feat(extension): add business command extension v1

.github/workflows/ci.yml

@@ -45,6 +45,10 @@ jobs:
             echo "::error::Unformatted Go files detected — run 'gofmt -w .' and commit"
             exit 1
           fi
+      - name: Check generated Go files
+        run: |
+          go generate ./shortcuts/sheets/...
+          git diff --exit-code
       - name: Check go.mod tidiness
         run: |
           go mod tidy

cmd/auth/auth.go

@@ -19,20 +19,30 @@
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
 	"github.com/larksuite/cli/internal/recovery"
+	"github.com/larksuite/cli/shortcuts"
+	shortcutcommon "github.com/larksuite/cli/shortcuts/common"
 )
 
 // NewCmdAuth creates the auth command with subcommands.
 func NewCmdAuth(f *cmdutil.Factory) *cobra.Command {
-	return newCmdAuth(f, nil)
+	return newCmdAuth(f, nil, shortcuts.AllShortcuts())
 }
 
 // NewCmdAuthWithRecovery creates the auth command with a build-local recovery
-// presenter while preserving NewCmdAuth's established function signature.
+// presenter, resolving domains from the registered shortcut set. Retained at its
+// established signature: callers outside this module cannot name
+// *recovery.Projector, but they can pass nil for it, so dropping this would
+// break them at compile time.
 func NewCmdAuthWithRecovery(f *cmdutil.Factory, projector *recovery.Projector) *cobra.Command {
-	return newCmdAuth(f, projector)
+	return NewCmdAuthWithRecoveryAndShortcuts(f, projector, shortcuts.AllShortcuts())
 }
 
-func newCmdAuth(f *cmdutil.Factory, projector *recovery.Projector) *cobra.Command {
+// NewCmdAuthWithRecoveryAndShortcuts creates auth commands from one build-local shortcut snapshot.
+func NewCmdAuthWithRecoveryAndShortcuts(f *cmdutil.Factory, projector *recovery.Projector, registered []shortcutcommon.Shortcut) *cobra.Command {
+	return newCmdAuth(f, projector, registered)
+}
+
+func newCmdAuth(f *cmdutil.Factory, projector *recovery.Projector, registered []shortcutcommon.Shortcut) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "auth",
 		Short: "OAuth credentials and authorization management",
@@ -49,7 +59,7 @@
 	}
 	cmdutil.DisableAuthCheck(cmd)
 
-	cmd.AddCommand(NewCmdAuthLogin(f, nil))
+	cmd.AddCommand(newCmdAuthLogin(f, nil, registered))
 	cmd.AddCommand(NewCmdAuthLogout(f, nil))
 	cmd.AddCommand(newCmdAuthStatus(f, nil, projector))
 	cmd.AddCommand(NewCmdAuthScopes(f, nil))

cmd/auth/auth_test.go

@@ -301,7 +301,7 @@ func TestDomainFlagCompletion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			comps := completeDomain(tt.toComplete)
+			comps := builtinResolver().complete(tt.toComplete, "")
 			sort.Strings(comps)
 
 			for _, want := range tt.wantContains {

cmd/auth/login.go

@@ -43,7 +43,16 @@
 
 // NewCmdAuthLogin creates the auth login subcommand.
 func NewCmdAuthLogin(f *cmdutil.Factory, runF func(*LoginOptions) error) *cobra.Command {
+	return newCmdAuthLogin(f, runF, shortcuts.AllShortcuts())
+}
+
+// newCmdAuthLogin resolves domains from one build's shortcut snapshot. The
+// snapshot stays a closure capture rather than a LoginOptions field: LoginOptions
+// is part of the exported runF signature, and an unexported field on it would
+// end positional literals for every caller outside this module.
+func newCmdAuthLogin(f *cmdutil.Factory, runF func(*LoginOptions) error, registered []common.Shortcut) *cobra.Command {
 	opts := &LoginOptions{Factory: f}
+	resolver := newDomainResolver(registered)
 
 	cmd := &cobra.Command{
 		Use:   "login",
@@ -65,7 +74,7 @@
 			if runF != nil {
 				return runF(opts)
 			}
-			return authLoginRun(opts)
+			return authLoginRun(opts, resolver)
 		},
 	}
 	cmdutil.SetSupportedIdentities(cmd, []string{"user"})
@@ -79,7 +88,7 @@
 			helpBrand = cfg.Brand
 		}
 	}
-	available := sortedKnownDomains(helpBrand)
+	available := resolver.sorted(helpBrand)
 	cmd.Flags().StringSliceVar(&opts.Domains, "domain", nil,
 		fmt.Sprintf("domain (repeatable or comma-separated, e.g. --domain calendar,task)\navailable: %s, all", strings.Join(available, ", ")))
 	cmd.Flags().StringSliceVar(&opts.Exclude, "exclude", nil,
@@ -89,15 +98,15 @@
 	cmd.Flags().StringVar(&opts.DeviceCode, "device-code", "", "poll and complete authorization with a device code from a previous --no-wait call")
 
 	cmdutil.RegisterFlagCompletion(cmd, "domain", func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		return completeDomain(toComplete), cobra.ShellCompDirectiveNoFileComp
+		return resolver.complete(toComplete, helpBrand), cobra.ShellCompDirectiveNoFileComp
 	})
 
 	return cmd
 }
 
-// completeDomain returns completions for comma-separated domain values.
-func completeDomain(toComplete string) []string {
-	allDomains := registry.ListFromMetaProjects()
+// complete returns completions for comma-separated domain values.
+func (r domainResolver) complete(toComplete string, brand core.LarkBrand) []string {
+	allDomains := r.sorted(brand)
 	parts := strings.Split(toComplete, ",")
 	prefix := parts[len(parts)-1]
 	base := strings.Join(parts[:len(parts)-1], ",")
@@ -116,7 +125,7 @@
 }
 
 // authLoginRun executes the login command logic.
-func authLoginRun(opts *LoginOptions) error {
+func authLoginRun(opts *LoginOptions, resolver domainResolver) error {
 	f := opts.Factory
 
 	config, err := f.Config()
@@ -151,14 +160,14 @@
 	// Expand --domain all to all available domains (from_meta projects + shortcut services)
 	for _, d := range selectedDomains {
 		if strings.EqualFold(d, "all") {
-			selectedDomains = sortedKnownDomains(config.Brand)
+			selectedDomains = resolver.sorted(config.Brand)
 			break
 		}
 	}
 
 	// Validate domain names and suggest corrections for unknown ones
 	if len(selectedDomains) > 0 {
-		knownDomains := allKnownDomains(config.Brand)
+		knownDomains := resolver.allKnown(config.Brand)
 		for _, d := range selectedDomains {
 			if !knownDomains[d] {
 				if suggestion := suggestDomain(d, knownDomains); suggestion != "" {
@@ -182,7 +191,7 @@
 
 	if !hasAnyOption {
 		if !opts.JSON && f.IOStreams.IsTerminal {
-			result, err := runInteractiveLogin(f.IOStreams, lang.Base(), msg, config.Brand)
+			result, err := runInteractiveLogin(f.IOStreams, lang.Base(), msg, config.Brand, resolver)
 			if err != nil {
 				return err
 			}
@@ -220,10 +229,10 @@
 	if len(selectedDomains) > 0 || opts.Recommend {
 		var candidateScopes []string
 		if len(selectedDomains) > 0 {
-			candidateScopes = collectScopesForDomains(selectedDomains, "user", config.Brand)
+			candidateScopes = resolver.scopesFor(selectedDomains, "user", config.Brand)
 		} else {
 			// --recommend without --domain: all domains
-			candidateScopes = collectScopesForDomains(sortedKnownDomains(config.Brand), "user", config.Brand)
+			candidateScopes = resolver.scopesFor(resolver.sorted(config.Brand), "user", config.Brand)
 		}
 
 		// Filter to auto-approve scopes if --recommend or interactive "common"
@@ -508,7 +517,25 @@
 // shortcut scopes for the given domain names.
 // Domains with auth_domain children are automatically expanded to include
 // their children's scopes.
-func collectScopesForDomains(domains []string, identity string, brand core.LarkBrand) []string {
+// domainResolver answers auth domain and scope questions against one build's
+// shortcut snapshot. The snapshot is a build-local input rather than a constant:
+// a distribution assembled with cmd.WithCommandSets contributes business
+// commands whose declared scopes must participate in --domain resolution, so
+// every method here reads the snapshot it was constructed with instead of the
+// built-in set.
+type domainResolver struct {
+	registered []common.Shortcut
+}
+
+func newDomainResolver(registered []common.Shortcut) domainResolver {
+	return domainResolver{registered: registered}
+}
+
+// scopesFor collects API scopes (from from_meta projects) and shortcut scopes
+// for the given domain names.
+// Domains with auth_domain children are automatically expanded to include
+// their children's scopes.
+func (r domainResolver) scopesFor(domains []string, identity string, brand core.LarkBrand) []string {
 	scopeSet := make(map[string]bool)
 
