.#2031
Closed
liangshuo-1 wants to merge 1 commit into
Closed
Conversation
github-actions
Bot
added
the
size/L
📝 WalkthroughWalkthroughAdds configurable workspace risk-control policy, cached credential/config provenance, host OS and product-model signal collection, and SDK transport enforcement for restricted headers on eligible official HTTPS OpenAPI requests. ChangesRisk-control signal flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CLI
participant Factory
participant CredentialProvider
participant RiskControlTransport
participant LarkAPI
CLI->>Factory: Create invocation configuration
Factory->>CredentialProvider: Resolve account and provenance
CredentialProvider-->>Factory: Workspace-managed status
Factory->>RiskControlTransport: Configure SDK transport policy
RiskControlTransport->>LarkAPI: Eligible request with trusted signals
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2031 +/- ##
=======================================
Coverage 75.13% 75.13%
=======================================
Files 905 905
Lines 96135 96135
=======================================
Hits 72229 72229
Misses 18348 18348
Partials 5558 5558 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
liangshuo-1
marked this pull request as ready for review
July 24, 2026 04:08
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@1353303d4806ae1cf8f9a6fe6f13abae42890668🧩 Skill updatenpx skills add larksuite/cli#feat/workspace-sdk-risk-protection -y -g |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/config/risk_control.go`:
- Around line 36-40: Update the RunE configuration-loading error path around
core.LoadOrNotConfigured to preserve already typed errors while wrapping raw
failures in the established typed internal/storage error and attaching the
original error with WithCause(err); continue returning successful configuration
results unchanged.
In `@internal/core/config.go`:
- Around line 69-73: Add adjacent unit coverage for
MultiAppConfig.RiskControlEnabled, directly asserting true when RiskControl is
omitted, true when explicitly enabled, and false when explicitly disabled. Keep
the existing explicit-false round-trip test, but ensure the resolver itself is
exercised for all three states.
In `@internal/credential/credential_provider.go`:
- Around line 263-275: Update the token-resolution flow around ResolveAccount so
every read of p.resolution.tokenSource, including the existing fast path, occurs
after participating in accountOnce or under the same synchronization protecting
resolution writes. Preserve the defaultAcct nil behavior and return the resolved
token source or existing error when initialization completes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a0211d66-767a-4021-8556-dc81e41b2a81
📒 Files selected for processing (32)
README.mdREADME.zh.mdcmd/config/config.gocmd/config/risk_control.gocmd/config/risk_control_test.gointernal/cmdutil/factory_default.gointernal/cmdutil/factory_proxy_warn_test.gointernal/cmdutil/factory_risk_control_test.gointernal/cmdutil/risk_control.gointernal/cmdutil/risk_control_route_sidecar_test.gointernal/cmdutil/risk_control_test.gointernal/cmdutil/secheader_test.gointernal/cmdutil/transport_test.gointernal/core/config.gointernal/core/config_snapshot.gointernal/core/config_snapshot_test.gointernal/core/config_test.gointernal/credential/credential_provider.gointernal/credential/credential_provider_test.gointernal/credential/default_provider.gointernal/credential/integration_test.gointernal/riskcontrol/host.gointernal/riskcontrol/host_darwin.gointernal/riskcontrol/host_darwin_test.gointernal/riskcontrol/host_linux.gointernal/riskcontrol/host_linux_test.gointernal/riskcontrol/host_other.gointernal/riskcontrol/host_test.gointernal/riskcontrol/host_windows.gointernal/riskcontrol/host_windows_test.gointernal/riskcontrol/transport.gointernal/riskcontrol/transport_test.go
Comment on lines
+36
to
+40
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| config, err := core.LoadOrNotConfigured() | ||
| if err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Return a typed error for configuration-load failures.
Returning err directly can bypass the command error-envelope contract. Pass through already typed errors; wrap raw load failures with a typed internal/storage error and .WithCause(err).
