J.C. Bartle 8b5cea29bc 🛠️ fix: Bind OpenID session tokens to authenticated identity ... Stamp OpenID session token state with the LibreChat user id, OpenID subject, tenant id, and normalized issuer when tokens are stored. Fail closed before OBO inline token reuse/refresh when the session token identity does not match the current authenticated identity, preventing a stale or mixed Express session from supplying another user's upstream assertion. Also validate the normal /api/auth/refresh session-token reuse shortcut against the signed marker-cookie user before returning cached session tokens. Note: sessions created before this change carry no identity stamp and are treated as a mismatch. This is self-healing — the reuse path forces a full IdP refresh (which re-stamps the session) and the OBO path throws, surfacing as a one-time re-authentication for active OBO users at deploy time. The session re-stamps within one session lifetime (SESSION_EXPIRY, default 15 min).		2026-06-28 17:53:46 -04:00
..
src	🛠️ fix: Bind OpenID session tokens to authenticated identity	2026-06-28 17:53:46 -04:00
types
.gitignore
babel.config.cjs
jest.config.mjs
jest.setup.cjs
package.json	✨ v0.8.7 (#13907)	2026-06-24 14:49:32 -04:00
tsconfig-paths-bootstrap.mjs
tsconfig.build.json
tsconfig.json
tsconfig.spec.json
tsdown.config.mjs