" { - ms, err := parseISOTimeToMillis("due", v) + ms, err := cmdutil.ParseISOTimeToMillis("due", v) if err != nil { return err } @@ -270,7 +269,7 @@ func newTodoTaskUpdateCommand(runner executor.Runner) *cobra.Command { inner["subject"] = v } if v, _ := cmd.Flags().GetString("due"); v != "" { - ms, err := parseISOTimeToMillis("due", v) + ms, err := cmdutil.ParseISOTimeToMillis("due", v) if err != nil { return err } @@ -444,16 +443,6 @@ func newTodoTaskDeleteCommand(runner executor.Runner) *cobra.Command { // ── helpers ──────────────────────────────────────────────── -// flagOrFallback returns the first non-empty value among the given flag names. -func flagOrFallback(cmd *cobra.Command, names ...string) string { - for _, name := range names { - if v, _ := cmd.Flags().GetString(name); strings.TrimSpace(v) != "" { - return v - } - } - return "" -} - // parseExecutorIds splits "id1,id2" into []string for the MCP executorIds array. func parseExecutorIds(s string) []string { s = strings.TrimSpace(s) @@ -470,25 +459,6 @@ func parseExecutorIds(s string) []string { return ids } -// parseISOTimeToMillis parses an ISO-8601 datetime string and returns Unix -// milliseconds. It supports timezone offsets (e.g. +08:00) and UTC "Z" suffix. -func parseISOTimeToMillis(flagName, value string) (int64, error) { - formats := []string{ - time.RFC3339, - "2006-01-02T15:04:05Z07:00", - "2006-01-02T15:04:05", - "2006-01-02 15:04:05", - } - for _, layout := range formats { - if t, err := time.Parse(layout, value); err == nil { - return t.UnixMilli(), nil - } - } - return 0, apperrors.NewValidation( - fmt.Sprintf("--%s format error, use ISO-8601 e.g. 2026-03-10T18:00:00+08:00", flagName), - ) -} - // ── list pagination helpers ──────────────────────────────── func normalizePage(raw string) string { diff --git a/internal/i18n/locales/en.json b/internal/i18n/locales/en.json index 916f03ce..bfd36759 100644 --- a/internal/i18n/locales/en.json +++ b/internal/i18n/locales/en.json @@ -155,5 +155,20 @@ "返回数据缺少 uploadUrl 或 fileToken": "Response data missing uploadUrl or fileToken", "附件工作流": "Attachment workflow", "页码 (必填)": "page number (required)", + "⚠️ 无法检查 CLI 数据访问权限状态": "⚠️ Unable to verify CLI data access permission status", + " 请检查网络连接后重试。": " Please check your network connection and retry.", + "检查 CLI 授权状态失败": "Failed to check CLI auth status", + "⚠️ 该组织尚未开启 CLI 数据访问权限": "⚠️ CLI data access is not enabled for this organization", + " 你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。": " The organization admin has not enabled \"Allow members to access their personal data via CLI\".", + " 组织主管理员：": " Organization super admins: ", + " 请联系组织主管理员开启后重新登录。": " Please contact the organization super admin to enable it and re-login.", + " 管理员操作入口：https://open-dev.dingtalk.com/fe/old#/developerSettings": " Admin settings: https://open-dev.dingtalk.com/fe/old#/developerSettings", + "该组织尚未开启 CLI 数据访问权限，请联系管理员开启": "CLI data access is not enabled for this organization, please contact admin to enable it", + "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...": "⏳ CLI data access is not enabled for this organization, please submit an authorization request in the browser...", + "✅ 权限已开启，继续登录...": "✅ Permission enabled, continuing login...", + "等待管理员审批中": "Waiting for admin approval", + "等待提交申请中": "Waiting to submit request", + "操作超时，请重新登录": "Operation timed out, please re-login", + "检查组织 CLI 授权状态...": "Checking organization CLI auth status...", "🔐 登录钉钉": "🔐 Login to DingTalk" } diff --git a/internal/i18n/locales/zh.json b/internal/i18n/locales/zh.json index 2a029280..dbfe9e9b 100644 --- a/internal/i18n/locales/zh.json +++ b/internal/i18n/locales/zh.json @@ -155,5 +155,20 @@ "返回数据缺少 uploadUrl 或 fileToken": "返回数据缺少 uploadUrl 或 