Channel and note Socket.IO room memberships were only ever established at user-join / join-channels / join-note / ydoc:document:join time, using the access grants in effect at that moment. Later mutations that revoked the underlying access basis — removing a user from a group, deleting a group that held grants, deactivating or removing a channel member, updating a channel's access_grants, updating a note's access_grants, or deleting the resource — did not touch the sessions holding those subscriptions. The affected users kept receiving channel broadcasts and ydoc updates until they voluntarily disconnected.
Add three helpers in socket/main.py:
leave_rooms_for_users — direct eviction of every session belonging to the listed users from a given room. leave_room is a no-op on non-members, so callers can invoke it optimistically.
resync_channel_rooms_for_users — when the specific lost channels are cheaper to re-derive than to diff (group mutations), recompute each user's accessible channels via Channels.get_channels_by_user_id and evict their sessions from any channel:* room they no longer qualify for. Enumerates candidate rooms via the socket.io manager's local room map with defensive fallback.
evict_users_from_note — single helper covering both note rooms (events-bus note:{id} and ydoc doc_{id}).
Wire these into every revocation path called out in the report:
routers/channels.py: member removal, membership deactivation, channel update (re-derives membership per current participant), channel deletion (closes the room entirely).
routers/groups.py: user removal from group and group deletion both resync channel rooms for the affected users. HTTPException is now re-raised so the broader except does not mask the authz-adjacent errors as 400s.
routers/notes.py: access-grant updates walk current participants of both note rooms and evict anyone who can no longer read; note deletion closes both rooms.
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
Note
Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/23650
**Author:** [@Classic298](https://github.com/Classic298)
**Created:** 4/12/2026
**Status:** 🔄 Open
**Base:** `dev` ← **Head:** `fix/socket-room-eviction-on-access-revoke`
---
### 📝 Commits (1)
- [`7adc663`](https://github.com/open-webui/open-webui/commit/7adc663b4c92d3276909f924f9aaaf7568695654) fix: evict Socket.IO room subscriptions when access is revoked
### 📊 Changes
**4 files changed** (+200 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/channels.py` (+26 -0)
📝 `backend/open_webui/routers/groups.py` (+20 -0)
📝 `backend/open_webui/routers/notes.py` (+28 -1)
📝 `backend/open_webui/socket/main.py` (+126 -0)
</details>
### 📄 Description
Channel and note Socket.IO room memberships were only ever established at user-join / join-channels / join-note / ydoc:document:join time, using the access grants in effect at that moment. Later mutations that revoked the underlying access basis — removing a user from a group, deleting a group that held grants, deactivating or removing a channel member, updating a channel's access_grants, updating a note's access_grants, or deleting the resource — did not touch the sessions holding those subscriptions. The affected users kept receiving channel broadcasts and ydoc updates until they voluntarily disconnected.
Add three helpers in socket/main.py:
leave_rooms_for_users — direct eviction of every session belonging to the listed users from a given room. leave_room is a no-op on non-members, so callers can invoke it optimistically.
resync_channel_rooms_for_users — when the specific lost channels are cheaper to re-derive than to diff (group mutations), recompute each user's accessible channels via Channels.get_channels_by_user_id and evict their sessions from any channel:* room they no longer qualify for. Enumerates candidate rooms via the socket.io manager's local room map with defensive fallback.
evict_users_from_note — single helper covering both note rooms (events-bus note:{id} and ydoc doc_{id}).
Wire these into every revocation path called out in the report:
routers/channels.py: member removal, membership deactivation, channel update (re-derives membership per current participant), channel deletion (closes the room entirely).
routers/groups.py: user removal from group and group deletion both resync channel rooms for the affected users. HTTPException is now re-raised so the broader except does not mask the authz-adjacent errors as 400s.
routers/notes.py: access-grant updates walk current participants of both note rooms and evict anyone who can no longer read; note deletion closes both rooms.
### Contributor License Agreement
<!--
🚨 DO NOT DELETE THE TEXT BELOW 🚨
Keep the "Contributor License Agreement" confirmation text intact.
Deleting it will trigger the CLA-Bot to INVALIDATE your PR.
Your PR will NOT be reviewed or merged until you check the box below confirming that you have read and agree to the terms of the CLA.
-->
- [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
> [!NOTE]
> Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/23650
Author: @Classic298
Created: 4/12/2026
Status: 🔄 Open
Base:
dev← Head:fix/socket-room-eviction-on-access-revoke📝 Commits (1)
7adc663fix: evict Socket.IO room subscriptions when access is revoked📊 Changes
4 files changed (+200 additions, -1 deletions)
View changed files
📝
backend/open_webui/routers/channels.py(+26 -0)📝
backend/open_webui/routers/groups.py(+20 -0)📝
backend/open_webui/routers/notes.py(+28 -1)📝
backend/open_webui/socket/main.py(+126 -0)📄 Description
Channel and note Socket.IO room memberships were only ever established at user-join / join-channels / join-note / ydoc:document:join time, using the access grants in effect at that moment. Later mutations that revoked the underlying access basis — removing a user from a group, deleting a group that held grants, deactivating or removing a channel member, updating a channel's access_grants, updating a note's access_grants, or deleting the resource — did not touch the sessions holding those subscriptions. The affected users kept receiving channel broadcasts and ydoc updates until they voluntarily disconnected.
Add three helpers in socket/main.py:
leave_rooms_for_users — direct eviction of every session belonging to the listed users from a given room. leave_room is a no-op on non-members, so callers can invoke it optimistically.
resync_channel_rooms_for_users — when the specific lost channels are cheaper to re-derive than to diff (group mutations), recompute each user's accessible channels via Channels.get_channels_by_user_id and evict their sessions from any channel:* room they no longer qualify for. Enumerates candidate rooms via the socket.io manager's local room map with defensive fallback.
evict_users_from_note — single helper covering both note rooms (events-bus note:{id} and ydoc doc_{id}).
Wire these into every revocation path called out in the report:
routers/channels.py: member removal, membership deactivation, channel update (re-derives membership per current participant), channel deletion (closes the room entirely).
routers/groups.py: user removal from group and group deletion both resync channel rooms for the affected users. HTTPException is now re-raised so the broader except does not mask the authz-adjacent errors as 400s.
routers/notes.py: access-grant updates walk current participants of both note rooms and evict anyone who can no longer read; note deletion closes both rooms.
Contributor License Agreement
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.