enh: access grant level perms

backend/open_webui/routers/skills.py

@@ -17,7 +17,7 @@ from open_webui.models.skills import (
     SkillAccessListResponse,
     Skills,
 )
-from open_webui.models.access_grants import AccessGrants, has_public_read_access_grant
+from open_webui.models.access_grants import AccessGrants, has_public_read_access_grant, has_user_access_grant, strip_user_access_grants
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.access_control import has_access, has_permission
 
@@ -360,6 +360,18 @@ async def update_skill_access_by_id(
             )
         ]
 
+    # Strip individual user sharing if user lacks permission
+    if (
+        user.role != "admin"
+        and has_user_access_grant(form_data.access_grants)
+        and not has_permission(
+            user.id,
+            "access_grants.allow_users",
+            request.app.state.config.USER_PERMISSIONS,
+        )
+    ):
+        form_data.access_grants = strip_user_access_grants(form_data.access_grants)
+
     AccessGrants.set_access_grants("skill", id, form_data.access_grants, db=db)
 
     return Skills.get_skill_by_id(id, db=db)