Remove debug logs

- Move email and avatar functions to package/auth

.env.example

@@ -485,21 +485,6 @@ SAML_IMAGE_URL=
 # SAML_USE_AUTHN_RESPONSE_SIGNED=
 
 
-#===============================================#
-# Microsoft Graph API / Entra ID Integration  #
-#===============================================#
-
-# Enable Entra ID people search integration in permissions/sharing system
-# When enabled, the people picker will search both local database and Entra ID
-USE_ENTRA_ID_FOR_PEOPLE_SEARCH=false
-
-# When enabled, entra id groups owners will be considered as members of the group
-ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS=false
-
-# Microsoft Graph API scopes needed for people/group search
-# Default scopes provide access to user profiles and group memberships
-OPENID_GRAPH_SCOPES=User.Read,People.Read,GroupMember.Read.All
-
 # LDAP
 LDAP_URL=
 LDAP_BIND_DN=

.github/workflows/unused-packages.yml

@@ -98,8 +98,6 @@ jobs:
             cd client
             UNUSED=$(depcheck --json | jq -r '.dependencies | join("\n")' || echo "")
             UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat ../client_used_deps.txt ../client_used_code.txt | sort) || echo "")
-            # Filter out false positives
-            UNUSED=$(echo "$UNUSED" | grep -v "^micromark-extension-llm-math$" || echo "")
             echo "CLIENT_UNUSED<<EOF" >> $GITHUB_ENV
             echo "$UNUSED" >> $GITHUB_ENV
             echo "EOF" >> $GITHUB_ENV

.gitignore

@@ -55,7 +55,6 @@ bower_components/
 # AI
 .clineignore
 .cursor
-.aider*
 
 # Floobits
 .floo

.vscode/launch.json

@@ -8,8 +8,7 @@
       "skipFiles": ["<node_internals>/**"],
       "program": "${workspaceFolder}/api/server/index.js",
       "env": {
-        "NODE_ENV": "production",
-        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
+        "NODE_ENV": "production"
       },
       "console": "integratedTerminal",
       "envFile": "${workspaceFolder}/.env"

api/app/clients/AnthropicClient.js

@@ -190,11 +190,10 @@ class AnthropicClient extends BaseClient {
         reverseProxyUrl: this.options.reverseProxyUrl,
       }),
       apiKey: this.apiKey,
-      fetchOptions: {},
     };
 
     if (this.options.proxy) {
-      options.fetchOptions.agent = new HttpsProxyAgent(this.options.proxy);
+      options.httpAgent = new HttpsProxyAgent(this.options.proxy);
     }
 
     if (this.options.reverseProxyUrl) {

api/app/clients/BaseClient.js

@@ -792,8 +792,7 @@ class BaseClient {
 
     userMessage.tokenCount = userMessageTokenCount;
     /*
-      Note: `AgentController` saves the user message if not saved here
-      (noted by `savedMessageIds`), so we update the count of its `userMessage` reference
+      Note: `AskController` saves the user message, so we update the count of its `userMessage` reference
     */
     if (typeof opts?.getReqData === 'function') {
       opts.getReqData({
@@ -802,8 +801,7 @@ class BaseClient {
     }
     /*
       Note: we update the user message to be sure it gets the calculated token count;
-      though `AgentController` saves the user message if not saved here
-      (noted by `savedMessageIds`), EditController does not
+      though `AskController` saves the user message, EditController does not
     */
     await userMessagePromise;
     await this.updateMessageInDatabase({

api/app/clients/OpenAIClient.js

@@ -1159,7 +1159,6 @@ ${convo}
       logger.debug('[OpenAIClient] chatCompletion', { baseURL, modelOptions });
       const opts = {
         baseURL,
-        fetchOptions: {},
       };
 
       if (this.useOpenRouter) {
@@ -1178,7 +1177,7 @@ ${convo}
       }
 
       if (this.options.proxy) {
-        opts.fetchOptions.agent = new HttpsProxyAgent(this.options.proxy);
+        opts.httpAgent = new HttpsProxyAgent(this.options.proxy);
       }
 
       /** @type {TAzureConfig | undefined} */
@@ -1396,7 +1395,7 @@ ${convo}
           ...modelOptions,
           stream: true,
         };
-        const stream = await openai.chat.completions
+        const stream = await openai.beta.chat.completions
           .stream(params)
           .on('abort', () => {
             /* Do nothing here */

api/app/clients/prompts/createContextHandlers.js

@@ -96,35 +96,35 @@ function createContextHandlers(req, userMessageContent) {
         resolvedQueries.length === 0
           ? '\n\tThe semantic search did not return any results.'
           : resolvedQueries
-              .map((queryResult, index) => {
-                const file = processedFiles[index];
-                let contextItems = queryResult.data;
+            .map((queryResult, index) => {
+              const file = processedFiles[index];
+              let contextItems = queryResult.data;
 
-                const generateContext = (currentContext) =>
-                  `
+              const generateContext = (currentContext) =>
+                `
           <file>
             <filename>${file.filename}</filename>
             <context>${currentContext}
             </context>
           </file>`;
 
-                if (useFullContext) {
-                  return generateContext(`\n${contextItems}`);
-                }
+              if (useFullContext) {
+                return generateContext(`\n${contextItems}`);
+              }
 
-                contextItems = queryResult.data
-                  .map((item) => {
-                    const pageContent = item[0].page_content;
-                    return `
+              contextItems = queryResult.data
+                .map((item) => {
+                  const pageContent = item[0].page_content;
+                  return `
             <contextItem>
               <![CDATA[${pageContent?.trim()}]]>
             </contextItem>`;
-                  })
-                  .join('');
+                })
+                .join('');
 
-                return generateContext(contextItems);
-              })
-              .join('');
+              return generateContext(contextItems);
+            })
+            .join('');
 
       if (useFullContext) {
         const prompt = `${header}

api/app/clients/specs/AnthropicClient.test.js

@@ -309,7 +309,7 @@ describe('AnthropicClient', () => {
       };
       client.setOptions({ modelOptions, promptCache: true });
       const anthropicClient = client.getClient(modelOptions);
-      expect(anthropicClient._options.defaultHeaders).toBeUndefined();
+      expect(anthropicClient.defaultHeaders).not.toHaveProperty('anthropic-beta');
     });
 
     it('should not add beta header for other models', () => {
@@ -320,7 +320,7 @@ describe('AnthropicClient', () => {
         },
       });
       const anthropicClient = client.getClient();
-      expect(anthropicClient._options.defaultHeaders).toBeUndefined();
+      expect(anthropicClient.defaultHeaders).not.toHaveProperty('anthropic-beta');
     });
   });
 

api/app/clients/tools/util/handleTools.js

@@ -1,14 +1,14 @@
-const { mcpToolPattern } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
 const { SerpAPI } = require('@langchain/community/tools/serpapi');
 const { Calculator } = require('@langchain/community/tools/calculator');
 const { EnvVar, createCodeExecutionTool, createSearchTool } = require('@librechat/agents');
 const {
   Tools,
+  Constants,
   EToolResources,
   loadWebSearchAuth,
   replaceSpecialVars,
 } = require('librechat-data-provider');
+const { getUserPluginAuthValue } = require('~/server/services/PluginService');
 const {
   availableTools,
   manifestToolMap,
@@ -28,10 +28,11 @@ const {
 } = require('../');
 const { primeFiles: primeCodeFiles } = require('~/server/services/Files/Code/process');
 const { createFileSearchTool, primeFiles: primeSearchFiles } = require('./fileSearch');
-const { getUserPluginAuthValue } = require('~/server/services/PluginService');
 const { loadAuthValues } = require('~/server/services/Tools/credentials');
-const { getCachedTools } = require('~/server/services/Config');
 const { createMCPTool } = require('~/server/services/MCP');
+const { logger } = require('~/config');
+
+const mcpToolPattern = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);
 
 /**
  * Validates the availability and authentication of tools for a user based on environment variables or user-specific plugin authentication values.
@@ -92,7 +93,7 @@ const validateTools = async (user, tools = []) => {
     return Array.from(validToolsSet.values());
   } catch (err) {
     logger.error('[validateTools] There was a problem validating tools', err);
-    throw new Error(err);
+    throw new Error('There was a problem validating tools');
   }
 };
 
@@ -235,7 +236,7 @@ const loadTools = async ({
 
   /** @type {Record<string, string>} */
   const toolContextMap = {};
-  const appTools = (await getCachedTools({ includeGlobal: true })) ?? {};
+  const appTools = options.req?.app?.locals?.availableTools ?? {};
 
   for (const tool of tools) {
     if (tool === Tools.execute_code) {
@@ -298,7 +299,6 @@ Current Date & Time: ${replaceSpecialVars({ text: '{{iso_datetime}}' })}
       requestedTools[tool] = async () =>
         createMCPTool({
           req: options.req,
-          res: options.res,
           toolKey: tool,
           model: agent?.model ?? model,
           provider: agent?.provider ?? endpoint,

api/cache/getLogStores.js

@@ -29,10 +29,6 @@ const roles = isRedisEnabled
   ? new Keyv({ store: keyvRedis })
   : new Keyv({ namespace: CacheKeys.ROLES });
 
-const mcpTools = isRedisEnabled
-  ? new Keyv({ store: keyvRedis })
-  : new Keyv({ namespace: CacheKeys.MCP_TOOLS });
-
 const audioRuns = isRedisEnabled
   ? new Keyv({ store: keyvRedis, ttl: Time.TEN_MINUTES })
   : new Keyv({ namespace: CacheKeys.AUDIO_RUNS, ttl: Time.TEN_MINUTES });
@@ -71,7 +67,6 @@ const openIdExchangedTokensCache = isRedisEnabled
 
 const namespaces = {
   [CacheKeys.ROLES]: roles,
-  [CacheKeys.MCP_TOOLS]: mcpTools,
   [CacheKeys.CONFIG_STORE]: config,
   [CacheKeys.PENDING_REQ]: pending_req,
   [ViolationTypes.BAN]: new Keyv({ store: keyvMongo, namespace: CacheKeys.BANS, ttl: duration }),

api/config/index.js

@@ -15,7 +15,7 @@ let flowManager = null;
  */
 function getMCPManager(userId) {
   if (!mcpManager) {
-    mcpManager = MCPManager.getInstance();
+    mcpManager = MCPManager.getInstance(logger);
   } else {
     mcpManager.checkIdleConnections(userId);
   }
@@ -30,6 +30,7 @@ function getFlowStateManager(flowsCache) {
   if (!flowManager) {
     flowManager = new FlowStateManager(flowsCache, {
       ttl: Time.ONE_MINUTE * 3,
+      logger,
     });
   }
   return flowManager;

api/db/indexSync.js

@@ -1,11 +1,8 @@
 const mongoose = require('mongoose');
 const { MeiliSearch } = require('meilisearch');
 const { logger } = require('@librechat/data-schemas');
-const { FlowStateManager } = require('@librechat/api');
-const { CacheKeys } = require('librechat-data-provider');
 
 const { isEnabled } = require('~/server/utils');
-const { getLogStores } = require('~/cache');
 
 const Conversation = mongoose.models.Conversation;
 const Message = mongoose.models.Message;
@@ -31,123 +28,43 @@ class MeiliSearchClient {
   }
 }
 
-/**
- * Performs the actual sync operations for messages and conversations
- */
-async function performSync() {
-  const client = MeiliSearchClient.getInstance();
-
-  const { status } = await client.health();
-  if (status !== 'available') {
-    throw new Error('Meilisearch not available');
-  }
-
-  if (indexingDisabled === true) {
-    logger.info('[indexSync] Indexing is disabled, skipping...');
-    return { messagesSync: false, convosSync: false };
-  }
-
-  let messagesSync = false;
-  let convosSync = false;
-
-  // Check if we need to sync messages
-  const messageProgress = await Message.getSyncProgress();
-  if (!messageProgress.isComplete) {
-    logger.info(
-      `[indexSync] Messages need syncing: ${messageProgress.totalProcessed}/${messageProgress.totalDocuments} indexed`,
-    );
-
-    // Check if we should do a full sync or incremental
-    const messageCount = await Message.countDocuments();
-    const messagesIndexed = messageProgress.totalProcessed;
-    const syncThreshold = parseInt(process.env.MEILI_SYNC_THRESHOLD || '1000', 10);
-
-    if (messageCount - messagesIndexed > syncThreshold) {
-      logger.info('[indexSync] Starting full message sync due to large difference');
-      await Message.syncWithMeili();
-      messagesSync = true;
-    } else if (messageCount !== messagesIndexed) {
-      logger.warn('[indexSync] Messages out of sync, performing incremental sync');
-      await Message.syncWithMeili();
-      messagesSync = true;
-    }
-  } else {
-    logger.info(
-      `[indexSync] Messages are fully synced: ${messageProgress.totalProcessed}/${messageProgress.totalDocuments}`,
-    );
-  }
-
-  // Check if we need to sync conversations
-  const convoProgress = await Conversation.getSyncProgress();
-  if (!convoProgress.isComplete) {
-    logger.info(
-      `[indexSync] Conversations need syncing: ${convoProgress.totalProcessed}/${convoProgress.totalDocuments} indexed`,
-    );
-
-    const convoCount = await Conversation.countDocuments();
-    const convosIndexed = convoProgress.totalProcessed;
-    const syncThreshold = parseInt(process.env.MEILI_SYNC_THRESHOLD || '1000', 10);
-
-    if (convoCount - convosIndexed > syncThreshold) {
-      logger.info('[indexSync] Starting full conversation sync due to large difference');
-      await Conversation.syncWithMeili();
-      convosSync = true;
-    } else if (convoCount !== convosIndexed) {
-      logger.warn('[indexSync] Convos out of sync, performing incremental sync');
-      await Conversation.syncWithMeili();
-      convosSync = true;
-    }
-  } else {
-    logger.info(
-      `[indexSync] Conversations are fully synced: ${convoProgress.totalProcessed}/${convoProgress.totalDocuments}`,
-    );
-  }
-
-  return { messagesSync, convosSync };
-}
-
-/**
- * Main index sync function that uses FlowStateManager to prevent concurrent execution
- */
 async function indexSync() {
   if (!searchEnabled) {
     return;
   }
-
-  logger.info('[indexSync] Starting index synchronization check...');
-
   try {
-    // Get or create FlowStateManager instance
-    const flowsCache = getLogStores(CacheKeys.FLOWS);
-    if (!flowsCache) {
-      logger.warn('[indexSync] Flows cache not available, falling back to direct sync');
-      return await performSync();
+    const client = MeiliSearchClient.getInstance();
+
+    const { status } = await client.health();
+    if (status !== 'available') {
+      throw new Error('Meilisearch not available');
     }
 
-    const flowManager = new FlowStateManager(flowsCache, {
-      ttl: 60000 * 10, // 10 minutes TTL for sync operations
-    });
-
-    // Use a unique flow ID for the sync operation
-    const flowId = 'meili-index-sync';
-    const flowType = 'MEILI_SYNC';
-
-    // This will only execute the handler if no other instance is running the sync
-    const result = await flowManager.createFlowWithHandler(flowId, flowType, performSync);
-
-    if (result.messagesSync || result.convosSync) {
-      logger.info('[indexSync] Sync completed successfully');
-    } else {
-      logger.debug('[indexSync] No sync was needed');
-    }
-
-    return result;
-  } catch (err) {
-    if (err.message.includes('flow already exists')) {
-      logger.info('[indexSync] Sync already running on another instance');
+    if (indexingDisabled === true) {
+      logger.info('[indexSync] Indexing is disabled, skipping...');
       return;
     }
 
+    const messageCount = await Message.countDocuments();
+    const convoCount = await Conversation.countDocuments();
+    const messages = await client.index('messages').getStats();
+    const convos = await client.index('convos').getStats();
+    const messagesIndexed = messages.numberOfDocuments;
+    const convosIndexed = convos.numberOfDocuments;
+
+    logger.debug(`[indexSync] There are ${messageCount} messages and ${messagesIndexed} indexed`);
+    logger.debug(`[indexSync] There are ${convoCount} convos and ${convosIndexed} indexed`);
+
+    if (messageCount !== messagesIndexed) {
+      logger.debug('[indexSync] Messages out of sync, indexing');
+      Message.syncWithMeili();
+    }
+
+    if (convoCount !== convosIndexed) {
+      logger.debug('[indexSync] Convos out of sync, indexing');
+      Conversation.syncWithMeili();
+    }
+  } catch (err) {
     if (err.message.includes('not found')) {
       logger.debug('[indexSync] Creating indices...');
       currentTimeout = setTimeout(async () => {

api/jest.config.js

@@ -1,4 +1,6 @@
+/** @type {import('jest').Config} */
 module.exports = {
+  displayName: 'default',
   testEnvironment: 'node',
   clearMocks: true,
   roots: ['<rootDir>'],
@@ -11,7 +13,7 @@ module.exports = {
   moduleNameMapper: {
     '~/(.*)': '<rootDir>/$1',
     '~/data/auth.json': '<rootDir>/__mocks__/auth.mock.json',
-    '^openid-client/passport$': '<rootDir>/test/__mocks__/openid-client-passport.js', // Mock for the passport strategy part
+    '^openid-client/passport$': '<rootDir>/test/__mocks__/openid-client-passport.js',
     '^openid-client$': '<rootDir>/test/__mocks__/openid-client.js',
   },
   transformIgnorePatterns: ['/node_modules/(?!(openid-client|oauth4webapi|jose)/).*/'],

api/models/Agent.js

@@ -4,17 +4,14 @@ const { logger } = require('@librechat/data-schemas');
 const { SystemRoles, Tools, actionDelimiter } = require('librechat-data-provider');
 const { GLOBAL_PROJECT_NAME, EPHEMERAL_AGENT_ID, mcp_delimiter } =
   require('librechat-data-provider').Constants;
-// Default category value for new agents
+const { CONFIG_STORE, STARTUP_CONFIG } = require('librechat-data-provider').CacheKeys;
 const {
   getProjectByName,
   addAgentIdsToProject,
   removeAgentIdsFromProject,
   removeAgentFromAllProjects,
 } = require('./Project');
-const { getCachedTools } = require('~/server/services/Config');
-
-// Category values are now imported from shared constants
-// Schema fields (category, support_contact, is_promoted) are defined in @librechat/data-schemas
+const getLogStores = require('~/cache/getLogStores');
 const { getActions } = require('./Action');
 const { Agent } = require('~/db/models');
 
@@ -25,7 +22,7 @@ const { Agent } = require('~/db/models');
  * @throws {Error} If the agent creation fails.
  */
 const createAgent = async (agentData) => {
-  const { author: _author, ...versionData } = agentData;
+  const { author, ...versionData } = agentData;
   const timestamp = new Date();
   const initialAgentData = {
     ...agentData,
@@ -36,7 +33,6 @@ const createAgent = async (agentData) => {
         updatedAt: timestamp,
       },
     ],
-    category: agentData.category || 'general',
   };
   return (await Agent.create(initialAgentData)).toObject();
 };
@@ -59,12 +55,12 @@ const getAgent = async (searchParameter) => await Agent.findOne(searchParameter)
  * @param {string} params.agent_id
  * @param {string} params.endpoint
  * @param {import('@librechat/agents').ClientOptions} [params.model_parameters]
- * @returns {Promise<Agent|null>} The agent document as a plain object, or null if not found.
+ * @returns {Agent|null} The agent document as a plain object, or null if not found.
  */
-const loadEphemeralAgent = async ({ req, agent_id, endpoint, model_parameters: _m }) => {
+const loadEphemeralAgent = ({ req, agent_id, endpoint, model_parameters: _m }) => {
   const { model, ...model_parameters } = _m;
   /** @type {Record<string, FunctionTool>} */
-  const availableTools = await getCachedTools({ includeGlobal: true });
+  const availableTools = req.app.locals.availableTools;
   /** @type {TEphemeralAgent | null} */
   const ephemeralAgent = req.body.ephemeralAgent;
   const mcpServers = new Set(ephemeralAgent?.mcp);
@@ -73,9 +69,6 @@ const loadEphemeralAgent = async ({ req, agent_id, endpoint, model_parameters: _
   if (ephemeralAgent?.execute_code === true) {
     tools.push(Tools.execute_code);
   }
-  if (ephemeralAgent?.file_search === true) {
-    tools.push(Tools.file_search);
-  }
   if (ephemeralAgent?.web_search === true) {
     tools.push(Tools.web_search);
   }
@@ -118,7 +111,7 @@ const loadAgent = async ({ req, agent_id, endpoint, model_parameters }) => {
     return null;
   }
   if (agent_id === EPHEMERAL_AGENT_ID) {
-    return await loadEphemeralAgent({ req, agent_id, endpoint, model_parameters });
+    return loadEphemeralAgent({ req, agent_id, endpoint, model_parameters });
   }
   const agent = await getAgent({
     id: agent_id,
@@ -129,7 +122,29 @@ const loadAgent = async ({ req, agent_id, endpoint, model_parameters }) => {
   }
 
   agent.version = agent.versions ? agent.versions.length : 0;
-  return agent;
+
+  if (agent.author.toString() === req.user.id) {
+    return agent;
+  }
+
+  if (!agent.projectIds) {
+    return null;
+  }
+
+  const cache = getLogStores(CONFIG_STORE);
+  /** @type {TStartupConfig} */
+  const cachedStartupConfig = await cache.get(STARTUP_CONFIG);
+  let { instanceProjectId } = cachedStartupConfig ?? {};
+  if (!instanceProjectId) {
+    instanceProjectId = (await getProjectByName(GLOBAL_PROJECT_NAME, '_id'))._id.toString();
+  }
+
+  for (const projectObjectId of agent.projectIds) {
+    const projectId = projectObjectId.toString();
+    if (projectId === instanceProjectId) {
+      return agent;
+    }
+  }
 };
 
 /**
@@ -159,7 +174,7 @@ const isDuplicateVersion = (updateData, currentData, versions, actionsHash = nul
     'actionsHash', // Exclude actionsHash from direct comparison
   ];
 
-  const { $push: _$push, $pull: _$pull, $addToSet: _$addToSet, ...directUpdates } = updateData;
+  const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
   if (Object.keys(directUpdates).length === 0 && !actionsHash) {
     return null;
@@ -254,14 +269,7 @@ const updateAgent = async (searchParameter, updateData, options = {}) => {
 
   const currentAgent = await Agent.findOne(searchParameter);
   if (currentAgent) {
-    const {
-      __v,
-      _id,
-      id: __id,
-      versions,
-      author: _author,
-      ...versionData
-    } = currentAgent.toObject();
+    const { __v, _id, id, versions, author, ...versionData } = currentAgent.toObject();
     const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
     let actionsHash = null;
@@ -452,113 +460,8 @@ const deleteAgent = async (searchParameter) => {
   return agent;
 };
 
-/**
- * Get agents by accessible IDs with optional cursor-based pagination.
- * @param {Object} params - The parameters for getting accessible agents.
- * @param {Array} [params.accessibleIds] - Array of agent ObjectIds the user has ACL access to.
- * @param {Object} [params.otherParams] - Additional query parameters (including author filter).
- * @param {number} [params.limit] - Number of agents to return (max 100). If not provided, returns all agents.
- * @param {string} [params.after] - Cursor for pagination - get agents after this cursor. // base64 encoded JSON string with updatedAt and _id.
- * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
- */
-const getListAgentsByAccess = async ({
-  accessibleIds = [],
-  otherParams = {},
-  limit = null,
-  after = null,
-}) => {
-  const isPaginated = limit !== null && limit !== undefined;
-  const normalizedLimit = isPaginated ? Math.min(Math.max(1, parseInt(limit) || 20), 100) : null;
-
-  // Build base query combining ACL accessible agents with other filters
-  const baseQuery = { ...otherParams };
-
-  if (accessibleIds.length > 0) {
-    baseQuery._id = { $in: accessibleIds };
-  }
-
-  // Add cursor condition
-  if (after) {
-    try {
-      const cursor = JSON.parse(Buffer.from(after, 'base64').toString('utf8'));
-      const { updatedAt, _id } = cursor;
-
-      const cursorCondition = {
-        $or: [
-          { updatedAt: { $lt: new Date(updatedAt) } },
-          { updatedAt: new Date(updatedAt), _id: { $gt: new mongoose.Types.ObjectId(_id) } },
-        ],
-      };
-
-      // Merge cursor condition with base query
-      if (Object.keys(baseQuery).length > 0) {
-        baseQuery.$and = [{ ...baseQuery }, cursorCondition];
-        // Remove the original conditions from baseQuery to avoid duplication
-        Object.keys(baseQuery).forEach((key) => {
-          if (key !== '$and') delete baseQuery[key];
-        });
-      } else {
-        Object.assign(baseQuery, cursorCondition);
-      }
-    } catch (error) {
-      logger.warn('Invalid cursor:', error.message);
-    }
-  }
-
-  let query = Agent.find(baseQuery, {
-    id: 1,
-    _id: 1,
-    name: 1,
-    avatar: 1,
-    author: 1,
-    projectIds: 1,
-    description: 1,
-    updatedAt: 1,
-    category: 1,
-    support_contact: 1,
-    is_promoted: 1,
-  }).sort({ updatedAt: -1, _id: 1 });
-
-  // Only apply limit if pagination is requested
-  if (isPaginated) {
-    query = query.limit(normalizedLimit + 1);
-  }
-
-  const agents = await query.lean();
-
-  const hasMore = isPaginated ? agents.length > normalizedLimit : false;
-  const data = (isPaginated ? agents.slice(0, normalizedLimit) : agents).map((agent) => {
-    if (agent.author) {
-      agent.author = agent.author.toString();
-    }
-    return agent;
-  });
-
-  // Generate next cursor only if paginated
-  let nextCursor = null;
-  if (isPaginated && hasMore && data.length > 0) {
-    const lastAgent = agents[normalizedLimit - 1];
-    nextCursor = Buffer.from(
-      JSON.stringify({
-        updatedAt: lastAgent.updatedAt.toISOString(),
-        _id: lastAgent._id.toString(),
-      }),
-    ).toString('base64');
-  }
-
-  return {
-    object: 'list',
-    data,
-    first_id: data.length > 0 ? data[0].id : null,
-    last_id: data.length > 0 ? data[data.length - 1].id : null,
-    has_more: hasMore,
-    after: nextCursor,
-  };
-};
-
 /**
  * Get all agents.
- * @deprecated Use getListAgentsByAccess for ACL-aware agent listing
  * @param {Object} searchParameter - The search parameters to find matching agents.
  * @param {string} searchParameter.author - The user ID of the agent's author.
  * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
@@ -577,15 +480,13 @@ const getListAgents = async (searchParameter) => {
   const agents = (
     await Agent.find(query, {
       id: 1,
-      _id: 1,
+      _id: 0,
       name: 1,
       avatar: 1,
       author: 1,
       projectIds: 1,
       description: 1,
-      // @deprecated - isCollaborative replaced by ACL permissions
       isCollaborative: 1,
-      category: 1,
     }).lean()
   ).map((agent) => {
     if (agent.author?.toString() !== author) {
@@ -751,14 +652,6 @@ const generateActionMetadataHash = async (actionIds, actions) => {
 
   return hashHex;
 };
-/**
- * Counts the number of promoted agents.
- * @returns  {Promise<number>} - The count of promoted agents
- */
-const countPromotedAgents = async () => {
-  const count = await Agent.countDocuments({ is_promoted: true });
-  return count;
-};
 
 /**
  * Load a default agent based on the endpoint
@@ -776,8 +669,6 @@ module.exports = {
   revertAgentVersion,
   updateAgentProjects,
   addAgentResourceFile,
-  getListAgentsByAccess,
   removeAgentResourceFiles,
   generateActionMetadataHash,
-  countPromotedAgents,
 };

api/models/Agent.spec.js

@@ -6,10 +6,6 @@ const originalEnv = {
 process.env.CREDS_KEY = '0123456789abcdef0123456789abcdef';
 process.env.CREDS_IV = '0123456789abcdef';
 
-jest.mock('~/server/services/Config', () => ({
-  getCachedTools: jest.fn(),
-}));
-
 const mongoose = require('mongoose');
 const { v4: uuidv4 } = require('uuid');
 const { agentSchema } = require('@librechat/data-schemas');
@@ -27,7 +23,6 @@ const {
   generateActionMetadataHash,
   revertAgentVersion,
 } = require('./Agent');
-const { getCachedTools } = require('~/server/services/Config');
 
 /**
  * @type {import('mongoose').Model<import('@librechat/data-schemas').IAgent>}
@@ -43,7 +38,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -411,9 +406,8 @@ describe('models/Agent', () => {
     beforeAll(async () => {
       mongoServer = await MongoMemoryServer.create();
       const mongoUri = mongoServer.getUri();
-      Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -670,7 +664,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -1332,7 +1326,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -1514,7 +1508,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -1552,12 +1546,6 @@ describe('models/Agent', () => {
     test('should test ephemeral agent loading logic', async () => {
       const { EPHEMERAL_AGENT_ID } = require('librechat-data-provider').Constants;
 
-      getCachedTools.mockResolvedValue({
-        tool1_mcp_server1: {},
-        tool2_mcp_server2: {},
-        another_tool: {},
-      });
-
       const mockReq = {
         user: { id: 'user123' },
         body: {
@@ -1568,6 +1556,15 @@ describe('models/Agent', () => {
             mcp: ['server1', 'server2'],
           },
         },
+        app: {
+          locals: {
+            availableTools: {
+              tool1_mcp_server1: {},
+              tool2_mcp_server2: {},
+              another_tool: {},
+            },
+          },
+        },
       };
 
       const result = await loadAgent({
@@ -1633,7 +1630,7 @@ describe('models/Agent', () => {
       expect(result.version).toBe(1);
     });
 
-    test('should return agent even when user is not author (permissions checked at route level)', async () => {
+    test('should return null when user is not author and agent has no projectIds', async () => {
       const authorId = new mongoose.Types.ObjectId();
       const userId = new mongoose.Types.ObjectId();
       const agentId = `agent_${uuidv4()}`;
@@ -1654,18 +1651,12 @@ describe('models/Agent', () => {
         model_parameters: { model: 'gpt-4' },
       });
 
-      // With the new permission system, loadAgent returns the agent regardless of permissions
-      // Permission checks are handled at the route level via middleware
-      expect(result).toBeTruthy();
-      expect(result.id).toBe(agentId);
-      expect(result.name).toBe('Test Agent');
+      expect(result).toBeFalsy();
     });
 
     test('should handle ephemeral agent with no MCP servers', async () => {
       const { EPHEMERAL_AGENT_ID } = require('librechat-data-provider').Constants;
 
-      getCachedTools.mockResolvedValue({});
-
       const mockReq = {
         user: { id: 'user123' },
         body: {
@@ -1676,6 +1667,11 @@ describe('models/Agent', () => {
             mcp: [],
           },
         },
+        app: {
+          locals: {
+            availableTools: {},
+          },
+        },
       };
 
       const result = await loadAgent({
@@ -1696,13 +1692,16 @@ describe('models/Agent', () => {
     test('should handle ephemeral agent with undefined ephemeralAgent in body', async () => {
       const { EPHEMERAL_AGENT_ID } = require('librechat-data-provider').Constants;
 
-      getCachedTools.mockResolvedValue({});
-
       const mockReq = {
         user: { id: 'user123' },
         body: {
           promptPrefix: 'Basic instructions',
         },
+        app: {
+          locals: {
+            availableTools: {},
+          },
+        },
       };
 
       const result = await loadAgent({
@@ -1735,13 +1734,6 @@ describe('models/Agent', () => {
         const { EPHEMERAL_AGENT_ID } = require('librechat-data-provider').Constants;
 
         const largeToolList = Array.from({ length: 100 }, (_, i) => `tool_${i}_mcp_server1`);
-        const availableTools = largeToolList.reduce((acc, tool) => {
-          acc[tool] = {};
-          return acc;
-        }, {});
-
-        getCachedTools.mockResolvedValue(availableTools);
-
         const mockReq = {
           user: { id: 'user123' },
           body: {
@@ -1752,6 +1744,14 @@ describe('models/Agent', () => {
               mcp: ['server1'],
             },
           },
+          app: {
+            locals: {
+              availableTools: largeToolList.reduce((acc, tool) => {
+                acc[tool] = {};
+                return acc;
+              }, {}),
+            },
+          },
         };
 
         const result = await loadAgent({
@@ -1766,7 +1766,7 @@ describe('models/Agent', () => {
         }
       });
 
-      test('should return agent from different project (permissions checked at route level)', async () => {
+      test('should handle loadAgent with agent from different project', async () => {
         const authorId = new mongoose.Types.ObjectId();
         const userId = new mongoose.Types.ObjectId();
         const agentId = `agent_${uuidv4()}`;
@@ -1789,11 +1789,7 @@ describe('models/Agent', () => {
           model_parameters: { model: 'gpt-4' },
         });
 
-        // With the new permission system, loadAgent returns the agent regardless of permissions
-        // Permission checks are handled at the route level via middleware
-        expect(result).toBeTruthy();
-        expect(result.id).toBe(agentId);
-        expect(result.name).toBe('Project Agent');
+        expect(result).toBeFalsy();
       });
     });
   });
@@ -1806,7 +1802,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();
@@ -2276,13 +2272,6 @@ describe('models/Agent', () => {
     test('should handle loadEphemeralAgent with malformed MCP tool names', async () => {
       const { EPHEMERAL_AGENT_ID } = require('librechat-data-provider').Constants;
 
