🪐 feat: MCP OAuth 2.0 Discovery Support (#7924)
* chore: Update @modelcontextprotocol/sdk to version 1.12.3 in package.json and package-lock.json
- Bump version of @modelcontextprotocol/sdk to 1.12.3 to incorporate recent updates.
- Update dependencies for ajv and cross-spawn to their latest versions.
- Add ajv as a new dependency in the sdk module.
- Include json-schema-traverse as a new dependency in the sdk module.
* feat: @librechat/auth
* feat: Add crypto module exports to auth package
- Introduced a new crypto module by creating index.ts in the crypto directory.
- Updated the main index.ts of the auth package to export from the new crypto module.
* feat: Update package dependencies and build scripts for auth package
- Added @librechat/auth as a dependency in package.json and package-lock.json.
- Updated build scripts to include the auth package in both frontend and bun build processes.
- Removed unused mongoose and openid-client dependencies from package-lock.json for cleaner dependency management.
* refactor: Migrate crypto utility functions to @librechat/auth
- Replaced local crypto utility imports with the new @librechat/auth package across multiple files.
- Removed the obsolete crypto.js file and its exports.
- Updated relevant services and models to utilize the new encryption and decryption methods from @librechat/auth.
* feat: Enhance OAuth token handling and update dependencies in auth package
* chore: Remove Token model and TokenService due to restructuring of OAuth handling
- Deleted the Token.js model and TokenService.js, which were responsible for managing OAuth tokens.
- This change is part of a broader refactor to streamline OAuth token management and improve code organization.
* refactor: imports from '@librechat/auth' to '@librechat/api' and add OAuth token handling functionality
* refactor: Simplify logger usage in MCP and FlowStateManager classes
* chore: fix imports
* feat: Add OAuth configuration schema to MCP with token exchange method support
* feat: FIRST PASS Implement MCP OAuth flow with token management and error handling
- Added a new route for handling OAuth callbacks and token retrieval.
- Integrated OAuth token storage and retrieval mechanisms.
- Enhanced MCP connection to support automatic OAuth flow initiation on 401 errors.
- Implemented dynamic client registration and metadata discovery for OAuth.
- Updated MCPManager to manage OAuth tokens and handle authentication requirements.
- Introduced comprehensive logging for OAuth processes and error handling.
* refactor: Update MCPConnection and MCPManager to utilize new URL handling
- Added a `url` property to MCPConnection for better URL management.
- Refactored MCPManager to use the new `url` property instead of a deprecated method for OAuth handling.
- Changed logging from info to debug level for flow manager and token methods initialization.
- Improved comments for clarity on existing tokens and OAuth event listener setup.
* refactor: Improve connection timeout error messages in MCPConnection and MCPManager and use initTimeout for connection
- Updated the connection timeout error messages to include the duration of the timeout.
- Introduced a configurable `connectTimeout` variable in both MCPConnection and MCPManager for better flexibility.
* chore: cleanup MCP OAuth Token exchange handling; fix: erroneous use of flowsCache and remove verbose logs
* refactor: Update MCPManager and MCPTokenStorage to use TokenMethods for token management
- Removed direct token storage handling in MCPManager and replaced it with TokenMethods for better abstraction.
- Refactored MCPTokenStorage methods to accept parameters for token operations, enhancing flexibility and readability.
- Improved logging messages related to token persistence and retrieval processes.
* refactor: Update MCP OAuth handling to use static methods and improve flow management
- Refactored MCPOAuthHandler to utilize static methods for initiating and completing OAuth flows, enhancing clarity and reducing instance dependencies.
- Updated MCPManager to pass flowManager explicitly to OAuth handling methods, improving flexibility in flow state management.
- Enhanced comments and logging for better understanding of OAuth processes and flow state retrieval.
* refactor: Integrate token methods into createMCPTool for enhanced token management
* refactor: Change logging from info to debug level in MCPOAuthHandler for improved log management
* chore: clean up logging
* feat: first pass, auth URL from MCP OAuth flow
* chore: Improve logging format for OAuth authentication URL display
* chore: cleanup mcp manager comments
* feat: add connection reconnection logic in MCPManager
* refactor: reorganize token storage handling in MCP
- Moved token storage logic from MCPManager to a new MCPTokenStorage class for better separation of concerns.
- Updated imports to reflect the new token storage structure.
- Enhanced methods for storing, retrieving, updating, and deleting OAuth tokens, improving overall token management.
* chore: update comment for SYSTEM_USER_ID in MCPManager for clarity
* feat: implement refresh token functionality in MCP
- Added refresh token handling in MCPManager to support token renewal for both app-level and user-specific connections.
- Introduced a refreshTokens function to facilitate token refresh logic.
- Enhanced MCPTokenStorage to manage client information and refresh token processes.
- Updated logging for better traceability during token operations.
