CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-09-07 06:59:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
LibreChat/api/server/middleware
History
Danny Avila de59da9636
🎟️ refactor: Require Credentials for Local Image Access by Default (#15252) 
* 🔐 fix: Protect Local Image Access by Default

* 🔐 fix: Scope Image Authorization to Active Sessions

* 🧹 style: Format Image Authorization Checks

* 🛡️ fix: Harden Image Avatar Authorization

* 🧭 style: Sort Image Authorization Imports

* 🔐 fix: Close Image Authorization Review Gaps

* 🧭 fix: Normalize Stored Avatar Base Paths

* 🏢 fix: Resolve Tenant Assistant Image Policy

* 🛂 fix: Enforce Effective Image Access Policy

* 🧹 style: Flatten Assistant Config Selection

* 🧷 fix: Preserve Image Access Compatibility

* 🪪 fix: Make Image Sessions Revocable

* 🏗️ fix: Move Image Session Policy Into API
2026-08-27 09:55:27 -04:00
..
__tests__ 🌐 fix: Expose Gemini Models to Vertex AI Agents (#15234) 2026-08-27 06:50:23 -04:00
accessResources 🖇️ fix: Bind Model-Spec Authorization to the Loaded Agent (#15256) 2026-08-26 10:38:20 -04:00
assistants ⚗️ feat: Agent Context Compaction/Summarization (#12287) 2026-03-21 14:28:56 -04:00
config ⚙️ perf: reduce first-load MongoDB round trips (#14101) 2026-07-06 09:36:34 -04:00
limiters 🛑 fix: Separate Agent Event Backpressure From User Bans (#15200) 2026-08-25 09:27:35 -04:00
roles 🤏 fix: Filter Admin Config Reads by Section-Scoped Read Capability (#14472) 2026-07-28 07:38:37 -04:00
spec 🎟️ refactor: Require Credentials for Local Image Access by Default (#15252) 2026-08-27 09:55:27 -04:00
validate ⚡ perf: Cut Serial Round Trips and a 100ms Admission Stall from Chat Turns (#15138) 2026-08-23 15:17:35 -04:00
abortMiddleware.js 🧾 fix: Honor Disabled Transactions on the Abort Paths (#15099) 2026-08-25 08:10:26 -04:00
abortMiddleware.spec.js 🧾 fix: Honor Disabled Transactions on the Abort Paths (#15099) 2026-08-25 08:10:26 -04:00
abortRun.js 🧾 fix: Honor Disabled Transactions on the Assistants Usage Path (#15100) 2026-08-25 08:30:12 -04:00
buildEndpointOption.js 🖇️ fix: Bind Model-Spec Authorization to the Loaded Agent (#15256) 2026-08-26 10:38:20 -04:00
buildEndpointOption.spec.js 🛂 feat: Filter Model-Bound Content by Source (#14425) 2026-08-21 22:43:32 -04:00
canAccessSharedLink.js 🔗 feat: Add Granular Access Control to Shared Links via ACL System (#13051) 2026-06-03 14:17:17 -04:00
canDeleteAccount.js 📜 feat: Implement System Grants for Capability-Based Authorization (#11896) 2026-03-21 14:28:54 -04:00
canDeleteAccount.spec.js 📜 feat: Implement System Grants for Capability-Based Authorization (#11896) 2026-03-21 14:28:54 -04:00
checkBan.js 🛑 fix: Separate Agent Event Backpressure From User Bans (#15200) 2026-08-25 09:27:35 -04:00
checkDomainAllowed.js ⚙️ perf: reduce first-load MongoDB round trips (#14101) 2026-07-06 09:36:34 -04:00
checkInviteUser.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
checkPeoplePickerAccess.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
checkPeoplePickerAccess.spec.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
checkSharePublicAccess.js 🗝️ fix: Enforce Skill Share Role Permission (#13062) 2026-05-11 09:39:58 -04:00
checkSharePublicAccess.spec.js 🗝️ fix: Enforce Skill Share Role Permission (#13062) 2026-05-11 09:39:58 -04:00
denyRequest.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
error.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
index.js 🧵 fix: Close Child-Thread Read and Search-Cleanup Gaps (#15055) 2026-08-21 00:44:37 -04:00
logHeaders.js
messageValidation.js ⚡ perf: Optimize First Load of Large Conversations (#14901) 2026-08-16 19:45:21 -04:00
moderateText.js 🧢 fix: Cap Batched HITL Answers Before PII and Moderation (#15257) 2026-08-26 10:10:19 -04:00
moderateText.spec.js 🧢 fix: Cap Batched HITL Answers Before PII and Moderation (#15257) 2026-08-26 10:10:19 -04:00
noIndex.js
optionalJwtAuth.js 🔐 feat: Mint Code API Auth Tokens (#13028) 2026-05-09 16:09:10 -04:00
optionalShareFileAuth.js 🍪 fix: Validate Shared-File Cookie Auth Against the Live Refresh Session (#13908) 2026-06-23 08:32:28 -04:00
optionalShareFileAuth.spec.js 🍪 fix: Validate Shared-File Cookie Auth Against the Live Refresh Session (#13908) 2026-06-23 08:32:28 -04:00
requireJwtAuth.js 📬 feat: Add Durable Agent Trigger Delivery (#14925) 2026-08-17 09:25:08 -04:00
requireLdapAuth.js
requireLocalAuth.js
setHeaders.js
setTwoFactorTempUser.js 🚦 fix: Guard Auth Continuation with Dedicated Limiter (#13555) 2026-06-06 14:21:28 -04:00
uaParser.js
validateEmailLogin.js 💂 fix: Enforce ALLOW_EMAIL_LOGIN on the Backend Login Route (#14180) 2026-07-09 09:55:36 -04:00
validateImageRequest.js 🎟️ refactor: Require Credentials for Local Image Access by Default (#15252) 2026-08-27 09:55:27 -04:00
validateMessageReq.js ⚙️ perf: reduce first-load MongoDB round trips (#14101) 2026-07-06 09:36:34 -04:00
validateModel.js 🌐 fix: Expose Gemini Models to Vertex AI Agents (#15234) 2026-08-27 06:50:23 -04:00
validatePasswordReset.js
validateRegistration.js