{"entries":[{"lastCommit":{"author":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2024-04-23T08:21:12.000000-04:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2024-04-23T08:21:12.000000-04:00"},"hash":"0ae98ff011ff55716a2e32a182ec678acd012ece","message":"🧪 ci: Add `.env.test` for `backend-review.yml` (#2501)\n\n* 🧪 ci: Add `.env.test` for `backend-review.yml`\r\n\r\n* chore: touch example file","tree":"dc5b22dbd06e8ab1a76dba70d49bfc718b211558"},"mode":"0100644","name":".env.test.example","size":432},{"lastCommit":{"author":{"email":"levy@andes.is","name":"Jón Levy","when":"2025-11-21T14:44:52.000000Z"},"committer":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-11-21T09:51:11.000000-05:00"},"hash":"ef3bf0a9321eb8b0a3c1cab7b8b2cec4794ab346","message":"🆔 feat: Add OpenID Connect Federated Provider Token Support (#9931)\n\n* feat: Add OpenID Connect federated provider token support\n\nImplements support for passing federated provider tokens (Cognito, Azure AD, Auth0)\nas variables in LibreChat's librechat.yaml configuration for both custom endpoints\nand MCP servers.\n\nFeatures:\n- New LIBRECHAT_OPENID_* template variables for federated provider tokens\n- JWT claims parsing from ID tokens without verification (for claim extraction)\n- Token validation with expiration checking\n- Support for multiple token storage locations (federatedTokens, openidTokens)\n- Integration with existing template variable system\n- Comprehensive test suite with Cognito-specific scenarios\n- Provider-agnostic design supporting Cognito, Azure AD, Auth0, etc.\n\nSecurity:\n- Server-side only token processing\n- Automatic token expiration validation\n- Graceful fallbacks for missing/invalid tokens\n- No client-side token exposure\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* fix: Add federated token propagation to OIDC authentication strategies\n\nAdds federatedTokens object to user during authentication to enable\nfederated provider token template variables in LibreChat configuration.\n\nChanges:\n- OpenID JWT Strategy: Extract raw JWT from Authorization header and\n attach as federatedTokens.access_token to enable {{LIBRECHAT_OPENID_TOKEN}}\n placeholder resolution\n- OpenID Strategy: Attach tokenset tokens as federatedTokens object to\n standardize token access across both authentication strategies\n\nThis enables proper token propagation for custom endpoints and MCP\nservers that require federated provider tokens for authorization.\n\nResolves missing token issue reported by @ramden in PR #9931\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Denis Ramic \nCo-Authored-By: Claude \n\n* test: Add federatedTokens validation tests for OIDC strategies\n\nAdds comprehensive test coverage for the federated token propagation\nfeature implemented in the authentication strategies.\n\nTests added:\n- Verify federatedTokens object is attached to user with correct structure\n (access_token, refresh_token, expires_at)\n- Verify both tokenset and federatedTokens are present in user object\n- Ensure tokens from OIDC provider are correctly propagated\n\nAlso fixes existing test suite by adding missing mocks:\n- isEmailDomainAllowed function mock\n- findOpenIDUser function mock\n\nThese tests validate the fix from commit 5874ba29f that enables\n{{LIBRECHAT_OPENID_TOKEN}} template variable functionality.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* docs: Remove implementation documentation file\n\nThe PR description already contains all necessary implementation details.\nThis documentation file is redundant and was requested to be removed.\n\n* fix: skip s256 check\n\n* fix(openid): handle missing refresh token in Cognito token refresh response\n\nWhen OPENID_REUSE_TOKENS=true, the token refresh flow was failing because\nCognito (and most OAuth providers) don't return a new refresh token in the\nrefresh grant response - they only return new access and ID tokens.\n\nChanges:\n- Modified setOpenIDAuthTokens() to accept optional existingRefreshToken parameter\n- Updated validation to only require access_token (refresh_token now optional)\n- Added logic to reuse existing refresh token when not provided in tokenset\n- Updated refreshController to pass original refresh token as fallback\n- Added comments explaining standard OAuth 2.0 refresh token behavior\n\nThis fixes the \"Token is not present. User is not authenticated.\" error that\noccurred during silent token refresh with Cognito as the OpenID provider.\n\nFixes: Authentication loop with OPENID_REUSE_TOKENS=true and AWS Cognito\n\n* fix(openid): extract refresh token from cookies for template variable replacement\n\nWhen OPENID_REUSE_TOKENS=true, the openIdJwtStrategy populates user.federatedTokens\nto enable template variable replacement (e.g., {{LIBRECHAT_OPENID_ACCESS_TOKEN}}).