refac

Author: tjbck

backend/open_webui/models/chats.py

@@ -1353,6 +1353,43 @@ async def get_chats_by_folder_id_and_user_id(
                 for chat in all_chats
             ]
 
+    async def get_all_chats_by_folder_id(
+        self,
+        folder_id: str,
+        skip: int = 0,
+        limit: int = 60,
+        db: AsyncSession | None = None,
+    ) -> list[dict]:
+        """Get chats in a folder across ALL users. Returns dicts with user_id."""
+        async with get_async_db_context(db) as session:
+            stmt = (
+                select(Chat.id, Chat.title, Chat.user_id, Chat.updated_at, Chat.created_at, Chat.last_read_at)
+                .filter_by(folder_id=folder_id)
+                .filter(or_(Chat.pinned == False, Chat.pinned == None))
+                .filter_by(archived=False)
+                .order_by(Chat.updated_at.desc(), Chat.id)
+            )
+
+            if skip:
+                stmt = stmt.offset(skip)
+            if limit:
+                stmt = stmt.limit(limit)
+
+            result = await session.execute(stmt)
+            all_chats = result.all()
+            return [
+                {
+                    'id': chat[0],
+                    'title': chat[1],
+                    'user_id': chat[2],
+                    'updated_at': chat[3],
+                    'created_at': chat[4],
+                    'last_read_at': chat[5],
+                }
+                for chat in all_chats
+            ]
+
+
     async def get_chats_by_folder_ids_and_user_id(
         self, folder_ids: list[str], user_id: str, db: AsyncSession | None = None
     ) -> list[ChatModel]:

backend/open_webui/models/folders.py

@@ -6,7 +6,7 @@
 
 from open_webui.internal.db import Base, JSONField, get_async_db_context
 from pydantic import BaseModel, ConfigDict
-from sqlalchemy import JSON, BigInteger, Boolean, Column, Text, delete, func, select
+from sqlalchemy import JSON, BigInteger, Boolean, Column, Text, delete, func, select, or_, and_
 from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
@@ -62,6 +62,20 @@ class FolderNameIdResponse(BaseModel):
     updated_at: int
 
 
+class SharedFolderResponse(BaseModel):
+    id: str
+    name: str
+    parent_id: Optional[str] = None
+    user_id: str
+    owner_name: Optional[str] = None
+    permission: str = 'read'
+    access_grants: list = []
+    is_expanded: bool = False
+    meta: Optional[dict] = None
+    created_at: int
+    updated_at: int
+
+
 ####################
 # Forms
 ####################
@@ -130,6 +144,56 @@ async def get_folder_by_id_and_user_id(
         except Exception:
             return None
 
+    async def get_folder_by_id(
+        self, id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[FolderModel]:
+        """Fetch folder by ID only (no user_id filter). Used for shared access."""
+        try:
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id))
+                folder = result.scalars().first()
+                if not folder:
+                    return None
+                return FolderModel.model_validate(folder)
+        except Exception:
+            return None
+
+    async def get_shared_folder_ids_for_user(
+        self, user_id: str, user_group_ids: set[str],
+        db: Optional[AsyncSession] = None
+    ) -> dict[str, str]:
+        """
+        Returns {folder_id: highest_permission} for all folders shared with user.
+        Checks direct user grants, group grants, and public (user:*) grants.
+        """
+        from open_webui.models.access_grants import AccessGrant
+
+        async with get_async_db_context(db) as db:
+            conditions = [
+                and_(AccessGrant.principal_type == 'user', AccessGrant.principal_id == '*'),
+                and_(AccessGrant.principal_type == 'user', AccessGrant.principal_id == user_id),
+            ]
+            if user_group_ids:
+                conditions.append(
+                    and_(AccessGrant.principal_type == 'group',
+                         AccessGrant.principal_id.in_(user_group_ids))
+                )
+            result = await db.execute(
+                select(AccessGrant).filter(
+                    AccessGrant.resource_type == 'folder',
+                    or_(*conditions),
+                )
+            )
+            grants = result.scalars().all()
+
+            # Build {folder_id: highest_permission} ('write' > 'read')
+            folder_perms = {}
+            for g in grants:
+                existing = folder_perms.get(g.resource_id)
+                if existing != 'write':
+                    folder_perms[g.resource_id] = g.permission
+            return folder_perms
+
     async def get_children_folders_by_id_and_user_id(
         self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[list[FolderModel]]:

backend/open_webui/routers/chats.py

@@ -32,6 +32,7 @@
 from open_webui.socket.main import get_event_emitter
 from open_webui.tasks import stop_item_tasks
 from open_webui.utils.access_control import filter_allowed_access_grants, has_permission
+from open_webui.utils.access_control.folders import has_folder_access
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.middleware import serialize_output
 from open_webui.utils.misc import get_message_list
@@ -561,10 +562,13 @@ async def create_new_chat(
     # to assume the column is clean. Also catches non-UUID / nonexistent IDs.
     if form_data.folder_id is not None:
         if not await Folders.get_folder_by_id_and_user_id(form_data.folder_id, user.id, db=db):
-            raise HTTPException(
-                status_code=status.HTTP_404_NOT_FOUND,
-                detail=ERROR_MESSAGES.NOT_FOUND,
-            )
+            # Check shared folder write access
+            shared_folder = await Folders.get_folder_by_id(form_data.folder_id, db=db)
+            if not shared_folder or not await has_folder_access(user.id, shared_folder, 'write', db):
+                raise HTTPException(
+                    status_code=status.HTTP_404_NOT_FOUND,
+                    detail=ERROR_MESSAGES.NOT_FOUND,
+                )
 
     try:
         chat = await Chats.insert_new_chat(str(uuid4()), user.id, form_data, db=db)
@@ -951,6 +955,14 @@ async def get_chat_by_id(id: str, user=Depends(get_verified_user), db: AsyncSess
             if has_grant:
                 chat = await Chats.get_chat_by_id(id, db=db)
 
+            # Check folder-based access (shared folders)
+            if not chat:
+                candidate = await Chats.get_chat_by_id(id, db=db)
+                if candidate and candidate.folder_id:
+                    folder = await Folders.get_folder_by_id(candidate.folder_id, db=db)
+                    if folder and await has_folder_access(user.id, folder, 'read', db):
+                        chat = candidate
+
     if chat:
         return ChatResponse(**chat.model_dump())
 
@@ -1493,10 +1505,13 @@ async def update_chat_folder_id_by_id(
         # folder_id values. None is allowed (moves the chat out of any folder).
         if form_data.folder_id is not None:
             if not await Folders.get_folder_by_id_and_user_id(form_data.folder_id, user.id, db=db):
-                raise HTTPException(
-                    status_code=status.HTTP_404_NOT_FOUND,
-                    detail=ERROR_MESSAGES.NOT_FOUND,
-                )
+                # Check shared folder write access
+                shared_folder = await Folders.get_folder_by_id(form_data.folder_id, db=db)
+                if not shared_folder or not await has_folder_access(user.id, shared_folder, 'write', db):
+                    raise HTTPException(
+                        status_code=status.HTTP_404_NOT_FOUND,
+                        detail=ERROR_MESSAGES.NOT_FOUND,
+                    )
 
         chat = await Chats.update_chat_folder_id_by_id_and_user_id(id, user.id, form_data.folder_id, db=db)
         return ChatResponse(**chat.model_dump())