{"record":{"id":"6a056ad25089866a","repo":"danny-avila/LibreChat","slug":"requiredpermissions-must-be-a-positive-number","errorCode":null,"errorMessage":"requiredPermissions must be a positive number","messagePattern":"requiredPermissions must be a positive number","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/api/src/acl/accessControlService.ts","lineNumber":182,"sourceCode":"  }: {\n    userId: string | Types.ObjectId;\n    role?: string;\n  }): Promise<ResolvedPrincipal[]> {\n    return await this._dbMethods.getUserPrincipals({ userId, role });\n  }\n\n  public async findAccessibleResourcesForPrincipals({\n    principalsList,\n    resourceType,\n    requiredPermissions,\n  }: {\n    principalsList: ResolvedPrincipal[];\n    resourceType: string;\n    requiredPermissions: number;\n  }): Promise<Types.ObjectId[]> {\n    try {\n      if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {\n        throw new Error('requiredPermissions must be a positive number');\n      }\n\n      this.validateResourceType(resourceType as ResourceType);\n\n      if (principalsList.length === 0) {\n        return [];\n      }\n\n      return await this._dbMethods.findAccessibleResources(\n        principalsList,\n        resourceType,\n        requiredPermissions,\n      );\n    } catch (error) {\n      if (error instanceof Error) {\n        logger.error(\n          `[PermissionService.findAccessibleResourcesForPrincipals] Error: ${error.message}`,\n        );","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/packages/api/src/acl/accessControlService.ts#L164-L200","documentation":"findAccessibleResourcesForPrincipals requires requiredPermissions to be a positive number (>= 1). The bit-mask query needs at least one permission bit (e.g. PermissionBits.VIEW = 1). Zero, negative, NaN, or non-number values are rejected before the query runs.","triggerScenarios":"Calling findAccessibleResourcesForPrincipals with requiredPermissions = 0, undefined, NaN, a string, or a negative number; computing the mask incorrectly so it lands at 0.","commonSituations":"Defaulting requiredPermissions to 0 when no checkbox is selected in the UI; passing a permission name string ('view') instead of the numeric bit; arithmetic that ANDs all bits away to 0.","solutions":["Pass a value from PermissionBits (e.g. PermissionBits.VIEW) or a bitwise OR of bits.","If the caller has no specific requirement, default to PermissionBits.VIEW rather than 0.","Compute the mask once and assert it is >= 1 before calling."],"exampleFix":"// before\nawait findAccessibleResourcesForPrincipals({ principalsList, resourceType, requiredPermissions: 0 });\n\n// after\nimport { PermissionBits } from 'librechat-data-provider';\nawait findAccessibleResourcesForPrincipals({\n  principalsList,\n  resourceType,\n  requiredPermissions: PermissionBits.VIEW | PermissionBits.EDIT,\n});","handlingStrategy":"validation","validationCode":"import { PermissionBits } from 'librechat-data-provider';\nfunction assertPermissionMask(v: unknown): number {\n  if (typeof v !== 'number' || !Number.isFinite(v) || v < 1) {\n    throw new Error('requiredPermissions must be a positive number');\n  }\n  return v;\n}","typeGuard":"const isPermissionMask = (v: unknown): v is number =>\n  typeof v === 'number' && Number.isFinite(v) && v >= 1;","tryCatchPattern":null,"preventionTips":["Always pass a PermissionBits value or a bitwise OR of bits.","Default to PermissionBits.VIEW rather than 0 when unspecified.","Compute the mask once and assert >= 1 before the call."],"tags":["acl","validation","permissions","permission-bits"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}