fix(base): clarify 91403 permission guidance

[xu91102]

背景

Base/Bitable 返回 91403 Forbidden 时，CLI 之前会落到 api/unknown，缺少可执行恢复步骤。用户遇到扫码登录后仍然 91403 时，很难区分是身份仍在 bot/app 模式、用户授权 scope 不完整，还是 Base 文档协作者 / 应用权限未授予。

Fixes #1778

核心改动

• 为 Base code 91403 增加 authorization/permission_denied 分类。
• 在 Base 错误封装中为 91403 增加具体 hint：
  • 重新用 lark-cli auth login --domain all 授权；
  • 切到 lark-cli config default-as user；
  • 用 lark-cli auth status --json --verify 核对授权；
  • 若 scopes 已具备，则检查 Base collaborator 访问和 base:app 应用权限发布状态。
• 增加单测覆盖 typed metadata 和 hint 内容。

验证

• GOCACHE=$PWD/.cache/go-build GOPROXY=https://goproxy.cn,direct go test ./shortcuts/base ./internal/errclass -count=1：通过
• GOCACHE=$PWD/.cache/go-build GOPROXY=https://goproxy.cn,direct go build -o ./lark-cli .：通过
• git diff --check：通过
• gofmt -l shortcuts/base/base_errors.go shortcuts/base/base_errors_test.go internal/errclass/codemeta_base.go internal/errclass/codemeta_test.go：通过，无输出
• rg -n '^(<<<<<<< .+|=======$|>>>>>>> .+)$' --glob '!vendor/**' --glob '!node_modules/**' .：通过，无冲突标记

风险与回滚

风险较低。改动只影响 Base 91403 错误分类和提示，不改变请求参数、认证流程或 API 调用。回滚本提交即可恢复原行为。

Summary by CodeRabbit

• New Features

  • Added clearer guidance when a Base permission-denied error occurs, helping users understand what went wrong and what to check next.
  • Expanded error metadata so this permission issue is consistently recognized as an authorization problem.

• Bug Fixes

  • Improved error handling to show a specific hint for code 91403 when no API hint is provided.

• Tests

  • Added coverage for the new permission-denied behavior and metadata lookup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2e36c241-3d2b-4df5-9932-f828f8f4eea7

📥 Commits

Reviewing files that changed from the base of the PR and between 74d8458 and ba89d70.

📒 Files selected for processing (4)

• internal/errclass/codemeta_base.go
• internal/errclass/codemeta_test.go
• shortcuts/base/base_errors.go
• shortcuts/base/base_errors_test.go

---

📝 Walkthrough

Walkthrough

This PR registers error code 91403 in the internal error classification registry as an Authorization/PermissionDenied category, and updates Base API error handling to attach a default "Base permission denied" hint when no hint is extracted for that code. Unit tests cover both the registry lookup and the error handling path.

Changes

Base permission-denied error 91403

Layer / File(s)	Summary
CodeMeta registration for 91403 internal/errclass/codemeta_base.go, internal/errclass/codemeta_test.go	Adds baseCodeMeta map registering code 91403 as Authorization/PermissionDenied, merged via init(), with a test asserting LookupCodeMeta(91403) returns the correct category, subtype, and non-retryable flag.
Default hint for 91403 in Base error handling shortcuts/base/base_errors.go, shortcuts/base/base_errors_test.go	baseAPIErrorFromResult now sets a default hint via new basePermissionDeniedHint() helper when code is 91403 and no extracted hint exists; test verifies classification and hint content.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• larksuite/cli#505: Both PRs address error code 91403 for Base permission-denied handling, with the retrieved PR documenting the corresponding no-retry workflow.

Suggested reviewers: zhouyue-bytedance

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main 91403 permission guidance change.
Description check	✅ Passed	The description covers motivation, changes, verification, and linked issue context, though its headings differ from the template.
Linked Issues check	✅ Passed	The PR adds 91403 authorization classification and clearer recovery hints, matching issue #1778's need for better Base permission guidance.
Out of Scope Changes check	✅ Passed	The changes stay focused on Base 91403 error classification, hints, and tests without unrelated scope.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}