LibreChat/api/server/services
Atef Bellaaj 187ab787da
🌩️ feat: CloudFront CDN File Strategy (#12193)
* 🌩️ feat: CloudFront CDN File Strategy + signed cookies

Squashed from PR #12193:
- feat(storage): add CloudFront CDN file strategy
- feat(auth): add CloudFront signed cookie support

Note: package.json/package-lock.json dependency additions are intentionally
omitted from this commit and will be re-added via `npm install` after rebase
to avoid lock-file merge conflicts. The two new peer deps that need to be
re-installed are:
  - @aws-sdk/client-cloudfront@^3.1032.0
  - @aws-sdk/cloudfront-signer@^3.1012.0

Also fixes 4 missing destructured names in AuthService.spec.js
(getUserById, generateToken, generateRefreshToken, createSession) that
were referenced in tests but not imported from the mocked '~/models'.

* 📦 chore: install CloudFront SDK deps for PR #12193

Adds the two AWS CloudFront packages required by the rebased
CloudFront CDN strategy:
  - @aws-sdk/client-cloudfront
  - @aws-sdk/cloudfront-signer

Following the @aws-sdk/client-s3 pattern:
  - api/package.json: regular dependency (runtime resolution)
  - packages/api/package.json: peerDependency

Generated by `npm install` against the freshly rebased lock file
to avoid the merge conflicts that came from the original PR's
lock-file edits being made against an older base of dev.

* 🐛 fix: CI failures + review findings on CloudFront PR #12193

CI fixes
- Rename packages/data-provider/src/__tests__/cloudfront-config.test.ts
  → src/cloudfront-config.spec.ts. Jest's default testMatch picks up
  __tests__/ directories even inside dist/, so the compiled .d.ts shell
  was being executed as an empty test suite. Moving to .spec.ts (matching
  the rest of the package) avoids the dist/ pickup.
- Add cookieExpiry: 1800 to CloudFront crud.test makeConfig: the schema
  applies a default so CloudFrontFullConfig requires it.

Review findings addressed
- #1 (Codex + comprehensive): Normalize CloudFront domain with /\/+$/
  regex (and key with /^\/+/ regex) in buildCloudFrontUrl, matching the
  cookie code so resource policy and file URLs stay aligned even when
  the configured domain has multiple trailing slashes. Added tests.
- #2: Move DEFAULT_BASE_PATH out of s3Config into shared
  packages/api/src/storage/constants.ts. ImageService no longer imports
  S3-specific config.
- #3: getCloudFrontConfig() returns Readonly<CloudFrontFullConfig> | null
  to discourage mutation of the cached signing config.
- #4: Add cross-field refinement tests for cloudfrontConfigSchema
  (invalidateOnDelete-without-distributionId,
  imageSigning="cookies"-without-cookieDomain).
- #6: Revert unrelated MCP comment re-indentation in
  librechat.example.yaml.
- #7: Add azure_blob to the strategy list comment.

Skipped
- #5 (extractKeyFromS3Url with CloudFront URLs): existing
  deleteFileFromCloudFront tests already cover the path-equivalence
  assumption; renaming the helper is real refactor work beyond this
  PR's scope.
- #8, #9 (NIT, low confidence): leaving for author judgement.

* 🧹 chore: drop dead DEFAULT_BASE_PATH from s3Config test mock

After moving DEFAULT_BASE_PATH to ~/storage/constants, crud.ts no longer
reads it from s3Config — so the entry in the s3Config jest mock was
misleading dead config. The tests still pass because the unmocked real
constants module provides the value.

---------

Co-authored-by: Danny Avila <danny@librechat.ai>
2026-05-05 13:21:05 -04:00
..
__tests__ 🐛 fix: Propagate User Identity to Subagent MCP Tool Calls (#12950) 2026-05-05 12:19:50 +09:00
Artifacts 🪄 fix: Code Block handling in Artifact Updates (#11417) 2026-01-20 08:45:43 -05:00
Config 🛡️ fix: Handle MCP Tool Cache Lookup Failures (#12910) 2026-05-02 09:21:28 +09:00
Endpoints 🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831) 2026-04-27 08:56:39 +09:00
Files 🌩️ feat: CloudFront CDN File Strategy (#12193) 2026-05-05 13:21:05 -04:00
Runs 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
start 🧬 chore: Align LibreChat With Agents LangChain Upgrade (#12922) 2026-05-03 12:46:01 -04:00
Threads 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
Tools 🛡️ fix: Filter user_provided Sentinel in Tool Credential Loading (#12840) 2026-04-29 09:09:54 +09:00
ActionService.js 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933) 2026-05-03 21:43:59 -04:00
ActionService.spec.js ⚗️ feat: Agent Context Compaction/Summarization (#12287) 2026-03-21 14:28:56 -04:00
AssistantService.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
AuthService.js 🌩️ feat: CloudFront CDN File Strategy (#12193) 2026-05-05 13:21:05 -04:00
AuthService.spec.js 🌩️ feat: CloudFront CDN File Strategy (#12193) 2026-05-05 13:21:05 -04:00
cleanup.js 📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830) 2026-03-21 14:28:53 -04:00
createRunBody.js feat: Add Current Datetime to Assistants (v1/v2) (#4952) 2024-12-11 15:26:18 -05:00
GraphApiService.js 🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606) 2026-04-13 08:50:52 -04:00
GraphApiService.spec.js 🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794) 2025-12-11 16:37:16 -05:00
GraphTokenService.js 🔒 refactor: graphTokenController to use federated access token for OBO assertion (#11893) 2026-02-21 18:03:39 -05:00
initializeMCPs.js 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933) 2026-05-03 21:43:59 -04:00
initializeMCPs.spec.js 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933) 2026-05-03 21:43:59 -04:00
initializeOAuthReconnectManager.js 💫 feat: MCP OAuth Auto-Reconnect (#9646) 2025-09-17 16:49:36 -04:00
MCP.js 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933) 2026-05-03 21:43:59 -04:00
MCP.spec.js 🪟 feat: Add allowedAddresses Exemption List For SSRF-Guarded Targets (#12933) 2026-05-03 21:43:59 -04:00
PermissionService.js 🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606) 2026-04-13 08:50:52 -04:00
PermissionService.spec.js 🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606) 2026-04-13 08:50:52 -04:00
PluginService.js 🔌 feat: MCP Reinitialization and OAuth in UI (#8598) 2025-07-22 22:52:45 -04:00
systemGrant.spec.js 📜 feat: Implement System Grants for Capability-Based Authorization (#11896) 2026-03-21 14:28:54 -04:00
ToolService.js 🐛 fix: Propagate User Identity to Subagent MCP Tool Calls (#12950) 2026-05-05 12:19:50 +09:00
twoFactorService.js 🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223) 2026-03-14 01:51:31 -04:00