Fix: Account deletion left external users stuck in groups

[likeabas]

Fixes #16601

Pull Request

Account deletion left external users stuck in groups.

Summary

What broke

• Groups store members as user.idOnTheSource when that exists (e.g. Entra id).
• Otherwise they store the Mongo user id.
• removeUserFromAllGroups only pulled the Mongo id.
• Cache invalidation used the Mongo id too — wrong key for Entra users.

Result

• Delete succeeds; the user document goes away.
• Group memberIds still hold the external id.
• Local users without idOnTheSource were fine.

Fix

• Resolve the same key as the write path: idOnTheSource || userId.toString().
• Pull and invalidate that key.
• Do it before deleteUserById, while the user doc still exists.

Type of change

• Bug fix
• Feature
• Refactor
• Performance improvement
• Breaking change
• Documentation
• Translation
• Tests / tooling / CI

Testing

Old situation

1. Create a user with idOnTheSource set (for example an Entra user).
2. Add that user to a group through addUserToGroup. Confirm Group.memberIds contains the external id and not the Mongo user id.
3. Delete the account.
4. Read the group again.
5. The external id is still in memberIds. Repeating the steps with a local user that has no idOnTheSource removes the Mongo id, which matches the current test.

In this fix
Repeat the steps. See that external users are deleted as well.

Automated tests:

Added and rewrote a test in packages/data-schemas/src/methods/userGroup.spec.ts

Checklist

• I reviewed my own changes
• Relevant tests have been added or updated
• Existing relevant tests pass
• The change does not introduce new warnings or errors
• User-facing or complex behavior is documented where necessary
• Required dependency changes have been merged/published
• Required documentation PR: N/A

[github-actions]

👋 Thanks for the contribution! LibreChat merges all changes into dev first — main only moves at release time — so this pull request's base branch was switched from main to dev automatically.

Nothing is needed from you; your commits, reviews and discussion are unchanged. If the diff now shows files you did not touch, rebase onto dev:

git remote add upstream https://github.com/LibreChat-AI/LibreChat.git
git fetch upstream dev
git rebase upstream/dev
git push --force-with-lease

Maintainers: apply the target: main label and restore the base branch if this one genuinely belongs on main.