fix: validate base shortcut JSON object inputs

[kongenpei]

Summary

Tighten base shortcut JSON validation so commands that require JSON objects fail early with actionable CLI errors instead of deferring malformed payloads to dry-run or API passthrough.

Changes

• Validate object-only JSON payloads for base field, record, and view setter shortcuts before execution.
• Clarify JSON input hints to point users and AI agents to @file.json, the command reference, and the lark-base skill.
• Extend shortcut and execution tests to cover invalid array payloads and the wrapped object payloads used by view group/sort setters.

Test Plan

• Unit tests pass
• Manual local verification confirms the lark xxx command works as expected
• make unit-test
• go mod tidy (no changes to go.mod or go.sum)
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main

Related Issues

• None

Summary by CodeRabbit

• Bug Fixes

  • Commands for record operations (search, upsert, batch create/update) and view commands now validate --json input earlier and reject non-object inputs with clear errors
  • View-related commands (group, sort, visible fields, timebar) enforce object-shaped JSON where appropriate

• Documentation

  • Improved error guidance: clearer tips on passing valid JSON, using a file, and referencing the skill/command reference

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dbe52299-48ee-4063-be7d-2769c82519d4

📥 Commits

Reviewing files that changed from the base of the PR and between 70a423b and fb25ba2.

📒 Files selected for processing (2)

• shortcuts/base/helpers.go
• shortcuts/base/helpers_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• shortcuts/base/helpers.go
• shortcuts/base/helpers_test.go

---

📝 Walkthrough

Walkthrough

Adds pre-execution JSON validation to multiple base shortcuts by introducing Validate hooks and tightening JSON parsing/error messages so that --json inputs are enforced to be the expected object/array shapes before DryRun/Execute.

Changes

Cohort / File(s)	Summary
Validation Hook Additions shortcuts/base/record_batch_create.go, shortcuts/base/record_batch_update.go, shortcuts/base/record_search.go, shortcuts/base/record_upsert.go, shortcuts/base/view_set_visible_fields.go	Added Validate hooks that call validateRecordJSON or validateViewJSONObject, performing pre-execution JSON validation for --json.
Validation Logic & Parsers shortcuts/base/helpers.go, shortcuts/base/record_ops.go, shortcuts/base/view_ops.go, shortcuts/base/field_ops.go	parseJSONObject now distinguishes syntax vs. semantic errors and returns errors for nil/invalid values; validateRecordJSON, validateViewCreate, and validateViewJSONObject now parse and return errors instead of no-ops; removed unused helper.
Shortcut Validate Hook Updates shortcuts/base/view_set_group.go, shortcuts/base/view_set_sort.go	Updated Validate callbacks to call validateViewJSONObject (object-required validation) instead of the previous value validator.
User Tip / Error Text shortcuts/base/base_shortcut_helpers.go	Refined jsonInputTip text to recommend passing valid JSON or using @file.json and referencing lark-base/command docs.
Tests: expectations & new cases shortcuts/base/base_execute_test.go, shortcuts/base/base_shortcuts_test.go, shortcuts/base/helpers_test.go	Added table-driven tests rejecting array-shaped --json in dry-run; updated many tests to expect non-nil Validate hooks and to match new error substrings (e.g., --json must be a JSON object) and revised tip text.

Sequence Diagram

sequenceDiagram
    participant User
    participant CLI as Shortcut Framework
    participant Shortcut as Base Shortcut
    participant Validator as Validate Hook
    participant Parser as parseJSONObject
    participant Formatter as Error Formatter

    User->>CLI: run command with --json
    CLI->>Shortcut: initialize runtime, invoke Shortcut
    Shortcut->>Validator: Validate(ctx, runtime)
    Validator->>Parser: parseJSONObject(runtime.Str("json"), "json")
    alt parsed object ok
        Parser-->>Validator: parsed object
        Validator-->>Shortcut: nil (validation passed)
        Shortcut->>CLI: proceed to DryRun/Execute
    else syntax error
        Parser-->>Formatter: formatJSONError / tip
        Formatter-->>Validator: error
        Validator-->>CLI: return validation error
        CLI-->>User: surface error (e.g., "--json must be a JSON object" + tip)
    else non-object (null/array)
        Parser-->>Formatter: common.FlagErrorf("--json must be a JSON object"...)
        Formatter-->>Validator: error
        Validator-->>CLI: return validation error
        CLI-->>User: surface error with tip
    end

Loading

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

• refactor: migrate base shortcuts to FileIO #347 — Related: modifies JSON parsing helpers and parseCtx usage similar to these changes.
• feat(base): add +record-search for keyword-based record search #328 — Related: adds/changes Validate hooks and record search/upsert validation logic overlapping these files.
• fix(base): unify --json help format with tips and agent hints #372 — Related: also adjusted BaseView JSON payload shapes and JSON input guidance for view shortcuts.

