3 commits

Author	SHA1	Message	Date
Rayan Salhab	3551c1ba8e	🪧 fix: Guard Admin OAuth Routes When Providers Are Not Configured (#14507) ... * fix: guard admin OpenID routes without config * fix: guard remaining admin SSO routes without registered strategy --------- Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com> Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-01 14:46:17 -04:00
Cha	73c43ded25	💂 fix: Enforce ALLOW_EMAIL_LOGIN on the Backend Login Route (#14180) ... * 🔒 fix: Enforce ALLOW_EMAIL_LOGIN on Backend Login Route ALLOW_EMAIL_LOGIN=false previously only hid the login form; POST /api/auth/login stayed mounted and accepted valid credentials. Add a validateEmailLogin middleware (mirroring validateRegistration / validatePasswordReset) that rejects login with 403 when the flag is disabled, with an ALLOW_EMAIL_LOGIN_OVERRIDE escape hatch for intentional direct API login (each use logged with request IP). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: Gate admin local login by email login flag * fix: Move email login gate into api package * test: Avoid mutating readonly request ip --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Danny Avila <danny@librechat.ai>	2026-07-09 09:55:36 -04:00
Danny Avila	0a7255b234	🎭 feat: Support OpenID Audience On Refresh Grants (#13077)	2026-05-11 17:40:30 -04:00