fix: reuse existing OAuth client registrations to prevent client_id mismatch

When using auto-discovered OAuth (DCR), LibreChat calls /register on every
flow initiation, getting a new client_id each time. When concurrent
connections or reconnections happen, the client_id used during /authorize
differs from the one used during /token, causing the server to reject the
exchange.

Before registering a new client, check if a valid client registration
already exists in the database and reuse it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Denis Palnitsky 2026-02-24 12:38:22 +01:00 committed by Danny Avila
parent 33ee7dea1e
commit 2fcf8c5419
4 changed files with 261 additions and 9 deletions

View file

@ -270,6 +270,7 @@ describe('MCPConnectionFactory', () => {
{},
undefined,
undefined,
oauthOptions.tokenMethods.findToken,
);
// initFlow must be awaited BEFORE the redirect to guarantee state is stored