 	// 1. API scopes from from_meta projects
@@ -526,7 +553,7 @@
 	}
 
 	// 3. Shortcut scopes matching by Service (only include shortcuts supporting the identity)
-	for _, sc := range shortcuts.AllShortcuts() {
+	for _, sc := range r.registered {
 		if !shortcuts.IsShortcutServiceAvailable(sc.Service, brand) {
 			continue
 		}
@@ -549,27 +576,66 @@
 // allKnownDomains returns all valid auth domain names (from_meta projects +
 // shortcut services), excluding domains that have auth_domain set (they are
 // folded into their parent domain).
-func allKnownDomains(brand core.LarkBrand) map[string]bool {
+func (r domainResolver) allKnown(brand core.LarkBrand) map[string]bool {
 	domains := make(map[string]bool)
 	for _, p := range registry.ListFromMetaProjects() {
 		if !registry.HasAuthDomain(p) {
 			domains[p] = true
 		}
 	}
-	for _, sc := range shortcuts.AllShortcuts() {
+	for _, sc := range r.registered {
 		if !shortcuts.IsShortcutServiceAvailable(sc.Service, brand) {
 			continue
 		}
+		// No scope filter here: matching main, a scope-less domain (e.g.
+		// event) stays addressable via --domain and the --help list, and
+		// fails later with "no matching scopes found". Only the interactive
+		// selector hides it (see domainResolver.metadata).
 		if !registry.HasAuthDomain(sc.Service) {
 			domains[sc.Service] = true
 		}
 	}
 	return domains
 }
 
+func shortcutHasDeclaredScopes(shortcut common.Shortcut) bool {
+	for _, identity := range []string{"user", "bot"} {
+		if len(shortcut.DeclaredScopesForIdentity(identity)) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// scopelessShortcutOnlyDomains returns shortcut-only domains none of whose
+// shortcuts declare any scope (e.g. event). The interactive selector hides
+// them — picking one can only end in "no matching scopes found" — while
+// --domain and the help list keep accepting them, matching main.
+func (r domainResolver) scopeless() map[string]bool {
+	fromMeta := make(map[string]bool)
+	for _, p := range registry.ListFromMetaProjects() {
+		fromMeta[p] = true
+	}
+	hasScopes := make(map[string]bool)
+	seen := make(map[string]bool)
+	for _, sc := range r.registered {
+		seen[sc.Service] = true
+		if shortcutHasDeclaredScopes(sc) {
+			hasScopes[sc.Service] = true
+		}
+	}
+	scopeless := make(map[string]bool)
+	for service := range seen {
+		if !fromMeta[service] && !hasScopes[service] {
+			scopeless[service] = true
+		}
+	}
+	return scopeless
+}
+
 // sortedKnownDomains returns all valid domain names sorted alphabetically.
-func sortedKnownDomains(brand core.LarkBrand) []string {
-	m := allKnownDomains(brand)
+func (r domainResolver) sorted(brand core.LarkBrand) []string {
+	m := r.allKnown(brand)
 	domains := make([]string, 0, len(m))
 	for d := range m {
 		domains = append(domains, d)

cmd/auth/login_brand_filter_test.go

@@ -7,26 +7,49 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/shortcuts"
 )
 
 func TestBrandFilter_AppsExcludedOnLark(t *testing.T) {
-	feishuDomains := allKnownDomains(core.BrandFeishu)
+	feishuDomains := builtinResolver().allKnown(core.BrandFeishu)
 	if !feishuDomains["apps"] {
 		t.Errorf("expected apps domain to be known on Feishu brand")
 	}
 
-	larkDomains := allKnownDomains(core.BrandLark)
+	larkDomains := builtinResolver().allKnown(core.BrandLark)
 	if larkDomains["apps"] {
 		t.Errorf("expected apps domain to be EXCLUDED on Lark brand")
 	}
 
-	feishuScopes := collectScopesForDomains([]string{"apps"}, "user", core.BrandFeishu)
+	feishuScopes := builtinResolver().scopesFor([]string{"apps"}, "user", core.BrandFeishu)
 	if len(feishuScopes) == 0 {
 		t.Errorf("expected non-empty scopes for apps on Feishu brand, got %d", len(feishuScopes))
 	}
 
-	larkScopes := collectScopesForDomains([]string{"apps"}, "user", core.BrandLark)
+	larkScopes := builtinResolver().scopesFor([]string{"apps"}, "user", core.BrandLark)
 	if len(larkScopes) != 0 {
 		t.Errorf("expected empty scopes for apps on Lark brand, got %d: %v", len(larkScopes), larkScopes)
 	}
 }
+
+func TestInteractiveDomainMetadataUsesActiveBrand(t *testing.T) {
+	registered := shortcuts.AllShortcuts()
+	feishuDomains := newDomainResolver(registered).metadata("en", core.BrandFeishu)
+	if !containsDomainMetadata(feishuDomains, "apps") {
+		t.Fatal("apps domain is missing for Feishu interactive login")
+	}
+
+	larkDomains := newDomainResolver(registered).metadata("en", core.BrandLark)
+	if containsDomainMetadata(larkDomains, "apps") {
+		t.Fatal("apps domain is present for Lark interactive login")
+	}
+}
+
+func containsDomainMetadata(domains []domainMeta, name string) bool {
+	for _, domain := range domains {
+		if domain.Name == name {
+			return true
+		}
+	}
+	return false
+}