\n\nHowever, the refresh_token field was incorrectly sourced from payload.refresh_token,\nwhich is always undefined because:\n1. JWTs don't contain refresh tokens in their payload\n2. The JWT itself IS the access token\n3. Refresh tokens are separate opaque tokens stored in HTTP-only cookies\n\nThis caused extractOpenIDTokenInfo() to receive incomplete federatedTokens,\nresulting in template variables remaining unreplaced in headers.\n\n**Root Cause:**\n- Line 90: `refresh_token: payload.refresh_token` (always undefined)\n- JWTs only contain access token data in their claims\n- Refresh tokens are separate, stored securely in cookies\n\n**Solution:**\n- Import `cookie` module to parse cookies from request\n- Extract refresh token from `refreshToken` cookie\n- Populate federatedTokens with both access token (JWT) and refresh token (from cookie)\n\n**Impact:**\n- Template variables like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} now work correctly\n- Headers in librechat.yaml are properly replaced with actual tokens\n- MCP server authentication with federated tokens now functional\n\n**Technical Details:**\n- passReqToCallback=true in JWT strategy provides req object access\n- Refresh token extracted via cookies.parse(req.headers.cookie).refreshToken\n- Falls back gracefully if cookie header or refreshToken is missing\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* fix: re-resolve headers on each request to pick up fresh federatedTokens\n\n- OpenAIClient now re-resolves headers in chatCompletion() before each API call\n- This ensures template variables like {{LIBRECHAT_OPENID_TOKEN}} are replaced\n with actual token values from req.user.federatedTokens\n- initialize.js now stores original template headers instead of pre-resolved ones\n- Fixes template variable replacement when OPENID_REUSE_TOKENS=true\n\nThe issue was that headers were only resolved once during client initialization,\nbefore openIdJwtStrategy had populated user.federatedTokens. Now headers are\nre-resolved on every request with the current user's fresh tokens.\n\n* debug: add logging to track header resolution in OpenAIClient\n\n* debug: log tokenset structure after refresh to diagnose missing access_token\n\n* fix: set federatedTokens on user object after OAuth refresh\n\n- After successful OAuth token refresh, the user object was not being\n updated with federatedTokens\n- This caused template variable resolution to fail on subsequent requests\n- Now sets user.federatedTokens with access_token, id_token, refresh_token\n and expires_at from the refreshed tokenset\n- Fixes template variables like {{LIBRECHAT_OPENID_TOKEN}} not being\n replaced after token refresh\n- Related to PR #9931 (OpenID federated token support)\n\n* fix(openid): pass user object through agent chain for template variable resolution\n\nRoot cause: buildAgentContext in agents/run.ts called resolveHeaders without\nthe user parameter, preventing OpenID federated token template variables from\nbeing resolved in agent runtime parameters.\n\nChanges:\n- packages/api/src/agents/run.ts: Add user parameter to createRun signature\n- packages/api/src/agents/run.ts: Pass user to resolveHeaders in buildAgentContext\n- api/server/controllers/agents/client.js: Pass user when calling createRun\n- api/server/services/Endpoints/bedrock/options.js: Add resolveHeaders call with debug logging\n- api/server/services/Endpoints/custom/initialize.js: Add debug logging\n- packages/api/src/utils/env.ts: Add comprehensive debug logging and stack traces\n- packages/api/src/utils/oidc.ts: Fix eslint errors (unused type, explicit any)\n\nThis ensures template variables like {{LIBRECHAT_OPENID_TOKEN}} and\n{{LIBRECHAT_USER_OPENIDID}} are properly resolved in both custom endpoint\nheaders and Bedrock AgentCore runtime parameters.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* refactor: remove debug logging from OpenID token template feature\n\nRemoved excessive debug logging that was added during development to make\nthe PR more suitable for upstream review:\n\n- Removed 7 debug statements from OpenAIClient.js\n- Removed all console.log statements from packages/api/src/utils/env.ts\n- Removed debug logging from bedrock/options.js\n- Removed debug logging from custom/initialize.js\n- Removed debug statement from AuthController.js\n\nThis reduces the changeset by ~50 lines while maintaining full functionality\nof the OpenID federated token template variable feature.