CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-08-03 22:32:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

📎 fix: Scope Attachment Usage to Request Owner (#13557)

Browse source 
* fix: harden attachment usage handling

* fix: sort file method imports

* fix: clarify file usage scope
This commit is contained in:
Danny Avila 2026-06-06 14:23:04 -04:00 • committed by GitHub
parent 3571dfcf22
commit 75bbefb1c8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 184 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
api/server/middleware/buildEndpointOption.js
View file

@ -132,7 +132,9 @@ async function buildEndpointOption(req, res, next) {
req.body.endpointOption = await builder(endpoint, parsedBody, endpointType);
if (req.body.files && !isAgents) {
req.body.endpointOption.attachments = updateFilesUsage(req.body.files);
req.body.endpointOption.attachments = updateFilesUsage(req.body.files, undefined, {
user: req.user.id,
});
}
next();

24
api/server/middleware/buildEndpointOption.spec.js
View file

@ -35,6 +35,7 @@ jest.mock('~/server/services/Endpoints/agents', () => ({
jest.mock('~/models', () => ({
updateFilesUsage: jest.fn(),
}));
const { updateFilesUsage } = require('~/models');
const mockGetEndpointsConfig = jest.fn();
jest.mock('~/server/services/Config', () => ({
@ -417,6 +418,29 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
expect(parsedResult.max_tokens).toBe(4096);
});
it('should scope non-agent chat attachment usage updates to the authenticated user', async () => {
const attachments = Promise.resolve([]);
updateFilesUsage.mockReturnValueOnce(attachments);
mockGetEndpointsConfig.mockResolvedValue({});
const req = createReq(
{
endpoint: EModelEndpoint.assistants,
assistant_id: 'asst_123',
files: [{ file_id: 'forged-file-id' }],
},
{ modelSpecs: null },
);
req.user = { id: 'user-1' };
await buildEndpointOption(req, createRes(), jest.fn());
expect(updateFilesUsage).toHaveBeenCalledWith(req.body.files, undefined, {
user: 'user-1',
});
expect(req.body.endpointOption.attachments).toBe(attachments);
});
it('should not enter the enforce branch when modelSpecs.list is empty', async () => {
mockGetEndpointsConfig.mockResolvedValue({});