From 3ed1d5f9d89f1bf0017727f0d13371550233ccc2 Mon Sep 17 00:00:00 2001
From: badgerbees <93577481+badgerbees@users.noreply.github.com>
Date: Wed, 5 Aug 2026 23:02:41 +0700
Subject: [PATCH] fix(feishu): harden API client with defensive HTTP status
 checks (#407)

- Check resp.StatusCode range (2xx) before JSON decoding
- Provide clear actionable errors with HTTP status codes for 5xx failures
- Prevent cryptic JSON parse errors from HTML error pages
---
 internal/channels/feishu/larkclient.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/internal/channels/feishu/larkclient.go b/internal/channels/feishu/larkclient.go
index 0e58bfb3..1628b39f 100644
--- a/internal/channels/feishu/larkclient.go
+++ b/internal/channels/feishu/larkclient.go
@@ -68,6 +68,10 @@ func (c *LarkClient) getToken(ctx context.Context) (string, error) {
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("lark token request failed with HTTP %d", resp.StatusCode)
+	}
+
 	var result struct {
 		Code              int    `json:"code"`
 		Msg               string `json:"msg"`
@@ -150,6 +154,10 @@ func (c *LarkClient) doJSONOnce(ctx context.Context, method, path string, body a
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("lark api %s %s: failed with HTTP %d", method, path, resp.StatusCode)
+	}
+
 	var result apiResponse
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, fmt.Errorf("lark api decode: %w", err)
@@ -176,6 +184,10 @@ func (c *LarkClient) doDownload(ctx context.Context, path string) ([]byte, strin
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, "", fmt.Errorf("lark download %s: failed with HTTP %d", path, resp.StatusCode)
+	}
+
 	// Check for JSON error response
 	ct := resp.Header.Get("Content-Type")
 	if ct != "" {
@@ -244,6 +256,10 @@ func (c *LarkClient) doMultipart(ctx context.Context, path string, fields map[st
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("lark upload %s: failed with HTTP %d", path, resp.StatusCode)
+	}
+
 	var result apiResponse
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, fmt.Errorf("lark upload decode: %w", err)