From a1d4dc7226acaa744c27b0bd2d974df9eeb2a74b Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Sat, 18 Apr 2026 10:51:35 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=AA=20test:=20rename=20misleading=20pu?=
 =?UTF-8?q?blic-dedup=20test=20and=20add=20real=20dedup=20coverage?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test previously named "returns deduplicated IDs even if the public
principal has multiple entries" only set up a single ACL entry, so it
did not actually exercise deduplication. Split into two tests: one for
the happy path (single entry with required bits), and one that bypasses
`grantPermission`'s upsert via `AclEntry.create` to confirm the
application-layer dedup Map handles genuine duplicates.

Refs #12729.
---
 .../data-schemas/src/methods/aclEntry.spec.ts | 31 ++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/packages/data-schemas/src/methods/aclEntry.spec.ts b/packages/data-schemas/src/methods/aclEntry.spec.ts
index 9c246f4b1b..d93ef55cc1 100644
--- a/packages/data-schemas/src/methods/aclEntry.spec.ts
+++ b/packages/data-schemas/src/methods/aclEntry.spec.ts
@@ -1378,7 +1378,7 @@ describe('AclEntry Model Tests', () => {
     });
 
     describe('findPublicResourceIds', () => {
-      test('returns deduplicated IDs even if the public principal has multiple entries', async () => {
+      test('returns the public resource ID when required bits are present', async () => {
         const shared = new mongoose.Types.ObjectId();
         await methods.grantPermission(
           PrincipalType.PUBLIC,
@@ -1396,6 +1396,35 @@ describe('AclEntry Model Tests', () => {
         expect(result).toHaveLength(1);
         expect(result[0].toString()).toBe(shared.toString());
       });
+
+      test('deduplicates when duplicate public entries exist for the same resource', async () => {
+        /**
+         * `grantPermission` upserts, so duplicates are not reachable through the
+         * public API. Bypass it with `AclEntry.create` to confirm the
+         * application-layer dedup logic handles the defensive case.
+         */
+        const shared = new mongoose.Types.ObjectId();
+        await AclEntry.create([
+          {
+            principalType: PrincipalType.PUBLIC,
+            resourceType: ResourceType.AGENT,
+            resourceId: shared,
+            permBits: PermissionBits.VIEW,
+            grantedBy: grantedById,
+          },
+          {
+            principalType: PrincipalType.PUBLIC,
+            resourceType: ResourceType.AGENT,
+            resourceId: shared,
+            permBits: PermissionBits.VIEW | PermissionBits.EDIT,
+            grantedBy: grantedById,
+          },
+        ]);
+
+        const result = await methods.findPublicResourceIds(ResourceType.AGENT, PermissionBits.VIEW);
+        expect(result).toHaveLength(1);
+        expect(result[0].toString()).toBe(shared.toString());
+      });
     });
 
     describe('getSoleOwnedResourceIds', () => {