openclaw - 💡(How to fix) Fix [openclaw-lark] Owner-only restriction on OAuth and User API prevents multi-user deployment [1 comments, 1 participants]

Summary

The openclaw-lark plugin restricts Feishu (Lark) User Access Token (UAT) operations to only the App Owner. This means in a multi-user deployment where the bot serves an entire organization, non-owner employees cannot:

1. Initiate OAuth authorization — oauth.js checks assertOwnerAccessStrict() and returns permission_denied for non-owners
2. Call any Feishu user API — tool-client.js calls assertOwnerAccessStrict() in invokeAsUser(), blocking all UAT-based tools (calendar, tasks, bitable, IM, etc.) for non-owner users

Current Behavior

oauth.js (executeAuthorize)

await assertOwnerAccessStrict(account, sdk, senderOpenId);
// Non-owner → returns { error: "permission_denied", message: "当前应用仅限所有者（App Owner）使用" }

tool-client.js (invokeAsUser)

await assertOwnerAccessStrict(this.account, this.sdk, userOpenId);
// Non-owner → throws, blocking all user-scoped Feishu API calls

Expected Behavior

The owner check should be configurable rather than hardcoded as fail-close. In many legitimate deployments:

• The Feishu app is created by an admin but used by all employees
• Each employee authorizes their own OAuth token — the owner check is unnecessary since users can only access their own data via UAT
• The security model should rely on OAuth scopes and user consent, not on an app-owner gate

Suggested Fix

Add a configuration option to disable the owner check, e.g.:

# openclaw config or lark plugin config
lark:
  ownerOnly: false  # default: true for backward compatibility

Or at minimum, an environment variable:

OPENCLAW_LARK_OWNER_ONLY=false

When disabled, any user who completes OAuth should be able to use all UAT-scoped Feishu tools.

Workaround

Currently requires manually patching two source files in openclaw-lark/src/ after every plugin update:

1. src/tools/oauth.js — remove the assertOwnerAccessStrict try/catch block
2. src/core/tool-client.js — comment out assertOwnerAccessStrict call

Then restart the gateway. This is fragile and breaks on updates.

Labels

This is specific to the openclaw-lark plugin (Feishu/Lark integration).