Freudator86 c6a6f2e3ae 🪪 feat: MCP OAuth - Support audience parameter for Auth0/Cognito-style providers (#13402) ... * feat(mcp/oauth): support audience parameter for Auth0/Cognito-style providers LibreChat already follows RFC 9728 (Protected Resource Metadata discovery) and RFC 8707 (resource indicators on /authorize). However, authorization servers that pre-date RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when an Auth0-specific 'audience' parameter is supplied on /authorize and /token. Without it, refresh_token responses strip the API audience and the next MCP call 401s. This change adds an optional 'audience' field to OAuthOptionsSchema and forwards it on: * pre-configured authorize URL build * discovered (DCR + RFC 9728) authorize URL build * refresh_token grant body 'resource' (RFC 8707) is left untouched and remains the standards-conformant route; 'audience' covers providers that ignore 'resource'. The two are independent — providers may accept either, both, or neither, so we forward whichever the operator configures. Schema tests added; no behavioral change for existing configs (field is optional with no default). Refs: MCP Authorization Spec 2025-06-18, RFC 9728, RFC 8707. * ci: build audience-fix branch image to ghcr.io/freudator86/librechat:audience-fix * Revert "ci: build audience-fix branch image to ghcr.io/freudator86/librechat:audience-fix" This reverts commit 7b3dfa6cd7. * tests: assert audience param in authorize URL + refresh body; tighten schema (.min(1)); refine comment to reflect actual code paths Adresses PR review: - audience: z.string().min(1).optional() rejects empty strings - schema comment now precisely lists the two code paths (authorize + refresh_token grant); explicitly notes the authorization_code exchange intentionally does not receive audience because Auth0 binds it from the initial /authorize request - new MCPOAuthAudience.test.ts: 4 cases — authorize URL with/without audience, refresh body with/without audience — using a local recording HTTP server (no shared helper changes) - new schema test: empty-string audience is rejected * style: inline two logger.debug calls (prettier) * style: inline third audience-debug log (prettier) * feat(mcp/oauth): add forward_audience_on_refresh opt-out for strict token endpoints (Cognito) Addresses Codex review P2 'Avoid sending audience on refresh grants': the previous behavior forwarded audience on every refresh_token grant, which is correct for Auth0 (strips the audience claim otherwise) but is non-standard for Cognito and other strict OAuth 2.0 token endpoints that document refresh as grant_type + client_id + refresh_token only. New optional boolean 'forward_audience_on_refresh' (default: true) preserves the existing Auth0-friendly default while letting operators of strict tenants opt out cleanly. Schema + handler tests cover both cases. No behavioral change for existing configs. * style: format MCP OAuth refresh audience log --------- Co-authored-by: Tim Freudenthal <tim@allesknut.de> Co-authored-by: Danny Avila <danny@librechat.ai>		2026-05-30 06:59:39 -07:00
..
src	🪪 feat: MCP OAuth - Support audience parameter for Auth0/Cognito-style providers (#13402)	2026-05-30 06:59:39 -07:00
types	🔬 ci: Add TypeScript Type Checks to Backend Workflow and Fix All Type Errors (#12451)	2026-03-28 21:06:39 -04:00
.gitignore
babel.config.cjs
jest.config.mjs	🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831)	2026-04-27 08:56:39 +09:00
jest.setup.cjs	🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831)	2026-04-27 08:56:39 +09:00
package.json	📦 chore: Bump @librechat/agents to v3.2.0	2026-05-30 02:04:38 -04:00
rollup.config.js	📡 feat: Add Backend OpenTelemetry Tracing (#12909)	2026-05-14 09:08:55 -04:00
tsconfig-paths-bootstrap.mjs
tsconfig.build.json
tsconfig.json	📦 chore: npm audit fixes and Mongoose 8.23 TypeScript follow-ups (#12996)	2026-05-07 09:47:40 -04:00
tsconfig.spec.json	📦 chore: Update TypeScript Config for TS v7 (#12794)	2026-04-23 12:51:03 -04:00