IRON LAW: Every API call requires a valid browser Cookie with X-XSRF-TOKEN. Auth failures return 301/302 redirects, not 401 — always check for redirects before parsing response JSON.

DingTalk Document API Guide

Portal: https://alidocs.dingtalk.com

Programmatic read access to DingTalk native documents via cookie-based session auth and internal endpoints reverse-engineered from the web frontend. No stable public OpenAPI covers these paths.

Workflow

1. ⛔ BLOCKING Authenticate → obtain cookie via manual extraction from browser → verify: XSRF-TOKEN present in cookie string
2. ⚠️ REQUIRED Create client → async with DingTalkClient(cookie) as client → verify: no DingTalkAuthError on first call
3. ⚠️ REQUIRED Navigate → extract space/node ID from URL → list children or get node info → verify: API returns isSuccess: true
4. ⚠️ REQUIRED Read/Download → branch by extension:
   • adoc → get_document_data() + extract_text_from_alidocs() for text; (conditional) export_to_pdf() if PDF output is needed
   • (conditional) dlink/hlink → resolve_external_link() first, then treat target as regular node
   • other → download_file() (validates extension against DOWNLOADABLE_EXTENSIONS)
5. (conditional) Cleanup → client auto-closes via async with; manual aclose() if not using context manager