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* test(openid): add comprehensive unit tests for template variable substitution\n\n- Add 34 unit tests for OIDC token utilities (oidc.spec.ts)\n- Test coverage for token extraction, validation, and placeholder processing\n- Integration tests for full OpenID token flow\n- All tests pass with comprehensive edge case coverage\n\n🤖 Generated with Claude Code\nCo-Authored-By: Claude \n\n* test: fix OpenID federated tokens test failures\n\n- Add serverMetadata() mock to openid-client mock configuration\n * Fixes TypeError in openIdJwtStrategy.js where serverMetadata() was being called\n * Mock now returns jwks_uri and end_session_endpoint as expected by the code\n\n- Update outdated initialize.spec.js test\n * Remove test expecting resolveHeaders call during initialization\n * Header resolution was refactored to be deferred until LLM request time\n * Update test to verify options are returned correctly with useLegacyContent flag\n\nFixes #9931 CI failures for backend unit tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* chore: fix package-lock.json conflict\n\n* chore: sync package-log with upstream\n\n* chore: cleanup\n\n* fix: use createSafeUser\n\n* fix: fix createSafeUser signature\n\n* chore: remove comments\n\n* chore: purge comments\n\n* fix: update Jest testPathPattern to testPathPatterns for Jest 30+ compatibility\n\n---------\n\nCo-authored-by: Claude \nCo-authored-by: Denis Ramic \nCo-authored-by: kristjanaapro \n\nchore: import order and add back JSDoc for OpenID JWT callback\n","tree":"9eb3a8c74c976e9215748d12376aaa3842186a35"},"mode":"0040000","name":"__mocks__","size":0},{"lastCommit":{"author":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-11-17T13:12:16.000000-05:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2025-11-17T13:12:16.000000-05:00"},"hash":"49c57b27fd8a5baaff07501e8e562c9671c77d8f","message":"➿ fix: `createFileSearchTool` to return tuples for error messages (#10547)\n\n","tree":"c251b0acbb33c13c716cde3365a9694afaf481e8"},"mode":"0040000","name":"app","size":0},{"lastCommit":{"author":{"email":"praneeth.goparaju@slalom.com","name":"“Praneeth","when":"2025-06-11T22:55:07.000000+05:30"},"committer":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-08-13T16:24:18.000000-04:00"},"hash":"949682ef0fdf9b87c4a92db02b9b9fbc6562a518","message":"🏪 feat: Agent Marketplace\n\nbugfix: Enhance Agent and AgentCategory schemas with new fields for category, support contact, and promotion status\n\nrefactored and moved agent category methods and schema to data-schema package\n\n🔧 fix: Merge and Rebase Conflicts\n\n- Move AgentCategory from api/models to @packages/data-schemas structure\n - Add schema, types, methods, and model following codebase conventions\n - Implement auto-seeding of default categories during AppService startup\n - Update marketplace controller to use new data-schemas methods\n - Remove old model file and standalone seed script\n\nrefactor: unify agent marketplace to single endpoint with cursor pagination\n\n - Replace multiple marketplace routes with unified /marketplace endpoint\n - Add query string controls: category, search, limit, cursor, promoted, requiredPermission\n - Implement cursor-based pagination replacing page-based system\n - Integrate ACL permissions for proper access control\n - Fix ObjectId constructor error in Agent model\n - Update React components to use unified useGetMarketplaceAgentsQuery hook\n - Enhance type safety and remove deprecated useDynamicAgentQuery\n - Update tests for new marketplace architecture\n -Known issues:\n see more button after category switching + Unit tests\n\nfeat: add icon property to ProcessedAgentCategory interface\n\n- Add useMarketplaceAgentsInfiniteQuery and useGetAgentCategoriesQuery to client/src/data-provider/Agents/\n - Replace manual pagination in AgentGrid with infinite query pattern\n - Update imports to use local data provider instead of librechat-data-provider\n - Add proper permission handling with PERMISSION_BITS.VIEW/EDIT constants\n - Improve agent access control by adding requiredPermission validation in backend\n - Remove manual cursor/state management in favor of infinite query built-ins\n - Maintain existing search and category filtering functionality\n\nrefactor: consolidate agent marketplace endpoints into main agents API and improve data management consistency\n\n - Remove dedicated marketplace controller and routes, merging functionality into main agents v1 API\n - Add countPromotedAgents function to Agent model for promoted agents count\n - Enhance getListAgents handler with marketplace filtering (category, search, promoted status)\n - Move getAgentCategories from marketplace to v1 controller with same functionality\n - Update agent mutations to invalidate marketplace queries and handle multiple permission levels\n - Improve cache management by updating all agent query variants (VIEW/EDIT permissions)\n - Consolidate agent data access patterns for better maintainability and consistency\n - Remove duplicate marketplace route definitions and middleware\n\nselected view only agents injected in the drop down\n\nfix: remove minlength validation for support contact name in agent schema\n\nfeat: add validation and error messages for agent name in AgentConfig and AgentPanel\n\nfix: update agent permission check logic in AgentPanel to simplify condition\n\nFix linting WIP\n\nFix Unit tests WIP\n\nESLint fixes\n\neslint fix\n\nrefactor: enhance isDuplicateVersion function in Agent model for improved comparison logic\n\n- Introduced handling for undefined/null values in array and object comparisons.