enh: access grant level perms

backend/open_webui/routers/models.py

@@ -17,7 +17,7 @@ from open_webui.models.models import (
     ModelAccessResponse,
     Models,
 )
-from open_webui.models.access_grants import AccessGrants, has_public_read_access_grant
+from open_webui.models.access_grants import AccessGrants, has_public_read_access_grant, has_user_access_grant, strip_user_access_grants
 
 from pydantic import BaseModel
 from open_webui.constants import ERROR_MESSAGES
@@ -584,6 +584,18 @@ async def update_model_access_by_id(
             )
         ]
 
+    # Strip individual user sharing if user lacks permission
+    if (
+        user.role != "admin"
+        and has_user_access_grant(form_data.access_grants)
+        and not has_permission(
+            user.id,
+            "access_grants.allow_users",
+            request.app.state.config.USER_PERMISSIONS,
+        )
+    ):
+        form_data.access_grants = strip_user_access_grants(form_data.access_grants)
+
     AccessGrants.set_access_grants(
         "model", form_data.id, form_data.access_grants, db=db
     )