fix: calendar_id validation rejects valid IDs with @ and . chars

src/feishu/tools/__tests__/validation.test.ts

@@ -18,6 +18,26 @@ describe('validateToken', () => {
   it('should reject empty string', () => {
     expect(() => validateToken('', 'test')).toThrow('无效的 test');
   });
+
+  it('should accept calendar_id with @, . and = characters', () => {
+    // Google Calendar IDs contain @ and .
+    expect(() => validateToken('user@gmail.com', 'calendar_id')).not.toThrow();
+    // Feishu shared calendar IDs may contain special chars
+    expect(() => validateToken('feishu.calendar_id+tag', 'calendar_id')).not.toThrow();
+    expect(() => validateToken('cal_abc=123:def', 'calendar_id')).not.toThrow();
+  });
+
+  it('should still reject path traversal in calendar_id', () => {
+    expect(() => validateToken('../etc/passwd', 'calendar_id')).toThrow('无效的 calendar_id');
+    expect(() => validateToken('abc/def', 'calendar_id')).toThrow('无效的 calendar_id');
+    expect(() => validateToken('abc def', 'calendar_id')).toThrow('无效的 calendar_id');
+  });
+
+  it('should still use strict validation for non-calendar tokens', () => {
+    // @ and . should be rejected for doc_token, folder_token, etc.
+    expect(() => validateToken('user@gmail.com', 'doc_token')).toThrow('无效的 doc_token');
+    expect(() => validateToken('has.dot', 'folder_token')).toThrow('无效的 folder_token');
+  });
 });
 
 describe('validateFieldsObject', () => {

src/feishu/tools/validation.ts

@@ -1,9 +1,19 @@
 /** 飞书资源 token 格式校验 (防止路径遍历/注入) */
 const TOKEN_RE = /^[A-Za-z0-9_-]+$/;
 
+/**
+ * 日历 ID 格式较特殊，允许 @.=+ 等字符（Google Calendar ID 形如 user@gmail.com）。
+ * 仍禁止 / \ .. 等路径遍历字符。
+ */
+const CALENDAR_ID_RE = /^[A-Za-z0-9_@.=+:-]+$/;
+
 export function validateToken(value: string, name: string): void {
-  if (!TOKEN_RE.test(value)) {
-    throw new Error(`无效的 ${name}: 仅允许字母、数字、下划线、横线`);
+  const re = name === 'calendar_id' ? CALENDAR_ID_RE : TOKEN_RE;
+  if (!re.test(value)) {
+    const allowed = name === 'calendar_id'
+      ? '仅允许字母、数字、下划线、横线、@、.、=、+、:'
+      : '仅允许字母、数字、下划线、横线';
+    throw new Error(`无效的 ${name}: ${allowed}`);
   }
 }