\n- Normalized array comparisons to treat undefined/null as empty arrays.\n- Added deep comparison for objects and improved handling of primitive values.\n- Enhanced projectIds comparison to ensure consistent MongoDB ObjectId handling.\n\nrefactor: remove redundant properties from IAgent interface in agent schema\n\nchore: update localization for agent detail component and clean up imports\n\nci: update access middleware tests\n\nchore: remove unused PermissionTypes import from Role model\n\nci: update AclEntry model tests\n\nci: update button accessibility labels in AgentDetail tests\n\nrefactor: update exhaustive dep. lint warning\n\n🔧 fix: Fixed agent actions access\n\nfeat: Add role-level permissions for agent sharing people picker\n\n - Add PEOPLE_PICKER permission type with VIEW_USERS and VIEW_GROUPS permissions\n - Create custom middleware for query-aware permission validation\n - Implement permission-based type filtering in PeoplePicker component\n - Hide people picker UI when user lacks permissions, show only public toggle\n - Support granular access: users-only, groups-only, or mixed search modes\n\nrefactor: Replace marketplace interface config with permission-based system\n\n - Add MARKETPLACE permission type to handle marketplace access control\n - Update interface configuration to use role-based marketplace settings (admin/user)\n - Replace direct marketplace boolean config with permission-based checks\n - Modify frontend components to use marketplace permissions instead of interface config\n - Update agent query hooks to use marketplace permissions for determining permission levels\n - Add marketplace configuration structure similar to peoplePicker in YAML config\n - Backend now sets MARKETPLACE permissions based on interface configuration\n - When marketplace enabled: users get agents with EDIT permissions in dropdown lists (builder mode)\n - When marketplace disabled: users get agents with VIEW permissions in dropdown lists (browse mode)\n\n🔧 fix: Redirect to New Chat if No Marketplace Access and Required Agent Name Placeholder (#8213)\n\n* Fix: Fix the redirect to new chat page if access to marketplace is denied\n\n* Fixed the required agent name placeholder\n\n---------\n\nCo-authored-by: Atef Bellaaj \n\nchore: fix tests, remove unnecessary imports\n\nrefactor: Implement permission checks for file access via agents\n\n- Updated `hasAccessToFilesViaAgent` to utilize permission checks for VIEW and EDIT access.\n- Replaced project-based access validation with permission-based checks.\n- Enhanced tests to cover new permission logic and ensure proper access control for files associated with agents.\n- Cleaned up imports and initialized models in test files for consistency.\n\nrefactor: Enhance test setup and cleanup for file access control\n\n- Introduced modelsToCleanup array to track models added during tests for proper cleanup.\n- Updated afterAll hooks in test files to ensure all collections are cleared and only added models are deleted.\n- Improved consistency in model initialization across test files.\n- Added comments for clarity on cleanup processes and test data management.\n\nchore: Update Jest configuration and test setup for improved timeout handling\n\n- Added a global test timeout of 30 seconds in jest.config.js.\n- Configured jest.setTimeout in jestSetup.js to allow individual test overrides if needed.\n- Enhanced test reliability by ensuring consistent timeout settings across all tests.\n\nrefactor: Implement file access filtering based on agent permissions\n\n- Introduced `filterFilesByAgentAccess` function to filter files based on user access through agents.\n- Updated `getFiles` and `primeFiles` functions to utilize the new filtering logic.\n- Moved `hasAccessToFilesViaAgent` function from the File model to permission services, adjusting imports accordingly\n- Enhanced tests to ensure proper access control and filtering behavior for files associated with agents.\n\nfix: make support_contact field a nested object rather than a sub-document\n\nrefactor: Update support_contact field initialization in agent model\n\n- Removed handling for empty support_contact object in createAgent function.