mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-03-16 20:56:35 +01:00
0c27ad2d55
* 🛡️ fix: Scope action mutations by parent resource ownership Prevent cross-tenant action overwrites by validating that an existing action's agent_id/assistant_id matches the URL parameter before allowing updates or deletes. Without this, a user with EDIT access on their own agent could reference a foreign action_id to hijack another agent's action record. * 🛡️ fix: Harden action ownership checks and scope write filters - Remove && short-circuit that bypassed the guard when agent_id or assistant_id was falsy (e.g. assistant-owned actions have no agent_id, so the check was skipped entirely on the agents route). - Include agent_id / assistant_id in the updateAction and deleteAction query filters so the DB write itself enforces ownership atomically. - Log a warning when deleteAction returns null (silent no-op from data-integrity mismatch). * 📝 docs: Update Action model JSDoc to reflect scoped query params * ✅ test: Add Action ownership scoping tests Cover update, delete, and cross-type protection scenarios using MongoMemoryServer to verify that scoped query filters (agent_id, assistant_id) prevent cross-tenant overwrites and deletions at the database level. * 🛡️ fix: Scope updateAction filter in agent duplication handler * 🐛 fix: Use action metadata domain instead of action_id when duplicating agent actions The duplicate handler was splitting `action.action_id` by `actionDelimiter` to extract the domain, but `action_id` is a bare nanoid that doesn't contain the delimiter. This produced malformed entries in the duplicated agent's actions array (nanoid_action_newNanoid instead of domain_action_newNanoid). The domain is available on `action.metadata.domain`. * ✅ test: Add integration tests for agent duplication action handling Uses MongoMemoryServer with real Agent and Action models to verify: - Duplicated actions use metadata.domain (not action_id) for the agent actions array entries - Sensitive metadata fields are stripped from duplicated actions - Original action documents are not modified
73 lines
2.4 KiB
JavaScript
73 lines
2.4 KiB
JavaScript
const { Action } = require('~/db/models');
|
|
|
|
/**
|
|
* Update an action with new data without overwriting existing properties,
|
|
* or create a new action if it doesn't exist.
|
|
*
|
|
* @param {{ action_id: string, agent_id?: string, assistant_id?: string, user?: string }} searchParams
|
|
* @param {Object} updateData - An object containing the properties to update.
|
|
* @returns {Promise<Action>} The updated or newly created action document as a plain object.
|
|
*/
|
|
const updateAction = async (searchParams, updateData) => {
|
|
const options = { new: true, upsert: true };
|
|
return await Action.findOneAndUpdate(searchParams, updateData, options).lean();
|
|
};
|
|
|
|
/**
|
|
* Retrieves all actions that match the given search parameters.
|
|
*
|
|
* @param {Object} searchParams - The search parameters to find matching actions.
|
|
* @param {boolean} includeSensitive - Flag to include sensitive data in the metadata.
|
|
* @returns {Promise<Array<Action>>} A promise that resolves to an array of action documents as plain objects.
|
|
*/
|
|
const getActions = async (searchParams, includeSensitive = false) => {
|
|
const actions = await Action.find(searchParams).lean();
|
|
|
|
if (!includeSensitive) {
|
|
for (let i = 0; i < actions.length; i++) {
|
|
const metadata = actions[i].metadata;
|
|
if (!metadata) {
|
|
continue;
|
|
}
|
|
|
|
const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
|
|
for (let field of sensitiveFields) {
|
|
if (metadata[field]) {
|
|
delete metadata[field];
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return actions;
|
|
};
|
|
|
|
/**
|
|
* Deletes an action by params.
|
|
*
|
|
* @param {{ action_id: string, agent_id?: string, assistant_id?: string, user?: string }} searchParams
|
|
* @returns {Promise<Action|null>} The deleted action document as a plain object, or null if no match.
|
|
*/
|
|
const deleteAction = async (searchParams) => {
|
|
return await Action.findOneAndDelete(searchParams).lean();
|
|
};
|
|
|
|
/**
|
|
* Deletes actions by params.
|
|
*
|
|
* @param {Object} searchParams - The search parameters to find the actions to delete.
|
|
* @param {string} searchParams.action_id - The ID of the action(s) to delete.
|
|
* @param {string} searchParams.user - The user ID of the action's author.
|
|
* @returns {Promise<Number>} A promise that resolves to the number of deleted action documents.
|
|
*/
|
|
const deleteActions = async (searchParams) => {
|
|
const result = await Action.deleteMany(searchParams);
|
|
return result.deletedCount;
|
|
};
|
|
|
|
module.exports = {
|
|
getActions,
|
|
updateAction,
|
|
deleteAction,
|
|
deleteActions,
|
|
};
|