🔧 fix: Chat Middleware, Zod Conversion, Auto-Save and S3 URL Refresh (#6720)

* 🔧 feat: Add configurable S3 URL refresh expiry time

* fix: Set default width and height for URLIcon component in case container style results in NaN

* refactor: Enhance auto-save functionality with debounced restore methods

* feat: Add support for additionalProperties in JSON schema conversion to Zod

* test: Add tests for additionalProperties handling in JSON schema to Zod conversion

* chore: Reorder import statements for better readability in ask route

* fix: Handle additional successful response status code (200) in SSE error handler

* fix: add missing rate limiting middleware for bedrock and agent chat routes

* fix: update moderation middleware to check feature flag before processing requests

* fix: add moderation middleware to chat routes for text moderation

* Revert "refactor: Enhance auto-save functionality with debounced restore methods"

This reverts commit d2e4134d1f.

* refactor: Move base64 encoding/decoding functions to top-level scope and optimize input handling

api/server/middleware/moderateText.js

@@ -1,39 +1,41 @@
 const axios = require('axios');
 const { ErrorTypes } = require('librechat-data-provider');
+const { isEnabled } = require('~/server/utils');
 const denyRequest = require('./denyRequest');
 const { logger } = require('~/config');
 
 async function moderateText(req, res, next) {
-  if (process.env.OPENAI_MODERATION === 'true') {
-    try {
-      const { text } = req.body;
+  if (!isEnabled(process.env.OPENAI_MODERATION)) {
+    return next();
+  }
+  try {
+    const { text } = req.body;
 
-      const response = await axios.post(
-        process.env.OPENAI_MODERATION_REVERSE_PROXY || 'https://api.openai.com/v1/moderations',
-        {
-          input: text,
+    const response = await axios.post(
+      process.env.OPENAI_MODERATION_REVERSE_PROXY || 'https://api.openai.com/v1/moderations',
+      {
+        input: text,
+      },
+      {
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${process.env.OPENAI_MODERATION_API_KEY}`,
         },
-        {
-          headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${process.env.OPENAI_MODERATION_API_KEY}`,
-          },
-        },
-      );
+      },
+    );
 
-      const results = response.data.results;
-      const flagged = results.some((result) => result.flagged);
+    const results = response.data.results;
+    const flagged = results.some((result) => result.flagged);
 
-      if (flagged) {
-        const type = ErrorTypes.MODERATION;
-        const errorMessage = { type };
-        return await denyRequest(req, res, errorMessage);
-      }
-    } catch (error) {
-      logger.error('Error in moderateText:', error);
-      const errorMessage = 'error in moderation check';
+    if (flagged) {
+      const type = ErrorTypes.MODERATION;
+      const errorMessage = { type };
       return await denyRequest(req, res, errorMessage);
     }
+  } catch (error) {
+    logger.error('Error in moderateText:', error);
+    const errorMessage = 'error in moderation check';
+    return await denyRequest(req, res, errorMessage);
   }
   next();
 }

api/server/routes/agents/chat.js

@@ -3,6 +3,7 @@ const { PermissionTypes, Permissions } = require('librechat-data-provider');
 const {
   setHeaders,
   handleAbort,
+  moderateText,
   // validateModel,
   generateCheckAccess,
   validateConvoAccess,
@@ -14,6 +15,7 @@ const addTitle = require('~/server/services/Endpoints/agents/title');
 
 const router = express.Router();
 
+router.use(moderateText);
 router.post('/abort', handleAbort());
 
 const checkAgentAccess = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);

api/server/routes/agents/index.js

@@ -1,21 +1,40 @@
 const express = require('express');
-const router = express.Router();
 const {
   uaParser,
   checkBan,
   requireJwtAuth,
-  // concurrentLimiter,
-  // messageIpLimiter,
-  // messageUserLimiter,
+  messageIpLimiter,
+  concurrentLimiter,
+  messageUserLimiter,
 } = require('~/server/middleware');
-
+const { isEnabled } = require('~/server/utils');
 const { v1 } = require('./v1');
 const chat = require('./chat');
 
+const { LIMIT_CONCURRENT_MESSAGES, LIMIT_MESSAGE_IP, LIMIT_MESSAGE_USER } = process.env ?? {};
+
+const router = express.Router();
+
 router.use(requireJwtAuth);
 router.use(checkBan);
 router.use(uaParser);
+
 router.use('/', v1);
-router.use('/chat', chat);
+
+const chatRouter = express.Router();
+if (isEnabled(LIMIT_CONCURRENT_MESSAGES)) {
+  chatRouter.use(concurrentLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_IP)) {
+  chatRouter.use(messageIpLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_USER)) {
+  chatRouter.use(messageUserLimiter);
+}
+
+chatRouter.use('/', chat);
+router.use('/chat', chatRouter);
 
 module.exports = router;

