mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-08-04 14:57:42 +00:00
74de989bde
* 🔒 fix: Skip revoke for principals also being granted (owner-lockout guard) bulkUpdateResourcePermissions flushes grants (upserts) before revokes (deletes). If a principal appears in both updatedPrincipals and revokedPrincipals, the ACL entry is granted and then immediately deleted, stripping access the caller just set. This can strip a resource owner's own grant when the share dialog places the owner in both lists from a client id/idOnTheSource mismatch (OpenID/Entra). Add a server-side guard: track principals granted in the same request and skip any revoke for the same principal, so granting wins and owner lockout is impossible regardless of how the client computes the share diff. Complements the client-side keying fix in #14317. Refs #14316 * 🔒 fix: Exclude PUBLIC from grant-wins guard so public-disable is honored The grant-wins guard must not apply to PrincipalType.PUBLIC. An explicit public: false disable adds the public principal to the revoke list; a contradictory payload that also grants public (public in the updated list) would otherwise skip the revoke and leave the resource public. Disabling public access must always win. User/group owner-lockout protection is unchanged. Addresses Codex P2 on #14347. * 🔒 fix: Move revoke guard inside per-principal try (tolerate malformed entries) The grant-wins guard read principal.type before the per-principal try/catch, so a malformed revoke entry (e.g. removed: [null]) would throw out of bulkUpdateResourcePermissions after grants were already flushed on non-transactional MongoDB, leaving partial permission changes. Move the guard inside the try so a malformed entry is recorded in results.errors and skipped, matching prior behavior. Addresses Codex P2 on #14347. |
||
|---|---|---|
| .. | ||
| __tests__ | ||
| Agents | ||
| Artifacts | ||
| Config | ||
| Endpoints | ||
| Files | ||
| Runs | ||
| Skills | ||
| start | ||
| Threads | ||
| Tools | ||
| ActionService.js | ||
| ActionService.spec.js | ||
| AssistantService.js | ||
| AuthService.js | ||
| AuthService.spec.js | ||
| cleanup.js | ||
| createRunBody.js | ||
| GraphApiService.js | ||
| GraphApiService.spec.js | ||
| GraphTokenService.js | ||
| initializeMCPs.js | ||
| initializeMCPs.spec.js | ||
| initializeOAuthReconnectManager.js | ||
| MCP.js | ||
| MCP.spec.js | ||
| MCPRequestContext.js | ||
| OboPolicyService.js | ||
| OboTokenService.js | ||
| OboTokenService.spec.js | ||
| PermissionService.js | ||
| PermissionService.spec.js | ||
| PluginService.js | ||
| systemGrant.spec.js | ||
| ToolService.js | ||
| twoFactorService.js | ||