From f9994d1547ffd88f852143bee0ad4c55ce4227a0 Mon Sep 17 00:00:00 2001
From: Atef Bellaaj <slalom.bellaaj@external.daimlertruck.com>
Date: Wed, 18 Jun 2025 14:37:51 +0200
Subject: [PATCH] feat: enhance agent permissions migration with DocumentDB
 compatibility and add dry-run script

---
 config/migrate-agent-permissions.js | 34 ++++++++++++++++-------------
 package.json                        |  5 ++++-
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/config/migrate-agent-permissions.js b/config/migrate-agent-permissions.js
index a50cf62ba9..0c7b218fd6 100644
--- a/config/migrate-agent-permissions.js
+++ b/config/migrate-agent-permissions.js
@@ -32,32 +32,36 @@ async function migrateAgentPermissionsEnhanced({ dryRun = true, batchSize = 100
 
   logger.info(`Found ${globalAgentIds.size} agents in global project`);
 
-  // Find agents without ACL entries
+  // Find agents without ACL entries using DocumentDB-compatible approach
   const agentsToMigrate = await Agent.aggregate([
     {
       $lookup: {
         from: 'aclentries',
-        let: { agentId: '$_id' },
-        pipeline: [
-          {
-            $match: {
-              $expr: {
-                $and: [
-                  { $eq: ['$resourceType', 'agent'] },
-                  { $eq: ['$resourceId', '$$agentId'] },
-                  { $eq: ['$principalType', 'user'] },
-                ],
-              },
+        localField: '_id',
+        foreignField: 'resourceId',
+        as: 'aclEntries',
+      },
+    },
+    {
+      $addFields: {
+        userAclEntries: {
+          $filter: {
+            input: '$aclEntries',
+            as: 'aclEntry',
+            cond: {
+              $and: [
+                { $eq: ['$$aclEntry.resourceType', 'agent'] },
+                { $eq: ['$$aclEntry.principalType', 'user'] },
+              ],
             },
           },
-        ],
-        as: 'aclEntries',
+        },
       },
     },
     {
       $match: {
         author: { $exists: true, $ne: null },
-        $expr: { $eq: [{ $size: '$aclEntries' }, 0] },
+        userAclEntries: { $size: 0 },
       },
     },
     {
diff --git a/package.json b/package.json
index 251247f4b9..ba1c3c4592 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,10 @@
     "b:test:api": "cd api && bun run b:test",
     "b:balance": "bun config/add-balance.js",
     "b:list-balances": "bun config/list-balances.js",
-    "reset-terms": "node config/reset-terms.js"
+    "reset-terms": "node config/reset-terms.js",
+    "migrate:agent-permissions:dry-run": "node config/migrate-agent-permissions.js --dry-run",
+    "migrate:agent-permissions": "node config/migrate-agent-permissions.js",
+    "migrate:agent-permissions:batch": "node config/migrate-agent-permissions.js --batch-size=50"
   },
   "repository": {
     "type": "git",