mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-06-26 17:31:27 +00:00
Some checks failed
Docker Dev Images Build / build (Dockerfile, librechat-dev, node) (push) Waiting to run
Docker Dev Images Build / build (Dockerfile.multi, librechat-dev-api, api-build) (push) Waiting to run
GitNexus Index / index (push) Waiting to run
GitNexus Index / post-index (push) Blocked by required conditions
Sync Locize Translations & Create Translation PR / Sync Translation Keys with Locize (push) Waiting to run
Sync Locize Translations & Create Translation PR / Create Translation PR on Version Published (push) Blocked by required conditions
Sync Helm Chart Tags / Ignore non-main push (push) Waiting to run
Sync Helm Chart Tags / Sync chart tags (push) Waiting to run
Publish `librechat-data-provider` to NPM / pack (push) Has been cancelled
Publish `@librechat/data-schemas` to NPM / pack (push) Has been cancelled
Publish `librechat-data-provider` to NPM / publish-npm (push) Has been cancelled
Publish `@librechat/data-schemas` to NPM / publish-npm (push) Has been cancelled
* Add OBO (On-Behalf-Of) token exchange support for MCP server connections Enables transparent authentication to Entra ID-backed MCP servers using the logged-in user's federated token via the OAuth 2.0 jwt-bearer grant. Configured via obo.scopes in librechat.yaml server config. - Extract generic OboTokenService from GraphTokenService (jwt-bearer grant + cache) - Refactor GraphTokenService to thin wrapper delegating to OboTokenService - Add obo schema field to BaseOptionsSchema in data-provider - Add resolveOboToken in packages/api/src/mcp/oauth/obo.ts (validates federated token, calls resolver, returns MCPOAuthTokens) - Wire oboTokenResolver through MCPConnectionFactory, MCPManager, UserConnectionManager - OBO tokens injected via request headers (not OAuth transport), refreshed on each tool call - Explicit error on OBO failure (no fallthrough to standard OAuth redirect) - Add unit tests for both resolveOboToken (9 tests) and exchangeOboToken (14 tests) * Add OBO authentication option to MCP server UI configuration Enable users to configure On-Behalf-Of (OBO) token exchange for MCP servers created via the UI (MongoDB-stored), in addition to the existing YAML-based configuration. - Add "On-Behalf-Of (OBO)" radio option to MCP server auth section with scopes input field - Remove obo from omitServerManagedFields so the field passes UI schema validation - Add OBO to AuthTypeEnum, obo_scopes to AuthConfig, and OBO handling in form defaults and submission - Add .min(1) validation on obo.scopes to reject empty strings - Add English localization keys: com_ui_obo, com_ui_obo_scopes, com_ui_obo_scopes_description - Add 5 schema validation tests for OBO field acceptance, transport compatibility, and edge cases * 🧊 fix: Add obo to safe properties in redactServerSecrets. Fixes the OBO configuration not showing up in the MCP UI after app restart * Address linter errors * 🧊 fix: fail closed on OBO refresh errors and retry transient token exchange failures - stop tool calls from falling back to stale Authorization headers when per-call OBO refresh fails - add one-time retry for transient Entra OBO exchange failures (network/429/5xx) - preserve structured OBO failure reasons and retryability in resolveOboToken - improve OBO auth error messaging for connection setup and tool execution - add tests for transient vs permanent OBO failure paths * Addressing linting errors / warnings * 🧊 fix: isolate OBO MCP auth to user-scoped connections - block OBO-enabled servers from app-level shared MCP connections - bypass shared connection lookup for OBO servers in MCPManager.getConnection - add regressions covering OBO connection scoping and preserve non-OBO app connection reuse * 🛠️ refactor: centralize MCP user-scoped connection policy - add shared requiresUserScopedConnection helper for OAuth, OBO, and customUserVars - use the shared predicate in MCPManager and ConnectionsRepository - add utils coverage for user-scoped connection policy * 🧊 fix: restrict MCP OBO config to header-capable transports - Move OBO configuration out of the shared MCP base options schema and allow it only on SSE and streamable-http transports, where request headers are applied. - Explicitly reject OBO on stdio and websocket configs to avoid accepted-but- nonfunctional server definitions. Add schema coverage for admin/config parsing and user-input websocket validation. * 🧊 fix: single-flight concurrent OBO token exchanges Concurrent tool calls that arrive on a cache miss were each issuing their own jwt-bearer request to the IdP. Under that fan-out, Entra intermittently returned errors that the retry classifier saw as non-retryable, surfacing as: "The identity provider rejected the OBO token exchange. Cannot execute tool <name>. Re-authenticate the user or verify the configured OBO scopes and retry." A user retry then hit the populated cache and succeeded, which matches the observed flakiness — the cache was empty at the moment of fan-out but populated by the time the user clicked retry. - Coalesce concurrent exchanges in `OboTokenService.exchangeOboToken` keyed by `${openidId}:${scopes}`. Callers that arrive while an exchange is in flight share the same upstream request and receive the same result. `fromCache=false` continues to force a fresh, independent exchange (and is not joined by `fromCache=true` callers). The IdP call, single-retry path, and cache write are unchanged — they were moved into a `performOboExchange` helper so the coalescing wrapper stays small. - Tests cover: coalescing on the same key, isolation between different keys, cleanup on success, cleanup on failure, and the `fromCache=false` bypass. * 🔒 feat: gate MCP OBO config behind MCP_SERVERS.CONFIGURE_OBO permission OBO silently mints per-user delegated tokens from the caller's federated access token and forwards them to whatever URL the server config points at. Previously, anyone with MCP_SERVERS.CREATE could configure obo.scopes — so if server creation is ever delegated beyond admins, a user could stand up an attacker-controlled server, attach it to a shared agent, and exfiltrate other users' downstream tokens on tool invocation. Add a dedicated MCP_SERVERS.CONFIGURE_OBO permission (ADMIN: true, USER: false by default) and enforce it at three layers so the safety property no longer depends on CREATE staying admin-only: - Create/update: POST/PATCH /api/mcp/servers returns 403 when the body carries `obo` and the caller's role lacks the permission. - Runtime fail-closed: for DB-sourced configs, MCPConnectionFactory and MCPManager.callTool re-check the original author's role before each OBO exchange. If the author has been downgraded, the exchange is skipped (factory) or refused (callTool) — retained configs lose their privileges automatically. - UI: the OBO option is hidden in the MCP server dialog for users without the permission; a CONFIGURE_OBO toggle is exposed in the MCP admin role editor. Existing role docs receive the new sub-key via the permission backfill in updateInterfacePermissions on next startup, preserving any operator-set values. YAML/Config-sourced server configs are unaffected since they're admin-controlled at the deployment level. * 🧊 fix: wire OBO machinery for servers with requiresOAuth: false The discovery and user-connection paths gated OAuth wiring (flow manager, token methods, oboTokenResolver, oboTrustChecker) behind isOAuthServer(), which only considers requiresOAuth/oauth fields. A DB-stored OBO server with requiresOAuth: false therefore landed in the non-OAuth branch, never received an oboTokenResolver, and the factory's usesObo getter evaluated to false — sending a bare request that the upstream rejected with invalid_token. Add requiresOAuthMachinery() (OAuth OR OBO) and use it at those two gates. isOAuthServer remains for the OAuth-handshake-only check (shouldInitiateOAuthBeforeConnect), where OBO must not initiate a handshake. Plumb the OBO resolver/trust-checker through ToolDiscoveryOptions so reinitMCPServer can pass them on the discovery path. * 🧊 fix: lock all OBO-target fields (URL, proxy, headers, auth) without CONFIGURE_OBO The CONFIGURE_OBO permission was meant to gate control of the endpoint that receives OBO-minted per-user delegated tokens and the scopes that are requested. The previous frontend lock + backend gate only covered obo.scopes and the auth section, leaving url/proxy/headers/etc. editable by anyone with UPDATE — meaning a non-permission user could still redirect an existing OBO server's token flow to an attacker endpoint. Switch to an allowlist policy: when editing an OBO server without CONFIGURE_OBO, only title/description/iconPath are mutable. Backend rejects any other field change with 403; frontend disables the non-allowlist sections (URL, transport, auth, trust) via fieldset. The comparison surface (MCP_USER_INPUT_FIELDS) is derived from MCPServerUserInputSchema's union members so it stays in sync with the schema. New schema fields land in the locked set by default — adding to the allowlist is the only way to unlock them, which preserves the security-review boundary. * 🧊 fix: skip unauthenticated MCP inspection for OBO-only servers MCPServerInspector.inspectServer() ran an unauthenticated temp connection unless the config had requiresOAuth or customUserVars set. For OBO-only servers without standard MCP OAuth advertisement, this caused MCPConnectionFactory.create to attempt the connection without a user or oboTokenResolver — failing on servers that reject the MCP initialize handshake without a valid bearer token, which surfaced as MCP_INSPECTION_FAILED on create/update. Add `obo` to the skip list alongside requiresOAuth and customUserVars, matching the existing pattern for user-scoped auth modes. * Addressed linting error: watchedTitle is declared but never referenced (the auto-fill logic at line 156 uses getValues('title') instead). Deleted constant.