-      getCachedTools.mockResolvedValue({
-        malformed_tool_name: {}, // No mcp delimiter
-        tool__server1: {}, // Wrong delimiter
-        tool_mcp_server1: {}, // Correct format
-        tool_mcp_server2: {}, // Different server
-      });
-
       const mockReq = {
         user: { id: 'user123' },
         body: {
@@ -2293,6 +2282,16 @@ describe('models/Agent', () => {
             mcp: ['server1'],
           },
         },
+        app: {
+          locals: {
+            availableTools: {
+              malformed_tool_name: {}, // No mcp delimiter
+              tool__server1: {}, // Wrong delimiter
+              tool_mcp_server1: {}, // Correct format
+              tool_mcp_server2: {}, // Different server
+            },
+          },
+        },
       };
 
       const result = await loadAgent({
@@ -2358,7 +2357,7 @@ describe('models/Agent', () => {
       const mongoUri = mongoServer.getUri();
       Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
       await mongoose.connect(mongoUri);
-    }, 20000);
+    });
 
     afterAll(async () => {
       await mongoose.disconnect();

api/models/Share.js

@@ -0,0 +1,346 @@
+const { nanoid } = require('nanoid');
+const { logger } = require('@librechat/data-schemas');
+const { Constants } = require('librechat-data-provider');
+const { Conversation, SharedLink } = require('~/db/models');
+const { getMessages } = require('./Message');
+
+class ShareServiceError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'ShareServiceError';
+    this.code = code;
+  }
+}
+
+const memoizedAnonymizeId = (prefix) => {
+  const memo = new Map();
+  return (id) => {
+    if (!memo.has(id)) {
+      memo.set(id, `${prefix}_${nanoid()}`);
+    }
+    return memo.get(id);
+  };
+};
+
+const anonymizeConvoId = memoizedAnonymizeId('convo');
+const anonymizeAssistantId = memoizedAnonymizeId('a');
+const anonymizeMessageId = (id) =>
+  id === Constants.NO_PARENT ? id : memoizedAnonymizeId('msg')(id);
+
+function anonymizeConvo(conversation) {
+  if (!conversation) {
+    return null;
+  }
+
+  const newConvo = { ...conversation };
+  if (newConvo.assistant_id) {
+    newConvo.assistant_id = anonymizeAssistantId(newConvo.assistant_id);
+  }
+  return newConvo;
+}
+
+function anonymizeMessages(messages, newConvoId) {
+  if (!Array.isArray(messages)) {
+    return [];
+  }
+
+  const idMap = new Map();
+  return messages.map((message) => {
+    const newMessageId = anonymizeMessageId(message.messageId);
+    idMap.set(message.messageId, newMessageId);
+
+    const anonymizedAttachments = message.attachments?.map((attachment) => {
+      return {
+        ...attachment,
+        messageId: newMessageId,
+        conversationId: newConvoId,
+      };
+    });
+
+    return {
+      ...message,
+      messageId: newMessageId,
+      parentMessageId:
+        idMap.get(message.parentMessageId) || anonymizeMessageId(message.parentMessageId),
+      conversationId: newConvoId,
+      model: message.model?.startsWith('asst_')
+        ? anonymizeAssistantId(message.model)
+        : message.model,
+      attachments: anonymizedAttachments,
+    };
+  });
+}
+
+async function getSharedMessages(shareId) {
+  try {
+    const share = await SharedLink.findOne({ shareId, isPublic: true })
+      .populate({
+        path: 'messages',
+        select: '-_id -__v -user',
+      })
+      .select('-_id -__v -user')
+      .lean();
+
+    if (!share?.conversationId || !share.isPublic) {
+      return null;
+    }
+
+    const newConvoId = anonymizeConvoId(share.conversationId);
+    const result = {
+      ...share,
+      conversationId: newConvoId,
+      messages: anonymizeMessages(share.messages, newConvoId),
+    };
+
+    return result;
+  } catch (error) {
+    logger.error('[getShare] Error getting share link', {
+      error: error.message,
+      shareId,
+    });
+    throw new ShareServiceError('Error getting share link', 'SHARE_FETCH_ERROR');
+  }
+}
+
+async function getSharedLinks(user, pageParam, pageSize, isPublic, sortBy, sortDirection, search) {
+  try {
+    const query = { user, isPublic };
+
+    if (pageParam) {
+      if (sortDirection === 'desc') {
+        query[sortBy] = { $lt: pageParam };
+      } else {
+        query[sortBy] = { $gt: pageParam };
+      }
+    }
+
+    if (search && search.trim()) {
+      try {
+        const searchResults = await Conversation.meiliSearch(search);
+
+        if (!searchResults?.hits?.length) {
+          return {
+            links: [],
+            nextCursor: undefined,
+            hasNextPage: false,
+          };
+        }
+
+        const conversationIds = searchResults.hits.map((hit) => hit.conversationId);
+        query['conversationId'] = { $in: conversationIds };
+      } catch (searchError) {
+        logger.error('[getSharedLinks] Meilisearch error', {
+          error: searchError.message,
+          user,
+        });
+        return {
+          links: [],
+          nextCursor: undefined,
+          hasNextPage: false,
+        };
+      }
+    }
+
+    const sort = {};
+    sort[sortBy] = sortDirection === 'desc' ? -1 : 1;
+
+    if (Array.isArray(query.conversationId)) {
+      query.conversationId = { $in: query.conversationId };
+    }
+
+    const sharedLinks = await SharedLink.find(query)
+      .sort(sort)
+      .limit(pageSize + 1)
+      .select('-__v -user')
+      .lean();
+
+    const hasNextPage = sharedLinks.length > pageSize;
+    const links = sharedLinks.slice(0, pageSize);
+
+    const nextCursor = hasNextPage ? links[links.length - 1][sortBy] : undefined;
+
+    return {
+      links: links.map((link) => ({
+        shareId: link.shareId,
+        title: link?.title || 'Untitled',
+        isPublic: link.isPublic,
+        createdAt: link.createdAt,
+        conversationId: link.conversationId,
+      })),
+      nextCursor,
+      hasNextPage,
+    };
+  } catch (error) {
+    logger.error('[getSharedLinks] Error getting shares', {
+      error: error.message,
+      user,
+    });
+    throw new ShareServiceError('Error getting shares', 'SHARES_FETCH_ERROR');
+  }
+}
+
+async function deleteAllSharedLinks(user) {
+  try {
+    const result = await SharedLink.deleteMany({ user });
+    return {
+      message: 'All shared links deleted successfully',
+      deletedCount: result.deletedCount,
+    };
+  } catch (error) {
+    logger.error('[deleteAllSharedLinks] Error deleting shared links', {
+      error: error.message,
+      user,
+    });
+    throw new ShareServiceError('Error deleting shared links', 'BULK_DELETE_ERROR');
+  }
+}
+
+async function createSharedLink(user, conversationId) {
+  if (!user || !conversationId) {
+    throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
+  }
+  try {
+    const [existingShare, conversationMessages] = await Promise.all([
+      SharedLink.findOne({ conversationId, isPublic: true }).select('-_id -__v -user').lean(),
+      getMessages({ conversationId }),
+    ]);
+
+    if (existingShare && existingShare.isPublic) {
+      throw new ShareServiceError('Share already exists', 'SHARE_EXISTS');
+    } else if (existingShare) {
+      await SharedLink.deleteOne({ conversationId });
+    }
+
+    const conversation = await Conversation.findOne({ conversationId }).lean();
+    const title = conversation?.title || 'Untitled';
+
+    const shareId = nanoid();
+    await SharedLink.create({
+      shareId,
+      conversationId,
+      messages: conversationMessages,
+      title,
+      user,
+    });
+
+    return { shareId, conversationId };
+  } catch (error) {
+    logger.error('[createSharedLink] Error creating shared link', {
+      error: error.message,
+      user,
+      conversationId,
+    });
+    throw new ShareServiceError('Error creating shared link', 'SHARE_CREATE_ERROR');
+  }
+}
+
+async function getSharedLink(user, conversationId) {
+  if (!user || !conversationId) {
+    throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
+  }
+
+  try {
+    const share = await SharedLink.findOne({ conversationId, user, isPublic: true })
+      .select('shareId -_id')
+      .lean();
+
+    if (!share) {
+      return { shareId: null, success: false };
+    }
+
+    return { shareId: share.shareId, success: true };
+  } catch (error) {
+    logger.error('[getSharedLink] Error getting shared link', {
+      error: error.message,
+      user,
+      conversationId,
+    });
+    throw new ShareServiceError('Error getting shared link', 'SHARE_FETCH_ERROR');
+  }
+}
+
+async function updateSharedLink(user, shareId) {
+  if (!user || !shareId) {
+    throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
+  }
+
+  try {
+    const share = await SharedLink.findOne({ shareId }).select('-_id -__v -user').lean();
+
+    if (!share) {
+      throw new ShareServiceError('Share not found', 'SHARE_NOT_FOUND');
+    }
+
+    const [updatedMessages] = await Promise.all([
+      getMessages({ conversationId: share.conversationId }),
+    ]);
+
+    const newShareId = nanoid();
+    const update = {
+      messages: updatedMessages,
+      user,
+      shareId: newShareId,
+    };
+
+    const updatedShare = await SharedLink.findOneAndUpdate({ shareId, user }, update, {
+      new: true,
+      upsert: false,
+      runValidators: true,
+    }).lean();
+
+    if (!updatedShare) {
+      throw new ShareServiceError('Share update failed', 'SHARE_UPDATE_ERROR');
+    }
+
+    anonymizeConvo(updatedShare);
+
+    return { shareId: newShareId, conversationId: updatedShare.conversationId };
+  } catch (error) {
+    logger.error('[updateSharedLink] Error updating shared link', {
+      error: error.message,
+      user,
+      shareId,
+    });
+    throw new ShareServiceError(
+      error.code === 'SHARE_UPDATE_ERROR' ? error.message : 'Error updating shared link',
+      error.code || 'SHARE_UPDATE_ERROR',
+    );
+  }
+}
+
+async function deleteSharedLink(user, shareId) {
+  if (!user || !shareId) {
+    throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
+  }
+
+  try {
+    const result = await SharedLink.findOneAndDelete({ shareId, user }).lean();
+
+    if (!result) {
+      return null;
+    }
+
+    return {
+      success: true,
+      shareId,
+      message: 'Share deleted successfully',
+    };
+  } catch (error) {
+    logger.error('[deleteSharedLink] Error deleting shared link', {
+      error: error.message,
+      user,
+      shareId,
+    });
+    throw new ShareServiceError('Error deleting shared link', 'SHARE_DELETE_ERROR');
+  }
+}
+
+module.exports = {
+  getSharedLink,
+  getSharedLinks,
+  createSharedLink,
+  updateSharedLink,
+  deleteSharedLink,
+  getSharedMessages,
+  deleteAllSharedLinks,
+};

api/models/Token.js

@@ -0,0 +1,42 @@
+const { findToken, updateToken, createToken } = require('~/models');
+const { encryptV2 } = require('~/server/utils/crypto');
+
+/**
+ * Handles the OAuth token by creating or updating the token.
+ * @param {object} fields
+ * @param {string} fields.userId - The user's ID.
+ * @param {string} fields.token - The full token to store.
+ * @param {string} fields.identifier - Unique, alternative identifier for the token.
+ * @param {number} fields.expiresIn - The number of seconds until the token expires.
+ * @param {object} fields.metadata - Additional metadata to store with the token.
+ * @param {string} [fields.type="oauth"] - The type of token. Default is 'oauth'.
+ */
+async function handleOAuthToken({
+  token,
+  userId,
+  identifier,
+  expiresIn,
+  metadata,
+  type = 'oauth',
+}) {
+  const encrypedToken = await encryptV2(token);
+  const tokenData = {
+    type,
+    userId,
+    metadata,
+    identifier,
+    token: encrypedToken,
+    expiresIn: parseInt(expiresIn, 10) || 3600,
+  };
+
+  const existingToken = await findToken({ userId, identifier });
+  if (existingToken) {
+    return await updateToken({ identifier }, tokenData);
+  } else {
+    return await createToken(tokenData);
+  }
+}
+
+module.exports = {
+  handleOAuthToken,
+};

api/models/inviteUser.js

@@ -1,6 +1,6 @@
 const mongoose = require('mongoose');
-const { getRandomValues } = require('@librechat/api');
 const { logger, hashToken } = require('@librechat/data-schemas');
+const { getRandomValues } = require('~/server/utils/crypto');
 const { createToken, findToken } = require('~/models');
 
 /**

api/models/tx.js

@@ -78,7 +78,7 @@ const tokenValues = Object.assign(
     'gpt-3.5-turbo-1106': { prompt: 1, completion: 2 },
     'o4-mini': { prompt: 1.1, completion: 4.4 },
     'o3-mini': { prompt: 1.1, completion: 4.4 },
-    o3: { prompt: 2, completion: 8 },
+    o3: { prompt: 10, completion: 40 },
     'o1-mini': { prompt: 1.1, completion: 4.4 },
     'o1-preview': { prompt: 15, completion: 60 },
     o1: { prompt: 15, completion: 60 },

api/package.json

@@ -34,25 +34,25 @@
   },
   "homepage": "https://librechat.ai",
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.52.0",
+    "@anthropic-ai/sdk": "^0.37.0",
     "@aws-sdk/client-s3": "^3.758.0",
     "@aws-sdk/s3-request-presigner": "^3.758.0",
     "@azure/identity": "^4.7.0",
     "@azure/search-documents": "^12.0.0",
     "@azure/storage-blob": "^12.27.0",
-    "@google/generative-ai": "^0.24.0",
+    "@google/generative-ai": "^0.23.0",
     "@googleapis/youtube": "^20.0.0",
     "@keyv/redis": "^4.3.3",
-    "@langchain/community": "^0.3.47",
-    "@langchain/core": "^0.3.60",
-    "@langchain/google-genai": "^0.2.13",
-    "@langchain/google-vertexai": "^0.2.13",
+    "@langchain/community": "^0.3.44",
+    "@langchain/core": "^0.3.57",
+    "@langchain/google-genai": "^0.2.9",
+    "@langchain/google-vertexai": "^0.2.9",
     "@langchain/textsplitters": "^0.1.0",
-    "@librechat/agents": "^2.4.41",
+    "@librechat/agents": "^2.4.38",
+    "@librechat/auth": "*",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@node-saml/passport-saml": "^5.0.0",
-    "@microsoft/microsoft-graph-client": "^3.0.7",
     "@waylaidwanderer/fetch-event-source": "^3.0.1",
     "axios": "^1.8.2",
     "bcryptjs": "^2.4.3",
@@ -121,6 +121,7 @@
     "jest": "^29.7.0",
     "mongodb-memory-server": "^10.1.3",
     "nodemon": "^3.0.3",
-    "supertest": "^7.1.0"
+    "supertest": "^7.1.0",
+    "ts-jest": "^29.4.0"
   }
-}
+}

api/server/controllers/AskController.js

@@ -0,0 +1,282 @@
+const { getResponseSender, Constants } = require('librechat-data-provider');
+const {
+  handleAbortError,
+  createAbortController,
+  cleanupAbortController,
+} = require('~/server/middleware');
+const {
+  disposeClient,
+  processReqData,
+  clientRegistry,
+  requestDataMap,
+} = require('~/server/cleanup');
+const { sendMessage, createOnProgress } = require('~/server/utils');
+const { saveMessage } = require('~/models');
+const { logger } = require('~/config');
+
+const AskController = async (req, res, next, initializeClient, addTitle) => {
+  let {
+    text,
+    endpointOption,
+    conversationId,
+    modelDisplayLabel,
+    parentMessageId = null,
+    overrideParentMessageId = null,
+  } = req.body;
+
+  let client = null;
+  let abortKey = null;
+  let cleanupHandlers = [];
+  let clientRef = null;
+
+  logger.debug('[AskController]', {
+    text,
+    conversationId,
+    ...endpointOption,
+    modelsConfig: endpointOption?.modelsConfig ? 'exists' : '',
+  });
+
+  let userMessage = null;
+  let userMessagePromise = null;
+  let promptTokens = null;
+  let userMessageId = null;
+  let responseMessageId = null;
+  let getAbortData = null;
+
+  const sender = getResponseSender({
+    ...endpointOption,
+    model: endpointOption.modelOptions.model,
+    modelDisplayLabel,
+  });
+  const initialConversationId = conversationId;
+  const newConvo = !initialConversationId;
+  const userId = req.user.id;
+
+  let reqDataContext = {
+    userMessage,
+    userMessagePromise,
+    responseMessageId,
+    promptTokens,
+    conversationId,
+    userMessageId,
+  };
+
+  const updateReqData = (data = {}) => {
+    reqDataContext = processReqData(data, reqDataContext);
+    abortKey = reqDataContext.abortKey;
+    userMessage = reqDataContext.userMessage;
+    userMessagePromise = reqDataContext.userMessagePromise;
+    responseMessageId = reqDataContext.responseMessageId;
+    promptTokens = reqDataContext.promptTokens;
+    conversationId = reqDataContext.conversationId;
+    userMessageId = reqDataContext.userMessageId;
+  };
+
+  let { onProgress: progressCallback, getPartialText } = createOnProgress();
+
+  const performCleanup = () => {
+    logger.debug('[AskController] Performing cleanup');
+    if (Array.isArray(cleanupHandlers)) {
+      for (const handler of cleanupHandlers) {
+        try {
+          if (typeof handler === 'function') {
+            handler();
+          }
+        } catch (e) {
+          // Ignore
+        }
+      }
+    }
+
+    if (abortKey) {
+      logger.debug('[AskController] Cleaning up abort controller');
+      cleanupAbortController(abortKey);
+      abortKey = null;
+    }
+
+    if (client) {
+      disposeClient(client);
+      client = null;
+    }
+
+    reqDataContext = null;
+    userMessage = null;
+    userMessagePromise = null;
+    promptTokens = null;
+    getAbortData = null;
+    progressCallback = null;
+    endpointOption = null;
+    cleanupHandlers = null;
+    addTitle = null;
+
+    if (requestDataMap.has(req)) {
+      requestDataMap.delete(req);
+    }
+    logger.debug('[AskController] Cleanup completed');
+  };
+
+  try {
+    ({ client } = await initializeClient({ req, res, endpointOption }));
+    if (clientRegistry && client) {
+      clientRegistry.register(client, { userId }, client);
+    }
+
+    if (client) {
+      requestDataMap.set(req, { client });
+    }
+
+    clientRef = new WeakRef(client);
+
+    getAbortData = () => {
+      const currentClient = clientRef?.deref();
+      const currentText =
+        currentClient?.getStreamText != null ? currentClient.getStreamText() : getPartialText();
+
+      return {
+        sender,
+        conversationId,
+        messageId: reqDataContext.responseMessageId,
+        parentMessageId: overrideParentMessageId ?? userMessageId,
+        text: currentText,
+        userMessage: userMessage,
+        userMessagePromise: userMessagePromise,
+        promptTokens: reqDataContext.promptTokens,
+      };
+    };
+
+    const { onStart, abortController } = createAbortController(
+      req,
+      res,
+      getAbortData,
+      updateReqData,
+    );
+
+    const closeHandler = () => {
+      logger.debug('[AskController] Request closed');
+      if (!abortController || abortController.signal.aborted || abortController.requestCompleted) {
+        return;
+      }
+      abortController.abort();
+      logger.debug('[AskController] Request aborted on close');
+    };
+
+    res.on('close', closeHandler);
+    cleanupHandlers.push(() => {
+      try {
+        res.removeListener('close', closeHandler);
+      } catch (e) {
+        // Ignore
+      }
+    });
+
+    const messageOptions = {
+      user: userId,
+      parentMessageId,
+      conversationId: reqDataContext.conversationId,
+      overrideParentMessageId,
+      getReqData: updateReqData,
+      onStart,
+      abortController,
+      progressCallback,
+      progressOptions: {
+        res,
+      },
+    };
+
+    /** @type {TMessage} */
+    let response = await client.sendMessage(text, messageOptions);
+    response.endpoint = endpointOption.endpoint;
+
+    const databasePromise = response.databasePromise;
+    delete response.databasePromise;
+
+    const { conversation: convoData = {} } = await databasePromise;
+    const conversation = { ...convoData };
+    conversation.title =
+      conversation && !conversation.title ? null : conversation?.title || 'New Chat';
+
+    const latestUserMessage = reqDataContext.userMessage;
+
+    if (client?.options?.attachments && latestUserMessage) {
+      latestUserMessage.files = client.options.attachments;
+      if (endpointOption?.modelOptions?.model) {
+        conversation.model = endpointOption.modelOptions.model;
+      }
+      delete latestUserMessage.image_urls;
+    }
+
+    if (!abortController.signal.aborted) {
+      const finalResponseMessage = { ...response };
+
+      sendMessage(res, {
+        final: true,
+        conversation,
+        title: conversation.title,
+        requestMessage: latestUserMessage,
+        responseMessage: finalResponseMessage,
+      });
+      res.end();
+
+      if (client?.savedMessageIds && !client.savedMessageIds.has(response.messageId)) {
+        await saveMessage(
+          req,
+          { ...finalResponseMessage, user: userId },
+          { context: 'api/server/controllers/AskController.js - response end' },
+        );
+      }
+    }
+
+    if (!client?.skipSaveUserMessage && latestUserMessage) {
+      await saveMessage(req, latestUserMessage, {
+        context: "api/server/controllers/AskController.js - don't skip saving user message",
+      });
+    }
+
+    if (typeof addTitle === 'function' && parentMessageId === Constants.NO_PARENT && newConvo) {
+      addTitle(req, {
+        text,
+        response: { ...response },
+        client,
+      })
+        .then(() => {
+          logger.debug('[AskController] Title generation started');
+        })
+        .catch((err) => {
+          logger.error('[AskController] Error in title generation', err);
+        })
+        .finally(() => {
+          logger.debug('[AskController] Title generation completed');
+          performCleanup();
+        });
+    } else {
+      performCleanup();
+    }
+  } catch (error) {
+    logger.error('[AskController] Error handling request', error);
+    let partialText = '';
+    try {
+      const currentClient = clientRef?.deref();
+      partialText =
+        currentClient?.getStreamText != null ? currentClient.getStreamText() : getPartialText();
+    } catch (getTextError) {
+      logger.error('[AskController] Error calling getText() during error handling', getTextError);
+    }
+
+    handleAbortError(res, req, error, {
+      sender,
+      partialText,
+      conversationId: reqDataContext.conversationId,
+      messageId: reqDataContext.responseMessageId,
+      parentMessageId: overrideParentMessageId ?? reqDataContext.userMessageId ?? parentMessageId,
+      userMessageId: reqDataContext.userMessageId,
+    })
+      .catch((err) => {
+        logger.error('[AskController] Error in `handleAbortError` during catch block', err);
+      })
+      .finally(() => {
+        performCleanup();
+      });
+  }
+};
+
+module.exports = AskController;

api/server/controllers/AuthController.js

@@ -1,21 +1,24 @@
 const cookies = require('cookie');
 const jwt = require('jsonwebtoken');
-const openIdClient = require('openid-client');
 const { logger } = require('@librechat/data-schemas');
 const {
   registerUser,
+  requestPasswordReset,
   resetPassword,
   setAuthTokens,
-  requestPasswordReset,
   setOpenIDAuthTokens,
-} = require('~/server/services/AuthService');
+} = require('@librechat/auth');
 const { findUser, getUserById, deleteAllUserSessions, findSession } = require('~/models');
-const { getOpenIdConfig } = require('~/strategies');
+const { getOpenIdConfig } = require('@librechat/auth');
 const { isEnabled } = require('~/server/utils');
+const { isEmailDomainAllowed } = require('~/server/services/domains');
+const { getBalanceConfig } = require('~/server/services/Config');
 
 const registrationController = async (req, res) => {
   try {
-    const response = await registerUser(req.body);
+    const isEmailDomAllowed = await isEmailDomainAllowed(req.body.email);
+    const balanceConfig = await getBalanceConfig();
+    const response = await registerUser(req.body, {}, isEmailDomAllowed, balanceConfig);
     const { status, message } = response;
     res.status(status).send({ message });
   } catch (err) {
@@ -65,9 +68,11 @@ const refreshController = async (req, res) => {
   if (!refreshToken) {
     return res.status(200).send('Refresh token not provided');
   }
+
   if (token_provider === 'openid' && isEnabled(process.env.OPENID_REUSE_TOKENS) === true) {
     try {
       const openIdConfig = getOpenIdConfig();
+      const openIdClient = await import('openid-client');
       const tokenset = await openIdClient.refreshTokenGrant(openIdConfig, refreshToken);
       const claims = tokenset.claims();
       const user = await findUser({ email: claims.email });

api/server/controllers/EditController.js

@@ -84,7 +84,7 @@ const EditController = async (req, res, next, initializeClient) => {
     }
 
     if (abortKey) {
-      logger.debug('[EditController] Cleaning up abort controller');
+      logger.debug('[AskController] Cleaning up abort controller');
       cleanupAbortController(abortKey);
       abortKey = null;
     }

api/server/controllers/PermissionsController.js

@@ -1,437 +0,0 @@
-/**
- * @import { TUpdateResourcePermissionsRequest, TUpdateResourcePermissionsResponse } from 'librechat-data-provider'
- */
-
-const mongoose = require('mongoose');
-const { logger } = require('@librechat/data-schemas');
-const {
-  getAvailableRoles,
-  ensurePrincipalExists,
-  getEffectivePermissions,
-  ensureGroupPrincipalExists,
-  bulkUpdateResourcePermissions,
-} = require('~/server/services/PermissionService');
-const { AclEntry } = require('~/db/models');
-const {
-  searchPrincipals: searchLocalPrincipals,
-  sortPrincipalsByRelevance,
-  calculateRelevanceScore,
-} = require('~/models');
-const {
-  searchEntraIdPrincipals,
-  entraIdPrincipalFeatureEnabled,
-} = require('~/server/services/GraphApiService');
-
-/**
- * Generic controller for resource permission endpoints
- * Delegates validation and logic to PermissionService
- */
-
-/**
- * Bulk update permissions for a resource (grant, update, remove)
- * @route PUT /api/{resourceType}/{resourceId}/permissions
- * @param {Object} req - Express request object
- * @param {Object} req.params - Route parameters
- * @param {string} req.params.resourceType - Resource type (e.g., 'agent')
- * @param {string} req.params.resourceId - Resource ID
- * @param {TUpdateResourcePermissionsRequest} req.body - Request body
- * @param {Object} res - Express response object
- * @returns {Promise<TUpdateResourcePermissionsResponse>} Updated permissions response
- */
-const updateResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    /** @type {TUpdateResourcePermissionsRequest} */
-    const { updated, removed, public: isPublic, publicAccessRoleId } = req.body;
-    const { id: userId } = req.user;
-
-    // Prepare principals for the service call
-    const updatedPrincipals = [];
-    const revokedPrincipals = [];
-
-    // Add updated principals
-    if (updated && Array.isArray(updated)) {
-      updatedPrincipals.push(...updated);
-    }
-
-    // Add public permission if enabled
-    if (isPublic && publicAccessRoleId) {
-      updatedPrincipals.push({
-        type: 'public',
-        id: null,
-        accessRoleId: publicAccessRoleId,
-      });
-    }
-
-    // Prepare authentication context for enhanced group member fetching
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-    const authHeader = req.headers.authorization;
-    const accessToken =
-      authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-    const authContext =
-      useEntraId && accessToken
-        ? {
-            accessToken,
-            sub: req.user.openidId,
-          }
-        : null;
-
-    // Ensure updated principals exist in the database before processing permissions
-    const validatedPrincipals = [];
-    for (const principal of updatedPrincipals) {
-      try {
-        let principalId;
-
-        if (principal.type === 'public') {
-          principalId = null; // Public principals don't need database records
-        } else if (principal.type === 'user') {
-          principalId = await ensurePrincipalExists(principal);
-        } else if (principal.type === 'group') {
-          // Pass authContext to enable member fetching for Entra ID groups when available
-          principalId = await ensureGroupPrincipalExists(principal, authContext);
-        } else {
-          logger.error(`Unsupported principal type: ${principal.type}`);
-          continue; // Skip invalid principal types
-        }
-
-        // Update the principal with the validated ID for ACL operations
-        validatedPrincipals.push({
-          ...principal,
-          id: principalId,
-        });
-      } catch (error) {
-        logger.error('Error ensuring principal exists:', {
-          principal: {
-            type: principal.type,
-            id: principal.id,
-            name: principal.name,
-            source: principal.source,
-          },
-          error: error.message,
-        });
-        // Continue with other principals instead of failing the entire operation
-        continue;
-      }
-    }
-
-    // Add removed principals
-    if (removed && Array.isArray(removed)) {
-      revokedPrincipals.push(...removed);
-    }
-
-    // If public is disabled, add public to revoked list
-    if (!isPublic) {
-      revokedPrincipals.push({
-        type: 'public',
-        id: null,
-      });
-    }
-
-    const results = await bulkUpdateResourcePermissions({
-      resourceType,
-      resourceId,
-      updatedPrincipals: validatedPrincipals,
-      revokedPrincipals,
-      grantedBy: userId,
-    });
-
-    /** @type {TUpdateResourcePermissionsResponse} */
-    const response = {
-      message: 'Permissions updated successfully',
-      results: {
-        principals: results.granted,
-        public: isPublic || false,
-        publicAccessRoleId: isPublic ? publicAccessRoleId : undefined,
-      },
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error updating resource permissions:', error);
-    res.status(400).json({
-      error: 'Failed to update permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get principals with their permission roles for a resource (UI-friendly format)
- * Uses efficient aggregation pipeline to join User/Group data in single query
- * @route GET /api/permissions/{resourceType}/{resourceId}
- */
-const getResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-
-    // Use aggregation pipeline for efficient single-query data retrieval
-    const results = await AclEntry.aggregate([
-      // Match ACL entries for this resource
-      {
-        $match: {
-          resourceType,
-          resourceId: mongoose.Types.ObjectId.isValid(resourceId)
-            ? mongoose.Types.ObjectId.createFromHexString(resourceId)
-            : resourceId,
-        },
-      },
-      // Lookup AccessRole information
-      {
-        $lookup: {
-          from: 'accessroles',
-          localField: 'roleId',
-          foreignField: '_id',
-          as: 'role',
-        },
-      },
-      // Lookup User information (for user principals)
-      {
-        $lookup: {
-          from: 'users',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'userInfo',
-        },
-      },
-      // Lookup Group information (for group principals)
-      {
-        $lookup: {
-          from: 'groups',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'groupInfo',
-        },
-      },
-      // Project final structure
-      {
-        $project: {
-          principalType: 1,
-          principalId: 1,
-          accessRoleId: { $arrayElemAt: ['$role.accessRoleId', 0] },
-          userInfo: { $arrayElemAt: ['$userInfo', 0] },
-          groupInfo: { $arrayElemAt: ['$groupInfo', 0] },
-        },
-      },
-    ]);
-
-    const principals = [];
-    let publicPermission = null;
-
-    // Process aggregation results
-    for (const result of results) {
-      if (result.principalType === 'public') {
-        publicPermission = {
-          public: true,
-          publicAccessRoleId: result.accessRoleId,
-        };
-      } else if (result.principalType === 'user' && result.userInfo) {
-        principals.push({
-          type: 'user',
-          id: result.userInfo._id.toString(),
-          name: result.userInfo.name || result.userInfo.username,
-          email: result.userInfo.email,
-          avatar: result.userInfo.avatar,
-          source: !result.userInfo._id ? 'entra' : 'local',
-          idOnTheSource: result.userInfo.idOnTheSource || result.userInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      } else if (result.principalType === 'group' && result.groupInfo) {
-        principals.push({
-          type: 'group',
-          id: result.groupInfo._id.toString(),
-          name: result.groupInfo.name,
-          email: result.groupInfo.email,
-          description: result.groupInfo.description,
-          avatar: result.groupInfo.avatar,
-          source: result.groupInfo.source || 'local',
-          idOnTheSource: result.groupInfo.idOnTheSource || result.groupInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      }
-    }
-
-    // Return response in format expected by frontend
-    const response = {
-      resourceType,
-      resourceId,
-      principals,
-      public: publicPermission?.public || false,
-      ...(publicPermission?.publicAccessRoleId && {
-        publicAccessRoleId: publicPermission.publicAccessRoleId,
-      }),
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error getting resource permissions principals:', error);
-    res.status(500).json({
-      error: 'Failed to get permissions principals',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @route GET /api/{resourceType}/roles
- */
-const getResourceRoles = async (req, res) => {
-  try {
-    const { resourceType } = req.params;
-
-    const roles = await getAvailableRoles({ resourceType });
-
-    res.status(200).json(
-      roles.map((role) => ({
-        accessRoleId: role.accessRoleId,
-        name: role.name,
-        description: role.description,
-        permBits: role.permBits,
-      })),
-    );
-  } catch (error) {
-    logger.error('Error getting resource roles:', error);
-    res.status(500).json({
-      error: 'Failed to get roles',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get user's effective permission bitmask for a resource
- * @route GET /api/{resourceType}/{resourceId}/effective
- */
-const getUserEffectivePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    const { id: userId } = req.user;
-
-    const permissionBits = await getEffectivePermissions({
-      userId,
-      resourceType,
-      resourceId,
-    });
-
-    res.status(200).json({
-      permissionBits,
-    });
-  } catch (error) {
-    logger.error('Error getting user effective permissions:', error);
-    res.status(500).json({
-      error: 'Failed to get effective permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Search for users and groups to grant permissions
- * Supports hybrid local database + Entra ID search when configured
- * @route GET /api/permissions/search-principals
- */
-const searchPrincipals = async (req, res) => {
-  try {
-    const { q: query, limit = 20, type } = req.query;
-
-    if (!query || query.trim().length === 0) {
-      return res.status(400).json({
-        error: 'Query parameter "q" is required and must not be empty',
-      });
-    }
-
-    if (query.trim().length < 2) {
-      return res.status(400).json({
-        error: 'Query must be at least 2 characters long',
-      });
-    }
-
-    const searchLimit = Math.min(Math.max(1, parseInt(limit) || 10), 50);
-    const typeFilter = ['user', 'group'].includes(type) ? type : null;
-
-    const localResults = await searchLocalPrincipals(query.trim(), searchLimit, typeFilter);
-    let allPrincipals = [...localResults];
-
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-
-    if (useEntraId && localResults.length < searchLimit) {
-      try {
-        const graphTypeMap = {
-          user: 'users',
-          group: 'groups',
-          null: 'all',
-        };
-
-        const authHeader = req.headers.authorization;
-        const accessToken =
-          authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-
-        if (accessToken) {
-          const graphResults = await searchEntraIdPrincipals(
-            accessToken,
-            req.user.openidId,
-            query.trim(),
-            graphTypeMap[typeFilter],
-            searchLimit - localResults.length,
-          );
-
-          const localEmails = new Set(
-            localResults.map((p) => p.email?.toLowerCase()).filter(Boolean),
-          );
-          const localGroupSourceIds = new Set(
-            localResults.map((p) => p.idOnTheSource).filter(Boolean),
-          );
-
-          for (const principal of graphResults) {
-            const isDuplicateByEmail =
-              principal.email && localEmails.has(principal.email.toLowerCase());
-            const isDuplicateBySourceId =
-              principal.idOnTheSource && localGroupSourceIds.has(principal.idOnTheSource);
-
-            if (!isDuplicateByEmail && !isDuplicateBySourceId) {
-              allPrincipals.push(principal);
-            }
-          }
-        }
-      } catch (graphError) {
-        logger.warn('Graph API search failed, falling back to local results:', graphError.message);
-      }
-    }
-    const scoredResults = allPrincipals.map((item) => ({
-      ...item,
-      _searchScore: calculateRelevanceScore(item, query.trim()),
-    }));
-
-    allPrincipals = sortPrincipalsByRelevance(scoredResults)
-      .slice(0, searchLimit)
-      .map((result) => {
-        const { _searchScore, ...resultWithoutScore } = result;
-        return resultWithoutScore;
-      });
-    res.status(200).json({
-      query: query.trim(),
-      limit: searchLimit,
-      type: typeFilter,
-      results: allPrincipals,
-      count: allPrincipals.length,
-      sources: {
-        local: allPrincipals.filter((r) => r.source === 'local').length,
-        entra: allPrincipals.filter((r) => r.source === 'entra').length,
-      },
-    });
-  } catch (error) {
-    logger.error('Error searching principals:', error);
-    res.status(500).json({
-      error: 'Failed to search principals',
-      details: error.message,
-    });
-  }
-};
-
-module.exports = {
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  getUserEffectivePermissions,
-  searchPrincipals,
-};

api/server/controllers/PluginController.js

@@ -1,11 +1,9 @@
-const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, AuthType } = require('librechat-data-provider');
-const { getCustomConfig, getCachedTools } = require('~/server/services/Config');
 const { getToolkitKey } = require('~/server/services/ToolService');
-const { getMCPManager, getFlowStateManager } = require('~/config');
+const { getCustomConfig } = require('~/server/services/Config');
 const { availableTools } = require('~/app/clients/tools');
+const { getMCPManager } = require('~/config');
 const { getLogStores } = require('~/cache');
-const { Constants } = require('librechat-data-provider');
 
 /**
  * Filters out duplicate plugins from the list of plugins.
@@ -86,45 +84,6 @@ const getAvailablePluginsController = async (req, res) => {
   }
 };
 
-function createServerToolsCallback() {
-  /**
-   * @param {string} serverName
-   * @param {TPlugin[] | null} serverTools
-   */
-  return async function (serverName, serverTools) {
-    try {
-      const mcpToolsCache = getLogStores(CacheKeys.MCP_TOOLS);
-      if (!serverName || !mcpToolsCache) {
-        return;
-      }
-      await mcpToolsCache.set(serverName, serverTools);
-      logger.debug(`MCP tools for ${serverName} added to cache.`);
-    } catch (error) {
-      logger.error('Error retrieving MCP tools from cache:', error);
-    }
-  };
-}
-
-function createGetServerTools() {
-  /**
-   * Retrieves cached server tools
-   * @param {string} serverName
-   * @returns {Promise<TPlugin[] | null>}
-   */
-  return async function (serverName) {
-    try {
-      const mcpToolsCache = getLogStores(CacheKeys.MCP_TOOLS);
-      if (!mcpToolsCache) {
-        return null;
-      }
-      return await mcpToolsCache.get(serverName);
-    } catch (error) {
-      logger.error('Error retrieving MCP tools from cache:', error);
-      return null;
-    }
-  };
-}
-
 /**
  * Retrieves and returns a list of available tools, either from a cache or by reading a plugin manifest file.
  *
@@ -150,16 +109,7 @@ const getAvailableTools = async (req, res) => {
     const customConfig = await getCustomConfig();
     if (customConfig?.mcpServers != null) {
       const mcpManager = getMCPManager();
-      const flowsCache = getLogStores(CacheKeys.FLOWS);
-      const flowManager = flowsCache ? getFlowStateManager(flowsCache) : null;
-      const serverToolsCallback = createServerToolsCallback();
-      const getServerTools = createGetServerTools();
-      const mcpTools = await mcpManager.loadManifestTools({
-        flowManager,
-        serverToolsCallback,
-        getServerTools,
-      });
-      pluginManifest = [...mcpTools, ...pluginManifest];
+      pluginManifest = await mcpManager.loadManifestTools(pluginManifest);
     }
 
     /** @type {TPlugin[]} */
@@ -173,57 +123,17 @@ const getAvailableTools = async (req, res) => {
       }
     });
 
-    const toolDefinitions = await getCachedTools({ includeGlobal: true });
+    const toolDefinitions = req.app.locals.availableTools;
+    const tools = authenticatedPlugins.filter(
+      (plugin) =>
+        toolDefinitions[plugin.pluginKey] !== undefined ||
+        (plugin.toolkit === true &&
+          Object.keys(toolDefinitions).some((key) => getToolkitKey(key) === plugin.pluginKey)),
+    );
 
-    const toolsOutput = [];
-    for (const plugin of authenticatedPlugins) {
-      const isToolDefined = toolDefinitions[plugin.pluginKey] !== undefined;
-      const isToolkit =
-        plugin.toolkit === true &&
-        Object.keys(toolDefinitions).some((key) => getToolkitKey(key) === plugin.pluginKey);
-
-      if (!isToolDefined && !isToolkit) {
-        continue;
-      }
-
-      const toolToAdd = { ...plugin };
-
-      if (!plugin.pluginKey.includes(Constants.mcp_delimiter)) {
-        toolsOutput.push(toolToAdd);
-        continue;
-      }
-
-      const parts = plugin.pluginKey.split(Constants.mcp_delimiter);
-      const serverName = parts[parts.length - 1];
-      const serverConfig = customConfig?.mcpServers?.[serverName];
-
-      if (!serverConfig?.customUserVars) {
-        toolsOutput.push(toolToAdd);
-        continue;
-      }
-
-      const customVarKeys = Object.keys(serverConfig.customUserVars);
-
-      if (customVarKeys.length === 0) {
-        toolToAdd.authConfig = [];
-        toolToAdd.authenticated = true;
-      } else {
-        toolToAdd.authConfig = Object.entries(serverConfig.customUserVars).map(([key, value]) => ({
-          authField: key,
-          label: value.title || key,
-          description: value.description || '',
-        }));
-        toolToAdd.authenticated = false;
-      }
-
-      toolsOutput.push(toolToAdd);
-    }
-
-    const finalTools = filterUniquePlugins(toolsOutput);
-    await cache.set(CacheKeys.TOOLS, finalTools);
-    res.status(200).json(finalTools);
+    await cache.set(CacheKeys.TOOLS, tools);
+    res.status(200).json(tools);
   } catch (error) {
-    logger.error('[getAvailableTools]', error);
     res.status(500).json({ message: error.message });
   }
 };

api/server/controllers/TwoFactorController.js

@@ -1,4 +1,3 @@
-const { encryptV3 } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const {
   verifyTOTP,
@@ -8,6 +7,7 @@ const {
   generateBackupCodes,
 } = require('~/server/services/twoFactorService');
 const { getUserById, updateUser } = require('~/models');
+const { encryptV3 } = require('~/server/utils/crypto');
 
 const safeAppTitle = (process.env.APP_TITLE || 'LibreChat').replace(/\s+/g, '');
 

api/server/controllers/UserController.js

@@ -1,6 +1,5 @@
 const {
   Tools,
-  Constants,
   FileSources,
   webSearchKeys,
   extractWebSearchEnvVars,
@@ -18,13 +17,12 @@ const {
 } = require('~/models');
 const { updateUserPluginAuth, deleteUserPluginAuth } = require('~/server/services/PluginService');
 const { updateUserPluginsService, deleteUserKey } = require('~/server/services/UserService');
-const { verifyEmail, resendVerificationEmail } = require('~/server/services/AuthService');
+const { verifyEmail, resendVerificationEmail } = require('@librechat/auth');
 const { needsRefresh, getNewS3URL } = require('~/server/services/Files/S3/crud');
 const { processDeleteRequest } = require('~/server/services/Files/process');
 const { Transaction, Balance, User } = require('~/db/models');
+const { deleteAllSharedLinks } = require('~/models/Share');
 const { deleteToolCalls } = require('~/models/ToolCall');
-const { deleteAllSharedLinks } = require('~/models');
-const { getMCPManager } = require('~/config');
 
 const getUserController = async (req, res) => {
   /** @type {MongoUser} */
@@ -104,22 +102,10 @@ const updateUserPluginsController = async (req, res) => {
     }
 
     let keys = Object.keys(auth);
-    const values = Object.values(auth); // Used in 'install' block
-
-    const isMCPTool = pluginKey.startsWith('mcp_') || pluginKey.includes(Constants.mcp_delimiter);
-
-    // Early exit condition:
-    // If keys are empty (meaning auth: {} was likely sent for uninstall, or auth was empty for install)
-    // AND it's not web_search (which has special key handling to populate `keys` for uninstall)
-    // AND it's NOT (an uninstall action FOR an MCP tool - we need to proceed for this case to clear all its auth)
-    // THEN return.
-    if (
-      keys.length === 0 &&
-      pluginKey !== Tools.web_search &&
-      !(action === 'uninstall' && isMCPTool)
-    ) {
+    if (keys.length === 0 && pluginKey !== Tools.web_search) {
       return res.status(200).send();
     }
+    const values = Object.values(auth);
 
