refac

backend/open_webui/models/prompts.py

@@ -502,10 +502,9 @@ class PromptsTable:
         name: str,
         command: str,
         tags: Optional[list[str]] = None,
-        access_grants: Optional[list[dict]] = None,
         db: Optional[Session] = None,
     ) -> Optional[PromptModel]:
-        """Update only name, command, tags, and access grants (no history created)."""
+        """Update only name, command, and tags (no history created)."""
         try:
             with get_db_context(db) as db:
                 prompt = db.query(Prompt).filter_by(id=prompt_id).first()
@@ -517,11 +516,6 @@ class PromptsTable:
                 
                 if tags is not None:
                     prompt.tags = tags
-
-                if access_grants is not None:
-                    AccessGrants.set_access_grants(
-                        "prompt", prompt_id, access_grants, db=db
-                    )
                     
                 prompt.updated_at = int(time.time())
                 db.commit()

backend/open_webui/routers/knowledge.py

@@ -501,6 +501,55 @@ async def update_knowledge_by_id(
         )
 
 
+############################
+# UpdateKnowledgeAccessById
+############################
+
+
+class KnowledgeAccessGrantsForm(BaseModel):
+    access_grants: list[dict]
+
+
+@router.post("/{id}/access/update", response_model=Optional[KnowledgeFilesResponse])
+async def update_knowledge_access_by_id(
+    id: str,
+    form_data: KnowledgeAccessGrantsForm,
+    user=Depends(get_verified_user),
+    db: Session = Depends(get_session),
+):
+    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    if not knowledge:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
+    if (
+        knowledge.user_id != user.id
+        and not AccessGrants.has_access(
+            user_id=user.id,
+            resource_type="knowledge",
+            resource_id=knowledge.id,
+            permission="write",
+            db=db,
+        )
+        and user.role != "admin"
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
+    AccessGrants.set_access_grants(
+        "knowledge", id, form_data.access_grants, db=db
+    )
+
+    return KnowledgeFilesResponse(
+        **Knowledges.get_knowledge_by_id(id=id, db=db).model_dump(),
+        files=Knowledges.get_file_metadatas_by_id(id, db=db),
+    )
+
+
 ############################
 # GetKnowledgeFilesById
 ############################

backend/open_webui/routers/prompts.py

@@ -33,7 +33,6 @@ class PromptMetadataForm(BaseModel):
     name: str
     command: str
     tags: Optional[list[str]] = None
-    access_grants: Optional[list[dict]] = None
 
 
 router = APIRouter()
@@ -373,7 +372,7 @@ async def update_prompt_metadata(
             )
 
     updated_prompt = Prompts.update_prompt_metadata(
-        prompt.id, form_data.name, form_data.command, form_data.tags, form_data.access_grants, db=db
+        prompt.id, form_data.name, form_data.command, form_data.tags, db=db
     )
     if updated_prompt:
         return updated_prompt
@@ -426,6 +425,52 @@ async def set_prompt_version(
         )
 
 
+############################
+# UpdatePromptAccessById
+############################
+
+
+class PromptAccessGrantsForm(BaseModel):
+    access_grants: list[dict]
+
+
+@router.post("/id/{prompt_id}/access/update", response_model=Optional[PromptModel])
+async def update_prompt_access_by_id(
+    prompt_id: str,
+    form_data: PromptAccessGrantsForm,
+    user=Depends(get_verified_user),
+    db: Session = Depends(get_session),
+):
+    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    if not prompt:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
+    if (
+        prompt.user_id != user.id
+        and not AccessGrants.has_access(
+            user_id=user.id,
+            resource_type="prompt",
+            resource_id=prompt.id,
+            permission="write",
+            db=db,
+        )
+        and user.role != "admin"
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
+    AccessGrants.set_access_grants(
+        "prompt", prompt_id, form_data.access_grants, db=db
+    )
+
+    return Prompts.get_prompt_by_id(prompt_id, db=db)
+
+
 ############################
 # DeletePromptById
 ############################