* chore: cleanup @librechat/auth
* feat: implement MCP server initialization in a separate service
- Added a new service to handle the initialization of MCP servers, improving code organization and readability.
- Refactored the server startup logic to utilize the new initializeMCP function.
- Removed redundant MCP initialization code from the main server file.
* fix: don't log auth url for user connections
* feat: enhance OAuth flow with success and error handling components
- Updated OAuth callback routes to redirect to new success and error pages instead of sending status messages.
- Introduced `OAuthSuccess` and `OAuthError` components to provide user feedback during authentication.
- Added localization support for success and error messages in the translation files.
- Implemented countdown functionality in the success component for a better user experience.
* fix: refresh token handling for user connections, add missing URL and methods
- add standard enum for system user id and helper for determining app-lvel vs. user-level connections
* refactor: update token handling in MCPManager and MCPTokenStorage
* fix: improve error logging in OAuth authentication handler
* fix: concurrency issues for both login url emission and concurrency of oauth flows for shared flows (same user, same server, multiple calls for same server)
* fix: properly fail shared flows for concurrent server calls and prevent duplication of tokens
* chore: remove unused auth package directory from update configuration
* ci: fix mocks in samlStrategy tests
* ci: add mcpConfig to AppService test setup
* chore: remove obsolete MCP OAuth implementation documentation
* fix: update build script for API to use correct command
* chore: bump version of @librechat/api to 1.2.4
* fix: update abort signal handling in createMCPTool function
* fix: add optional clientInfo parameter to refreshTokensFunction metadata
* refactor: replace app.locals.availableTools with getCachedTools in multiple services and controllers for improved tool management
* fix: concurrent refresh token handling issue
* refactor: add signal parameter to getUserConnection method for improved abort handling
* chore: JSDoc typing for `loadEphemeralAgent`
* refactor: update isConnectionActive method to use destructured parameters for improved readability
* feat: implement caching for MCP tools to handle app-level disconnects for loading list of tools
* ci: fix agent test
2025-06-17 13:50:33 -04:00
|
|
|
const { CacheKeys } = require('librechat-data-provider');
|
|
|
|
const getLogStores = require('~/cache/getLogStores');
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Cache key generators for different tool access patterns
|
|
|
|
* These will support future permission-based caching
|
|
|
|
*/
|
|
|
|
const ToolCacheKeys = {
|
|
|
|
/** Global tools available to all users */
|
|
|
|
GLOBAL: 'tools:global',
|
|
|
|
/** Tools available to a specific user */
|
|
|
|
USER: (userId) => `tools:user:${userId}`,
|
|
|
|
/** Tools available to a specific role */
|
|
|
|
ROLE: (roleId) => `tools:role:${roleId}`,
|
|
|
|
/** Tools available to a specific group */
|
|
|
|
GROUP: (groupId) => `tools:group:${groupId}`,
|
|
|
|
/** Combined effective tools for a user (computed from all sources) */
|
|
|
|
EFFECTIVE: (userId) => `tools:effective:${userId}`,
|
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Retrieves available tools from cache
|
|
|
|
* @function getCachedTools
|
|
|
|
* @param {Object} options - Options for retrieving tools
|
|
|
|
* @param {string} [options.userId] - User ID for user-specific tools
|
|
|
|
* @param {string[]} [options.roleIds] - Role IDs for role-based tools
|
|
|
|
* @param {string[]} [options.groupIds] - Group IDs for group-based tools
|
|
|
|
* @param {boolean} [options.includeGlobal=true] - Whether to include global tools
|
2025-08-23 03:27:05 -04:00
|
|
|
* @returns {Promise<LCAvailableTools|null>} The available tools object or null if not cached
|
🪐 feat: MCP OAuth 2.0 Discovery Support (#7924)
* chore: Update @modelcontextprotocol/sdk to version 1.12.3 in package.json and package-lock.json
- Bump version of @modelcontextprotocol/sdk to 1.12.3 to incorporate recent updates.
- Update dependencies for ajv and cross-spawn to their latest versions.
- Add ajv as a new dependency in the sdk module.
- Include json-schema-traverse as a new dependency in the sdk module.
* feat: @librechat/auth
* feat: Add crypto module exports to auth package
- Introduced a new crypto module by creating index.ts in the crypto directory.
- Updated the main index.ts of the auth package to export from the new crypto module.
* feat: Update package dependencies and build scripts for auth package
- Added @librechat/auth as a dependency in package.json and package-lock.json.
- Updated build scripts to include the auth package in both frontend and bun build processes.
- Removed unused mongoose and openid-client dependencies from package-lock.json for cleaner dependency management.
* refactor: Migrate crypto utility functions to @librechat/auth
- Replaced local crypto utility imports with the new @librechat/auth package across multiple files.
- Removed the obsolete crypto.js file and its exports.
- Updated relevant services and models to utilize the new encryption and decryption methods from @librechat/auth.
