Guide Feishu app setup and surface tenant lookup codes

backend/internal/identityprovider/admin_test.go

@@ -2,6 +2,7 @@ package identityprovider
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"io"
 	"net/http"
@@ -123,6 +124,34 @@ func TestQueryTenantRejectsWrongAppAndUpstreamFailure(t *testing.T) {
 	}
 }
 
+func TestTenantErrorsIdentifyStageWithoutLeakingFeishuMessage(t *testing.T) {
+	previous := upstreamClient
+	defer func() { upstreamClient = previous }()
+	for _, tc := range []struct {
+		name, endpoint, payload, want string
+		status                        int
+	}{
+		{"tenant denied", feishuTenantQuery, `{"code":99991672,"msg":"secret in upstream error"}`, "99991672", 403},
+		{"unexpected tenant endpoint", feishuTenantQuery, `not json`, "HTTP 404", 404},
+		{"token denied", feishuTenantToken, `{"code":10003,"msg":"secret in upstream error"}`, "10003", 401},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			upstreamClient = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
+				body := `{"code":0,"tenant_access_token":"temporary-token"}`
+				status := 200
+				if req.URL.String() == tc.endpoint {
+					body, status = tc.payload, tc.status
+				}
+				return &http.Response{StatusCode: status, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
+			})}
+			_, _, err := queryFeishuTenant(context.Background(), tenantCredentials{AppID: "cli_test", AppSecret: "private-value"})
+			if err == nil || !strings.Contains(err.Error(), tc.want) || strings.Contains(err.Error(), "secret in upstream error") || strings.Contains(err.Error(), "private-value") {
+				t.Fatalf("unsafe or unhelpful error: %v", err)
+			}
+		})
+	}
+}
+
 func TestAdminNeverEchoesFeishuSecretAndKeepsEncryptedValue(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("VPN_DATA_DIR", dir)