     /** @type {number} */
     let status = 200;
@@ -146,53 +132,16 @@ const updateUserPluginsController = async (req, res) => {
         }
       }
     } else if (action === 'uninstall') {
-      // const isMCPTool was defined earlier
-      if (isMCPTool && keys.length === 0) {
-        // This handles the case where auth: {} is sent for an MCP tool uninstall.
-        // It means "delete all credentials associated with this MCP pluginKey".
-        authService = await deleteUserPluginAuth(user.id, null, true, pluginKey);
+      for (let i = 0; i < keys.length; i++) {
+        authService = await deleteUserPluginAuth(user.id, keys[i]);
         if (authService instanceof Error) {
-          logger.error(
-            `[authService] Error deleting all auth for MCP tool ${pluginKey}:`,
-            authService,
-          );
+          logger.error('[authService]', authService);
           ({ status, message } = authService);
         }
-      } else {
-        // This handles:
-        // 1. Web_search uninstall (keys will be populated with all webSearchKeys if auth was {}).
-        // 2. Other tools uninstall (if keys were provided).
-        // 3. MCP tool uninstall if specific keys were provided in `auth` (not current frontend behavior).
-        // If keys is empty for non-MCP tools (and not web_search), this loop won't run, and nothing is deleted.
-        for (let i = 0; i < keys.length; i++) {
-          authService = await deleteUserPluginAuth(user.id, keys[i]); // Deletes by authField name
-          if (authService instanceof Error) {
-            logger.error('[authService] Error deleting specific auth key:', authService);
-            ({ status, message } = authService);
-          }
-        }
       }
     }
 
     if (status === 200) {
-      // If auth was updated successfully, disconnect MCP sessions as they might use these credentials
-      if (pluginKey.startsWith(Constants.mcp_prefix)) {
-        try {
-          const mcpManager = getMCPManager(user.id);
-          if (mcpManager) {
-            logger.info(
-              `[updateUserPluginsController] Disconnecting MCP connections for user ${user.id} after plugin auth update for ${pluginKey}.`,
-            );
-            await mcpManager.disconnectUserConnections(user.id);
-          }
-        } catch (disconnectError) {
-          logger.error(
-            `[updateUserPluginsController] Error disconnecting MCP connections for user ${user.id} after plugin auth update:`,
-            disconnectError,
-          );
-          // Do not fail the request for this, but log it.
-        }
-      }
       return res.status(status).send();
     }
 

api/server/controllers/agents/client.js

@@ -31,15 +31,11 @@ const {
 } = require('librechat-data-provider');
 const { DynamicStructuredTool } = require('@langchain/core/tools');
 const { getBufferString, HumanMessage } = require('@langchain/core/messages');
-const {
-  getCustomEndpointConfig,
-  createGetMCPAuthMap,
-  checkCapability,
-} = require('~/server/services/Config');
+const { getCustomEndpointConfig, checkCapability } = require('~/server/services/Config');
 const { addCacheControl, createContextHandlers } = require('~/app/clients/prompts');
 const { initializeAgent } = require('~/server/services/Endpoints/agents/agent');
 const { spendTokens, spendStructuredTokens } = require('~/models/spendTokens');
-const { getFormattedMemories, deleteMemory, setMemory } = require('~/models');
+const { setMemory, deleteMemory, getFormattedMemories } = require('~/models');
 const { encodeAndFormat } = require('~/server/services/Files/images/encode');
 const initOpenAI = require('~/server/services/Endpoints/openAI/initialize');
 const { checkAccess } = require('~/server/middleware/roles/access');
@@ -683,8 +679,6 @@ class AgentClient extends BaseClient {
         version: 'v2',
       };
 
-      const getUserMCPAuthMap = await createGetMCPAuthMap();
-
       const toolSet = new Set((this.options.agent.tools ?? []).map((tool) => tool && tool.name));
       let { messages: initialMessages, indexTokenCountMap } = formatAgentMessages(
         payload,
@@ -804,20 +798,6 @@ class AgentClient extends BaseClient {
           run.Graph.contentData = contentData;
         }
 
-        try {
-          if (getUserMCPAuthMap) {
-            config.configurable.userMCPAuthMap = await getUserMCPAuthMap({
-              tools: agent.tools,
-              userId: this.options.req.user.id,
-            });
-          }
-        } catch (err) {
-          logger.error(
-            `[api/server/controllers/agents/client.js #chatCompletion] Error getting custom user vars for agent ${agent.id}`,
-            err,
-          );
-        }
-
         await run.processStream({ messages }, config, {
           keepContent: i !== 0,
           tokenCounter: createTokenCounter(this.getEncoding()),

api/server/controllers/agents/v1.js

@@ -1,10 +1,11 @@
 const fs = require('fs').promises;
 const { nanoid } = require('nanoid');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
 const {
   Tools,
-  SystemRoles,
+  Constants,
+  FileContext,
   FileSources,
+  SystemRoles,
   EToolResources,
   actionDelimiter,
 } = require('librechat-data-provider');
@@ -13,26 +14,18 @@ const {
   createAgent,
   updateAgent,
   deleteAgent,
-  getListAgentsByAccess,
-  countPromotedAgents,
-  updateAgentProjects,
-  revertAgentVersion,
+  getListAgents,
 } = require('~/models/Agent');
-const {
-  grantPermission,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-} = require('~/server/services/PermissionService');
+const { uploadImageBuffer, filterFile } = require('~/server/services/Files/process');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
-const { resizeAvatar } = require('~/server/services/Files/images/avatar');
+const { resizeAvatar } = require('@librechat/auth');
 const { refreshS3Url } = require('~/server/services/Files/S3/crud');
-const { filterFile } = require('~/server/services/Files/process');
 const { updateAction, getActions } = require('~/models/Action');
-const { getCachedTools } = require('~/server/services/Config');
-const { revertAgentVersion } = require('~/models/Agent');
+const { updateAgentProjects } = require('~/models/Agent');
+const { getProjectByName } = require('~/models/Project');
 const { deleteFileByFilter } = require('~/models/File');
-const { getCategoriesWithCounts } = require('~/models');
+const { revertAgentVersion } = require('~/models/Agent');
+const { logger } = require('~/config');
 
 const systemTools = {
   [Tools.execute_code]: true,
@@ -54,9 +47,8 @@ const createAgentHandler = async (req, res) => {
 
     agentData.tools = [];
 
-    const availableTools = await getCachedTools({ includeGlobal: true });
     for (const tool of tools) {
-      if (availableTools[tool]) {
+      if (req.app.locals.availableTools[tool]) {
         agentData.tools.push(tool);
       }
 
@@ -76,27 +68,6 @@ const createAgentHandler = async (req, res) => {
 
     agentData.id = `agent_${nanoid()}`;
     const agent = await createAgent(agentData);
-
-    // Automatically grant owner permissions to the creator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[createAgent] Granted owner permissions to user ${userId} for agent ${agent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[createAgent] Failed to grant owner permissions for agent ${agent.id}:`,
-        permissionError,
-      );
-    }
-
     res.status(201).json(agent);
   } catch (error) {
     logger.error('[/Agents] Error creating agent', error);
@@ -115,14 +86,21 @@ const createAgentHandler = async (req, res) => {
  * @returns {Promise<Agent>} 200 - success response - application/json
  * @returns {Error} 404 - Agent not found
  */
-const getAgentHandler = async (req, res, expandProperties = false) => {
+const getAgentHandler = async (req, res) => {
   try {
     const id = req.params.id;
     const author = req.user.id;
 
-    // Permissions are validated by middleware before calling this function
-    // Simply load the agent by ID
-    const agent = await getAgent({ id });
+    let query = { id, author };
+
+    const globalProject = await getProjectByName(Constants.GLOBAL_PROJECT_NAME, ['agentIds']);
+    if (globalProject && (globalProject.agentIds?.length ?? 0) > 0) {
+      query = {
+        $or: [{ id, $in: globalProject.agentIds }, query],
+      };
+    }
+
+    const agent = await getAgent(query);
 
     if (!agent) {
       return res.status(404).json({ error: 'Agent not found' });
@@ -139,45 +117,23 @@ const getAgentHandler = async (req, res, expandProperties = false) => {
     }
 
     agent.author = agent.author.toString();
-
-    // @deprecated - isCollaborative replaced by ACL permissions
     agent.isCollaborative = !!agent.isCollaborative;
 
-    // Check if agent is public
-    const isPublic = await hasPublicPermission({
-      resourceType: 'agent',
-      resourceId: agent._id,
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    agent.isPublic = isPublic;
-
     if (agent.author !== author) {
       delete agent.author;
     }
 
-    if (!expandProperties) {
-      // VIEW permission: Basic agent info only
+    if (!agent.isCollaborative && agent.author !== author && req.user.role !== SystemRoles.ADMIN) {
       return res.status(200).json({
-        _id: agent._id,
         id: agent.id,
         name: agent.name,
-        description: agent.description,
         avatar: agent.avatar,
         author: agent.author,
-        provider: agent.provider,
-        model: agent.model,
         projectIds: agent.projectIds,
-        // @deprecated - isCollaborative replaced by ACL permissions
         isCollaborative: agent.isCollaborative,
-        isPublic: agent.isPublic,
         version: agent.version,
-        // Safe metadata
-        createdAt: agent.createdAt,
-        updatedAt: agent.updatedAt,
       });
     }
-
-    // EDIT permission: Full agent details including sensitive configuration
     return res.status(200).json(agent);
   } catch (error) {
     logger.error('[/Agents/:id] Error retrieving agent', error);
@@ -197,20 +153,42 @@ const getAgentHandler = async (req, res, expandProperties = false) => {
 const updateAgentHandler = async (req, res) => {
   try {
     const id = req.params.id;
-    const { _id, ...updateData } = req.body;
+    const { projectIds, removeProjectIds, ...updateData } = req.body;
+    const isAdmin = req.user.role === SystemRoles.ADMIN;
     const existingAgent = await getAgent({ id });
+    const isAuthor = existingAgent.author.toString() === req.user.id;
 
     if (!existingAgent) {
       return res.status(404).json({ error: 'Agent not found' });
     }
+    const hasEditPermission = existingAgent.isCollaborative || isAdmin || isAuthor;
+
+    if (!hasEditPermission) {
+      return res.status(403).json({
+        error: 'You do not have permission to modify this non-collaborative agent',
+      });
+    }
+
+    /** @type {boolean} */
+    const isProjectUpdate = (projectIds?.length ?? 0) > 0 || (removeProjectIds?.length ?? 0) > 0;
 
     let updatedAgent =
       Object.keys(updateData).length > 0
         ? await updateAgent({ id }, updateData, {
             updatingUserId: req.user.id,
+            skipVersioning: isProjectUpdate,
           })
         : existingAgent;
 
+    if (isProjectUpdate) {
+      updatedAgent = await updateAgentProjects({
+        user: req.user,
+        agentId: id,
+        projectIds,
+        removeProjectIds,
+      });
+    }
+
     if (updatedAgent.author) {
       updatedAgent.author = updatedAgent.author.toString();
     }
@@ -328,26 +306,6 @@ const duplicateAgentHandler = async (req, res) => {
     newAgentData.actions = agentActions;
     const newAgent = await createAgent(newAgentData);
 
-    // Automatically grant owner permissions to the duplicator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: newAgent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[duplicateAgent] Granted owner permissions to user ${userId} for duplicated agent ${newAgent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[duplicateAgent] Failed to grant owner permissions for duplicated agent ${newAgent.id}:`,
-        permissionError,
-      );
-    }
-
     return res.status(201).json({
       agent: newAgent,
       actions: newActionsList,
@@ -374,7 +332,7 @@ const deleteAgentHandler = async (req, res) => {
     if (!agent) {
       return res.status(404).json({ error: 'Agent not found' });
     }
-    await deleteAgent({ id });
+    await deleteAgent({ id, author: req.user.id });
     return res.json({ message: 'Agent deleted' });
   } catch (error) {
     logger.error('[/Agents/:id] Error deleting Agent', error);
@@ -383,7 +341,7 @@ const deleteAgentHandler = async (req, res) => {
 };
 
 /**
- * Lists agents using ACL-aware permissions (ownership + explicit shares).
+ *
  * @route GET /Agents
  * @param {object} req - Express Request
  * @param {object} req.query - Request query
@@ -392,64 +350,9 @@ const deleteAgentHandler = async (req, res) => {
  */
 const getListAgentsHandler = async (req, res) => {
   try {
-    const userId = req.user.id;
-    const { category, search, limit, cursor, promoted } = req.query;
-    let requiredPermission = req.query.requiredPermission;
-    if (typeof requiredPermission === 'string') {
-      requiredPermission = parseInt(requiredPermission, 10);
-      if (isNaN(requiredPermission)) {
-        requiredPermission = PermissionBits.VIEW;
-      }
-    } else if (typeof requiredPermission !== 'number') {
-      requiredPermission = PermissionBits.VIEW;
-    }
-    // Base filter
-    const filter = {};
-
-    // Handle category filter - only apply if category is defined
-    if (category !== undefined && category.trim() !== '') {
-      filter.category = category;
-    }
-
-    // Handle promoted filter - only from query param
-    if (promoted === '1') {
-      filter.is_promoted = true;
-    } else if (promoted === '0') {
-      filter.is_promoted = { $ne: true };
-    }
-
-    // Handle search filter
-    if (search && search.trim() !== '') {
-      filter.$or = [
-        { name: { $regex: search.trim(), $options: 'i' } },
-        { description: { $regex: search.trim(), $options: 'i' } },
-      ];
-    }
-    // Get agent IDs the user has VIEW access to via ACL
-    const accessibleIds = await findAccessibleResources({
-      userId,
-      resourceType: 'agent',
-      requiredPermissions: requiredPermission,
+    const data = await getListAgents({
+      author: req.user.id,
     });
-    const publiclyAccessibleIds = await findPubliclyAccessibleResources({
-      resourceType: 'agent',
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    // Use the new ACL-aware function
-    const data = await getListAgentsByAccess({
-      accessibleIds,
-      otherParams: filter,
-      limit,
-      after: cursor,
-    });
-    if (data?.data?.length) {
-      data.data = data.data.map((agent) => {
-        if (publiclyAccessibleIds.some((id) => id.equals(agent._id))) {
-          agent.isPublic = true;
-        }
-        return agent;
-      });
-    }
     return res.json(data);
   } catch (error) {
     logger.error('[/Agents] Error listing Agents', error);
@@ -527,7 +430,7 @@ const uploadAgentAvatarHandler = async (req, res) => {
     };
 
     promises.push(
-      await updateAgent({ id: agent_id }, data, {
+      await updateAgent({ id: agent_id, author: req.user.id }, data, {
         updatingUserId: req.user.id,
       }),
     );
@@ -542,7 +445,7 @@ const uploadAgentAvatarHandler = async (req, res) => {
     try {
       await fs.unlink(req.file.path);
       logger.debug('[/:agent_id/avatar] Temp. image upload file deleted');
-    } catch {
+    } catch (error) {
       logger.debug('[/:agent_id/avatar] Temp. image upload file already deleted');
     }
   }
@@ -607,48 +510,7 @@ const revertAgentVersionHandler = async (req, res) => {
     res.status(500).json({ error: error.message });
   }
 };
-/**
- * Get all agent categories with counts
- *
- * @param {Object} _req - Express request object (unused)
- * @param {Object} res - Express response object
- */
-const getAgentCategories = async (_req, res) => {
-  try {
-    const categories = await getCategoriesWithCounts();
-    const promotedCount = await countPromotedAgents();
-    const formattedCategories = categories.map((category) => ({
-      value: category.value,
-      label: category.label,
-      count: category.agentCount,
-      description: category.description,
-    }));
 
-    if (promotedCount > 0) {
-      formattedCategories.unshift({
-        value: 'promoted',
-        label: 'Promoted',
-        count: promotedCount,
-        description: 'Our recommended agents',
-      });
-    }
-
-    formattedCategories.push({
-      value: 'all',
-      label: 'All',
-      description: 'All available agents',
-    });
-
-    res.status(200).json(formattedCategories);
-  } catch (error) {
-    logger.error('[/Agents/Marketplace] Error fetching agent categories:', error);
-    res.status(500).json({
-      error: 'Failed to fetch agent categories',
-      userMessage: 'Unable to load categories. Please refresh the page.',
-      suggestion: 'Try refreshing the page or check your network connection',
-    });
-  }
-};
 module.exports = {
   createAgent: createAgentHandler,
   getAgent: getAgentHandler,
@@ -658,5 +520,4 @@ module.exports = {
   getListAgents: getListAgentsHandler,
   uploadAgentAvatar: uploadAgentAvatarHandler,
   revertAgentVersion: revertAgentVersionHandler,
-  getAgentCategories,
 };

api/server/controllers/assistants/v1.js

@@ -1,5 +1,4 @@
 const fs = require('fs').promises;
-const { logger } = require('@librechat/data-schemas');
 const { FileContext } = require('librechat-data-provider');
 const { uploadImageBuffer, filterFile } = require('~/server/services/Files/process');
 const validateAuthor = require('~/server/middleware/assistants/validateAuthor');
@@ -7,9 +6,9 @@ const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { deleteAssistantActions } = require('~/server/services/ActionService');
 const { updateAssistantDoc, getAssistants } = require('~/models/Assistant');
 const { getOpenAIClient, fetchAssistants } = require('./helpers');
-const { getCachedTools } = require('~/server/services/Config');
 const { manifestToolMap } = require('~/app/clients/tools');
 const { deleteFileByFilter } = require('~/models/File');
+const { logger } = require('~/config');
 
 /**
  * Create an assistant.
@@ -31,20 +30,21 @@ const createAssistant = async (req, res) => {
     delete assistantData.conversation_starters;
     delete assistantData.append_current_datetime;
 
-    const toolDefinitions = await getCachedTools({ includeGlobal: true });
-
     assistantData.tools = tools
       .map((tool) => {
         if (typeof tool !== 'string') {
           return tool;
         }
 
+        const toolDefinitions = req.app.locals.availableTools;
         const toolDef = toolDefinitions[tool];
         if (!toolDef && manifestToolMap[tool] && manifestToolMap[tool].toolkit === true) {
-          return Object.entries(toolDefinitions)
-            .filter(([key]) => key.startsWith(`${tool}_`))
-
-            .map(([_, val]) => val);
+          return (
+            Object.entries(toolDefinitions)
+              .filter(([key]) => key.startsWith(`${tool}_`))
+              // eslint-disable-next-line no-unused-vars
+              .map(([_, val]) => val)
+          );
         }
 
         return toolDef;
@@ -135,21 +135,21 @@ const patchAssistant = async (req, res) => {
       append_current_datetime,
       ...updateData
     } = req.body;
-
-    const toolDefinitions = await getCachedTools({ includeGlobal: true });
-
     updateData.tools = (updateData.tools ?? [])
       .map((tool) => {
         if (typeof tool !== 'string') {
           return tool;
         }
 
+        const toolDefinitions = req.app.locals.availableTools;
         const toolDef = toolDefinitions[tool];
         if (!toolDef && manifestToolMap[tool] && manifestToolMap[tool].toolkit === true) {
-          return Object.entries(toolDefinitions)
-            .filter(([key]) => key.startsWith(`${tool}_`))
-
-            .map(([_, val]) => val);
+          return (
+            Object.entries(toolDefinitions)
+              .filter(([key]) => key.startsWith(`${tool}_`))
+              // eslint-disable-next-line no-unused-vars
+              .map(([_, val]) => val)
+          );
         }
 
         return toolDef;

api/server/controllers/assistants/v2.js

@@ -1,11 +1,10 @@
-const { logger } = require('@librechat/data-schemas');
 const { ToolCallTypes } = require('librechat-data-provider');
 const validateAuthor = require('~/server/middleware/assistants/validateAuthor');
 const { validateAndUpdateTool } = require('~/server/services/ActionService');
-const { getCachedTools } = require('~/server/services/Config');
 const { updateAssistantDoc } = require('~/models/Assistant');
 const { manifestToolMap } = require('~/app/clients/tools');
 const { getOpenAIClient } = require('./helpers');
+const { logger } = require('~/config');
 
 /**
  * Create an assistant.
@@ -28,20 +27,21 @@ const createAssistant = async (req, res) => {
     delete assistantData.conversation_starters;
     delete assistantData.append_current_datetime;
 
-    const toolDefinitions = await getCachedTools({ includeGlobal: true });
-
     assistantData.tools = tools
       .map((tool) => {
         if (typeof tool !== 'string') {
           return tool;
         }
 
+        const toolDefinitions = req.app.locals.availableTools;
         const toolDef = toolDefinitions[tool];
         if (!toolDef && manifestToolMap[tool] && manifestToolMap[tool].toolkit === true) {
-          return Object.entries(toolDefinitions)
-            .filter(([key]) => key.startsWith(`${tool}_`))
-
-            .map(([_, val]) => val);
+          return (
+            Object.entries(toolDefinitions)
+              .filter(([key]) => key.startsWith(`${tool}_`))
+              // eslint-disable-next-line no-unused-vars
+              .map(([_, val]) => val)
+          );
         }
 
         return toolDef;
@@ -125,13 +125,13 @@ const updateAssistant = async ({ req, openai, assistant_id, updateData }) => {
 
   let hasFileSearch = false;
   for (const tool of updateData.tools ?? []) {
-    const toolDefinitions = await getCachedTools({ includeGlobal: true });
+    const toolDefinitions = req.app.locals.availableTools;
     let actualTool = typeof tool === 'string' ? toolDefinitions[tool] : tool;
 
     if (!actualTool && manifestToolMap[tool] && manifestToolMap[tool].toolkit === true) {
       actualTool = Object.entries(toolDefinitions)
         .filter(([key]) => key.startsWith(`${tool}_`))
-
+        // eslint-disable-next-line no-unused-vars
         .map(([_, val]) => val);
     } else if (!actualTool) {
       continue;

api/server/controllers/auth/LoginController.js

@@ -1,5 +1,5 @@
 const { generate2FATempToken } = require('~/server/services/twoFactorService');
-const { setAuthTokens } = require('~/server/services/AuthService');
+const { setAuthTokens } = require('@librechat/auth');
 const { logger } = require('~/config');
 
 const loginController = async (req, res) => {

api/server/controllers/auth/LogoutController.js

@@ -1,6 +1,6 @@
 const cookies = require('cookie');
-const { getOpenIdConfig } = require('~/strategies');
-const { logoutUser } = require('~/server/services/AuthService');
+const { getOpenIdConfig } = require('@librechat/auth');
+const { logoutUser } = require('@librechat/auth');
 const { isEnabled } = require('~/server/utils');
 const { logger } = require('~/config');
 

api/server/controllers/auth/TwoFactorAuthController.js

@@ -5,7 +5,7 @@ const {
   getTOTPSecret,
   verifyBackupCode,
 } = require('~/server/services/twoFactorService');
-const { setAuthTokens } = require('~/server/services/AuthService');
+const { setAuthTokens } = require('@librechat/auth');
 const { getUserById } = require('~/models');
 
 /**

api/server/index.js

@@ -1,27 +1,29 @@
 require('dotenv').config();
-const fs = require('fs');
 const path = require('path');
 require('module-alias')({ base: path.resolve(__dirname, '..') });
 const cors = require('cors');
 const axios = require('axios');
 const express = require('express');
-const passport = require('passport');
 const compression = require('compression');
-const cookieParser = require('cookie-parser');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
+const passport = require('passport');
 const mongoSanitize = require('express-mongo-sanitize');
+const fs = require('fs');
+const cookieParser = require('cookie-parser');
 const { connectDb, indexSync } = require('~/db');
 
+const { initAuth, passportLogin, ldapLogin, jwtLogin } = require('@librechat/auth');
+const { isEnabled } = require('~/server/utils');
+const { logger } = require('~/config');
 const validateImageRequest = require('./middleware/validateImageRequest');
-const { jwtLogin, ldapLogin, passportLogin } = require('~/strategies');
 const errorController = require('./controllers/ErrorController');
-const initializeMCP = require('./services/initializeMCP');
 const configureSocialLogins = require('./socialLogins');
 const AppService = require('./services/AppService');
 const staticCache = require('./utils/staticCache');
 const noIndex = require('./middleware/noIndex');
 const routes = require('./routes');
+const { getBalanceConfig } = require('./services/Config');
+const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { FileSources } = require('librechat-data-provider');
 
 const { PORT, HOST, ALLOW_SOCIAL_LOGIN, DISABLE_COMPRESSION, TRUST_PROXY } = process.env ?? {};
 
@@ -36,12 +38,15 @@ const startServer = async () => {
   if (typeof Bun !== 'undefined') {
     axios.defaults.headers.common['Accept-Encoding'] = 'gzip';
   }
-  await connectDb();
+  const mongooseInstance = await connectDb();
+
+  const balanceConfig = await getBalanceConfig();
+  const { saveBuffer } = getStrategyFunctions(process.env.CDN_PROVIDER ?? FileSources.local);
+  // initialize the auth package
+  initAuth(mongooseInstance, balanceConfig, saveBuffer);
 
   logger.info('Connected to MongoDB');
-  indexSync().catch((err) => {
-    logger.error('[indexSync] Background sync failed:', err);
-  });
+  await indexSync();
 
   app.disable('x-powered-by');
   app.set('trust proxy', trusted_proxy);
@@ -97,6 +102,7 @@ const startServer = async () => {
   app.use('/api/actions', routes.actions);
   app.use('/api/keys', routes.keys);
   app.use('/api/user', routes.user);
+  app.use('/api/ask', routes.ask);
   app.use('/api/search', routes.search);
   app.use('/api/edit', routes.edit);
   app.use('/api/messages', routes.messages);
@@ -117,11 +123,9 @@ const startServer = async () => {
   app.use('/api/roles', routes.roles);
   app.use('/api/agents', routes.agents);
   app.use('/api/banner', routes.banner);
+  app.use('/api/bedrock', routes.bedrock);
   app.use('/api/memories', routes.memories);
-  app.use('/api/permissions', routes.accessPermissions);
-
   app.use('/api/tags', routes.tags);
-  app.use('/api/mcp', routes.mcp);
 
   app.use((req, res) => {
     res.set({
@@ -145,8 +149,6 @@ const startServer = async () => {
     } else {
       logger.info(`Server listening at http://${host == '0.0.0.0' ? 'localhost' : host}:${port}`);
     }
-
-    initializeMCP(app);
   });
 };
 
@@ -189,5 +191,5 @@ process.on('uncaughtException', (err) => {
   process.exit(1);
 });
 
-/** Export app for easier testing purposes */
+// export app for easier testing purposes
 module.exports = app;

api/server/middleware/accessResources/canAccessAgentFromBody.js

@@ -1,97 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { Constants, isAgentsEndpoint } = require('librechat-data-provider');
-const { canAccessResource } = require('./canAccessResource');
-const { getAgent } = require('~/models/Agent');
-
-/**
- * Agent ID resolver function for agent_id from request body
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- * This is used specifically for chat routes where agent_id comes from request body
- *
- * @param {string} agentCustomId - Custom agent ID from request body
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentIdFromBody = async (agentCustomId) => {
-  // Handle ephemeral agents - they don't need permission checks
-  if (agentCustomId === Constants.EPHEMERAL_AGENT_ID) {
-    return null; // No permission check needed for ephemeral agents
-  }
-
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Middleware factory that creates middleware to check agent access permissions from request body.
- * This middleware is specifically designed for chat routes where the agent_id comes from req.body
- * instead of route parameters.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for agent chat (requires VIEW permission)
- * router.post('/chat',
- *   canAccessAgentFromBody({ requiredPermission: PermissionBits.VIEW }),
- *   buildEndpointOption,
- *   chatController
- * );
- */
-const canAccessAgentFromBody = (options) => {
-  const { requiredPermission } = options;
-
-  // Validate required options
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentFromBody: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      const { endpoint, agent_id } = req.body;
-      let agentId = agent_id;
-
-      if (!isAgentsEndpoint(endpoint)) {
-        agentId = Constants.EPHEMERAL_AGENT_ID;
-      }
-
-      if (!agentId) {
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: 'agent_id is required in request body',
-        });
-      }
-
-      // Skip permission checks for ephemeral agents
-      if (agentId === Constants.EPHEMERAL_AGENT_ID) {
-        return next();
-      }
-
-      const agentAccessMiddleware = canAccessResource({
-        resourceType: 'agent',
-        requiredPermission,
-        resourceIdParam: 'agent_id', // This will be ignored since we use custom resolver
-        idResolver: () => resolveAgentIdFromBody(agentId),
-      });
-
-      const tempReq = {
-        ...req,
-        params: {
-          ...req.params,
-          agent_id: agentId,
-        },
-      };
-
-      return agentAccessMiddleware(tempReq, res, next);
-    } catch (error) {
-      logger.error('Failed to validate agent access permissions', error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to validate agent access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessAgentFromBody,
-};

api/server/middleware/accessResources/canAccessAgentResource.js

@@ -1,58 +0,0 @@
-const { getAgent } = require('~/models/Agent');
-const { canAccessResource } = require('./canAccessResource');
-
-/**
- * Agent ID resolver function
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- *
- * @param {string} agentCustomId - Custom agent ID from route parameter
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentId = async (agentCustomId) => {
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Agent-specific middleware factory that creates middleware to check agent access permissions.
- * This middleware extends the generic canAccessResource to handle agent custom ID resolution.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='id'] - The name of the route parameter containing the agent custom ID
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for viewing agents
- * router.get('/agents/:id',
- *   canAccessAgentResource({ requiredPermission: 1 }),
- *   getAgent
- * );
- *
- * @example
- * // Custom resource ID parameter and edit permission
- * router.patch('/agents/:agent_id',
- *   canAccessAgentResource({
- *     requiredPermission: 2,
- *     resourceIdParam: 'agent_id'
- *   }),
- *   updateAgent
- * );
- */
-const canAccessAgentResource = (options) => {
-  const { requiredPermission, resourceIdParam = 'id' } = options;
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentResource: requiredPermission is required and must be a number');
-  }
-
-  return canAccessResource({
-    resourceType: 'agent',
-    requiredPermission,
-    resourceIdParam,
-    idResolver: resolveAgentId,
-  });
-};
-
-module.exports = {
-  canAccessAgentResource,
-};

api/server/middleware/accessResources/canAccessAgentResource.spec.js

@@ -1,384 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { User, Role, AclEntry } = require('~/db/models');
-const { createAgent } = require('~/models/Agent');
-
-describe('canAccessAgentResource middleware', () => {
-  let mongoServer;
-  let req, res, next;
-  let testUser;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-    await Role.create({
-      name: 'test-role',
-      permissions: {
-        AGENTS: {
-          USE: true,
-          CREATE: true,
-          SHARED_GLOBAL: false,
-        },
-      },
-    });
-
-    // Create a test user
-    testUser = await User.create({
-      email: 'test@example.com',
-      name: 'Test User',
-      username: 'testuser',
-      role: 'test-role',
-    });
-
-    req = {
-      user: { id: testUser._id.toString(), role: 'test-role' },
-      params: {},
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-
-    jest.clearAllMocks();
-  });
-
-  describe('middleware factory', () => {
-    test('should throw error if requiredPermission is not provided', () => {
-      expect(() => canAccessAgentResource({})).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should throw error if requiredPermission is not a number', () => {
-      expect(() => canAccessAgentResource({ requiredPermission: '1' })).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should create middleware with default resourceIdParam', () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3); // Express middleware signature
-    });
-
-    test('should create middleware with custom resourceIdParam', () => {
-      const middleware = canAccessAgentResource({
-        requiredPermission: 2,
-        resourceIdParam: 'agent_id',
-      });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3);
-    });
-  });
-
-  describe('permission checking with real agents', () => {
-    test('should allow access when user is the agent author', async () => {
-      // Create an agent owned by the test user
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author (owner permissions)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when user is not the author and has no ACL entry', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other@example.com',
-        name: 'Other User',
-        username: 'otheruser',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Other User Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry for the other user (owner)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: otherUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should allow access when user has ACL entry with sufficient permissions', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other2@example.com',
-        name: 'Other User 2',
-        username: 'otheruser2',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Shared Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting view permission to test user
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when ACL permissions are insufficient', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other3@example.com',
-        name: 'Other User 3',
-        username: 'otheruser3',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Limited Access Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting only view permission
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission only
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 2 }); // EDIT permission required
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should handle non-existent agent', async () => {
-      req.params.id = 'agent_nonexistent';
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(404);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Not Found',
-        message: 'agent not found',
-      });
-    });
-
-    test('should use custom resourceIdParam', async () => {
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Custom Param Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.agent_id = agent.id; // Using custom param name
-
-      const middleware = canAccessAgentResource({
-        requiredPermission: 1,
-        resourceIdParam: 'agent_id',
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('permission levels', () => {
-    let agent;
-
-    beforeEach(async () => {
-      agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Permission Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry with all permissions for the owner
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-    });
-
-    test('should support view permission (1)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support edit permission (2)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 2 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support delete permission (4)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 4 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support share permission (8)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 8 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support combined permissions', async () => {
-      const viewAndEdit = 1 | 2; // 3
-      const middleware = canAccessAgentResource({ requiredPermission: viewAndEdit });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-
-  describe('integration with agent operations', () => {
-    test('should work with agent CRUD operations', async () => {
-      const agentId = `agent_${Date.now()}`;
-
-      // Create agent
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Integration Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-        description: 'Testing integration',
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agentId;
-
-      // Test view access
-      const viewMiddleware = canAccessAgentResource({ requiredPermission: 1 });
-      await viewMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-      jest.clearAllMocks();
-
-      // Update the agent
-      const { updateAgent } = require('~/models/Agent');
-      await updateAgent({ id: agentId }, { description: 'Updated description' });
-
-      // Test edit access
-      const editMiddleware = canAccessAgentResource({ requiredPermission: 2 });
-      await editMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-});

api/server/middleware/accessResources/canAccessResource.js

@@ -1,157 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { SystemRoles } = require('librechat-data-provider');
-const { checkPermission } = require('~/server/services/PermissionService');
-
-/**
- * Generic base middleware factory that creates middleware to check resource access permissions.
- * This middleware expects MongoDB ObjectIds as resource identifiers for ACL permission checks.
- *
- * @param {Object} options - Configuration options
- * @param {string} options.resourceType - The type of resource (e.g., 'agent', 'file', 'project')
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='resourceId'] - The name of the route parameter containing the resource ID
- * @param {Function} [options.idResolver] - Optional function to resolve custom IDs to ObjectIds
- * @returns {Function} Express middleware function
- *
- * @example
- * // Direct usage with ObjectId (for resources that use MongoDB ObjectId in routes)
- * router.get('/prompts/:promptId',
- *   canAccessResource({ resourceType: 'prompt', requiredPermission: 1 }),
- *   getPrompt
- * );
- *
- * @example
- * // Usage with custom ID resolver (for resources that use custom string IDs)
- * router.get('/agents/:id',
- *   canAccessResource({
- *     resourceType: 'agent',
- *     requiredPermission: 1,
- *     resourceIdParam: 'id',
- *     idResolver: (customId) => resolveAgentId(customId)
- *   }),
- *   getAgent
- * );
- */
-const canAccessResource = (options) => {
-  const {
-    resourceType,
-    requiredPermission,
-    resourceIdParam = 'resourceId',
-    idResolver = null,
-  } = options;
-
-  if (!resourceType || typeof resourceType !== 'string') {
-    throw new Error('canAccessResource: resourceType is required and must be a string');
-  }
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessResource: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      // Extract resource ID from route parameters
-      const rawResourceId = req.params[resourceIdParam];
-
-      if (!rawResourceId) {
-        logger.warn(`[canAccessResource] Missing ${resourceIdParam} in route parameters`);
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: `${resourceIdParam} is required`,
-        });
-      }
-
-      // Check if user is authenticated
-      if (!req.user || !req.user.id) {
-        logger.warn(
-          `[canAccessResource] Unauthenticated request for ${resourceType} ${rawResourceId}`,
-        );
-        return res.status(401).json({
-          error: 'Unauthorized',
-          message: 'Authentication required',
-        });
-      }
-      // if system admin let through
-      if (req.user.role === SystemRoles.ADMIN) {
-        return next();
-      }
-      const userId = req.user.id;
-      let resourceId = rawResourceId;
-      let resourceInfo = null;
-
-      // Resolve custom ID to ObjectId if resolver is provided
-      if (idResolver) {
-        logger.debug(
-          `[canAccessResource] Resolving ${resourceType} custom ID ${rawResourceId} to ObjectId`,
-        );
-
-        const resolutionResult = await idResolver(rawResourceId);
-
-        if (!resolutionResult) {
-          logger.warn(`[canAccessResource] ${resourceType} not found: ${rawResourceId}`);
-          return res.status(404).json({
-            error: 'Not Found',
-            message: `${resourceType} not found`,
-          });
-        }
-
-        // Handle different resolver return formats
-        if (typeof resolutionResult === 'string' || resolutionResult._id) {
-          resourceId = resolutionResult._id || resolutionResult;
-          resourceInfo = typeof resolutionResult === 'object' ? resolutionResult : null;
-        } else {
-          resourceId = resolutionResult;
-        }
-
-        logger.debug(
-          `[canAccessResource] Resolved ${resourceType} ${rawResourceId} to ObjectId ${resourceId}`,
-        );
-      }
-
-      // Check permissions using PermissionService with ObjectId
-      const hasPermission = await checkPermission({
-        userId,
-        resourceType,
-        resourceId,
-        requiredPermission,
-      });
-
-      if (hasPermission) {
-        logger.debug(
-          `[canAccessResource] User ${userId} has permission ${requiredPermission} on ${resourceType} ${rawResourceId} (${resourceId})`,
-        );
-
-        req.resourceAccess = {
-          resourceType,
-          resourceId, // MongoDB ObjectId for ACL operations
-          customResourceId: rawResourceId, // Original ID from route params
-          permission: requiredPermission,
-          userId,
-          ...(resourceInfo && { resourceInfo }),
-        };
-
-        return next();
-      }
-
-      logger.warn(
-        `[canAccessResource] User ${userId} denied access to ${resourceType} ${rawResourceId} ` +
-          `(required permission: ${requiredPermission})`,
-      );
-
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: `Insufficient permissions to access this ${resourceType}`,
-      });
-    } catch (error) {
-      logger.error(`[canAccessResource] Error checking access for ${resourceType}:`, error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to check resource access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessResource,
-};

api/server/middleware/accessResources/index.js

@@ -1,9 +0,0 @@
-const { canAccessResource } = require('./canAccessResource');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { canAccessAgentFromBody } = require('./canAccessAgentFromBody');
-
-module.exports = {
-  canAccessResource,
-  canAccessAgentResource,
-  canAccessAgentFromBody,
-};

api/server/middleware/buildEndpointOption.js

@@ -1,11 +1,11 @@
-const { logger } = require('@librechat/data-schemas');
 const {
-  EndpointURLs,
+  parseCompactConvo,
   EModelEndpoint,
   isAgentsEndpoint,
-  parseCompactConvo,
+  EndpointURLs,
 } = require('librechat-data-provider');
 const azureAssistants = require('~/server/services/Endpoints/azureAssistants');
+const { getModelsConfig } = require('~/server/controllers/ModelController');
 const assistants = require('~/server/services/Endpoints/assistants');
 const gptPlugins = require('~/server/services/Endpoints/gptPlugins');
 const { processFiles } = require('~/server/services/Files/process');
@@ -36,9 +36,6 @@ async function buildEndpointOption(req, res, next) {
   try {
     parsedBody = parseCompactConvo({ endpoint, endpointType, conversation: req.body });
   } catch (error) {
-    logger.warn(
-      `Error parsing conversation for endpoint ${endpoint}${error?.message ? `: ${error.message}` : ''}`,
-    );
     return handleError(res, { text: 'Error parsing conversation' });
   }
 
