Merge pull request #21346 from open-webui/dev

0.8.1

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -11,7 +11,9 @@ body:
 
         ## Important Notes
 
-        - **Before submitting a bug report**: Please check the [Issues](https://github.com/open-webui/open-webui/issues) or [Discussions](https://github.com/open-webui/open-webui/discussions) sections to see if a similar issue has already been reported. If unsure, start a discussion first, as this helps us efficiently focus on improving the project.
+        - **Before submitting a bug report**: Please check the [Issues](https://github.com/open-webui/open-webui/issues) and [Discussions](https://github.com/open-webui/open-webui/discussions) sections to see if a similar issue has already been reported. If unsure, start a discussion first, as this helps us efficiently focus on improving the project. Duplicates may be closed without notice. **Please search for existing issues AND discussions. No matter open or closed.**
+
+        - Check for opened, **but also for (recently) CLOSED issues** as the issue you are trying to report **might already have been fixed on the dev branch!**
 
         - **Respectful collaboration**: Open WebUI is a volunteer-driven project with a single maintainer and contributors who also have full-time jobs. Please be constructive and respectful in your communication.
 
@@ -19,13 +21,19 @@ body:
 
         - **Bug Reproducibility**: If a bug cannot be reproduced using a `:main` or `:dev` Docker setup or with `pip install` on Python 3.11, community assistance may be required. In such cases, we will move it to the "[Issues](https://github.com/open-webui/open-webui/discussions/categories/issues)" Discussions section. Your help is appreciated!
 
+        - **Scope**: If you want to report a SECURITY VULNERABILITY, then do so through our [GitHub security page](https://github.com/open-webui/open-webui/security).
+
   - type: checkboxes
     id: issue-check
     attributes:
       label: Check Existing Issues
       description: Confirm that you’ve checked for existing reports before submitting a new one.
       options:
-        - label: I have searched the existing issues and discussions.
+        - label: I have searched for any existing and/or related issues.
+          required: true
+        - label: I have searched for any existing and/or related discussions.
+          required: true
+        - label: I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
           required: true
         - label: I am using the latest version of Open WebUI.
           required: true
@@ -47,7 +55,7 @@ body:
     id: open-webui-version
     attributes:
       label: Open WebUI Version
-      description: Specify the version (e.g., v0.3.11)
+      description: Specify the version (e.g., v0.6.26)
     validations:
       required: true
 
@@ -63,7 +71,7 @@ body:
     id: operating-system
     attributes:
       label: Operating System
-      description: Specify the OS (e.g., Windows 10, macOS Sonoma, Ubuntu 22.04)
+      description: Specify the OS (e.g., Windows 10, macOS Sonoma, Ubuntu 22.04, Debian 12)
     validations:
       required: true
 
@@ -126,6 +134,7 @@ body:
       description: |
         Please provide a **very detailed, step-by-step guide** to reproduce the issue. Your instructions should be so clear and precise that anyone can follow them without guesswork. Include every relevant detail—settings, configuration options, exact commands used, values entered, and any prerequisites or environment variables.  
         **If full reproduction steps and all relevant settings are not provided, your issue may not be addressed.**
+        **If your steps to reproduction are incomplete, lacking detail or not reproducible, your issue can not be addressed.**
 
       placeholder: |
         Example (include every detail):
@@ -163,5 +172,5 @@ body:
     attributes:
       value: |
         ## Note
-        If the bug report is incomplete or does not follow instructions, it may not be addressed. Ensure that you've followed all the **README.md** and **troubleshooting.md** guidelines, and provide all necessary information for us to reproduce the issue.  
+        **If the bug report is incomplete, does not follow instructions or is lacking details it may not be addressed.** Ensure that you've followed all the **README.md** and **troubleshooting.md** guidelines, and provide all necessary information for us to reproduce the issue.  
         Thank you for contributing to Open WebUI!

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -8,10 +8,21 @@ body:
       value: |
         ## Important Notes
         ### Before submitting
-        Please check the [Issues](https://github.com/open-webui/open-webui/issues) or [Discussions](https://github.com/open-webui/open-webui/discussions) to see if a similar request has been posted.
+        
+        Please check the **open AND closed** [Issues](https://github.com/open-webui/open-webui/issues) AND [Discussions](https://github.com/open-webui/open-webui/discussions) to see if a similar request has been posted.
         It's likely we're already tracking it! If you’re unsure, start a discussion post first.
-        This will help us efficiently focus on improving the project.
 