* feat: Enhance OAuth token handling and update dependencies in auth package
* chore: Remove Token model and TokenService due to restructuring of OAuth handling
- Deleted the Token.js model and TokenService.js, which were responsible for managing OAuth tokens.
- This change is part of a broader refactor to streamline OAuth token management and improve code organization.
* refactor: imports from '@librechat/auth' to '@librechat/api' and add OAuth token handling functionality
* refactor: Simplify logger usage in MCP and FlowStateManager classes
* chore: fix imports
* feat: Add OAuth configuration schema to MCP with token exchange method support
* feat: FIRST PASS Implement MCP OAuth flow with token management and error handling
- Added a new route for handling OAuth callbacks and token retrieval.
- Integrated OAuth token storage and retrieval mechanisms.
- Enhanced MCP connection to support automatic OAuth flow initiation on 401 errors.
- Implemented dynamic client registration and metadata discovery for OAuth.
- Updated MCPManager to manage OAuth tokens and handle authentication requirements.
- Introduced comprehensive logging for OAuth processes and error handling.
* refactor: Update MCPConnection and MCPManager to utilize new URL handling
- Added a `url` property to MCPConnection for better URL management.
- Refactored MCPManager to use the new `url` property instead of a deprecated method for OAuth handling.
- Changed logging from info to debug level for flow manager and token methods initialization.
- Improved comments for clarity on existing tokens and OAuth event listener setup.
* refactor: Improve connection timeout error messages in MCPConnection and MCPManager and use initTimeout for connection
- Updated the connection timeout error messages to include the duration of the timeout.
- Introduced a configurable `connectTimeout` variable in both MCPConnection and MCPManager for better flexibility.
* chore: cleanup MCP OAuth Token exchange handling; fix: erroneous use of flowsCache and remove verbose logs
* refactor: Update MCPManager and MCPTokenStorage to use TokenMethods for token management
- Removed direct token storage handling in MCPManager and replaced it with TokenMethods for better abstraction.
- Refactored MCPTokenStorage methods to accept parameters for token operations, enhancing flexibility and readability.
- Improved logging messages related to token persistence and retrieval processes.
* refactor: Update MCP OAuth handling to use static methods and improve flow management
- Refactored MCPOAuthHandler to utilize static methods for initiating and completing OAuth flows, enhancing clarity and reducing instance dependencies.
- Updated MCPManager to pass flowManager explicitly to OAuth handling methods, improving flexibility in flow state management.
- Enhanced comments and logging for better understanding of OAuth processes and flow state retrieval.
* refactor: Integrate token methods into createMCPTool for enhanced token management
* refactor: Change logging from info to debug level in MCPOAuthHandler for improved log management
* chore: clean up logging
* feat: first pass, auth URL from MCP OAuth flow
* chore: Improve logging format for OAuth authentication URL display
* chore: cleanup mcp manager comments
* feat: add connection reconnection logic in MCPManager
* refactor: reorganize token storage handling in MCP
- Moved token storage logic from MCPManager to a new MCPTokenStorage class for better separation of concerns.
- Updated imports to reflect the new token storage structure.
- Enhanced methods for storing, retrieving, updating, and deleting OAuth tokens, improving overall token management.
* chore: update comment for SYSTEM_USER_ID in MCPManager for clarity
* feat: implement refresh token functionality in MCP
- Added refresh token handling in MCPManager to support token renewal for both app-level and user-specific connections.
- Introduced a refreshTokens function to facilitate token refresh logic.
- Enhanced MCPTokenStorage to manage client information and refresh token processes.
- Updated logging for better traceability during token operations.
* chore: cleanup @librechat/auth
* feat: implement MCP server initialization in a separate service
- Added a new service to handle the initialization of MCP servers, improving code organization and readability.
- Refactored the server startup logic to utilize the new initializeMCP function.
- Removed redundant MCP initialization code from the main server file.
* fix: don't log auth url for user connections
* feat: enhance OAuth flow with success and error handling components
- Updated OAuth callback routes to redirect to new success and error pages instead of sending status messages.
- Introduced `OAuthSuccess` and `OAuthError` components to provide user feedback during authentication.
- Added localization support for success and error messages in the translation files.
- Implemented countdown functionality in the success component for a better user experience.