Proposed fix
config, err := core.LoadOrNotConfigured()
if err != nil {
- return err
+ if _, ok := errs.ProblemOf(err); ok {
+ return err
+ }
+ return errs.NewInternalError(errs.SubtypeStorage,
+ "failed to load risk-control policy: %v", err).WithCause(err)
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| RunE: func(cmd *cobra.Command, args []string) error { | |
| config, err := core.LoadOrNotConfigured() | |
| if err != nil { | |
| return err | |
| } | |
| RunE: func(cmd *cobra.Command, args []string) error { | |
| config, err := core.LoadOrNotConfigured() | |
| if err != nil { | |
| if _, ok := errs.ProblemOf(err); ok { | |
| return err | |
| } | |
| return errs.NewInternalError(errs.SubtypeStorage, | |
| "failed to load risk-control policy: %v", err).WithCause(err) | |
| } |
🧰 Tools
🪛 GitHub Check: codecov/patch
[warning] 39-39: cmd/config/risk_control.go#L39
Added line #L39 was not covered by tests
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/config/risk_control.go` around lines 36 - 40, Update the RunE
configuration-loading error path around core.LoadOrNotConfigured to preserve
already typed errors while wrapping raw failures in the established typed
internal/storage error and attaching the original error with WithCause(err);
continue returning successful configuration results unchanged.
Sources: Coding guidelines, Learnings
Comment on lines
+69
to
+73
| // RiskControlEnabled resolves the workspace policy. An omitted preference | ||
| // keeps the default-on account-protection behavior. | ||
| func (m *MultiAppConfig) RiskControlEnabled() bool { | ||
| return m != nil && (m.RiskControl == nil || *m.RiskControl) | ||
| } |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Test the default-on resolver directly.
The round-trip test only verifies explicit false; it never calls RiskControlEnabled(). Cover omitted, explicit true, and explicit false so the default-on protection contract cannot regress unnoticed. Based on coding guidelines, “Every behavior change must include an adjacent test.”
🧰 Tools
🪛 GitHub Check: codecov/patch
[warning] 71-72: internal/core/config.go#L71-L72
Added lines #L71 - L72 were not covered by tests
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@internal/core/config.go` around lines 69 - 73, Add adjacent unit coverage for
MultiAppConfig.RiskControlEnabled, directly asserting true when RiskControl is
omitted, true when explicitly enabled, and false when explicitly disabled. Keep
the existing explicit-false round-trip test, but ensure the resolver itself is
exercised for all three states.
Sources: Coding guidelines, Linters/SAST tools
Comment on lines
+263
to
+275
| if p.resolution.tokenSource != nil { | ||
| return p.resolution.tokenSource, nil | ||
| } | ||
| if p.defaultAcct == nil { | ||
| return nil, nil | ||
| } | ||
| if _, err := p.ResolveAccount(ctx); err != nil { | ||
| return nil, err | ||
| } | ||
| if p.selectedSource == nil { | ||
| if p.resolution.tokenSource == nil { | ||
| return nil, fmt.Errorf("credential provider resolved an account without selecting a token source") | ||
| } | ||
| return p.selectedSource, nil | ||
| return p.resolution.tokenSource, nil |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Synchronize the resolution fast path.
This reads p.resolution.tokenSource before participating in accountOnce, while ResolveAccount writes the full resolution inside that sync.Once. Concurrent account and token resolution can therefore race, potentially observing a partially initialized token source. Resolve through ResolveAccount before reading the cached resolution, or guard all resolution reads/writes with a mutex.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@internal/credential/credential_provider.go` around lines 263 - 275, Update
the token-resolution flow around ResolveAccount so every read of
p.resolution.tokenSource, including the existing fast path, occurs after
participating in accountOnce or under the same synchronization protecting
resolution writes. Preserve the defaultAcct nil behavior and return the resolved
token source or existing error when initialization completes.
liangshuo-1
force-pushed
the
feat/workspace-sdk-risk-protection
branch
from
July 24, 2026 08:59
1e16cba to
3fce3ec
Compare
github-actions
Bot
added
domain/base
liangshuo-1
force-pushed
the
feat/workspace-sdk-risk-protection
branch
from
July 24, 2026 08:59
3fce3ec to
d644b3e
Compare
github-actions
Bot
added
size/L
liangshuo-1
force-pushed
the
feat/workspace-sdk-risk-protection
branch
from
July 24, 2026 09:03
d644b3e to
1353303
Compare
github-actions
Bot
added
size/M
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.