+        #### Scope
+
+        If your feature request is likely to take more than a quick coding session to implement, test and verify, then open it in the **Ideas** section of the [Discussions](https://github.com/open-webui/open-webui/discussions) instead.
+        **We will close and force move your feature request to the Ideas section, if we believe your feature request is not trivial/quick to implement.**
+        This is to ensure the issues tab is used only for issues, quickly addressable feature requests and tracking tickets by the maintainers.
+        Other feature requests belong in the **Ideas** section of the [Discussions](https://github.com/open-webui/open-webui/discussions).
+        
+        If your feature request might impact others in the community, definitely open a discussion instead and evaluate whether and how to implement it.
+        
+        This will help us efficiently focus on improving the project.
+        
         ### Collaborate respectfully
         We value a **constructive attitude**, so please be mindful of your communication. If negativity is part of your approach, our capacity to engage may be limited. We're here to help if you're **open to learning** and **communicating positively**.
 
@@ -22,7 +33,6 @@ body:
 
         We appreciate your time and ask that you **respect ours**.
 
-
         ### Contributing
         If you encounter an issue, we highly encourage you to submit a pull request or fork the project. We actively work to prevent contributor burnout to maintain the quality and continuity of Open WebUI.
 
@@ -35,14 +45,22 @@ body:
       label: Check Existing Issues
       description: Please confirm that you've checked for existing similar requests
       options:
-        - label: I have searched the existing issues and discussions.
+        - label: I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request.
+          required: true
+  - type: checkboxes
+    id: feature-scope
+    attributes:
+      label: Verify Feature Scope
+      description: Please confirm the feature's scope is within the described scope
+      options:
+        - label: I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.
           required: true
   - type: textarea
     id: problem-description
     attributes:
       label: Problem Description
       description: Is your feature request related to a problem? Please provide a clear and concise description of what the problem is.
-      placeholder: "Ex. I'm always frustrated when..."
+      placeholder: "Ex. I'm always frustrated when... / Not related to a problem"
     validations:
       required: true
   - type: textarea

.github/dependabot.yml

@@ -12,12 +12,6 @@ updates:
       interval: monthly
     target-branch: 'dev'
 
-  - package-ecosystem: npm
-    directory: '/'
-    schedule:
-      interval: monthly
-    target-branch: 'dev'
-
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:

.github/pull_request_template.md

@@ -1,17 +1,28 @@
+<!--
+⚠️ CRITICAL CHECKS FOR CONTRIBUTORS (READ, DON'T DELETE) ⚠️
+1. Target the `dev` branch. PRs targeting `main` will be automatically closed.
+2. Do NOT delete the CLA section at the bottom. It is required for the bot to accept your PR.
+-->
+
 # Pull Request Checklist
 
-### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request.
+### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) to discuss your idea/fix with the community before creating a pull request, and describe your changes before submitting a pull request.
+
+This is to ensure large feature PRs are discussed with the community first, before starting work on it. If the community does not want this feature or it is not relevant for Open WebUI as a project, it can be identified in the discussion before working on the feature and submitting the PR.
 
 **Before submitting, make sure you've checked the following:**
 
-- [ ] **Target branch:** Please verify that the pull request targets the `dev` branch.
-- [ ] **Description:** Provide a concise description of the changes made in this pull request.
+- [ ] **Target branch:** Verify that the pull request targets the `dev` branch. **PRs targeting `main` will be immediately closed.**
+- [ ] **Description:** Provide a concise description of the changes made in this pull request down below.
 - [ ] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description.
-- [ ] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources?
-- [ ] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation?
-- [ ] **Testing:** Have you written and run sufficient tests to validate the changes?
+- [ ] **Documentation:** Add docs in [Open WebUI Docs Repository](https://github.com/open-webui/docs). Document user-facing behavior, environment variables, public APIs/interfaces, or deployment steps.
+- [ ] **Dependencies:** Are there any new or upgraded dependencies? If so, explain why, update the changelog/docs, and include any compatibility notes. Actually run the code/function that uses updated library to ensure it doesn't crash.
+- [ ] **Testing:** Perform manual tests to **verify the implemented fix/feature works as intended AND does not break any other functionality**. Include reproducible steps to demonstrate the issue before the fix. Test edge cases (URL encoding, HTML entities, types). Take this as an opportunity to **make screenshots of the feature/fix and include them in the PR description**.
+- [ ] **Agentic AI Code:** Confirm this Pull Request is **not written by any AI Agent** or has at least **gone through additional human review AND manual testing**. If any AI Agent is the co-author of this PR, it may lead to immediate closure of the PR.
 - [ ] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
-- [ ] **Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following:
+- [ ] **Design & Architecture:** Prefer smart defaults over adding new settings; use local state for ephemeral UI logic. Open a Discussion for major architectural or UX changes.
+- [ ] **Git Hygiene:** Keep PRs atomic (one logical change). Clean up commits and rebase on `dev` to ensure no unrelated commits (e.g. from `main`) are included. Push updates to the existing PR branch instead of closing and reopening.
+- [ ] **Title Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following:
   - **BREAKING CHANGE**: Significant changes that may affect compatibility
   - **build**: Changes that affect the build system or external dependencies
   - **ci**: Changes to our continuous integration processes or workflows
@@ -73,4 +84,13 @@
 
