GokayAI f80f0be90e 🔑 fix: Stringify Ban Cache Keys When Redis Is Off (#16039) ... * 🔑 fix: Stringify Ban Cache Keys When Redis Is Off Keyv/Mongo throws when checkBan passes a raw ObjectId as the cache key with Redis disabled, which 500s every social OAuth login. Fixes #16025 Signed-off-by: GokayAI <60583610+gokay-ai@users.noreply.github.com> * 🔑 fix: Stringify Violation Log Keys and Cover Bans With Real Keyv logViolation keyed its violation and ban logs by the raw `req.user.id ?? req.user._id`, the same shape checkBan used, so a lean user document would hit the same keyv 5.6 `key.startsWith` TypeError on the namespaced violation stores and record its ban under an ObjectId. The new spec drives checkBan and logViolation through real namespaced Keyv instances (Mongo-backed ban store, in-memory violation logs) with an ObjectId-only OAuth user: an unbanned user passes, and a ban logged from one address is enforced for the same user from another. * 🎯 refactor: Stringify Only the ObjectId Fallback for Ban Keys The id is converted once, where a non-string can enter: the lean document's `_id` fallback. `req.user.id` is already a string on every path that sets it (the JWT strategies, Mongoose's `id` virtual, the 2FA limiter's temp-token id), and the email lookup already stringifies, so `getBanCacheKey` and that line go back to their dev form. --------- Signed-off-by: GokayAI <60583610+gokay-ai@users.noreply.github.com> Co-authored-by: Danny Avila <danny@librechat.ai>		2026-09-19 15:52:06 -04:00
..
checkBan.test.js	🔑 fix: Stringify Ban Cache Keys When Redis Is Off (#16039)	2026-09-19 15:52:06 -04:00