fix: enforce model access control on Ollama generate, show, embed, embeddings endpoints (#23631)

These four endpoints checked model existence but never verified the user has read access via AccessGrants, allowing any authenticated user to use restricted models.

Uses the canonical check_model_access helper from utils.access_control.

backend/open_webui/routers/ollama.py

@@ -797,11 +797,14 @@ async def show_model_info(request: Request, form_data: ModelNameForm, user=Depen
     form_data = form_data.model_dump(exclude_none=True)
     form_data['model'] = form_data.get('model', form_data.get('name'))
 
+    model = form_data.get('model')
+
+    # Enforce per-model access control
+    check_model_access(user, Models.get_model_by_id(model), BYPASS_MODEL_ACCESS_CONTROL)
+
     await get_all_models(request, user=user)
     models = request.app.state.OLLAMA_MODELS
 
-    model = form_data.get('model')
-
     if model not in models:
         raise HTTPException(
             status_code=400,
@@ -846,6 +849,9 @@ async def embed(
 
     log.info(f'generate_ollama_batch_embeddings {form_data}')
 
+    # Enforce per-model access control
+    check_model_access(user, Models.get_model_by_id(form_data.model), BYPASS_MODEL_ACCESS_CONTROL)
+
     if url_idx is None:
         model = form_data.model
 
@@ -902,6 +908,9 @@ async def embeddings(
 
     log.info(f'generate_ollama_embeddings {form_data}')
 
+    # Enforce per-model access control
+    check_model_access(user, Models.get_model_by_id(form_data.model), BYPASS_MODEL_ACCESS_CONTROL)
+
     if url_idx is None:
         model = form_data.model
 
@@ -964,11 +973,15 @@ async def generate_completion(
     if not request.app.state.config.ENABLE_OLLAMA_API:
         raise HTTPException(status_code=503, detail='Ollama API is disabled')
 
+    # Enforce per-model access control
+    check_model_access(user, Models.get_model_by_id(form_data.model), BYPASS_MODEL_ACCESS_CONTROL)
+
     if url_idx is None:
         await get_all_models(request, user=user)
         models = request.app.state.OLLAMA_MODELS
 
         model = form_data.model
+
         if model in models:
             url_idx = random.choice(models[model]['urls'])
         else: