CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-09-13 01:51:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

🌉 Persist OIDC refresh-token recovery bridges in MongoDB

Browse source 
Store SSE OBO refresh-token recovery bridges in MongoDB instead of
process-local memory so /api/auth/refresh can recover after worker
restarts or cross-worker routing.

Derive bridge expiry from REFRESH_TOKEN_EXPIRY so the recovery window
matches the stale refreshToken cookie it repairs, and delete bridges
after successful recovery.
This commit is contained in:
J.C. Bartle 2026-06-23 17:19:57 -04:00
parent 13d118a2ea
commit 164ebaf09d
13 changed files with 469 additions and 223 deletions
Download patch file Download diff file Expand all files Collapse all files

6
api/server/controllers/AuthController.js
View file

@ -334,7 +334,11 @@ const refreshController = async (req, res) => {
existingRefreshToken: bridgedRefreshToken,
tenantId: retryUser.tenantId,
});
deleteRefreshTokenBridge({ oldRefreshToken: refreshToken });
await deleteRefreshTokenBridge({
oldRefreshToken: refreshToken,
userId,
tenantId: bridgeUser.tenantId,
});
return res
.status(200)
.send({ token, user: sanitizeUserForAuthResponse(retryUser) });

6
api/server/controllers/AuthController.spec.js
View file

@ -770,7 +770,11 @@ describe('refreshController – OpenID path', () => {
existingRefreshToken: 'bridged-refresh',
tenantId: undefined,
});
expect(deleteRefreshTokenBridge).toHaveBeenCalledWith({ oldRefreshToken: 'stored-refresh' });
expect(deleteRefreshTokenBridge).toHaveBeenCalledWith({
oldRefreshToken: 'stored-refresh',
userId: 'user-db-id',
tenantId: 'tenant-1',
});
expect(res.status).toHaveBeenCalledWith(200);
});