fix(models): update user and token operations to use centralized functions

api/server/controllers/AuthController.js

@@ -9,12 +9,10 @@ const {
   requestPasswordReset,
   setOpenIDAuthTokens,
 } = require('~/server/services/AuthService');
-const { findUser, getUserById } = require('~/models');
+const { findUser, getUserById, deleteAllUserSessions, findSession } = require('~/models');
 const { getOpenIdConfig } = require('~/strategies');
 const { isEnabled } = require('~/server/utils');
 
-const Session = require('~/db/models').Session;
-
 const registrationController = async (req, res) => {
   try {
     const response = await registerUser(req.body);
@@ -50,7 +48,7 @@ const resetPasswordController = async (req, res) => {
     if (resetPasswordService instanceof Error) {
       return res.status(400).json(resetPasswordService);
     } else {
-      await Session.deleteAllUserSessions({ userId: req.body.userId });
+      await deleteAllUserSessions({ userId: req.body.userId });
       return res.status(200).json(resetPasswordService);
     }
   } catch (e) {
@@ -98,7 +96,7 @@ const refreshController = async (req, res) => {
     }
 
     // Find the session with the hashed refresh token
-    const session = await Session.findSession({
+    const session = await findSession({
       userId: userId,
       refreshToken: refreshToken,
     });

api/server/controllers/TwoFactorController.js

@@ -1,16 +1,15 @@
-const mongoose = require('mongoose');
 const { logger } = require('@librechat/data-schemas');
 const {
+  verifyTOTP,
+  getTOTPSecret,
+  verifyBackupCode,
   generateTOTPSecret,
   generateBackupCodes,
-  verifyTOTP,
-  verifyBackupCode,
-  getTOTPSecret,
 } = require('~/server/services/twoFactorService');
+const { getUserById, updateUser } = require('~/models');
 const { encryptV3 } = require('~/server/utils/crypto');
-const safeAppTitle = (process.env.APP_TITLE || 'LibreChat').replace(/\s+/g, '');
 
-const User = require('~/db/models').User;
+const safeAppTitle = (process.env.APP_TITLE || 'LibreChat').replace(/\s+/g, '');
 
 /**
  * Enable 2FA for the user by generating a new TOTP secret and backup codes.
@@ -26,7 +25,7 @@ const enable2FA = async (req, res) => {
     const encryptedSecret = encryptV3(secret);
 
     // Update the user record: store the secret & backup codes and set twoFactorEnabled to false.
-    const user = await User.updateUser(userId, {
+    const user = await updateUser(userId, {
       totpSecret: encryptedSecret,
       backupCodes: codeObjects,
       twoFactorEnabled: false,
@@ -48,7 +47,7 @@ const verify2FA = async (req, res) => {
   try {
     const userId = req.user.id;
     const { token, backupCode } = req.body;
-    const user = await User.getUserById(userId);
+    const user = await getUserById(userId);
 
     if (!user || !user.totpSecret) {
       return res.status(400).json({ message: '2FA not initiated' });
@@ -80,7 +79,7 @@ const confirm2FA = async (req, res) => {
   try {
     const userId = req.user.id;
     const { token } = req.body;
-    const user = await User.getUserById(userId);
+    const user = await getUserById(userId);
 
     if (!user || !user.totpSecret) {
       return res.status(400).json({ message: '2FA not initiated' });
@@ -88,7 +87,7 @@ const confirm2FA = async (req, res) => {
 
     const secret = await getTOTPSecret(user.totpSecret);
     if (await verifyTOTP(secret, token)) {
-      await User.updateUser(userId, { twoFactorEnabled: true });
+      await updateUser(userId, { twoFactorEnabled: true });
       return res.status(200).json();
     }
     return res.status(400).json({ message: 'Invalid token.' });
@@ -104,7 +103,7 @@ const confirm2FA = async (req, res) => {
 const disable2FA = async (req, res) => {
   try {
     const userId = req.user.id;
-    await User.updateUser(userId, { totpSecret: null, backupCodes: [], twoFactorEnabled: false });
+    await updateUser(userId, { totpSecret: null, backupCodes: [], twoFactorEnabled: false });
     return res.status(200).json();
   } catch (err) {
     logger.error('[disable2FA]', err);
@@ -119,7 +118,7 @@ const regenerateBackupCodes = async (req, res) => {
   try {
     const userId = req.user.id;
     const { plainCodes, codeObjects } = await generateBackupCodes();
-    await User.updateUser(userId, { backupCodes: codeObjects });
+    await updateUser(userId, { backupCodes: codeObjects });
     return res.status(200).json({
       backupCodes: plainCodes,
       backupCodesHash: codeObjects,