 ### Contributor License Agreement
 
-By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
+<!--
+🚨 DO NOT DELETE THE TEXT BELOW 🚨
+Keep the "Contributor License Agreement" confirmation text intact.
+Deleting it will trigger the CLA-Bot to INVALIDATE your PR.
+-->
+
+By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
+
+> [!NOTE]
+> Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

.github/workflows/build-release.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check for changes in package.json
         run: |
@@ -36,7 +36,7 @@ jobs:
           echo "::set-output name=content::$CHANGELOG_ESCAPED"
 
       - name: Create GitHub release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -61,7 +61,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Trigger Docker build workflow
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             github.rest.actions.createWorkflowDispatch({

.github/workflows/deploy-to-hf-spaces.yml

@@ -27,7 +27,7 @@ jobs:
       HF_TOKEN: ${{ secrets.HF_TOKEN }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           lfs: true
 
@@ -57,7 +57,8 @@ jobs:
           git lfs install
           git lfs track "*.ttf"
           git lfs track "*.jpg"
-          rm demo.gif
+          rm demo.png
+          rm banner.png
           git add .
           git commit -m "GitHub deploy: ${{ github.sha }}"
           git push --force https://open-webui:${HF_TOKEN}@huggingface.co/spaces/open-webui/open-webui main

.github/workflows/docker-build.yaml

@@ -43,7 +43,7 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -141,8 +141,11 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
+      - name: Delete huge unnecessary tools folder
+        run: rm -rf /opt/hostedtoolcache
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -243,8 +246,11 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
+      - name: Delete huge unnecessary tools folder
+        run: rm -rf /opt/hostedtoolcache
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -347,7 +353,7 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -419,6 +425,108 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  build-slim-image:
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+
+    steps:
+      # GitHub Packages requires the entire repository name to be in lowercase
+      # although the repository owner has a lowercase username, this prevents some people from running actions after forking
+      - name: Set repository and image name to lowercase
+        run: |
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >>${GITHUB_ENV}
+          echo "FULL_IMAGE_NAME=ghcr.io/${IMAGE_NAME,,}" >>${GITHUB_ENV}
+        env:
+          IMAGE_NAME: '${{ github.repository }}'
+
+      - name: Prepare
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker images (slim tag)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.FULL_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha,prefix=git-
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,enable=${{ github.ref == 'refs/heads/main' }},prefix=,suffix=,value=slim
+          flavor: |
+            latest=${{ github.ref == 'refs/heads/main' }}
+            suffix=-slim,onlatest=true
+
+      - name: Extract metadata for Docker cache
+        id: cache-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.FULL_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            ${{ github.ref_type == 'tag' && 'type=raw,value=main' || '' }}
+          flavor: |
+            prefix=cache-slim-${{ matrix.platform }}-
+            latest=false
+
+      - name: Build Docker image (slim)
+        uses: docker/build-push-action@v5
+        id: build
+        with:
+          context: .
+          push: true
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.FULL_IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=registry,ref=${{ steps.cache-meta.outputs.tags }}
+          cache-to: type=registry,ref=${{ steps.cache-meta.outputs.tags }},mode=max
+          build-args: |
+            BUILD_HASH=${{ github.sha }}
+            USE_SLIM=true
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-slim-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
   merge-main-images:
     runs-on: ubuntu-latest
     needs: [build-main-image]
@@ -433,7 +541,7 @@ jobs:
           IMAGE_NAME: '${{ github.repository }}'
 