@@ -80,7 +77,6 @@ async function buildEndpointOption(req, res, next) {
         conversation: currentModelSpec.preset,
       });
     } catch (error) {
-      logger.error(`Error parsing model spec for endpoint ${endpoint}`, error);
       return handleError(res, { text: 'Error parsing model spec' });
     }
   }
@@ -88,23 +84,20 @@ async function buildEndpointOption(req, res, next) {
   try {
     const isAgents =
       isAgentsEndpoint(endpoint) || req.baseUrl.startsWith(EndpointURLs[EModelEndpoint.agents]);
-    const builder = isAgents
-      ? (...args) => buildFunction[EModelEndpoint.agents](req, ...args)
-      : buildFunction[endpointType ?? endpoint];
+    const endpointFn = buildFunction[isAgents ? EModelEndpoint.agents : (endpointType ?? endpoint)];
+    const builder = isAgents ? (...args) => endpointFn(req, ...args) : endpointFn;
 
     // TODO: use object params
     req.body.endpointOption = await builder(endpoint, parsedBody, endpointType);
 
+    // TODO: use `getModelsConfig` only when necessary
+    const modelsConfig = await getModelsConfig(req);
+    req.body.endpointOption.modelsConfig = modelsConfig;
     if (req.body.files && !isAgents) {
       req.body.endpointOption.attachments = processFiles(req.body.files);
     }
-
     next();
   } catch (error) {
-    logger.error(
-      `Error building endpoint option for endpoint ${endpoint} with type ${endpointType}`,
-      error,
-    );
     return handleError(res, { text: 'Error building endpoint option' });
   }
 }

api/server/middleware/index.js

@@ -8,7 +8,6 @@ const concurrentLimiter = require('./concurrentLimiter');
 const validateEndpoint = require('./validateEndpoint');
 const requireLocalAuth = require('./requireLocalAuth');
 const canDeleteAccount = require('./canDeleteAccount');
-const accessResources = require('./accessResources');
 const setBalanceConfig = require('./setBalanceConfig');
 const requireLdapAuth = require('./requireLdapAuth');
 const abortMiddleware = require('./abortMiddleware');
@@ -30,7 +29,6 @@ module.exports = {
   ...validate,
   ...limiters,
   ...roles,
-  ...accessResources,
   noIndex,
   checkBan,
   uaParser,

api/server/middleware/roles/access.spec.js

@@ -1,251 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { checkAccess, generateCheckAccess } = require('./access');
-const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { Role } = require('~/db/models');
-
-// Mock only the logger
-jest.mock('~/config', () => ({
-  logger: {
-    warn: jest.fn(),
-    error: jest.fn(),
-  },
-}));
-
-describe('Access Middleware', () => {
-  let mongoServer;
-  let req, res, next;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-
-    // Create test roles
-    await Role.create({
-      name: 'user',
-      permissions: {
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: false,
-          [Permissions.SHARED_GLOBAL]: false,
-        },
-      },
-    });
-
-    await Role.create({
-      name: 'admin',
-      permissions: {
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.SHARED_GLOBAL]: true,
-        },
-      },
-    });
-
-    req = {
-      user: { id: 'user123', role: 'user' },
-      body: {},
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-    jest.clearAllMocks();
-  });
-
-  describe('checkAccess', () => {
-    test('should return false if user is not provided', async () => {
-      const result = await checkAccess(null, PermissionTypes.AGENTS, [Permissions.USE]);
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has required permission', async () => {
-      const result = await checkAccess(req.user, PermissionTypes.AGENTS, [Permissions.USE]);
-      expect(result).toBe(true);
-    });
-
-    test('should return false if user lacks required permission', async () => {
-      const result = await checkAccess(req.user, PermissionTypes.AGENTS, [Permissions.CREATE]);
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has any of multiple permissions', async () => {
-      const result = await checkAccess(req.user, PermissionTypes.AGENTS, [
-        Permissions.USE,
-        Permissions.CREATE,
-      ]);
-      expect(result).toBe(true);
-    });
-
-    test('should check body properties when permission is not directly granted', async () => {
-      // User role doesn't have CREATE permission, but bodyProps allows it
-      const bodyProps = {
-        [Permissions.CREATE]: ['agentId', 'name'],
-      };
-
-      const checkObject = { agentId: 'agent123' };
-
-      const result = await checkAccess(
-        req.user,
-        PermissionTypes.AGENTS,
-        [Permissions.CREATE],
-        bodyProps,
-        checkObject,
-      );
-      expect(result).toBe(true);
-    });
-
-    test('should return false if role is not found', async () => {
-      req.user.role = 'nonexistent';
-      const result = await checkAccess(req.user, PermissionTypes.AGENTS, [Permissions.USE]);
-      expect(result).toBe(false);
-    });
-
-    test('should return false if role has no permissions for the requested type', async () => {
-      await Role.create({
-        name: 'limited',
-        permissions: {
-          // Explicitly set AGENTS permissions to false
-          [PermissionTypes.AGENTS]: {
-            [Permissions.USE]: false,
-            [Permissions.CREATE]: false,
-            [Permissions.SHARED_GLOBAL]: false,
-          },
-          // Has permissions for other types
-          [PermissionTypes.PROMPTS]: {
-            [Permissions.USE]: true,
-          },
-        },
-      });
-      req.user.role = 'limited';
-
-      const result = await checkAccess(req.user, PermissionTypes.AGENTS, [Permissions.USE]);
-      expect(result).toBe(false);
-    });
-
-    test('should handle admin role with all permissions', async () => {
-      req.user.role = 'admin';
-
-      const createResult = await checkAccess(req.user, PermissionTypes.AGENTS, [
-        Permissions.CREATE,
-      ]);
-      expect(createResult).toBe(true);
-
-      const shareResult = await checkAccess(req.user, PermissionTypes.AGENTS, [
-        Permissions.SHARED_GLOBAL,
-      ]);
-      expect(shareResult).toBe(true);
-    });
-  });
-
-  describe('generateCheckAccess', () => {
-    test('should call next() when user has required permission', async () => {
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should return 403 when user lacks permission', async () => {
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.CREATE]);
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-
-    test('should check body properties when configured', async () => {
-      req.body = { agentId: 'agent123', description: 'test' };
-
-      const bodyProps = {
-        [Permissions.CREATE]: ['agentId'],
-      };
-
-      const middleware = generateCheckAccess(
-        PermissionTypes.AGENTS,
-        [Permissions.CREATE],
-        bodyProps,
-      );
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should handle database errors gracefully', async () => {
-      // Create a user with an invalid role that will cause getRoleByName to fail
-      req.user.role = { invalid: 'object' }; // This will cause an error when querying
-
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(500);
-      expect(res.json).toHaveBeenCalledWith({
-        message: expect.stringContaining('Server error:'),
-      });
-    });
-
-    test('should work with multiple permission types', async () => {
-      req.user.role = 'admin';
-
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [
-        Permissions.USE,
-        Permissions.CREATE,
-        Permissions.SHARED_GLOBAL,
-      ]);
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should handle missing user gracefully', async () => {
-      req.user = null;
-
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(500);
-      expect(res.json).toHaveBeenCalledWith({
-        message: expect.stringContaining('Server error:'),
-      });
-    });
-
-    test('should handle role with no AGENTS permissions', async () => {
-      await Role.create({
-        name: 'noaccess',
-        permissions: {
-          // Explicitly set AGENTS with all permissions false
-          [PermissionTypes.AGENTS]: {
-            [Permissions.USE]: false,
-            [Permissions.CREATE]: false,
-            [Permissions.SHARED_GLOBAL]: false,
-          },
-        },
-      });
-      req.user.role = 'noaccess';
-
-      const middleware = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-  });
-});

api/server/middleware/validate/convoAccess.js

@@ -1,8 +1,8 @@
-const { isEnabled } = require('@librechat/api');
 const { Constants, ViolationTypes, Time } = require('librechat-data-provider');
 const { searchConversation } = require('~/models/Conversation');
 const denyRequest = require('~/server/middleware/denyRequest');
 const { logViolation, getLogStores } = require('~/cache');
+const { isEnabled } = require('~/server/utils');
 
 const { USE_REDIS, CONVO_ACCESS_VIOLATION_SCORE: score = 0 } = process.env ?? {};
 

api/server/routes/accessPermissions.js

@@ -1,62 +0,0 @@
-const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
-const {
-  getUserEffectivePermissions,
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  searchPrincipals,
-} = require('~/server/controllers/PermissionsController');
-const { requireJwtAuth, checkBan, uaParser, canAccessResource } = require('~/server/middleware');
-
-const router = express.Router();
-
-// Apply common middleware
-router.use(requireJwtAuth);
-router.use(checkBan);
-router.use(uaParser);
-
-/**
- * Generic routes for resource permissions
- * Pattern: /api/permissions/{resourceType}/{resourceId}
- */
-
-/**
- * GET /api/permissions/search-principals
- * Search for users and groups to grant permissions
- */
-router.get('/search-principals', searchPrincipals);
-
-/**
- * GET /api/permissions/{resourceType}/roles
- * Get available roles for a resource type
- */
-router.get('/:resourceType/roles', getResourceRoles);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}
- * Get all permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId', getResourcePermissions);
-
-/**
- * PUT /api/permissions/{resourceType}/{resourceId}
- * Bulk update permissions for a specific resource
- */
-router.put(
-  '/:resourceType/:resourceId',
-  canAccessResource({
-    resourceType: 'agent',
-    requiredPermission: PermissionBits.SHARE,
-    resourceIdParam: 'resourceId',
-  }),
-  updateResourcePermissions,
-);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}/effective
- * Get user's effective permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId/effective', getUserEffectivePermissions);
-
-module.exports = router;

api/server/routes/actions.js

@@ -1,10 +1,8 @@
 const express = require('express');
 const jwt = require('jsonwebtoken');
-const { getAccessToken } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
 const { CacheKeys } = require('librechat-data-provider');
-const { findToken, updateToken, createToken } = require('~/models');
-const { getFlowStateManager } = require('~/config');
+const { getAccessToken } = require('~/server/services/TokenService');
+const { logger, getFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const router = express.Router();
@@ -30,19 +28,18 @@ router.get('/:action_id/oauth/callback', async (req, res) => {
     try {
       decodedState = jwt.verify(state, JWT_SECRET);
     } catch (err) {
-      logger.error('Error verifying state parameter:', err);
       await flowManager.failFlow(identifier, 'oauth', 'Invalid or expired state parameter');
-      return res.redirect('/oauth/error?error=invalid_state');
+      return res.status(400).send('Invalid or expired state parameter');
     }
 
     if (decodedState.action_id !== action_id) {
       await flowManager.failFlow(identifier, 'oauth', 'Mismatched action ID in state parameter');
-      return res.redirect('/oauth/error?error=invalid_state');
+      return res.status(400).send('Mismatched action ID in state parameter');
     }
 
     if (!decodedState.user) {
       await flowManager.failFlow(identifier, 'oauth', 'Invalid user ID in state parameter');
-      return res.redirect('/oauth/error?error=invalid_state');
+      return res.status(400).send('Invalid user ID in state parameter');
     }
     identifier = `${decodedState.user}:${action_id}`;
     const flowState = await flowManager.getFlowState(identifier, 'oauth');
@@ -50,34 +47,91 @@ router.get('/:action_id/oauth/callback', async (req, res) => {
       throw new Error('OAuth flow not found');
     }
 
-    const tokenData = await getAccessToken(
-      {
-        code,
-        userId: decodedState.user,
-        identifier,
-        client_url: flowState.metadata.client_url,
-        redirect_uri: flowState.metadata.redirect_uri,
-        token_exchange_method: flowState.metadata.token_exchange_method,
-        /** Encrypted values */
-        encrypted_oauth_client_id: flowState.metadata.encrypted_oauth_client_id,
-        encrypted_oauth_client_secret: flowState.metadata.encrypted_oauth_client_secret,
-      },
-      {
-        findToken,
-        updateToken,
-        createToken,
-      },
-    );
+    const tokenData = await getAccessToken({
+      code,
+      userId: decodedState.user,
+      identifier,
+      client_url: flowState.metadata.client_url,
+      redirect_uri: flowState.metadata.redirect_uri,
+      token_exchange_method: flowState.metadata.token_exchange_method,
+      /** Encrypted values */
+      encrypted_oauth_client_id: flowState.metadata.encrypted_oauth_client_id,
+      encrypted_oauth_client_secret: flowState.metadata.encrypted_oauth_client_secret,
+    });
     await flowManager.completeFlow(identifier, 'oauth', tokenData);
-
-    /** Redirect to React success page */
-    const serverName = flowState.metadata?.action_name || `Action ${action_id}`;
-    const redirectUrl = `/oauth/success?serverName=${encodeURIComponent(serverName)}`;
-    res.redirect(redirectUrl);
+    res.send(`
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <title>Authentication Successful</title>
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+          <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+          <style>
+            body {
+              font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont;
+              background-color: rgb(249, 250, 251);
+              margin: 0;
+              padding: 2rem;
+              display: flex;
+              justify-content: center;
+              align-items: center;
+              min-height: 100vh;
+            }
+            .card {
+              background-color: white;
+              border-radius: 0.5rem;
+              padding: 2rem;
+              max-width: 28rem;
+              width: 100%;
+              box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
+              text-align: center;
+            }
+            .heading {
+              color: rgb(17, 24, 39);
+              font-size: 1.875rem;
+              font-weight: 700;
+              margin: 0 0 1rem;
+            }
+            .description {
+              color: rgb(75, 85, 99);
+              font-size: 0.875rem;
+              margin: 0.5rem 0;
+            }
+            .countdown {
+              color: rgb(99, 102, 241);
+              font-weight: 500;
+            }
+          </style>
+        </head>
+        <body>
+          <div class="card">
+            <h1 class="heading">Authentication Successful</h1>
+            <p class="description">
+              Your authentication was successful. This window will close in 
+              <span class="countdown" id="countdown">3</span> seconds.
+            </p>
+          </div>
+          <script>
+            let secondsLeft = 3;
+            const countdownElement = document.getElementById('countdown');
+            
+            const countdown = setInterval(() => {
+              secondsLeft--;
+              countdownElement.textContent = secondsLeft;
+              
+              if (secondsLeft <= 0) {
+                clearInterval(countdown);
+                window.close();
+              }
+            }, 1000);
+          </script>
+        </body>
+      </html>
+    `);
   } catch (error) {
     logger.error('Error in OAuth callback:', error);
     await flowManager.failFlow(identifier, 'oauth', error);
-    res.redirect('/oauth/error?error=callback_failed');
+    res.status(500).send('Authentication failed. Please try again.');
   }
 });
 

api/server/routes/agents/actions.js

@@ -1,15 +1,20 @@
 const express = require('express');
 const { nanoid } = require('nanoid');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
-const { actionDelimiter, removeNullishValues } = require('librechat-data-provider');
+const { actionDelimiter, SystemRoles, removeNullishValues } = require('librechat-data-provider');
 const { encryptMetadata, domainParser } = require('~/server/services/ActionService');
 const { updateAction, getActions, deleteAction } = require('~/models/Action');
 const { isActionDomainAllowed } = require('~/server/services/domains');
-const { canAccessAgentResource } = require('~/server/middleware');
 const { getAgent, updateAgent } = require('~/models/Agent');
+const { logger } = require('~/config');
 
 const router = express.Router();
 
+// If the user has ADMIN role
+// then action edition is possible even if not owner of the assistant
+const isAdmin = (req) => {
+  return req.user.role === SystemRoles.ADMIN;
+};
+
 /**
  * Retrieves all user's actions
  * @route GET /actions/
@@ -18,8 +23,9 @@ const router = express.Router();
  */
 router.get('/', async (req, res) => {
   try {
-    // Get all actions for the user (admin permissions handled by middleware if needed)
-    const searchParams = { user: req.user.id };
+    const admin = isAdmin(req);
+    // If admin, get all actions, otherwise only user's actions
+    const searchParams = admin ? {} : { user: req.user.id };
     res.json(await getActions(searchParams));
   } catch (error) {
     res.status(500).json({ error: error.message });
@@ -35,110 +41,106 @@ router.get('/', async (req, res) => {
  * @param {ActionMetadata} req.body.metadata - Metadata for the action.
  * @returns {Object} 200 - success response - application/json
  */
-router.post(
-  '/:agent_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  async (req, res) => {
-    try {
-      const { agent_id } = req.params;
+router.post('/:agent_id', async (req, res) => {
+  try {
+    const { agent_id } = req.params;
 
-      /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
-      const { functions, action_id: _action_id, metadata: _metadata } = req.body;
-      if (!functions.length) {
-        return res.status(400).json({ message: 'No functions provided' });
-      }
-
-      let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
-      const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
-      if (!isDomainAllowed) {
-        return res.status(400).json({ message: 'Domain not allowed' });
-      }
-
-      let { domain } = metadata;
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const action_id = _action_id ?? nanoid();
-      const initialPromises = [];
-
-      // Permissions already validated by middleware - load agent directly
-      initialPromises.push(getAgent({ id: agent_id }));
-      if (_action_id) {
-        initialPromises.push(getActions({ action_id }, true));
-      }
-
-      /** @type {[Agent, [Action|undefined]]} */
-      const [agent, actions_result] = await Promise.all(initialPromises);
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for adding action' });
-      }
-
-      if (actions_result && actions_result.length) {
-        const action = actions_result[0];
-        metadata = { ...action.metadata, ...metadata };
-      }
-
-      const { actions: _actions = [], author: agent_author } = agent ?? {};
-      const actions = [];
-      for (const action of _actions) {
-        const [_action_domain, current_action_id] = action.split(actionDelimiter);
-        if (current_action_id === action_id) {
-          continue;
-        }
-
-        actions.push(action);
-      }
-
-      actions.push(`${domain}${actionDelimiter}${action_id}`);
-
-      /** @type {string[]}} */
-      const { tools: _tools = [] } = agent;
-
-      const tools = _tools
-        .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
-        .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
-
-      // Force version update since actions are changing
-      const updatedAgent = await updateAgent(
-        { id: agent_id },
-        { tools, actions },
-        {
-          updatingUserId: req.user.id,
-          forceVersion: true,
-        },
-      );
-
-      // Only update user field for new actions
-      const actionUpdateData = { metadata, agent_id };
-      if (!actions_result || !actions_result.length) {
-        // For new actions, use the agent owner's user ID
-        actionUpdateData.user = agent_author || req.user.id;
-      }
-
-      /** @type {[Action]} */
-      const updatedAction = await updateAction({ action_id }, actionUpdateData);
-
-      const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
-      for (let field of sensitiveFields) {
-        if (updatedAction.metadata[field]) {
-          delete updatedAction.metadata[field];
-        }
-      }
-
-      res.json([updatedAgent, updatedAction]);
-    } catch (error) {
-      const message = 'Trouble updating the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
+    const { functions, action_id: _action_id, metadata: _metadata } = req.body;
+    if (!functions.length) {
+      return res.status(400).json({ message: 'No functions provided' });
     }
-  },
-);
+
+    let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
+    const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
+    if (!isDomainAllowed) {
+      return res.status(400).json({ message: 'Domain not allowed' });
+    }
+
+    let { domain } = metadata;
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const action_id = _action_id ?? nanoid();
+    const initialPromises = [];
+    const admin = isAdmin(req);
+
+    // If admin, can edit any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    // TODO: share agents
+    initialPromises.push(getAgent(agentQuery));
+    if (_action_id) {
+      initialPromises.push(getActions({ action_id }, true));
+    }
+
+    /** @type {[Agent, [Action|undefined]]} */
+    const [agent, actions_result] = await Promise.all(initialPromises);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for adding action' });
+    }
+
+    if (actions_result && actions_result.length) {
+      const action = actions_result[0];
+      metadata = { ...action.metadata, ...metadata };
+    }
+
+    const { actions: _actions = [], author: agent_author } = agent ?? {};
+    const actions = [];
+    for (const action of _actions) {
+      const [_action_domain, current_action_id] = action.split(actionDelimiter);
+      if (current_action_id === action_id) {
+        continue;
+      }
+
+      actions.push(action);
+    }
+
+    actions.push(`${domain}${actionDelimiter}${action_id}`);
+
+    /** @type {string[]}} */
+    const { tools: _tools = [] } = agent;
+
+    const tools = _tools
+      .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
+      .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
+
+    // Force version update since actions are changing
+    const updatedAgent = await updateAgent(
+      agentQuery,
+      { tools, actions },
+      {
+        updatingUserId: req.user.id,
+        forceVersion: true,
+      },
+    );
+
+    // Only update user field for new actions
+    const actionUpdateData = { metadata, agent_id };
+    if (!actions_result || !actions_result.length) {
+      // For new actions, use the agent owner's user ID
+      actionUpdateData.user = agent_author || req.user.id;
+    }
+
+    /** @type {[Action]} */
+    const updatedAction = await updateAction({ action_id }, actionUpdateData);
+
+    const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
+    for (let field of sensitiveFields) {
+      if (updatedAction.metadata[field]) {
+        delete updatedAction.metadata[field];
+      }
+    }
+
+    res.json([updatedAgent, updatedAction]);
+  } catch (error) {
+    const message = 'Trouble updating the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});
 
 /**
  * Deletes an action for a specific agent.
@@ -147,55 +149,52 @@ router.post(
  * @param {string} req.params.action_id - The ID of the action to delete.
  * @returns {Object} 200 - success response - application/json
  */
-router.delete(
-  '/:agent_id/:action_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  async (req, res) => {
-    try {
-      const { agent_id, action_id } = req.params;
+router.delete('/:agent_id/:action_id', async (req, res) => {
+  try {
+    const { agent_id, action_id } = req.params;
+    const admin = isAdmin(req);
 
-      // Permissions already validated by middleware - load agent directly
-      const agent = await getAgent({ id: agent_id });
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for deleting action' });
-      }
-
-      const { tools = [], actions = [] } = agent;
-
-      let domain = '';
-      const updatedActions = actions.filter((action) => {
-        if (action.includes(action_id)) {
-          [domain] = action.split(actionDelimiter);
-          return false;
-        }
-        return true;
-      });
-
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
-
-      // Force version update since actions are being removed
-      await updateAgent(
-        { id: agent_id },
-        { tools: updatedTools, actions: updatedActions },
-        { updatingUserId: req.user.id, forceVersion: true },
-      );
-      await deleteAction({ action_id });
-      res.status(200).json({ message: 'Action deleted successfully' });
-    } catch (error) {
-      const message = 'Trouble deleting the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    // If admin, can delete any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    const agent = await getAgent(agentQuery);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for deleting action' });
     }
-  },
-);
+
+    const { tools = [], actions = [] } = agent;
+
+    let domain = '';
+    const updatedActions = actions.filter((action) => {
+      if (action.includes(action_id)) {
+        [domain] = action.split(actionDelimiter);
+        return false;
+      }
+      return true;
+    });
+
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
+
+    // Force version update since actions are being removed
+    await updateAgent(
+      agentQuery,
+      { tools: updatedTools, actions: updatedActions },
+      { updatingUserId: req.user.id, forceVersion: true },
+    );
+    // If admin, can delete any action, otherwise only user's actions
+    const actionQuery = admin ? { action_id } : { action_id, user: req.user.id };
+    await deleteAction(actionQuery);
+    res.status(200).json({ message: 'Action deleted successfully' });
+  } catch (error) {
+    const message = 'Trouble deleting the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});
 
 module.exports = router;

api/server/routes/agents/chat.js

@@ -1,5 +1,4 @@
 const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
 const {
   setHeaders,
@@ -8,7 +7,6 @@ const {
   generateCheckAccess,
   validateConvoAccess,
   buildEndpointOption,
-  canAccessAgentFromBody,
 } = require('~/server/middleware');
 const { initializeClient } = require('~/server/services/Endpoints/agents');
 const AgentController = require('~/server/controllers/agents/request');
@@ -19,12 +17,8 @@ const router = express.Router();
 router.use(moderateText);
 
 const checkAgentAccess = generateCheckAccess(PermissionTypes.AGENTS, [Permissions.USE]);
-const checkAgentResourceAccess = canAccessAgentFromBody({
-  requiredPermission: PermissionBits.VIEW,
-});
 
 router.use(checkAgentAccess);
-router.use(checkAgentResourceAccess);
 router.use(validateConvoAccess);
 router.use(buildEndpointOption);
 router.use(setHeaders);

api/server/routes/agents/index.js

@@ -37,6 +37,4 @@ if (isEnabled(LIMIT_MESSAGE_USER)) {
 chatRouter.use('/', chat);
 router.use('/chat', chatRouter);
 
-// Add marketplace routes
-
 module.exports = router;

api/server/routes/agents/v1.js

@@ -1,11 +1,6 @@
 const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const {
-  requireJwtAuth,
-  generateCheckAccess,
-  canAccessAgentResource,
-} = require('~/server/middleware');
+const { requireJwtAuth, generateCheckAccess } = require('~/server/middleware');
 const v1 = require('~/server/controllers/agents/v1');
 const actions = require('./actions');
 const tools = require('./tools');
@@ -42,11 +37,6 @@ router.use('/actions', actions);
  */
 router.use('/tools', tools);
 
-/**
- * Get all agent categories with counts
- * @route GET /agents/marketplace/categories
- */
-router.get('/categories', v1.getAgentCategories);
 /**
  * Creates an agent.
  * @route POST /agents
@@ -56,38 +46,13 @@ router.get('/categories', v1.getAgentCategories);
 router.post('/', checkAgentCreate, v1.createAgent);
 
 /**
- * Retrieves basic agent information (VIEW permission required).
- * Returns safe, non-sensitive agent data for viewing purposes.
+ * Retrieves an agent.
  * @route GET /agents/:id
  * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Basic agent info - application/json
+ * @returns {Agent} 200 - Success response - application/json
  */
-router.get(
-  '/:id',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.getAgent,
-);
+router.get('/:id', checkAgentAccess, v1.getAgent);
 
-/**
- * Retrieves full agent details including sensitive configuration (EDIT permission required).
- * Returns complete agent data for editing/configuration purposes.
- * @route GET /agents/:id/expanded
- * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Full agent details - application/json
- */
-router.get(
-  '/:id/expanded',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  (req, res) => v1.getAgent(req, res, true), // Expanded version
-);
 /**
  * Updates an agent.
  * @route PATCH /agents/:id
@@ -95,15 +60,7 @@ router.get(
  * @param {AgentUpdateParams} req.body - The agent update parameters.
  * @returns {Agent} 200 - Success response - application/json
  */
-router.patch(
-  '/:id',
-  checkGlobalAgentShare,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  v1.updateAgent,
-);
+router.patch('/:id', checkGlobalAgentShare, v1.updateAgent);
 
 /**
  * Duplicates an agent.
@@ -111,15 +68,7 @@ router.patch(
  * @param {string} req.params.id - Agent identifier.
  * @returns {Agent} 201 - Success response - application/json
  */
-router.post(
-  '/:id/duplicate',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.duplicateAgent,
-);
+router.post('/:id/duplicate', checkAgentCreate, v1.duplicateAgent);
 
 /**
  * Deletes an agent.
@@ -127,15 +76,7 @@ router.post(
  * @param {string} req.params.id - Agent identifier.
  * @returns {Agent} 200 - success response - application/json
  */
-router.delete(
-  '/:id',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.DELETE,
-    resourceIdParam: 'id',
-  }),
-  v1.deleteAgent,
-);
+router.delete('/:id', checkAgentCreate, v1.deleteAgent);
 
 /**
  * Reverts an agent to a previous version.
@@ -162,14 +103,6 @@ router.get('/', checkAgentAccess, v1.getListAgents);
  * @param {string} [req.body.metadata] - Optional metadata for the agent's avatar.
  * @returns {Object} 200 - success response - application/json
  */
-avatar.post(
-  '/:agent_id/avatar/',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  v1.uploadAgentAvatar,
-);
+avatar.post('/:agent_id/avatar/', checkAgentAccess, v1.uploadAgentAvatar);
 
 module.exports = { v1: router, avatar };

api/server/routes/ask/addToCache.js

@@ -0,0 +1,63 @@
+const { Keyv } = require('keyv');
+const { KeyvFile } = require('keyv-file');
+const { logger } = require('~/config');
+
+const addToCache = async ({ endpoint, endpointOption, userMessage, responseMessage }) => {
+  try {
+    const conversationsCache = new Keyv({
+      store: new KeyvFile({ filename: './data/cache.json' }),
+      namespace: 'chatgpt', // should be 'bing' for bing/sydney
+    });
+
+    const {
+      conversationId,
+      messageId: userMessageId,
+      parentMessageId: userParentMessageId,
+      text: userText,
+    } = userMessage;
+    const {
+      messageId: responseMessageId,
+      parentMessageId: responseParentMessageId,
+      text: responseText,
+    } = responseMessage;
+
+    let conversation = await conversationsCache.get(conversationId);
+    // used to generate a title for the conversation if none exists
+    // let isNewConversation = false;
+    if (!conversation) {
+      conversation = {
+        messages: [],
+        createdAt: Date.now(),
+      };
+      // isNewConversation = true;
+    }
+
+    const roles = (options) => {
+      if (endpoint === 'openAI') {
+        return options?.chatGptLabel || 'ChatGPT';
+      }
+    };
+
+    let _userMessage = {
+      id: userMessageId,
+      parentMessageId: userParentMessageId,
+      role: 'User',
+      message: userText,
+    };
+
+    let _responseMessage = {
+      id: responseMessageId,
+      parentMessageId: responseParentMessageId,
+      role: roles(endpointOption),
+      message: responseText,
+    };
+
+    conversation.messages.push(_userMessage, _responseMessage);
+
+    await conversationsCache.set(conversationId, conversation);
+  } catch (error) {
+    logger.error('[addToCache] Error adding conversation to cache', error);
+  }
+};
+
+module.exports = addToCache;

api/server/routes/ask/anthropic.js

@@ -0,0 +1,25 @@
+const express = require('express');
+const AskController = require('~/server/controllers/AskController');
+const { addTitle, initializeClient } = require('~/server/services/Endpoints/anthropic');
+const {
+  setHeaders,
+  handleAbort,
+  validateModel,
+  validateEndpoint,
+  buildEndpointOption,
+} = require('~/server/middleware');
+
+const router = express.Router();
+
+router.post(
+  '/',
+  validateEndpoint,
+  validateModel,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res, next) => {
+    await AskController(req, res, next, initializeClient, addTitle);
+  },
+);
+
+module.exports = router;

api/server/routes/ask/custom.js

@@ -0,0 +1,25 @@
+const express = require('express');
+const AskController = require('~/server/controllers/AskController');
+const { initializeClient } = require('~/server/services/Endpoints/custom');
+const { addTitle } = require('~/server/services/Endpoints/openAI');
+const {
+  setHeaders,
+  validateModel,
+  validateEndpoint,
+  buildEndpointOption,
+} = require('~/server/middleware');
+
+const router = express.Router();
+
+router.post(
+  '/',
+  validateEndpoint,
+  validateModel,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res, next) => {
+    await AskController(req, res, next, initializeClient, addTitle);
+  },
+);
+
+module.exports = router;

api/server/routes/ask/google.js

@@ -0,0 +1,24 @@
+const express = require('express');
+const AskController = require('~/server/controllers/AskController');
+const { initializeClient, addTitle } = require('~/server/services/Endpoints/google');
+const {
+  setHeaders,
+  validateModel,
+  validateEndpoint,
+  buildEndpointOption,
+} = require('~/server/middleware');
+
+const router = express.Router();
+
+router.post(
+  '/',
+  validateEndpoint,
+  validateModel,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res, next) => {
+    await AskController(req, res, next, initializeClient, addTitle);
+  },
+);
+
+module.exports = router;

api/server/routes/ask/gptPlugins.js

@@ -0,0 +1,241 @@
+const express = require('express');
+const { getResponseSender, Constants } = require('librechat-data-provider');
+const { initializeClient } = require('~/server/services/Endpoints/gptPlugins');
+const { sendMessage, createOnProgress } = require('~/server/utils');
+const { addTitle } = require('~/server/services/Endpoints/openAI');
+const { saveMessage, updateMessage } = require('~/models');
+const {
+  handleAbort,
+  createAbortController,
+  handleAbortError,
+  setHeaders,
+  validateModel,
+  validateEndpoint,
+  buildEndpointOption,
+  moderateText,
+} = require('~/server/middleware');
+const { validateTools } = require('~/app');
+const { logger } = require('~/config');
+
+const router = express.Router();
+
+router.use(moderateText);
+
+router.post(
+  '/',
+  validateEndpoint,
+  validateModel,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res) => {
+    let {
+      text,
+      endpointOption,
+      conversationId,
+      parentMessageId = null,
+      overrideParentMessageId = null,
+    } = req.body;
+
+    logger.debug('[/ask/gptPlugins]', { text, conversationId, ...endpointOption });
+
+    let userMessage;
+    let userMessagePromise;
+    let promptTokens;
+    let userMessageId;
+    let responseMessageId;
+    const sender = getResponseSender({
+      ...endpointOption,
+      model: endpointOption.modelOptions.model,
+    });
+    const newConvo = !conversationId;
+    const user = req.user.id;
+
+    const plugins = [];
+
+    const getReqData = (data = {}) => {
+      for (let key in data) {
+        if (key === 'userMessage') {
+          userMessage = data[key];
+          userMessageId = data[key].messageId;
+        } else if (key === 'userMessagePromise') {
+          userMessagePromise = data[key];
+        } else if (key === 'responseMessageId') {
+          responseMessageId = data[key];
+        } else if (key === 'promptTokens') {
+          promptTokens = data[key];
+        } else if (!conversationId && key === 'conversationId') {
+          conversationId = data[key];
+        }
+      }
+    };
+
+    let streaming = null;
+    let timer = null;
+
+    const {
+      onProgress: progressCallback,
+      sendIntermediateMessage,
+      getPartialText,
+    } = createOnProgress({
+      onProgress: () => {
+        if (timer) {
+          clearTimeout(timer);
+        }
+
+        streaming = new Promise((resolve) => {
+          timer = setTimeout(() => {
+            resolve();
+          }, 250);
+        });
+      },
+    });
+
+    const pluginMap = new Map();
+    const onAgentAction = async (action, runId) => {
+      pluginMap.set(runId, action.tool);
+      sendIntermediateMessage(res, {
+        plugins,
+        parentMessageId: userMessage.messageId,
+        messageId: responseMessageId,
+      });
+    };
+
+    const onToolStart = async (tool, input, runId, parentRunId) => {
+      const pluginName = pluginMap.get(parentRunId);
+      const latestPlugin = {
+        runId,
+        loading: true,
+        inputs: [input],
+        latest: pluginName,
+        outputs: null,
+      };
+
+      if (streaming) {
+        await streaming;
+      }
+      const extraTokens = ':::plugin:::\n';
+      plugins.push(latestPlugin);
+      sendIntermediateMessage(
+        res,
+        { plugins, parentMessageId: userMessage.messageId, messageId: responseMessageId },
+        extraTokens,
+      );
+    };
+
+    const onToolEnd = async (output, runId) => {
+      if (streaming) {
+        await streaming;
+      }
+
+      const pluginIndex = plugins.findIndex((plugin) => plugin.runId === runId);
+
+      if (pluginIndex !== -1) {
+        plugins[pluginIndex].loading = false;
+        plugins[pluginIndex].outputs = output;
+      }
+    };
+
+    const getAbortData = () => ({
+      sender,
+      conversationId,
+      userMessagePromise,
+      messageId: responseMessageId,
+      parentMessageId: overrideParentMessageId ?? userMessageId,
+      text: getPartialText(),
+      plugins: plugins.map((p) => ({ ...p, loading: false })),
+      userMessage,
+      promptTokens,
+    });
+    const { abortController, onStart } = createAbortController(req, res, getAbortData, getReqData);
+
+    try {
+      endpointOption.tools = await validateTools(user, endpointOption.tools);
+      const { client } = await initializeClient({ req, res, endpointOption });
+
+      const onChainEnd = () => {
+        if (!client.skipSaveUserMessage) {
+          saveMessage(
+            req,
+            { ...userMessage, user },
+            { context: 'api/server/routes/ask/gptPlugins.js - onChainEnd' },
+          );
+        }
+        sendIntermediateMessage(res, {
+          plugins,
+          parentMessageId: userMessage.messageId,
+          messageId: responseMessageId,
+        });
+      };
+
+      let response = await client.sendMessage(text, {
+        user,
+        conversationId,
+        parentMessageId,
+        overrideParentMessageId,
+        getReqData,
+        onAgentAction,
+        onChainEnd,
+        onToolStart,
+        onToolEnd,
+        onStart,
+        getPartialText,
+        ...endpointOption,
+        progressCallback,
+        progressOptions: {
+          res,
+          // parentMessageId: overrideParentMessageId || userMessageId,
+          plugins,
+        },
+        abortController,
+      });
+
+      if (overrideParentMessageId) {
+        response.parentMessageId = overrideParentMessageId;
+      }
+
+      logger.debug('[/ask/gptPlugins]', response);
+
+      const { conversation = {} } = await response.databasePromise;
+      delete response.databasePromise;
+      conversation.title =
+        conversation && !conversation.title ? null : conversation?.title || 'New Chat';
+
+      sendMessage(res, {
+        title: conversation.title,
+        final: true,
+        conversation,
+        requestMessage: userMessage,
+        responseMessage: response,
+      });
+      res.end();
+
+      if (parentMessageId === Constants.NO_PARENT && newConvo) {
+        addTitle(req, {
+          text,
+          response,
+          client,
+        });
+      }
+
+      response.plugins = plugins.map((p) => ({ ...p, loading: false }));
+      if (response.plugins?.length > 0) {
+        await updateMessage(
+          req,
+          { ...response, user },
+          { context: 'api/server/routes/ask/gptPlugins.js - save plugins used' },
+        );
+      }
+    } catch (error) {
+      const partialText = getPartialText();
+      handleAbortError(res, req, error, {
+        partialText,
+        conversationId,
+        sender,
+        messageId: responseMessageId,
+        parentMessageId: userMessageId ?? parentMessageId,
+      });
+    }
+  },
+);
+
+module.exports = router;

