mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-05-13 16:07:30 +00:00
* Remote Agent Auth middleware * consider migration and update user * fix eslint errors * add scope validation * fix codex review errors * add filter for use: sig * add jwks-rsa deps * Fix remote agent OIDC auth review findings * Polish remote agent OIDC timeout coverage * Reject remote OIDC tokens without subject * Use tenant context for remote agent auth config * Harden remote agent OIDC scope handling * Polish remote agent OIDC cache and scope tests * Resolve remote agent auth review comments * Reuse OpenID email claim resolver for remote auth * Skip empty OpenID email fallback claims * Use pre-auth tenant context for remote auth config * Downgrade expected OIDC fallback logging * Require secure remote OIDC endpoints * Polish remote agent auth edge cases * Enforce unique balance records * Bind remote OpenID users to issuer * Fix issuer-scoped OpenID indexes * Avoid unique balance index requirement * Fix remote OpenID issuer normalization boundaries * Require issuer-bound OpenID lookups * Enforce tenant API key policy after auth * Fix remote auth tenant policy types * Normalize remote OIDC discovery issuer * Allow normalized remote OIDC issuer validation * Enforce resolved tenant OIDC policy * Polish OpenID issuer and scope validation --------- Co-authored-by: Danny Avila <danny@librechat.ai>
41 lines
1.1 KiB
JavaScript
41 lines
1.1 KiB
JavaScript
const { PermissionTypes, Permissions } = require('librechat-data-provider');
|
|
const {
|
|
generateCheckAccess,
|
|
preAuthTenantMiddleware,
|
|
createRequireApiKeyAuth,
|
|
createRemoteAgentAuth,
|
|
createCheckRemoteAgentAccess,
|
|
} = require('@librechat/api');
|
|
const { getEffectivePermissions } = require('~/server/services/PermissionService');
|
|
const { getAppConfig } = require('~/server/services/Config');
|
|
const db = require('~/models');
|
|
|
|
const apiKeyMiddleware = createRequireApiKeyAuth({
|
|
validateAgentApiKey: db.validateAgentApiKey,
|
|
findUser: db.findUser,
|
|
});
|
|
|
|
const requireRemoteAgentAuth = createRemoteAgentAuth({
|
|
apiKeyMiddleware,
|
|
findUser: db.findUser,
|
|
updateUser: db.updateUser,
|
|
getAppConfig,
|
|
});
|
|
|
|
const checkRemoteAgentsFeature = generateCheckAccess({
|
|
permissionType: PermissionTypes.REMOTE_AGENTS,
|
|
permissions: [Permissions.USE],
|
|
getRoleByName: db.getRoleByName,
|
|
});
|
|
|
|
const checkAgentPermission = createCheckRemoteAgentAccess({
|
|
getAgent: db.getAgent,
|
|
getEffectivePermissions,
|
|
});
|
|
|
|
module.exports = {
|
|
checkAgentPermission,
|
|
preAuthTenantMiddleware,
|
|
requireRemoteAgentAuth,
|
|
checkRemoteAgentsFeature,
|
|
};
|