Skip to content

feat: use accounts v3 for OAuth token requests - #2276

Open
albertnusouo wants to merge 3 commits into
mainfrom
feat/unified-token-endpoint
Open

feat: use accounts v3 for OAuth token requests#2276
albertnusouo wants to merge 3 commits into
mainfrom
feat/unified-token-endpoint

Conversation

@albertnusouo

@albertnusouo albertnusouo commented Aug 10, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

OAuth user-token flows still used the legacy Open Platform token endpoint for device-code polling and refresh. This PR routes those requests to the brand-specific Accounts v3 token endpoint and encodes refresh requests as form data, aligning token acquisition with the unified OAuth endpoint contract.

Changes

  • Update ResolveOAuthEndpoints in internal/auth/device_flow.go to use the Feishu or Lark Accounts origin with /oauth/v3/token
  • Serialize refresh-token requests in internal/auth/uat_client.go as application/x-www-form-urlencoded
  • Preserve the existing refresh lock, retry, CAS, and stored-token disposition behavior
  • Update endpoint and request-shape tests, refresh auth-login stubs, and remove the unused PathOAuthTokenV2 constant

Test Plan

  • make unit-test passed
  • validate passed (build, vet, unit tests, and integration tests)
  • local-eval skipped: sandbox credentials were not configured in this environment (E2E not run; skillave N/A)
  • acceptance-reviewer skipped: the local-eval prerequisite was unavailable
  • manual verification: go test ./internal/auth ./internal/core ./internal/credential ./internal/cmdutil
  • manual verification: git diff --check origin/main...HEAD

Related Issues

N/A

Summary by CodeRabbit

  • Bug Fixes
    • Updated OAuth authentication flows to use the V3 token endpoint.
    • Improved UAT token refresh compatibility by sending URL-encoded form data.
    • Updated authentication validation to reflect the new token and refresh request formats.

@github-actions github-actions Bot added the size/L Large or sensitive change across domains or core paths label Aug 10, 2026
@coderabbitai

coderabbitai Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3e322a44-9e48-4733-92b2-60744ff5ea02

📥 Commits

Reviewing files that changed from the base of the PR and between 8419534 and 50e0370.

📒 Files selected for processing (6)
  • cmd/auth/login_test.go
  • internal/auth/device_flow.go
  • internal/auth/device_flow_test.go
  • internal/auth/paths.go
  • internal/auth/uat_client.go
  • internal/auth/uat_client_refresh_test.go
💤 Files with no reviewable changes (1)
  • internal/auth/paths.go
📝 Walkthrough

Walkthrough

Authentication now uses OAuth token V3 endpoints for device flow. UAT token refresh requests now use URL-encoded form data instead of JSON. Tests validate both protocol changes.

Changes

OAuth endpoint migration

Layer / File(s) Summary
OAuth token V3 resolution and coverage
internal/auth/paths.go, internal/auth/device_flow.go, internal/auth/device_flow_test.go, cmd/auth/login_test.go		 Device-flow token resolution and authentication mocks now use OAuth token V3 paths. The legacy V2 path constant was removed. Feishu and Lark endpoint expectations were updated.

UAT refresh request encoding

Layer / File(s) Summary
Form-encoded refresh requests
internal/auth/uat_client.go, internal/auth/uat_client_refresh_test.go		 UAT refresh requests now send application/x-www-form-urlencoded data. Tests parse and validate the encoded grant type, refresh token, client ID, and client secret.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the primary change to use Accounts v3 for OAuth token requests.
Description check ✅ Passed The description covers the required summary, changes, test plan, and related issues with clear verification details and skip reasons.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/unified-token-endpoint

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Quality Summary

CI did not complete successfully. Use the failed check links below to decide whether this PR needs a code change or a rerun.

Failed checks

@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@50e03702b79a7711dcb871ff1eeff210ac99c199

🧩 Skill update

npx skills add larksuite/cli#feat/unified-token-endpoint -y -g

@codecov

codecov Bot commented Aug 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.44%. Comparing base (8419534) to head (50e0370).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #2276   +/-   ##
=======================================
  Coverage   76.44%   76.44%           
=======================================
  Files        1013     1013           
  Lines      111932   111925    -7     
=======================================
- Hits        85561    85560    -1     
+ Misses      19860    19855    -5     
+ Partials     6511     6510    -1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@liangshuo-1 liangshuo-1 Awaiting requested review from liangshuo-1 liangshuo-1 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

feature size/L Large or sensitive change across domains or core paths

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@albertnusouo