api/server/routes/ask/index.js

@@ -0,0 +1,47 @@
+const express = require('express');
+const { EModelEndpoint } = require('librechat-data-provider');
+const {
+  uaParser,
+  checkBan,
+  requireJwtAuth,
+  messageIpLimiter,
+  concurrentLimiter,
+  messageUserLimiter,
+  validateConvoAccess,
+} = require('~/server/middleware');
+const { isEnabled } = require('~/server/utils');
+const gptPlugins = require('./gptPlugins');
+const anthropic = require('./anthropic');
+const custom = require('./custom');
+const google = require('./google');
+const openAI = require('./openAI');
+
+const { LIMIT_CONCURRENT_MESSAGES, LIMIT_MESSAGE_IP, LIMIT_MESSAGE_USER } = process.env ?? {};
+
+const router = express.Router();
+
+router.use(requireJwtAuth);
+router.use(checkBan);
+router.use(uaParser);
+
+if (isEnabled(LIMIT_CONCURRENT_MESSAGES)) {
+  router.use(concurrentLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_IP)) {
+  router.use(messageIpLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_USER)) {
+  router.use(messageUserLimiter);
+}
+
+router.use(validateConvoAccess);
+
+router.use([`/${EModelEndpoint.azureOpenAI}`, `/${EModelEndpoint.openAI}`], openAI);
+router.use(`/${EModelEndpoint.gptPlugins}`, gptPlugins);
+router.use(`/${EModelEndpoint.anthropic}`, anthropic);
+router.use(`/${EModelEndpoint.google}`, google);
+router.use(`/${EModelEndpoint.custom}`, custom);
+
+module.exports = router;

api/server/routes/ask/openAI.js

@@ -0,0 +1,27 @@
+const express = require('express');
+const AskController = require('~/server/controllers/AskController');
+const { addTitle, initializeClient } = require('~/server/services/Endpoints/openAI');
+const {
+  handleAbort,
+  setHeaders,
+  validateModel,
+  validateEndpoint,
+  buildEndpointOption,
+  moderateText,
+} = require('~/server/middleware');
+
+const router = express.Router();
+router.use(moderateText);
+
+router.post(
+  '/',
+  validateEndpoint,
+  validateModel,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res, next) => {
+    await AskController(req, res, next, initializeClient, addTitle);
+  },
+);
+
+module.exports = router;

api/server/routes/bedrock/chat.js

@@ -0,0 +1,37 @@
+const express = require('express');
+
+const router = express.Router();
+const {
+  setHeaders,
+  handleAbort,
+  moderateText,
+  // validateModel,
+  // validateEndpoint,
+  buildEndpointOption,
+} = require('~/server/middleware');
+const { initializeClient } = require('~/server/services/Endpoints/bedrock');
+const AgentController = require('~/server/controllers/agents/request');
+const addTitle = require('~/server/services/Endpoints/agents/title');
+
+router.use(moderateText);
+
+/**
+ * @route POST /
+ * @desc Chat with an assistant
+ * @access Public
+ * @param {express.Request} req - The request object, containing the request data.
+ * @param {express.Response} res - The response object, used to send back a response.
+ * @returns {void}
+ */
+router.post(
+  '/',
+  // validateModel,
+  // validateEndpoint,
+  buildEndpointOption,
+  setHeaders,
+  async (req, res, next) => {
+    await AgentController(req, res, next, initializeClient, addTitle);
+  },
+);
+
+module.exports = router;

api/server/routes/bedrock/index.js

@@ -0,0 +1,35 @@
+const express = require('express');
+const {
+  uaParser,
+  checkBan,
+  requireJwtAuth,
+  messageIpLimiter,
+  concurrentLimiter,
+  messageUserLimiter,
+} = require('~/server/middleware');
+const { isEnabled } = require('~/server/utils');
+const chat = require('./chat');
+
+const { LIMIT_CONCURRENT_MESSAGES, LIMIT_MESSAGE_IP, LIMIT_MESSAGE_USER } = process.env ?? {};
+
+const router = express.Router();
+
+router.use(requireJwtAuth);
+router.use(checkBan);
+router.use(uaParser);
+
+if (isEnabled(LIMIT_CONCURRENT_MESSAGES)) {
+  router.use(concurrentLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_IP)) {
+  router.use(messageIpLimiter);
+}
+
+if (isEnabled(LIMIT_MESSAGE_USER)) {
+  router.use(messageUserLimiter);
+}
+
+router.use('/chat', chat);
+
+module.exports = router;

api/server/routes/config.js

@@ -1,11 +1,10 @@
 const express = require('express');
-const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, defaultSocialLogins, Constants } = require('librechat-data-provider');
-const { getCustomConfig } = require('~/server/services/Config/getCustomConfig');
 const { getLdapConfig } = require('~/server/services/Config/ldap');
 const { getProjectByName } = require('~/models/Project');
 const { isEnabled } = require('~/server/utils');
 const { getLogStores } = require('~/cache');
+const { logger } = require('~/config');
 
 const router = express.Router();
 const emailLoginEnabled =
@@ -22,7 +21,6 @@ const publicSharedLinksEnabled =
 
 router.get('/', async function (req, res) {
   const cache = getLogStores(CacheKeys.CONFIG_STORE);
-
   const cachedStartupConfig = await cache.get(CacheKeys.STARTUP_CONFIG);
   if (cachedStartupConfig) {
     res.send(cachedStartupConfig);
@@ -98,18 +96,6 @@ router.get('/', async function (req, res) {
       bundlerURL: process.env.SANDPACK_BUNDLER_URL,
       staticBundlerURL: process.env.SANDPACK_STATIC_BUNDLER_URL,
     };
-
-    payload.mcpServers = {};
-    const config = await getCustomConfig();
-    if (config?.mcpServers != null) {
-      for (const serverName in config.mcpServers) {
-        const serverConfig = config.mcpServers[serverName];
-        payload.mcpServers[serverName] = {
-          customUserVars: serverConfig?.customUserVars || {},
-        };
-      }
-    }
-
     /** @type {TCustomConfig['webSearch']} */
     const webSearchConfig = req.app.locals.webSearch;
     if (

api/server/routes/files/avatar.js

@@ -1,7 +1,6 @@
 const fs = require('fs').promises;
 const express = require('express');
-const { getStrategyFunctions } = require('~/server/services/Files/strategies');
-const { resizeAvatar } = require('~/server/services/Files/images/avatar');
+const { getAvatarProcessFunction, resizeAvatar } = require('@librechat/auth');
 const { filterFile } = require('~/server/services/Files/process');
 const { logger } = require('~/config');
 
@@ -26,7 +25,7 @@ router.post('/', async (req, res) => {
       desiredFormat,
     });
 
-    const { processAvatar } = getStrategyFunctions(fileStrategy);
+    const processAvatar = getAvatarProcessFunction(fileStrategy);
     const url = await processAvatar({ buffer: resizedBuffer, userId, manual });
 
     res.json({ url });

api/server/routes/index.js

@@ -1,4 +1,3 @@
-const accessPermissions = require('./accessPermissions');
 const assistants = require('./assistants');
 const categories = require('./categories');
 const tokenizer = require('./tokenizer');
@@ -10,6 +9,7 @@ const presets = require('./presets');
 const prompts = require('./prompts');
 const balance = require('./balance');
 const plugins = require('./plugins');
+const bedrock = require('./bedrock');
 const actions = require('./actions');
 const banner = require('./banner');
 const search = require('./search');
@@ -26,10 +26,10 @@ const auth = require('./auth');
 const edit = require('./edit');
 const keys = require('./keys');
 const user = require('./user');
-const mcp = require('./mcp');
+const ask = require('./ask');
 
 module.exports = {
-  mcp,
+  ask,
   edit,
   auth,
   keys,
@@ -45,6 +45,7 @@ module.exports = {
   search,
   config,
   models,
+  bedrock,
   prompts,
   plugins,
   actions,
@@ -57,5 +58,4 @@ module.exports = {
   assistants,
   categories,
   staticRoute,
-  accessPermissions,
 };

api/server/routes/mcp.js

@@ -1,205 +0,0 @@
-const { Router } = require('express');
-const { MCPOAuthHandler } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { CacheKeys } = require('librechat-data-provider');
-const { requireJwtAuth } = require('~/server/middleware');
-const { getFlowStateManager } = require('~/config');
-const { getLogStores } = require('~/cache');
-
-const router = Router();
-
-/**
- * Initiate OAuth flow
- * This endpoint is called when the user clicks the auth link in the UI
- */
-router.get('/:serverName/oauth/initiate', requireJwtAuth, async (req, res) => {
-  try {
-    const { serverName } = req.params;
-    const { userId, flowId } = req.query;
-    const user = req.user;
-
-    // Verify the userId matches the authenticated user
-    if (userId !== user.id) {
-      return res.status(403).json({ error: 'User mismatch' });
-    }
-
-    logger.debug('[MCP OAuth] Initiate request', { serverName, userId, flowId });
-
-    const flowsCache = getLogStores(CacheKeys.FLOWS);
-    const flowManager = getFlowStateManager(flowsCache);
-
-    /** Flow state to retrieve OAuth config */
-    const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
-    if (!flowState) {
-      logger.error('[MCP OAuth] Flow state not found', { flowId });
-      return res.status(404).json({ error: 'Flow not found' });
-    }
-
-    const { serverUrl, oauth: oauthConfig } = flowState.metadata || {};
-    if (!serverUrl || !oauthConfig) {
-      logger.error('[MCP OAuth] Missing server URL or OAuth config in flow state');
-      return res.status(400).json({ error: 'Invalid flow state' });
-    }
-
-    const { authorizationUrl, flowId: oauthFlowId } = await MCPOAuthHandler.initiateOAuthFlow(
-      serverName,
-      serverUrl,
-      userId,
-      oauthConfig,
-    );
-
-    logger.debug('[MCP OAuth] OAuth flow initiated', { oauthFlowId, authorizationUrl });
-
-    // Redirect user to the authorization URL
-    res.redirect(authorizationUrl);
-  } catch (error) {
-    logger.error('[MCP OAuth] Failed to initiate OAuth', error);
-    res.status(500).json({ error: 'Failed to initiate OAuth' });
-  }
-});
-
-/**
- * OAuth callback handler
- * This handles the OAuth callback after the user has authorized the application
- */
-router.get('/:serverName/oauth/callback', async (req, res) => {
-  try {
-    const { serverName } = req.params;
-    const { code, state, error: oauthError } = req.query;
-
-    logger.debug('[MCP OAuth] Callback received', {
-      serverName,
-      code: code ? 'present' : 'missing',
-      state,
-      error: oauthError,
-    });
-
-    if (oauthError) {
-      logger.error('[MCP OAuth] OAuth error received', { error: oauthError });
-      return res.redirect(`/oauth/error?error=${encodeURIComponent(String(oauthError))}`);
-    }
-
-    if (!code || typeof code !== 'string') {
-      logger.error('[MCP OAuth] Missing or invalid code');
-      return res.redirect('/oauth/error?error=missing_code');
-    }
-
-    if (!state || typeof state !== 'string') {
-      logger.error('[MCP OAuth] Missing or invalid state');
-      return res.redirect('/oauth/error?error=missing_state');
-    }
-
-    // Extract flow ID from state
-    const flowId = state;
-    logger.debug('[MCP OAuth] Using flow ID from state', { flowId });
-
-    const flowsCache = getLogStores(CacheKeys.FLOWS);
-    const flowManager = getFlowStateManager(flowsCache);
-
-    logger.debug('[MCP OAuth] Getting flow state for flowId: ' + flowId);
-    const flowState = await MCPOAuthHandler.getFlowState(flowId, flowManager);
-
-    if (!flowState) {
-      logger.error('[MCP OAuth] Flow state not found for flowId:', flowId);
-      return res.redirect('/oauth/error?error=invalid_state');
-    }
-
-    logger.debug('[MCP OAuth] Flow state details', {
-      serverName: flowState.serverName,
-      userId: flowState.userId,
-      hasMetadata: !!flowState.metadata,
-      hasClientInfo: !!flowState.clientInfo,
-      hasCodeVerifier: !!flowState.codeVerifier,
-    });
-
-    // Complete the OAuth flow
-    logger.debug('[MCP OAuth] Completing OAuth flow');
-    const tokens = await MCPOAuthHandler.completeOAuthFlow(flowId, code, flowManager);
-    logger.info('[MCP OAuth] OAuth flow completed, tokens received in callback route');
-
-    // For system-level OAuth, we need to store the tokens and retry the connection
-    if (flowState.userId === 'system') {
-      logger.debug(`[MCP OAuth] System-level OAuth completed for ${serverName}`);
-    }
-
-    /** ID of the flow that the tool/connection is waiting for */
-    const toolFlowId = flowState.metadata?.toolFlowId;
-    if (toolFlowId) {
-      logger.debug('[MCP OAuth] Completing tool flow', { toolFlowId });
-      await flowManager.completeFlow(toolFlowId, 'mcp_oauth', tokens);
-    }
-
-    /** Redirect to success page with flowId and serverName */
-    const redirectUrl = `/oauth/success?serverName=${encodeURIComponent(serverName)}`;
-    res.redirect(redirectUrl);
-  } catch (error) {
-    logger.error('[MCP OAuth] OAuth callback error', error);
-    res.redirect('/oauth/error?error=callback_failed');
-  }
-});
-
-/**
- * Get OAuth tokens for a completed flow
- * This is primarily for user-level OAuth flows
- */
-router.get('/oauth/tokens/:flowId', requireJwtAuth, async (req, res) => {
-  try {
-    const { flowId } = req.params;
-    const user = req.user;
-
-    if (!user?.id) {
-      return res.status(401).json({ error: 'User not authenticated' });
-    }
-
-    // Allow system flows or user-owned flows
-    if (!flowId.startsWith(`${user.id}:`) && !flowId.startsWith('system:')) {
-      return res.status(403).json({ error: 'Access denied' });
-    }
-
-    const flowsCache = getLogStores(CacheKeys.FLOWS);
-    const flowManager = getFlowStateManager(flowsCache);
-
-    const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
-    if (!flowState) {
-      return res.status(404).json({ error: 'Flow not found' });
-    }
-
-    if (flowState.status !== 'COMPLETED') {
-      return res.status(400).json({ error: 'Flow not completed' });
-    }
-
-    res.json({ tokens: flowState.result });
-  } catch (error) {
-    logger.error('[MCP OAuth] Failed to get tokens', error);
-    res.status(500).json({ error: 'Failed to get tokens' });
-  }
-});
-
-/**
- * Check OAuth flow status
- * This endpoint can be used to poll the status of an OAuth flow
- */
-router.get('/oauth/status/:flowId', async (req, res) => {
-  try {
-    const { flowId } = req.params;
-    const flowsCache = getLogStores(CacheKeys.FLOWS);
-    const flowManager = getFlowStateManager(flowsCache);
-
-    const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
-    if (!flowState) {
-      return res.status(404).json({ error: 'Flow not found' });
-    }
-
-    res.json({
-      status: flowState.status,
-      completed: flowState.status === 'COMPLETED',
-      failed: flowState.status === 'FAILED',
-      error: flowState.error,
-    });
-  } catch (error) {
-    logger.error('[MCP OAuth] Failed to get flow status', error);
-    res.status(500).json({ error: 'Failed to get flow status' });
-  }
-});
-
-module.exports = router;

api/server/routes/oauth.js

@@ -1,7 +1,6 @@
 // file deepcode ignore NoRateLimitingForLogin: Rate limiting is handled by the `loginLimiter` middleware
 const express = require('express');
 const passport = require('passport');
-const { randomState } = require('openid-client');
 const {
   checkBan,
   logHeaders,
@@ -9,8 +8,7 @@ const {
   setBalanceConfig,
   checkDomainAllowed,
 } = require('~/server/middleware');
-const { syncUserEntraGroupMemberships } = require('~/server/services/PermissionService');
-const { setAuthTokens, setOpenIDAuthTokens } = require('~/server/services/AuthService');
+const { setAuthTokens, setOpenIDAuthTokens } = require('@librechat/auth');
 const { isEnabled } = require('~/server/utils');
 const { logger } = require('~/config');
 
@@ -36,7 +34,6 @@ const oauthHandler = async (req, res) => {
       req.user.provider == 'openid' &&
       isEnabled(process.env.OPENID_REUSE_TOKENS) === true
     ) {
-      await syncUserEntraGroupMemberships(req.user, req.user.tokenset.access_token);
       setOpenIDAuthTokens(req.user.tokenset, res);
     } else {
       await setAuthTokens(req.user._id, res);
@@ -49,9 +46,7 @@ const oauthHandler = async (req, res) => {
 
 router.get('/error', (req, res) => {
   // A single error message is pushed by passport when authentication fails.
-  logger.error('Error in OAuth authentication:', {
-    message: req.session?.messages?.pop() || 'Unknown error',
-  });
+  logger.error('Error in OAuth authentication:', { message: req.session.messages.pop() });
 
   // Redirect to login page with auth_failed parameter to prevent infinite redirect loops
   res.redirect(`${domains.client}/login?redirect=false`);
@@ -108,7 +103,8 @@ router.get(
 /**
  * OpenID Routes
  */
-router.get('/openid', (req, res, next) => {
+router.get('/openid', async (req, res, next) => {
+  const { randomState } = await import('openid-client');
   return passport.authenticate('openid', {
     session: false,
     state: randomState(),

api/server/routes/share.js

@@ -1,15 +1,15 @@
 const express = require('express');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
+
 const {
+  getSharedLink,
   getSharedMessages,
   createSharedLink,
   updateSharedLink,
-  deleteSharedLink,
   getSharedLinks,
-  getSharedLink,
-} = require('~/models');
+  deleteSharedLink,
+} = require('~/models/Share');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const { isEnabled } = require('~/server/utils');
 const router = express.Router();
 
 /**
@@ -35,7 +35,6 @@ if (allowSharedLinks) {
           res.status(404).end();
         }
       } catch (error) {
-        logger.error('Error getting shared messages:', error);
         res.status(500).json({ message: 'Error getting shared messages' });
       }
     },
@@ -55,7 +54,9 @@ router.get('/', requireJwtAuth, async (req, res) => {
       sortDirection: ['asc', 'desc'].includes(req.query.sortDirection)
         ? req.query.sortDirection
         : 'desc',
-      search: req.query.search ? decodeURIComponent(req.query.search.trim()) : undefined,
+      search: req.query.search
+        ? decodeURIComponent(req.query.search.trim())
+        : undefined,
     };
 
     const result = await getSharedLinks(
@@ -74,7 +75,7 @@ router.get('/', requireJwtAuth, async (req, res) => {
       hasNextPage: result.hasNextPage,
     });
   } catch (error) {
-    logger.error('Error getting shared links:', error);
+    console.error('Error getting shared links:', error);
     res.status(500).json({
       message: 'Error getting shared links',
       error: error.message,
@@ -92,7 +93,6 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
       conversationId: req.params.conversationId,
     });
   } catch (error) {
-    logger.error('Error getting shared link:', error);
     res.status(500).json({ message: 'Error getting shared link' });
   }
 });
@@ -106,7 +106,6 @@ router.post('/:conversationId', requireJwtAuth, async (req, res) => {
       res.status(404).end();
     }
   } catch (error) {
-    logger.error('Error creating shared link:', error);
     res.status(500).json({ message: 'Error creating shared link' });
   }
 });
@@ -120,7 +119,6 @@ router.patch('/:shareId', requireJwtAuth, async (req, res) => {
       res.status(404).end();
     }
   } catch (error) {
-    logger.error('Error updating shared link:', error);
     res.status(500).json({ message: 'Error updating shared link' });
   }
 });
@@ -135,8 +133,7 @@ router.delete('/:shareId', requireJwtAuth, async (req, res) => {
 
     return res.status(200).json(result);
   } catch (error) {
-    logger.error('Error deleting shared link:', error);
-    return res.status(400).json({ message: 'Error deleting shared link' });
+    return res.status(400).json({ message: error.message });
   }
 });
 

api/server/services/ActionService.js

@@ -3,13 +3,7 @@ const { nanoid } = require('nanoid');
 const { tool } = require('@langchain/core/tools');
 const { logger } = require('@librechat/data-schemas');
 const { GraphEvents, sleep } = require('@librechat/agents');
-const {
-  sendEvent,
-  encryptV2,
-  decryptV2,
-  logAxiosError,
-  refreshAccessToken,
-} = require('@librechat/api');
+const { sendEvent, logAxiosError } = require('@librechat/api');
 const {
   Time,
   CacheKeys,
@@ -20,11 +14,13 @@ const {
   isImageVisionTool,
   actionDomainSeparator,
 } = require('librechat-data-provider');
-const { findToken, updateToken, createToken } = require('~/models');
+const { refreshAccessToken } = require('~/server/services/TokenService');
+const { encryptV2, decryptV2 } = require('~/server/utils/crypto');
 const { getActions, deleteActions } = require('~/models/Action');
 const { deleteAssistant } = require('~/models/Assistant');
 const { getFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
+const { findToken } = require('~/models');
 
 const JWT_SECRET = process.env.JWT_SECRET;
 const toolNameRegex = /^[a-zA-Z0-9_-]+$/;
@@ -262,22 +258,15 @@ async function createActionTool({
               try {
                 const refresh_token = await decryptV2(refreshTokenData.token);
                 const refreshTokens = async () =>
-                  await refreshAccessToken(
-                    {
-                      userId,
-                      identifier,
-                      refresh_token,
-                      client_url: metadata.auth.client_url,
-                      encrypted_oauth_client_id: encrypted.oauth_client_id,
-                      token_exchange_method: metadata.auth.token_exchange_method,
-                      encrypted_oauth_client_secret: encrypted.oauth_client_secret,
-                    },
-                    {
-                      findToken,
-                      updateToken,
-                      createToken,
-                    },
-                  );
+                  await refreshAccessToken({
+                    userId,
+                    identifier,
+                    refresh_token,
+                    client_url: metadata.auth.client_url,
+                    encrypted_oauth_client_id: encrypted.oauth_client_id,
+                    token_exchange_method: metadata.auth.token_exchange_method,
+                    encrypted_oauth_client_secret: encrypted.oauth_client_secret,
+                  });
                 const flowsCache = getLogStores(CacheKeys.FLOWS);
                 const flowManager = getFlowStateManager(flowsCache);
                 const refreshData = await flowManager.createFlowWithHandler(

api/server/services/AppService.interface.spec.js

@@ -1,7 +1,5 @@
 jest.mock('~/models', () => ({
   initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
   updateAccessPermissions: jest.fn(),

api/server/services/AppService.js

@@ -1,6 +1,7 @@
 const {
   FileSources,
   loadOCRConfig,
+  processMCPEnv,
   EModelEndpoint,
   loadMemoryConfig,
   getConfigDefaults,
@@ -17,7 +18,6 @@ const {
 const { azureAssistantsDefaults, assistantsConfigSetup } = require('./start/assistants');
 const { initializeAzureBlobService } = require('./Files/Azure/initialize');
 const { initializeFirebase } = require('./Files/Firebase/initialize');
-const { seedDefaultRoles, initializeRoles, ensureDefaultCategories } = require('~/models');
 const loadCustomConfig = require('./Config/loadCustomConfig');
 const handleRateLimits = require('./Config/handleRateLimits');
 const { loadDefaultInterface } = require('./start/interface');
@@ -27,7 +27,8 @@ const { processModelSpecs } = require('./start/modelSpecs');
 const { initializeS3 } = require('./Files/S3/initialize');
 const { loadAndFormatTools } = require('./ToolService');
 const { isEnabled } = require('~/server/utils');
-const { setCachedTools } = require('./Config');
+const { initializeRoles } = require('~/models');
+const { getMCPManager } = require('~/config');
 const paths = require('~/config/paths');
 
 /**
@@ -37,8 +38,6 @@ const paths = require('~/config/paths');
  */
 const AppService = async (app) => {
   await initializeRoles();
-  await seedDefaultRoles();
-  await ensureDefaultCategories();
   /** @type {TCustomConfig} */
   const config = (await loadCustomConfig()) ?? {};
   const configDefaults = getConfigDefaults();
@@ -77,10 +76,11 @@ const AppService = async (app) => {
     directory: paths.structuredTools,
   });
 
-  await setCachedTools(availableTools, { isGlobal: true });
-
-  // Store MCP config for later initialization
-  const mcpConfig = config.mcpServers || null;
+  if (config.mcpServers != null) {
+    const mcpManager = getMCPManager();
+    await mcpManager.initializeMCP(config.mcpServers, processMCPEnv);
+    await mcpManager.mapAvailableTools(availableTools);
+  }
 
   const socialLogins =
     config?.registration?.socialLogins ?? configDefaults?.registration?.socialLogins;
@@ -96,11 +96,11 @@ const AppService = async (app) => {
     socialLogins,
     filteredTools,
     includedTools,
+    availableTools,
     imageOutputType,
     interfaceConfig,
     turnstileConfig,
     balance,
-    mcpConfig,
   };
 
   const agentsDefaults = agentsConfigSetup(config);

api/server/services/AppService.spec.js

@@ -28,31 +28,10 @@ jest.mock('./Files/Firebase/initialize', () => ({
 }));
 jest.mock('~/models', () => ({
   initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
   updateAccessPermissions: jest.fn(),
 }));
-jest.mock('./Config', () => ({
-  setCachedTools: jest.fn(),
-  getCachedTools: jest.fn().mockResolvedValue({
-    ExampleTool: {
-      type: 'function',
-      function: {
-        description: 'Example tool function',
-        name: 'exampleFunction',
-        parameters: {
-          type: 'object',
-          properties: {
-            param1: { type: 'string', description: 'An example parameter' },
-          },
-          required: ['param1'],
-        },
-      },
-    },
-  }),
-}));
 jest.mock('./ToolService', () => ({
   loadAndFormatTools: jest.fn().mockReturnValue({
     ExampleTool: {
@@ -142,9 +121,22 @@ describe('AppService', () => {
         sidePanel: true,
         presets: true,
       }),
-      mcpConfig: null,
       turnstileConfig: mockedTurnstileConfig,
       modelSpecs: undefined,
+      availableTools: {
+        ExampleTool: {
+          type: 'function',
+          function: expect.objectContaining({
+            description: 'Example tool function',
+            name: 'exampleFunction',
+            parameters: expect.objectContaining({
+              type: 'object',
+              properties: expect.any(Object),
+              required: expect.arrayContaining(['param1']),
+            }),
+          }),
+        },
+      },
       paths: expect.anything(),
       ocr: expect.anything(),
       imageOutputType: expect.any(String),
@@ -231,41 +223,14 @@ describe('AppService', () => {
 
   it('should load and format tools accurately with defined structure', async () => {
     const { loadAndFormatTools } = require('./ToolService');
-    const { setCachedTools, getCachedTools } = require('./Config');
-
     await AppService(app);
 
     expect(loadAndFormatTools).toHaveBeenCalledWith({
-      adminFilter: undefined,
-      adminIncluded: undefined,
       directory: expect.anything(),
     });
 
-    // Verify setCachedTools was called with the tools
-    expect(setCachedTools).toHaveBeenCalledWith(
-      {
-        ExampleTool: {
-          type: 'function',
-          function: {
-            description: 'Example tool function',
-            name: 'exampleFunction',
-            parameters: {
-              type: 'object',
-              properties: {
-                param1: { type: 'string', description: 'An example parameter' },
-              },
-              required: ['param1'],
-            },
-          },
-        },
-      },
-      { isGlobal: true },
-    );
-
-    // Verify we can retrieve the tools from cache
-    const cachedTools = await getCachedTools({ includeGlobal: true });
-    expect(cachedTools.ExampleTool).toBeDefined();
-    expect(cachedTools.ExampleTool).toEqual({
+    expect(app.locals.availableTools.ExampleTool).toBeDefined();
+    expect(app.locals.availableTools.ExampleTool).toEqual({
       type: 'function',
       function: {
         description: 'Example tool function',
@@ -570,6 +535,7 @@ describe('AppService updating app.locals and issuing warnings', () => {
 
     expect(app.locals).toBeDefined();
     expect(app.locals.paths).toBeDefined();
+    expect(app.locals.availableTools).toBeDefined();
     expect(app.locals.fileStrategy).toEqual(FileSources.local);
     expect(app.locals.socialLogins).toEqual(defaultSocialLogins);
     expect(app.locals.balance).toEqual(
@@ -602,6 +568,7 @@ describe('AppService updating app.locals and issuing warnings', () => {
 
     expect(app.locals).toBeDefined();
     expect(app.locals.paths).toBeDefined();
+    expect(app.locals.availableTools).toBeDefined();
     expect(app.locals.fileStrategy).toEqual(customConfig.fileStrategy);
     expect(app.locals.socialLogins).toEqual(customConfig.registration.socialLogins);
     expect(app.locals.balance).toEqual(customConfig.balance);

api/server/services/AuthService.js

@@ -1,512 +0,0 @@
-const bcrypt = require('bcryptjs');
-const { webcrypto } = require('node:crypto');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { SystemRoles, errorsToString } = require('librechat-data-provider');
-const {
-  findUser,
-  createUser,
-  updateUser,
-  findToken,
-  countUsers,
-  getUserById,
-  findSession,
-  createToken,
-  deleteTokens,
-  deleteSession,
-  createSession,
-  generateToken,
-  deleteUserById,
-  generateRefreshToken,
-} = require('~/models');
-const { isEmailDomainAllowed } = require('~/server/services/domains');
-const { checkEmailConfig, sendEmail } = require('~/server/utils');
-const { getBalanceConfig } = require('~/server/services/Config');
-const { registerSchema } = require('~/strategies/validators');
-
-const domains = {
-  client: process.env.DOMAIN_CLIENT,
-  server: process.env.DOMAIN_SERVER,
-};
-
-const isProduction = process.env.NODE_ENV === 'production';
-const genericVerificationMessage = 'Please check your email to verify your email address.';
-
-/**
- * Logout user
- *
- * @param {ServerRequest} req
- * @param {string} refreshToken
- * @returns
- */
-const logoutUser = async (req, refreshToken) => {
-  try {
-    const userId = req.user._id;
-    const session = await findSession({ userId: userId, refreshToken });
-
-    if (session) {
-      try {
-        await deleteSession({ sessionId: session._id });
-      } catch (deleteErr) {
-        logger.error('[logoutUser] Failed to delete session.', deleteErr);
-        return { status: 500, message: 'Failed to delete session.' };
-      }
-    }
-
-    try {
-      req.session.destroy();
-    } catch (destroyErr) {
-      logger.debug('[logoutUser] Failed to destroy session.', destroyErr);
-    }
-
-    return { status: 200, message: 'Logout successful' };
-  } catch (err) {
-    return { status: 500, message: err.message };
-  }
-};
-
-/**
- * Creates Token and corresponding Hash for verification
- * @returns {[string, string]}
- */
-const createTokenHash = () => {
-  const token = Buffer.from(webcrypto.getRandomValues(new Uint8Array(32))).toString('hex');
-  const hash = bcrypt.hashSync(token, 10);
-  return [token, hash];
-};
-
-/**
- * Send Verification Email
- * @param {Partial<MongoUser> & { _id: ObjectId, email: string, name: string}} user
- * @returns {Promise<void>}
- */
-const sendVerificationEmail = async (user) => {
-  const [verifyToken, hash] = createTokenHash();
-
-  const verificationLink = `${
-    domains.client
-  }/verify?token=${verifyToken}&email=${encodeURIComponent(user.email)}`;
-  await sendEmail({
-    email: user.email,
-    subject: 'Verify your email',
-    payload: {
-      appName: process.env.APP_TITLE || 'LibreChat',
-      name: user.name || user.username || user.email,
-      verificationLink: verificationLink,
-      year: new Date().getFullYear(),
-    },
-    template: 'verifyEmail.handlebars',
-  });
-
-  await createToken({
-    userId: user._id,
-    email: user.email,
-    token: hash,
-    createdAt: Date.now(),
-    expiresIn: 900,
-  });
-
-  logger.info(`[sendVerificationEmail] Verification link issued. [Email: ${user.email}]`);
-};
-
-/**
- * Verify Email
- * @param {Express.Request} req
- */
-const verifyEmail = async (req) => {
-  const { email, token } = req.body;
-  const decodedEmail = decodeURIComponent(email);
-
-  const user = await findUser({ email: decodedEmail }, 'email _id emailVerified');
-
-  if (!user) {
-    logger.warn(`[verifyEmail] [User not found] [Email: ${decodedEmail}]`);
-    return new Error('User not found');
-  }
-
-  if (user.emailVerified) {
-    logger.info(`[verifyEmail] Email already verified [Email: ${decodedEmail}]`);
-    return { message: 'Email already verified', status: 'success' };
-  }
-
-  let emailVerificationData = await findToken({ email: decodedEmail });
-
-  if (!emailVerificationData) {
-    logger.warn(`[verifyEmail] [No email verification data found] [Email: ${decodedEmail}]`);
-    return new Error('Invalid or expired password reset token');
-  }
-
-  const isValid = bcrypt.compareSync(token, emailVerificationData.token);
-
-  if (!isValid) {
-    logger.warn(
-      `[verifyEmail] [Invalid or expired email verification token] [Email: ${decodedEmail}]`,
-    );
-    return new Error('Invalid or expired email verification token');
-  }
-
-  const updatedUser = await updateUser(emailVerificationData.userId, { emailVerified: true });
-
-  if (!updatedUser) {
-    logger.warn(`[verifyEmail] [User update failed] [Email: ${decodedEmail}]`);
-    return new Error('Failed to update user verification status');
-  }
-
-  await deleteTokens({ token: emailVerificationData.token });
-  logger.info(`[verifyEmail] Email verification successful [Email: ${decodedEmail}]`);
-  return { message: 'Email verification was successful', status: 'success' };
-};
-
-/**
- * Register a new user.
- * @param {MongoUser} user <email, password, name, username>
- * @param {Partial<MongoUser>} [additionalData={}]
- * @returns {Promise<{status: number, message: string, user?: MongoUser}>}
- */
-const registerUser = async (user, additionalData = {}) => {
-  const { error } = registerSchema.safeParse(user);
-  if (error) {
-    const errorMessage = errorsToString(error.errors);
-    logger.info(
-      'Route: register - Validation Error',
-      { name: 'Request params:', value: user },
-      { name: 'Validation error:', value: errorMessage },
-    );
-
-    return { status: 404, message: errorMessage };
-  }
-
-  const { email, password, name, username } = user;
-
-  let newUserId;
-  try {
-    const existingUser = await findUser({ email }, 'email _id');
-
-    if (existingUser) {
-      logger.info(
-        'Register User - Email in use',
-        { name: 'Request params:', value: user },
-        { name: 'Existing user:', value: existingUser },
-      );
-
-      // Sleep for 1 second
-      await new Promise((resolve) => setTimeout(resolve, 1000));
-      return { status: 200, message: genericVerificationMessage };
-    }
-
-    if (!(await isEmailDomainAllowed(email))) {
-      const errorMessage =
-        'The email address provided cannot be used. Please use a different email address.';
-      logger.error(`[registerUser] [Registration not allowed] [Email: ${user.email}]`);
-      return { status: 403, message: errorMessage };
-    }
-
-    //determine if this is the first registered user (not counting anonymous_user)
-    const isFirstRegisteredUser = (await countUsers()) === 0;
-
-    const salt = bcrypt.genSaltSync(10);
-    const newUserData = {
-      provider: 'local',
-      email,
-      username,
-      name,
-      avatar: null,
-      role: isFirstRegisteredUser ? SystemRoles.ADMIN : SystemRoles.USER,
-      password: bcrypt.hashSync(password, salt),
-      ...additionalData,
-    };
-
-    const emailEnabled = checkEmailConfig();
-    const disableTTL = isEnabled(process.env.ALLOW_UNVERIFIED_EMAIL_LOGIN);
-    const balanceConfig = await getBalanceConfig();
-
-    const newUser = await createUser(newUserData, balanceConfig, disableTTL, true);
-    newUserId = newUser._id;
-    if (emailEnabled && !newUser.emailVerified) {
-      await sendVerificationEmail({
-        _id: newUserId,
-        email,
-        name,
-      });
-    } else {
-      await updateUser(newUserId, { emailVerified: true });
-    }
-
-    return { status: 200, message: genericVerificationMessage };
-  } catch (err) {
-    logger.error('[registerUser] Error in registering user:', err);
-    if (newUserId) {
-      const result = await deleteUserById(newUserId);
-      logger.warn(
-        `[registerUser] [Email: ${email}] [Temporary User deleted: ${JSON.stringify(result)}]`,
-      );
-    }
-    return { status: 500, message: 'Something went wrong' };
-  }
-};
-
-/**
- * Request password reset
- * @param {Express.Request} req
- */
-const requestPasswordReset = async (req) => {
-  const { email } = req.body;
-  const user = await findUser({ email }, 'email _id');
-  const emailEnabled = checkEmailConfig();
-
-  logger.warn(`[requestPasswordReset] [Password reset request initiated] [Email: ${email}]`);
-
-  if (!user) {
-    logger.warn(`[requestPasswordReset] [No user found] [Email: ${email}] [IP: ${req.ip}]`);
-    return {
-      message: 'If an account with that email exists, a password reset link has been sent to it.',
-    };
-  }
-
-  await deleteTokens({ userId: user._id });
-
-  const [resetToken, hash] = createTokenHash();
-
-  await createToken({
-    userId: user._id,
-    token: hash,
-    createdAt: Date.now(),
-    expiresIn: 900,
-  });
-
-  const link = `${domains.client}/reset-password?token=${resetToken}&userId=${user._id}`;
-
-  if (emailEnabled) {
-    await sendEmail({
-      email: user.email,
-      subject: 'Password Reset Request',
-      payload: {
-        appName: process.env.APP_TITLE || 'LibreChat',
-        name: user.name || user.username || user.email,
-        link: link,
-        year: new Date().getFullYear(),
-      },
-      template: 'requestPasswordReset.handlebars',
-    });
-    logger.info(
-      `[requestPasswordReset] Link emailed. [Email: ${email}] [ID: ${user._id}] [IP: ${req.ip}]`,
-    );
-  } else {
-    logger.info(
-      `[requestPasswordReset] Link issued. [Email: ${email}] [ID: ${user._id}] [IP: ${req.ip}]`,
-    );
-    return { link };
-  }
-
-  return {
-    message: 'If an account with that email exists, a password reset link has been sent to it.',
-  };
-};
-
-/**
- * Reset Password
- *
- * @param {*} userId
- * @param {String} token
- * @param {String} password
- * @returns
- */
-const resetPassword = async (userId, token, password) => {
-  let passwordResetToken = await findToken({
-    userId,
-  });
-
-  if (!passwordResetToken) {
-    return new Error('Invalid or expired password reset token');
-  }
-
-  const isValid = bcrypt.compareSync(token, passwordResetToken.token);
-
-  if (!isValid) {
-    return new Error('Invalid or expired password reset token');
-  }
-
-  const hash = bcrypt.hashSync(password, 10);
-  const user = await updateUser(userId, { password: hash });
-
-  if (checkEmailConfig()) {
-    await sendEmail({
-      email: user.email,
-      subject: 'Password Reset Successfully',
-      payload: {
-        appName: process.env.APP_TITLE || 'LibreChat',
-        name: user.name || user.username || user.email,
-        year: new Date().getFullYear(),
-      },
-      template: 'passwordReset.handlebars',
-    });
-  }
-
-  await deleteTokens({ token: passwordResetToken.token });
-  logger.info(`[resetPassword] Password reset successful. [Email: ${user.email}]`);
-  return { message: 'Password reset was successful' };
-};
-
-/**
- * Set Auth Tokens
- *
- * @param {String | ObjectId} userId
- * @param {Object} res
- * @param {String} sessionId
- * @returns
- */
-const setAuthTokens = async (userId, res, sessionId = null) => {
-  try {
-    const user = await getUserById(userId);
-    const token = await generateToken(user);
-
-    let session;
-    let refreshToken;
-    let refreshTokenExpires;
-
-    if (sessionId) {
-      session = await findSession({ sessionId: sessionId }, { lean: false });
-      refreshTokenExpires = session.expiration.getTime();
-      refreshToken = await generateRefreshToken(session);
-    } else {
-      const result = await createSession(userId);
-      session = result.session;
-      refreshToken = result.refreshToken;
-      refreshTokenExpires = session.expiration.getTime();
-    }
-
-    res.cookie('refreshToken', refreshToken, {
-      expires: new Date(refreshTokenExpires),
-      httpOnly: true,
-      secure: isProduction,
-      sameSite: 'strict',
-    });
-    res.cookie('token_provider', 'librechat', {
-      expires: new Date(refreshTokenExpires),
-      httpOnly: true,
-      secure: isProduction,
-      sameSite: 'strict',
-    });
-    return token;
-  } catch (error) {
-    logger.error('[setAuthTokens] Error in setting authentication tokens:', error);
-    throw error;
-  }
-};
-
-/**
- * @function setOpenIDAuthTokens
- * Set OpenID Authentication Tokens
- * //type tokenset from openid-client
- * @param {import('openid-client').TokenEndpointResponse & import('openid-client').TokenEndpointResponseHelpers} tokenset
- * - The tokenset object containing access and refresh tokens
- * @param {Object} res - response object
- * @returns {String} - access token
- */
-const setOpenIDAuthTokens = (tokenset, res) => {
-  try {
-    if (!tokenset) {
-      logger.error('[setOpenIDAuthTokens] No tokenset found in request');
-      return;
-    }
-    const { REFRESH_TOKEN_EXPIRY } = process.env ?? {};
-    const expiryInMilliseconds = REFRESH_TOKEN_EXPIRY
-      ? eval(REFRESH_TOKEN_EXPIRY)
-      : 1000 * 60 * 60 * 24 * 7; // 7 days default
-    const expirationDate = new Date(Date.now() + expiryInMilliseconds);
-    if (tokenset == null) {
-      logger.error('[setOpenIDAuthTokens] No tokenset found in request');
-      return;
-    }
-    if (!tokenset.access_token || !tokenset.refresh_token) {
-      logger.error('[setOpenIDAuthTokens] No access or refresh token found in tokenset');
-      return;
-    }
-    res.cookie('refreshToken', tokenset.refresh_token, {
-      expires: expirationDate,
-      httpOnly: true,
-      secure: isProduction,
-      sameSite: 'strict',
-    });
-    res.cookie('token_provider', 'openid', {
-      expires: expirationDate,
-      httpOnly: true,
-      secure: isProduction,
-      sameSite: 'strict',
-    });
-    return tokenset.access_token;
-  } catch (error) {
-    logger.error('[setOpenIDAuthTokens] Error in setting authentication tokens:', error);
-    throw error;
-  }
-};
-
-/**
- * Resend Verification Email
- * @param {Object} req
- * @param {Object} req.body
- * @param {String} req.body.email
- * @returns {Promise<{status: number, message: string}>}
- */
-const resendVerificationEmail = async (req) => {
-  try {
-    const { email } = req.body;
-    await deleteTokens(email);
-    const user = await findUser({ email }, 'email _id name');
-
-    if (!user) {
-      logger.warn(`[resendVerificationEmail] [No user found] [Email: ${email}]`);
-      return { status: 200, message: genericVerificationMessage };
-    }
-
-    const [verifyToken, hash] = createTokenHash();
-
-    const verificationLink = `${
-      domains.client
-    }/verify?token=${verifyToken}&email=${encodeURIComponent(user.email)}`;
-
-    await sendEmail({
-      email: user.email,
-      subject: 'Verify your email',
-      payload: {
-        appName: process.env.APP_TITLE || 'LibreChat',
-        name: user.name || user.username || user.email,
-        verificationLink: verificationLink,
-        year: new Date().getFullYear(),
-      },
-      template: 'verifyEmail.handlebars',
-    });
-
-    await createToken({
-      userId: user._id,
-      email: user.email,
-      token: hash,
-      createdAt: Date.now(),
-      expiresIn: 900,
-    });
-
-    logger.info(`[resendVerificationEmail] Verification link issued. [Email: ${user.email}]`);
-
-    return {
-      status: 200,
-      message: genericVerificationMessage,
-    };
-  } catch (error) {
-    logger.error(`[resendVerificationEmail] Error resending verification email: ${error.message}`);
-    return {
-      status: 500,
-      message: 'Something went wrong.',
-    };
-  }
-};
-
-module.exports = {
-  logoutUser,
-  verifyEmail,
-  registerUser,
-  setAuthTokens,
-  resetPassword,
-  requestPasswordReset,
-  resendVerificationEmail,
-  setOpenIDAuthTokens,
-};