* fix: refresh token handling for user connections, add missing URL and methods
- add standard enum for system user id and helper for determining app-lvel vs. user-level connections
* refactor: update token handling in MCPManager and MCPTokenStorage
* fix: improve error logging in OAuth authentication handler
* fix: concurrency issues for both login url emission and concurrency of oauth flows for shared flows (same user, same server, multiple calls for same server)
* fix: properly fail shared flows for concurrent server calls and prevent duplication of tokens
* chore: remove unused auth package directory from update configuration
* ci: fix mocks in samlStrategy tests
* ci: add mcpConfig to AppService test setup
* chore: remove obsolete MCP OAuth implementation documentation
* fix: update build script for API to use correct command
* chore: bump version of @librechat/api to 1.2.4
* fix: update abort signal handling in createMCPTool function
* fix: add optional clientInfo parameter to refreshTokensFunction metadata
* refactor: replace app.locals.availableTools with getCachedTools in multiple services and controllers for improved tool management
* fix: concurrent refresh token handling issue
* refactor: add signal parameter to getUserConnection method for improved abort handling
* chore: JSDoc typing for `loadEphemeralAgent`
* refactor: update isConnectionActive method to use destructured parameters for improved readability
* feat: implement caching for MCP tools to handle app-level disconnects for loading list of tools
* ci: fix agent test
2025-06-17 13:50:33 -04:00
|
|
|
*/
|
|
|
|
async function getCachedTools(options = {}) {
|
|
|
|
const cache = getLogStores(CacheKeys.CONFIG_STORE);
|
|
|
|
const { userId, roleIds = [], groupIds = [], includeGlobal = true } = options;
|
|
|
|
|
|
|
|
// For now, return global tools (current behavior)
|
|
|
|
// This will be expanded to merge tools from different sources
|
|
|
|
if (!userId && includeGlobal) {
|
|
|
|
return await cache.get(ToolCacheKeys.GLOBAL);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Future implementation will merge tools from multiple sources
|
|
|
|
// based on user permissions, roles, and groups
|
|
|
|
if (userId) {
|
2025-08-23 03:27:05 -04:00
|
|
|
/** @type {LCAvailableTools | null} Check if we have pre-computed effective tools for this user */
|
🪐 feat: MCP OAuth 2.0 Discovery Support (#7924)
* chore: Update @modelcontextprotocol/sdk to version 1.12.3 in package.json and package-lock.json
- Bump version of @modelcontextprotocol/sdk to 1.12.3 to incorporate recent updates.
- Update dependencies for ajv and cross-spawn to their latest versions.
- Add ajv as a new dependency in the sdk module.
- Include json-schema-traverse as a new dependency in the sdk module.
* feat: @librechat/auth
* feat: Add crypto module exports to auth package
- Introduced a new crypto module by creating index.ts in the crypto directory.
- Updated the main index.ts of the auth package to export from the new crypto module.
* feat: Update package dependencies and build scripts for auth package
- Added @librechat/auth as a dependency in package.json and package-lock.json.
- Updated build scripts to include the auth package in both frontend and bun build processes.
- Removed unused mongoose and openid-client dependencies from package-lock.json for cleaner dependency management.
* refactor: Migrate crypto utility functions to @librechat/auth
- Replaced local crypto utility imports with the new @librechat/auth package across multiple files.
- Removed the obsolete crypto.js file and its exports.
- Updated relevant services and models to utilize the new encryption and decryption methods from @librechat/auth.
* feat: Enhance OAuth token handling and update dependencies in auth package
* chore: Remove Token model and TokenService due to restructuring of OAuth handling
- Deleted the Token.js model and TokenService.js, which were responsible for managing OAuth tokens.
- This change is part of a broader refactor to streamline OAuth token management and improve code organization.
* refactor: imports from '@librechat/auth' to '@librechat/api' and add OAuth token handling functionality
* refactor: Simplify logger usage in MCP and FlowStateManager classes
* chore: fix imports
* feat: Add OAuth configuration schema to MCP with token exchange method support
* feat: FIRST PASS Implement MCP OAuth flow with token management and error handling
- Added a new route for handling OAuth callbacks and token retrieval.
- Integrated OAuth token storage and retrieval mechanisms.
- Enhanced MCP connection to support automatic OAuth flow initiation on 401 errors.
- Implemented dynamic client registration and metadata discovery for OAuth.
- Updated MCPManager to manage OAuth tokens and handle authentication requirements.
- Introduced comprehensive logging for OAuth processes and error handling.
* refactor: Update MCPConnection and MCPManager to utilize new URL handling
- Added a `url` property to MCPConnection for better URL management.
- Refactored MCPManager to use the new `url` property instead of a deprecated method for OAuth handling.
- Changed logging from info to debug level for flow manager and token methods initialization.
- Improved comments for clarity on existing tokens and OAuth event listener setup.
* refactor: Improve connection timeout error messages in MCPConnection and MCPManager and use initTimeout for connection
- Updated the connection timeout error messages to include the duration of the timeout.
- Introduced a configurable `connectTimeout` variable in both MCPConnection and MCPManager for better flexibility.
* chore: cleanup MCP OAuth Token exchange handling; fix: erroneous use of flowsCache and remove verbose logs
* refactor: Update MCPManager and MCPTokenStorage to use TokenMethods for token management
- Removed direct token storage handling in MCPManager and replaced it with TokenMethods for better abstraction.
- Refactored MCPTokenStorage methods to accept parameters for token operations, enhancing flexibility and readability.