\n- Changed default value of support_contact in agent schema to undefined.\n\ntest: Add comprehensive tests for support_contact field handling and versioning\n\nrefactor: remove unused avatar upload mutation field and add informational toast for success\n\nchore: add missing SidePanelProvider for AgentMarketplace and organize imports\n\nfix: resolve agent selection race condition in marketplace HandleStartChat\n- Set agent in localStorage before newConversation to prevent useSelectorEffects from auto-selecting previous agent\n\nfix: resolve agent dropdown showing raw ID instead of agent info from URL\n\n - Add proactive agent fetching when agent_id is present in URL parameters\n - Inject fetched agent into agents cache so dropdowns display proper name/avatar\n - Use useAgentsMap dependency to ensure proper cache initialization timing\n - Prevents raw agent IDs from showing in UI when visiting shared agent links\n\nFix: Agents endpoint renamed to \"My Agent\" for less confusion with the Marketplace agents.\n\nchore: fix ESLint issues and Test Mocks\n\nci: update permissions structure in loadDefaultInterface tests\n\n- Refactored permissions for MEMORY and added new permissions for MARKETPLACE and PEOPLE_PICKER.\n- Ensured consistent structure for permissions across different types.\n\nfeat: support_contact validation to allow empty email strings\n","tree":"c1d38e77151538ab7173e8eed2ac1b20f3c25a82"},"mode":"0100644","name":"jestSetup.js","size":654},{"lastCommit":{"author":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-07-25T00:07:37.000000-04:00"},"committer":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-08-13T16:24:16.000000-04:00"},"hash":"52e59e40be5916a0b4eda1c4dc19870089664ba7","message":"📚 feat: Add Source Citations for File Search in Agents (#8652)\n\n* feat: Source Citations for file_search in Agents\n\n* Fix: Added citation limits and relevance score to app service. Removed duplicate tests\n\n* ✨ feat: implement Role-level toggle to optionally disable file Source Citation in Agents\n\n* 🐛 fix: update mock for librechat-data-provider to include PermissionTypes and SystemRoles\n\n---------\n\nCo-authored-by: “Praneeth \n","tree":"6001a22f355f26055922b4e622f72b0e3f9940db"},"mode":"0040000","name":"server","size":0},{"lastCommit":{"author":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-08-26T12:10:18.000000-04:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2025-08-26T12:10:18.000000-04:00"},"hash":"9a210971f530de1650d9afaf65d5dab6f3e97f98","message":"🛜 refactor: Streamline App Config Usage (#9234)\n\n* WIP: app.locals refactoring\n\nWIP: appConfig\n\nfix: update memory configuration retrieval to use getAppConfig based on user role\n\nfix: update comment for AppConfig interface to clarify purpose\n\n🏷️ refactor: Update tests to use getAppConfig for endpoint configurations\n\nci: Update AppService tests to initialize app config instead of app.locals\n\nci: Integrate getAppConfig into remaining tests\n\nrefactor: Update multer storage destination to use promise-based getAppConfig and improve error handling in tests\n\nrefactor: Rename initializeAppConfig to setAppConfig and update related tests\n\nci: Mock getAppConfig in various tests to provide default configurations\n\nrefactor: Update convertMCPToolsToPlugins to use mcpManager for server configuration and adjust related tests\n\nchore: rename `Config/getAppConfig` -> `Config/app`\n\nfix: streamline OpenAI image tools configuration by removing direct appConfig dependency and using function parameters\n\nchore: correct parameter documentation for imageOutputType in ToolService.js\n\nrefactor: remove `getCustomConfig` dependency in config route\n\nrefactor: update domain validation to use appConfig for allowed domains\n\nrefactor: use appConfig registration property\n\nchore: remove app parameter from AppService invocation\n\nrefactor: update AppConfig interface to correct registration and turnstile configurations\n\nrefactor: remove getCustomConfig dependency and use getAppConfig in PluginController, multer, and MCP services\n\nrefactor: replace getCustomConfig with getAppConfig in STTService, TTSService, and related files\n\nrefactor: replace getCustomConfig with getAppConfig in Conversation and Message models, update tempChatRetention functions to use AppConfig type\n\nrefactor: update getAppConfig calls in Conversation and Message models to include user role for temporary chat expiration\n\nci: update related tests\n\nrefactor: update getAppConfig call in getCustomConfigSpeech to include user role\n\nfix: update appConfig usage to access allowedDomains from actions instead of registration\n\nrefactor: enhance AppConfig to include