refac

backend/open_webui/routers/chats.py

@@ -829,29 +829,31 @@ async def get_shared_chat_by_id(
     if user.role == 'pending':
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=ERROR_MESSAGES.NOT_FOUND)
 
-    if user.role == 'admin' and ENABLE_ADMIN_CHAT_ACCESS:
+    chat = await Chats.get_chat_by_share_id(share_id, db=db)
+
+    # Fallback: admins can also access any chat directly by chat ID
+    if not chat and user.role == 'admin' and ENABLE_ADMIN_CHAT_ACCESS:
         chat = await Chats.get_chat_by_id(share_id, db=db)
-    else:
-        chat = await Chats.get_chat_by_share_id(share_id, db=db)
 
     if not chat:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=ERROR_MESSAGES.NOT_FOUND)
 
-    # Look up the original chat_id to check access grants
+    # Look up the original chat_id to check access grants (admins bypass)
-    shared = await SharedChats.get_by_id(share_id, db=db)
+    if user.role != 'admin' or not ENABLE_ADMIN_CHAT_ACCESS:
-    if shared:
+        shared = await SharedChats.get_by_id(share_id, db=db)
-        has_grant = await AccessGrants.has_access(
+        if shared:
-            user_id=user.id,
+            has_grant = await AccessGrants.has_access(
-            resource_type='shared_chat',
+                user_id=user.id,
-            resource_id=shared.chat_id,
+                resource_type='shared_chat',
-            permission='read',
+                resource_id=shared.chat_id,
-            db=db,
+                permission='read',
-        )
+                db=db,
-        if not has_grant:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
             )
+            if not has_grant:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+                )
 
     return ChatResponse(**chat.model_dump())
 
@@ -1183,10 +1185,11 @@ async def clone_chat_by_id(
 async def clone_shared_chat_by_id(
     id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
 ):
-    if user.role == 'admin':
+    chat = await Chats.get_chat_by_share_id(id, db=db)
+
+    # Fallback: admins can also access any chat directly by chat ID
+    if not chat and user.role == 'admin' and ENABLE_ADMIN_CHAT_ACCESS:
         chat = await Chats.get_chat_by_id(id, db=db)
-    else:
-        chat = await Chats.get_chat_by_share_id(id, db=db)
 
     if not chat:
         raise HTTPException(