refac

backend/open_webui/utils/access_control/__init__.py

@@ -3,9 +3,11 @@ from typing import Any
 
 from open_webui.config import DEFAULT_USER_PERMISSIONS
 from open_webui.models.access_grants import (
+    has_anyone_read_access_grant,
     has_public_read_access_grant,
     has_public_write_access_grant,
     has_user_access_grant,
+    strip_anyone_access_grants,
     strip_user_access_grants,
 )
 from open_webui.models.groups import Groups
@@ -215,13 +217,31 @@ async def filter_allowed_access_grants(
     user_role: str,
     access_grants: list,
     public_permission_key: str,
+    anyone_permission_key: str | None = None,
     db: AsyncSession | None = None,
 ) -> list:
     """
     Checks if the user has the required permissions to grant access to a resource.
     Returns the filtered list of access grants if permissions are missing.
     """
-    if user_role == 'admin' or not access_grants:
+    if not access_grants:
+        return access_grants
+
+    if has_anyone_read_access_grant(access_grants) and (
+        not anyone_permission_key
+        or (
+            user_role != 'admin'
+            and not await has_permission(
+                user_id,
+                anyone_permission_key,
+                default_permissions,
+                db=db,
+            )
+        )
+    ):
+        access_grants = strip_anyone_access_grants(access_grants)
+
+    if user_role == 'admin':
         return access_grants
 
     # Check if user can share publicly