fileStrategies and update related file strategy logic\n\nrefactor: update imports to use normalizeEndpointName from @librechat/api and remove redundant definitions\n\nchore: remove deprecated unused RunManager\n\nrefactor: get balance config primarily from appConfig\n\nrefactor: remove customConfig dependency for appConfig and streamline loadConfigModels logic\n\nrefactor: remove getCustomConfig usage and use app config in file citations\n\nrefactor: consolidate endpoint loading logic into loadEndpoints function\n\nrefactor: update appConfig access to use endpoints structure across various services\n\nrefactor: implement custom endpoints configuration and streamline endpoint loading logic\n\nrefactor: update getAppConfig call to include user role parameter\n\nrefactor: streamline endpoint configuration and enhance appConfig usage across services\n\nrefactor: replace getMCPAuthMap with getUserMCPAuthMap and remove unused getCustomConfig file\n\nrefactor: add type annotation for loadedEndpoints in loadEndpoints function\n\nrefactor: move /services/Files/images/parse to TS API\n\nchore: add missing FILE_CITATIONS permission to IRole interface\n\nrefactor: restructure toolkits to TS API\n\nrefactor: separate manifest logic into its own module\n\nrefactor: consolidate tool loading logic into a new tools module for startup logic\n\nrefactor: move interface config logic to TS API\n\nrefactor: migrate checkEmailConfig to TypeScript and update imports\n\nrefactor: add FunctionTool interface and availableTools to AppConfig\n\nrefactor: decouple caching and DB operations from AppService, make part of consolidated `getAppConfig`\n\nWIP: fix tests\n\n* fix: rebase conflicts\n\n* refactor: remove app.locals references\n\n* refactor: replace getBalanceConfig with getAppConfig in various strategies and middleware\n\n* refactor: replace appConfig?.balance with getBalanceConfig in various controllers and clients\n\n* test: add balance configuration to titleConvo method in AgentClient tests\n\n* chore: remove unused `openai-chat-tokens` package\n\n* chore: remove unused imports in initializeMCPs.js\n\n* refactor: update balance configuration to use getAppConfig instead of getBalanceConfig\n\n* refactor: integrate configMiddleware for centralized configuration handling\n\n* refactor: optimize email domain validation by removing unnecessary async calls\n\n* refactor: simplify multer storage configuration by removing async calls\n\n* refactor: reorder imports for better readability in user.js\n\n* refactor: replace getAppConfig calls with req.config for improved performance\n\n* chore: replace getAppConfig calls with req.config in tests for centralized configuration handling\n\n* chore: remove unused override config\n\n* refactor: add configMiddleware to endpoint route and replace getAppConfig with req.config\n\n* chore: remove customConfig parameter from TTSService constructor\n\n* refactor: pass appConfig from request to processFileCitations for improved configuration handling\n\n* refactor: remove configMiddleware from endpoint route and retrieve appConfig directly in getEndpointsConfig if not in `req.config`\n\n* test: add mockAppConfig to processFileCitations tests for improved configuration handling\n\n* fix: pass req.config to hasCustomUserVars and call without await after synchronous refactor\n\n* fix: type safety in useExportConversation\n\n* refactor: retrieve appConfig using getAppConfig in PluginController and remove configMiddleware from plugins route, to avoid always retrieving when plugins are cached\n\n* chore: change `MongoUser` typedef to `IUser`\n\n* fix: Add `user` and `config` fields to ServerRequest and update JSDoc type annotations from Express.Request to ServerRequest\n\n* fix: remove unused setAppConfig mock from Server configuration tests","tree":"704bbf88f3f5e635e0b2835b27ad3817485a069f"},"mode":"0040000","name":"services","size":0}],"lastCommit":{"author":{"email":"levy@andes.is","name":"Jón Levy","when":"2025-11-21T14:44:52.000000Z"},"committer":{"email":"danny@librechat.ai","name":"Danny Avila","when":"2025-11-21T09:51:11.000000-05:00"},"hash":"ef3bf0a9321eb8b0a3c1cab7b8b2cec4794ab346","message":"🆔 feat: Add OpenID Connect Federated Provider Token Support (#9931)\n\n* feat: Add OpenID Connect federated provider token support\n\nImplements support for passing federated provider tokens (Cognito, Azure AD, Auth0)\nas variables in LibreChat's librechat.yaml configuration for both custom endpoints\nand MCP servers.\n\nFeatures:\n- New LIBRECHAT_OPENID_* template variables for federated provider tokens\n- JWT claims parsing from ID tokens without verification (for claim extraction)\n- Token validation with expiration checking\n- Support for multiple token storage locations (federatedTokens, openidTokens)\n- Integration with existing template variable system\n- Comprehensive test suite with Cognito-specific scenarios\n- Provider-agnostic design supporting Cognito, Azure AD, Auth0, etc.