LibreChat/api
Danny Avila b7bfdfa8b2
🪪 fix: Handle Delimited String Role Claims in OpenID Strategy (#11892)
* fix: handle space/comma-separated string roles claim in OpenID strategy

  When an OpenID provider returns the roles claim as a delimited string
  (e.g. "role1 role2 admin"), the previous code wrapped the entire string
  as a single array element, causing role checks to always fail even for users with the required role.

  Split string claims on whitespace and commas before comparison so that
  both array and delimited-string formats are handled correctly.

  Adds regression tests for space-separated, comma-separated, mixed, and
  non-matching delimited string cases.

* fix: enhance admin role handling in OpenID strategy

  Updated the OpenID strategy to correctly handle admin roles specified as space-separated or comma-separated strings. The logic now splits these strings into an array for accurate role checks.

  Added tests to verify that admin roles are granted or denied based on the presence of the specified admin role in the delimited string format.
2026-02-21 18:06:02 -05:00
..
app 🧩 refactor: Tool Context Builders for Web Search & Image Gen (#11644) 2026-02-05 14:10:19 +01:00
cache 🪙 refactor: Distinguish ID Tokens from Access Tokens in OIDC Federated Auth (#11711) 2026-02-13 11:07:39 -05:00
config 🪵 fix: Standardize Logging Directory with Environment-Aware Resolution (#11000) 2025-12-16 18:00:06 -05:00
db 🪂 fix: Handle MongoDB Connection Errors to Prevent Process Crashes (#11809) 2026-02-16 16:23:59 -05:00
models 🤖 feat: Gemini 3.1 Pricing and Context Window (#11884) 2026-02-20 16:21:32 -05:00
server 🔒 refactor: graphTokenController to use federated access token for OBO assertion (#11893) 2026-02-21 18:03:39 -05:00
strategies 🪪 fix: Handle Delimited String Role Claims in OpenID Strategy (#11892) 2026-02-21 18:06:02 -05:00
test 🪣 fix: Proper Key Extraction from S3 URL (#11241) 2026-02-21 15:07:16 -05:00
utils 🤖 feat: Gemini 3.1 Pricing and Context Window (#11884) 2026-02-20 16:21:32 -05:00
jest.config.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
jsconfig.json feat(api): initial Redis support; fix(SearchBar): proper debounce (#1039) 2023-10-11 17:05:47 -04:00
package.json 📦 chore: Bump @librechat/agents to v3.1.51 (#11891) 2026-02-21 16:17:42 -05:00
typedefs.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00