api/server/services/Config/getCachedTools.js

@@ -1,258 +0,0 @@
-const { CacheKeys } = require('librechat-data-provider');
-const getLogStores = require('~/cache/getLogStores');
-
-/**
- * Cache key generators for different tool access patterns
- * These will support future permission-based caching
- */
-const ToolCacheKeys = {
-  /** Global tools available to all users */
-  GLOBAL: 'tools:global',
-  /** Tools available to a specific user */
-  USER: (userId) => `tools:user:${userId}`,
-  /** Tools available to a specific role */
-  ROLE: (roleId) => `tools:role:${roleId}`,
-  /** Tools available to a specific group */
-  GROUP: (groupId) => `tools:group:${groupId}`,
-  /** Combined effective tools for a user (computed from all sources) */
-  EFFECTIVE: (userId) => `tools:effective:${userId}`,
-};
-
-/**
- * Retrieves available tools from cache
- * @function getCachedTools
- * @param {Object} options - Options for retrieving tools
- * @param {string} [options.userId] - User ID for user-specific tools
- * @param {string[]} [options.roleIds] - Role IDs for role-based tools
- * @param {string[]} [options.groupIds] - Group IDs for group-based tools
- * @param {boolean} [options.includeGlobal=true] - Whether to include global tools
- * @returns {Promise<Object|null>} The available tools object or null if not cached
- */
-async function getCachedTools(options = {}) {
-  const cache = getLogStores(CacheKeys.CONFIG_STORE);
-  const { userId, roleIds = [], groupIds = [], includeGlobal = true } = options;
-
-  // For now, return global tools (current behavior)
-  // This will be expanded to merge tools from different sources
-  if (!userId && includeGlobal) {
-    return await cache.get(ToolCacheKeys.GLOBAL);
-  }
-
-  // Future implementation will merge tools from multiple sources
-  // based on user permissions, roles, and groups
-  if (userId) {
-    // Check if we have pre-computed effective tools for this user
-    const effectiveTools = await cache.get(ToolCacheKeys.EFFECTIVE(userId));
-    if (effectiveTools) {
-      return effectiveTools;
-    }
-
-    // Otherwise, compute from individual sources
-    const toolSources = [];
-
-    if (includeGlobal) {
-      const globalTools = await cache.get(ToolCacheKeys.GLOBAL);
-      if (globalTools) {
-        toolSources.push(globalTools);
-      }
-    }
-
-    // User-specific tools
-    const userTools = await cache.get(ToolCacheKeys.USER(userId));
-    if (userTools) {
-      toolSources.push(userTools);
-    }
-
-    // Role-based tools
-    for (const roleId of roleIds) {
-      const roleTools = await cache.get(ToolCacheKeys.ROLE(roleId));
-      if (roleTools) {
-        toolSources.push(roleTools);
-      }
-    }
-
-    // Group-based tools
-    for (const groupId of groupIds) {
-      const groupTools = await cache.get(ToolCacheKeys.GROUP(groupId));
-      if (groupTools) {
-        toolSources.push(groupTools);
-      }
-    }
-
-    // Merge all tool sources (for now, simple merge - future will handle conflicts)
-    if (toolSources.length > 0) {
-      return mergeToolSources(toolSources);
-    }
-  }
-
-  return null;
-}
-
-/**
- * Sets available tools in cache
- * @function setCachedTools
- * @param {Object} tools - The tools object to cache
- * @param {Object} options - Options for caching tools
- * @param {string} [options.userId] - User ID for user-specific tools
- * @param {string} [options.roleId] - Role ID for role-based tools
- * @param {string} [options.groupId] - Group ID for group-based tools
- * @param {boolean} [options.isGlobal=false] - Whether these are global tools
- * @param {number} [options.ttl] - Time to live in milliseconds
- * @returns {Promise<boolean>} Whether the operation was successful
- */
-async function setCachedTools(tools, options = {}) {
-  const cache = getLogStores(CacheKeys.CONFIG_STORE);
-  const { userId, roleId, groupId, isGlobal = false, ttl } = options;
-
-  let cacheKey;
-  if (isGlobal || (!userId && !roleId && !groupId)) {
-    cacheKey = ToolCacheKeys.GLOBAL;
-  } else if (userId) {
-    cacheKey = ToolCacheKeys.USER(userId);
-  } else if (roleId) {
-    cacheKey = ToolCacheKeys.ROLE(roleId);
-  } else if (groupId) {
-    cacheKey = ToolCacheKeys.GROUP(groupId);
-  }
-
-  if (!cacheKey) {
-    throw new Error('Invalid cache key options provided');
-  }
-
-  return await cache.set(cacheKey, tools, ttl);
-}
-
-/**
- * Invalidates cached tools
- * @function invalidateCachedTools
- * @param {Object} options - Options for invalidating tools
- * @param {string} [options.userId] - User ID to invalidate
- * @param {string} [options.roleId] - Role ID to invalidate
- * @param {string} [options.groupId] - Group ID to invalidate
- * @param {boolean} [options.invalidateGlobal=false] - Whether to invalidate global tools
- * @param {boolean} [options.invalidateEffective=true] - Whether to invalidate effective tools
- * @returns {Promise<void>}
- */
-async function invalidateCachedTools(options = {}) {
-  const cache = getLogStores(CacheKeys.CONFIG_STORE);
-  const { userId, roleId, groupId, invalidateGlobal = false, invalidateEffective = true } = options;
-
-  const keysToDelete = [];
-
-  if (invalidateGlobal) {
-    keysToDelete.push(ToolCacheKeys.GLOBAL);
-  }
-
-  if (userId) {
-    keysToDelete.push(ToolCacheKeys.USER(userId));
-    if (invalidateEffective) {
-      keysToDelete.push(ToolCacheKeys.EFFECTIVE(userId));
-    }
-  }
-
-  if (roleId) {
-    keysToDelete.push(ToolCacheKeys.ROLE(roleId));
-    // TODO: In future, invalidate all users with this role
-  }
-
-  if (groupId) {
-    keysToDelete.push(ToolCacheKeys.GROUP(groupId));
-    // TODO: In future, invalidate all users in this group
-  }
-
-  await Promise.all(keysToDelete.map((key) => cache.delete(key)));
-}
-
-/**
- * Computes and caches effective tools for a user
- * @function computeEffectiveTools
- * @param {string} userId - The user ID
- * @param {Object} context - Context containing user's roles and groups
- * @param {string[]} [context.roleIds=[]] - User's role IDs
- * @param {string[]} [context.groupIds=[]] - User's group IDs
- * @param {number} [ttl] - Time to live for the computed result
- * @returns {Promise<Object>} The computed effective tools
- */
-async function computeEffectiveTools(userId, context = {}, ttl) {
-  const { roleIds = [], groupIds = [] } = context;
-
-  // Get all tool sources
-  const tools = await getCachedTools({
-    userId,
-    roleIds,
-    groupIds,
-    includeGlobal: true,
-  });
-
-  if (tools) {
-    // Cache the computed result
-    const cache = getLogStores(CacheKeys.CONFIG_STORE);
-    await cache.set(ToolCacheKeys.EFFECTIVE(userId), tools, ttl);
-  }
-
-  return tools;
-}
-
-/**
- * Merges multiple tool sources into a single tools object
- * @function mergeToolSources
- * @param {Object[]} sources - Array of tool objects to merge
- * @returns {Object} Merged tools object
- */
-function mergeToolSources(sources) {
-  // For now, simple merge that combines all tools
-  // Future implementation will handle:
-  // - Permission precedence (deny > allow)
-  // - Tool property conflicts
-  // - Metadata merging
-  const merged = {};
-
-  for (const source of sources) {
-    if (!source || typeof source !== 'object') {
-      continue;
-    }
-
-    for (const [toolId, toolConfig] of Object.entries(source)) {
-      // Simple last-write-wins for now
-      // Future: merge based on permission levels
-      merged[toolId] = toolConfig;
-    }
-  }
-
-  return merged;
-}
-
-/**
- * Middleware-friendly function to get tools for a request
- * @function getToolsForRequest
- * @param {Object} req - Express request object
- * @returns {Promise<Object|null>} Available tools for the request
- */
-async function getToolsForRequest(req) {
-  const userId = req.user?.id;
-
-  // For now, return global tools if no user
-  if (!userId) {
-    return getCachedTools({ includeGlobal: true });
-  }
-
-  // Future: Extract roles and groups from req.user
-  const roleIds = req.user?.roles || [];
-  const groupIds = req.user?.groups || [];
-
-  return getCachedTools({
-    userId,
-    roleIds,
-    groupIds,
-    includeGlobal: true,
-  });
-}
-
-module.exports = {
-  ToolCacheKeys,
-  getCachedTools,
-  setCachedTools,
-  getToolsForRequest,
-  invalidateCachedTools,
-  computeEffectiveTools,
-};

api/server/services/Config/getCustomConfig.js

@@ -1,10 +1,6 @@
-const { logger } = require('@librechat/data-schemas');
-const { getUserMCPAuthMap } = require('@librechat/api');
 const { CacheKeys, EModelEndpoint } = require('librechat-data-provider');
 const { normalizeEndpointName, isEnabled } = require('~/server/utils');
 const loadCustomConfig = require('./loadCustomConfig');
-const { getCachedTools } = require('./getCachedTools');
-const { findPluginAuthsByKeys } = require('~/models');
 const getLogStores = require('~/cache/getLogStores');
 
 /**
@@ -54,46 +50,4 @@ const getCustomEndpointConfig = async (endpoint) => {
   );
 };
 
-async function createGetMCPAuthMap() {
-  const customConfig = await getCustomConfig();
-  const mcpServers = customConfig?.mcpServers;
-  const hasCustomUserVars = Object.values(mcpServers ?? {}).some((server) => server.customUserVars);
-  if (!hasCustomUserVars) {
-    return;
-  }
-
-  /**
-   * @param {Object} params
-   * @param {GenericTool[]} [params.tools]
-   * @param {string} params.userId
-   * @returns {Promise<Record<string, Record<string, string>> | undefined>}
-   */
-  return async function ({ tools, userId }) {
-    try {
-      if (!tools || tools.length === 0) {
-        return;
-      }
-      const appTools = await getCachedTools({
-        userId,
-      });
-      return await getUserMCPAuthMap({
-        tools,
-        userId,
-        appTools,
-        findPluginAuthsByKeys,
-      });
-    } catch (err) {
-      logger.error(
-        `[api/server/controllers/agents/client.js #chatCompletion] Error getting custom user vars for agent`,
-        err,
-      );
-    }
-  };
-}
-
-module.exports = {
-  getCustomConfig,
-  getBalanceConfig,
-  createGetMCPAuthMap,
-  getCustomEndpointConfig,
-};
+module.exports = { getCustomConfig, getBalanceConfig, getCustomEndpointConfig };

api/server/services/Config/index.js

@@ -1,5 +1,4 @@
 const { config } = require('./EndpointService');
-const getCachedTools = require('./getCachedTools');
 const getCustomConfig = require('./getCustomConfig');
 const loadCustomConfig = require('./loadCustomConfig');
 const loadConfigModels = require('./loadConfigModels');
@@ -15,7 +14,6 @@ module.exports = {
   loadDefaultModels,
   loadOverrideConfig,
   loadAsyncEndpoints,
-  ...getCachedTools,
   ...getCustomConfig,
   ...getEndpointsConfig,
 };

api/server/services/Endpoints/agents/agent.js

@@ -1,9 +1,5 @@
 const { Providers } = require('@librechat/agents');
-const {
-  primeResources,
-  extractLibreChatParams,
-  optionalChainWithEmptyCheck,
-} = require('@librechat/api');
+const { primeResources, optionalChainWithEmptyCheck } = require('@librechat/api');
 const {
   ErrorTypes,
   EModelEndpoint,
@@ -19,9 +15,10 @@ const initGoogle = require('~/server/services/Endpoints/google/initialize');
 const generateArtifactsPrompt = require('~/app/clients/prompts/artifacts');
 const { getCustomEndpointConfig } = require('~/server/services/Config');
 const { processFiles } = require('~/server/services/Files/process');
-const { getFiles, getToolFilesByIds } = require('~/models/File');
 const { getConvoFiles } = require('~/models/Conversation');
+const { getToolFilesByIds } = require('~/models/File');
 const { getModelMaxTokens } = require('~/utils');
+const { getFiles } = require('~/models/File');
 
 const providerConfigMap = {
   [Providers.XAI]: initCustom,
@@ -66,17 +63,11 @@ const initializeAgent = async ({
   }
   let currentFiles;
 
-  const _modelOptions = structuredClone(
-    Object.assign(
-      { model: agent.model },
-      agent.model_parameters ?? { model: agent.model },
-      isInitialAgent === true ? endpointOption?.model_parameters : {},
-    ),
-  );
-
-  const { resendFiles, maxContextTokens, modelOptions } = extractLibreChatParams(_modelOptions);
-
-  if (isInitialAgent && conversationId != null && resendFiles) {
+  if (
+    isInitialAgent &&
+    conversationId != null &&
+    (agent.model_parameters?.resendFiles ?? true) === true
+  ) {
     const fileIds = (await getConvoFiles(conversationId)) ?? [];
     /** @type {Set<EToolResources>} */
     const toolResourceSet = new Set();
@@ -126,11 +117,15 @@ const initializeAgent = async ({
     getOptions = initCustom;
     agent.provider = Providers.OPENAI;
   }
-
+  const model_parameters = Object.assign(
+    {},
+    agent.model_parameters ?? { model: agent.model },
+    isInitialAgent === true ? endpointOption?.model_parameters : {},
+  );
   const _endpointOption =
     isInitialAgent === true
-      ? Object.assign({}, endpointOption, { model_parameters: modelOptions })
-      : { model_parameters: modelOptions };
+      ? Object.assign({}, endpointOption, { model_parameters })
+      : { model_parameters };
 
   const options = await getOptions({
     req,
@@ -141,19 +136,6 @@ const initializeAgent = async ({
     endpointOption: _endpointOption,
   });
 
-  const tokensModel =
-    agent.provider === EModelEndpoint.azureOpenAI ? agent.model : modelOptions.model;
-  const maxTokens = optionalChainWithEmptyCheck(
-    modelOptions.maxOutputTokens,
-    modelOptions.maxTokens,
-    0,
-  );
-  const agentMaxContextTokens = optionalChainWithEmptyCheck(
-    maxContextTokens,
-    getModelMaxTokens(tokensModel, providerEndpointMap[provider]),
-    4096,
-  );
-
   if (
     agent.endpoint === EModelEndpoint.azureOpenAI &&
     options.llmConfig?.azureOpenAIApiInstanceName == null
@@ -166,11 +148,15 @@ const initializeAgent = async ({
   }
 
   /** @type {import('@librechat/agents').ClientOptions} */
-  agent.model_parameters = { ...options.llmConfig };
+  agent.model_parameters = Object.assign(model_parameters, options.llmConfig);
   if (options.configOptions) {
     agent.model_parameters.configuration = options.configOptions;
   }
 
+  if (!agent.model_parameters.model) {
+    agent.model_parameters.model = agent.model;
+  }
+
   if (agent.instructions && agent.instructions !== '') {
     agent.instructions = replaceSpecialVars({
       text: agent.instructions,
@@ -185,13 +171,25 @@ const initializeAgent = async ({
     });
   }
 
+  const tokensModel =
+    agent.provider === EModelEndpoint.azureOpenAI ? agent.model : agent.model_parameters.model;
+  const maxTokens = optionalChainWithEmptyCheck(
+    agent.model_parameters.maxOutputTokens,
+    agent.model_parameters.maxTokens,
+    0,
+  );
+  const maxContextTokens = optionalChainWithEmptyCheck(
+    agent.model_parameters.maxContextTokens,
+    agent.max_context_tokens,
+    getModelMaxTokens(tokensModel, providerEndpointMap[provider]),
+    4096,
+  );
   return {
     ...agent,
     tools,
     attachments,
-    resendFiles,
     toolContextMap,
-    maxContextTokens: (agentMaxContextTokens - maxTokens) * 0.9,
+    maxContextTokens: (maxContextTokens - maxTokens) * 0.9,
   };
 };
 

api/server/services/Endpoints/agents/build.js

@@ -1,9 +1,10 @@
-const { isAgentsEndpoint, removeNullishValues, Constants } = require('librechat-data-provider');
+const { isAgentsEndpoint, Constants } = require('librechat-data-provider');
 const { loadAgent } = require('~/models/Agent');
 const { logger } = require('~/config');
 
 const buildOptions = (req, endpoint, parsedBody, endpointType) => {
-  const { spec, iconURL, agent_id, instructions, ...model_parameters } = parsedBody;
+  const { spec, iconURL, agent_id, instructions, maxContextTokens, ...model_parameters } =
+    parsedBody;
   const agentPromise = loadAgent({
     req,
     agent_id: isAgentsEndpoint(endpoint) ? agent_id : Constants.EPHEMERAL_AGENT_ID,
@@ -14,16 +15,19 @@ const buildOptions = (req, endpoint, parsedBody, endpointType) => {
     return undefined;
   });
 
-  return removeNullishValues({
+  const endpointOption = {
     spec,
     iconURL,
     endpoint,
     agent_id,
     endpointType,
     instructions,
+    maxContextTokens,
     model_parameters,
     agent: agentPromise,
-  });
+  };
+
+  return endpointOption;
 };
 
 module.exports = { buildOptions };

api/server/services/Endpoints/agents/initialize.js

@@ -1,17 +1,11 @@
 const { logger } = require('@librechat/data-schemas');
 const { createContentAggregator } = require('@librechat/agents');
+const { Constants, EModelEndpoint, getResponseSender } = require('librechat-data-provider');
 const {
-  Constants,
-  EModelEndpoint,
-  isAgentsEndpoint,
-  getResponseSender,
-} = require('librechat-data-provider');
-const {
-  createToolEndCallback,
   getDefaultHandlers,
+  createToolEndCallback,
 } = require('~/server/controllers/agents/callbacks');
 const { initializeAgent } = require('~/server/services/Endpoints/agents/agent');
-const { getCustomEndpointConfig } = require('~/server/services/Config');
 const { loadAgentTools } = require('~/server/services/ToolService');
 const AgentClient = require('~/server/controllers/agents/client');
 const { getAgent } = require('~/models/Agent');
@@ -67,7 +61,6 @@ const initializeClient = async ({ req, res, endpointOption }) => {
   }
 
   const primaryAgent = await endpointOption.agent;
-  delete endpointOption.agent;
   if (!primaryAgent) {
     throw new Error('Agent not found');
   }
@@ -115,25 +108,11 @@ const initializeClient = async ({ req, res, endpointOption }) => {
     }
   }
 
-  let endpointConfig = req.app.locals[primaryConfig.endpoint];
-  if (!isAgentsEndpoint(primaryConfig.endpoint) && !endpointConfig) {
-    try {
-      endpointConfig = await getCustomEndpointConfig(primaryConfig.endpoint);
-    } catch (err) {
-      logger.error(
-        '[api/server/controllers/agents/client.js #titleConvo] Error getting custom endpoint config',
-        err,
-      );
-    }
-  }
-
   const sender =
     primaryAgent.name ??
     getResponseSender({
       ...endpointOption,
       model: endpointOption.model_parameters.model,
-      modelDisplayLabel: endpointConfig?.modelDisplayLabel,
-      modelLabel: endpointOption.model_parameters.modelLabel,
     });
 
   const client = new AgentClient({
@@ -151,8 +130,8 @@ const initializeClient = async ({ req, res, endpointOption }) => {
     iconURL: endpointOption.iconURL,
     attachments: primaryConfig.attachments,
     endpointType: endpointOption.endpointType,
-    resendFiles: primaryConfig.resendFiles ?? true,
     maxContextTokens: primaryConfig.maxContextTokens,
+    resendFiles: primaryConfig.model_parameters?.resendFiles ?? true,
     endpoint:
       primaryConfig.id === Constants.EPHEMERAL_AGENT_ID
         ? primaryConfig.endpoint

api/server/services/Endpoints/anthropic/llm.js

@@ -1,4 +1,4 @@
-const { ProxyAgent } = require('undici');
+const { HttpsProxyAgent } = require('https-proxy-agent');
 const { anthropicSettings, removeNullishValues } = require('librechat-data-provider');
 const { checkPromptCacheSupport, getClaudeHeaders, configureReasoning } = require('./helpers');
 
@@ -67,10 +67,7 @@ function getLLMConfig(apiKey, options = {}) {
   }
 
   if (options.proxy) {
-    const proxyAgent = new ProxyAgent(options.proxy);
-    requestOptions.clientOptions.fetchOptions = {
-      dispatcher: proxyAgent,
-    };
+    requestOptions.clientOptions.httpAgent = new HttpsProxyAgent(options.proxy);
   }
 
   if (options.reverseProxyUrl) {

api/server/services/Endpoints/anthropic/llm.spec.js

@@ -21,12 +21,8 @@ describe('getLLMConfig', () => {
       proxy: 'http://proxy:8080',
     });
 
-    expect(result.llmConfig.clientOptions).toHaveProperty('fetchOptions');
-    expect(result.llmConfig.clientOptions.fetchOptions).toHaveProperty('dispatcher');
-    expect(result.llmConfig.clientOptions.fetchOptions.dispatcher).toBeDefined();
-    expect(result.llmConfig.clientOptions.fetchOptions.dispatcher.constructor.name).toBe(
-      'ProxyAgent',
-    );
+    expect(result.llmConfig.clientOptions).toHaveProperty('httpAgent');
+    expect(result.llmConfig.clientOptions.httpAgent).toHaveProperty('proxy', 'http://proxy:8080');
   });
 
   it('should include reverse proxy URL when provided', () => {

api/server/services/Files/images/avatar.js

@@ -1,86 +0,0 @@
-const sharp = require('sharp');
-const fs = require('fs').promises;
-const fetch = require('node-fetch');
-const { EImageOutputType } = require('librechat-data-provider');
-const { resizeAndConvert } = require('./resize');
-const { logger } = require('~/config');
-
-/**
- * Uploads an avatar image for a user. This function can handle various types of input (URL, Buffer, or File object),
- * processes the image to a square format, converts it to target format, and returns the resized buffer.
- *
- * @param {Object} params - The parameters object.
- * @param {string} params.userId - The unique identifier of the user for whom the avatar is being uploaded.
- * @param {string} options.desiredFormat - The desired output format of the image.
- * @param {(string|Buffer|File)} params.input - The input representing the avatar image. Can be a URL (string),
- *                                               a Buffer, or a File object.
- *
- * @returns {Promise<any>}
- *          A promise that resolves to a resized buffer.
- *
- * @throws {Error} Throws an error if the user ID is undefined, the input type is invalid, the image fetching fails,
- *                 or any other error occurs during the processing.
- */
-async function resizeAvatar({ userId, input, desiredFormat = EImageOutputType.PNG }) {
-  try {
-    if (userId === undefined) {
-      throw new Error('User ID is undefined');
-    }
-
-    let imageBuffer;
-    if (typeof input === 'string') {
-      const response = await fetch(input);
-
-      if (!response.ok) {
-        throw new Error(`Failed to fetch image from URL. Status: ${response.status}`);
-      }
-      imageBuffer = await response.buffer();
-    } else if (input instanceof Buffer) {
-      imageBuffer = input;
-    } else if (typeof input === 'object' && input instanceof File) {
-      const fileContent = await fs.readFile(input.path);
-      imageBuffer = Buffer.from(fileContent);
-    } else {
-      throw new Error('Invalid input type. Expected URL, Buffer, or File.');
-    }
-
-    const metadata = await sharp(imageBuffer).metadata();
-    const { width, height } = metadata;
-    const minSize = Math.min(width, height);
-
-    if (metadata.format === 'gif') {
-      const resizedBuffer = await sharp(imageBuffer, { animated: true })
-        .extract({
-          left: Math.floor((width - minSize) / 2),
-          top: Math.floor((height - minSize) / 2),
-          width: minSize,
-          height: minSize,
-        })
-        .resize(250, 250)
-        .gif()
-        .toBuffer();
-
-      return resizedBuffer;
-    }
-
-    const squaredBuffer = await sharp(imageBuffer)
-      .extract({
-        left: Math.floor((width - minSize) / 2),
-        top: Math.floor((height - minSize) / 2),
-        width: minSize,
-        height: minSize,
-      })
-      .toBuffer();
-
-    const { buffer } = await resizeAndConvert({
-      inputBuffer: squaredBuffer,
-      desiredFormat,
-    });
-    return buffer;
-  } catch (error) {
-    logger.error('Error uploading the avatar:', error);
-    throw error;
-  }
-}
-
-module.exports = { resizeAvatar };

api/server/services/Files/images/index.js

@@ -1,4 +1,3 @@
-const avatar = require('./avatar');
 const convert = require('./convert');
 const encode = require('./encode');
 const parse = require('./parse');
@@ -9,5 +8,4 @@ module.exports = {
   ...encode,
   ...parse,
   ...resize,
-  avatar,
 };

api/server/services/Files/images/resize.js

@@ -89,28 +89,4 @@ async function resizeImageBuffer(inputBuffer, resolution, endpoint) {
   };
 }
 
-/**
- * Resizes an image buffer to a specified format and width.
- *
- * @param {Object} options - The options for resizing and converting the image.
- * @param {Buffer} options.inputBuffer - The buffer of the image to be resized.
- * @param {string} options.desiredFormat - The desired output format of the image.
- * @param {number} [options.width=150] - The desired width of the image. Defaults to 150 pixels.
- * @returns {Promise<{ buffer: Buffer, width: number, height: number, bytes: number }>} An object containing the resized image buffer, its size, and dimensions.
- * @throws Will throw an error if the resolution or format parameters are invalid.
- */
-async function resizeAndConvert({ inputBuffer, desiredFormat, width = 150 }) {
-  const resizedBuffer = await sharp(inputBuffer)
-    .resize({ width })
-    .toFormat(desiredFormat)
-    .toBuffer();
-  const resizedMetadata = await sharp(resizedBuffer).metadata();
-  return {
-    buffer: resizedBuffer,
-    width: resizedMetadata.width,
-    height: resizedMetadata.height,
-    bytes: Buffer.byteLength(resizedBuffer),
-  };
-}
-
-module.exports = { resizeImageBuffer, resizeAndConvert };
+module.exports = { resizeImageBuffer };

api/server/services/Files/process.js

@@ -19,11 +19,8 @@ const {
   isAssistantsEndpoint,
 } = require('librechat-data-provider');
 const { EnvVar } = require('@librechat/agents');
-const {
-  convertImage,
-  resizeAndConvert,
-  resizeImageBuffer,
-} = require('~/server/services/Files/images');
+const { convertImage, resizeImageBuffer } = require('~/server/services/Files/images');
+const { resizeAndConvert } = require('@librechat/auth');
 const { addResourceFileId, deleteResourceFileId } = require('~/server/controllers/assistants/v2');
 const { addAgentResourceFile, removeAgentResourceFiles } = require('~/models/Agent');
 const { getOpenAIClient } = require('~/server/controllers/assistants/helpers');

api/server/services/Files/strategies.js

@@ -59,7 +59,6 @@ const firebaseStrategy = () => ({
   deleteFile: deleteFirebaseFile,
   saveBuffer: saveBufferToFirebase,
   prepareImagePayload: prepareImageURL,
-  processAvatar: processFirebaseAvatar,
   handleImageUpload: uploadImageToFirebase,
   getDownloadStream: getFirebaseFileStream,
 });
@@ -74,7 +73,6 @@ const localStrategy = () => ({
   getFileURL: getLocalFileURL,
   saveBuffer: saveLocalBuffer,
   deleteFile: deleteLocalFile,
-  processAvatar: processLocalAvatar,
   handleImageUpload: uploadLocalImage,
   prepareImagePayload: prepareImagesLocal,
   getDownloadStream: getLocalFileStream,
@@ -91,7 +89,6 @@ const s3Strategy = () => ({
   deleteFile: deleteFileFromS3,
   saveBuffer: saveBufferToS3,
   prepareImagePayload: prepareImageURLS3,
-  processAvatar: processS3Avatar,
   handleImageUpload: uploadImageToS3,
   getDownloadStream: getS3FileStream,
 });
@@ -107,7 +104,6 @@ const azureStrategy = () => ({
   deleteFile: deleteFileFromAzure,
   saveBuffer: saveBufferToAzure,
   prepareImagePayload: prepareAzureImageURL,
-  processAvatar: processAzureAvatar,
   handleImageUpload: uploadImageToAzure,
   getDownloadStream: getAzureFileStream,
 });
@@ -123,8 +119,6 @@ const vectorStrategy = () => ({
   getFileURL: null,
   /** @type {typeof saveLocalBuffer | null} */
   saveBuffer: null,
-  /** @type {typeof processLocalAvatar | null} */
-  processAvatar: null,
   /** @type {typeof uploadLocalImage | null} */
   handleImageUpload: null,
   /** @type {typeof prepareImagesLocal | null} */
@@ -147,8 +141,6 @@ const openAIStrategy = () => ({
   getFileURL: null,
   /** @type {typeof saveLocalBuffer | null} */
   saveBuffer: null,
-  /** @type {typeof processLocalAvatar | null} */
-  processAvatar: null,
   /** @type {typeof uploadLocalImage | null} */
   handleImageUpload: null,
   /** @type {typeof prepareImagesLocal | null} */
@@ -170,8 +162,6 @@ const codeOutputStrategy = () => ({
   getFileURL: null,
   /** @type {typeof saveLocalBuffer | null} */
   saveBuffer: null,
-  /** @type {typeof processLocalAvatar | null} */
-  processAvatar: null,
   /** @type {typeof uploadLocalImage | null} */
   handleImageUpload: null,
   /** @type {typeof prepareImagesLocal | null} */
@@ -189,8 +179,6 @@ const mistralOCRStrategy = () => ({
   getFileURL: null,
   /** @type {typeof saveLocalBuffer | null} */
   saveBuffer: null,
-  /** @type {typeof processLocalAvatar | null} */
-  processAvatar: null,
   /** @type {typeof uploadLocalImage | null} */
   handleImageUpload: null,
   /** @type {typeof prepareImagesLocal | null} */