181 lines
6 KiB
JavaScript
181 lines
6 KiB
JavaScript
const mockRegistry = {
|
|
ensureConfigServers: jest.fn(),
|
|
getAllServerConfigs: jest.fn(),
|
|
};
|
|
|
|
jest.mock('~/config', () => ({
|
|
getMCPServersRegistry: jest.fn(() => mockRegistry),
|
|
getMCPManager: jest.fn(),
|
|
getFlowStateManager: jest.fn(),
|
|
getOAuthReconnectionManager: jest.fn(),
|
|
}));
|
|
|
|
jest.mock('@librechat/data-schemas', () => ({
|
|
getTenantId: jest.fn(() => 'tenant-1'),
|
|
logger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
|
|
}));
|
|
|
|
jest.mock('~/server/services/Config', () => ({
|
|
getAppConfig: jest.fn(),
|
|
setCachedTools: jest.fn(),
|
|
getCachedTools: jest.fn(),
|
|
getMCPServerTools: jest.fn(),
|
|
loadCustomConfig: jest.fn(),
|
|
}));
|
|
|
|
jest.mock('@librechat/api', () => ({
|
|
sendEvent: jest.fn(),
|
|
MCPOAuthHandler: jest.fn(),
|
|
isMCPDomainAllowed: jest.fn(),
|
|
normalizeServerName: jest.fn((name) => name),
|
|
normalizeJsonSchema: jest.fn((schema) => schema),
|
|
GenerationJobManager: jest.fn(),
|
|
resolveJsonSchemaRefs: jest.fn((schema) => schema),
|
|
buildOAuthToolCallName: jest.fn((name) => name),
|
|
}));
|
|
|
|
jest.mock('~/cache', () => ({ getLogStores: jest.fn() }));
|
|
jest.mock('~/models', () => ({
|
|
findToken: jest.fn(),
|
|
createToken: jest.fn(),
|
|
updateToken: jest.fn(),
|
|
}));
|
|
jest.mock('~/server/services/GraphTokenService', () => ({
|
|
getGraphApiToken: jest.fn(),
|
|
}));
|
|
jest.mock('~/server/services/OboTokenService', () => ({
|
|
exchangeOboToken: jest.fn(),
|
|
}));
|
|
jest.mock('~/server/services/OboPolicyService', () => ({
|
|
createOboTrustChecker: jest.fn(() => async () => true),
|
|
}));
|
|
jest.mock('~/server/services/Tools/mcp', () => ({
|
|
reinitMCPServer: jest.fn(),
|
|
}));
|
|
|
|
const { getAppConfig } = require('~/server/services/Config');
|
|
const { resolveConfigServers, resolveMcpConfigNames, resolveAllMcpConfigs } = require('../MCP');
|
|
|
|
describe('resolveConfigServers', () => {
|
|
beforeEach(() => jest.clearAllMocks());
|
|
|
|
it('resolves config servers for the current request context', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: { srv: { url: 'http://a' } } });
|
|
mockRegistry.ensureConfigServers.mockResolvedValue({ srv: { name: 'srv' } });
|
|
|
|
const result = await resolveConfigServers({ user: { id: 'u1', role: 'admin' } });
|
|
|
|
expect(result).toEqual({ srv: { name: 'srv' } });
|
|
expect(getAppConfig).toHaveBeenCalledWith(
|
|
expect.objectContaining({ role: 'admin', userId: 'u1' }),
|
|
);
|
|
expect(mockRegistry.ensureConfigServers).toHaveBeenCalledWith({ srv: { url: 'http://a' } });
|
|
});
|
|
|
|
it('returns {} when ensureConfigServers throws', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: { srv: {} } });
|
|
mockRegistry.ensureConfigServers.mockRejectedValue(new Error('inspect failed'));
|
|
|
|
const result = await resolveConfigServers({ user: { id: 'u1' } });
|
|
|
|
expect(result).toEqual({});
|
|
});
|
|
|
|
it('returns {} when getAppConfig throws', async () => {
|
|
getAppConfig.mockRejectedValue(new Error('db timeout'));
|
|
|
|
const result = await resolveConfigServers({ user: { id: 'u1' } });
|
|
|
|
expect(result).toEqual({});
|
|
});
|
|
|
|
