refac

backend/open_webui/routers/automations.py

@@ -15,6 +15,8 @@ from open_webui.models.automations import (
     AutomationRuns,
     Automations,
 )
+from open_webui.models.access_grants import AccessGrants
+from open_webui.models.channels import Channels
 from open_webui.models.config import Config
 from open_webui.models.folders import Folders
 from open_webui.utils.access_control import has_permission
@@ -104,6 +106,48 @@ async def check_automation_folder_access(folder_id: Optional[str], user, db: Asy
         )
 
 
+async def check_automation_channel_access(form_data: AutomationForm, user, db: AsyncSession):
+    target = form_data.data.target
+    if not target or target.type != 'channel':
+        return
+
+    if not target.channel_id or not await Config.get('channels.enable'):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
+    channel = await Channels.get_channel_by_id(target.channel_id, db=db)
+    if not channel:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+
+    if user.role == 'admin':
+        return
+    if not await has_permission(user.id, 'features.channels', await Config.get('user.permissions')):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.DEFAULT(),
+        )
+    if channel.type in ['group', 'dm']:
+        allowed = await Channels.is_user_channel_member(channel.id, user.id, db=db)
+    else:
+        allowed = await AccessGrants.has_access(
+            user_id=user.id,
+            resource_type='channel',
+            resource_id=channel.id,
+            permission='write',
+            db=db,
+        )
+    if not allowed:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.DEFAULT(),
+        )
+
+
 async def enrich_automation(automation: AutomationModel, db: AsyncSession, tz: str = None) -> AutomationResponse:
     """Full enrichment for single-item views (includes next_runs computation)."""
     last_run = await AutomationRuns.get_latest(automation.id, db=db)
@@ -174,6 +218,7 @@ async def create_new_automation(
 ):
     await check_automations_permission(request, user)
     await check_automation_folder_access(form_data.folder_id, user, db)
+    await check_automation_channel_access(form_data, user, db)
     try:
         validate_rrule(form_data.data.rrule, tz=user.timezone)
     except ValueError as e:
@@ -232,6 +277,7 @@ async def update_automation_by_id(
     automation = await Automations.get_by_id(id, db=db)
     check_automation_access(automation, user)
     await check_automation_folder_access(form_data.folder_id, user, db)
+    await check_automation_channel_access(form_data, user, db)
 
     try:
         validate_rrule(form_data.data.rrule, tz=user.timezone)

backend/open_webui/routers/channels.py

@@ -1075,16 +1075,10 @@ async def model_response_handler(request, channel, message, user, db=None):
                         ],
                     ]
 
-                # Resolve model config (same helpers automations use)
-                from open_webui.utils.automations import (
-                    _resolve_model_features,
-                    _resolve_model_filter_ids,
-                    _resolve_model_tool_ids,
-                )
+                # Resolve model config (same path automations use)
+                from open_webui.utils.automations import _resolve_model_defaults
 
-                tool_ids = _resolve_model_tool_ids(request.app, model_id)
-                features = await _resolve_model_features(request.app, model_id)
-                filter_ids = _resolve_model_filter_ids(request.app, model_id)
+                tool_ids, features, filter_ids, _ = await _resolve_model_defaults(request.app, model_id)
 
                 # Build full form_data — same shape as frontend POST.
                 # The channel: prefix routes pipeline events to the