CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-08-04 14:57:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

🏣 fix: Reject System Tenant In Auth Context (#13278)

Browse source
This commit is contained in:
Danny Avila 2026-05-23 16:55:32 -04:00 • committed by GitHub
parent 5071b2b617
commit 1693b586d4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 25 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
packages/api/src/middleware/__tests__/tenant.spec.ts
View file

@ -168,6 +168,20 @@ describe('tenantContextMiddleware', () => {
expect(tenantId).toBe('tenant-y');
});
it('rejects a normalized system tenant sentinel for authenticated requests', async () => {
const req = mockReq({ tenantId: ` ${SYSTEM_TENANT_ID} `, role: 'user' });
const res = mockRes();
const next: NextFunction = jest.fn();
await tenantContextMiddleware(req, res, next);
expect(res.status).toHaveBeenCalledWith(403);
expect(res.json).toHaveBeenCalledWith({
error: 'System tenant is not allowed for request-scoped routes',
});
expect(next).not.toHaveBeenCalled();
});
it('different requests get independent tenant contexts', async () => {
const runRequest = (tid: string) => {
const req = mockReq({ tenantId: tid, role: 'user' });

14
packages/api/src/middleware/tenant.ts
View file

@ -20,6 +20,7 @@ type ContextRequest = {
};
const REQUEST_ID_HEADERS = ['x-request-id', 'x-correlation-id'] as const;
const SYSTEM_TENANT_REJECTION_MESSAGE = 'System tenant is not allowed for request-scoped routes';
let _checkedThread = false;
@ -119,14 +120,21 @@ export function tenantContextMiddleware(
const user = req.user;
const context = buildTenantContext(req);
const { tenantId } = context;
if (tenantId === SYSTEM_TENANT_ID) {
logger.warn('[tenantContextMiddleware] Rejected system tenant for request route', {
path: req.path,
});
res.status(403).json({ error: SYSTEM_TENANT_REJECTION_MESSAGE });
return;
}
if (!user) {
runWithTenantContext(context, next);
return;
}
const { tenantId } = context;
if (!tenantId) {
if (isStrict()) {
res.status(403).json({ error: 'Tenant context required in strict isolation mode' });
@ -255,7 +263,7 @@ export function restoreTenantContextFromReq(
return rejectRequestWithUploadCleanup(
req,
res,
'System tenant is not allowed for request-scoped routes',
SYSTEM_TENANT_REJECTION_MESSAGE,
);
}