mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-09-22 06:00:56 +02:00
bf80cf30b3
* feat: integrate OpenID Connect support with token reuse
- Added `jwks-rsa` and `new-openid-client` dependencies for OpenID Connect functionality.
- Implemented OpenID token refresh logic in `AuthController`.
- Enhanced `LogoutController` to handle OpenID logout and session termination.
- Updated JWT authentication middleware to support OpenID token provider.
- Modified OAuth routes to accommodate OpenID authentication and token management.
- Created `setOpenIDAuthTokens` function to manage OpenID tokens in cookies.
- Upgraded OpenID strategy with user info fetching and token exchange protocol.
- Introduced `openIdJwtLogin` strategy for handling OpenID JWT tokens.
- Added caching mechanism for exchanged OpenID tokens.
- Updated configuration to include OpenID exchanged tokens cache key.
- updated .env.example to include the new env variables needed for the feature.
* fix: update return type in downloadImage documentation for clarity and fixed openIdJwtLogin env variables
* fix: update Jest configuration and tests for OpenID strategy integration
* fix: update OpenID strategy to include callback URL in setup
* fix: fix optionalJwtAuth middleware to support OpenID token reuse and improve currentUrl method in CustomOpenIDStrategy to override the dynamic host issue related to proxy (e.g. cloudfront)
* fix: fixed code formatting
* Fix: Add mocks for openid-client and passport strategy in Jest configuration to fix unit tests
* fix eslint errors: Format mock file openid-client.
* ✨ feat: Add PKCE support for OpenID and default handling in strategy setup
---------
Co-authored-by: Atef Bellaaj <slalom.bellaaj@external.daimlertruck.com>
Co-authored-by: Ruben Talstra <RubenTalstra1211@outlook.com>
75 lines
2.3 KiB
JavaScript
75 lines
2.3 KiB
JavaScript
const { Keyv } = require('keyv');
|
|
const passport = require('passport');
|
|
const session = require('express-session');
|
|
const MemoryStore = require('memorystore')(session);
|
|
const RedisStore = require('connect-redis').default;
|
|
const {
|
|
setupOpenId,
|
|
googleLogin,
|
|
githubLogin,
|
|
discordLogin,
|
|
facebookLogin,
|
|
appleLogin,
|
|
openIdJwtLogin,
|
|
} = require('~/strategies');
|
|
const { isEnabled } = require('~/server/utils');
|
|
const keyvRedis = require('~/cache/keyvRedis');
|
|
const { logger } = require('~/config');
|
|
|
|
/**
|
|
*
|
|
* @param {Express.Application} app
|
|
*/
|
|
const configureSocialLogins = async (app) => {
|
|
logger.info('Configuring social logins...');
|
|
|
|
if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
|
|
passport.use(googleLogin());
|
|
}
|
|
if (process.env.FACEBOOK_CLIENT_ID && process.env.FACEBOOK_CLIENT_SECRET) {
|
|
passport.use(facebookLogin());
|
|
}
|
|
if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
|
|
passport.use(githubLogin());
|
|
}
|
|
if (process.env.DISCORD_CLIENT_ID && process.env.DISCORD_CLIENT_SECRET) {
|
|
passport.use(discordLogin());
|
|
}
|
|
if (process.env.APPLE_CLIENT_ID && process.env.APPLE_PRIVATE_KEY_PATH) {
|
|
passport.use(appleLogin());
|
|
}
|
|
if (
|
|
process.env.OPENID_CLIENT_ID &&
|
|
process.env.OPENID_CLIENT_SECRET &&
|
|
process.env.OPENID_ISSUER &&
|
|
process.env.OPENID_SCOPE &&
|
|
process.env.OPENID_SESSION_SECRET
|
|
) {
|
|
logger.info('Configuring OpenID Connect...');
|
|
const sessionOptions = {
|
|
secret: process.env.OPENID_SESSION_SECRET,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
};
|
|
if (isEnabled(process.env.USE_REDIS)) {
|
|
logger.debug('Using Redis for session storage in OpenID...');
|
|
const keyv = new Keyv({ store: keyvRedis });
|
|
const client = keyv.opts.store.client;
|
|
sessionOptions.store = new RedisStore({ client, prefix: 'openid_session' });
|
|
} else {
|
|
sessionOptions.store = new MemoryStore({
|
|
checkPeriod: 86400000, // prune expired entries every 24h
|
|
});
|
|
}
|
|
app.use(session(sessionOptions));
|
|
app.use(passport.session());
|
|
const config = await setupOpenId();
|
|
if (isEnabled(process.env.OPENID_REUSE_TOKENS)) {
|
|
logger.info('OpenID token reuse is enabled.');
|
|
passport.use('openidJwt', openIdJwtLogin(config));
|
|
}
|
|
logger.info('OpenID Connect configured.');
|
|
}
|
|
};
|
|
|
|
module.exports = configureSocialLogins;
|