What causes "requiredPermissions must be a positive number" in danny-avila/LibreChat?

Pass a value from PermissionBits (e.g. PermissionBits.VIEW) or a bitwise OR of bits.

danny-avila/LibreChat · error · Error

requiredPermissions must be a positive number

Error message

requiredPermissions must be a positive number

What it means

findAccessibleResourcesForPrincipals requires requiredPermissions to be a positive number (>= 1). The bit-mask query needs at least one permission bit (e.g. PermissionBits.VIEW = 1). Zero, negative, NaN, or non-number values are rejected before the query runs.

Source

Thrown at packages/api/src/acl/accessControlService.ts:182

  }: {
    userId: string | Types.ObjectId;
    role?: string;
  }): Promise<ResolvedPrincipal[]> {
    return await this._dbMethods.getUserPrincipals({ userId, role });
  }

  public async findAccessibleResourcesForPrincipals({
    principalsList,
    resourceType,
    requiredPermissions,
  }: {
    principalsList: ResolvedPrincipal[];
    resourceType: string;
    requiredPermissions: number;
  }): Promise<Types.ObjectId[]> {
    try {
      if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
        throw new Error('requiredPermissions must be a positive number');
      }

      this.validateResourceType(resourceType as ResourceType);

      if (principalsList.length === 0) {
        return [];
      }

      return await this._dbMethods.findAccessibleResources(
        principalsList,
        resourceType,
        requiredPermissions,
      );
    } catch (error) {
      if (error instanceof Error) {
        logger.error(
          `[PermissionService.findAccessibleResourcesForPrincipals] Error: ${error.message}`,
        );

View on GitHub (pinned to 5ff282f900)

Solutions

Pass a value from PermissionBits (e.g. PermissionBits.VIEW) or a bitwise OR of bits.
If the caller has no specific requirement, default to PermissionBits.VIEW rather than 0.
Compute the mask once and assert it is >= 1 before calling.

Example fix

// before
await findAccessibleResourcesForPrincipals({ principalsList, resourceType, requiredPermissions: 0 });

// after
import { PermissionBits } from 'librechat-data-provider';
await findAccessibleResourcesForPrincipals({
  principalsList,
  resourceType,
  requiredPermissions: PermissionBits.VIEW | PermissionBits.EDIT,
});

Defensive patterns

Strategy: validation

Validate before calling

import { PermissionBits } from 'librechat-data-provider';
function assertPermissionMask(v: unknown): number {
  if (typeof v !== 'number' || !Number.isFinite(v) || v < 1) {
    throw new Error('requiredPermissions must be a positive number');
  }
  return v;
}

Type guard

const isPermissionMask = (v: unknown): v is number =>
  typeof v === 'number' && Number.isFinite(v) && v >= 1;

Prevention

Always pass a PermissionBits value or a bitwise OR of bits.
Default to PermissionBits.VIEW rather than 0 when unspecified.
Compute the mask once and assert >= 1 before the call.

When it happens

Trigger: Calling findAccessibleResourcesForPrincipals with requiredPermissions = 0, undefined, NaN, a string, or a negative number; computing the mask incorrectly so it lands at 0.

Common situations: Defaulting requiredPermissions to 0 when no checkbox is selected in the UI; passing a permission name string ('view') instead of the numeric bit; arithmetic that ANDs all bits away to 0.

Related errors

AI-assisted analysis of danny-avila/LibreChat@5ff282f900 (2026-08-12). Data as JSON: /api/errors/6a056ad25089866a. Report an issue: GitHub.