api/server/controllers/UserController.js

@@ -4,9 +4,17 @@ const {
   webSearchKeys,
   extractWebSearchEnvVars,
 } = require('librechat-data-provider');
-const mongoose = require('mongoose');
 const { logger } = require('@librechat/data-schemas');
-const { getFiles, deleteFiles, deleteConvos, deletePresets, deleteMessages } = require('~/models');
+const {
+  getFiles,
+  updateUser,
+  deleteFiles,
+  deleteConvos,
+  deletePresets,
+  deleteMessages,
+  deleteUserById,
+  deleteAllUserSessions,
+} = require('~/models');
 const { updateUserPluginAuth, deleteUserPluginAuth } = require('~/server/services/PluginService');
 const { updateUserPluginsService, deleteUserKey } = require('~/server/services/UserService');
 const { verifyEmail, resendVerificationEmail } = require('~/server/services/AuthService');
@@ -16,7 +24,6 @@ const { deleteAllSharedLinks } = require('~/models/Share');
 const { deleteToolCalls } = require('~/models/ToolCall');
 
 const Transaction = require('~/db/models').Transaction;
-const Session = require('~/db/models').Session;
 const Balance = require('~/db/models').Balance;
 const User = require('~/db/models').User;
 
@@ -32,7 +39,7 @@ const getUserController = async (req, res) => {
     const originalAvatar = userData.avatar;
     try {
       userData.avatar = await getNewS3URL(userData.avatar);
-      await User.updateUser(userData.id, { avatar: userData.avatar });
+      await updateUser(userData.id, { avatar: userData.avatar });
     } catch (error) {
       userData.avatar = originalAvatar;
       logger.error('Error getting new S3 URL for avatar:', error);
@@ -153,7 +160,7 @@ const deleteUserController = async (req, res) => {
 
   try {
     await deleteMessages({ user: user.id }); // delete user messages
-    await Session.deleteAllUserSessions({ userId: user.id }); // delete user sessions
+    await deleteAllUserSessions({ userId: user.id }); // delete user sessions
     await Transaction.deleteMany({ user: user.id }); // delete user transactions
     await deleteUserKey({ userId: user.id, all: true }); // delete user keys
     await Balance.deleteMany({ user: user._id }); // delete user balances
@@ -161,7 +168,7 @@ const deleteUserController = async (req, res) => {
     /* TODO: Delete Assistant Threads */
     await deleteConvos(user.id); // delete user convos
     await deleteUserPluginAuth(user.id, null, true); // delete user plugin auth
-    await User.deleteUserById(user.id); // delete user
+    await deleteUserById(user.id); // delete user
     await deleteAllSharedLinks(user.id); // delete user shared links
     await deleteUserFiles(req); // delete user files
     await deleteFiles(null, user.id); // delete database files in case of orphaned files from previous steps

api/server/controllers/auth/TwoFactorAuthController.js

@@ -1,14 +1,12 @@
 const jwt = require('jsonwebtoken');
-const mongoose = require('mongoose');
+const { logger } = require('@librechat/data-schemas');
 const {
   verifyTOTP,
-  verifyBackupCode,
   getTOTPSecret,
+  verifyBackupCode,
 } = require('~/server/services/twoFactorService');
 const { setAuthTokens } = require('~/server/services/AuthService');
-const { logger } = require('@librechat/data-schemas');
-
-const User = require('~/db/models').User;
+const { getUserById } = require('~/models');
 
 /**
  * Verifies the 2FA code during login using a temporary token.
@@ -27,7 +25,7 @@ const verify2FAWithTempToken = async (req, res) => {
       return res.status(401).json({ message: 'Invalid or expired temporary token' });
     }
 
-    const user = await User.getUserById(payload.userId);
+    const user = await getUserById(payload.userId);
     if (!user || !user.twoFactorEnabled) {
       return res.status(400).json({ message: '2FA is not enabled for this user' });
     }