From 75cd652b694a396c9d2361e7abc2e9fd9825dee5 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Sat, 18 Apr 2026 11:25:20 -0400
Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20refactor:=20extract=20`fil?=
 =?UTF-8?q?terByBitsAndDedup`=20helper=20for=20ACL=20reads?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`findAccessibleResources` and `findPublicResourceIds` each inlined the
same bitmask-filter + `Map`-based dedup loop. Lift it into a private
`filterByBitsAndDedup(entries, requiredBits)` helper so the Cosmos-DB
compatible pattern lives in one place. Pure rename/extract — no
behavior change.

Refs #12729.
---
 packages/data-schemas/src/methods/aclEntry.ts | 47 ++++++++++---------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/packages/data-schemas/src/methods/aclEntry.ts b/packages/data-schemas/src/methods/aclEntry.ts
index 43e1bba9cf..100d8531d7 100644
--- a/packages/data-schemas/src/methods/aclEntry.ts
+++ b/packages/data-schemas/src/methods/aclEntry.ts
@@ -10,6 +10,29 @@ import type {
 import type { AclEntry, IAclEntry } from '~/types';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
 
+/**
+ * Filter entries by a required permission bitmask and deduplicate by resourceId,
+ * preserving the first-seen `Types.ObjectId` instance. Used in place of
+ * `$bitsAllSet` for compatibility with MongoDB forks (e.g. Azure Cosmos DB for
+ * MongoDB) that do not implement the `$bitsAllSet` query operator.
+ */
+function filterByBitsAndDedup(
+  entries: Array<{ resourceId: Types.ObjectId; permBits: number }>,
+  requiredBits: number,
+): Types.ObjectId[] {
+  const uniqueIds = new Map<string, Types.ObjectId>();
+  for (const entry of entries) {
+    if ((entry.permBits & requiredBits) !== requiredBits) {
+      continue;
+    }
+    const key = entry.resourceId.toString();
+    if (!uniqueIds.has(key)) {
+      uniqueIds.set(key, entry.resourceId);
+    }
+  }
+  return Array.from(uniqueIds.values());
+}
+
 export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
   /**
    * Find ACL entries for a specific principal (user or group)
@@ -359,17 +382,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
       .select('resourceId permBits')
       .lean();
 
-    const uniqueIds = new Map<string, Types.ObjectId>();
-    for (const entry of entries) {
-      if ((entry.permBits & requiredPermBit) !== requiredPermBit) {
-        continue;
-      }
-      const key = entry.resourceId.toString();
-      if (!uniqueIds.has(key)) {
-        uniqueIds.set(key, entry.resourceId);
-      }
-    }
-    return Array.from(uniqueIds.values());
+    return filterByBitsAndDedup(entries, requiredPermBit);
   }
 
   /**
@@ -417,17 +430,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
       .select('resourceId permBits')
       .lean();
 
-    const uniqueIds = new Map<string, Types.ObjectId>();
-    for (const entry of entries) {
-      if ((entry.permBits & requiredPermissions) !== requiredPermissions) {
-        continue;
-      }
-      const key = entry.resourceId.toString();
-      if (!uniqueIds.has(key)) {
-        uniqueIds.set(key, entry.resourceId);
-      }
-    }
-    return Array.from(uniqueIds.values());
+    return filterByBitsAndDedup(entries, requiredPermissions);
   }
 
   /**