J.C. Bartle 1786da6c00 🛠️ fix: fail closed on OBO MCP user identity mismatch ... Add an OBO-specific guard before MCP tool execution that requires the effective invocation user and captured request user to both have ids and to match. This prevents OBO tool calls from falling back to a separate configurable.user_id identity after request-bound OBO context has already been captured. Keep the existing user id fallback behavior for non-OBO MCP calls. Tests cover mismatched OBO users, missing user ids, and the matching-user path ignoring a conflicting configurable.user_id.		2026-06-28 15:42:06 -04:00
..
__tests__	🛂 fix: Re-Check execute_code Authorization on Event-Driven Tool Loads (#13912)	2026-06-23 08:30:39 -04:00
Artifacts	🪡 fix: Artifact Edit Saves (#13358)	2026-05-27 22:03:42 -07:00
Config	📨 feat: Custom Headers on Built-in Provider Endpoints (#13742)	2026-06-14 17:02:04 -04:00
Endpoints	💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing (#13738)	2026-06-14 12:00:32 -04:00
Files	🧾 fix: Harden Historical File Authorization (#13918)	2026-06-23 15:49:57 -04:00
Runs	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
Skills	🧬 feat: Add GitHub Skill Sync (#13293)	2026-06-10 21:05:54 -04:00
start	🧬 chore: Align LibreChat With Agents LangChain Upgrade (#12922)	2026-05-03 12:46:01 -04:00
Threads	🪪 fix: Scope Message Conversation Access (#13183)	2026-05-18 17:34:30 -04:00
Tools	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
ActionService.js	⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts (#13622)	2026-06-09 17:50:02 -04:00
ActionService.spec.js	⚗️ feat: Agent Context Compaction/Summarization (#12287)	2026-03-21 14:28:56 -04:00
AssistantService.js	🪦 refactor: Remove Legacy Code (#10533)	2025-12-11 16:36:12 -05:00
AuthService.js	🫙 fix: preserve stale OIDC cookie bridge key	2026-06-24 15:15:39 -04:00
AuthService.spec.js	⚡ Fix OpenID refresh flight retry and marker hydration	2026-06-26 10:59:52 -04:00
cleanup.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
createRunBody.js
GraphApiService.js	🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606)	2026-04-13 08:50:52 -04:00
GraphApiService.spec.js	🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794)	2025-12-11 16:37:16 -05:00
GraphTokenService.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
initializeMCPs.js	🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814)	2026-06-17 20:14:53 -04:00
initializeMCPs.spec.js	🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814)	2026-06-17 20:14:53 -04:00
initializeOAuthReconnectManager.js	💫 feat: MCP OAuth Auto-Reconnect (#9646)	2025-09-17 16:49:36 -04:00
MCP.js	🛠️ fix: fail closed on OBO MCP user identity mismatch	2026-06-28 15:42:06 -04:00
MCP.spec.js	🛠️ fix: fail closed on OBO MCP user identity mismatch	2026-06-28 15:42:06 -04:00
MCPRequestContext.js	🪢 fix: Tie MCP Cleanup To Resumable Runs (#13769)	2026-06-15 15:26:03 -04:00
OboPolicyService.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
OboTokenService.js	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
OboTokenService.spec.js	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
OpenIDRefreshFlight.js	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
OpenIDRefreshFlight.spec.js	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
OpenIDSessionRefresh.js	🛠️ fix: preserve OIDC refresh-token sync on save failures	2026-06-28 11:31:39 -04:00
OpenIDSessionRefresh.spec.js	🛠️ fix: preserve OIDC refresh-token sync on save failures	2026-06-28 11:31:39 -04:00
PermissionService.js	🪪 fix: Filter ACL Principal Details (#13524)	2026-06-05 19:06:41 -04:00
PermissionService.spec.js	🪪 fix: Filter ACL Principal Details (#13524)	2026-06-05 19:06:41 -04:00
PluginService.js	🔌 feat: MCP Reinitialization and OAuth in UI (#8598)	2025-07-22 22:52:45 -04:00
RefreshTokenBridge.js	🛠️ fix: keep OIDC refresh bridge during recovery grace	2026-06-28 12:15:43 -04:00
RefreshTokenBridge.spec.js	🛠️ fix: keep OIDC refresh bridge during recovery grace	2026-06-28 12:15:43 -04:00
systemGrant.spec.js	📜 feat: Implement System Grants for Capability-Based Authorization (#11896)	2026-03-21 14:28:54 -04:00
ToolService.js	🛠️ fix: centralize OBO identity scoping	2026-06-28 10:39:04 -04:00
twoFactorService.js	🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223)	2026-03-14 01:51:31 -04:00