fileToken", "附件工作流": "附件工作流", "页码 (必填)": "页码 (必填)", + "⚠️ 无法检查 CLI 数据访问权限状态": "⚠️ 无法检查 CLI 数据访问权限状态", + " 请检查网络连接后重试。": " 请检查网络连接后重试。", + "检查 CLI 授权状态失败": "检查 CLI 授权状态失败", + "⚠️ 该组织尚未开启 CLI 数据访问权限": "⚠️ 该组织尚未开启 CLI 数据访问权限", + " 你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。": " 你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。", + " 组织主管理员：": " 组织主管理员：", + " 请联系组织主管理员开启后重新登录。": " 请联系组织主管理员开启后重新登录。", + " 管理员操作入口：https://open-dev.dingtalk.com/fe/old#/developerSettings": " 管理员操作入口：https://open-dev.dingtalk.com/fe/old#/developerSettings", + "该组织尚未开启 CLI 数据访问权限，请联系管理员开启": "该组织尚未开启 CLI 数据访问权限，请联系管理员开启", + "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...": "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...", + "✅ 权限已开启，继续登录...": "✅ 权限已开启，继续登录...", + "等待管理员审批中": "等待管理员审批中", + "等待提交申请中": "等待提交申请中", + "操作超时，请重新登录": "操作超时，请重新登录", + "检查组织 CLI 授权状态...": "检查组织 CLI 授权状态...", "🔐 登录钉钉": "🔐 登录钉钉" } diff --git a/internal/logging/logger.go b/internal/logging/logger.go index 3f3dd0a6..a4c5b459 100644 --- a/internal/logging/logger.go +++ b/internal/logging/logger.go @@ -24,7 +24,7 @@ import ( "strconv" "sync" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" ) const ( diff --git a/internal/market/registry.go b/internal/market/registry.go index 070b622e..8b4ab679 100644 --- a/internal/market/registry.go +++ b/internal/market/registry.go @@ -26,8 +26,8 @@ import ( "strings" "time" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" ) const ( diff --git a/internal/output/sanitize.go b/internal/output/sanitize.go index 0d20df5d..95f333dd 100644 --- a/internal/output/sanitize.go +++ b/internal/output/sanitize.go @@ -13,7 +13,7 @@ package output -import "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/validate" +import "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/validate" // SanitizeForTerminal strips ANSI escape sequences, control characters, and // dangerous Unicode from text before it is printed to a terminal. diff --git a/internal/pipeline/handlers/paramname.go b/internal/pipeline/handlers/paramname.go index 1cd4207a..21378917 100644 --- a/internal/pipeline/handlers/paramname.go +++ b/internal/pipeline/handlers/paramname.go @@ -17,6 +17,7 @@ import ( "strings" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil" ) // ParamNameHandler performs fuzzy correction on flag names that are @@ -101,7 +102,7 @@ func tryFuzzyMatch(arg string, known map[string]bool, candidates []string) (stri ambiguous := false for _, candidate := range candidates { - dist := levenshtein(bare, candidate) + dist := cmdutil.LevenshteinDist(bare, candidate) if dist < bestDist { bestDist = dist bestMatch = candidate @@ -117,48 +118,3 @@ func tryFuzzyMatch(arg string, known map[string]bool, candidates []string) (stri return "--" + bestMatch + suffix, true } - -// levenshtein computes the edit distance between two strings using -// the standard dynamic programming approach with O(min(m,n)) space. -func levenshtein(a, b string) int { - if a == b { - return 0 - } - - la, lb := len(a), len(b) - if la == 0 { - return lb - } - if lb == 0 { - return la - } - - // Ensure a is the shorter string for O(min) space. - if la > lb { - a, b = b, a - la, lb = lb, la - } - - prev := make([]int, la+1) - curr := make([]int, la+1) - for i := range prev { - prev[i] = i - } - - for j := 1; j <= lb; j++ { - curr[0] = j - for i := 1; i <= la; i++ { - cost := 1 - if a[i-1] == b[j-1] { - cost = 0 - } - curr[i] = min( - prev[i]+1, // deletion - curr[i-1]+1, // insertion - prev[i-1]+cost, // substitution - ) - } - prev, curr = curr, prev - } - return prev[la] -} diff --git a/internal/pipeline/handlers/paramname_test.go b/internal/pipeline/handlers/paramname_test.go index ef3f6c07..b569b14b 100644 --- a/internal/pipeline/handlers/paramname_test.go +++ b/internal/pipeline/handlers/paramname_test.go @@ -18,6 +18,7 @@ import ( "testing" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil" ) func TestLevenshtein(t *testing.T) { @@ -40,12 +41,11 @@ func TestLevenshtein(t *testing.T) { for _, tt := range tests { t.Run(tt.a+"→"+tt.b, func(t *testing.T) { - got := levenshtein(tt.a, tt.b) + got := cmdutil.LevenshteinDist(tt.a, tt.b) if got != tt.want { - t.Errorf("levenshtein(%q, %q) = %d, want %d", tt.a, tt.b, got, tt.want) + t.Errorf("LevenshteinDist(%q, %q) = %d, want %d", tt.a, tt.b, got, tt.want) } - // Verify symmetry. - gotRev := levenshtein(tt.b, tt.a) + gotRev := cmdutil.LevenshteinDist(tt.b, tt.a) if gotRev != got { t.Errorf("asymmetric: (%q,%q)=%d but (%q,%q)=%d", tt.a, tt.b, got, tt.b, tt.a, gotRev) } diff --git a/internal/security/storage.go b/internal/security/storage.go index 43269e80..bd066720 100644 --- a/internal/security/storage.go +++ b/internal/security/storage.go @@ -20,7 +20,7 @@ import ( "path/filepath" "time" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" ) // DataFileName is the encrypted token data file name. diff --git a/internal/transport/client.go b/internal/transport/client.go index 072434a3..9b566fd7 100644 --- a/internal/transport/client.go +++ b/internal/transport/client.go @@ -30,11 +30,11 @@ import ( "log/slog" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config" apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n" "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging" - "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/validate" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config" + "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/validate" ) const ( diff --git a/internal/upgrade/downloader.go b/internal/upgrade/downloader.go new file mode 100644 index 00000000..38584429 --- /dev/null +++ b/internal/upgrade/downloader.go @@ -0,0 +1,185 @@ +// Copyright 2026 Alibaba Group +// Licensed under the Apache License, Version 2.0 + +package upgrade + +import ( + "context" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "strings" + "time" +) + +// DownloadConfig holds download configuration. +type DownloadConfig struct { + MaxRetries int + Timeout time.Duration + ProgressCallback func(downloaded, total int64) + ProgressInterval time.Duration +} + +// DefaultDownloadConfig returns sensible download defaults. +func DefaultDownloadConfig() *DownloadConfig { + return &DownloadConfig{ + MaxRetries: 3, + Timeout: 10 * time.Minute, + ProgressInterval: 200 * time.Millisecond, + } +} + +// Download fetches url to destPath with default config. +func Download(url, destPath string) (int64, error) { + return DownloadWithConfig(context.Background(), url, destPath, DefaultDownloadConfig()) +} + +// DownloadWithProgress downloads a file and reports progress. +func DownloadWithProgress(ctx context.Context, url, destPath string, showProgress func(percent float64, downloaded, total int64)) (int64, error) { + cfg := DefaultDownloadConfig() + cfg.ProgressCallback = func(downloaded, total int64) { + if showProgress != nil && total > 0 { + percent := float64(downloaded) / float64(total) * 100 + showProgress(percent, downloaded, total) + } + } + return DownloadWithConfig(ctx, url, destPath, cfg) +} + +// DownloadWithConfig fetches a file with custom configuration and retries. +func DownloadWithConfig(ctx context.Context, url, destPath string, cfg *DownloadConfig) (int64, error) { + if err := os.MkdirAll(filepath.Dir(destPath), 0755); err != nil { + return 0, fmt.Errorf("创建目录失败: %w", err) + } + + maxRetries := cfg.MaxRetries + if maxRetries < 1 { + maxRetries = 1 + } + + var lastErr error + for attempt := 0; attempt < maxRetries; attempt++ { + if attempt > 0 { + backoff := time.Second * time.Duration(1<