From 5fa35c7660878136db232f47edaec53297dc771a Mon Sep 17 00:00:00 2001 From: "J.C. Bartle" Date: Wed, 24 Jun 2026 15:46:23 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=A6=20test:=20Exclude=20RefreshTokenBr?= =?UTF-8?q?idge=20from=20tenant-isolation=20coverage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add RefreshTokenBridge to the tenant-isolation coverage allowlist because refresh bridge lookups run during unauthenticated OpenID refresh recovery. The controller first recovers user context from the signed OpenID marker cookie, then the bridge methods apply explicit user and tenant filters. Ambient tenant isolation would bind this recovery path to request-local tenant context that is not available at the point the stale cookie is being resolved --- .../models/plugins/tenantIsolation.coverage.spec.ts | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts index 6f318abe10..3af1e34b79 100644 --- a/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts +++ b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts @@ -15,10 +15,17 @@ const TENANT_ISOLATION_APPLIED = Symbol.for('librechat:tenantIsolation'); * status rows and tenant-scoped override rows, so its methods apply explicit * tenant filters instead of ambient ALS scoping. AuditLog composes its tenant * filter from the JWT-resolved caller and uses `{ tenantId: { $exists: false } }` - * for platform-level entries. Adding an entry here must be a deliberate, - * reviewed decision — that is the whole point of this guard. + * for platform-level entries. RefreshTokenBridge resolves tenant context from + * the signed OpenID marker cookie during unauthenticated refresh recovery, and + * its methods apply explicit tenant filters. Adding an entry here must be a + * deliberate, reviewed decision — that is the whole point of this guard. */ -const MANUAL_TENANT_SCOPING = new Set(['SystemGrant', 'SkillSyncStatus', 'AuditLog']); +const MANUAL_TENANT_SCOPING = new Set([ + 'SystemGrant', + 'SkillSyncStatus', + 'AuditLog', + 'RefreshTokenBridge', +]); function isPluginApplied(schema: mongoose.Schema): boolean { return (schema as unknown as { [key: symbol]: boolean })[TENANT_ISOLATION_APPLIED] === true;