CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-09-09 16:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

📦 test: Exclude RefreshTokenBridge from tenant-isolation coverage

Browse source 
Add RefreshTokenBridge to the tenant-isolation coverage allowlist because
refresh bridge lookups run during unauthenticated OpenID refresh recovery.
The controller first recovers user context from the signed OpenID marker
cookie, then the bridge methods apply explicit user and tenant filters.

Ambient tenant isolation would bind this recovery path to request-local
tenant context that is not available at the point the stale cookie is being
resolved
This commit is contained in:
J.C. Bartle 2026-06-24 15:46:23 -04:00
parent 9bb146cfe7
commit 5fa35c7660
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
View file

@ -15,10 +15,17 @@ const TENANT_ISOLATION_APPLIED = Symbol.for('librechat:tenantIsolation');
* status rows and tenant-scoped override rows, so its methods apply explicit
* tenant filters instead of ambient ALS scoping. AuditLog composes its tenant
* filter from the JWT-resolved caller and uses `{ tenantId: { $exists: false } }`
* for platform-level entries. Adding an entry here must be a deliberate,
* reviewed decision — that is the whole point of this guard.
* for platform-level entries. RefreshTokenBridge resolves tenant context from
* the signed OpenID marker cookie during unauthenticated refresh recovery, and
* its methods apply explicit tenant filters. Adding an entry here must be a
* deliberate, reviewed decision — that is the whole point of this guard.
*/
const MANUAL_TENANT_SCOPING = new Set<string>(['SystemGrant', 'SkillSyncStatus', 'AuditLog']);
const MANUAL_TENANT_SCOPING = new Set<string>([
'SystemGrant',
'SkillSyncStatus',
'AuditLog',
'RefreshTokenBridge',
]);
function isPluginApplied(schema: mongoose.Schema): boolean {
return (schema as unknown as { [key: symbol]: boolean })[TENANT_ISOLATION_APPLIED] === true;