fix(calendar): support bot identity in +search-event

[FnExpress]

Summary

calendar +search-event rejects bot identity during local shortcut validation, even though the underlying Search Event API and the generated calendar events search_event command support bot access. This prevents agents from locating events in calendars accessible to the application, including events created and managed by the application itself.

Official API: https://open.larkoffice.com/document/server-docs/calendar-v4/calendar-event/search

Evidence

The generated command schema advertises both identities:

{
  "access_tokens": ["bot", "user"]
}

Before this change, the shortcut fails before making an API request:

$ lark-cli calendar +search-event --as bot --query "application-owned test event"
--as bot is not supported, this command only supports: user

The generated command succeeds with the same bot identity and returns an event created in the application's primary calendar:

$ lark-cli calendar events search_event --as bot --calendar-id primary \
    --data '{"query":"application-owned test event"}'
# success: the application-owned event is returned

After changing the shortcut identity declaration, a locally built CLI successfully finds the same event through calendar +search-event --as bot.

This isolates the failure to the shortcut's local AuthTypes declaration rather than the Open Platform API or application permissions.

Scope and permission boundary

This change does not expand calendar visibility. User identity continues to search calendars accessible to the user; bot identity searches only calendars accessible to the application. Bot identity does not automatically gain access to users' personal calendars.

Changes

• Allow calendar +search-event to run with user or bot identity.
• Clarify the identity-specific visibility boundary in the calendar Skill.
• Add a bot dry-run E2E contract test.
• Add a self-contained live E2E workflow: create an event as bot, find it with +search-event, then clean it up.
• Refresh the Calendar E2E command inventory and coverage metrics.

Test Plan

• make unit-test
• go vet ./...
• gofmt -l . produces no output
• go mod tidy produces no go.mod / go.sum changes
• golangci-lint --new-from-rev=origin/main reports 0 issues
• Bot dry-run E2E passes
• Manual live verification: bot creates an event; generated search finds it; patched shortcut finds the same event
• Live E2E automation requires tenant test credentials and was skipped locally; the self-contained workflow is included for CI

Related Issues

• None

Summary by CodeRabbit

• New Features

  • Enabled bot-authenticated callers to use the read-only calendar event search shortcut.
  • Clarified how search results differ between user and application identities.

• Tests

  • Added end-to-end coverage for bot-based dry runs and event search workflows.

• Documentation

  • Updated calendar CLI coverage metrics and command coverage details.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The calendar +search-event shortcut now permits bot authorization. Documentation clarifies identity-specific search scope, and end-to-end tests cover bot dry-run requests and event discovery workflows. Calendar coverage records are updated accordingly.

Changes

Calendar Search Event

Layer / File(s)	Summary
Search-event authorization and identity scope shortcuts/calendar/calendar_search_event.go, skills/lark-calendar/SKILL.md	The shortcut accepts both user and bot callers, and documentation distinguishes user calendar access from application-owned calendar access.
Bot search-event workflow coverage tests/cli_e2e/calendar/calendar_search_event_workflow_test.go, tests/cli_e2e/calendar/coverage.md	End-to-end tests validate bot dry-run payloads and polling-based event discovery; coverage totals and command tables are updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• larksuite/cli#528: Modifies the same calendar search-event E2E tests and coverage documentation.

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: enabling bot identity for +search-event.
Description check	✅ Passed	The description follows the template and includes summary, changes, test plan, and related issues, with sufficient verification detail.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}