fix(calendar): support bot identity in +search-event

[FnExpress]

Summary

calendar +search-event rejects bot identity during local shortcut validation, even though the underlying Search Event API and the generated calendar events search_event command support bot access. This prevents agents from locating events in calendars accessible to the application, including events created and managed by the application itself.

Official API: https://open.larkoffice.com/document/server-docs/calendar-v4/calendar-event/search

Evidence

The generated command schema advertises both identities:

{
  "access_tokens": ["bot", "user"]
}

Before this change, the shortcut fails before making an API request:

$ lark-cli calendar +search-event --as bot --query "application-owned test event"
--as bot is not supported, this command only supports: user

The generated command succeeds with the same bot identity and returns an event created in the application's primary calendar:

$ lark-cli calendar events search_event --as bot --calendar-id primary \
    --data '{"query":"application-owned test event"}'
# success: the application-owned event is returned

After changing the shortcut identity declaration, a locally built CLI successfully finds the same event through calendar +search-event --as bot.

This isolates the failure to the shortcut's local AuthTypes declaration rather than the Open Platform API or application permissions.

Scope and permission boundary

This change does not expand calendar visibility. User identity continues to search calendars accessible to the user; bot identity searches only calendars accessible to the application. Bot identity does not automatically gain access to users' personal calendars.

Changes

• Allow calendar +search-event to run with user or bot identity.
• Clarify the identity-specific visibility boundary in the calendar Skill.
• Add a bot dry-run E2E contract test.
• Add a self-contained live E2E workflow: create an event as bot, find it with +search-event, then clean it up.
• Refresh the Calendar E2E command inventory and coverage metrics.

Test Plan

• make unit-test
• go vet ./...
• gofmt -l . produces no output
• go mod tidy produces no go.mod / go.sum changes
• golangci-lint --new-from-rev=origin/main reports 0 issues
• Bot dry-run E2E passes
• Manual live verification: bot creates an event; generated search finds it; patched shortcut finds the same event
• Live E2E automation requires tenant test credentials and was skipped locally; the self-contained workflow is included for CI

Related Issues

• None

Summary by CodeRabbit

• New Features

  • Calendar event search now supports bot authentication in addition to user authentication.
  • Bot-based searches are scoped to calendars accessible by the application.

• Documentation

  • Clarified how search scope differs between user and bot authentication.

• Tests

  • Added end-to-end coverage for bot-authenticated event search, including dry runs and complete workflows.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f874f690-1ccf-4f7f-abb3-0fc620d3f944

📥 Commits

Reviewing files that changed from the base of the PR and between 8ba910e and b45cbfe.

📒 Files selected for processing (4)

• shortcuts/calendar/calendar_search_event.go
• skills/lark-calendar/SKILL.md
• tests/cli_e2e/calendar/calendar_search_event_workflow_test.go
• tests/cli_e2e/calendar/coverage.md

---

📝 Walkthrough

Walkthrough

Calendar event search now supports bot authentication. Documentation clarifies user and bot calendar access scopes, while end-to-end tests cover bot request generation and searching for a newly created event.

Changes

Calendar search bot support

Layer / File(s)	Summary
Bot authentication and identity scope shortcuts/calendar/calendar_search_event.go, skills/lark-calendar/SKILL.md	CalendarSearchEvent accepts both user and bot authentication, and the documentation describes their calendar access scopes.
Bot search workflow validation tests/cli_e2e/calendar/calendar_search_event_workflow_test.go, tests/cli_e2e/calendar/coverage.md	End-to-end tests validate bot dry-run request details and eventual event search results, with updated calendar coverage metrics and command entries.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant E2ETest
  participant CLI
  participant CalendarAPI
  E2ETest->>CLI: Create searchable event as bot
  CLI->>CalendarAPI: Create event
  CalendarAPI-->>CLI: Return event_id
  E2ETest->>CLI: Run +search-event as bot
  CLI->>CalendarAPI: Search events
  CalendarAPI-->>CLI: Return matching event_id
  E2ETest->>CLI: Delete event during cleanup
  CLI->>CalendarAPI: Delete event

Loading

Possibly related PRs

• larksuite/cli#2011: Updates the same calendar search shortcut to support bot authentication with related documentation and end-to-end coverage.

Suggested reviewers: liangshuo-1

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}