refac

backend/open_webui/routers/calendar.py

@@ -19,6 +19,7 @@ from open_webui.models.calendar import (
     CalendarUpdateForm,
     RSVPForm,
 )
+from open_webui.models.config import Config
 from open_webui.models.groups import Groups
 from open_webui.models.users import UserModel
 from open_webui.utils.access_control import filter_allowed_access_grants, has_permission
@@ -34,13 +35,14 @@ SCHEDULED_TASKS_CALENDAR_ID = '__scheduled_tasks__'
 
 async def check_calendar_permission(request: Request, user):
     """Check global feature flag AND per-user permission for calendar access."""
-    if not request.app.state.config.ENABLE_CALENDAR:
+    config = await Config.get_many('calendar.enable', 'user.permissions')
+    if not config.get('calendar.enable'):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
     if user.role != 'admin' and not await has_permission(
-        user.id, 'features.calendar', request.app.state.config.USER_PERMISSIONS
+        user.id, 'features.calendar', config.get('user.permissions')
     ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -50,11 +52,12 @@ async def check_calendar_permission(request: Request, user):
 
 async def _user_has_automations(request: Request, user) -> bool:
     """Check if automations feature is available to this user."""
-    if not getattr(request.app.state.config, 'ENABLE_AUTOMATIONS', False):
+    config = await Config.get_many('automations.enable', 'user.permissions')
+    if not config.get('automations.enable', False):
         return False
     if user.role == 'admin':
         return True
-    return await has_permission(user.id, 'features.automations', request.app.state.config.USER_PERMISSIONS)
+    return await has_permission(user.id, 'features.automations', config.get('user.permissions'))
 
 
 async def _check_calendar_access(calendar_id: str, user: UserModel, permission: str = 'write') -> CalendarModel:
@@ -116,7 +119,7 @@ async def create_calendar(request: Request, form_data: CalendarForm, user: UserM
     # could create a calendar with `principal_id='*' permission='read'|'write'`,
     # making their events readable or writable by any other verified user.
     form_data.access_grants = await filter_allowed_access_grants(
-        request.app.state.config.USER_PERMISSIONS,
+        await Config.get('user.permissions'),
         user.id,
         user.role,
         form_data.access_grants,
@@ -373,7 +376,7 @@ async def update_calendar(
     # publicly readable/writable without the corresponding sharing permission.
     if form_data.access_grants is not None:
         form_data.access_grants = await filter_allowed_access_grants(
-            request.app.state.config.USER_PERMISSIONS,
+            await Config.get('user.permissions'),
             user.id,
             user.role,
             form_data.access_grants,