Dustin Healy fc3189b718 🔐 fix: Restore Tenant Context in MCP OAuth Callback (#12782) ... * fix: restore tenant context in MCP OAuth callback for multi-tenant deployments The MCP OAuth callback is a cross-origin redirect from the OAuth provider. SameSite=Strict cookies (including the JWT) are not sent, leaving the callback with no tenant context. With TENANT_ISOLATION_STRICT=true, all DB writes fail. Stores tenantId in flow metadata at OAuth initiation time (when the user is authenticated), then restores it via tenantStorage.run in the callback, wrapping the entire post-validation body. * test: address review findings for tenant context tests - Assert tenantId flows through to initFlow in MCPConnectionFactory test - Add beforeEach to tenant context tests to reset mocks independently		2026-04-22 14:05:51 -07:00
..
config.spec.js	🚫 fix: Hide Delete Account Button When ALLOW_ACCOUNT_DELETION Is Disabled (#12568)	2026-04-07 23:51:23 -04:00
convos-duplicate-ratelimit.spec.js	🗑️ chore: Remove Action Test Suite and Update Mock Implementations (#12268)	2026-03-21 14:28:55 -04:00
convos-import.spec.js	📏 refactor: Add File Size Limits to Conversation Imports (#12221)	2026-03-14 03:06:29 -04:00
convos.spec.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
grants.spec.js	⛩️ feat: Admin Grants API Endpoints (#12438)	2026-03-30 16:49:23 -04:00
keys.spec.js	🔱 chore: Harden API Routes Against IDOR and DoS Attacks (#11760)	2026-02-12 18:08:24 -05:00
ldap.spec.js	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
mcp.spec.js	🔐 fix: Restore Tenant Context in MCP OAuth Callback (#12782)	2026-04-22 14:05:51 -07:00
messages-delete.spec.js	🗑️ chore: Remove Action Test Suite and Update Mock Implementations (#12268)	2026-03-21 14:28:55 -04:00
roles.spec.js	🔨 fix: Custom Role Permissions (#12528)	2026-04-03 13:24:11 -04:00
static.spec.js	🗂️ fix: Disable express-static-gzip for Uploaded Images (#8307)	2025-07-11 16:51:53 -04:00