Danny Avila 83d8ac0682 🪜 feat: Add OpenID Role Sync (#13415) ... * Shared Role-Sync Core * Environment Configuration * Browser OpenID Wiring & improved shared component * API Auth Wiring * Improved Role Lookup * added example for sync env * small simplification * protect existing manual assigned ADMIN Roles * fix: Apply OpenID role-sync fallback for present-but-empty claims Both role-sync call sites skipped on a falsy `openIdRoleValues`, treating an empty claim string ('') the same as a missing claim and returning before `selectOpenIdRole` could apply the configured fallback role. An IdP emitting an empty roles claim for a user with no mapped groups left the stale local role in place instead of the authoritative fallback. Skip only when the helper returns `undefined` (missing/invalid), letting an empty string flow through to fallback selection — consistent with how an empty array is already handled. Adds regression coverage on both the OpenID strategy and the remote-agent API auth paths. * refactor: Address OpenID role-sync review feedback - role.ts: reuse the shared escapeRegExp util instead of a local escapeRegex duplicate, matching prompt/skill/user/userGroup methods (Copilot). - openidStrategy.js / remoteAgentAuth.ts: make the tenantStorage.run callbacks async so the documented ALS contract is satisfied and tenant context cannot be lost during Mongoose execution; the wrapped lookups/updates are already async, so behavior is unchanged (codex P2). * fix: Harden OpenID role-sync claim and fallback handling Addresses the second Codex review cycle (P2 findings): - Apply fallback when the claim is absent: getOpenIdRolesForOpenIdSync now returns an empty list (not undefined) when the token source exists but has no usable claim value, so callers still run selection and assign the configured fallback instead of leaving a stale elevated role. A truly unavailable source still returns undefined and skips sync. - Resolve group overage for access tokens too: the _claim_names/_claim_sources overage path previously only ran for claimSource 'id'; Entra also moves an oversized groups claim into access tokens, so 'access'+'groups' (the only source supported by remote-agent API sync) now resolves overage as well. - Allow system fallback roles for tenant users: getLibreChatRolesForOpenIdSync treats SystemRoles (e.g. USER) as always-available canonical names, since they are provisioned globally at startup and a tenant-scoped lookup may not return them — preventing a spurious 'configured roles do not exist: USER'. Adds unit and strategy-level coverage for all three. * fix: Tighten OpenID role-sync tenant scoping and config validation Addresses the third Codex review cycle: - Constrain base-user role lookups to base roles (P2): findRolesByNames now filters to roles with an unset tenantId when no tenant ALS context is active, so a base user cannot match — and be assigned — a role that only exists within a tenant. Tenant-scoped lookups remain controlled by the isolation plugin. - Re-enforce tenant login policy after role sync (P2): when role sync changes a tenant user's role, the OpenID strategy re-resolves the tenant appConfig and re-checks allowedDomains, so a token cannot complete login under the previous role's looser policy. - Skip role-sync-specific validation when disabled (P3): getOpenIdRoleSyncOptions returns disabled options before validating role-sync settings, so a stale or mistyped value no longer breaks OpenID login while the feature is off. Adds unit and strategy-level coverage for all three. * fix: Run base role lookups under system context for strict isolation Follow-up to the base-role scoping fix (Codex P1). With TENANT_ISOLATION_STRICT=true, the tenant-isolation pre('find') hook throws on a context-less query before the manual tenantId filter is honored, so base OpenID/remote-agent auth would 500 instead of validating base roles. findRolesByNames now runs the no-context lookup inside runAsSystem (SYSTEM_TENANT_ID), bypassing strict-mode injection while still applying an explicit base-role (tenantId unset) filter. Adds a strict-mode regression test. --------- Co-authored-by: Peter Rothlaender <peter.rothlaender@ginkgo.com>		2026-06-02 14:00:56 -04:00
..
appleStrategy.js
appleStrategy.test.js
discordStrategy.js
facebookStrategy.js
githubStrategy.js
googleStrategy.js
index.js
jwtStrategy.js
ldapStrategy.js
ldapStrategy.spec.js
localStrategy.js
openIdJwtStrategy.js
openIdJwtStrategy.spec.js
openidStrategy.js	🪜 feat: Add OpenID Role Sync (#13415)	2026-06-02 14:00:56 -04:00
openidStrategy.spec.js	🪜 feat: Add OpenID Role Sync (#13415)	2026-06-02 14:00:56 -04:00
process.js
process.test.js
samlStrategy.js
samlStrategy.spec.js
socialLogin.js
socialLogin.test.js
validators.js
validators.spec.js