refac: share one folder write-access check across chat folder_id paths (#28366)

Chat creation and chat moves each carried their own copy of the same folder_id validation, resolving the folder and checking ownership and shared write access in slightly different ways. Both now call a single has_folder_write_access helper, which the chat-completions creation path uses as well, so ownership, inherited write grants and nonexistent or malformed ids behave identically everywhere a chat folder_id is set. The owner case also costs one query fewer than before.

backend/open_webui/utils/access_control/folders.py

@@ -3,7 +3,7 @@ from open_webui.models.folders import FolderModel, Folders
 from sqlalchemy.ext.asyncio import AsyncSession
 
 
-async def has_folder_access(user_id: str, folder: FolderModel, permission: str, db: AsyncSession) -> bool:
+async def has_folder_access(user_id: str, folder: FolderModel, permission: str, db: AsyncSession | None) -> bool:
     """Check if user has access to folder directly or via ancestor inheritance."""
     if folder.user_id == user_id:
         return True
@@ -22,3 +22,11 @@ async def has_folder_access(user_id: str, folder: FolderModel, permission: str,
         if parent:
             return await has_folder_access(user_id, parent, permission, db)
     return False
+
+
+async def has_folder_write_access(user_id: str, folder_id: str, db: AsyncSession | None = None) -> bool:
+    """Check write access on the folder with this id; False if no such folder exists."""
+    folder = await Folders.get_folder_by_id(folder_id, db=db)
+    if not folder:
+        return False
+    return await has_folder_access(user_id, folder, 'write', db)