LibreChat/api/strategies
Danny Avila b7bfdfa8b2
🪪 fix: Handle Delimited String Role Claims in OpenID Strategy (#11892)
* fix: handle space/comma-separated string roles claim in OpenID strategy

  When an OpenID provider returns the roles claim as a delimited string
  (e.g. "role1 role2 admin"), the previous code wrapped the entire string
  as a single array element, causing role checks to always fail even for users with the required role.

  Split string claims on whitespace and commas before comparison so that
  both array and delimited-string formats are handled correctly.

  Adds regression tests for space-separated, comma-separated, mixed, and
  non-matching delimited string cases.

* fix: enhance admin role handling in OpenID strategy

  Updated the OpenID strategy to correctly handle admin roles specified as space-separated or comma-separated strings. The logic now splits these strings into an array for accurate role checks.

  Added tests to verify that admin roles are granted or denied based on the presence of the specified admin role in the delimited string format.
2026-02-21 18:06:02 -05:00
..
appleStrategy.js 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
appleStrategy.test.js 🛂 feat: Social Login by Provider ID First then Email (#10358) 2025-11-05 09:20:35 -05:00
discordStrategy.js 🍎 feat: Apple auth (#5473) 2025-01-31 09:49:09 -05:00
facebookStrategy.js 🍎 feat: Apple auth (#5473) 2025-01-31 09:49:09 -05:00
githubStrategy.js feat: added Github Enterprise SSO login (#5621) 2025-02-03 15:30:02 -05:00
googleStrategy.js 🧠 feat: Reasoning UI for Agents (#5904) 2025-02-15 18:52:29 -05:00
index.js 🔐 feat: Admin Auth. Routes with Secure Cross-Origin Token Exchange (#11297) 2026-01-28 17:44:31 -05:00
jwtStrategy.js 🧑‍💻 refactor: Secure Field Selection for 2FA & API Build Sourcemap (#9087) 2025-08-15 18:55:49 -04:00
ldapStrategy.js 📧 fix: Case-Insensitive Domain Matching (#9868) 2025-09-27 21:20:19 -04:00
ldapStrategy.spec.js 📧 fix: Case-Insensitive Domain Matching (#9868) 2025-09-27 21:20:19 -04:00
localStrategy.js 🛜 refactor: Streamline App Config Usage (#9234) 2025-08-26 12:10:18 -04:00
openIdJwtStrategy.js 🪙 refactor: Distinguish ID Tokens from Access Tokens in OIDC Federated Auth (#11711) 2026-02-13 11:07:39 -05:00
openIdJwtStrategy.spec.js 🪙 refactor: Distinguish ID Tokens from Access Tokens in OIDC Federated Auth (#11711) 2026-02-13 11:07:39 -05:00
openidStrategy.js 🪪 fix: Handle Delimited String Role Claims in OpenID Strategy (#11892) 2026-02-21 18:06:02 -05:00
openidStrategy.spec.js 🪪 fix: Handle Delimited String Role Claims in OpenID Strategy (#11892) 2026-02-21 18:06:02 -05:00
process.js 🛂 feat: Social Login by Provider ID First then Email (#10358) 2025-11-05 09:20:35 -05:00
process.test.js 🛂 feat: Social Login by Provider ID First then Email (#10358) 2025-11-05 09:20:35 -05:00
samlStrategy.js 📧 fix: Case-Insensitive Domain Matching (#9868) 2025-09-27 21:20:19 -04:00
samlStrategy.spec.js 📧 fix: Case-Insensitive Domain Matching (#9868) 2025-09-27 21:20:19 -04:00
socialLogin.js 🛂 feat: Social Login by Provider ID First then Email (#10358) 2025-11-05 09:20:35 -05:00
socialLogin.test.js 📬 refactor: Normalize Email Handling in User Methods (#10743) 2025-12-01 09:41:25 -05:00
validators.js 🔐 feat: Add Configurable Min. Password Length (#9315) 2025-08-27 16:30:56 -04:00
validators.spec.js 🔐 feat: Add Configurable Min. Password Length (#9315) 2025-08-27 16:30:56 -04:00