it('passes empty mcpConfig when appConfig has none', async () => {
|
|
getAppConfig.mockResolvedValue({});
|
|
mockRegistry.ensureConfigServers.mockResolvedValue({});
|
|
|
|
await resolveConfigServers({ user: { id: 'u1' } });
|
|
|
|
expect(mockRegistry.ensureConfigServers).toHaveBeenCalledWith({});
|
|
});
|
|
});
|
|
|
|
describe('resolveMcpConfigNames', () => {
|
|
beforeEach(() => jest.clearAllMocks());
|
|
|
|
it('resolves current request config server names', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: { cfg_srv: {}, yaml_srv: {} } });
|
|
|
|
const result = await resolveMcpConfigNames({ user: { id: 'u1', role: 'admin' } });
|
|
|
|
expect(result).toEqual(['cfg_srv', 'yaml_srv']);
|
|
expect(getAppConfig).toHaveBeenCalledWith(
|
|
expect.objectContaining({ role: 'admin', userId: 'u1' }),
|
|
);
|
|
});
|
|
|
|
it('returns [] when mcpConfig is absent', async () => {
|
|
getAppConfig.mockResolvedValue({});
|
|
|
|
const result = await resolveMcpConfigNames({ user: { id: 'u1' } });
|
|
|
|
expect(result).toEqual([]);
|
|
});
|
|
|
|
it('propagates getAppConfig failures for write-path callers', async () => {
|
|
getAppConfig.mockRejectedValue(new Error('db timeout'));
|
|
|
|
await expect(resolveMcpConfigNames({ user: { id: 'u1' } })).rejects.toThrow('db timeout');
|
|
});
|
|
});
|
|
|
|
describe('resolveAllMcpConfigs', () => {
|
|
beforeEach(() => jest.clearAllMocks());
|
|
|
|
it('merges config servers with base servers', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: { cfg_srv: {} } });
|
|
mockRegistry.ensureConfigServers.mockResolvedValue({ cfg_srv: { name: 'cfg_srv' } });
|
|
mockRegistry.getAllServerConfigs.mockResolvedValue({
|
|
cfg_srv: { name: 'cfg_srv' },
|
|
yaml_srv: { name: 'yaml_srv' },
|
|
});
|
|
|
|
const result = await resolveAllMcpConfigs('u1', { id: 'u1', role: 'user' });
|
|
|
|
expect(result).toEqual({
|
|
cfg_srv: { name: 'cfg_srv' },
|
|
yaml_srv: { name: 'yaml_srv' },
|
|
});
|
|
expect(mockRegistry.getAllServerConfigs).toHaveBeenCalledWith(
|
|
'u1',
|
|
{
|
|
cfg_srv: { name: 'cfg_srv' },
|
|
},
|
|
'user',
|
|
);
|
|
});
|
|
|
|
it('continues with empty configServers when ensureConfigServers fails', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: { srv: {} } });
|
|
mockRegistry.ensureConfigServers.mockRejectedValue(new Error('inspect failed'));
|
|
mockRegistry.getAllServerConfigs.mockResolvedValue({ yaml_srv: { name: 'yaml_srv' } });
|
|
|
|
const result = await resolveAllMcpConfigs('u1', { id: 'u1' });
|
|
|
|
expect(result).toEqual({ yaml_srv: { name: 'yaml_srv' } });
|
|
expect(mockRegistry.getAllServerConfigs).toHaveBeenCalledWith('u1', {});
|
|
});
|
|
|
|
it('propagates getAllServerConfigs failures', async () => {
|
|
getAppConfig.mockResolvedValue({ mcpConfig: {} });
|
|
mockRegistry.ensureConfigServers.mockResolvedValue({});
|
|
mockRegistry.getAllServerConfigs.mockRejectedValue(new Error('redis down'));
|
|
|
|
await expect(resolveAllMcpConfigs('u1', { id: 'u1' })).rejects.toThrow('redis down');
|
|
});
|
|
|
|
it('propagates getAppConfig failures', async () => {
|
|
getAppConfig.mockRejectedValue(new Error('mongo down'));
|
|
|
|
await expect(resolveAllMcpConfigs('u1', { id: 'u1' })).rejects.toThrow('mongo down');
|
|
});
|
|
});
|