feat/revoke token

[JackZhao10086]

Summary

Improve the auth logout flow by revoking stored OAuth tokens before clearing local auth state, while keeping logout output clean even when token revocation fails. This makes logout behavior more complete without surfacing non-blocking revoke warnings to users.

Changes

• Add OAuth token revocation support to auth logout before removing local stored tokens and clearing logged-in users from config
• Add a dedicated revoke helper and extend OAuth endpoint resolution with the revoke endpoint
• Fall back to revoking the access token when no refresh token is available
• Keep logout best-effort by continuing local cleanup even if remote token revocation fails
• Stop printing revoke-related warning messages during logout so successful local logout remains clean
• Add unit tests covering revoke request behavior, logout revoke flow, access-token fallback, and revoke-failure cleanup behavior

Test Plan

• Unit tests pass
• Manual local verification confirms the lark-cli auth logout flow works as expected

Related Issues

• None

Summary by CodeRabbit

• New Features

  • Logout now attempts server-side token revocation (prefers refresh tokens, falls back to access tokens) and still clears local credentials even if revocation fails.
  • Added support for an OAuth revoke endpoint and robust handling/parsing of revoke responses, including retryable and typed error mapping.

• Tests

  • Added comprehensive tests covering revoke requests, response parsing, network/error mappings, and logout behavior (success, fallback, and failure).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a0ec29b3-f165-4c4f-b9c8-82722e1ae042

📥 Commits

Reviewing files that changed from the base of the PR and between 13808ea and 019582b.

📒 Files selected for processing (3)

• internal/auth/device_flow_test.go
• internal/auth/revoke.go
• internal/auth/revoke_test.go

💤 Files with no reviewable changes (1)

• internal/auth/revoke_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• internal/auth/revoke.go

---

📝 Walkthrough

Walkthrough

Adds OAuth token revocation: a revoke path constant and endpoint resolution, a RevokeToken HTTP implementation with error parsing and tests, and integration into authLogoutRun with tests for success, fallback, and revoke failures.

Changes

OAuth Token Revocation in Logout

Layer / File(s)	Summary
Revoke endpoint path and configuration internal/auth/paths.go, internal/auth/device_flow.go, internal/auth/device_flow_test.go	Adds PathOAuthRevoke and OAuthEndpoints.Revoke, populated by ResolveOAuthEndpoints; tests assert resolved revoke URL for Feishu and Lark.
RevokeToken implementation and tests internal/auth/revoke.go, internal/auth/revoke_test.go	Implements RevokeToken that POSTs form-encoded client_id, client_secret, token, optional token_type_hint to the revoke endpoint, reads/parses response, and returns typed errors for HTTP >= 400. Tests cover transport failures, form contents, error-body parsing, and response-read failures.
Logout command revocation integration cmd/auth/logout.go, cmd/auth/logout_test.go	authLogoutRun initializes an HTTP client and resolves app secret once, then for each user prefers revoking the refresh token (falls back to access token) via RevokeToken before removing local tokens; tests cover successful revoke, access-token fallback, and server-error resilience.

sequenceDiagram
  participant User
  participant authLogoutRun
  participant RevokeToken
  participant HTTPClient
  participant OAuthServer

  User->>authLogoutRun: logout()
  authLogoutRun->>authLogoutRun: init HTTP client, resolve app secret
  loop per user
    alt refresh token present
      authLogoutRun->>RevokeToken: revoke(refresh_token, hint=refresh_token)
    else access token present
      authLogoutRun->>RevokeToken: revoke(access_token, hint=access_token)
    else
      authLogoutRun->>authLogoutRun: skip revoke
    end
    RevokeToken->>HTTPClient: POST /oauth/v1/revoke (form)
    HTTPClient->>OAuthServer: send request
    OAuthServer-->>HTTPClient: status + body
    authLogoutRun->>LocalStore: RemoveStoredToken
  end
  authLogoutRun-->>User: "Logged out"

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

Suggested reviewers

• liangshuo-1
• albertnusouo
• XingjianSun

🐰 I hopped through code both near and far,
Revoked the tokens, set them ajar,
Tried refresh then access, one by one,
Cleared local crumbs when the work was done,
A carrot-cheer for logout — hop and run!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat/revoke token' is concise and directly related to the main change—adding OAuth token revocation support to the auth logout flow.
Description check	✅ Passed	The description includes a clear summary, comprehensive list of changes, test plan status, and related issues section, aligning well with the required template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/revoke_token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/auth/revoke.go`:
- Around line 29-48: Wrap all plain error returns in the revoke path with the
repository's typed errors and preserve causes: for transport failures from
http.NewRequest and httpClient.Do return
errs.NewNetworkError(errs.SubtypeNetworkTransport, "token revoke transport
error").WithCause(err); for io.ReadAll and other non-transport failures return
an appropriate typed internal error (e.g. errs.NewInternalError("token revoke
read error")).WithCause(err); and for HTTP error responses (after
logHTTPResponse and formatOAuthErrorBody) return a typed API/validation/internal
error instead of fmt.Errorf while preserving the original body/error as the
cause; update the returns around http.NewRequest, httpClient.Do, io.ReadAll and
the resp.StatusCode >= 400 branch accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7978a337-6774-4938-9c26-62abbae91b9e

📥 Commits

Reviewing files that changed from the base of the PR and between 465c789 and c183a23.

📒 Files selected for processing (7)

• cmd/auth/logout.go
• cmd/auth/logout_test.go
• internal/auth/device_flow.go
• internal/auth/device_flow_test.go
• internal/auth/paths.go
• internal/auth/revoke.go
• internal/auth/revoke_test.go

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@019582b8efb4ae8ea3b778594c29f786ff286755

🧩 Skill update

npx skills add larksuite/cli#feat/revoke_token -y -g

[codecov]

Codecov Report

❌ Patch coverage is 63.21839% with 32 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.86%. Comparing base (465c789) to head (019582b).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/auth/revoke.go	57.33%	18 Missing and 14 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1434      +/-   ##
==========================================
- Coverage   72.87%   72.86%   -0.01%     
==========================================
  Files         732      738       +6     
  Lines       69181    69535     +354     
==========================================
+ Hits        50413    50666     +253     
- Misses      14986    15055      +69     
- Partials     3782     3814      +32     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/auth/revoke_test.go`:
- Around line 130-139: The test currently only checks ProblemOf category/code
and message substrings; update the failure-case assertions to also verify typed
metadata and cause preservation by asserting p.Subtype == errs.SubtypeUnknown
(use errs.SubtypeUnknown) and that the original error is wrapped (e.g.,
errors.Unwrap(err) != nil or using errors.Is/As to inspect the cause). Add the
same Subtype and wrapped-cause assertions to the other revoke tests mentioned
(the other error-path blocks that call errs.ProblemOf) so the typed-error
contract is fully asserted.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 02fd9487-13d3-47a2-b0aa-c0869ad867bd

📥 Commits

Reviewing files that changed from the base of the PR and between 44a314f and 13808ea.

📒 Files selected for processing (2)

• internal/auth/revoke.go
• internal/auth/revoke_test.go