api/server/services/GraphApiService.js

@@ -1,525 +0,0 @@
-const client = require('openid-client');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { CacheKeys } = require('librechat-data-provider');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-
-/**
- * @import { TPrincipalSearchResult, TGraphPerson, TGraphUser, TGraphGroup, TGraphPeopleResponse, TGraphUsersResponse, TGraphGroupsResponse } from 'librechat-data-provider'
- */
-
-/**
- * Checks if Entra ID principal search feature is enabled based on environment variables and user authentication
- * @param {Object} user - User object from request
- * @param {string} user.provider - Authentication provider
- * @param {string} user.openidId - OpenID subject identifier
- * @returns {boolean} True if Entra ID principal search is enabled and user is authenticated via OpenID
- */
-const entraIdPrincipalFeatureEnabled = (user) => {
-  return (
-    isEnabled(process.env.USE_ENTRA_ID_FOR_PEOPLE_SEARCH) &&
-    isEnabled(process.env.OPENID_REUSE_TOKENS) &&
-    user?.provider === 'openid' &&
-    user?.openidId
-  );
-};
-
-/**
- * Creates a Microsoft Graph client with on-behalf-of token exchange
- * @param {string} accessToken - OpenID Connect access token from user
- * @param {string} sub - Subject identifier from token claims
- * @returns {Promise<Client>} Authenticated Graph API client
- */
-const createGraphClient = async (accessToken, sub) => {
-  try {
-    // Reason: Use existing OpenID configuration and token exchange pattern from openidStrategy.js
-    const openidConfig = getOpenIdConfig();
-    const exchangedToken = await exchangeTokenForGraphAccess(openidConfig, accessToken, sub);
-
-    const graphClient = Client.init({
-      authProvider: (done) => {
-        done(null, exchangedToken);
-      },
-    });
-
-    return graphClient;
-  } catch (error) {
-    logger.error('[createGraphClient] Error creating Graph client:', error);
-    throw error;
-  }
-};
-
-/**
- * Exchange OpenID token for Graph API access using on-behalf-of flow
- * Similar to exchangeAccessTokenIfNeeded in openidStrategy.js but for Graph scopes
- * @param {Configuration} config - OpenID configuration
- * @param {string} accessToken - Original access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<string>} Graph API access token
- */
-const exchangeTokenForGraphAccess = async (config, accessToken, sub) => {
-  try {
-    const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
-    const cacheKey = `${sub}:graph`;
-
-    const cachedToken = await tokensCache.get(cacheKey);
-    if (cachedToken) {
-      return cachedToken.access_token;
-    }
-
-    const graphScopes = process.env.OPENID_GRAPH_SCOPES || 'User.Read,People.Read,Group.Read.All';
-    const scopeString = graphScopes
-      .split(',')
-      .map((scope) => `https://graph.microsoft.com/${scope}`)
-      .join(' ');
-
-    const grantResponse = await client.genericGrantRequest(
-      config,
-      'urn:ietf:params:oauth:grant-type:jwt-bearer',
-      {
-        scope: scopeString,
-        assertion: accessToken,
-        requested_token_use: 'on_behalf_of',
-      },
-    );
-
-    await tokensCache.set(
-      cacheKey,
-      {
-        access_token: grantResponse.access_token,
-      },
-      grantResponse.expires_in * 1000,
-    );
-
-    return grantResponse.access_token;
-  } catch (error) {
-    logger.error('[exchangeTokenForGraphAccess] Token exchange failed:', error);
-    throw error;
-  }
-};
-
-/**
- * Search for principals (people and groups) using Microsoft Graph API
- * Uses searchContacts first, then searchUsers and searchGroups to fill remaining slots
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} query - Search query string
- * @param {string} type - Type filter ('users', 'groups', or 'all')
- * @param {number} limit - Maximum number of results
- * @returns {Promise<TPrincipalSearchResult[]>} Array of principal search results
- */
-const searchEntraIdPrincipals = async (accessToken, sub, query, type = 'all', limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    const graphClient = await createGraphClient(accessToken, sub);
-    let allResults = [];
-
-    if (type === 'users' || type === 'all') {
-      const contactResults = await searchContacts(graphClient, query, limit);
-      allResults.push(...contactResults);
-    }
-    if (allResults.length >= limit) {
-      return allResults.slice(0, limit);
-    }
-
-    if (type === 'users') {
-      const userResults = await searchUsers(graphClient, query, limit);
-      allResults.push(...userResults);
-    } else if (type === 'groups') {
-      const groupResults = await searchGroups(graphClient, query, limit);
-      allResults.push(...groupResults);
-    } else if (type === 'all') {
-      const [userResults, groupResults] = await Promise.all([
-        searchUsers(graphClient, query, limit),
-        searchGroups(graphClient, query, limit),
-      ]);
-
-      allResults.push(...userResults, ...groupResults);
-    }
-
-    const seenIds = new Set();
-    const uniqueResults = allResults.filter((result) => {
-      if (seenIds.has(result.idOnTheSource)) {
-        return false;
-      }
-      seenIds.add(result.idOnTheSource);
-      return true;
-    });
-
-    return uniqueResults.slice(0, limit);
-  } catch (error) {
-    logger.error('[searchEntraIdPrincipals] Error searching principals:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's Entra ID group memberships from Microsoft Graph
- * Uses /me/memberOf endpoint to get groups the user is a member of
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient.api('/me/memberOf').select('id').get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserEntraGroups] Error fetching user groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's owned Entra ID groups from Microsoft Graph
- * Uses /me/ownedObjects/microsoft.graph.group endpoint to get groups the user owns
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserOwnedEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient
-      .api('/me/ownedObjects/microsoft.graph.group')
-      .select('id')
-      .get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserOwnedEntraGroups] Error fetching user owned groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get group members from Microsoft Graph API
- * Recursively fetches all members using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of member IDs (idOnTheSource values)
- */
-const getGroupMembers = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allMembers = [];
-    let nextLink = `/groups/${groupId}/members`;
-
-    while (nextLink) {
-      const membersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const members = membersResponse.value || [];
-      allMembers.push(...members.map((member) => member.id));
-
-      nextLink = membersResponse['@odata.nextLink']
-        ? membersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allMembers;
-  } catch (error) {
-    logger.error('[getGroupMembers] Error fetching group members:', error);
-    return [];
-  }
-};
-/**
- * Get group owners from Microsoft Graph API
- * Recursively fetches all owners using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of owner IDs (idOnTheSource values)
- */
-const getGroupOwners = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allOwners = [];
-    let nextLink = `/groups/${groupId}/owners`;
-
-    while (nextLink) {
-      const ownersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const owners = ownersResponse.value || [];
-      allOwners.push(...owners.map((member) => member.id));
-
-      nextLink = ownersResponse['@odata.nextLink']
-        ? ownersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allOwners;
-  } catch (error) {
-    logger.error('[getGroupOwners] Error fetching group owners:', error);
-    return [];
-  }
-};
-/**
- * Search for contacts (users only) using Microsoft Graph /me/people endpoint
- * Returns mapped TPrincipalSearchResult objects for users only
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user contact results
- */
-const searchContacts = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    if (
-      process.env.OPENID_GRAPH_SCOPES &&
-      !process.env.OPENID_GRAPH_SCOPES.toLowerCase().includes('people.read')
-    ) {
-      logger.warn('[searchContacts] People.Read scope is not enabled, skipping contact search');
-      return [];
-    }
-    // Reason: Search only for OrganizationUser (person) type, not groups
-    const filter = "personType/subclass eq 'OrganizationUser'";
-
-    let apiCall = graphClient
-      .api('/me/people')
-      .search(`"${query}"`)
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,scoredEmailAddresses,personType,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .filter(filter)
-      .top(limit);
-
-    const contactsResponse = await apiCall.get();
-    return (contactsResponse.value || []).map(mapContactToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchContacts] Error searching contacts:', error);
-    return [];
-  }
-};
-
-/**
- * Search for users using Microsoft Graph /users endpoint
- * Returns mapped TPrincipalSearchResult objects
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user results
- */
-const searchUsers = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search users by display name, email, and user principal name
-    const usersResponse = await graphClient
-      .api('/users')
-      .search(
-        `"displayName:${query}" OR "userPrincipalName:${query}" OR "mail:${query}" OR "givenName:${query}" OR "surname:${query}"`,
-      )
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,mail,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (usersResponse.value || []).map(mapUserToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchUsers] Error searching users:', error);
-    return [];
-  }
-};
-
-/**
- * Search for groups using Microsoft Graph /groups endpoint
- * Returns mapped TPrincipalSearchResult objects, includes all group types
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped group results
- */
-const searchGroups = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search all groups by display name and email without filtering group types
-    const groupsResponse = await graphClient
-      .api('/groups')
-      .search(`"displayName:${query}" OR "mail:${query}" OR "mailNickname:${query}"`)
-      .select('id,displayName,mail,mailNickname,description,groupTypes,resourceProvisioningOptions')
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (groupsResponse.value || []).map(mapGroupToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchGroups] Error searching groups:', error);
-    return [];
-  }
-};
-
-/**
- * Test Graph API connectivity and permissions
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Object>} Test results with available permissions
- */
-const testGraphApiAccess = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const results = {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [],
-    };
-
-    // Test User.Read permission
-    try {
-      await graphClient.api('/me').select('id,displayName').get();
-      results.userAccess = true;
-    } catch (error) {
-      results.errors.push(`User.Read: ${error.message}`);
-    }
-
-    // Test People.Read permission with OrganizationUser filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'OrganizationUser'")
-        .top(1)
-        .get();
-      results.peopleAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (OrganizationUser): ${error.message}`);
-    }
-
-    // Test People.Read permission with UnifiedGroup filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'UnifiedGroup'")
-        .top(1)
-        .get();
-      results.groupsAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (UnifiedGroup): ${error.message}`);
-    }
-
-    // Test /users endpoint access (requires User.Read.All or similar)
-    try {
-      await graphClient
-        .api('/users')
-        .search('"displayName:test"')
-        .select('id,displayName,userPrincipalName')
-        .top(1)
-        .get();
-      results.usersEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Users endpoint: ${error.message}`);
-    }
-
-    // Test /groups endpoint access (requires Group.Read.All or similar)
-    try {
-      await graphClient
-        .api('/groups')
-        .search('"displayName:test"')
-        .select('id,displayName,mail')
-        .top(1)
-        .get();
-      results.groupsEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Groups endpoint: ${error.message}`);
-    }
-
-    return results;
-  } catch (error) {
-    logger.error('[testGraphApiAccess] Error testing Graph API access:', error);
-    return {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [error.message],
-    };
-  }
-};
-
-/**
- * Map Graph API user object to TPrincipalSearchResult format
- * @param {TGraphUser} user - Raw user object from Graph API
- * @returns {TPrincipalSearchResult} Mapped user result
- */
-const mapUserToTPrincipalSearchResult = (user) => {
-  return {
-    id: null,
-    type: 'user',
-    name: user.displayName,
-    email: user.mail || user.userPrincipalName,
-    username: user.userPrincipalName,
-    source: 'entra',
-    idOnTheSource: user.id,
-  };
-};
-
-/**
- * Map Graph API group object to TPrincipalSearchResult format
- * @param {TGraphGroup} group - Raw group object from Graph API
- * @returns {TPrincipalSearchResult} Mapped group result
- */
-const mapGroupToTPrincipalSearchResult = (group) => {
-  return {
-    id: null,
-    type: 'group',
-    name: group.displayName,
-    email: group.mail || group.userPrincipalName,
-    description: group.description,
-    source: 'entra',
-    idOnTheSource: group.id,
-  };
-};
-
-/**
- * Map Graph API /me/people contact object to TPrincipalSearchResult format
- * Handles both user and group contacts from the people endpoint
- * @param {TGraphPerson} contact - Raw contact object from Graph API /me/people
- * @returns {TPrincipalSearchResult} Mapped contact result
- */
-const mapContactToTPrincipalSearchResult = (contact) => {
-  const isGroup = contact.personType?.class === 'Group';
-  const primaryEmail = contact.scoredEmailAddresses?.[0]?.address;
-
-  return {
-    id: null,
-    type: isGroup ? 'group' : 'user',
-    name: contact.displayName,
-    email: primaryEmail,
-    username: !isGroup ? contact.userPrincipalName : undefined,
-    source: 'entra',
-    idOnTheSource: contact.id,
-  };
-};
-
-module.exports = {
-  getGroupMembers,
-  getGroupOwners,
-  createGraphClient,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  testGraphApiAccess,
-  searchEntraIdPrincipals,
-  exchangeTokenForGraphAccess,
-  entraIdPrincipalFeatureEnabled,
-};

api/server/services/GraphApiService.spec.js

@@ -1,720 +0,0 @@
-jest.mock('@microsoft/microsoft-graph-client');
-jest.mock('~/strategies/openidStrategy');
-jest.mock('~/cache/getLogStores');
-jest.mock('@librechat/data-schemas', () => ({
-  ...jest.requireActual('@librechat/data-schemas'),
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-jest.mock('~/config', () => ({
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-  createAxiosInstance: jest.fn(() => ({
-    create: jest.fn(),
-    defaults: {},
-  })),
-}));
-jest.mock('~/utils', () => ({
-  logAxiosError: jest.fn(),
-}));
-
-jest.mock('~/server/services/Config', () => ({}));
-jest.mock('~/server/services/Files/strategies', () => ({
-  getStrategyFunctions: jest.fn(),
-}));
-
-const mongoose = require('mongoose');
-const client = require('openid-client');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-const GraphApiService = require('./GraphApiService');
-
-describe('GraphApiService', () => {
-  let mongoServer;
-  let mockGraphClient;
-  let mockTokensCache;
-  let mockOpenIdConfig;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  afterEach(() => {
-    // Clean up environment variables
-    delete process.env.OPENID_GRAPH_SCOPES;
-  });
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    await mongoose.connection.dropDatabase();
-
-    // Set up environment variable for People.Read scope
-    process.env.OPENID_GRAPH_SCOPES = 'User.Read,People.Read,Group.Read.All';
-
-    // Mock Graph client
-    mockGraphClient = {
-      api: jest.fn().mockReturnThis(),
-      search: jest.fn().mockReturnThis(),
-      filter: jest.fn().mockReturnThis(),
-      select: jest.fn().mockReturnThis(),
-      header: jest.fn().mockReturnThis(),
-      top: jest.fn().mockReturnThis(),
-      get: jest.fn(),
-    };
-
-    Client.init.mockReturnValue(mockGraphClient);
-
-    // Mock tokens cache
-    mockTokensCache = {
-      get: jest.fn(),
-      set: jest.fn(),
-    };
-    getLogStores.mockReturnValue(mockTokensCache);
-
-    // Mock OpenID config
-    mockOpenIdConfig = {
-      client_id: 'test-client-id',
-      issuer: 'https://test-issuer.com',
-    };
-    getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-
-    // Mock openid-client (using the existing jest mock configuration)
-    if (client.genericGrantRequest) {
-      client.genericGrantRequest.mockResolvedValue({
-        access_token: 'mocked-graph-token',
-        expires_in: 3600,
-      });
-    }
-  });
-
-  describe('Dependency Contract Tests', () => {
-    it('should fail if getOpenIdConfig interface changes', () => {
-      // Reason: Ensure getOpenIdConfig returns expected structure
-      const config = getOpenIdConfig();
-
-      expect(config).toBeDefined();
-      expect(typeof config).toBe('object');
-      // Add specific property checks that GraphApiService depends on
-      expect(config).toHaveProperty('client_id');
-      expect(config).toHaveProperty('issuer');
-
-      // Ensure the function is callable
-      expect(typeof getOpenIdConfig).toBe('function');
-    });
-
-    it('should fail if openid-client.genericGrantRequest interface changes', () => {
-      // Reason: Ensure client.genericGrantRequest maintains expected signature
-      if (client.genericGrantRequest) {
-        expect(typeof client.genericGrantRequest).toBe('function');
-
-        // Test that it accepts the expected parameters
-        const mockCall = client.genericGrantRequest(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope: 'test-scope',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-
-        expect(mockCall).toBeDefined();
-      }
-    });
-
-    it('should fail if Microsoft Graph Client interface changes', () => {
-      // Reason: Ensure Graph Client maintains expected fluent API
-      expect(typeof Client.init).toBe('function');
-
-      const client = Client.init({ authProvider: jest.fn() });
-      expect(client).toHaveProperty('api');
-      expect(typeof client.api).toBe('function');
-    });
-  });
-
-  describe('createGraphClient', () => {
-    it('should create graph client with exchanged token', async () => {
-      const accessToken = 'test-access-token';
-      const sub = 'test-user-id';
-
-      const result = await GraphApiService.createGraphClient(accessToken, sub);
-
-      expect(getOpenIdConfig).toHaveBeenCalled();
-      expect(Client.init).toHaveBeenCalledWith({
-        authProvider: expect.any(Function),
-      });
-      expect(result).toBe(mockGraphClient);
-    });
-
-    it('should handle token exchange errors gracefully', async () => {
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      await expect(GraphApiService.createGraphClient('invalid-token', 'test-user')).rejects.toThrow(
-        'Token exchange failed',
-      );
-    });
-  });
-
-  describe('exchangeTokenForGraphAccess', () => {
-    it('should return cached token if available', async () => {
-      const cachedToken = { access_token: 'cached-token' };
-      mockTokensCache.get.mockResolvedValue(cachedToken);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      expect(result).toBe('cached-token');
-      expect(mockTokensCache.get).toHaveBeenCalledWith('test-user:graph');
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).not.toHaveBeenCalled();
-      }
-    });
-
-    it('should exchange token and cache result', async () => {
-      mockTokensCache.get.mockResolvedValue(null);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/User.Read https://graph.microsoft.com/People.Read https://graph.microsoft.com/Group.Read.All',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      expect(mockTokensCache.set).toHaveBeenCalledWith(
-        'test-user:graph',
-        { access_token: 'mocked-graph-token' },
-        3600000,
-      );
-
-      expect(result).toBe('mocked-graph-token');
-    });
-
-    it('should use custom scopes from environment', async () => {
-      const originalEnv = process.env.OPENID_GRAPH_SCOPES;
-      process.env.OPENID_GRAPH_SCOPES = 'Custom.Read,Custom.Write';
-
-      mockTokensCache.get.mockResolvedValue(null);
-
-      await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/Custom.Read https://graph.microsoft.com/Custom.Write',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      process.env.OPENID_GRAPH_SCOPES = originalEnv;
-    });
-  });
-
-  describe('searchEntraIdPrincipals', () => {
-    // Mock data used by multiple tests
-    const mockContactsResponse = {
-      value: [
-        {
-          id: 'contact-user-1',
-          displayName: 'John Doe',
-          userPrincipalName: 'john@company.com',
-          mail: 'john@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-          scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-        },
-        {
-          id: 'contact-group-1',
-          displayName: 'Marketing Team',
-          mail: 'marketing@company.com',
-          personType: { class: 'Group', subclass: 'UnifiedGroup' },
-          scoredEmailAddresses: [{ address: 'marketing@company.com', relevanceScore: 0.8 }],
-        },
-      ],
-    };
-
-    const mockUsersResponse = {
-      value: [
-        {
-          id: 'dir-user-1',
-          displayName: 'Jane Smith',
-          userPrincipalName: 'jane@company.com',
-          mail: 'jane@company.com',
-        },
-      ],
-    };
-
-    const mockGroupsResponse = {
-      value: [
-        {
-          id: 'dir-group-1',
-          displayName: 'Development Team',
-          mail: 'dev@company.com',
-        },
-      ],
-    };
-
-    beforeEach(() => {
-      // Reset mock call history for each test
-      jest.clearAllMocks();
-
-      // Re-apply the Client.init mock after clearAllMocks
-      Client.init.mockReturnValue(mockGraphClient);
-
-      // Re-apply openid-client mock
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockResolvedValue({
-          access_token: 'mocked-graph-token',
-          expires_in: 3600,
-        });
-      }
-
-      // Re-apply cache mock
-      mockTokensCache.get.mockResolvedValue(null); // Force token exchange
-      mockTokensCache.set.mockResolvedValue();
-      getLogStores.mockReturnValue(mockTokensCache);
-      getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-    });
-
-    it('should return empty results for short queries', async () => {
-      const result = await GraphApiService.searchEntraIdPrincipals('token', 'user', 'a', 'all', 10);
-
-      expect(result).toEqual([]);
-      expect(mockGraphClient.api).not.toHaveBeenCalled();
-    });
-
-    it('should search contacts first and additional users for users type', async () => {
-      // Mock responses for this specific test
-      const contactsFilteredResponse = {
-        value: [
-          {
-            id: 'contact-user-1',
-            displayName: 'John Doe',
-            userPrincipalName: 'john@company.com',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-            scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(contactsFilteredResponse) // contacts call
-        .mockResolvedValueOnce(mockUsersResponse); // users call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"john"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call users endpoint for additional results
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:john" OR "userPrincipalName:john" OR "mail:john" OR "givenName:john" OR "surname:john"',
-      );
-
-      // Should return TPrincipalSearchResult array
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(2); // 1 from contacts + 1 from users
-      expect(result[0]).toMatchObject({
-        id: null,
-        type: 'user',
-        name: 'John Doe',
-        email: 'john@company.com',
-        source: 'entra',
-        idOnTheSource: 'contact-user-1',
-      });
-    });
-
-    it('should search groups endpoint only for groups type', async () => {
-      // Mock responses for this specific test - only groups endpoint called
-      mockGraphClient.get.mockResolvedValueOnce(mockGroupsResponse); // only groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'team',
-        'groups',
-        10,
-      );
-
-      // Should NOT call contacts for groups type
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/me/people');
-
-      // Should call groups endpoint only
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:team" OR "mail:team" OR "mailNickname:team"',
-      );
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(1); // 1 from groups only
-    });
-
-    it('should search all endpoints for all type', async () => {
-      // Mock responses for this specific test
-      mockGraphClient.get
-        .mockResolvedValueOnce(mockContactsResponse) // contacts call (both user and group)
-        .mockResolvedValueOnce(mockUsersResponse) // users call
-        .mockResolvedValueOnce(mockGroupsResponse); // groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call both users and groups endpoints
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(4); // 2 from contacts + 1 from users + 1 from groups
-    });
-
-    it('should early exit if contacts reach limit', async () => {
-      // Mock contacts to return exactly the limit
-      const limitedContactsResponse = {
-        value: Array(10).fill({
-          id: 'contact-1',
-          displayName: 'Contact User',
-          mail: 'contact@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-        }),
-      };
-
-      mockGraphClient.get.mockResolvedValueOnce(limitedContactsResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      // Should not call users endpoint since limit was reached
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/users');
-
-      expect(result).toHaveLength(10);
-    });
-
-    it('should deduplicate results based on idOnTheSource', async () => {
-      // Mock responses with duplicate IDs
-      const duplicateContactsResponse = {
-        value: [
-          {
-            id: 'duplicate-id',
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-          },
-        ],
-      };
-
-      const duplicateUsersResponse = {
-        value: [
-          {
-            id: 'duplicate-id', // Same ID as contact
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(duplicateContactsResponse)
-        .mockResolvedValueOnce(duplicateUsersResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should only return one result despite duplicate IDs
-      expect(result).toHaveLength(1);
-      expect(result[0].idOnTheSource).toBe('duplicate-id');
-    });
-
-    it('should handle Graph API errors gracefully', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('Graph API error'));
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('getUserEntraGroups', () => {
-    it('should fetch user groups from memberOf endpoint', async () => {
-      const mockGroupsResponse = {
-        value: [
-          {
-            id: 'group-1',
-          },
-          {
-            id: 'group-2',
-          },
-        ],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/memberOf');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id');
-
-      expect(result).toHaveLength(2);
-      expect(result).toEqual(['group-1', 'group-2']);
-    });
-
-    it('should return empty array on error', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('API error'));
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle empty response', async () => {
-      const mockGroupsResponse = {
-        value: [],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle missing value property', async () => {
-      mockGraphClient.get.mockResolvedValue({});
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('testGraphApiAccess', () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it('should test all permissions and return success results', async () => {
-      // Mock successful responses for all tests
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me test
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser test
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup test
-        .mockResolvedValueOnce({ value: [] }) // /users endpoint test
-        .mockResolvedValueOnce({ value: [] }); // /groups endpoint test
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: true,
-        groupsEndpointAccess: true,
-        errors: [],
-      });
-
-      // Verify all endpoints were tested
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-      expect(mockGraphClient.filter).toHaveBeenCalledWith("personType/subclass eq 'UnifiedGroup'");
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-    });
-
-    it('should handle partial failures and record errors', async () => {
-      // Mock mixed success/failure responses
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockRejectedValueOnce(new Error('People access denied')) // people OrganizationUser fail
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Users endpoint access denied')) // /users fail
-        .mockResolvedValueOnce({ value: [] }); // /groups success
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: false,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: true,
-        errors: [
-          'People.Read (OrganizationUser): People access denied',
-          'Users endpoint: Users endpoint access denied',
-        ],
-      });
-    });
-
-    it('should handle complete Graph client creation failure', async () => {
-      // Mock token exchange failure to test error handling
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      const result = await GraphApiService.testGraphApiAccess('invalid-token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: ['Token exchange failed'],
-      });
-    });
-
-    it('should record all permission errors', async () => {
-      // Mock all requests to fail
-      mockGraphClient.get
-        .mockRejectedValueOnce(new Error('User.Read denied'))
-        .mockRejectedValueOnce(new Error('People.Read OrganizationUser denied'))
-        .mockRejectedValueOnce(new Error('People.Read UnifiedGroup denied'))
-        .mockRejectedValueOnce(new Error('Users directory access denied'))
-        .mockRejectedValueOnce(new Error('Groups directory access denied'));
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'User.Read: User.Read denied',
-          'People.Read (OrganizationUser): People.Read OrganizationUser denied',
-          'People.Read (UnifiedGroup): People.Read UnifiedGroup denied',
-          'Users endpoint: Users directory access denied',
-          'Groups endpoint: Groups directory access denied',
-        ],
-      });
-    });
-
-    it('should test new endpoints with correct search patterns', async () => {
-      // Mock successful responses for endpoint testing
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup
-        .mockResolvedValueOnce({ value: [] }) // /users
-        .mockResolvedValueOnce({ value: [] }); // /groups
-
-      await GraphApiService.testGraphApiAccess('token', 'user');
-
-      // Verify /users endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,userPrincipalName');
-
-      // Verify /groups endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,mail');
-    });
-
-    it('should handle endpoint-specific permission failures', async () => {
-      // Mock specific endpoint failures
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser success
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Insufficient privileges')) // /users fail (User.Read.All needed)
-        .mockRejectedValueOnce(new Error('Access denied to groups')); // /groups fail (Group.Read.All needed)
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'Users endpoint: Insufficient privileges',
-          'Groups endpoint: Access denied to groups',
-        ],
-      });
-    });
-  });
-});

api/server/services/MCP.js

@@ -1,111 +1,27 @@
 const { z } = require('zod');
 const { tool } = require('@langchain/core/tools');
-const { logger } = require('@librechat/data-schemas');
-const { Time, CacheKeys, StepTypes } = require('librechat-data-provider');
-const { sendEvent, normalizeServerName, MCPOAuthHandler } = require('@librechat/api');
-const { Constants: AgentConstants, Providers, GraphEvents } = require('@librechat/agents');
+const { normalizeServerName } = require('@librechat/api');
+const { Constants: AgentConstants, Providers } = require('@librechat/agents');
 const {
   Constants,
   ContentTypes,
   isAssistantsEndpoint,
   convertJsonSchemaToZod,
 } = require('librechat-data-provider');
-const { getMCPManager, getFlowStateManager } = require('~/config');
-const { findToken, createToken, updateToken } = require('~/models');
-const { getCachedTools } = require('./Config');
-const { getLogStores } = require('~/cache');
-
-/**
- * @param {object} params
- * @param {ServerResponse} params.res - The Express response object for sending events.
- * @param {string} params.stepId - The ID of the step in the flow.
- * @param {ToolCallChunk} params.toolCall - The tool call object containing tool information.
- * @param {string} params.loginFlowId - The ID of the login flow.
- * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
- */
-function createOAuthStart({ res, stepId, toolCall, loginFlowId, flowManager, signal }) {
-  /**
-   * Creates a function to handle OAuth login requests.
-   * @param {string} authURL - The URL to redirect the user for OAuth authentication.
-   * @returns {Promise<boolean>} Returns true to indicate the event was sent successfully.
-   */
-  return async function (authURL) {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall, args: '' }],
-        auth: authURL,
-        expires_at: Date.now() + Time.TWO_MINUTES,
-      },
-    };
-    /** Used to ensure the handler (use of `sendEvent`) is only invoked once */
-    await flowManager.createFlowWithHandler(
-      loginFlowId,
-      'oauth_login',
-      async () => {
-        sendEvent(res, { event: GraphEvents.ON_RUN_STEP_DELTA, data });
-        logger.debug('Sent OAuth login request to client');
-        return true;
-      },
-      signal,
-    );
-  };
-}
-
-/**
- * @param {object} params
- * @param {ServerResponse} params.res - The Express response object for sending events.
- * @param {string} params.stepId - The ID of the step in the flow.
- * @param {ToolCallChunk} params.toolCall - The tool call object containing tool information.
- * @param {string} params.loginFlowId - The ID of the login flow.
- * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
- */
-function createOAuthEnd({ res, stepId, toolCall }) {
-  return async function () {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall }],
-      },
-    };
-    sendEvent(res, { event: GraphEvents.ON_RUN_STEP_DELTA, data });
-    logger.debug('Sent OAuth login success to client');
-  };
-}
-
-/**
- * @param {object} params
- * @param {string} params.userId - The ID of the user.
- * @param {string} params.serverName - The name of the server.
- * @param {string} params.toolName - The name of the tool.
- * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
- */
-function createAbortHandler({ userId, serverName, toolName, flowManager }) {
-  return function () {
-    logger.info(`[MCP][User: ${userId}][${serverName}][${toolName}] Tool call aborted`);
-    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
-    flowManager.failFlow(flowId, 'mcp_oauth', new Error('Tool call aborted'));
-  };
-}
+const { logger, getMCPManager } = require('~/config');
 
 /**
  * Creates a general tool for an entire action set.
  *
  * @param {Object} params - The parameters for loading action sets.
  * @param {ServerRequest} params.req - The Express request object, containing user/request info.
- * @param {ServerResponse} params.res - The Express response object for sending events.
  * @param {string} params.toolKey - The toolKey for the tool.
  * @param {import('@librechat/agents').Providers | EModelEndpoint} params.provider - The provider for the tool.
  * @param {string} params.model - The model for the tool.
  * @returns { Promise<typeof tool | { _call: (toolInput: Object | string) => unknown}> } An object with `_call` method to execute the tool input.
  */
-async function createMCPTool({ req, res, toolKey, provider: _provider }) {
-  const availableTools = await getCachedTools({ includeGlobal: true });
-  const toolDefinition = availableTools?.[toolKey]?.function;
+async function createMCPTool({ req, toolKey, provider: _provider }) {
+  const toolDefinition = req.app.locals.availableTools[toolKey]?.function;
   if (!toolDefinition) {
     logger.error(`Tool ${toolKey} not found in available tools`);
     return null;
@@ -135,42 +51,10 @@ async function createMCPTool({ req, res, toolKey, provider: _provider }) {
   /** @type {(toolArguments: Object | string, config?: GraphRunnableConfig) => Promise<unknown>} */
   const _call = async (toolArguments, config) => {
     const userId = config?.configurable?.user?.id || config?.configurable?.user_id;
-    /** @type {ReturnType<typeof createAbortHandler>} */
-    let abortHandler = null;
-    /** @type {AbortSignal} */
-    let derivedSignal = null;
-
     try {
-      const flowsCache = getLogStores(CacheKeys.FLOWS);
-      const flowManager = getFlowStateManager(flowsCache);
-      derivedSignal = config?.signal ? AbortSignal.any([config.signal]) : undefined;
+      const derivedSignal = config?.signal ? AbortSignal.any([config.signal]) : undefined;
       const mcpManager = getMCPManager(userId);
       const provider = (config?.metadata?.provider || _provider)?.toLowerCase();
-
-      const { args: _args, stepId, ...toolCall } = config.toolCall ?? {};
-      const loginFlowId = `${serverName}:oauth_login:${config.metadata.thread_id}:${config.metadata.run_id}`;
-      const oauthStart = createOAuthStart({
-        res,
-        stepId,
-        toolCall,
-        loginFlowId,
-        flowManager,
-        signal: derivedSignal,
-      });
-      const oauthEnd = createOAuthEnd({
-        res,
-        stepId,
-        toolCall,
-      });
-
-      if (derivedSignal) {
-        abortHandler = createAbortHandler({ userId, serverName, toolName, flowManager });
-        derivedSignal.addEventListener('abort', abortHandler, { once: true });
-      }
-
-      const customUserVars =
-        config?.configurable?.userMCPAuthMap?.[`${Constants.mcp_prefix}${serverName}`];
-
       const result = await mcpManager.callTool({
         serverName,
         toolName,
@@ -178,17 +62,8 @@ async function createMCPTool({ req, res, toolKey, provider: _provider }) {
         toolArguments,
         options: {
           signal: derivedSignal,
+          user: config?.configurable?.user,
         },
-        user: config?.configurable?.user,
-        customUserVars,
-        flowManager,
-        tokenMethods: {
-          findToken,
-          createToken,
-          updateToken,
-        },
-        oauthStart,
-        oauthEnd,
       });
 
       if (isAssistantsEndpoint(provider) && Array.isArray(result)) {
@@ -203,28 +78,9 @@ async function createMCPTool({ req, res, toolKey, provider: _provider }) {
         `[MCP][User: ${userId}][${serverName}] Error calling "${toolName}" MCP tool:`,
         error,
       );
-
-      /** OAuth error, provide a helpful message */
-      const isOAuthError =
-        error.message?.includes('401') ||
-        error.message?.includes('OAuth') ||
-        error.message?.includes('authentication') ||
-        error.message?.includes('Non-200 status code (401)');
-
-      if (isOAuthError) {
-        throw new Error(
-          `OAuth authentication required for ${serverName}. Please check the server logs for the authentication URL.`,
-        );
-      }
-
       throw new Error(
         `"${toolKey}" tool call failed${error?.message ? `: ${error?.message}` : '.'}`,
       );
-    } finally {
-      // Clean up abort handler to prevent memory leaks
-      if (abortHandler && derivedSignal) {
-        derivedSignal.removeEventListener('abort', abortHandler);
-      }
     }
   };
 

