LibreChat/api/server/services
Jens Schumann ad74a282d1
🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect (#14538)
* fix: resolve customUserVars before first post-OAuth-callback MCP reconnect

The OAuth callback route reconnects the user's MCP connection immediately
after storing new tokens, but never resolves customUserVars before doing
so - unlike the /reinitialize route a few hundred lines below, which does.
As a result, headers/oauth_headers templates like `{{MY_KEY}}` are sent
to the MCP server literally, unsubstituted, on this first connection
attempt, even though the user's value is already saved. The upstream
server rejects it as an invalid credential.

Fixes #14537

* refactor: share getServerCustomUserVars reader from @librechat/api

The mcp_-prefixed key shape was built by getUserMCPAuthMap but re-derived
by hand at each read site (a private helper in services/MCP.js, and the
new callback-route extraction). Export a reader from the same module that
owns the writer and reuse it at both sites, so the key shape has a single
source of truth.

* chore: sort destructured require members in routes/mcp.js

---------

Co-authored-by: Danny Avila <danny@librechat.ai>
2026-07-30 22:17:06 -04:00
..
__tests__ 🔗 fix: Resolve MCP Tool-Key Boundary Against Configured Server Names (#14448) 2026-07-27 14:45:38 -04:00
Agents 📇 feat: Agent Contact Visibility with Owner Fallback (#13663) 2026-06-25 15:58:15 -04:00
Artifacts 🧵 fix: Preserve Fenced Markdown Artifacts (#14121) 2026-07-05 12:04:59 -04:00
Config ⚙️ perf: reduce first-load MongoDB round trips (#14101) 2026-07-06 09:36:34 -04:00
Endpoints 🎯 feat: Tool Intent Label Capability (tool_intents) (#14499) 2026-07-29 15:40:52 -04:00
Files 🕶 feat: Generalize Admin Config Secret Redaction (#14509) 2026-07-29 13:55:45 -04:00
Runs
Skills 🧬 feat: Add GitHub Skill Sync (#13293) 2026-06-10 21:05:54 -04:00
start 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume (#14139) 2026-07-08 15:31:05 -04:00
Threads 🪪 fix: Scope Message Conversation Access (#13183) 2026-05-18 17:34:30 -04:00
Tools 🪟 fix: Surface MCP Initialization Errors (#14529) 2026-07-30 13:22:11 -04:00
ActionService.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
ActionService.spec.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
AssistantService.js
AuthService.js 🔡 fix: Normalize Email Case When Issuing Verification Tokens (#14172) 2026-07-09 08:42:39 -04:00
AuthService.spec.js 🔡 fix: Normalize Email Case When Issuing Verification Tokens (#14172) 2026-07-09 08:42:39 -04:00
cleanup.js
createRunBody.js
GraphApiService.js
GraphApiService.spec.js
GraphTokenService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
initializeMCPs.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeMCPs.spec.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeOAuthReconnectManager.js
MCP.js 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect (#14538) 2026-07-30 22:17:06 -04:00
MCP.spec.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
MCPRequestContext.js 🪢 fix: Tie MCP Cleanup To Resumable Runs (#13769) 2026-06-15 15:26:03 -04:00
OboPolicyService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
OboTokenService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
OboTokenService.spec.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
PermissionService.js 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing (#14347) 2026-07-20 22:27:25 -04:00
PermissionService.spec.js 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing (#14347) 2026-07-20 22:27:25 -04:00
PluginService.js
systemGrant.spec.js
ToolService.js 🎯 feat: Tool Intent Label Capability (tool_intents) (#14499) 2026-07-29 15:40:52 -04:00
twoFactorService.js