Serve side chat management by jeswr · Pull Request #10 · solid/LibreChat

jeswr · 2026-02-08T17:53:05Z

PR'ing the work done by @langsamu and @PreciousOritsedere to add Solid Login and Chat Management to Librechat to the main branch of the solid fork to enable internal review before upstreaming.

jeswr

Partial review - to be completed tomorrow morning.

api/models/Message.js

api/models/Conversation.js

api/app/clients/BaseClient.js

api/models/Conversation.js

api/server/middleware/validateMessageReq.js

api/server/routes/agents/chat.js

api/server/routes/agents/index.js

api/server/routes/config.js

api/server/routes/convos.js

jeswr · 2026-02-09T09:53:29Z

@PreciousOritsedere the primary architectural comments I have as I am completing this review are are:

There is lots of duplicated code - we should be applying DRY principles
There appear to be code changes that are not Solid specific. Any logging that is useful for Librechat in general should be contributed in a separate PR to make reviewing easier
Theres still appears to be lots code specifying the content of the JSON document written to a Solid Pod. Since this document content is shared with the documents sent to MongoDB; please try and remove this custom code.

PreciousOritsedere · 2026-02-10T17:59:21Z

Theres still appears to be lots code specifying the content of the JSON document written to a Solid Pod. Since this document content is shared with the documents sent to MongoDB; please try and remove this custom code.

I have pushed this commit to address this : "Theres still appears to be lots code specifying the content of the JSON document written to a Solid Pod. Since this document content is shared with the documents sent to MongoDB; please try and remove this custom code."

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

…penID provider.

…ng data on updates - Added req.user?.openidId check in saveConvo to ensure Solid storage is only used for Solid users - Fix saveConvoToSolid to merge updates with existing conversation data instead of overwriting - Preserve all conversation fields when only updating specific fields (e.g., title) - Fixes issue where conversation titles were not being saved to Solid Pod and where titles would revert to "untitled" after page refresh

- Add req parameter to duplicateConversation function for Solid storage support - Implement individual save operations for Solid users (saveConvo/saveMessage) - Maintain parent-child message relationships when duplicating - Use getMessagesFromSolid to retrieve messages from Solid Pod - Preserve existing bulk save approach for MongoDB users

- Added req parameter to deleteConvos function for Solid storage support - Implemented Solid storage deletion using deleteConvosFromSolid - Delete all associated messages when deleting conversations - Handle both single conversation and bulk deletion scenarios - Maintained MongoDB compatibility for non-Solid users

- Add support for archiving and unarchiving conversations stored in Solid Pods. - The isArchived field is now properly saved, retrieved, and filtered when fetching conversations for Solid-authenticated users.

Commented out several lines in conversation object construction and added TODOs for future enhancements.

- Added support for sharing conversations stored in Solid Pods by granting public read access via ACL (Access Control List) while preserving owner write permissions. This allows Solid users to share conversations while maintaining the ability to continue adding more messages to the conversation(write access)

- Added SolidIcon component for Solid authentication branding - Added Solid-specific configuration (solidLoginEnabled, solidLabel, solidImageUrl) - Added SOLID_OPENID_* environment variables for Solid authentication - Configure both Solid and generic OpenID strategies independently - Both buttons use the same /oauth/openid route and 'openid' strategy - Update TypeScript types to include Solid configuration fields This allows users to have separate "Login with Solid" and "Login with OpenID" buttons with different labels while maintaining the same authentication flow. The Solid button appears when SOLID_OPENID_* env vars are configured, and the OpenID button appears when OPENID_* env vars are configured (or when Solid is enabled, since they share the same strategy).

removed commented out code Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

api/server/services/SolidStorage.js

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

api/server/services/SolidStorage.js

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

api/server/services/SolidStorage.js

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

api/server/services/SolidStorage.js

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

api/server/services/SolidStorage.js

…rage, path walk

… writes - Run ensureBaseStructure in background after Solid/OpenID login (oauth handler) - Writes await baton so they don't run until base structure is ready - Lazy init if user never hit OAuth callback; return promise so .catch() is safe

Copilot

Pull request overview

This PR integrates Solid Pod storage for LibreChat, enabling users who log in via "Continue with Solid" to store conversations and messages in their personal Solid Pods instead of MongoDB. The implementation adds Solid-OIDC authentication, Pod storage operations, public sharing with ACL-based permissions, and maintains full backward compatibility with MongoDB for non-Solid users.

