refac

backend/open_webui/utils/auth.py

@@ -35,6 +35,7 @@ from open_webui.env import (
     pk,
 )
 from open_webui.models.auths import Auths
+from open_webui.models.config import Config
 from open_webui.models.users import Users
 from open_webui.utils.access_control import has_permission
 from pytz import UTC
@@ -409,12 +410,16 @@ async def get_current_user_by_api_key(request, api_key: str):
             detail=ERROR_MESSAGES.INVALID_TOKEN,
         )
 
+    user_permissions = await Config.get('user.permissions')
+    enable_endpoint_restrictions = await Config.get('auth.api_key.endpoint_restrictions')
+    allowed_endpoints = await Config.get('auth.api_key.allowed_endpoints', '')
+
     if not request.state.enable_api_keys or (
         user.role != 'admin'
         and not await has_permission(
             user.id,
             'features.api_keys',
-            request.app.state.config.USER_PERMISSIONS,
+            user_permissions,
         )
     ):
         raise HTTPException(status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.API_KEY_NOT_ALLOWED)
@@ -422,10 +427,8 @@ async def get_current_user_by_api_key(request, api_key: str):
     # Enforce endpoint restrictions — checked here (not in middleware)
     # so it applies regardless of how the API key was transported
     # (Authorization header, cookie, x-api-key header, etc.).
-    if request.app.state.config.ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS:
-        allowed_paths = [
-            path.strip() for path in str(request.app.state.config.API_KEYS_ALLOWED_ENDPOINTS).split(',') if path.strip()
-        ]
+    if enable_endpoint_restrictions:
+        allowed_paths = [path.strip() for path in str(allowed_endpoints).split(',') if path.strip()]
         request_path = request.scope['path']  # Use raw ASGI path — not spoofable via Host header (CVE-2026-48710)
         is_allowed = any(request_path == allowed or request_path.startswith(allowed + '/') for allowed in allowed_paths)
         if not is_allowed: