From 2751a0f0b64b8a58b89b9fc275e81fa5424d5b01 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sun, 1 Mar 2026 19:09:10 -0600
Subject: [PATCH] refac

---
 backend/open_webui/utils/access_control/__init__.py | 7 ++-----
 package-lock.json                                   | 4 ++--
 package.json                                        | 2 +-
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/backend/open_webui/utils/access_control/__init__.py b/backend/open_webui/utils/access_control/__init__.py
index 232bd20d60..a228bbd6a8 100644
--- a/backend/open_webui/utils/access_control/__init__.py
+++ b/backend/open_webui/utils/access_control/__init__.py
@@ -163,8 +163,8 @@ def has_connection_access(
     based on ``config.access_grants`` within the connection dict.
 
     - Admin with BYPASS_ADMIN_ACCESS_CONTROL → always allowed
-    - Empty / missing access_grants → allowed for all users
-    - Otherwise → delegates to ``has_access``
+    - Missing, None, or empty access_grants → private, admin-only
+    - access_grants has entries → delegates to ``has_access``
     """
     from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
 
@@ -175,9 +175,6 @@ def has_connection_access(
         user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
 
     access_grants = (connection.get("config") or {}).get("access_grants", [])
-    if not access_grants:
-        return True
-
     return has_access(user.id, "read", access_grants, user_group_ids)
 
 
diff --git a/package-lock.json b/package-lock.json
index 7681c6b6f9..14ce3d6500 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "open-webui",
-	"version": "0.8.6",
+	"version": "0.8.7",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "open-webui",
-			"version": "0.8.6",
+			"version": "0.8.7",
 			"dependencies": {
 				"@azure/msal-browser": "^4.5.0",
 				"@codemirror/lang-javascript": "^6.2.2",
diff --git a/package.json b/package.json
index 8477f654b4..c0fef7e548 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "open-webui",
-	"version": "0.8.6",
+	"version": "0.8.7",
 	"private": true,
 	"scripts": {
 		"dev": "npm run pyodide:fetch && vite dev --host",