From da5f6a8b2f81a6a8742a76dd080c90defc8ac82e Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Sat, 18 Apr 2026 10:33:09 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix:=20delegate=20`findPubliclyA?=
 =?UTF-8?q?ccessibleResources`=20to=20fixed=20DB=20method?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`AccessControlService.findPubliclyAccessibleResources` inlined the same
`$bitsAllSet` query as the data-schemas layer, which fails on Azure
Cosmos DB for MongoDB. Delegate to `_dbMethods.findPublicResourceIds`
so a single implementation carries the Cosmos-compatible bitwise logic.

Refs #12729.
---
 packages/api/src/acl/accessControlService.ts | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/packages/api/src/acl/accessControlService.ts b/packages/api/src/acl/accessControlService.ts
index 98bc939c24..57d072561a 100644
--- a/packages/api/src/acl/accessControlService.ts
+++ b/packages/api/src/acl/accessControlService.ts
@@ -174,16 +174,7 @@ export class AccessControlService {
 
       this.validateResourceType(resourceType);
 
-      // Find all public ACL entries where the public principal has at least the required permission bits
-      const entries = await this._aclModel
-        .find({
-          principalType: PrincipalType.PUBLIC,
-          resourceType,
-          permBits: { $bitsAllSet: requiredPermissions },
-        })
-        .distinct('resourceId');
-
-      return entries;
+      return await this._dbMethods.findPublicResourceIds(resourceType, requiredPermissions);
     } catch (error) {
       if (error instanceof Error) {
         logger.error(`[PermissionService.findPubliclyAccessibleResources] Error: ${error.message}`);