feat: add interface user permission (#20424)

* feat: add interface user permission

Adds admin configurable user / group permissions for the interface settings section

* rename

backend/open_webui/config.py

@@ -1471,6 +1471,11 @@ USER_PERMISSIONS_FEATURES_API_KEYS = (
 )
 
 
+USER_PERMISSIONS_SETTINGS_INTERFACE = (
+    os.environ.get("USER_PERMISSIONS_SETTINGS_INTERFACE", "True").lower() == "true"
+)
+
+
 DEFAULT_USER_PERMISSIONS = {
     "workspace": {
         "models": USER_PERMISSIONS_WORKSPACE_MODELS_ACCESS,
@@ -1529,6 +1534,9 @@ DEFAULT_USER_PERMISSIONS = {
         "image_generation": USER_PERMISSIONS_FEATURES_IMAGE_GENERATION,
         "code_interpreter": USER_PERMISSIONS_FEATURES_CODE_INTERPRETER,
     },
+    "settings": {
+        "interface": USER_PERMISSIONS_SETTINGS_INTERFACE,
+    },
 }
 
 USER_PERMISSIONS = PersistentConfig(

backend/open_webui/routers/users.py

@@ -227,11 +227,16 @@ class FeaturesPermissions(BaseModel):
     code_interpreter: bool = True
 
 
+class SettingsPermissions(BaseModel):
+    interface: bool = True
+
+
 class UserPermissions(BaseModel):
     workspace: WorkspacePermissions
     sharing: SharingPermissions
     chat: ChatPermissions
     features: FeaturesPermissions
+    settings: SettingsPermissions
 
 
 @router.get("/default/permissions", response_model=UserPermissions)
@@ -249,6 +254,9 @@ async def get_default_user_permissions(request: Request, user=Depends(get_admin_
         "features": FeaturesPermissions(
             **request.app.state.config.USER_PERMISSIONS.get("features", {})
         ),
+        "settings": SettingsPermissions(
+            **request.app.state.config.USER_PERMISSIONS.get("settings", {})
+        ),
     }
 
 

src/lib/components/admin/Users/Groups/EditGroupModal.svelte

@@ -91,6 +91,9 @@
 			web_search: true,
 			image_generation: true,
 			code_interpreter: true
+		},
+		settings: {
+			interface: true
 		}
 	};
 

src/lib/components/admin/Users/Groups/Permissions.svelte

@@ -61,6 +61,9 @@
 			web_search: true,
 			image_generation: true,
 			code_interpreter: true
+		},
+		settings: {
+			interface: true
 		}
 	};
 
@@ -79,7 +82,8 @@
 			workspace: { ...defaults.workspace, ...obj.workspace },
 			sharing: { ...defaults.sharing, ...obj.sharing },
 			chat: { ...defaults.chat, ...obj.chat },
-			features: { ...defaults.features, ...obj.features }
+			features: { ...defaults.features, ...obj.features },
+			settings: { ...defaults.settings, ...obj.settings }
 		};
 	}
 
@@ -839,4 +843,26 @@
 			{/if}
 		</div>
 	</div>
+
+	<hr class=" border-gray-100/30 dark:border-gray-850/30" />
+
+	<div>
+		<div class=" mb-2 text-sm font-medium">{$i18n.t('Settings Permissions')}</div>
+
+		<div class="flex flex-col w-full">
+			<div class="flex w-full justify-between my-1">
+				<div class=" self-center text-xs font-medium">
+					{$i18n.t('Interface Settings Access')}
+				</div>
+				<Switch bind:state={permissions.settings.interface} />
+			</div>
+			{#if defaultPermissions?.settings?.interface && !permissions.settings.interface}
+				<div>
+					<div class="text-xs text-gray-500">
+						{$i18n.t('This is a default user permission and will remain enabled.')}
+					</div>
+				</div>
+			{/if}
+		</div>
+	</div>
 </div>

src/lib/components/chat/SettingsModal.svelte

@@ -487,6 +487,10 @@
 				);
 			}
 
+			if (tab.id === 'interface') {
+				return $user?.role === 'admin' || ($user?.permissions?.settings?.interface ?? true);
+			}
+
 			return true;
 		});
 	};