- Improved logging messages related to token persistence and retrieval processes.
* refactor: Update MCP OAuth handling to use static methods and improve flow management
- Refactored MCPOAuthHandler to utilize static methods for initiating and completing OAuth flows, enhancing clarity and reducing instance dependencies.
- Updated MCPManager to pass flowManager explicitly to OAuth handling methods, improving flexibility in flow state management.
- Enhanced comments and logging for better understanding of OAuth processes and flow state retrieval.
* refactor: Integrate token methods into createMCPTool for enhanced token management
* refactor: Change logging from info to debug level in MCPOAuthHandler for improved log management
* chore: clean up logging
* feat: first pass, auth URL from MCP OAuth flow
* chore: Improve logging format for OAuth authentication URL display
* chore: cleanup mcp manager comments
* feat: add connection reconnection logic in MCPManager
* refactor: reorganize token storage handling in MCP
- Moved token storage logic from MCPManager to a new MCPTokenStorage class for better separation of concerns.
- Updated imports to reflect the new token storage structure.
- Enhanced methods for storing, retrieving, updating, and deleting OAuth tokens, improving overall token management.
* chore: update comment for SYSTEM_USER_ID in MCPManager for clarity
* feat: implement refresh token functionality in MCP
- Added refresh token handling in MCPManager to support token renewal for both app-level and user-specific connections.
- Introduced a refreshTokens function to facilitate token refresh logic.
- Enhanced MCPTokenStorage to manage client information and refresh token processes.
- Updated logging for better traceability during token operations.
* chore: cleanup @librechat/auth
* feat: implement MCP server initialization in a separate service
- Added a new service to handle the initialization of MCP servers, improving code organization and readability.
- Refactored the server startup logic to utilize the new initializeMCP function.
- Removed redundant MCP initialization code from the main server file.
* fix: don't log auth url for user connections
* feat: enhance OAuth flow with success and error handling components
- Updated OAuth callback routes to redirect to new success and error pages instead of sending status messages.
- Introduced `OAuthSuccess` and `OAuthError` components to provide user feedback during authentication.
- Added localization support for success and error messages in the translation files.
- Implemented countdown functionality in the success component for a better user experience.
* fix: refresh token handling for user connections, add missing URL and methods
- add standard enum for system user id and helper for determining app-lvel vs. user-level connections
* refactor: update token handling in MCPManager and MCPTokenStorage
* fix: improve error logging in OAuth authentication handler
* fix: concurrency issues for both login url emission and concurrency of oauth flows for shared flows (same user, same server, multiple calls for same server)
* fix: properly fail shared flows for concurrent server calls and prevent duplication of tokens
* chore: remove unused auth package directory from update configuration
* ci: fix mocks in samlStrategy tests
* ci: add mcpConfig to AppService test setup
* chore: remove obsolete MCP OAuth implementation documentation
* fix: update build script for API to use correct command
* chore: bump version of @librechat/api to 1.2.4
* fix: update abort signal handling in createMCPTool function
* fix: add optional clientInfo parameter to refreshTokensFunction metadata
* refactor: replace app.locals.availableTools with getCachedTools in multiple services and controllers for improved tool management
* fix: concurrent refresh token handling issue
* refactor: add signal parameter to getUserConnection method for improved abort handling
* chore: JSDoc typing for `loadEphemeralAgent`
* refactor: update isConnectionActive method to use destructured parameters for improved readability
* feat: implement caching for MCP tools to handle app-level disconnects for loading list of tools
* ci: fix agent test
2025-06-17 13:50:33 -04:00
|
|
|
const effectiveTools = await cache.get(ToolCacheKeys.EFFECTIVE(userId));
|
|
|
|
if (effectiveTools) {
|
|
|
|
return effectiveTools;
|
|
|
|
}
|
|
|
|
|
2025-08-23 03:27:05 -04:00
|
|
|
/** @type {LCAvailableTools | null} Otherwise, compute from individual sources */
|
🪐 feat: MCP OAuth 2.0 Discovery Support (#7924)
* chore: Update @modelcontextprotocol/sdk to version 1.12.3 in package.json and package-lock.json
- Bump version of @modelcontextprotocol/sdk to 1.12.3 to incorporate recent updates.
- Update dependencies for ajv and cross-spawn to their latest versions.
- Add ajv as a new dependency in the sdk module.
- Include json-schema-traverse as a new dependency in the sdk module.
* feat: @librechat/auth
* feat: Add crypto module exports to auth package
- Introduced a new crypto module by creating index.ts in the crypto directory.
- Updated the main index.ts of the auth package to export from the new crypto module.
* feat: Update package dependencies and build scripts for auth package
- Added @librechat/auth as a dependency in package.json and package-lock.json.
- Updated build scripts to include the auth package in both frontend and bun build processes.
- Removed unused mongoose and openid-client dependencies from package-lock.json for cleaner dependency management.