\n\nSecurity:\n- Server-side only token processing\n- Automatic token expiration validation\n- Graceful fallbacks for missing/invalid tokens\n- No client-side token exposure\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* fix: Add federated token propagation to OIDC authentication strategies\n\nAdds federatedTokens object to user during authentication to enable\nfederated provider token template variables in LibreChat configuration.\n\nChanges:\n- OpenID JWT Strategy: Extract raw JWT from Authorization header and\n attach as federatedTokens.access_token to enable {{LIBRECHAT_OPENID_TOKEN}}\n placeholder resolution\n- OpenID Strategy: Attach tokenset tokens as federatedTokens object to\n standardize token access across both authentication strategies\n\nThis enables proper token propagation for custom endpoints and MCP\nservers that require federated provider tokens for authorization.\n\nResolves missing token issue reported by @ramden in PR #9931\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Denis Ramic \nCo-Authored-By: Claude \n\n* test: Add federatedTokens validation tests for OIDC strategies\n\nAdds comprehensive test coverage for the federated token propagation\nfeature implemented in the authentication strategies.\n\nTests added:\n- Verify federatedTokens object is attached to user with correct structure\n (access_token, refresh_token, expires_at)\n- Verify both tokenset and federatedTokens are present in user object\n- Ensure tokens from OIDC provider are correctly propagated\n\nAlso fixes existing test suite by adding missing mocks:\n- isEmailDomainAllowed function mock\n- findOpenIDUser function mock\n\nThese tests validate the fix from commit 5874ba29f that enables\n{{LIBRECHAT_OPENID_TOKEN}} template variable functionality.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* docs: Remove implementation documentation file\n\nThe PR description already contains all necessary implementation details.\nThis documentation file is redundant and was requested to be removed.\n\n* fix: skip s256 check\n\n* fix(openid): handle missing refresh token in Cognito token refresh response\n\nWhen OPENID_REUSE_TOKENS=true, the token refresh flow was failing because\nCognito (and most OAuth providers) don't return a new refresh token in the\nrefresh grant response - they only return new access and ID tokens.\n\nChanges:\n- Modified setOpenIDAuthTokens() to accept optional existingRefreshToken parameter\n- Updated validation to only require access_token (refresh_token now optional)\n- Added logic to reuse existing refresh token when not provided in tokenset\n- Updated refreshController to pass original refresh token as fallback\n- Added comments explaining standard OAuth 2.0 refresh token behavior\n\nThis fixes the \"Token is not present. User is not authenticated.\" error that\noccurred during silent token refresh with Cognito as the OpenID provider.\n\nFixes: Authentication loop with OPENID_REUSE_TOKENS=true and AWS Cognito\n\n* fix(openid): extract refresh token from cookies for template variable replacement\n\nWhen OPENID_REUSE_TOKENS=true, the openIdJwtStrategy populates user.federatedTokens\nto enable template variable replacement (e.g., {{LIBRECHAT_OPENID_ACCESS_TOKEN}}).\n\nHowever, the refresh_token field was incorrectly sourced from payload.refresh_token,\nwhich is always undefined because:\n1. JWTs don't contain refresh tokens in their payload\n2. The JWT itself IS the access token\n3. Refresh tokens are separate opaque tokens stored in HTTP-only cookies\n\nThis caused extractOpenIDTokenInfo() to receive incomplete federatedTokens,\nresulting in template variables remaining unreplaced in headers.\n\n**Root Cause:**\n- Line 90: `refresh_token: payload.refresh_token` (always undefined)\n- JWTs only contain access token data in their claims\n- Refresh tokens are separate, stored securely in cookies\n\n**Solution:**\n- Import `cookie` module to parse cookies from request\n- Extract refresh token from `refreshToken` cookie\n- Populate federatedTokens with both access token (JWT) and refresh token (from cookie)\n\n**Impact:**\n- Template variables like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} now work correctly\n- Headers in librechat.yaml are properly replaced with actual tokens\n- MCP server authentication with federated tokens now functional\n\n**Technical Details:**\n- passReqToCallback=true in JWT strategy provides req object access\n- Refresh token extracted via cookies.parse(req.headers.cookie).refreshToken\n- Falls back gracefully if cookie header or