CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-10-08 22:41:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

🔑 feat: Refresh-Capable Google Admin OAuth Sessions

Browse source 
Google admin sessions cannot be refreshed today. Three gaps add up to that:
passport.authenticate('googleAdmin', ...) in api/server/routes/admin/auth.js
never sets access_type=offline, so Google omits the refresh_token from its
token response; createOAuthHandler in api/server/controllers/auth/oauth.js
only forwards a refresh token into the admin exchange payload when the user's
provider is 'openid' AND OPENID_REUSE_TOKENS is enabled; and
/api/admin/oauth/refresh is openid-only, calling openid-client.refreshTokenGrant
against the configured OIDC issuer. OpenID admins refresh transparently
because all three are in place for them.

This PR closes all three. The googleAdmin authenticate call now passes
accessType: 'offline' and prompt: 'consent' so Google issues a refresh token
on consent; the chat-side googleLogin is untouched. The shared socialLogin
verify callback now passes the IdP refreshToken through as passport's third
argument (info), landing on req.authInfo, with the two-argument call shape
preserved when no refresh token is present so existing strategy tests stay
valid. createOAuthHandler reads req.authInfo?.refreshToken for non-OpenID
admin providers and forwards it into the exchange code; the OpenID branch
and its OPENID_REUSE_TOKENS gate are unchanged. /api/admin/oauth/refresh
now accepts an optional provider field ('openid' | 'google', default 'openid').
The new Google branch POSTs grant_type=refresh_token to
https://oauth2.googleapis.com/token, decodes the returned id_token for the sub
claim, looks up the admin user by googleId, enforces tenant scope and
ACCESS_ADMIN, and mints a fresh LibreChat JWT in the same response shape
/oauth/exchange returns. It is gated on GOOGLE_CLIENT_ID and
GOOGLE_CLIENT_SECRET being set (returns 503 GOOGLE_NOT_CONFIGURED otherwise);
unknown provider values return 400 INVALID_PROVIDER.
This commit is contained in:
Dustin Healy 2026-06-18 07:54:30 -07:00
parent 9de3249e9c
commit d40c51616e
6 changed files with 524 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

14
api/server/controllers/auth/oauth.js
View file

@ -43,11 +43,15 @@ function createOAuthHandler(redirectUri = domains.client) {
const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
const token = await generateToken(req.user, sessionExpiry);
/** Get refresh token from tokenset for OpenID users */
const refreshToken =
req.user.provider === 'openid' && isEnabled(process.env.OPENID_REUSE_TOKENS) === true
? req.user.tokenset?.refresh_token || req.user.federatedTokens?.refresh_token
: undefined;
let refreshToken;
if (req.user.provider === 'openid') {
if (isEnabled(process.env.OPENID_REUSE_TOKENS) === true) {
refreshToken =
req.user.tokenset?.refresh_token || req.user.federatedTokens?.refresh_token;
}
} else {
refreshToken = req.authInfo?.refreshToken;
}
const expiresAt = Date.now() + sessionExpiry;
const callbackUrl = new URL(redirectUri);