bug: auth check --scope "" bypasses required flag validation and returns ok: true

[crw9527]

Summary

lark-cli auth check --scope "" bypasses MarkFlagRequired (which only prevents omitting the flag entirely) and returns {"ok": true} with exit code 0, as if all scopes were granted. This can silently mislead scripts into thinking a scope check passed when nothing was actually checked.

Location

cmd/auth/check.go:47-51

required := strings.Fields(opts.Scope)
if len(required) == 0 {
    output.PrintJson(f.IOStreams.Out, map[string]interface{}{"ok": true, "granted": []string{}, "missing": []string{}})
    return nil  // exit 0 — misleading
}

Reproduction

lark-cli auth check --scope ""
# Output: {"ok":true,"granted":[],"missing":[]}
# Exit code: 0

Impact

Scripts that build the scope string dynamically can silently pass an empty value:

REQUIRED_SCOPE=""
lark-cli auth check --scope "$REQUIRED_SCOPE"
# Exits 0, script proceeds thinking scopes are fine

Suggested Fix

Return a validation error when the resolved scope list is empty:

required := strings.Fields(opts.Scope)
if len(required) == 0 {
    return output.ErrValidation("--scope cannot be empty")
}