Guide Feishu app setup and surface tenant lookup codes

backend/internal/identityprovider/admin.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -19,6 +20,14 @@ import (
 const feishuTenantToken = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
 const feishuTenantQuery = "https://open.feishu.cn/open-apis/tenant/v2/tenant/query"
 
+// Do not include upstream msg: it is untrusted and may contain request data.
+func feishuFailure(stage string, status int, code *int) error {
+	if code != nil {
+		return fmt.Errorf("%s失败（飞书错误码 %d，HTTP %d）；请按错误码检查应用权限、发布状态及接口配置", stage, *code, status)
+	}
+	return fmt.Errorf("%s失败（HTTP %d，未获得飞书错误码）；请检查飞书接口配置", stage, status)
+}
+
 func secureAdmin(c *gin.Context) bool {
 	if c.Request.TLS != nil {
 		return true
@@ -68,8 +77,12 @@ func queryFeishuTenant(ctx context.Context, creds tenantCredentials) (string, st
 		Code              *int   `json:"code"`
 		TenantAccessToken string `json:"tenant_access_token"`
 	}
-	if resp.StatusCode != http.StatusOK || json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&token) != nil || token.Code == nil || *token.Code != 0 || token.TenantAccessToken == "" {
-		return "", "", errors.New("获取飞书访问凭据失败，请检查 App ID 和 App Secret")
+	decodeErr := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&token)
+	if resp.StatusCode != http.StatusOK || decodeErr != nil || token.Code == nil || *token.Code != 0 {
+		return "", "", feishuFailure("获取飞书访问凭据", resp.StatusCode, token.Code)
+	}
+	if token.TenantAccessToken == "" {
+		return "", "", errors.New("飞书未返回 tenant_access_token")
 	}
 	req, err = http.NewRequestWithContext(ctx, http.MethodGet, feishuTenantQuery, nil)
 	if err != nil {
@@ -90,8 +103,9 @@ func queryFeishuTenant(ctx context.Context, creds tenantCredentials) (string, st
 			} `json:"tenant"`
 		} `json:"data"`
 	}
-	if resp.StatusCode != http.StatusOK || json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&result) != nil || result.Code == nil || *result.Code != 0 {
-		return "", "", errors.New("查询飞书企业信息失败，请确认应用已开通企业信息读取权限")
+	decodeErr = json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&result)
+	if resp.StatusCode != http.StatusOK || decodeErr != nil || result.Code == nil || *result.Code != 0 {
+		return "", "", feishuFailure("查询飞书企业信息", resp.StatusCode, result.Code)
 	}
 	if !validTenant(result.Data.Tenant.TenantKey) {
 		return "", "", errors.New("飞书未返回有效的企业标识")