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: digests-main-*
           path: /tmp/digests
@@ -487,7 +595,7 @@ jobs:
           IMAGE_NAME: '${{ github.repository }}'
 
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: digests-cuda-*
           path: /tmp/digests
@@ -543,7 +651,7 @@ jobs:
           IMAGE_NAME: '${{ github.repository }}'
 
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: digests-cuda126-*
           path: /tmp/digests
@@ -599,7 +707,7 @@ jobs:
           IMAGE_NAME: '${{ github.repository }}'
 
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: digests-ollama-*
           path: /tmp/digests
@@ -640,3 +748,59 @@ jobs:
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+
+  merge-slim-images:
+    runs-on: ubuntu-latest
+    needs: [build-slim-image]
+    steps:
+      # GitHub Packages requires the entire repository name to be in lowercase
+      # although the repository owner has a lowercase username, this prevents some people from running actions after forking
+      - name: Set repository and image name to lowercase
+        run: |
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >>${GITHUB_ENV}
+          echo "FULL_IMAGE_NAME=ghcr.io/${IMAGE_NAME,,}" >>${GITHUB_ENV}
+        env:
+          IMAGE_NAME: '${{ github.repository }}'
+
+      - name: Download digests
+        uses: actions/download-artifact@v5
+        with:
+          pattern: digests-slim-*
+          path: /tmp/digests
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker images (default slim tag)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.FULL_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha,prefix=git-
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,enable=${{ github.ref == 'refs/heads/main' }},prefix=,suffix=,value=slim
+          flavor: |
+            latest=${{ github.ref == 'refs/heads/main' }}
+            suffix=-slim,onlatest=true
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.FULL_IMAGE_NAME }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ steps.meta.outputs.version }}

.github/workflows/format-backend.yaml

@@ -30,10 +30,10 @@ jobs:
           - 3.12.x
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '${{ matrix.python-version }}'
 

.github/workflows/format-build-frontend.yaml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '22'
 
@@ -51,10 +51,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '22'
 

.github/workflows/release-pypi.yml

@@ -16,15 +16,15 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Install Git
         run: sudo apt-get update && sudo apt-get install -y git
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.11
       - name: Build

.prettierignore

@@ -3,8 +3,6 @@ pnpm-lock.yaml
 package-lock.json
 yarn.lock
 
-kubernetes/
-
 # Copy of .gitignore
 .DS_Store
 node_modules

Dockerfile

@@ -3,6 +3,8 @@
 # use build args in the docker build command with --build-arg="BUILDARG=true"
 ARG USE_CUDA=false
 ARG USE_OLLAMA=false
+ARG USE_SLIM=false
+ARG USE_PERMISSION_HARDENING=false
 # Tested with cu117 for CUDA 11 and cu121 for CUDA 12 (default)
 ARG USE_CUDA_VER=cu128
 # any sentence transformer model; models to use can be found at https://huggingface.co/models?library=sentence-transformers
@@ -11,6 +13,7 @@ ARG USE_CUDA_VER=cu128
 # IMPORTANT: If you change the embedding model (sentence-transformers/all-MiniLM-L6-v2) and vice versa, you aren't able to use RAG Chat with your previous documents loaded in the WebUI! You need to re-embed them.
 ARG USE_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
 ARG USE_RERANKING_MODEL=""
+ARG USE_AUXILIARY_EMBEDDING_MODEL=TaylorAI/bge-micro-v2
 
 # Tiktoken encoding name; models to use can be found at https://huggingface.co/models?library=tiktoken
 ARG USE_TIKTOKEN_ENCODING_NAME="cl100k_base"
@@ -24,6 +27,9 @@ ARG GID=0
 FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS build
 ARG BUILD_HASH
 
+# Set Node.js options (heap limit Allocation failed - JavaScript heap out of memory)
+# ENV NODE_OPTIONS="--max-old-space-size=4096"
+
 WORKDIR /app
 
 # to store git revision in build
@@ -37,26 +43,34 @@ ENV APP_BUILD_HASH=${BUILD_HASH}
 RUN npm run build
 
 ######## WebUI backend ########
-FROM python:3.11-slim-bookworm AS base
+FROM python:3.11.14-slim-bookworm AS base
 
