mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-01-19 08:46:11 +01:00
4b6999ddf2
* feat: implement admin authentication with OpenID & Local Auth proxy support * feat: implement admin OAuth exchange flow with caching support - Added caching for admin OAuth exchange codes with a short TTL. - Introduced new endpoints for generating and exchanging admin OAuth codes. - Updated relevant controllers and routes to handle admin panel redirects and token exchanges. - Enhanced logging for better traceability of OAuth operations. * refactor: enhance OpenID strategy mock to support multiple verify callbacks - Updated the OpenID strategy mock to store and retrieve verify callbacks by strategy name. - Improved backward compatibility by maintaining a method to get the last registered callback. - Adjusted tests to utilize the new callback retrieval methods, ensuring clarity in the verification process for the 'openid' strategy. * refactor: reorder import statements for better organization * refactor: admin OAuth flow with improved URL handling and validation - Added a utility function to retrieve the admin panel URL, defaulting to a local development URL if not set in the environment. - Updated the OAuth exchange endpoint to include validation for the authorization code format. - Refactored the admin panel redirect logic to handle URL parsing more robustly, ensuring accurate origin comparisons. - Removed redundant local URL definitions from the codebase for better maintainability. * refactor: remove deprecated requireAdmin middleware and migrate to TypeScript - Deleted the old requireAdmin middleware file and its references in the middleware index. - Introduced a new TypeScript version of the requireAdmin middleware with enhanced error handling and logging. - Updated routes to utilize the new requireAdmin middleware, ensuring consistent access control for admin routes. * feat: add requireAdmin middleware for admin role verification - Introduced requireAdmin middleware to enforce admin role checks for authenticated users. - Implemented comprehensive error handling and logging for unauthorized access attempts. - Added unit tests to validate middleware functionality and ensure proper behavior for different user roles. - Updated middleware index to include the new requireAdmin export.
28 lines
976 B
TypeScript
28 lines
976 B
TypeScript
import { logger } from '@librechat/data-schemas';
|
|
import { SystemRoles } from 'librechat-data-provider';
|
|
import type { NextFunction, Response } from 'express';
|
|
import type { ServerRequest } from '~/types/http';
|
|
|
|
/**
|
|
* Middleware to check if authenticated user has admin role.
|
|
* Should be used AFTER authentication middleware (requireJwtAuth, requireLocalAuth, etc.)
|
|
*/
|
|
export const requireAdmin = (req: ServerRequest, res: Response, next: NextFunction) => {
|
|
if (!req.user) {
|
|
logger.warn('[requireAdmin] No user found in request');
|
|
return res.status(401).json({
|
|
error: 'Authentication required',
|
|
error_code: 'AUTHENTICATION_REQUIRED',
|
|
});
|
|
}
|
|
|
|
if (!req.user.role || req.user.role !== SystemRoles.ADMIN) {
|
|
logger.debug(`[requireAdmin] Access denied for non-admin user: ${req.user.email}`);
|
|
return res.status(403).json({
|
|
error: 'Access denied: Admin privileges required',
|
|
error_code: 'ADMIN_REQUIRED',
|
|
});
|
|
}
|
|
|
|
next();
|
|
};
|