* refactor: Migrate crypto utility functions to @librechat/auth
- Replaced local crypto utility imports with the new @librechat/auth package across multiple files.
- Removed the obsolete crypto.js file and its exports.
- Updated relevant services and models to utilize the new encryption and decryption methods from @librechat/auth.
* feat: Enhance OAuth token handling and update dependencies in auth package
* chore: Remove Token model and TokenService due to restructuring of OAuth handling
- Deleted the Token.js model and TokenService.js, which were responsible for managing OAuth tokens.
- This change is part of a broader refactor to streamline OAuth token management and improve code organization.
* refactor: imports from '@librechat/auth' to '@librechat/api' and add OAuth token handling functionality
* refactor: Simplify logger usage in MCP and FlowStateManager classes
* chore: fix imports
* feat: Add OAuth configuration schema to MCP with token exchange method support
* feat: FIRST PASS Implement MCP OAuth flow with token management and error handling
- Added a new route for handling OAuth callbacks and token retrieval.
- Integrated OAuth token storage and retrieval mechanisms.
- Enhanced MCP connection to support automatic OAuth flow initiation on 401 errors.
- Implemented dynamic client registration and metadata discovery for OAuth.
- Updated MCPManager to manage OAuth tokens and handle authentication requirements.
- Introduced comprehensive logging for OAuth processes and error handling.
* refactor: Update MCPConnection and MCPManager to utilize new URL handling
- Added a `url` property to MCPConnection for better URL management.
- Refactored MCPManager to use the new `url` property instead of a deprecated method for OAuth handling.
- Changed logging from info to debug level for flow manager and token methods initialization.
- Improved comments for clarity on existing tokens and OAuth event listener setup.
* refactor: Improve connection timeout error messages in MCPConnection and MCPManager and use initTimeout for connection
- Updated the connection timeout error messages to include the duration of the timeout.
- Introduced a configurable `connectTimeout` variable in both MCPConnection and MCPManager for better flexibility.
* chore: cleanup MCP OAuth Token exchange handling; fix: erroneous use of flowsCache and remove verbose logs
* refactor: Update MCPManager and MCPTokenStorage to use TokenMethods for token management
- Removed direct token storage handling in MCPManager and replaced it with TokenMethods for better abstraction.
- Refactored MCPTokenStorage methods to accept parameters for token operations, enhancing flexibility and readability.
- Improved logging messages related to token persistence and retrieval processes.
* refactor: Update MCP OAuth handling to use static methods and improve flow management
- Refactored MCPOAuthHandler to utilize static methods for initiating and completing OAuth flows, enhancing clarity and reducing instance dependencies.
- Updated MCPManager to pass flowManager explicitly to OAuth handling methods, improving flexibility in flow state management.
- Enhanced comments and logging for better understanding of OAuth processes and flow state retrieval.
* refactor: Integrate token methods into createMCPTool for enhanced token management
* refactor: Change logging from info to debug level in MCPOAuthHandler for improved log management
* chore: clean up logging
* feat: first pass, auth URL from MCP OAuth flow
* chore: Improve logging format for OAuth authentication URL display
* chore: cleanup mcp manager comments
* feat: add connection reconnection logic in MCPManager
* refactor: reorganize token storage handling in MCP
- Moved token storage logic from MCPManager to a new MCPTokenStorage class for better separation of concerns.
- Updated imports to reflect the new token storage structure.
- Enhanced methods for storing, retrieving, updating, and deleting OAuth tokens, improving overall token management.
* chore: update comment for SYSTEM_USER_ID in MCPManager for clarity
* feat: implement refresh token functionality in MCP
- Added refresh token handling in MCPManager to support token renewal for both app-level and user-specific connections.
- Introduced a refreshTokens function to facilitate token refresh logic.
- Enhanced MCPTokenStorage to manage client information and refresh token processes.
- Updated logging for better traceability during token operations.
* chore: cleanup @librechat/auth
* feat: implement MCP server initialization in a separate service
- Added a new service to handle the initialization of MCP servers, improving code organization and readability.
- Refactored the server startup logic to utilize the new initializeMCP function.
- Removed redundant MCP initialization code from the main server file.
* fix: don't log auth url for user connections
* feat: enhance OAuth flow with success and error handling components
- Updated OAuth callback routes to redirect to new success and error pages instead of sending status messages.
- Introduced `OAuthSuccess` and `OAuthError` components to provide user feedback during authentication.
- Added localization support for success and error messages in the translation files.
- Implemented countdown functionality in the success component for a better user experience.
