mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-08-04 14:57:42 +00:00
044c134ecf
listConfigs, getBaseConfig, and getConfig only checked the broad read:configs capability, so a caller holding nothing but read:configs:<section> grants got a blanket 403 on all three instead of a response filtered to the sections they hold. Any deployment using section-scoped config grants hits this. Adds hasAnyConfigReadAccess as a cheap pre-flight check covering broad and section-scoped read and manage grants (manage implies read), so a zero-access caller still 403s before a DB fetch while a section-scoped caller gets the response filtered to exactly what they hold. The same manage-implies-read rule is fixed at its root in getParentCapabilities so a manage-only caller sees the section they manage instead of having it stripped after passing the pre-flight. Resolves every section for a request in one batched getHeldCapabilities query via getReadableConfigSections instead of one round trip per section. Includes AppConfig field-renaming normalization (interfaceConfig, turnstileConfig, mcpConfig) so the filter checks the canonical section name rather than the renamed response field, and stops availableTools from bypassing the filter by gating it on its filteredTools/includedTools source sections. |
||
|---|---|---|
| .. | ||
| acl | ||
| actions | ||
| admin | ||
| agents | ||
| apiKeys | ||
| app | ||
| artifacts | ||
| auth | ||
| cache | ||
| cdn | ||
| cluster | ||
| crypto | ||
| db | ||
| endpoints | ||
| favorites | ||
| files | ||
| flow | ||
| html | ||
| langfuse | ||
| mcp | ||
| memory | ||
| middleware | ||
| modelSpecs | ||
| oauth | ||
| projects | ||
| prompts | ||
| rum | ||
| shared-links | ||
| skills | ||
| storage | ||
| stream | ||
| telemetry | ||
| tools | ||
| types | ||
| utils | ||
| web | ||
| index.ts | ||
| telemetry.ts | ||