LibreChat/api
Danny Avila 5e3cdd0b2c
📮 fix: Consume an Invite Only Once the Account Exists (#15611)
* 📮 fix: Consume an Invite Only Once the Account Exists

`checkInviteUser` deleted the invite token and then called `next()`, but everything
that can still reject a registration runs after it: the schema, the allowed-domain
check, and the email-already-in-use check. A mistyped password confirmation therefore
destroyed the invite — the invitee corrected it, resubmitted, and got "Invalid invite
token" with no way back short of an admin re-inviting them.

The deletion moves to `registrationController`, after `registerUser` reports success.

That report needed a new signal. `registerUser` returns the same 200 and the same
generic message whether it created an account or found the email already in use —
deliberately, so the response cannot be used to enumerate accounts — so the status
alone cannot say whether an account exists. It now also returns `userCreated` on the
creation path, which the controller reads and never forwards; the response body is
unchanged.

A failed deletion is logged rather than surfaced. By that point the account exists,
and leaving a usable invite behind is recoverable in a way that telling the user their
registration failed is not.

Fixes #15541

* ♻️ test: Fold the Invite Tests Into the Existing AuthController Spec

From Copilot's review. The new spec reached for `jest.requireActual` on
`@librechat/data-schemas`, `~/server/services/AuthService` and `~/models`, which pulls
real implementations into a unit test — `~/models` builds the data-schemas methods
against mongoose — and diverges from `AuthController.spec.js`, which stubs each module
outright.

Rather than restate that harness with narrower stubs, the tests move into the spec that
already has it. `deleteTokens` joins its `~/models` mock, which also keeps that shared
mock in step with the controller's imports: a stale mock there hands the controller an
undefined function, and the omission only surfaces when some later test happens to
exercise the path.
2026-09-04 15:38:32 -04:00
..
app 🫙 fix: Drop Blank Content Blocks From Promptless Sends (#15530) 2026-09-02 20:15:00 -04:00
cache 🚰 fix: Throttle Shared Link Reads and Aggregate Audit Findings (#15605) 2026-09-04 12:38:34 -04:00
config 🫆 chore: Remove Published Credential Defaults (#14680) 2026-08-07 07:25:05 -04:00
db 🐇 refactor: Decouple Meilisearch From Document Saves (#15109) 2026-08-21 22:26:44 -04:00
models 🧩 fix: Preserve Deployment Skill IDs on Agents (#14368) 2026-07-21 19:44:27 -04:00
server 📮 fix: Consume an Invite Only Once the Account Exists (#15611) 2026-09-04 15:38:32 -04:00
strategies 🔐 fix: Keep OpenID Metadata Out of Logs and Traces (#15470) 2026-09-01 13:22:12 -04:00
test 🔐 fix: Redirect OAuth Browser Navigations Instead of Rendering JSON (#15440) 2026-08-31 21:13:47 -04:00
utils ⚡ feat: Add Gemini 3.8 Flash Support (#15519) 2026-09-02 15:06:40 -04:00
jest.config.js 🎨 feat: Theme-Adaptive SVG Support for Custom MCP and Group Icons (#13817) 2026-09-04 10:49:43 -04:00
jsconfig.json
package.json 🎨 feat: Theme-Adaptive SVG Support for Custom MCP and Group Icons (#13817) 2026-09-04 10:49:43 -04:00
typedefs.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00