LibreChat/api/server
Jens Schumann ad74a282d1
🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect (#14538)
* fix: resolve customUserVars before first post-OAuth-callback MCP reconnect

The OAuth callback route reconnects the user's MCP connection immediately
after storing new tokens, but never resolves customUserVars before doing
so - unlike the /reinitialize route a few hundred lines below, which does.
As a result, headers/oauth_headers templates like `{{MY_KEY}}` are sent
to the MCP server literally, unsubstituted, on this first connection
attempt, even though the user's value is already saved. The upstream
server rejects it as an invalid credential.

Fixes #14537

* refactor: share getServerCustomUserVars reader from @librechat/api

The mcp_-prefixed key shape was built by getUserMCPAuthMap but re-derived
by hand at each read site (a private helper in services/MCP.js, and the
new callback-route extraction). Export a reader from the same module that
owns the writer and reuse it at both sites, so the key shape has a single
source of truth.

* chore: sort destructured require members in routes/mcp.js

---------

Co-authored-by: Danny Avila <danny@librechat.ai>
2026-07-30 22:17:06 -04:00
..
controllers 🛑 feat: Preemptive Steer - Backend Interrupt & Steer (#14518) 2026-07-30 12:36:13 -04:00
middleware 🤏 fix: Filter Admin Config Reads by Section-Scoped Read Capability (#14472) 2026-07-28 07:38:37 -04:00
routes 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect (#14538) 2026-07-30 22:17:06 -04:00
services 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect (#14538) 2026-07-30 22:17:06 -04:00
utils 🔄 feat: Continue Shared Conversations as Personal Copies (#13714) 2026-06-24 16:27:01 -04:00
cleanup.js
experimental.js ⏱️ feat: Configurable HTTP Server Timeouts (#14481) 2026-07-28 09:10:17 -04:00
experimental.spec.js ⏱️ feat: Configurable HTTP Server Timeouts (#14481) 2026-07-28 09:10:17 -04:00
index.js 🪢 feat: Langfuse Fanout Connection Setting (#14108) 2026-07-29 18:33:10 -04:00
index.metrics.spec.js
index.spec.js ⏱️ feat: Configurable HTTP Server Timeouts (#14481) 2026-07-28 09:10:17 -04:00
socialLogins.js ⏳ feat: Make OpenID Token Reuse Window Configurable (#13546) 2026-06-06 15:15:58 -04:00
socialLogins.spec.js ⏳ feat: Make OpenID Token Reuse Window Configurable (#13546) 2026-06-06 15:15:58 -04:00
telemetry.js
telemetry.spec.js