{"record":{"id":"fbec5636b2e5ee4b","repo":"larksuite/cli","slug":"failed-to-resolve-uat-for-user-identity-verificati","errorCode":null,"errorMessage":"failed to resolve UAT for user identity verification: %w","messagePattern":"failed to resolve UAT for user identity verification: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/credential/credential_provider.go","lineNumber":235,"sourceCode":"\t\treturn acct, nil\n\t}\n\treturn nil, core.NotConfiguredError()\n}\n\n// enrichUserInfo resolves user identity when extension provides a UAT.\n// If UAT is available, user_info API call is mandatory (security: verify token validity).\n// If no UAT from extension, falls back to provider-supplied OpenID.\nfunc (p *CredentialProvider) enrichUserInfo(ctx context.Context, acct *Account, source credentialSource) error {\n\tif p.httpClient == nil || source == nil {\n\t\treturn nil\n\t}\n\ttok, found, err := source.TryResolveToken(ctx, TokenSpec{Type: TokenTypeUAT, AppID: acct.AppID})\n\tif err != nil {\n\t\tvar blockErr *extcred.BlockError\n\t\tif errors.As(err, &blockErr) {\n\t\t\treturn nil // provider explicitly blocks UAT; skip enrichment\n\t\t}\n\t\treturn fmt.Errorf(\"failed to resolve UAT for user identity verification: %w\", err)\n\t}\n\tif !found {\n\t\treturn nil\n\t}\n\t// Have UAT — must verify and resolve identity\n\thc, err := p.httpClient()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get HTTP client for user_info: %w\", err)\n\t}\n\trequestCtx := core.WithCredentialSource(ctx, tok.Source)\n\tinfo, err := fetchUserInfo(requestCtx, hc, acct.Brand, tok.Token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to verify user identity: %w\", err)\n\t}\n\tacct.UserOpenId = info.OpenID\n\tacct.UserName = info.Name\n\treturn nil\n}","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/credential/credential_provider.go#L217-L253","documentation":"During account resolution the credential provider tries to obtain a User Access Token (UAT) from the active credential source in order to verify the user's identity (via the user_info endpoint). If the source returns any error other than an explicit extcred.BlockError, the failure is wrapped with this message and propagated from doResolveAccount, aborting account resolution. BlockError is treated as a benign skip; any other resolution failure is fatal.","triggerScenarios":"source.TryResolveToken(ctx, TokenSpec{Type: TokenTypeUAT, AppID: ...}) returns a non-nil error that is not *extcred.BlockError — e.g. the extension credential source fails to load, keychain/OS credential store access fails, or the source implementation itself errors while looking up the UAT.","commonSituations":"A credential extension/plugin is misconfigured or crashing; OS keychain locked or inaccessible (Linux without a secret service, SSH session without keyring); stale extension registration pointing at a removed backend.","solutions":["Check the wrapped cause (%w) to identify which credential source failed and fix that backend (start/re-authenticate the extension, unlock the OS keychain)","If the extension intentionally should not supply UATs, fix it to return extcred.BlockError so enrichment is skipped instead of failing","Remove or re-register the broken credential source, or fall back to a working auth mode (e.g. re-run the auth/login flow) and retry"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// Verify the credential source is healthy before account resolution\n_, _, err := source.TryResolveToken(ctx, credential.TokenSpec{Type: credential.TokenTypeUAT, AppID: acct.AppID})\nif err != nil && !isBlockError(err) {\n\treturn fmt.Errorf(\"UAT source unhealthy: %w\", err)\n}","typeGuard":"func isBlockError(err error) bool {\n\tvar be *extcred.BlockError\n\treturn errors.As(err, &be)\n}","tryCatchPattern":"if err := provider.ResolveAccount(ctx); err != nil {\n\tvar blockErr *extcred.BlockError\n\tif errors.As(err, &blockErr) {\n\t\t// source intentionally blocks UAT — proceed without user identity\n\t} else {\n\t\treturn fmt.Errorf(\"cannot resolve account: %w\", err)\n\t}\n}","preventionTips":["Keep credential extensions updated and registered correctly","Ensure the OS keychain/secret service is running and unlocked before running commands","Treat extcred.BlockError as a normal skip signal in custom sources"],"tags":["auth","uat","credential-source"],"backgroundTag":"uat-resolution-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}