api/server/services/PermissionService.js

@@ -1,721 +0,0 @@
-const mongoose = require('mongoose');
-const { getTransactionSupport, logger } = require('@librechat/data-schemas');
-const { isEnabled } = require('~/server/utils');
-const {
-  entraIdPrincipalFeatureEnabled,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  getGroupMembers,
-  getGroupOwners,
-} = require('~/server/services/GraphApiService');
-const {
-  findGroupByExternalId,
-  findRoleByIdentifier,
-  getUserPrincipals,
-  createGroup,
-  createUser,
-  updateUser,
-  findUser,
-  grantPermission: grantPermissionACL,
-  findAccessibleResources: findAccessibleResourcesACL,
-  hasPermission,
-  getEffectivePermissions: getEffectivePermissionsACL,
-  findEntriesByPrincipalsAndResource,
-} = require('~/models');
-const { AclEntry, AccessRole, Group } = require('~/db/models');
-
-/** @type {boolean|null} */
-let transactionSupportCache = null;
-
-/**
- * @import { TPrincipal } from 'librechat-data-provider'
- */
-/**
- * Grant a permission to a principal for a resource using a role
- * @param {Object} params - Parameters for granting role-based permission
- * @param {string} params.principalType - 'user', 'group', or 'public'
- * @param {string|mongoose.Types.ObjectId|null} params.principalId - The ID of the principal (null for 'public')
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {string} params.accessRoleId - The ID of the role (e.g., 'agent_viewer', 'agent_editor')
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID granting the permission
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} The created or updated ACL entry
- */
-const grantPermission = async ({
-  principalType,
-  principalId,
-  resourceType,
-  resourceId,
-  accessRoleId,
-  grantedBy,
-  session,
-}) => {
-  try {
-    if (!['user', 'group', 'public'].includes(principalType)) {
-      throw new Error(`Invalid principal type: ${principalType}`);
-    }
-
-    if (principalType !== 'public' && !principalId) {
-      throw new Error('Principal ID is required for user and group principals');
-    }
-
-    if (principalId && !mongoose.Types.ObjectId.isValid(principalId)) {
-      throw new Error(`Invalid principal ID: ${principalId}`);
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    // Get the role to determine permission bits
-    const role = await findRoleByIdentifier(accessRoleId);
-    if (!role) {
-      throw new Error(`Role ${accessRoleId} not found`);
-    }
-
-    // Ensure the role is for the correct resource type
-    if (role.resourceType !== resourceType) {
-      throw new Error(
-        `Role ${accessRoleId} is for ${role.resourceType} resources, not ${resourceType}`,
-      );
-    }
-    return await grantPermissionACL(
-      principalType,
-      principalId,
-      resourceType,
-      resourceId,
-      role.permBits,
-      grantedBy,
-      session,
-      role._id,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.grantPermission] Error: ${error.message}`);
-    throw error;
-  }
-};
-
-/**
- * Check if a user has specific permission bits on a resource
- * @param {Object} params - Parameters for checking permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether the user has the required permission bits
- */
-const checkPermission = async ({ userId, resourceType, resourceId, requiredPermission }) => {
-  try {
-    if (typeof requiredPermission !== 'number' || requiredPermission < 1) {
-      throw new Error('requiredPermission must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return false;
-    }
-
-    return await hasPermission(principals, resourceType, resourceId, requiredPermission);
-  } catch (error) {
-    logger.error(`[PermissionService.checkPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermission must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Get effective permission bitmask for a user on a resource
- * @param {Object} params - Parameters for getting effective permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @returns {Promise<number>} Effective permission bitmask
- */
-const getEffectivePermissions = async ({ userId, resourceType, resourceId }) => {
-  try {
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return 0;
-    }
-    return await getEffectivePermissionsACL(principals, resourceType, resourceId);
-  } catch (error) {
-    logger.error(`[PermissionService.getEffectivePermissions] Error: ${error.message}`);
-    return 0;
-  }
-};
-
-/**
- * Find all resources of a specific type that a user has access to with specific permission bits
- * @param {Object} params - Parameters for finding accessible resources
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findAccessibleResources = async ({ userId, resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principalsList = await getUserPrincipals(userId);
-
-    if (principalsList.length === 0) {
-      return [];
-    }
-    return await findAccessibleResourcesACL(principalsList, resourceType, requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.findAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Find all publicly accessible resources of a specific type
- * @param {Object} params - Parameters for finding publicly accessible resources
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findPubliclyAccessibleResources = async ({ resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Find all public ACL entries where the public principal has at least the required permission bits
-    const entries = await AclEntry.find({
-      principalType: 'public',
-      resourceType,
-      permBits: { $bitsAllSet: requiredPermissions },
-    }).distinct('resourceId');
-
-    return entries;
-  } catch (error) {
-    logger.error(`[PermissionService.findPubliclyAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @param {Object} params - Parameters for getting available roles
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @returns {Promise<Array>} Array of role definitions
- */
-const getAvailableRoles = async ({ resourceType }) => {
-  try {
-    return await AccessRole.find({ resourceType }).lean();
-  } catch (error) {
-    logger.error(`[PermissionService.getAvailableRoles] Error: ${error.message}`);
-    return [];
-  }
-};
-
-/**
- * Ensures a principal exists in the database based on TPrincipal data
- * Creates user if it doesn't exist locally (for Entra ID users)
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - 'user', 'group', or 'public'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @returns {Promise<string|null>} Returns the principalId for database operations, null for public
- */
-const ensurePrincipalExists = async function (principal) {
-  if (principal.type === 'public') {
-    return null;
-  }
-
-  if (principal.id) {
-    return principal.id;
-  }
-
-  if (principal.type === 'user' && principal.source === 'entra') {
-    if (!principal.email || !principal.idOnTheSource) {
-      throw new Error('Entra ID user principals must have email and idOnTheSource');
-    }
-
-    let existingUser = await findUser({ idOnTheSource: principal.idOnTheSource });
-
-    if (!existingUser) {
-      existingUser = await findUser({ email: principal.email.toLowerCase() });
-    }
-
-    if (existingUser) {
-      if (!existingUser.idOnTheSource && principal.idOnTheSource) {
-        await updateUser(existingUser._id, {
-          idOnTheSource: principal.idOnTheSource,
-          provider: 'openid',
-        });
-      }
-      return existingUser._id.toString();
-    }
-
-    const userData = {
-      name: principal.name,
-      email: principal.email.toLowerCase(),
-      emailVerified: false,
-      provider: 'openid',
-      idOnTheSource: principal.idOnTheSource,
-    };
-
-    const userId = await createUser(userData, true, false);
-    return userId.toString();
-  }
-
-  if (principal.type === 'group') {
-    throw new Error('Group principals should be handled by group-specific methods');
-  }
-
-  throw new Error(`Unsupported principal type: ${principal.type}`);
-};
-
-/**
- * Ensures a group principal exists in the database based on TPrincipal data
- * Creates group if it doesn't exist locally (for Entra ID groups)
- * For Entra ID groups, always synchronizes member IDs when authentication context is provided
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - Must be 'group'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.description] - Group description
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @param {Object} [authContext] - Optional authentication context for fetching member data
- * @param {string} [authContext.accessToken] - Access token for Graph API calls
- * @param {string} [authContext.sub] - Subject identifier
- * @returns {Promise<string>} Returns the groupId for database operations
- */
-const ensureGroupPrincipalExists = async function (principal, authContext = null) {
-  if (principal.type !== 'group') {
-    throw new Error(`Invalid principal type: ${principal.type}. Expected 'group'`);
-  }
-
-  if (principal.source === 'entra') {
-    if (!principal.name || !principal.idOnTheSource) {
-      throw new Error('Entra ID group principals must have name and idOnTheSource');
-    }
-
-    let memberIds = [];
-    if (authContext && authContext.accessToken && authContext.sub) {
-      try {
-        memberIds = await getGroupMembers(
-          authContext.accessToken,
-          authContext.sub,
-          principal.idOnTheSource,
-        );
-
-        // Include group owners as members if feature is enabled
-        if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-          const ownerIds = await getGroupOwners(
-            authContext.accessToken,
-            authContext.sub,
-            principal.idOnTheSource,
-          );
-          if (ownerIds && ownerIds.length > 0) {
-            memberIds.push(...ownerIds);
-            // Remove duplicates
-            memberIds = [...new Set(memberIds)];
-          }
-        }
-      } catch (error) {
-        logger.error('Failed to fetch group members from Graph API:', error);
-      }
-    }
-
-    let existingGroup = await findGroupByExternalId(principal.idOnTheSource, 'entra');
-
-    if (!existingGroup && principal.email) {
-      existingGroup = await Group.findOne({ email: principal.email.toLowerCase() }).lean();
-    }
-
-    if (existingGroup) {
-      const updateData = {};
-      let needsUpdate = false;
-
-      if (!existingGroup.idOnTheSource && principal.idOnTheSource) {
-        updateData.idOnTheSource = principal.idOnTheSource;
-        updateData.source = 'entra';
-        needsUpdate = true;
-      }
-
-      if (principal.description && existingGroup.description !== principal.description) {
-        updateData.description = principal.description;
-        needsUpdate = true;
-      }
-
-      if (principal.email && existingGroup.email !== principal.email.toLowerCase()) {
-        updateData.email = principal.email.toLowerCase();
-        needsUpdate = true;
-      }
-
-      if (authContext && authContext.accessToken && authContext.sub) {
-        updateData.memberIds = memberIds;
-        needsUpdate = true;
-      }
-
-      if (needsUpdate) {
-        await Group.findByIdAndUpdate(existingGroup._id, { $set: updateData }, { new: true });
-      }
-
-      return existingGroup._id.toString();
-    }
-
-    const groupData = {
-      name: principal.name,
-      source: 'entra',
-      idOnTheSource: principal.idOnTheSource,
-      memberIds: memberIds, // Store idOnTheSource values of group members (empty if no auth context)
-    };
-
-    if (principal.email) {
-      groupData.email = principal.email.toLowerCase();
-    }
-
-    if (principal.description) {
-      groupData.description = principal.description;
-    }
-
-    const newGroup = await createGroup(groupData);
-    return newGroup._id.toString();
-  }
-  if (principal.id && authContext == null) {
-    return principal.id;
-  }
-
-  throw new Error(`Unsupported group principal source: ${principal.source}`);
-};
-
-/**
- * Synchronize user's Entra ID group memberships on sign-in
- * Gets user's group IDs from GraphAPI and updates memberships only for existing groups in database
- * Optionally includes groups the user owns if ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS is enabled
- * @param {Object} user - User object with authentication context
- * @param {string} user.openidId - User's OpenID subject identifier
- * @param {string} user.idOnTheSource - User's Entra ID (oid from token claims)
- * @param {string} user.provider - Authentication provider ('openid')
- * @param {string} accessToken - Access token for Graph API calls
- * @param {mongoose.ClientSession} [session] - Optional MongoDB session for transactions
- * @returns {Promise<void>}
- */
-const syncUserEntraGroupMemberships = async (user, accessToken, session = null) => {
-  try {
-    if (!entraIdPrincipalFeatureEnabled(user) || !accessToken || !user.idOnTheSource) {
-      return;
-    }
-
-    const memberGroupIds = await getUserEntraGroups(accessToken, user.openidId);
-    let allGroupIds = [...(memberGroupIds || [])];
-
-    // Include owned groups if feature is enabled
-    if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-      const ownedGroupIds = await getUserOwnedEntraGroups(accessToken, user.openidId);
-      if (ownedGroupIds && ownedGroupIds.length > 0) {
-        allGroupIds.push(...ownedGroupIds);
-        // Remove duplicates
-        allGroupIds = [...new Set(allGroupIds)];
-      }
-    }
-
-    if (!allGroupIds || allGroupIds.length === 0) {
-      return;
-    }
-
-    const sessionOptions = session ? { session } : {};
-
-    await Group.updateMany(
-      {
-        idOnTheSource: { $in: allGroupIds },
-        source: 'entra',
-        memberIds: { $ne: user.idOnTheSource },
-      },
-      { $addToSet: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-
-    await Group.updateMany(
-      {
-        source: 'entra',
-        memberIds: user.idOnTheSource,
-        idOnTheSource: { $nin: allGroupIds },
-      },
-      { $pull: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.syncUserEntraGroupMemberships] Error syncing groups:`, error);
-  }
-};
-
-/**
- * Check if public has a specific permission on a resource
- * @param {Object} params - Parameters for checking public permission
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether public has the required permission bits
- */
-const hasPublicPermission = async ({ resourceType, resourceId, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Use public principal to check permissions
-    const publicPrincipal = [{ principalType: 'public' }];
-
-    const entries = await findEntriesByPrincipalsAndResource(
-      publicPrincipal,
-      resourceType,
-      resourceId,
-    );
-
-    // Check if any entry has the required permission bits
-    return entries.some((entry) => (entry.permBits & requiredPermissions) === requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.hasPublicPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Bulk update permissions for a resource (grant, update, revoke)
- * Efficiently handles multiple permission changes in a single transaction
- *
- * @param {Object} params - Parameters for bulk permission update
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {Array<TPrincipal>} params.updatedPrincipals - Array of principals to grant/update permissions for
- * @param {Array<TPrincipal>} params.revokedPrincipals - Array of principals to revoke permissions from
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID making the changes
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} Results object with granted, updated, revoked arrays and error details
- */
-const bulkUpdateResourcePermissions = async ({
-  resourceType,
-  resourceId,
-  updatedPrincipals = [],
-  revokedPrincipals = [],
-  grantedBy,
-  session,
-}) => {
-  const supportsTransactions = await getTransactionSupport(mongoose, transactionSupportCache);
-  transactionSupportCache = supportsTransactions;
-  let localSession = session;
-  let shouldEndSession = false;
-
-  try {
-    if (!Array.isArray(updatedPrincipals)) {
-      throw new Error('updatedPrincipals must be an array');
-    }
-
-    if (!Array.isArray(revokedPrincipals)) {
-      throw new Error('revokedPrincipals must be an array');
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    if (!localSession && supportsTransactions) {
-      localSession = await mongoose.startSession();
-      localSession.startTransaction();
-      shouldEndSession = true;
-    }
-
-    const sessionOptions = localSession ? { session: localSession } : {};
-
-    const roles = await AccessRole.find({ resourceType }).lean();
-    const rolesMap = new Map();
-    roles.forEach((role) => {
-      rolesMap.set(role.accessRoleId, role);
-    });
-
-    const results = {
-      granted: [],
-      updated: [],
-      revoked: [],
-      errors: [],
-    };
-
-    const bulkWrites = [];
-
-    for (const principal of updatedPrincipals) {
-      try {
-        if (!principal.accessRoleId) {
-          results.errors.push({
-            principal,
-            error: 'accessRoleId is required for updated principals',
-          });
-          continue;
-        }
-
-        const role = rolesMap.get(principal.accessRoleId);
-        if (!role) {
-          results.errors.push({
-            principal,
-            error: `Role ${principal.accessRoleId} not found`,
-          });
-          continue;
-        }
-
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        const update = {
-          $set: {
-            permBits: role.permBits,
-            roleId: role._id,
-            grantedBy,
-            grantedAt: new Date(),
-          },
-          $setOnInsert: {
-            principalType: principal.type,
-            resourceType,
-            resourceId,
-            ...(principal.type !== 'public' && {
-              principalId: principal.id,
-              principalModel: principal.type === 'user' ? 'User' : 'Group',
-            }),
-          },
-        };
-
-        bulkWrites.push({
-          updateOne: {
-            filter: query,
-            update: update,
-            upsert: true,
-          },
-        });
-
-        results.granted.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          accessRoleId: principal.accessRoleId,
-          memberCount: principal.memberCount,
-          memberIds: principal.memberIds,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (bulkWrites.length > 0) {
-      await AclEntry.bulkWrite(bulkWrites, sessionOptions);
-    }
-
-    const deleteQueries = [];
-    for (const principal of revokedPrincipals) {
-      try {
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        deleteQueries.push(query);
-
-        results.revoked.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          memberCount: principal.memberCount,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (deleteQueries.length > 0) {
-      await AclEntry.deleteMany(
-        {
-          $or: deleteQueries,
-        },
-        sessionOptions,
-      );
-    }
-
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.commitTransaction();
-    }
-
-    return results;
-  } catch (error) {
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.abortTransaction();
-    }
-    logger.error(`[PermissionService.bulkUpdateResourcePermissions] Error: ${error.message}`);
-    throw error;
-  } finally {
-    if (shouldEndSession && localSession) {
-      localSession.endSession();
-    }
-  }
-};
-
-module.exports = {
-  grantPermission,
-  checkPermission,
-  getEffectivePermissions,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-  getAvailableRoles,
-  bulkUpdateResourcePermissions,
-  ensurePrincipalExists,
-  ensureGroupPrincipalExists,
-  syncUserEntraGroupMemberships,
-};

api/server/services/PluginService.js

@@ -1,6 +1,6 @@
-const { logger } = require('@librechat/data-schemas');
-const { encrypt, decrypt } = require('@librechat/api');
-const { findOnePluginAuth, updatePluginAuth, deletePluginAuth } = require('~/models');
+const { encrypt, decrypt } = require('~/server/utils/crypto');
+const { PluginAuth } = require('~/db/models');
+const { logger } = require('~/config');
 
 /**
  * Asynchronously retrieves and decrypts the authentication value for a user's plugin, based on a specified authentication field.
@@ -25,7 +25,7 @@ const { findOnePluginAuth, updatePluginAuth, deletePluginAuth } = require('~/mod
  */
 const getUserPluginAuthValue = async (userId, authField, throwError = true) => {
   try {
-    const pluginAuth = await findOnePluginAuth({ userId, authField });
+    const pluginAuth = await PluginAuth.findOne({ userId, authField }).lean();
     if (!pluginAuth) {
       throw new Error(`No plugin auth ${authField} found for user ${userId}`);
     }
@@ -79,12 +79,23 @@ const getUserPluginAuthValue = async (userId, authField, throwError = true) => {
 const updateUserPluginAuth = async (userId, authField, pluginKey, value) => {
   try {
     const encryptedValue = await encrypt(value);
-    return await updatePluginAuth({
-      userId,
-      authField,
-      pluginKey,
-      value: encryptedValue,
-    });
+    const pluginAuth = await PluginAuth.findOne({ userId, authField }).lean();
+    if (pluginAuth) {
+      return await PluginAuth.findOneAndUpdate(
+        { userId, authField },
+        { $set: { value: encryptedValue } },
+        { new: true, upsert: true },
+      ).lean();
+    } else {
+      const newPluginAuth = await new PluginAuth({
+        userId,
+        authField,
+        value: encryptedValue,
+        pluginKey,
+      });
+      await newPluginAuth.save();
+      return newPluginAuth.toObject();
+    }
   } catch (err) {
     logger.error('[updateUserPluginAuth]', err);
     return err;
@@ -94,25 +105,26 @@ const updateUserPluginAuth = async (userId, authField, pluginKey, value) => {
 /**
  * @async
  * @param {string} userId
- * @param {string | null} authField - The specific authField to delete, or null if `all` is true.
- * @param {boolean} [all=false] - Whether to delete all auths for the user (or for a specific pluginKey if provided).
- * @param {string} [pluginKey] - Optional. If `all` is true and `pluginKey` is provided, delete all auths for this user and pluginKey.
+ * @param {string} authField
+ * @param {boolean} [all]
  * @returns {Promise<import('mongoose').DeleteResult>}
  * @throws {Error}
  */
-const deleteUserPluginAuth = async (userId, authField, all = false, pluginKey) => {
+const deleteUserPluginAuth = async (userId, authField, all = false) => {
+  if (all) {
+    try {
+      const response = await PluginAuth.deleteMany({ userId });
+      return response;
+    } catch (err) {
+      logger.error('[deleteUserPluginAuth]', err);
+      return err;
+    }
+  }
+
   try {
-    return await deletePluginAuth({
-      userId,
-      authField,
-      pluginKey,
-      all,
-    });
+    return await PluginAuth.deleteOne({ userId, authField });
   } catch (err) {
-    logger.error(
-      `[deleteUserPluginAuth] Error deleting ${all ? 'all' : 'single'} auth(s) for userId: ${userId}${pluginKey ? ` and pluginKey: ${pluginKey}` : ''}`,
-      err,
-    );
+    logger.error('[deleteUserPluginAuth]', err);
     return err;
   }
 };

api/server/services/TokenService.js

@@ -0,0 +1,195 @@
+const axios = require('axios');
+const { logAxiosError } = require('@librechat/api');
+const { logger } = require('@librechat/data-schemas');
+const { TokenExchangeMethodEnum } = require('librechat-data-provider');
+const { handleOAuthToken } = require('~/models/Token');
+const { decryptV2 } = require('~/server/utils/crypto');
+
+/**
+ * Processes the access tokens and stores them in the database.
+ * @param {object} tokenData
+ * @param {string} tokenData.access_token
+ * @param {number} tokenData.expires_in
+ * @param {string} [tokenData.refresh_token]
+ * @param {number} [tokenData.refresh_token_expires_in]
+ * @param {object} metadata
+ * @param {string} metadata.userId
+ * @param {string} metadata.identifier
+ * @returns {Promise<void>}
+ */
+async function processAccessTokens(tokenData, { userId, identifier }) {
+  const { access_token, expires_in = 3600, refresh_token, refresh_token_expires_in } = tokenData;
+  if (!access_token) {
+    logger.error('Access token not found: ', tokenData);
+    throw new Error('Access token not found');
+  }
+  await handleOAuthToken({
+    identifier,
+    token: access_token,
+    expiresIn: expires_in,
+    userId,
+  });
+
+  if (refresh_token != null) {
+    logger.debug('Processing refresh token');
+    await handleOAuthToken({
+      token: refresh_token,
+      type: 'oauth_refresh',
+      userId,
+      identifier: `${identifier}:refresh`,
+      expiresIn: refresh_token_expires_in ?? null,
+    });
+  }
+  logger.debug('Access tokens processed');
+}
+
+/**
+ * Refreshes the access token using the refresh token.
+ * @param {object} fields
+ * @param {string} fields.userId - The ID of the user.
+ * @param {string} fields.client_url - The URL of the OAuth provider.
+ * @param {string} fields.identifier - The identifier for the token.
+ * @param {string} fields.refresh_token - The refresh token to use.
+ * @param {string} fields.token_exchange_method - The token exchange method ('default_post' or 'basic_auth_header').
+ * @param {string} fields.encrypted_oauth_client_id - The client ID for the OAuth provider.
+ * @param {string} fields.encrypted_oauth_client_secret - The client secret for the OAuth provider.
+ * @returns {Promise<{
+ *  access_token: string,
+ *  expires_in: number,
+ *  refresh_token?: string,
+ *  refresh_token_expires_in?: number,
+ * }>}
+ */
+const refreshAccessToken = async ({
+  userId,
+  client_url,
+  identifier,
+  refresh_token,
+  token_exchange_method,
+  encrypted_oauth_client_id,
+  encrypted_oauth_client_secret,
+}) => {
+  try {
+    const oauth_client_id = await decryptV2(encrypted_oauth_client_id);
+    const oauth_client_secret = await decryptV2(encrypted_oauth_client_secret);
+
+    const headers = {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      Accept: 'application/json',
+    };
+
+    const params = new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token,
+    });
+
+    if (token_exchange_method === TokenExchangeMethodEnum.BasicAuthHeader) {
+      const basicAuth = Buffer.from(`${oauth_client_id}:${oauth_client_secret}`).toString('base64');
+      headers['Authorization'] = `Basic ${basicAuth}`;
+    } else {
+      params.append('client_id', oauth_client_id);
+      params.append('client_secret', oauth_client_secret);
+    }
+
+    const response = await axios({
+      method: 'POST',
+      url: client_url,
+      headers,
+      data: params.toString(),
+    });
+    await processAccessTokens(response.data, {
+      userId,
+      identifier,
+    });
+    logger.debug(`Access token refreshed successfully for ${identifier}`);
+    return response.data;
+  } catch (error) {
+    const message = 'Error refreshing OAuth tokens';
+    throw new Error(
+      logAxiosError({
+        message,
+        error,
+      }),
+    );
+  }
+};
+
+/**
+ * Handles the OAuth callback and exchanges the authorization code for tokens.
+ * @param {object} fields
+ * @param {string} fields.code - The authorization code returned by the provider.
+ * @param {string} fields.userId - The ID of the user.
+ * @param {string} fields.identifier - The identifier for the token.
+ * @param {string} fields.client_url - The URL of the OAuth provider.
+ * @param {string} fields.redirect_uri - The redirect URI for the OAuth provider.
+ * @param {string} fields.token_exchange_method - The token exchange method ('default_post' or 'basic_auth_header').
+ * @param {string} fields.encrypted_oauth_client_id - The client ID for the OAuth provider.
+ * @param {string} fields.encrypted_oauth_client_secret - The client secret for the OAuth provider.
+ * @returns {Promise<{
+ *  access_token: string,
+ *  expires_in: number,
+ *  refresh_token?: string,
+ *  refresh_token_expires_in?: number,
+ * }>}
+ */
+const getAccessToken = async ({
+  code,
+  userId,
+  identifier,
+  client_url,
+  redirect_uri,
+  token_exchange_method,
+  encrypted_oauth_client_id,
+  encrypted_oauth_client_secret,
+}) => {
+  const oauth_client_id = await decryptV2(encrypted_oauth_client_id);
+  const oauth_client_secret = await decryptV2(encrypted_oauth_client_secret);
+
+  const headers = {
+    'Content-Type': 'application/x-www-form-urlencoded',
+    Accept: 'application/json',
+  };
+
+  const params = new URLSearchParams({
+    code,
+    grant_type: 'authorization_code',
+    redirect_uri,
+  });
+
+  if (token_exchange_method === TokenExchangeMethodEnum.BasicAuthHeader) {
+    const basicAuth = Buffer.from(`${oauth_client_id}:${oauth_client_secret}`).toString('base64');
+    headers['Authorization'] = `Basic ${basicAuth}`;
+  } else {
+    params.append('client_id', oauth_client_id);
+    params.append('client_secret', oauth_client_secret);
+  }
+
+  try {
+    const response = await axios({
+      method: 'POST',
+      url: client_url,
+      headers,
+      data: params.toString(),
+    });
+
+    await processAccessTokens(response.data, {
+      userId,
+      identifier,
+    });
+    logger.debug(`Access tokens successfully created for ${identifier}`);
+    return response.data;
+  } catch (error) {
+    const message = 'Error exchanging OAuth code';
+    throw new Error(
+      logAxiosError({
+        message,
+        error,
+      }),
+    );
+  }
+};
+
+module.exports = {
+  getAccessToken,
+  refreshAccessToken,
+};

api/server/services/ToolService.js

@@ -1,7 +1,5 @@
 const fs = require('fs');
 const path = require('path');
-const { sleep } = require('@librechat/agents');
-const { logger } = require('@librechat/data-schemas');
 const { zodToJsonSchema } = require('zod-to-json-schema');
 const { Calculator } = require('@langchain/community/tools/calculator');
 const { tool: toolFn, Tool, DynamicStructuredTool } = require('@langchain/core/tools');
@@ -33,12 +31,14 @@ const {
   toolkits,
 } = require('~/app/clients/tools');
 const { processFileURL, uploadImageBuffer } = require('~/server/services/Files/process');
-const { getEndpointsConfig, getCachedTools } = require('~/server/services/Config');
 const { createOnSearchResults } = require('~/server/services/Tools/search');
 const { isActionDomainAllowed } = require('~/server/services/domains');
+const { getEndpointsConfig } = require('~/server/services/Config');
 const { recordUsage } = require('~/server/services/Threads');
 const { loadTools } = require('~/app/clients/tools/util');
 const { redactMessage } = require('~/config/parsers');
+const { sleep } = require('~/server/utils');
+const { logger } = require('~/config');
 
 /**
  * @param {string} toolName
@@ -226,7 +226,7 @@ async function processRequiredActions(client, requiredActions) {
     `[required actions] user: ${client.req.user.id} | thread_id: ${requiredActions[0].thread_id} | run_id: ${requiredActions[0].run_id}`,
     requiredActions,
   );
-  const toolDefinitions = await getCachedTools({ includeGlobal: true });
+  const toolDefinitions = client.req.app.locals.availableTools;
   const seenToolkits = new Set();
   const tools = requiredActions
     .map((action) => {
@@ -553,7 +553,6 @@ async function loadAgentTools({ req, res, agent, tool_resources, openAIApiKey })
     tools: _agentTools,
     options: {
       req,
-      res,
       openAIApiKey,
       tool_resources,
       processFileURL,

api/server/services/UserService.js

@@ -1,6 +1,6 @@
 const { logger } = require('@librechat/data-schemas');
-const { encrypt, decrypt } = require('@librechat/api');
 const { ErrorTypes } = require('librechat-data-provider');
+const { encrypt, decrypt } = require('~/server/utils/crypto');
 const { updateUser } = require('~/models');
 const { Key } = require('~/db/models');
 
@@ -70,7 +70,6 @@ const getUserKeyValues = async ({ userId, name }) => {
   try {
     userValues = JSON.parse(userValues);
   } catch (e) {
-    logger.error('[getUserKeyValues]', e);
     throw new Error(
       JSON.stringify({
         type: ErrorTypes.INVALID_USER_KEY,

api/server/services/initializeMCP.js

@@ -1,54 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { CacheKeys, processMCPEnv } = require('librechat-data-provider');
-const { getMCPManager, getFlowStateManager } = require('~/config');
-const { getCachedTools, setCachedTools } = require('./Config');
-const { getLogStores } = require('~/cache');
-const { findToken, updateToken, createToken, deleteTokens } = require('~/models');
-
-/**
- * Initialize MCP servers
- * @param {import('express').Application} app - Express app instance
- */
-async function initializeMCP(app) {
-  const mcpServers = app.locals.mcpConfig;
-  if (!mcpServers) {
-    return;
-  }
-
-  logger.info('Initializing MCP servers...');
-  const mcpManager = getMCPManager();
-  const flowsCache = getLogStores(CacheKeys.FLOWS);
-  const flowManager = flowsCache ? getFlowStateManager(flowsCache) : null;
-
-  try {
-    await mcpManager.initializeMCP({
-      mcpServers,
-      flowManager,
-      tokenMethods: {
-        findToken,
-        updateToken,
-        createToken,
-        deleteTokens,
-      },
-      processMCPEnv,
-    });
-
-    delete app.locals.mcpConfig;
-    const availableTools = await getCachedTools();
-
-    if (!availableTools) {
-      logger.warn('No available tools found in cache during MCP initialization');
-      return;
-    }
-
-    const toolsCopy = { ...availableTools };
-    await mcpManager.mapAvailableTools(toolsCopy, flowManager);
-    await setCachedTools(toolsCopy, { isGlobal: true });
-
-    logger.info('MCP servers initialized successfully');
-  } catch (error) {
-    logger.error('Failed to initialize MCP servers:', error);
-  }
-}
-
-module.exports = initializeMCP;

api/server/services/start/checks.js

@@ -5,7 +5,8 @@ const {
   conflictingAzureVariables,
   extractVariableName,
 } = require('librechat-data-provider');
-const { isEnabled, checkEmailConfig } = require('~/server/utils');
+const { isEnabled } = require('~/server/utils');
+const { checkEmailConfig } = require('@librechat/auth');
 const { logger } = require('~/config');
 
 const secretDefaults = {

api/server/services/twoFactorService.js

@@ -1,5 +1,5 @@
 const { webcrypto } = require('node:crypto');
-const { hashBackupCode, decryptV3, decryptV2 } = require('@librechat/api');
+const { hashBackupCode, decryptV3, decryptV2 } = require('~/server/utils/crypto');
 const { updateUser } = require('~/models');
 
 // Base32 alphabet for TOTP secret encoding.

api/server/socialLogins.js

@@ -5,14 +5,17 @@ const MemoryStore = require('memorystore')(session);
 const RedisStore = require('connect-redis').default;
 const {
   setupOpenId,
+  getOpenIdConfig,
   googleLogin,
   githubLogin,
   discordLogin,
   facebookLogin,
   appleLogin,
-  setupSaml,
+  samlLogin,
   openIdJwtLogin,
-} = require('~/strategies');
+} = require('@librechat/auth');
+const { CacheKeys } = require('librechat-data-provider');
+const getLogStores = require('~/cache/getLogStores');
 const { isEnabled } = require('~/server/utils');
 const keyvRedis = require('~/cache/keyvRedis');
 const { logger } = require('~/config');
@@ -64,10 +67,14 @@ const configureSocialLogins = async (app) => {
     }
     app.use(session(sessionOptions));
     app.use(passport.session());
-    const config = await setupOpenId();
+
+    const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
+    const openidLogin = await setupOpenId(tokensCache);
+    passport.use('openid', openidLogin);
+
     if (isEnabled(process.env.OPENID_REUSE_TOKENS)) {
       logger.info('OpenID token reuse is enabled.');
-      passport.use('openidJwt', openIdJwtLogin(config));
+      passport.use('openidJwt', openIdJwtLogin(getOpenIdConfig()));
     }
     logger.info('OpenID Connect configured.');
   }
@@ -95,7 +102,8 @@ const configureSocialLogins = async (app) => {
     }
     app.use(session(sessionOptions));
     app.use(passport.session());
-    setupSaml();
+
+    passport.use('saml', samlLogin());
 
     logger.info('SAML Connect configured.');
   }

api/server/utils/crypto.js

@@ -1,15 +1,15 @@
-import 'dotenv/config';
-import crypto from 'node:crypto';
+require('dotenv').config();
+const crypto = require('node:crypto');
 const { webcrypto } = crypto;
 
 // Use hex decoding for both key and IV for legacy methods.
-const key = Buffer.from(process.env.CREDS_KEY ?? '', 'hex');
-const iv = Buffer.from(process.env.CREDS_IV ?? '', 'hex');
+const key = Buffer.from(process.env.CREDS_KEY, 'hex');
+const iv = Buffer.from(process.env.CREDS_IV, 'hex');
 const algorithm = 'AES-CBC';
 
 // --- Legacy v1/v2 Setup: AES-CBC with fixed key and IV ---
 
-export async function encrypt(value: string) {
+async function encrypt(value) {
   const cryptoKey = await webcrypto.subtle.importKey('raw', key, { name: algorithm }, false, [
     'encrypt',
   ]);
@@ -23,7 +23,7 @@ export async function encrypt(value: string) {
   return Buffer.from(encryptedBuffer).toString('hex');
 }
 
-export async function decrypt(encryptedValue: string) {
+async function decrypt(encryptedValue) {
   const cryptoKey = await webcrypto.subtle.importKey('raw', key, { name: algorithm }, false, [
     'decrypt',
   ]);
@@ -39,7 +39,7 @@ export async function decrypt(encryptedValue: string) {
 
 // --- v2: AES-CBC with a random IV per encryption ---
 
-export async function encryptV2(value: string) {
+async function encryptV2(value) {
   const gen_iv = webcrypto.getRandomValues(new Uint8Array(16));
   const cryptoKey = await webcrypto.subtle.importKey('raw', key, { name: algorithm }, false, [
     'encrypt',
@@ -54,12 +54,12 @@ export async function encryptV2(value: string) {
   return Buffer.from(gen_iv).toString('hex') + ':' + Buffer.from(encryptedBuffer).toString('hex');
 }
 
-export async function decryptV2(encryptedValue: string) {
+async function decryptV2(encryptedValue) {
   const parts = encryptedValue.split(':');
   if (parts.length === 1) {
     return parts[0];
   }
-  const gen_iv = Buffer.from(parts.shift() ?? '', 'hex');
+  const gen_iv = Buffer.from(parts.shift(), 'hex');
   const encrypted = parts.join(':');
   const cryptoKey = await webcrypto.subtle.importKey('raw', key, { name: algorithm }, false, [
     'decrypt',
@@ -81,10 +81,10 @@ const algorithm_v3 = 'aes-256-ctr';
  * Encrypts a value using AES-256-CTR.
  * Note: AES-256 requires a 32-byte key. Ensure that process.env.CREDS_KEY is a 64-character hex string.
  *
- * @param value - The plaintext to encrypt.
- * @returns The encrypted string with a "v3:" prefix.
+ * @param {string} value - The plaintext to encrypt.
+ * @returns {string} The encrypted string with a "v3:" prefix.
  */
-export function encryptV3(value: string) {
+function encryptV3(value) {
   if (key.length !== 32) {
     throw new Error(`Invalid key length: expected 32 bytes, got ${key.length} bytes`);
   }
@@ -94,7 +94,7 @@ export function encryptV3(value: string) {
   return `v3:${iv_v3.toString('hex')}:${encrypted.toString('hex')}`;
 }
 
-export function decryptV3(encryptedValue: string) {
+function decryptV3(encryptedValue) {
   const parts = encryptedValue.split(':');
   if (parts[0] !== 'v3') {
     throw new Error('Not a v3 encrypted value');
@@ -106,7 +106,7 @@ export function decryptV3(encryptedValue: string) {
   return decrypted.toString('utf8');
 }
 
-export async function getRandomValues(length: number) {
+async function getRandomValues(length) {
   if (!Number.isInteger(length) || length <= 0) {
     throw new Error('Length must be a positive integer');
   }
@@ -117,13 +117,24 @@ export async function getRandomValues(length: number) {
 
 /**
  * Computes SHA-256 hash for the given input.
- * @param input - The input to hash.
- * @returns The SHA-256 hash of the input.
+ * @param {string} input
+ * @returns {Promise<string>}
  */
-export async function hashBackupCode(input: string) {
+async function hashBackupCode(input) {
   const encoder = new TextEncoder();
   const data = encoder.encode(input);
   const hashBuffer = await webcrypto.subtle.digest('SHA-256', data);
   const hashArray = Array.from(new Uint8Array(hashBuffer));
   return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
 }
+
+module.exports = {
+  encrypt,
+  decrypt,
+  encryptV2,
+  decryptV2,
+  encryptV3,
+  decryptV3,
+  hashBackupCode,
+  getRandomValues,
+};

api/server/utils/index.js

@@ -2,38 +2,17 @@ const streamResponse = require('./streamResponse');
 const removePorts = require('./removePorts');
 const countTokens = require('./countTokens');
 const handleText = require('./handleText');
-const sendEmail = require('./sendEmail');
+const cryptoUtils = require('./crypto');
 const queue = require('./queue');
 const files = require('./files');
 const math = require('./math');
 
-/**
- * Check if email configuration is set
- * @returns {Boolean}
- */
-function checkEmailConfig() {
-  // Check if Mailgun is configured
-  const hasMailgunConfig =
-    !!process.env.MAILGUN_API_KEY && !!process.env.MAILGUN_DOMAIN && !!process.env.EMAIL_FROM;
-
-  // Check if SMTP is configured
-  const hasSMTPConfig =
-    (!!process.env.EMAIL_SERVICE || !!process.env.EMAIL_HOST) &&
-    !!process.env.EMAIL_USERNAME &&
-    !!process.env.EMAIL_PASSWORD &&
-    !!process.env.EMAIL_FROM;
-
-  // Return true if either Mailgun or SMTP is properly configured
-  return hasMailgunConfig || hasSMTPConfig;
-}
-
 module.exports = {
   ...streamResponse,
-  checkEmailConfig,
+  ...cryptoUtils,
   ...handleText,
   countTokens,
   removePorts,
-  sendEmail,
   ...files,
   ...queue,
   math,

api/server/utils/sendEmail.js

@@ -1,173 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const axios = require('axios');
-const FormData = require('form-data');
-const nodemailer = require('nodemailer');
-const handlebars = require('handlebars');
-const { logAxiosError } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { isEnabled } = require('~/server/utils/handleText');
-
-/**
- * Sends an email using Mailgun API.
- *
- * @async
- * @function sendEmailViaMailgun
- * @param {Object} params - The parameters for sending the email.
- * @param {string} params.to - The recipient's email address.
- * @param {string} params.from - The sender's email address.
- * @param {string} params.subject - The subject of the email.
- * @param {string} params.html - The HTML content of the email.
- * @returns {Promise<Object>} - A promise that resolves to the response from Mailgun API.
- */
-const sendEmailViaMailgun = async ({ to, from, subject, html }) => {
-  const mailgunApiKey = process.env.MAILGUN_API_KEY;
-  const mailgunDomain = process.env.MAILGUN_DOMAIN;
-  const mailgunHost = process.env.MAILGUN_HOST || 'https://api.mailgun.net';
-
-  if (!mailgunApiKey || !mailgunDomain) {
-    throw new Error('Mailgun API key and domain are required');
-  }
-
-  const formData = new FormData();
-  formData.append('from', from);
-  formData.append('to', to);
-  formData.append('subject', subject);
-  formData.append('html', html);
-  formData.append('o:tracking-clicks', 'no');
-
-  try {
-    const response = await axios.post(`${mailgunHost}/v3/${mailgunDomain}/messages`, formData, {
-      headers: {
-        ...formData.getHeaders(),
-        Authorization: `Basic ${Buffer.from(`api:${mailgunApiKey}`).toString('base64')}`,
-      },
-    });
-
-    return response.data;
-  } catch (error) {
-    throw new Error(logAxiosError({ error, message: 'Failed to send email via Mailgun' }));
-  }
-};
-
-/**
- * Sends an email using SMTP via Nodemailer.
- *
- * @async
- * @function sendEmailViaSMTP
- * @param {Object} params - The parameters for sending the email.
- * @param {Object} params.transporterOptions - The transporter configuration options.
- * @param {Object} params.mailOptions - The email options.
- * @returns {Promise<Object>} - A promise that resolves to the info object of the sent email.
- */
-const sendEmailViaSMTP = async ({ transporterOptions, mailOptions }) => {
-  const transporter = nodemailer.createTransport(transporterOptions);
-  return await transporter.sendMail(mailOptions);
-};
-
-/**
- * Sends an email using the specified template, subject, and payload.
- *
- * @async
- * @function sendEmail
- * @param {Object} params - The parameters for sending the email.
- * @param {string} params.email - The recipient's email address.
- * @param {string} params.subject - The subject of the email.
- * @param {Record<string, string>} params.payload - The data to be used in the email template.
- * @param {string} params.template - The filename of the email template.
- * @param {boolean} [throwError=true] - Whether to throw an error if the email sending process fails.
- * @returns {Promise<Object>} - A promise that resolves to the info object of the sent email or the error if sending the email fails.
- *
- * @example
- * const emailData = {
- *   email: 'recipient@example.com',
- *   subject: 'Welcome!',
- *   payload: { name: 'Recipient' },
- *   template: 'welcome.html'
- * };
- *
- * sendEmail(emailData)
- *   .then(info => console.log('Email sent:', info))
- *   .catch(error => console.error('Error sending email:', error));
- *
- * @throws Will throw an error if the email sending process fails and throwError is `true`.
- */
-const sendEmail = async ({ email, subject, payload, template, throwError = true }) => {
-  try {
-    // Read and compile the email template
-    const source = fs.readFileSync(path.join(__dirname, 'emails', template), 'utf8');
-    const compiledTemplate = handlebars.compile(source);
-    const html = compiledTemplate(payload);
-
-    // Prepare common email data
-    const fromName = process.env.EMAIL_FROM_NAME || process.env.APP_TITLE;
-    const fromEmail = process.env.EMAIL_FROM;
-    const fromAddress = `"${fromName}" <${fromEmail}>`;
-    const toAddress = `"${payload.name}" <${email}>`;
-
-    // Check if Mailgun is configured
-    if (process.env.MAILGUN_API_KEY && process.env.MAILGUN_DOMAIN) {
-      logger.debug('[sendEmail] Using Mailgun provider');
-      return await sendEmailViaMailgun({
-        from: fromAddress,
-        to: toAddress,
-        subject: subject,
-        html: html,
-      });
-    }
-
-    // Default to SMTP
-    logger.debug('[sendEmail] Using SMTP provider');
-    const transporterOptions = {
-      // Use STARTTLS by default instead of obligatory TLS
-      secure: process.env.EMAIL_ENCRYPTION === 'tls',
-      // If explicit STARTTLS is set, require it when connecting
-      requireTls: process.env.EMAIL_ENCRYPTION === 'starttls',
-      tls: {
-        // Whether to accept unsigned certificates
-        rejectUnauthorized: !isEnabled(process.env.EMAIL_ALLOW_SELFSIGNED),
-      },
-      auth: {
-        user: process.env.EMAIL_USERNAME,
-        pass: process.env.EMAIL_PASSWORD,
-      },
-    };
-
-    if (process.env.EMAIL_ENCRYPTION_HOSTNAME) {
-      // Check the certificate against this name explicitly
-      transporterOptions.tls.servername = process.env.EMAIL_ENCRYPTION_HOSTNAME;
-    }
-
-    // Mailer service definition has precedence
-    if (process.env.EMAIL_SERVICE) {
-      transporterOptions.service = process.env.EMAIL_SERVICE;
-    } else {
-      transporterOptions.host = process.env.EMAIL_HOST;
-      transporterOptions.port = process.env.EMAIL_PORT ?? 25;
-    }
-
-    const mailOptions = {
-      // Header address should contain name-addr
-      from: fromAddress,
-      to: toAddress,
-      envelope: {
-        // Envelope from should contain addr-spec
-        // Mistake in the Nodemailer documentation?
-        from: fromEmail,
-        to: email,
-      },
-      subject: subject,
-      html: html,
-    };
-
-    return await sendEmailViaSMTP({ transporterOptions, mailOptions });
-  } catch (error) {
-    if (throwError) {
-      throw error;
-    }
-    logger.error('[sendEmail]', error);
-    return error;
-  }
-};
-
-module.exports = sendEmail;