Introduction

The DeepSeek Harness Web GUI is suitable for local or internal use. When the same Web GUI is accessed by multiple users, two specific problems need to be addressed: where the visitor’s identity comes from, and which sessions each user can see.

dsh-lark-web-auth is designed for this scenario. It adds Feishu OAuth login to the DeepSeek Harness Web GUI and performs session isolation based on open_id. It belongs to the DSH community plugin ecosystem; the DSH community directory is an independent site with no official affiliation with DeepSeek / Fenxiang.

Overview

dsh-lark-web-auth is a DeepSeek Harness plugin maintained by Awesome-AI-Pedia under the MIT license.

Its positioning is: to add Feishu login to the DeepSeek Harness Web GUI and ensure each user can only see, access, and modify their own session.

It can be used independently for web-side login only, without interacting with Feishu bots; it can also be used in conjunction with dsh-lark-link to automatically make Feishu bot sessions visible to users after they log into the webpage.

Core Features

  • Feishu OAuth Login: Automatically redirects unauthenticated users to Feishu authorization, and writes an httpOnly cookie upon callback.
  • Session Isolation: Each session_id belongs to one open_id; users can only see, access, and modify their own session.
  • Non-leakage of existence: Requests by non-owners uniformly return 404.
  • Login state persistence: Uses SQLite for storage, so the session remains active after process restarts.
  • Zero frontend source code modification: Injects a small UI via webServer.tapIndex().
  • Backfilling existing sessions: Scans sessions with the dm:* prefix on first startup, looks up chat_id to open_id via the Feishu API, and writes them to the ownership table.
  • Integration with dsh-lark-link: Makes Feishu bot sessions automatically visible to users after they log in to the webpage.

How Isolation Works

The isolation method is explained below based on the request chain.

  1. HTTP Layer: All /api/* requests pass through middleware to validate the cookie; unauthenticated requests return 401.
  2. RPC Layer: The typert agent / session lookup is wrapped. The openId in the request context must equal the record in the session_owner table.
  3. List Layer: The return value of the session.list API is filtered, keeping only items where the owner matches.
  4. New sessions: Listens to the session/created event, writing the openId from the request context to session_owner. dm:* prefix dsh-lark-link sessions look up open_id via chat_id.

Installation and Enablement

First, install the plugin:

dsh plugin --profile web add dsh-lark-web-auth

The plugin runs with the permissions of the current dsh process; you should check the source code and MIT license before installing.

This plugin must be loaded after api-remotes; otherwise, the typert lookup override may fail.

Configuration

The following required environment variables need to be set:

LARK_WEB_APP_ID
LARK_WEB_APP_SECRET
LARK_WEB_BASE_URL
LARK_WEB_COOKIE_SECRET

Among them, LARK_WEB_COOKIE_SECRET requires a 32+ byte random string. Rotating this value will kick all users offline.

The following are optional environment variables:

LARK_WEB_AUTH_ENABLED
LARK_WEB_DB_PATH
LARK_WEB_DOMAIN
  • LARK_WEB_AUTH_ENABLED=false can be used to temporarily disable it.
  • LARK_WEB_DB_PATH defaults to ~/.dsh/lark-web-auth.sqlite.
  • LARK_WEB_DOMAIN can be set to feishu or lark.

Feishu Open Platform Settings

Complete the following settings in a self-built application on the Feishu Open Platform.

  1. Add the homepage address:
https://web.yourdomain.com
  1. Configure the Redirect URL in security settings:
https://web.yourdomain.com/auth/lark/callback
  1. Enable the following in permission management:
contact:user.base:readonly

Here, web.yourdomain.com is a sample domain; replace it with the actual public or intranet domain.

Deployment Example

Below is a Caddy example that reverse proxies a domain to the local 3080 port:

web.yourdomain.com {
    reverse_proxy localhost:3080
}

Set environment variables before starting, then start the Web profile:

export LARK_WEB_APP_ID=cli_xxxxx
export LARK_WEB_APP_SECRET=xxxxx
export LARK_WEB_BASE_URL=https://web.yourdomain.com
export LARK_WEB_COOKIE_SECRET=$(openssl rand -base64 32)
dsh --profile web

cli_xxxxx, xxxxx, and web.yourdomain.com in the example all need to be replaced with actual values.

Suitable Scenarios and Limitations

This plugin is suitable for scenarios where Feishu identity login is needed for the DeepSeek Harness Web GUI, and for internal deployments with single-machine, multi-user isolation.

The following limitations should be noted:

  • Single-machine SQLite storage does not support multi-instance deployment; the README states it is sufficient for up to 100 users.
  • Backfilling of existing data is best-effort. If the Feishu API fails to look up chat_id to open_id, the session will remain in a state with no owner, invisible to anyone, and requires manual assignment.
  • Team/group session sharing is not supported; one session can only belong to one person.
  • Audit logs are not implemented (i.e., it is not recorded who viewed whose session).
  • After LARK_WEB_COOKIE_SECRET is rotated, all users will be kicked offline.
  • The plugin must be loaded after api-remotes.

Conclusion

The value of dsh-lark-web-auth lies in: using Feishu OAuth as the web login method and isolating DeepSeek Harness sessions by user. It does not modify frontend source code, and configuration is centralized in environment variables; it can be used standalone or in combination with dsh-lark-link.

GitHub Repository: https://github.com/Awesome-AI-Pedia/dsh-lark-web-auth

The Community Directory page URL was not provided in the verified materials; you can search for dsh-lark-web-auth in the DSH Community Directory.