mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-07-01 20:01:35 +00:00
bd158905b3
Post-identity-resolution ban check: the initial checkBan middleware fires before the
refresh token is exchanged and req.user is populated, so it can only evaluate IP bans.
After applyGoogleAdminRefresh/applyAdminRefresh resolves the user identity, we now
synthesize req.user and re-run checkBan against the resolved user's id before emitting
the JWT, so a user-level ban is enforced even from a fresh IP.
Domain allowlist now includes userId: the getAppConfig call in isEmailAllowedForUser
was passing only role, missing user and group-level allowedDomains overrides that the
initial OAuth callback's checkDomainAllowed enforces via userId. Both branches now
pass userId so buildPrincipals takes the full user+group+role resolution path. The
tenant branch is also inlined (replacing resolveAppConfigForUser) to accept userId,
wrapped in tenantStorage.run for correct Mongoose scoping and cache-key resolution.
Cross-tenant email-fallback migration: the Passport verify callback fires before
tenantContextMiddleware, so findUser({email}) is unscoped and can return a same-email
user from another tenant. Writing googleId onto that document permanently corrupts
the other tenant's account. Migration is now blocked for users with a tenantId;
single-tenant users are unaffected.
|
||
|---|---|---|
| .. | ||
| appleStrategy.js | ||
| appleStrategy.test.js | ||
| discordStrategy.js | ||
| facebookStrategy.js | ||
| githubStrategy.js | ||
| googleStrategy.js | ||
| index.js | ||
| jwtStrategy.js | ||
| ldapStrategy.js | ||
| ldapStrategy.spec.js | ||
| localStrategy.js | ||
| openIdJwtStrategy.js | ||
| openIdJwtStrategy.spec.js | ||
| openidStrategy.js | ||
| openidStrategy.spec.js | ||
| process.js | ||
| process.test.js | ||
| samlStrategy.js | ||
| samlStrategy.spec.js | ||
| socialLogin.js | ||
| socialLogin.test.js | ||
| validators.js | ||
| validators.spec.js | ||