Changes:

Added Solid-OIDC authentication flow with dedicated "Continue with Solid" button
Implemented Solid Pod storage for conversations and messages with automatic container management
Added public sharing functionality using manual ACL (Access Control List) for shared conversations
Integrated storage backend selection based on authentication provider (Solid vs MongoDB)
Added comprehensive conversation management (create, read, update, delete, duplicate, share) for Solid storage

Reviewed changes

Copilot reviewed 41 out of 43 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`api/server/services/SolidStorage.js`	Core Solid Pod operations including storage, retrieval, sharing, and ACL management
`api/server/utils/isSolidUser.js`	Helper to detect Solid login for storage routing
`api/models/Message.js`	Integrated Solid storage for messages with MongoDB fallback
`api/models/Conversation.js`	Integrated Solid storage for conversations with MongoDB fallback
`api/strategies/SolidOpenidStrategy.js`	Solid-OIDC authentication strategy implementation
`packages/data-schemas/src/methods/share.ts`	Updated share methods to support Solid Pod storage
`packages/data-provider/src/createPayload.ts`	Added payload normalization for Solid storage compatibility
`api/server/routes/share.js`	Updated share routes to pass request object for Solid support
`api/server/routes/config.js`	Added Solid configuration to startup config
`client/src/components/Auth/SocialLoginRender.tsx`	Added Solid login button with custom branding

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-18T21:49:28Z

api/server/socialLogins.js

  const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
  const sessionOptions = {
-    secret: process.env.OPENID_SESSION_SECRET,
+    secret: process.env.SOLID_OPENID_SESSION_SECRET,


The session secret should use OPENID_SESSION_SECRET (generic) instead of SOLID_OPENID_SESSION_SECRET (Solid-specific) on line 89 to match the original code on line 59. Using different session secrets for Solid vs generic OpenID will cause session incompatibility issues.

Suggested change

secret: process.env.SOLID_OPENID_SESSION_SECRET,

secret: process.env.OPENID_SESSION_SECRET,

Copilot · 2026-02-18T21:49:29Z

api/strategies/SolidOpenidStrategy.js

+      client_secret: process.env.SOLID_OPENID_CLIENT_SECRET,
+    };
+
+    if (shouldGenerateNonce) {
+      clientMetadata.response_types = ['code'];
+      clientMetadata.grant_types = ['authorization_code'];
+      clientMetadata.token_endpoint_auth_method = 'client_secret_post';


Solid pods using dynamic client registration should not require a client_secret. The presence of SOLID_OPENID_CLIENT_SECRET suggests static client registration, which is less secure and not aligned with Solid's recommended authentication flow. Consider implementing dynamic client registration without a client secret.

Suggested change

client_secret: process.env.SOLID_OPENID_CLIENT_SECRET,

};

if (shouldGenerateNonce) {

clientMetadata.response_types = ['code'];

clientMetadata.grant_types = ['authorization_code'];

clientMetadata.token_endpoint_auth_method = 'client_secret_post';

};

if (shouldGenerateNonce) {

clientMetadata.response_types = ['code'];

clientMetadata.grant_types = ['authorization_code'];

Copilot · 2026-02-18T21:49:29Z

api/server/index.js

+    res.send({
+      '@context': ['https://www.w3.org/ns/solid/oidc-context.jsonld'],
+      redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL],
+
+      // TODO: Don't hardcode path
+      client_id: process.env.DOMAIN_SERVER + '/solid-client-id',


The redirect_uris and client_id use OPENID_CALLBACK_URL instead of SOLID_OPENID_CALLBACK_URL. This will cause authentication failures when Solid and generic OpenID have different callback URLs configured.

Suggested change

res.send({

'@context': ['https://www.w3.org/ns/solid/oidc-context.jsonld'],

redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL],

// TODO: Don't hardcode path

client_id: process.env.DOMAIN_SERVER + '/solid-client-id',

const solidCallbackPath =

process.env.SOLID_OPENID_CALLBACK_URL ||

process.env.OPENID_CALLBACK_URL ||

'/solid-client-id';

const solidClientIdUrl = (process.env.DOMAIN_SERVER || '') + solidCallbackPath;

res.send({

'@context': ['https://www.w3.org/ns/solid/oidc-context.jsonld'],

redirect_uris: [solidClientIdUrl],

client_id: solidClientIdUrl,

Copilot · 2026-02-18T21:49:29Z

api/server/routes/config.js

@@ -46,10 +46,14 @@ router.get('/', async function (req, res) {

    const isOpenIdEnabled =
      !!process.env.OPENID_CLIENT_ID &&


The isOpenIdEnabled check is missing OPENID_CLIENT_SECRET validation, which is inconsistent with the original check that included it. This could allow incomplete OpenID configuration to be considered enabled.

