fix: preserve original filename in multipart file upload

[zhaojunlin0405]

Summary

lark-cli api --file <path> built every multipart file part with a hardcoded
unknown-file name, because the local-file branch handed the SDK a bare
*bytes.Reader (which has no Name()). On the approval attachment upload
endpoint, the backend derives the attachment's display name from that part
filename, so approval attachments showed up as "unknown file" instead of e.g.
invoice.pdf. This is a shared-layer defect affecting all generic --file
uploads, not approval alone.

Changes

• Bump github.com/larksuite/oapi-sdk-go/v3 from v3.5.4 to v3.7.2 to get the
  filename-aware Formdata.AddFileWithName API. This bump spans two minors and
  also touches the SDK's token-signing path (tenant-token precedence, a new
  client-assertion mode, an added error return). Those are a no-op for this CLI:
  it builds its client with token caching disabled, no client-assertion
  provider, a single pinned access-token type, and an explicitly supplied token,
  so none of the changed branches are reached and the outbound Authorization
  header is byte-identical across the two SDK versions.
• In internal/cmdutil/BuildFormdata, the local-file branch now calls
  AddFileWithName(fieldName, filepath.Base(filePath), reader), so the
  multipart part carries the real basename. The stdin branch is unchanged
  (--file - keeps the unknown-file fallback — no stable local name).
• Add wire-level regression tests in cmd/api and cmd/service that parse the
  captured multipart body and assert the part filename (basename, field=path,
  --data coexistence, stdin fallback).

Test Plan

• go test ./internal/cmdutil ./cmd/api ./cmd/service — the new tests parse
  the captured multipart/form-data body and assert the Content-Disposition
  filename is the real basename (and unknown-file for stdin).
• go build ./..., go vet ./..., go mod tidy (no residual diff), and
  go-licenses check — all clean.
• End-to-end against a live approval backend: uploaded the same file with the
  pre-fix build and with this fix, then read back the created approval instance's
  attachment display name. Pre-fix build showed the attachment as unknown-file
  (reproducing the Approval attachment uploads lose filename and show as unknown file #729 symptom); this fix showed the original filename.
  Confirmed with a non-ASCII (CJK) filename, which is preserved byte-for-byte end
  to end.

Related Issues

Fixes #729

Summary by CodeRabbit

• Bug Fixes

  • File uploads now keep the original filename in multipart requests, instead of sending the full local path.
  • Uploads from stdin use a consistent fallback filename.
  • Combined file uploads and JSON form data are now sent together correctly in multipart requests.

• Tests

  • Added coverage for multipart upload behavior, including filename handling and mixed text/file form fields.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 058492d2-7af0-4fa8-a0da-e0b3228a9eb9

📥 Commits

Reviewing files that changed from the base of the PR and between b77e6cf and cc9f498.

📒 Files selected for processing (1)

• cmd/api/api_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• cmd/api/api_test.go

---

📝 Walkthrough

Walkthrough

BuildFormdata now uses the local file basename as the multipart filename for non-stdin uploads. The oapi-sdk-go dependency was updated, and multipart-focused tests were added in cmd/api and cmd/service to verify filename handling and form-field contents.

Changes

Filename preservation in multipart uploads

Layer / File(s)	Summary
BuildFormdata filename fix and dependency bump internal/cmdutil/fileupload.go, go.mod	Non-stdin uploads now use AddFileWithName with filepath.Base(filePath) to preserve the multipart filename; oapi-sdk-go/v3 was bumped from v3.5.4 to v3.7.2.
cmd/api multipart filename tests cmd/api/api_test.go	Adds a multipart parsing helper and tests for local filenames, basename extraction, --data text fields, and the stdin unknown-file fallback.
cmd/service multipart filename tests cmd/service/service_test.go	Adds a multipart parsing helper and a test confirming the uploaded image part keeps photo.jpg as its filename.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

• larksuite/cli#395: Both PRs modify multipart filename/metadata handling in BuildFormdata and the related upload tests.

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: preserving multipart upload filenames.
Description check	✅ Passed	The PR description includes the required Summary, Changes, Test Plan, and Related Issues sections and is mostly complete.
Linked Issues check	✅ Passed	The changes satisfy #729's filename-preservation goal by sending the real basename in uploads and adding regression tests.
Out of Scope Changes check	✅ Passed	The SDK bump and test additions are directly tied to the filename-preservation fix and do not appear unrelated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/upload-filename-lost

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.43%. Comparing base (047d729) to head (cc9f498).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1767      +/-   ##
==========================================
+ Coverage   74.39%   74.43%   +0.03%     
==========================================
  Files         860      860              
  Lines       89481    89754     +273     
==========================================
+ Hits        66571    66809     +238     
- Misses      17750    17765      +15     
- Partials     5160     5180      +20     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@cc9f4983bcf6c4bc032b31ed1882389bd557edcb

🧩 Skill update

npx skills add larksuite/cli#fix/upload-filename-lost -y -g