refreshToken is missing\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* fix: re-resolve headers on each request to pick up fresh federatedTokens\n\n- OpenAIClient now re-resolves headers in chatCompletion() before each API call\n- This ensures template variables like {{LIBRECHAT_OPENID_TOKEN}} are replaced\n with actual token values from req.user.federatedTokens\n- initialize.js now stores original template headers instead of pre-resolved ones\n- Fixes template variable replacement when OPENID_REUSE_TOKENS=true\n\nThe issue was that headers were only resolved once during client initialization,\nbefore openIdJwtStrategy had populated user.federatedTokens. Now headers are\nre-resolved on every request with the current user's fresh tokens.\n\n* debug: add logging to track header resolution in OpenAIClient\n\n* debug: log tokenset structure after refresh to diagnose missing access_token\n\n* fix: set federatedTokens on user object after OAuth refresh\n\n- After successful OAuth token refresh, the user object was not being\n updated with federatedTokens\n- This caused template variable resolution to fail on subsequent requests\n- Now sets user.federatedTokens with access_token, id_token, refresh_token\n and expires_at from the refreshed tokenset\n- Fixes template variables like {{LIBRECHAT_OPENID_TOKEN}} not being\n replaced after token refresh\n- Related to PR #9931 (OpenID federated token support)\n\n* fix(openid): pass user object through agent chain for template variable resolution\n\nRoot cause: buildAgentContext in agents/run.ts called resolveHeaders without\nthe user parameter, preventing OpenID federated token template variables from\nbeing resolved in agent runtime parameters.\n\nChanges:\n- packages/api/src/agents/run.ts: Add user parameter to createRun signature\n- packages/api/src/agents/run.ts: Pass user to resolveHeaders in buildAgentContext\n- api/server/controllers/agents/client.js: Pass user when calling createRun\n- api/server/services/Endpoints/bedrock/options.js: Add resolveHeaders call with debug logging\n- api/server/services/Endpoints/custom/initialize.js: Add debug logging\n- packages/api/src/utils/env.ts: Add comprehensive debug logging and stack traces\n- packages/api/src/utils/oidc.ts: Fix eslint errors (unused type, explicit any)\n\nThis ensures template variables like {{LIBRECHAT_OPENID_TOKEN}} and\n{{LIBRECHAT_USER_OPENIDID}} are properly resolved in both custom endpoint\nheaders and Bedrock AgentCore runtime parameters.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* refactor: remove debug logging from OpenID token template feature\n\nRemoved excessive debug logging that was added during development to make\nthe PR more suitable for upstream review:\n\n- Removed 7 debug statements from OpenAIClient.js\n- Removed all console.log statements from packages/api/src/utils/env.ts\n- Removed debug logging from bedrock/options.js\n- Removed debug logging from custom/initialize.js\n- Removed debug statement from AuthController.js\n\nThis reduces the changeset by ~50 lines while maintaining full functionality\nof the OpenID federated token template variable feature.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* test(openid): add comprehensive unit tests for template variable substitution\n\n- Add 34 unit tests for OIDC token utilities (oidc.spec.ts)\n- Test coverage for token extraction, validation, and placeholder processing\n- Integration tests for full OpenID token flow\n- All tests pass with comprehensive edge case coverage\n\n🤖 Generated with Claude Code\nCo-Authored-By: Claude \n\n* test: fix OpenID federated tokens test failures\n\n- Add serverMetadata() mock to openid-client mock configuration\n * Fixes TypeError in openIdJwtStrategy.js where serverMetadata() was being called\n * Mock now returns jwks_uri and end_session_endpoint as expected by the code\n\n- Update outdated initialize.spec.js test\n * Remove test expecting resolveHeaders call during initialization\n * Header resolution was refactored to be deferred until LLM request time\n * Update test to verify options are returned correctly with useLegacyContent flag\n\nFixes #9931 CI failures for backend unit tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude \n\n* chore: fix package-lock.json conflict\n\n* chore: sync package-log with upstream\n\n* chore: cleanup\n\n* fix: use createSafeUser\n\n* fix: fix createSafeUser signature\n\n* chore: remove comments\n\n* chore: purge comments\n\n* fix: update Jest testPathPattern to testPathPatterns for Jest 30+ compatibility\n\n---------\n\nCo-authored-by: Claude \nCo-authored-by: Denis Ramic \nCo-authored-by: kristjanaapro \n\nchore: import order and add back JSDoc for OpenID JWT callback\n","tree":"9eb3a8c74c976e9215748d12376aaa3842186a35"}}