CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-09-09 16:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11
LibreChat/api/server/services
History
J.C. Bartle 8b5cea29bc 🛠️ fix: Bind OpenID session tokens to authenticated identity 
Stamp OpenID session token state with the LibreChat user id, OpenID subject,
tenant id, and normalized issuer when tokens are stored.

Fail closed before OBO inline token reuse/refresh when the session token
identity does not match the current authenticated identity, preventing a stale
or mixed Express session from supplying another user's upstream assertion.

Also validate the normal /api/auth/refresh session-token reuse shortcut against
the signed marker-cookie user before returning cached session tokens.

Note: sessions created before this change carry no identity stamp and are
treated as a mismatch. This is self-healing — the reuse path forces a full IdP
refresh (which re-stamps the session) and the OBO path throws, surfacing as a
one-time re-authentication for active OBO users at deploy time. The session
re-stamps within one session lifetime (SESSION_EXPIRY, default 15 min).
2026-06-28 17:53:46 -04:00
..
__tests__ 🛂 fix: Re-Check execute_code Authorization on Event-Driven Tool Loads (#13912) 2026-06-23 08:30:39 -04:00
Artifacts 🪡 fix: Artifact Edit Saves (#13358) 2026-05-27 22:03:42 -07:00
Config 📨 feat: Custom Headers on Built-in Provider Endpoints (#13742) 2026-06-14 17:02:04 -04:00
Endpoints 💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing (#13738) 2026-06-14 12:00:32 -04:00
Files 🧾 fix: Harden Historical File Authorization (#13918) 2026-06-23 15:49:57 -04:00
Runs 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
Skills 🧬 feat: Add GitHub Skill Sync (#13293) 2026-06-10 21:05:54 -04:00
start 🧬 chore: Align LibreChat With Agents LangChain Upgrade (#12922) 2026-05-03 12:46:01 -04:00
Threads 🪪 fix: Scope Message Conversation Access (#13183) 2026-05-18 17:34:30 -04:00
Tools 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
ActionService.js ⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts (#13622) 2026-06-09 17:50:02 -04:00
ActionService.spec.js ⚗️ feat: Agent Context Compaction/Summarization (#12287) 2026-03-21 14:28:56 -04:00
AssistantService.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
AuthService.js 🛠️ fix: Bind OpenID session tokens to authenticated identity 2026-06-28 17:53:46 -04:00
AuthService.spec.js 🛠️ fix: Bind OpenID session tokens to authenticated identity 2026-06-28 17:53:46 -04:00
cleanup.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
createRunBody.js ⌚ feat: Add Current Datetime to Assistants (v1/v2) (#4952) 2024-12-11 15:26:18 -05:00
GraphApiService.js 🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606) 2026-04-13 08:50:52 -04:00
GraphApiService.spec.js 🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794) 2025-12-11 16:37:16 -05:00
GraphTokenService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
initializeMCPs.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeMCPs.spec.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeOAuthReconnectManager.js 💫 feat: MCP OAuth Auto-Reconnect (#9646) 2025-09-17 16:49:36 -04:00
MCP.js 🛠️ fix: fail closed on OBO MCP user identity mismatch 2026-06-28 15:42:06 -04:00
MCP.spec.js 🛠️ fix: fail closed on OBO MCP user identity mismatch 2026-06-28 15:42:06 -04:00
MCPRequestContext.js 🪢 fix: Tie MCP Cleanup To Resumable Runs (#13769) 2026-06-15 15:26:03 -04:00
OboPolicyService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
OboTokenService.js 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
OboTokenService.spec.js 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
OpenIDRefreshFlight.js 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
OpenIDRefreshFlight.spec.js 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
OpenIDSessionRefresh.js 🛠️ fix: Bind OpenID session tokens to authenticated identity 2026-06-28 17:53:46 -04:00
OpenIDSessionRefresh.spec.js 🛠️ fix: Bind OpenID session tokens to authenticated identity 2026-06-28 17:53:46 -04:00
PermissionService.js 🪪 fix: Filter ACL Principal Details (#13524) 2026-06-05 19:06:41 -04:00
PermissionService.spec.js 🪪 fix: Filter ACL Principal Details (#13524) 2026-06-05 19:06:41 -04:00
PluginService.js 🔌 feat: MCP Reinitialization and OAuth in UI (#8598) 2025-07-22 22:52:45 -04:00
RefreshTokenBridge.js 🛠️ fix: keep OIDC refresh bridge during recovery grace 2026-06-28 12:15:43 -04:00
RefreshTokenBridge.spec.js 🛠️ fix: keep OIDC refresh bridge during recovery grace 2026-06-28 12:15:43 -04:00
systemGrant.spec.js 📜 feat: Implement System Grants for Capability-Based Authorization (#11896) 2026-03-21 14:28:54 -04:00
ToolService.js 🛠️ fix: centralize OBO identity scoping 2026-06-28 10:39:04 -04:00
twoFactorService.js 🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223) 2026-03-14 01:51:31 -04:00