feat: open terminal integration

backend/open_webui/utils/access_control.py

@@ -153,6 +153,34 @@ def has_access(
     return False
 
 
+def has_connection_access(
+    user: UserModel,
+    connection: dict,
+    user_group_ids: Optional[Set[str]] = None,
+) -> bool:
+    """
+    Check if a user can access a server connection (tool server, terminal, etc.)
+    based on ``config.access_grants`` within the connection dict.
+
+    - Admin with BYPASS_ADMIN_ACCESS_CONTROL → always allowed
+    - Empty / missing access_grants → allowed for all users
+    - Otherwise → delegates to ``has_access``
+    """
+    from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
+
+    if user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL:
+        return True
+
+    if user_group_ids is None:
+        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
+
+    access_grants = (connection.get("config") or {}).get("access_grants", [])
+    if not access_grants:
+        return True
+
+    return has_access(user.id, "read", access_grants, user_group_ids)
+
+
 def migrate_access_control(
     data: dict, ac_key: str = "access_control", grants_key: str = "access_grants"
 ) -> None: