PR: Feishu Plugin - Auto-grant document permissions to requesting user#28295
PR: Feishu Plugin - Auto-grant document permissions to requesting user#28295Takhoffman merged 2 commits intoopenclaw:mainfrom
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b70e6ee54b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
extensions/feishu/src/docx.ts
Outdated
| url: `https://feishu.cn/docx/${doc?.document_id}`, | ||
| url: `https://feishu.cn/docx/${docToken}`, | ||
| ...(ownerOpenId && { | ||
| owner_permission_added: true, |
There was a problem hiding this comment.
Report owner permission status from the real grant outcome
The create response unconditionally includes owner_permission_added: true whenever owner_open_id is provided, even though the permission grant is explicitly marked non-critical and can fail in the preceding try/catch. In cases where Feishu rejects the permission update (invalid user, policy restrictions, transient API error), callers will be told sharing succeeded and may not perform fallback sharing, leaving the requester without access.
Useful? React with 👍 / 👎.
| // Auto add owner permission if ownerOpenId is provided | ||
| if (docToken && ownerOpenId) { | ||
| try { | ||
| await client.drive.permissionMember.create({ |
There was a problem hiding this comment.
Check permission API response code before treating it as success
The new drive.permissionMember.create call ignores its return payload and only handles thrown exceptions, but this codebase consistently checks res.code for Feishu API failures. If this endpoint returns a non-zero code without throwing, the grant will silently fail and still flow through as if successful; capture the result and validate code like the other Feishu operations in this file.
Useful? React with 👍 / 👎.
Greptile SummaryAdded optional permission auto-granting when creating Feishu documents via new Key changes:
Issues found:
Confidence Score: 3/5
Last reviewed commit: b70e6ee |
extensions/feishu/src/docx.ts
Outdated
| ); | ||
| case "create": | ||
| return json(await createDoc(client, p.title, p.folder_token)); | ||
| return json(await createDoc(client, p.title, p.folder_token, (p as any).owner_open_id, (p as any).owner_perm_type)); |
There was a problem hiding this comment.
Type casting to any bypasses type safety. Use proper type narrowing instead.
| return json(await createDoc(client, p.title, p.folder_token, (p as any).owner_open_id, (p as any).owner_perm_type)); | |
| const createParams = p as Extract<FeishuDocParams, { action: "create" }>; | |
| return json(await createDoc(client, createParams.title, createParams.folder_token, createParams.owner_open_id, createParams.owner_perm_type)); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/feishu/src/docx.ts
Line: 539
Comment:
Type casting to `any` bypasses type safety. Use proper type narrowing instead.
```suggestion
const createParams = p as Extract<FeishuDocParams, { action: "create" }>;
return json(await createDoc(client, createParams.title, createParams.folder_token, createParams.owner_open_id, createParams.owner_perm_type));
```
How can I resolve this? If you propose a fix, please make it concise.
extensions/feishu/src/docx.ts
Outdated
| ...(ownerOpenId && { | ||
| owner_permission_added: true, | ||
| owner_open_id: ownerOpenId, | ||
| owner_perm_type: ownerPermType | ||
| }), |
There was a problem hiding this comment.
owner_permission_added incorrectly reports true even when the permission API call fails. The try/catch above only logs a warning, so failures are silently ignored while claiming success. Track actual success status in a variable set to true only after successful API call.
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/feishu/src/docx.ts
Line: 305-309
Comment:
`owner_permission_added` incorrectly reports `true` even when the permission API call fails. The try/catch above only logs a warning, so failures are silently ignored while claiming success. Track actual success status in a variable set to `true` only after successful API call.
How can I resolve this? If you propose a fix, please make it concise.
extensions/feishu/src/doc-schema.ts
Outdated
| owner_perm_type: Type.Optional(Type.Union([ | ||
| Type.Literal("view"), | ||
| Type.Literal("edit"), | ||
| Type.Literal("full_access") | ||
| ], { description: "Permission type (default: full_access)" })), |
There was a problem hiding this comment.
Consider using optionalStringEnum from src/agents/schema/typebox.ts instead of nested Type.Union for string enums (follows tool schema guidelines). Note: existing feishu schemas use this pattern, so consistency across all schema files would be needed.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/feishu/src/doc-schema.ts
Line: 25-29
Comment:
Consider using `optionalStringEnum` from `src/agents/schema/typebox.ts` instead of nested Type.Union for string enums (follows tool schema guidelines). Note: existing feishu schemas use this pattern, so consistency across all schema files would be needed.
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.b70e6ee to
b076d65
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: afa9452e8e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // Auto add owner permission if ownerOpenId is provided | ||
| if (docToken && ownerOpenId) { | ||
| try { | ||
| await client.drive.permissionMember.create({ |
There was a problem hiding this comment.
