Add environment variable expansion for allowedDomains config

[npeham]

Summary

This PR adds support for environment variable substitution in the allowedDomains configuration across mcpSettings, actions, and registration sections. Operators can now reference environment variables using ${ENV_VAR} syntax, and if the resolved value is a comma-separated list (optionally wrapped in brackets), it is automatically expanded into multiple domains.

This allows operators to manage domain allowlists centrally via environment variables, e.g.:

MCP_ALLOWED_DOMAINS='http://internal:8080,https://secure.api.com'

Then reference it in config:

mcpSettings:
  allowedDomains:
    - '${MCP_ALLOWED_DOMAINS}'

Change Type

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Changes

• packages/data-provider/src/config.ts:

  • Added expandAllowedDomainsEntry() helper to resolve ${ENV_VAR} references and expand comma-separated lists
  • Added stripWrappingQuotes() utility for parsing quoted domain entries
  • Created allowedDomainsSchema Zod schema with transformation logic
  • Updated configSchema to use allowedDomainsSchema for mcpSettings.allowedDomains, actions.allowedDomains, and registration.allowedDomains

• packages/data-provider/src/config.spec.ts:

  • Added comprehensive test suite for allowedDomainsSchema covering:
    • Literal domain passthrough
    • Single environment variable resolution
    • Comma-separated list expansion
    • Bracket-wrapped and quoted list parsing
    • Combining literal entries with expanded env vars
    • Fail-closed behavior (undefined env vars remain as placeholders)
    • Empty entry filtering
    • Integration with configSchema

• librechat.example.yaml:

  • Updated documentation to explain ${ENV_VAR} syntax and comma-separated list expansion

Testing

All new functionality is covered by unit tests in config.spec.ts. The test suite validates:

• Environment variable resolution and expansion
• Comma-separated list parsing with optional bracket wrapping
• Quote stripping from individual entries
• Fail-closed behavior when env vars are undefined
• Integration with the main configSchema

Run tests with: cd packages/data-provider && npx jest config.spec.ts

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in complex areas of my code (JSDoc on public schema and helpers)
• I have made pertinent documentation changes (example config updated)
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective
• Local unit tests pass with my changes

https://claude.ai/code/session_01GmfhbeTigYTtP5Bw52Keek