init (#20883)

Co-authored-by: Tim Baek <tim@openwebui.com>

backend/open_webui/routers/channels.py

@@ -422,6 +422,13 @@ async def get_channel_by_id(
     db: Session = Depends(get_session),
 ):
     check_channels_access(request, user)
+    if user.role != "admin" and not has_permission(
+        user.id, "features.channels", request.app.state.config.USER_PERMISSIONS, db=db
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
     channel = Channels.get_channel_by_id(id, db=db)
     if not channel:
         raise HTTPException(
@@ -534,6 +541,13 @@ async def get_channel_members_by_id(
     db: Session = Depends(get_session),
 ):
     check_channels_access(request, user)
+    if user.role != "admin" and not has_permission(
+        user.id, "features.channels", request.app.state.config.USER_PERMISSIONS, db=db
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
 
     channel = Channels.get_channel_by_id(id, db=db)
     if not channel:
@@ -855,6 +869,13 @@ async def get_channel_messages(
     db: Session = Depends(get_session),
 ):
     check_channels_access(request, user)
+    if user.role != "admin" and not has_permission(
+        user.id, "features.channels", request.app.state.config.USER_PERMISSIONS, db=db
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
     channel = Channels.get_channel_by_id(id, db=db)
     if not channel:
         raise HTTPException(

backend/open_webui/socket/main.py

@@ -42,6 +42,7 @@ from open_webui.utils.auth import decode_token
 from open_webui.socket.utils import RedisDict, RedisLock, YdocManager
 from open_webui.tasks import create_task, stop_item_tasks
 from open_webui.utils.redis import get_redis_connection
+from open_webui.utils.access_control import has_permission
 from open_webui.models.access_grants import AccessGrants
 
 
@@ -345,11 +346,12 @@ async def user_join(sid, data):
 
     await sio.enter_room(sid, f"user:{user.id}")
 
-    # Join all the channels
-    channels = Channels.get_channels_by_user_id(user.id)
-    log.debug(f"{channels=}")
-    for channel in channels:
-        await sio.enter_room(sid, f"channel:{channel.id}")
+    # Join all the channels only if user has channels permission
+    if user.role == "admin" or has_permission(user.id, "features.channels"):
+        channels = Channels.get_channels_by_user_id(user.id)
+        log.debug(f"{channels=}")
+        for channel in channels:
+            await sio.enter_room(sid, f"channel:{channel.id}")
 
     return {"id": user.id, "name": user.name}
 
@@ -375,11 +377,12 @@ async def join_channel(sid, data):
     if not user:
         return
 
-    # Join all the channels
-    channels = Channels.get_channels_by_user_id(user.id)
-    log.debug(f"{channels=}")
-    for channel in channels:
-        await sio.enter_room(sid, f"channel:{channel.id}")
+    # Join all the channels only if user has channels permission
+    if user.role == "admin" or has_permission(user.id, "features.channels"):
+        channels = Channels.get_channels_by_user_id(user.id)
+        log.debug(f"{channels=}")
+        for channel in channels:
+            await sio.enter_room(sid, f"channel:{channel.id}")
 
 
 @sio.on("join-note")