feat(apps): add role management shortcuts

internal/errclass/codemeta_spark.go

@@ -0,0 +1,28 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package errclass
+
+import "github.com/larksuite/cli/errs"
+
+// sparkCodeMeta holds stable Spark app-role business-code classifications.
+// Command-specific recovery guidance belongs in the Apps shortcut layer; the
+// numeric code remains the source-specific discriminator on the error envelope.
+var sparkCodeMeta = map[int]CodeMeta{
+	3340001: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // request parameters are invalid
+	3344027: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role user count exceeds the service limit
+	3344028: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role department count exceeds the service limit
+	3344029: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role chat count exceeds the service limit
+	3344030: {Category: errs.CategoryAuthorization, Subtype: errs.SubtypePermissionDenied}, // app administrator required
+	3344031: {Category: errs.CategoryAuthorization, Subtype: errs.SubtypePermissionDenied}, // app administrator or developer required
+	3344034: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role ID
+	3344035: {Category: errs.CategoryAPI, Subtype: errs.SubtypeNotFound},                   // role does not exist
+	3344036: {Category: errs.CategoryAPI, Subtype: errs.SubtypeAlreadyExists},              // role ID already exists
+	3344037: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // app role count exceeds the service limit
+	3344038: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role name
+	3344039: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role description
+	3344040: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // unsupported member type
+	3344041: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid member ID
+}
+
+func init() { mergeCodeMeta(sparkCodeMeta, "spark") }

internal/errclass/codemeta_spark_test.go

@@ -0,0 +1,59 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package errclass
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+)
+
+func TestLookupCodeMetaSparkRoleCodes(t *testing.T) {
+	tests := []struct {
+		code     int
+		category errs.Category
+		subtype  errs.Subtype
+	}{
+		{3340001, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+		{3344027, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
+		{3344028, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
+		{3344029, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
+		{3344030, errs.CategoryAuthorization, errs.SubtypePermissionDenied},
+		{3344031, errs.CategoryAuthorization, errs.SubtypePermissionDenied},
+		{3344034, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+		{3344035, errs.CategoryAPI, errs.SubtypeNotFound},
+		{3344036, errs.CategoryAPI, errs.SubtypeAlreadyExists},
+		{3344037, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
+		{3344038, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+		{3344039, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+		{3344040, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+		{3344041, errs.CategoryAPI, errs.SubtypeInvalidParameters},
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%d", tt.code), func(t *testing.T) {
+			meta, ok := LookupCodeMeta(tt.code)
+			if !ok {
+				t.Fatalf("code %d is not registered", tt.code)
+			}
+			if meta.Category != tt.category || meta.Subtype != tt.subtype || meta.Retryable {
+				t.Fatalf("code %d metadata = %+v, want category=%s subtype=%s retryable=false", tt.code, meta, tt.category, tt.subtype)
+			}
+
+			err := BuildAPIError(map[string]any{
+				"code":   tt.code,
+				"msg":    "spark role error",
+				"log_id": "log-spark-role",
+			}, ClassifyContext{Identity: "user"})
+			problem, ok := errs.ProblemOf(err)
+			if !ok {
+				t.Fatalf("BuildAPIError(%d) = %#v, want typed problem", tt.code, err)
+			}
+			if problem.Category != tt.category || problem.Subtype != tt.subtype || problem.Code != tt.code || problem.LogID != "log-spark-role" || problem.Retryable {
+				t.Fatalf("BuildAPIError(%d) problem = %+v", tt.code, problem)
+			}
+		})
+	}
+}

internal/qualitygate/rules/dryrun.go

@@ -337,7 +337,7 @@ func fakeValueFromPlaceholderName(name string) (string, bool) {
 	case name == "open_id" || hasPlaceholderToken(tokens, "user", "owner", "participant", "approver", "speaker"):
 		return "ou_test123", true
 	case hasPlaceholderToken(tokens, "department", "dept"):
-		return "od_test123", true
+		return "od-test123", true
 	case hasPlaceholderToken(tokens, "message"):
 		return "om_test123", true
 	case name == "file_key":

internal/qualitygate/rules/dryrun_test.go

@@ -316,6 +316,13 @@ func TestRunDryRunsMaterializesInlinePlaceholderFlagValues(t *testing.T) {
 	}
 }
 
+func TestFakeValueFromPlaceholderNameUsesOpenDepartmentPrefix(t *testing.T) {
+	got, ok := fakeValueFromPlaceholderName("open_department_id")
+	if !ok || got != "od-test123" {
+		t.Fatalf("open_department_id placeholder = %q, %v; want od-test123, true", got, ok)
+	}
+}
+
 func TestRunDryRunsMaterializesNumericPlaceholderFlagValues(t *testing.T) {
 	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/vc/v1/bots/events","params":{"meeting_id":"400000000001","page_size":50}}]}`)
 	m := manifest.Manifest{Commands: []manifest.Command{{

shortcuts/apps/apps_access_scope_get_test.go

@@ -20,7 +20,7 @@ func TestAppsAccessScopeGet_Specific(t *testing.T) {
 			"data": map[string]interface{}{
 				"scope":       "Range",
 				"users":       []interface{}{"ou_x", "ou_y"},
-				"departments": []interface{}{"od_z"},
+				"departments": []interface{}{"od-z"},
 				"chats":       []interface{}{"oc_g"},
 				"apply_config": map[string]interface{}{
 					"enabled":   true,
@@ -39,7 +39,7 @@ func TestAppsAccessScopeGet_Specific(t *testing.T) {
 	if !strings.Contains(got, `"scope": "Range"`) {
 		t.Fatalf("scope string not preserved (expect raw \"Range\"): %s", got)
 	}
-	if !strings.Contains(got, `"ou_x"`) || !strings.Contains(got, `"od_z"`) || !strings.Contains(got, `"oc_g"`) {
+	if !strings.Contains(got, `"ou_x"`) || !strings.Contains(got, `"od-z"`) || !strings.Contains(got, `"oc_g"`) {
 		t.Fatalf("users/departments/chats fields missing in envelope: %s", got)
 	}
 	if !strings.Contains(got, `"ou_appr"`) {