[PR #17543] [CLOSED] feat: only allow users with Write permission or admin to post/edit/delete Channel messages #63320

New Issue

GiteaMirror · 2026-05-06T08:01:11-05:00

GiteaMirror commented

2026-05-06 08:01:11 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/17543
Author: @nguyen-trantrung
Created: 9/18/2025
Status: ❌ Closed

Base: dev ← Head: feat/channel-acl

📝 Commits (5)

3d4a8e8 feat: only allow users with Write permission or admin to post/edit/delete messages in channels
0dc36a9 feat: disabled MessageInput, edit and delete for non-admin and non-write users in channels
a0e792b feat: Allow changing between Read/Write for accessRoles of user group for in ChannelModal
1401690 Merge changes from dev
68c3e00 Merge branch 'dev' into feat/channel-acl

📊 Changes

9 files changed (+335 additions, -15 deletions)

View changed files

📝 backend/open_webui/routers/channels.py (+11 -4)
📝 src/lib/components/channel/Channel.svelte (+30 -1)
📝 src/lib/components/channel/MessageInput.svelte (+13 -3)
📝 src/lib/components/channel/Messages.svelte (+3 -1)
📝 src/lib/components/channel/Messages/Message.svelte (+3 -2)
📝 src/lib/components/channel/Thread.svelte (+7 -3)
📝 src/lib/components/layout/Sidebar/ChannelModal.svelte (+1 -1)
➕ src/lib/utils/index.test.ts (+215 -0)
📝 src/lib/utils/index.ts (+52 -0)

📄 Description

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.

Before submitting, make sure you've checked the following:

Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request. Described here: https://github.com/open-webui/open-webui/discussions/17508#discussion-8910332
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources? No
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation? No
Testing: Have you written and run sufficient tests to validate the changes? A couple of unit tests for the checkAccess util, anything else are manually verified
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? Yes
Prefix: To clearly categorize this pull request, prefix the pull request title using one of the following:
- BREAKING CHANGE: Significant changes that may affect compatibility
- build: Changes that affect the build system or external dependencies
- ci: Changes to our continuous integration processes or workflows
- chore: Refactor, cleanup, or other non-functional code changes
- docs: Documentation update or addition
- feat: Introduces a new feature or enhancement to the codebase
- fix: Bug fix or error correction
- i18n: Internationalization or localization changes
- perf: Performance improvement
- refactor: Code restructuring for better maintainability, readability, or scalability
- style: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
- test: Adding missing tests or correcting existing tests
- WIP: Work in progress, a temporary label for incomplete or ongoing work

Changelog Entry

Description

Private channels now allow setting a user group to Write; disables post/delete/edit message for Read user groups

Added

Added checkAccess in src/lib/utils/index.ts and tests in src/lib/utils/index.test.ts

Changed

Updated guards in routes/channels.py to only allow users with Write to post/delete/edit messages
Updated frontend for Channel to disable MessageInput and message edit/delete menu buttons for non-admin and non-write users

Deprecated

Removed

Fixed

Security

Updated guards in routes/channels.py to only allow users with Write to post/delete/edit messages

Breaking Changes

BREAKING CHANGE: Current user groups are created with Read permission by default, will not be able to post/edit/delete messages. Admins must manually migrate them to Write permission.

Additional Information

Screenshots or Videos

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/17543 **Author:** [@nguyen-trantrung](https://github.com/nguyen-trantrung) **Created:** 9/18/2025 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `feat/channel-acl` --- ### 📝 Commits (5) - [`3d4a8e8`](https://github.com/open-webui/open-webui/commit/3d4a8e80db1622c36c3d511359402a8167441c20) feat: only allow users with Write permission or admin to post/edit/delete messages in channels - [`0dc36a9`](https://github.com/open-webui/open-webui/commit/0dc36a9b83e27674d064f03d6e35d853ddd13117) feat: disabled MessageInput, edit and delete for non-admin and non-write users in channels - [`a0e792b`](https://github.com/open-webui/open-webui/commit/a0e792bf2c21b02214a8894cb01686dfae6751be) feat: Allow changing between Read/Write for accessRoles of user group for in ChannelModal - [`1401690`](https://github.com/open-webui/open-webui/commit/1401690d936b530787ee3e4fafb7130d97764040) Merge changes from dev - [`68c3e00`](https://github.com/open-webui/open-webui/commit/68c3e0044af318ac3158267699efdebb07410bf3) Merge branch 'dev' into feat/channel-acl ### 📊 Changes **9 files changed** (+335 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/channels.py` (+11 -4) 📝 `src/lib/components/channel/Channel.svelte` (+30 -1) 📝 `src/lib/components/channel/MessageInput.svelte` (+13 -3) 📝 `src/lib/components/channel/Messages.svelte` (+3 -1) 📝 `src/lib/components/channel/Messages/Message.svelte` (+3 -2) 📝 `src/lib/components/channel/Thread.svelte` (+7 -3) 📝 `src/lib/components/layout/Sidebar/ChannelModal.svelte` (+1 -1) ➕ `src/lib/utils/index.test.ts` (+215 -0) 📝 `src/lib/utils/index.ts` (+52 -0) </details> ### 📄 Description # Pull Request Checklist ### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request. **Before submitting, make sure you've checked the following:** - [X] **Target branch:** Please verify that the pull request targets the `dev` branch. - [X] **Description:** Provide a concise description of the changes made in this pull request. *Described here: https://github.com/open-webui/open-webui/discussions/17508#discussion-8910332* - [X] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [X] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources? *No* - [X] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation? *No* - [X] **Testing:** Have you written and run sufficient tests to validate the changes? *A couple of unit tests for the `checkAccess` util, anything else are manually verified* - [X] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? *Yes* - [X] **Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following: - **BREAKING CHANGE**: Significant changes that may affect compatibility - **build**: Changes that affect the build system or external dependencies - **ci**: Changes to our continuous integration processes or workflows - **chore**: Refactor, cleanup, or other non-functional code changes - **docs**: Documentation update or addition - **feat**: Introduces a new feature or enhancement to the codebase - **fix**: Bug fix or error correction - **i18n**: Internationalization or localization changes - **perf**: Performance improvement - **refactor**: Code restructuring for better maintainability, readability, or scalability - **style**: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.) - **test**: Adding missing tests or correcting existing tests - **WIP**: Work in progress, a temporary label for incomplete or ongoing work # Changelog Entry ### Description - Private channels now allow setting a user group to Write; disables post/delete/edit message for Read user groups ### Added - Added `checkAccess` in `src/lib/utils/index.ts` and tests in `src/lib/utils/index.test.ts` ### Changed - Updated guards in `routes/channels.py` to only allow users with Write to post/delete/edit messages - Updated frontend for Channel to disable MessageInput and message edit/delete menu buttons for non-admin and non-write users ### Deprecated ### Removed ### Fixed ### Security - Updated guards in `routes/channels.py` to only allow users with Write to post/delete/edit messages ### Breaking Changes - **BREAKING CHANGE**: Current user groups are created with Read permission by default, will not be able to post/edit/delete messages. Admins must manually migrate them to Write permission. --- ### Additional Information ### Screenshots or Videos ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-06 08:01:11 -05:00

GiteaMirror closed this issue

2026-05-06 08:01:18 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#63320