{"record":{"id":"c62ee0c2b5f0d7a3","repo":"larksuite/cli","slug":"d-s","errorCode":null,"errorMessage":"[%d] %s","messagePattern":"\\[%d\\] %s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/verify.go","lineNumber":37,"sourceCode":"\tapiResp, err := sdk.Do(ctx, &larkcore.ApiReq{\n\t\tHttpMethod:                http.MethodGet,\n\t\tApiPath:                   PathUserInfoV1,\n\t\tSupportedAccessTokenTypes: []larkcore.AccessTokenType{larkcore.AccessTokenTypeUser},\n\t}, larkcore.WithUserAccessToken(accessToken))\n\tif err != nil {\n\t\treturn err\n\t}\n\tlogSDKResponse(PathUserInfoV1, apiResp)\n\n\tvar resp struct {\n\t\tCode int    `json:\"code\"`\n\t\tMsg  string `json:\"msg\"`\n\t}\n\tif err := json.Unmarshal(apiResp.RawBody, &resp); err != nil {\n\t\treturn fmt.Errorf(\"failed to parse response: %w\", err)\n\t}\n\tif resp.Code != 0 {\n\t\treturn fmt.Errorf(\"[%d] %s\", resp.Code, resp.Msg)\n\t}\n\treturn nil\n}\n","sourceCodeStart":19,"sourceCodeEnd":41,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/auth/verify.go#L19-L41","documentation":"VerifyUserToken parsed the verification response successfully, but the API-level business code was non-zero. The error message is '[code] msg' — the Feishu API's own code and message pair indicating token verification was rejected (invalid, expired, or unauthorized token). This is a server-side semantic failure, not a transport problem.","triggerScenarios":"resp.Code != 0 after unmarshalling the verify response — e.g. token invalid/expired/revoked, wrong app identity, or missing permission for the verification endpoint.","commonSituations":"User token expired between issuance and verification; token belongs to a different app (app_id/app_secret mismatch after config change); token revoked by logout; clock skew making the token appear expired.","solutions":["Look up the embedded code in the Feishu error-code docs to identify the exact rejection reason (expired vs invalid vs permission).","If the token is expired, re-run the login/device flow to obtain a fresh token and retry verification.","Verify the app_id/app_secret used for verification match the app that issued the token.","Check system clock skew (NTP) if the code indicates an expired but recently issued token."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// check token freshness before verification\ntype tok interface{ ExpiresAt() time.Time }\nif t, ok := token.(tok); ok && time.Now().After(t.ExpiresAt()) {\n    token = relogin(ctx) // refresh before verifying\n}","typeGuard":"func isBizReject(err error) (code int, msg string, ok bool) {\n    s := err.Error()\n    if strings.HasPrefix(s, \"[\") {\n        if n, _ := fmt.Sscanf(s, \"[%d]\", &code); n == 1 { return code, s, true }\n    }\n    return 0, s, false\n}","tryCatchPattern":"if err := auth.VerifyUserToken(ctx, tok); err != nil {\n    if code, msg, ok := isBizReject(err); ok {\n        switch code {\n        case errExpired:\n            return reauthAndRetry(ctx)\n        default:\n            return fmt.Errorf(\"token rejected by API (code %d): %s\", code, msg)\n        }\n    }\n    return err\n}","preventionTips":["Refresh/re-login before tokens expire instead of verifying stale tokens.","Ensure app_id/app_secret used for verification match the token-issuing app.","Sync system clocks (NTP) to avoid false expiry.","Map known Feishu error codes to recovery actions (re-login vs config fix)."],"tags":["auth","token-verification","api-error","go"],"backgroundTag":"token-verification-rejected","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}