* fix: refresh token handling for user connections, add missing URL and methods
- add standard enum for system user id and helper for determining app-lvel vs. user-level connections
* refactor: update token handling in MCPManager and MCPTokenStorage
* fix: improve error logging in OAuth authentication handler
* fix: concurrency issues for both login url emission and concurrency of oauth flows for shared flows (same user, same server, multiple calls for same server)
* fix: properly fail shared flows for concurrent server calls and prevent duplication of tokens
* chore: remove unused auth package directory from update configuration
* ci: fix mocks in samlStrategy tests
* ci: add mcpConfig to AppService test setup
* chore: remove obsolete MCP OAuth implementation documentation
* fix: update build script for API to use correct command
* chore: bump version of @librechat/api to 1.2.4
* fix: update abort signal handling in createMCPTool function
* fix: add optional clientInfo parameter to refreshTokensFunction metadata
* refactor: replace app.locals.availableTools with getCachedTools in multiple services and controllers for improved tool management
* fix: concurrent refresh token handling issue
* refactor: add signal parameter to getUserConnection method for improved abort handling
* chore: JSDoc typing for `loadEphemeralAgent`
* refactor: update isConnectionActive method to use destructured parameters for improved readability
* feat: implement caching for MCP tools to handle app-level disconnects for loading list of tools
* ci: fix agent test
2025-06-17 13:50:33 -04:00
|
|
|
const toolSources = [];
|
|
|
|
|
|
|
|
if (includeGlobal) {
|
|
|
|
const globalTools = await cache.get(ToolCacheKeys.GLOBAL);
|
|
|
|
if (globalTools) {
|
|
|
|
toolSources.push(globalTools);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// User-specific tools
|
|
|
|
const userTools = await cache.get(ToolCacheKeys.USER(userId));
|
|
|
|
if (userTools) {
|
|
|
|
toolSources.push(userTools);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Role-based tools
|
|
|
|
for (const roleId of roleIds) {
|
|
|
|
const roleTools = await cache.get(ToolCacheKeys.ROLE(roleId));
|
|
|
|
if (roleTools) {
|
|
|
|
toolSources.push(roleTools);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Group-based tools
|
|
|
|
for (const groupId of groupIds) {
|
|
|
|
const groupTools = await cache.get(ToolCacheKeys.GROUP(groupId));
|
|
|
|
if (groupTools) {
|
|
|
|
toolSources.push(groupTools);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Merge all tool sources (for now, simple merge - future will handle conflicts)
|
|
|
|
if (toolSources.length > 0) {
|
|
|
|
return mergeToolSources(toolSources);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Sets available tools in cache
|
|
|
|
* @function setCachedTools
|
|
|
|
* @param {Object} tools - The tools object to cache
|
|
|
|
* @param {Object} options - Options for caching tools
|
|
|
|
* @param {string} [options.userId] - User ID for user-specific tools
|
|
|
|
* @param {string} [options.roleId] - Role ID for role-based tools
|
|
|
|
* @param {string} [options.groupId] - Group ID for group-based tools
|
|
|
|
* @param {boolean} [options.isGlobal=false] - Whether these are global tools
|
|
|
|
* @param {number} [options.ttl] - Time to live in milliseconds
|
|
|
|
* @returns {Promise<boolean>} Whether the operation was successful
|
|
|
|
*/
|
|
|
|
async function setCachedTools(tools, options = {}) {
|
|
|
|
const cache = getLogStores(CacheKeys.CONFIG_STORE);
|
|
|
|
const { userId, roleId, groupId, isGlobal = false, ttl } = options;
|
|
|
|
|
|
|
|
let cacheKey;
|
|
|
|
if (isGlobal || (!userId && !roleId && !groupId)) {
|
|
|
|
cacheKey = ToolCacheKeys.GLOBAL;
|
|
|
|
} else if (userId) {
|
|
|
|
cacheKey = ToolCacheKeys.USER(userId);
|
|
|
|
} else if (roleId) {
|
|
|
|
cacheKey = ToolCacheKeys.ROLE(roleId);
|
|
|
|
} else if (groupId) {
|
|
|
|
cacheKey = ToolCacheKeys.GROUP(groupId);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!cacheKey) {
|
|
|
|
throw new Error('Invalid cache key options provided');
|
|
|
|
}
|
|
|
|
|
|
|
|
return await cache.set(cacheKey, tools, ttl);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Invalidates cached tools
|
|
|
|
* @function invalidateCachedTools
|
|
|
|
* @param {Object} options - Options for invalidating tools
|
|
|
|
* @param {string} [options.userId] - User ID to invalidate
|
|
|
|
* @param {string} [options.roleId] - Role ID to invalidate
