GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — feat: support ClientAssertion authentication for ISV apps by SadMemories · Pull Request #178 · larksuite/oapi-sdk-python

Conversation

SadMemories commented Nov 12, 2026

Copy link

Copy Markdown

Collaborator

商店应用配置 ClientAssertionProvider 后，可在调用业务 API 时使用 tenant_key 自动兑换并缓存 TAT，无需 AppSecret、AppTicket 或 AppAccessToken。

使用现有 OAuth 地址、aud 和代理路由，通过 /oauth/v3/token 发送 client_credentials 请求，并按租户和 OAuth 地址隔离缓存。新增 ISV 响应检查；业务错误信息同时包含 error 和 error_description，响应字段校验失败时说明具体原因，避免将无效 Token 写入缓存。

复用已有 UAT 获取与刷新流程，保持自建应用、AppSecret 模式及各语言原有缓存和重试行为。

验证：运行 ClientAssertion token manager、auth、access token 三组测试，39 项通过。覆盖租户缓存隔离、代理路由、错误透出、失败响应不缓存及现有 UAT 流程。

未执行真实 Token 兑换或发送消息。

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

SadMemories added 2 commits

October 20, 2026 10:41


          feat: support ClientAssertion authentication for ISV apps

55cd901

Reuse existing OAuth exchanges for ISV tenant tokens with client_credentials and tenant_key, and enable existing UAT flows. Preserve cache and retry behavior, add scoped failure logs, regression tests, and usage documentation.

Change-Id: If787253e21d439e679320127fb6ae4d23dfc9f78


          fix: preserve OAuth error details for ISV tenant tokens

3efbf18

Change-Id: I72a453cca86d273cb05c0aaa9a1f329151d3f8d5

github-advanced-security Bot found potential problems

Nov 12, 2026

View reviewed changes

Comment thread

lark_oapi/core/token/manager.py

		msg += f", error: {resp['error']}"
		if resp.get("error_description"):
		msg += f", error_description: {resp['error_description']}"
		logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg)

Comment thread

lark_oapi/core/token/manager.py

		msg += f", error: {resp['error']}"
		if resp.get("error_description"):
		msg += f", error_description: {resp['error_description']}"
		logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg)

Comment thread

lark_oapi/core/token/manager.py

		msg += f", error: {resp['error']}"
		if resp.get("error_description"):
		msg += f", error_description: {resp['error_description']}"
		logger.warning("ISV tenant token exchange failed, aud:%s, status:%s, code:%s, msg:%s", aud, raw.status_code, resp.get("code", 0), msg)

Comment thread

lark_oapi/core/token/manager.py

		msg = "access_token is empty"
		elif int(resp.get("expires_in") or 0) <= 0:
		msg = "expires_in must be positive"
		logger.warning("invalid ISV tenant token response, aud:%s, msg:%s", aud, msg)

Reviewers

1 more reviewer

github-advanced-security[bot]

github-advanced-security[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.