CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-08-04 14:57:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

🔐 feat: Mint Code API Auth Tokens (#13028)

Browse source 
* feat: Mint CodeAPI auth tokens

* style: Format CodeAPI download route

* fix: Prune CodeAPI token cache

* fix: Propagate CodeAPI managed auth

* test: Mock CodeAPI auth in traversal suite

* fix: Pass auth context to invoked skill cache

* feat: Mint CodeAPI plan context

* chore: Refresh CodeAPI auth guidance

* fix: Guard OpenID JWT fallback

* fix: Default CodeAPI JWT tenant in single-tenant mode

* chore: Update @librechat/agents to version 3.1.84 in package-lock.json and package.json files

* chore: Standardize references to Code API in comments and tests
This commit is contained in:
Danny Avila 2026-05-09 16:09:10 -04:00 • committed by GitHub
parent 8a654dc8b1
commit c67e2b54dc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
23 changed files with 973 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

39
api/server/middleware/requireJwtAuth.js
View file

@ -2,6 +2,9 @@ const cookies = require('cookie');
const passport = require('passport');
const { isEnabled, tenantContextMiddleware } = require('@librechat/api');
const hasPassportStrategy = (strategy) =>
typeof passport._strategy === 'function' && passport._strategy(strategy) != null;
/**
* Custom Middleware to handle JWT authentication, with support for OpenID token reuse.
* Switches between JWT and OpenID authentication based on cookies and environment settings.
@ -13,17 +16,35 @@ const { isEnabled, tenantContextMiddleware } = require('@librechat/api');
const requireJwtAuth = (req, res, next) => {
const cookieHeader = req.headers.cookie;
const tokenProvider = cookieHeader ? cookies.parse(cookieHeader).token_provider : null;
const openidReuseEnabled = isEnabled(process.env.OPENID_REUSE_TOKENS);
const openidJwtAvailable = openidReuseEnabled && hasPassportStrategy('openidJwt');
const strategies =
tokenProvider === 'openid' && openidJwtAvailable
? ['openidJwt', 'jwt']
: ['jwt', ...(openidJwtAvailable ? ['openidJwt'] : [])];
const strategy =
tokenProvider === 'openid' && isEnabled(process.env.OPENID_REUSE_TOKENS) ? 'openidJwt' : 'jwt';
const authenticateWithStrategy = (index) => {
const strategy = strategies[index];
passport.authenticate(strategy, { session: false }, (err, user, info, status) => {
if (err) {
return next(err);
}
if (!user) {
if (index + 1 < strategies.length) {
return authenticateWithStrategy(index + 1);
}
return res.status(status || 401).json({
message: info?.message || 'Unauthorized',
});
}
req.user = user;
req.authStrategy = strategy;
// req.user is now populated by passport — set up tenant ALS context
tenantContextMiddleware(req, res, next);
})(req, res, next);
};
passport.authenticate(strategy, { session: false })(req, res, (err) => {
if (err) {
return next(err);
}
// req.user is now populated by passport — set up tenant ALS context
tenantContextMiddleware(req, res, next);
});
authenticateWithStrategy(0);
};
module.exports = requireJwtAuth;