|
|
|
|
* @param {string} [options.groupId] - Group ID to invalidate
|
|
|
|
* @param {boolean} [options.invalidateGlobal=false] - Whether to invalidate global tools
|
|
|
|
* @param {boolean} [options.invalidateEffective=true] - Whether to invalidate effective tools
|
|
|
|
* @returns {Promise<void>}
|
|
|
|
*/
|
|
|
|
async function invalidateCachedTools(options = {}) {
|
|
|
|
const cache = getLogStores(CacheKeys.CONFIG_STORE);
|
|
|
|
const { userId, roleId, groupId, invalidateGlobal = false, invalidateEffective = true } = options;
|
|
|
|
|
|
|
|
const keysToDelete = [];
|
|
|
|
|
|
|
|
if (invalidateGlobal) {
|
|
|
|
keysToDelete.push(ToolCacheKeys.GLOBAL);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (userId) {
|
|
|
|
keysToDelete.push(ToolCacheKeys.USER(userId));
|
|
|
|
if (invalidateEffective) {
|
|
|
|
keysToDelete.push(ToolCacheKeys.EFFECTIVE(userId));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (roleId) {
|
|
|
|
keysToDelete.push(ToolCacheKeys.ROLE(roleId));
|
|
|
|
// TODO: In future, invalidate all users with this role
|
|
|
|
}
|
|
|
|
|
|
|
|
if (groupId) {
|
|
|
|
keysToDelete.push(ToolCacheKeys.GROUP(groupId));
|
|
|
|
// TODO: In future, invalidate all users in this group
|
|
|
|
}
|
|
|
|
|
|
|
|
await Promise.all(keysToDelete.map((key) => cache.delete(key)));
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Computes and caches effective tools for a user
|
|
|
|
* @function computeEffectiveTools
|
|
|
|
* @param {string} userId - The user ID
|
|
|
|
* @param {Object} context - Context containing user's roles and groups
|
|
|
|
* @param {string[]} [context.roleIds=[]] - User's role IDs
|
|
|
|
* @param {string[]} [context.groupIds=[]] - User's group IDs
|
|
|
|
* @param {number} [ttl] - Time to live for the computed result
|
|
|
|
* @returns {Promise<Object>} The computed effective tools
|
|
|
|
*/
|
|
|
|
async function computeEffectiveTools(userId, context = {}, ttl) {
|
|
|
|
const { roleIds = [], groupIds = [] } = context;
|
|
|
|
|
|
|
|
// Get all tool sources
|
|
|
|
const tools = await getCachedTools({
|
|
|
|
userId,
|
|
|
|
roleIds,
|
|
|
|
groupIds,
|
|
|
|
includeGlobal: true,
|
|
|
|
});
|
|
|
|
|
|
|
|
if (tools) {
|
|
|
|
// Cache the computed result
|
|
|
|
const cache = getLogStores(CacheKeys.CONFIG_STORE);
|
|
|
|
await cache.set(ToolCacheKeys.EFFECTIVE(userId), tools, ttl);
|
|
|
|
}
|
|
|
|
|
|
|
|
return tools;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Merges multiple tool sources into a single tools object
|
|
|
|
* @function mergeToolSources
|
|
|
|
* @param {Object[]} sources - Array of tool objects to merge
|
|
|
|
* @returns {Object} Merged tools object
|
|
|
|
*/
|
|
|
|
function mergeToolSources(sources) {
|
|
|
|
// For now, simple merge that combines all tools
|
|
|
|
// Future implementation will handle:
|
|
|
|
// - Permission precedence (deny > allow)
|
|
|
|
// - Tool property conflicts
|
|
|
|
// - Metadata merging
|
|
|
|
const merged = {};
|
|
|
|
|
|
|
|
for (const source of sources) {
|
|
|
|
if (!source || typeof source !== 'object') {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (const [toolId, toolConfig] of Object.entries(source)) {
|
|
|
|
// Simple last-write-wins for now
|
|
|
|
// Future: merge based on permission levels
|
|
|
|
merged[toolId] = toolConfig;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return merged;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Middleware-friendly function to get tools for a request
|
|
|
|
* @function getToolsForRequest
|
|
|
|
* @param {Object} req - Express request object
|
|
|
|
* @returns {Promise<Object|null>} Available tools for the request
|
|
|
|
*/
|
|
|
|
async function getToolsForRequest(req) {
|
|
|
|
const userId = req.user?.id;
|
|
|
|
|
|
|
|
// For now, return global tools if no user
|
|
|
|
if (!userId) {
|
|
|
|
return getCachedTools({ includeGlobal: true });
|
|
|
|
}
|
|
|
|
|
|
|
|
// Future: Extract roles and groups from req.user
|
|
|
|
const roleIds = req.user?.roles || [];
|
|
|
|
const groupIds = req.user?.groups || [];
|
|
|
|
|
|
|
|
return getCachedTools({
|
|
|
|
userId,
|
|
|
|
roleIds,
|
|
|
|
groupIds,
|
|
|
|
includeGlobal: true,
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
|
|
|
module.exports = {
|
|
|
|
ToolCacheKeys,
|
|
|
|
getCachedTools,
|
|
|
|
setCachedTools,
|
|
|
|
getToolsForRequest,
|
|
|
|
invalidateCachedTools,
|
|
|
|
computeEffectiveTools,
|
|
|
|
};
|