Suggested change

!!process.env.OPENID_CLIENT_ID &&

!!process.env.OPENID_CLIENT_ID &&

!!process.env.OPENID_CLIENT_SECRET &&

Use Promise.all over messageFiles so getFile + file.text() run in parallel instead of sequentially; keep per-file error handling and validation.

jeswr · 2026-02-20T08:19:05Z

api/server/services/SolidStorage.js

+  const promise = (async () => {
+    try {
+      const { authenticatedFetch, podUrl } = await getSolidFetchAndPodUrl(req);
+      await ensureBaseStructure(podUrl, authenticatedFetch);
+      logger.debug('[SolidStorage] Base structure ready after login', { openidId });
+    } catch (err) {
+      baseStructureBatonMap.delete(openidId);
+      logger.warn('[SolidStorage] Base structure init after login failed', {
+        openidId,
+        error: err?.message,
+      });
+      throw err;
+    }
+  })();
+  baseStructureBatonMap.set(openidId, promise);
+  return promise;


You can just call ensureBaseStructureReady here - no need to repeat the logic.

I have pushed this commit: d98aa69 to address this

api/server/services/SolidStorage.js

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

…terLogin

jeswr commented Feb 8, 2026

View reviewed changes

langsamu and others added 27 commits February 10, 2026 19:49

Duplicate OpenID strategy to enable Solid login

406d055

Proper naming for Solid-OIDC strategy

3a68fdd

Add task reminders about email in Solid login

b0f171d

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

Add Solid-OIDC Client ID Document route

895c24d

Take Solid-OIDC redirect URI from config

28e1018

Temporarily allow insecure OIDC AS for local development

db84761

Add client_id to Solid-OIDC Client ID Document

6967601

Don't require client secret for Solid-OIDC

d14da45

Added Middleware to log authorization code from received from Solid/O…

962a6b0

…penID provider.

server stores conversations in pod

40b99d8

updated progress documentation

bf7354a

update progress documentation

db5fe9a

update progress document

0f525bc

Update progress document

f5db68f

feat: implement archive functionality for Solid storage users

62d70c7

- Add support for archiving and unarchiving conversations stored in Solid Pods. - The isArchived field is now properly saved, retrieved, and filtered when fetching conversations for Solid-authenticated users.

Update progress document

d98ebb4

Comment out unused fields and add TODOs

8b834c5

Commented out several lines in conversation object construction and added TODOs for future enhancements.

debugging sharing

6dc8f2c

uodate progress document

4dee664

update progress document

3294941

update env.example

16f2022

Update api/models/Message.js

0a8a218

removed commented out code Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

PreciousOritsedere and others added 4 commits February 18, 2026 11:12

Update packages/api/src/auth/openid.ts

1be4297

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

Added comment back

9e88b48

remove commented code

214efd2

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

checkout queries.ts file from main to rebase

46a9bed

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

fix Unrelated re-ordering

c68048a

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

remove optional chaining

db84f14

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

remove fetch require import

d72bc4d

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

Update api/server/services/SolidStorage.js

1b8eef4

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

jeswr commented Feb 18, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

PreciousOritsedere added 2 commits February 18, 2026 15:32

feat(SolidStorage): robust Pod discovery via Link header, profile sto…

9425059

…rage, path walk

jeswr marked this pull request as ready for review February 18, 2026 21:39

Copilot AI review requested due to automatic review settings February 18, 2026 21:39

Copilot started reviewing on behalf of jeswr February 18, 2026 21:40 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

PreciousOritsedere added 5 commits February 19, 2026 14:30

fix(solid): use status-only error checks

f0fd8f8

perf(solid): fetch message files in parallel in getMessagesFromSolid

14505e0

Use Promise.all over messageFiles so getFile + file.text() run in parallel instead of sequentially; keep per-file error handling and validation.

perf(solid): cache Pod URL in session to avoid repeated profile requests

39f07b5

chore: fixing eslinting

c9f7f61

chore: fix linting

25db7a4

jeswr commented Feb 20, 2026

View reviewed changes

api/server/services/SolidStorage.js Outdated Show resolved Hide resolved

PreciousOritsedere and others added 3 commits February 20, 2026 15:35

jesse's changes for code optimization

c05dc70

Co-authored-by: Jesse Wright <63333554+jeswr@users.noreply.github.com>

refactor(solid): use ensureBaseStructureReady in startBaseStructureAf…

d98aa69

…terLogin

fix linting error

69d3c86

	secret: process.env.SOLID_OPENID_SESSION_SECRET,
	secret: process.env.OPENID_SESSION_SECRET,

		@@ -46,10 +46,14 @@ router.get('/', async function (req, res) {

		const isOpenIdEnabled =
		!!process.env.OPENID_CLIENT_ID &&

	!!process.env.OPENID_CLIENT_ID &&
	!!process.env.OPENID_CLIENT_ID &&
	!!process.env.OPENID_CLIENT_SECRET &&

Comments

Conversation

jeswr commented Feb 8, 2026

Uh oh!

jeswr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeswr commented Feb 9, 2026

Uh oh!

PreciousOritsedere commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

jeswr Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

PreciousOritsedere Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants