Emil_Shanaty/open-webui-ai4me
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #21277 from open-webui/acl

Browse Source 
refac: acl
This commit is contained in:
Tim Baek
2026-02-09 13:34:36 -06:00
committed by GitHub
parent 65904b867e 68c77295bd
commit 48a0abb40f
57 changed files with 2994 additions and 879 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/tools/builtin.py
+41 -16
View File
@@ -743,10 +743,14 @@ async def view_note(
user_id = __user__.get("id")
user_group_ids = [group.id for group in Groups.get_groups_by_member_id(user_id)]
from open_webui.utils.access_control import has_access
from open_webui.models.access_grants import AccessGrants
if note.user_id != user_id and not has_access(
user_id, "read", note.access_control, user_group_ids
if note.user_id != user_id and not AccessGrants.has_access(
user_id=user_id,
resource_type="note",
resource_id=note.id,
permission="read",
user_group_ids=set(user_group_ids),
):
return json.dumps({"error": "Access denied"})
@@ -797,7 +801,7 @@ async def write_note(
form = NoteForm(
title=title,
data={"content": {"md": content}},
access_control={}, # Private by default - only owner can access
access_grants=[], # Private by default - only owner can access
)
new_note = Notes.insert_new_note(user_id, form)
@@ -852,10 +856,14 @@ async def replace_note_content(
user_id = __user__.get("id")
user_group_ids = [group.id for group in Groups.get_groups_by_member_id(user_id)]
from open_webui.utils.access_control import has_access
from open_webui.models.access_grants import AccessGrants
if note.user_id != user_id and not has_access(
user_id, "write", note.access_control, user_group_ids
if note.user_id != user_id and not AccessGrants.has_access(
user_id=user_id,
resource_type="note",
resource_id=note.id,
permission="write",
user_group_ids=set(user_group_ids),
):
return json.dumps({"error": "Write access denied"})
@@ -1532,7 +1540,7 @@ async def view_knowledge_file(
try:
from open_webui.models.files import Files
from open_webui.models.knowledge import Knowledges
from open_webui.utils.access_control import has_access
from open_webui.models.access_grants import AccessGrants
user_id = __user__.get("id")
user_role = __user__.get("role", "user")
@@ -1551,8 +1559,12 @@ async def view_knowledge_file(
if (
user_role == "admin"
or knowledge_base.user_id == user_id
or has_access(
user_id, "read", knowledge_base.access_control, user_group_ids
or AccessGrants.has_access(
user_id=user_id,
resource_type="knowledge",
resource_id=knowledge_base.id,
permission="read",
user_group_ids=set(user_group_ids),
)
):
has_knowledge_access = True
@@ -1631,7 +1643,7 @@ async def query_knowledge_files(
from open_webui.models.files import Files
from open_webui.models.notes import Notes
from open_webui.retrieval.utils import query_collection
from open_webui.utils.access_control import has_access
from open_webui.models.access_grants import AccessGrants
user_id = __user__.get("id")
user_role = __user__.get("role", "user")
@@ -1656,8 +1668,12 @@ async def query_knowledge_files(
if knowledge and (
user_role == "admin"
or knowledge.user_id == user_id
or has_access(
user_id, "read", knowledge.access_control, user_group_ids
or AccessGrants.has_access(
user_id=user_id,
resource_type="knowledge",
resource_id=knowledge.id,
permission="read",
user_group_ids=set(user_group_ids),
)
):
collection_names.append(item_id)
@@ -1674,7 +1690,12 @@ async def query_knowledge_files(
if note and (
user_role == "admin"
or note.user_id == user_id
or has_access(user_id, "read", note.access_control)
or AccessGrants.has_access(
user_id=user_id,
resource_type="note",
resource_id=note.id,
permission="read",
)
):
content = note.data.get("content", {}).get("md", "")
note_results.append(
@@ -1693,8 +1714,12 @@ async def query_knowledge_files(
if knowledge and (
user_role == "admin"
or knowledge.user_id == user_id
or has_access(
user_id, "read", knowledge.access_control, user_group_ids
or AccessGrants.has_access(
user_id=user_id,
resource_type="knowledge",
resource_id=knowledge.id,
permission="read",
user_group_ids=set(user_group_ids),
)
):
collection_names.append(knowledge_id)