Suggested Reviewers

• zgz2048
• fangshuyu-768

Poem

🐰 Hopping through inputs with careful zest,
Objects not arrays — we check them best.
Errors now point where the answer lies,
Lark-base tips guide curious eyes.
Shortcuts pre-flight — safe hops, no surprise. ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: validating JSON object inputs in base shortcuts to enforce stricter input checking.
Description check	✅ Passed	The description follows the template structure, includes a clear summary, lists main changes, provides a test plan with verification steps, and marks tests as completed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/base-json-object-validation

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

kongenpei has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@fb25ba2eb20424a6b398ce098eb27810c8833cf6

🧩 Skill update

npx skills add larksuite/cli#codex/base-json-object-validation -y -g

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

shortcuts/base/helpers.go (1)

33-47: ⚠️ Potential issue | 🟠 Major

null bypasses object-only validation in parseJSONObject.

At line 46, the function returns success when the payload is JSON null, since json.Unmarshal treats null as valid input for map[string]interface{} (returning nil error and a nil map). This allows non-object input through validation and can cause downstream issues.

Add an explicit nil check after successful parsing:

Proposed fix

 func parseJSONObject(pc *parseCtx, raw string, flagName string) (map[string]interface{}, error) {
 	resolved, err := loadJSONInput(pc, raw, flagName)
 	if err != nil {
 		return nil, err
 	}
 	var result map[string]interface{}
 	if err := common.ParseJSON([]byte(resolved), &result); err != nil {
 		var syntaxErr *json.SyntaxError
 		if errors.As(err, &syntaxErr) {
 			return nil, formatJSONError(flagName, "object", err)
 		}
 		return nil, common.FlagErrorf("--%s must be a JSON object; %s", flagName, jsonInputTip(flagName))
 	}
+	if result == nil {
+		return nil, common.FlagErrorf("--%s must be a JSON object; %s", flagName, jsonInputTip(flagName))
+	}
 	return result, nil
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@shortcuts/base/helpers.go` around lines 33 - 47, parseJSONObject currently
accepts JSON "null" because common.ParseJSON succeeds but yields a nil map;
after calling common.ParseJSON in parseJSONObject (the block that assigns to var
result map[string]interface{}), add an explicit nil check (if result == nil) and
return the same flag-style error used for non-object inputs (e.g. return nil,
common.FlagErrorf("--%s must be a JSON object; %s", flagName,
jsonInputTip(flagName))). This keeps existing syntax error handling
(formatJSONError) intact and ensures only real JSON objects are accepted.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@shortcuts/base/helpers.go`:
- Around line 33-47: parseJSONObject currently accepts JSON "null" because
common.ParseJSON succeeds but yields a nil map; after calling common.ParseJSON
in parseJSONObject (the block that assigns to var result
map[string]interface{}), add an explicit nil check (if result == nil) and return
the same flag-style error used for non-object inputs (e.g. return nil,
common.FlagErrorf("--%s must be a JSON object; %s", flagName,
jsonInputTip(flagName))). This keeps existing syntax error handling
(formatJSONError) intact and ensures only real JSON objects are accepted.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 25258953-69da-4368-ab79-f1243e3dfd30

📥 Commits

Reviewing files that changed from the base of the PR and between 7fdc162 and 70a423b.

📒 Files selected for processing (15)

• shortcuts/base/base_execute_test.go
• shortcuts/base/base_shortcut_helpers.go
• shortcuts/base/base_shortcuts_test.go
• shortcuts/base/field_ops.go
• shortcuts/base/helpers.go
• shortcuts/base/helpers_test.go
• shortcuts/base/record_batch_create.go
• shortcuts/base/record_batch_update.go
• shortcuts/base/record_ops.go
• shortcuts/base/record_search.go
• shortcuts/base/record_upsert.go
• shortcuts/base/view_ops.go
• shortcuts/base/view_set_group.go
• shortcuts/base/view_set_sort.go
• shortcuts/base/view_set_visible_fields.go

[greptile-apps]

kongenpei has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.