Validate permission API result before treating grant as success
This call ignores the returned payload and only reacts to thrown exceptions, but Feishu endpoints in this plugin generally signal failures via non-zero code values. If drive.permissionMember.create returns { code != 0 } without throwing, the grant silently fails and execution continues as if sharing succeeded, which can leave the requester without access after document creation.
Useful? React with 👍 / 👎.
extensions/feishu/src/docx.ts
Outdated
| url: `https://feishu.cn/docx/${doc?.document_id}`, | ||
| url: `https://feishu.cn/docx/${docToken}`, | ||
| ...(ownerOpenId && { | ||
| owner_permission_added: true, |
There was a problem hiding this comment.
Set owner_permission_added from actual grant outcome
The response unconditionally sets owner_permission_added: true whenever ownerOpenId is present, even when the permission grant throws and is caught as non-critical. In those failure paths, callers receive a false success signal and may skip fallback sharing logic, so the intended user still cannot open or edit the new doc.
Useful? React with 👍 / 👎.
afa9452 to
d9118f7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9118f7976
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // Auto add owner permission if ownerOpenId is provided | ||
| if (docToken && ownerOpenId) { | ||
| try { | ||
| await client.drive.permissionMember.create({ |
There was a problem hiding this comment.
Validate permission-create response before marking grant success
createDoc treats drive.permissionMember.create as successful whenever the call resolves, but Feishu SDK operations in this plugin typically signal failures via non-zero code values (see extensions/feishu/src/perm.ts), not only thrown exceptions. In that case, this path still sets ownerPermissionAdded = true and reports owner_permission_added: true, so callers can incorrectly assume sharing succeeded and skip fallback permission handling, leaving the requesting user without access.
Useful? React with 👍 / 👎.
|
PR #28295 - PR: Feishu Plugin - Auto-grant document permissions to requesting user (#28295) Merged via squash.
Thanks @zhoulongchao77! |
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit 323320c)
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit 323320c)
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit 323320c)
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit bf9585d) # Conflicts: # extensions/feishu/src/docx.test.ts # extensions/feishu/src/docx.ts
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit bf9585d) # Conflicts: # extensions/feishu/src/doc-schema.ts # extensions/feishu/src/docx.test.ts # extensions/feishu/src/docx.ts
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> (cherry picked from commit bf9585d)
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
openclaw#28295) thanks @zhoulongchao77 Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: zhoulongchao77 <65058500+zhoulongchao77@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
PR: Feishu Plugin - Auto-grant document permissions to requesting user
Summary
Describe the problem and fix in 2–5 bullets:
owner_open_idandowner_perm_typeto thecreateaction infeishu_doctool. ThecreateDocfunction now automatically callsdrive.permissionMember.createto grant full_access permission to the specified user when document is created.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
New features:
feishu_doctool'screateaction now accepts optional parameters:owner_open_id(string): Open ID of user to grant permissionsowner_perm_type(string): Permission type - "view", "edit", or "full_access" (default: "full_access")owner_open_idis provided, the document will automatically grant that user full_access permission upon creationowner_permission_added(boolean): whether permission was successfully addedowner_open_id(string): the user ID that received permissionowner_perm_type(string): the permission type grantedBackward compatible: Yes - existing calls to
createaction continue to work exactly as before.Security Impact (required)
Yes)owner_open_idparameter, and only when that parameter is provided. No permissions are granted by default.No)Yes)drive.permissionMember.createwhen owner_open_id is providedNo)No)Repro + Verification
Environment
OS: macOS / Linux / Windows
Runtime/container: Node.js 18+
Model/provider: Any (feishu plugin is independent)
Integration/channel: Feishu
Relevant config:
Steps
feishu_docwith action: "create" without new parameters - verify document creation still worksfeishu_docwith action: "create", title: "Test", owner_open_id: "ou_xxx", owner_perm_type: "full_access"Expected
Actual
Evidence
Attach at least one:
Evidence from testing:
{ "document_id": "xxx", "title": "Test Document", "url": "https://feishu.cn/docx/xxx", "owner_permission_added": true, "owner_open_id": "ou_xxx", "owner_perm_type": "full_access" }Full testing details and screenshots: https://blog.csdn.net/m0_46360532/article/details/158426139
Human Verification (required)
What you personally verified (not just CI), and how:
Verified scenarios:
Edge cases checked:
What you did NOT verify:
Compatibility / Migration
Yes)No)No)If yes, exact upgrade steps: N/A
Failure Recovery (if this breaks)
How to disable/revert this change quickly:
docx.tsanddoc-schema.tsFiles/config to restore:
extensions/feishu/src/docx.tsextensions/feishu/src/doc-schema.tsKnown bad symptoms reviewers should watch for:
Risks and Mitigations
List only real risks for this PR. Add/remove entries as needed.
Risk: Permission API calls could fail and block document creation
Risk: Backward compatibility could break
Risk: Unintended permissions could be granted
Related Blog Post: https://blog.csdn.net/m0_46360532/article/details/158426139