api/server/routes/ask/index.js

@@ -1,10 +1,4 @@
 const express = require('express');
-const openAI = require('./openAI');
-const custom = require('./custom');
-const google = require('./google');
-const anthropic = require('./anthropic');
-const gptPlugins = require('./gptPlugins');
-const { isEnabled } = require('~/server/utils');
 const { EModelEndpoint } = require('librechat-data-provider');
 const {
   uaParser,
@@ -15,6 +9,12 @@ const {
   messageUserLimiter,
   validateConvoAccess,
 } = require('~/server/middleware');
+const { isEnabled } = require('~/server/utils');
+const gptPlugins = require('./gptPlugins');
+const anthropic = require('./anthropic');
+const custom = require('./custom');
+const google = require('./google');
+const openAI = require('./openAI');
 
 const { LIMIT_CONCURRENT_MESSAGES, LIMIT_MESSAGE_IP, LIMIT_MESSAGE_USER } = process.env ?? {};
 

api/server/routes/bedrock/chat.js

@@ -4,6 +4,7 @@ const router = express.Router();
 const {
   setHeaders,
   handleAbort,
+  moderateText,
   // validateModel,
   // validateEndpoint,
   buildEndpointOption,
@@ -12,6 +13,7 @@ const { initializeClient } = require('~/server/services/Endpoints/bedrock');
 const AgentController = require('~/server/controllers/agents/request');
 const addTitle = require('~/server/services/Endpoints/agents/title');
 
+router.use(moderateText);
 router.post('/abort', handleAbort());
 
 /**

api/server/routes/bedrock/index.js

@@ -1,19 +1,35 @@
 const express = require('express');
-const router = express.Router();
 const {
   uaParser,
   checkBan,
   requireJwtAuth,
-  // concurrentLimiter,
-  // messageIpLimiter,
-  // messageUserLimiter,
+  messageIpLimiter,
+  concurrentLimiter,
+  messageUserLimiter,
 } = require('~/server/middleware');
-
+const { isEnabled } = require('~/server/utils');
 const chat = require('./chat');
 
+const { LIMIT_CONCURRENT_MESSAGES, LIMIT_MESSAGE_IP, LIMIT_MESSAGE_USER } = process.env ?? {};
+
+const router = express.Router();
+
 router.use(requireJwtAuth);
 router.use(checkBan);
 router.use(uaParser);
+
+if (isEnabled(LIMIT_CONCURRENT_MESSAGES)) {
+  router.use(concurrentLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_IP)) {
+  router.use(messageIpLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_USER)) {
+  router.use(messageUserLimiter);
+}
+
 router.use('/chat', chat);
 
 module.exports = router;

api/server/services/Files/S3/crud.js

@@ -16,6 +16,7 @@ const bucketName = process.env.AWS_BUCKET_NAME;
 const defaultBasePath = 'images';
 
 let s3UrlExpirySeconds = 7 * 24 * 60 * 60;
+let s3RefreshExpiryMs = null;
 
 if (process.env.S3_URL_EXPIRY_SECONDS !== undefined) {
   const parsed = parseInt(process.env.S3_URL_EXPIRY_SECONDS, 10);
@@ -29,6 +30,19 @@ if (process.env.S3_URL_EXPIRY_SECONDS !== undefined) {
   }
 }
 
+if (process.env.S3_REFRESH_EXPIRY_MS !== null && process.env.S3_REFRESH_EXPIRY_MS) {
+  const parsed = parseInt(process.env.S3_REFRESH_EXPIRY_MS, 10);
+
+  if (!isNaN(parsed) && parsed > 0) {
+    s3RefreshExpiryMs = parsed;
+    logger.info(`[S3] Using custom refresh expiry time: ${s3RefreshExpiryMs}ms`);
+  } else {
+    logger.warn(
+      `[S3] Invalid S3_REFRESH_EXPIRY_MS value: "${process.env.S3_REFRESH_EXPIRY_MS}". Using default refresh logic.`,
+    );
+  }
+}
+
 /**
  * Constructs the S3 key based on the base path, user ID, and file name.
  */
@@ -293,8 +307,16 @@ function needsRefresh(signedUrl, bufferSeconds) {
 
     // Check if it's close to expiration
     const now = new Date();
-    const bufferTime = new Date(now.getTime() + bufferSeconds * 1000);
 
+    // If S3_REFRESH_EXPIRY_MS is set, use it to determine if URL is expired
+    if (s3RefreshExpiryMs !== null) {
+      const urlCreationTime = dateObj.getTime();
+      const urlAge = now.getTime() - urlCreationTime;
+      return urlAge >= s3RefreshExpiryMs;
+    }
+
+    // Otherwise use the default buffer-based logic
+    const bufferTime = new Date(now.getTime() + bufferSeconds * 1000);
     return expiresAtDate <= bufferTime;
   } catch (error) {
     logger.error('Error checking URL expiration:', error);