diff --git a/README.md b/README.md index 4079033..32637a7 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ flashduty integration list --fields integration_id,name,plugin_type flashduty channel integration-list --channel-id 20001 --fields integration_id,channel_id,name,plugin_type ``` -Public integrations require integration permissions; dedicated integrations require channel permissions and access to the owning channel. Choose by ownership, not by the numeric ID. Both use the management App Key, and a permission failure never switches command families. The bundled Agent Skill explains selection, discovery, and confirmed changes. +Public integration instances require integration permissions. Dedicated reads accept Channels Read, Channels Manage, or Integrations Read and require visibility of the owning channel; dedicated writes require Channels Manage and management access to that channel. The shared `integration type-list` catalog accepts these three read permissions; scoped App Keys must allow `integration.api:read:typeList`. Choose by ownership, not by the numeric ID. Both use the management App Key, and a permission failure never switches command families. The bundled Agent Skill explains selection, discovery, and confirmed changes. ### Request bodies diff --git a/README_zh.md b/README_zh.md index 4932005..a0635e0 100644 --- a/README_zh.md +++ b/README_zh.md @@ -90,7 +90,7 @@ flashduty integration list --fields integration_id,name,plugin_type flashduty channel integration-list --channel-id 20001 --fields integration_id,channel_id,name,plugin_type ``` -公共集成需要集成中心权限；专属集成需要协作空间权限以及对目标空间的访问或管理权限。按实际归属选择，不能只凭数字 ID 判断类型。两类命令均使用管理用的 App Key，权限失败时不会自动切换接口。随 CLI 分发的 Agent Skill 提供类型选择、查询和经确认后修改配置的指引。 +公共集成实例需要集成中心权限。专属集成读取允许协作空间查看、协作空间管理或集成中心查看权限，同时要求目标空间可见；写入须有协作空间管理权限以及目标空间的管理资格。共用的 `integration type-list` 类型目录允许这三项读取权限；限制了接口范围的 App Key 须允许 `integration.api:read:typeList`。按实际归属选择，不能只凭数字 ID 判断类型。两类命令均使用管理用的 App Key，权限失败时不会自动切换接口。随 CLI 分发的 Agent Skill 提供类型选择、查询和经确认后修改配置的指引。 ### 请求体 diff --git a/go.mod b/go.mod index 94f025c..2421d6a 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli go 1.26.0 require ( - github.com/flashcatcloud/go-flashduty v0.15.21 + github.com/flashcatcloud/go-flashduty v0.15.22 github.com/mattn/go-runewidth v0.0.30 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 diff --git a/go.sum b/go.sum index 1add092..1e03545 100644 --- a/go.sum +++ b/go.sum @@ -1,8 +1,8 @@ github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY= github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/flashcatcloud/go-flashduty v0.15.21 h1:GLXsWw55BKm0xodjnYrA4Q32G5nmCm6PW+qkVLZPT8M= -github.com/flashcatcloud/go-flashduty v0.15.21/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= +github.com/flashcatcloud/go-flashduty v0.15.22 h1:blLlBLFzZxhjGzma9u7l3kZBWjmNTM5tg9FJdKkd9Lg= +github.com/flashcatcloud/go-flashduty v0.15.22/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk= diff --git a/skills/flashduty/reference/integration.md b/skills/flashduty/reference/integration.md index e985b27..e0da1ff 100644 --- a/skills/flashduty/reference/integration.md +++ b/skills/flashduty/reference/integration.md @@ -7,12 +7,14 @@ Prereq: read `SKILL.md`. Choose the command family from the integration's owners | User intent or existing ownership | Command family | Permission boundary | |---|---|---| | Public integration managed in the integration center; shared ingestion connected to channels through subscriptions or routing | `integration *` | Integrations Read/Manage plus the integration's object permissions | -| Dedicated alert integration owned by one collaboration space (协作空间专属集成) | `channel integration-*` | Channels Read/Manage plus visibility or management of the owning channel; no integration-center permission required | +| Dedicated alert integration owned by one collaboration space (协作空间专属集成) | `channel integration-*` | Reads: Channels Read/Manage or Integrations Read plus channel visibility. Writes: Channels Manage plus channel management access | For an existing integration, use its known ownership; an ID alone does not identify the scope. A target channel receiving alerts does not by itself mean the integration is dedicated: public integrations can also route there. For creation, use a dedicated integration when ingestion belongs to that one channel, or a public integration when the user wants shared ingestion managed in the integration center. If ownership or intended scope is unclear, ask before creating or changing configuration. Never retry a failed call through the other integration family, including on access denied or not found. Public does not mean anonymous: both families use the management App Key and its owner's permissions. An integration key is a separate credential for inbound events. +`integration type-list` is a shared catalog for both families. It accepts Channels Read, Channels Manage, or Integrations Read. Scoped App Keys must allow `integration.api:read:typeList`; a `channel.integration:*:*` scope does not include this endpoint. Catalog access does not grant access to public integration instances. + ## Public integrations ### Read before changing configuration