🩻 feat(insights): Scope Insights to Authorized Agents (#15549)

* feat(insights): add agent-scoped access

* fix(insights): exclude unattributed assistant messages

* fix(sharing): key role insight toggles by principal

* fix(sharing): preserve insight grant snapshot

* fix(permissions): preserve insight bits atomically

* fix(permissions): guard insight audit rollback

* fix(insights): keep admin grant controls accessible

* fix(permissions): reconcile duplicate principal updates

* fix(insights): show automatic admin access

* fix(permissions): harden insights access updates

* fix(insights): simplify authorization and preserve client state

api/server/middleware/checkPeoplePickerAccess.js

@@ -1,5 +1,10 @@
 const { logger } = require('@librechat/data-schemas');
-const { PrincipalType, PermissionTypes, Permissions } = require('librechat-data-provider');
+const {
+  PrincipalType,
+  PermissionTypes,
+  Permissions,
+  SystemRoles,
+} = require('librechat-data-provider');
 const { getRoleByName } = require('~/models');
 
 const VALID_PRINCIPAL_TYPES = new Set([
@@ -27,6 +32,10 @@ const checkPeoplePickerAccess = async (req, res, next) => {
       });
     }
 
+    if (user.role === SystemRoles.ADMIN) {
+      return next();
+    }
+
     const role = await getRoleByName(user.role);
     if (!role || !role.permissions) {
       return res.status(403).json({

api/server/middleware/checkPeoplePickerAccess.spec.js

@@ -1,5 +1,10 @@
 const { logger } = require('@librechat/data-schemas');
-const { PrincipalType, PermissionTypes, Permissions } = require('librechat-data-provider');
+const {
+  PrincipalType,
+  PermissionTypes,
+  Permissions,
+  SystemRoles,
+} = require('librechat-data-provider');
 const { checkPeoplePickerAccess } = require('./checkPeoplePickerAccess');
 const { getRoleByName } = require('~/models');
 
@@ -53,6 +58,16 @@ describe('checkPeoplePickerAccess', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it('allows a literal admin regardless of configured people picker permissions', async () => {
+    req.user.role = SystemRoles.ADMIN;
+
+    await checkPeoplePickerAccess(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(getRoleByName).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+  });
+
   it('should allow access when searching for users with VIEW_USERS permission', async () => {
     req.query.type = PrincipalType.USER;
     getRoleByName.mockResolvedValue({