 # Use args
 ARG USE_CUDA
 ARG USE_OLLAMA
 ARG USE_CUDA_VER
+ARG USE_SLIM
+ARG USE_PERMISSION_HARDENING
 ARG USE_EMBEDDING_MODEL
 ARG USE_RERANKING_MODEL
+ARG USE_AUXILIARY_EMBEDDING_MODEL
 ARG UID
 ARG GID
 
+# Python settings
+ENV PYTHONUNBUFFERED=1
+
 ## Basis ##
 ENV ENV=prod \
     PORT=8080 \
     # pass build args to the build
     USE_OLLAMA_DOCKER=${USE_OLLAMA} \
     USE_CUDA_DOCKER=${USE_CUDA} \
+    USE_SLIM_DOCKER=${USE_SLIM} \
     USE_CUDA_DOCKER_VER=${USE_CUDA_VER} \
     USE_EMBEDDING_MODEL_DOCKER=${USE_EMBEDDING_MODEL} \
-    USE_RERANKING_MODEL_DOCKER=${USE_RERANKING_MODEL}
+    USE_RERANKING_MODEL_DOCKER=${USE_RERANKING_MODEL} \
+    USE_AUXILIARY_EMBEDDING_MODEL_DOCKER=${USE_AUXILIARY_EMBEDDING_MODEL}
 
 ## Basis URL Config ##
 ENV OLLAMA_BASE_URL="/ollama" \
@@ -77,6 +91,7 @@ ENV WHISPER_MODEL="base" \
 ## RAG Embedding model settings ##
 ENV RAG_EMBEDDING_MODEL="$USE_EMBEDDING_MODEL_DOCKER" \
     RAG_RERANKING_MODEL="$USE_RERANKING_MODEL_DOCKER" \
+    AUXILIARY_EMBEDDING_MODEL="$USE_AUXILIARY_EMBEDDING_MODEL_DOCKER" \
     SENTENCE_TRANSFORMERS_HOME="/app/backend/data/cache/embedding/models"
 
 ## Tiktoken model settings ##
@@ -113,7 +128,7 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     git build-essential pandoc gcc netcat-openbsd curl jq \
     python3-dev \
-    ffmpeg libsm6 libxext6 \
+    ffmpeg libsm6 libxext6 zstd \
     && rm -rf /var/lib/apt/lists/*
 
 # install python dependencies
@@ -122,19 +137,27 @@ COPY --chown=$UID:$GID ./backend/requirements.txt ./requirements.txt
 RUN pip3 install --no-cache-dir uv && \
     if [ "$USE_CUDA" = "true" ]; then \
     # If you use CUDA the whisper and embedding model will be downloaded on first use
-    pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/$USE_CUDA_DOCKER_VER --no-cache-dir && \
+    # fix: pin torch<=2.9.1 - torch 2.10.0 aarch64 wheels cause SIGILL on ARM devices (RPi 4 Cortex-A72) #21349
+    pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/$USE_CUDA_DOCKER_VER --no-cache-dir && \
     uv pip install --system -r requirements.txt --no-cache-dir && \
     python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')" && \
+    python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')" && \
     python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
     python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
+    python -c "import nltk; nltk.download('punkt_tab')"; \
     else \
-    pip3 install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu --no-cache-dir && \
+    pip3 install 'torch<=2.9.1' torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu --no-cache-dir && \
     uv pip install --system -r requirements.txt --no-cache-dir && \
+    if [ "$USE_SLIM" != "true" ]; then \
     python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ['RAG_EMBEDDING_MODEL'], device='cpu')" && \
+    python -c "import os; from sentence_transformers import SentenceTransformer; SentenceTransformer(os.environ.get('AUXILIARY_EMBEDDING_MODEL', 'TaylorAI/bge-micro-v2'), device='cpu')" && \
     python -c "import os; from faster_whisper import WhisperModel; WhisperModel(os.environ['WHISPER_MODEL'], device='cpu', compute_type='int8', download_root=os.environ['WHISPER_MODEL_DIR'])"; \
     python -c "import os; import tiktoken; tiktoken.get_encoding(os.environ['TIKTOKEN_ENCODING_NAME'])"; \
+    python -c "import nltk; nltk.download('punkt_tab')"; \
     fi; \
-    chown -R $UID:$GID /app/backend/data/
+    fi; \
+    mkdir -p /app/backend/data && chown -R $UID:$GID /app/backend/data/ && \
+    rm -rf /var/lib/apt/lists/*;
 
 # Install Ollama if requested
 RUN if [ "$USE_OLLAMA" = "true" ]; then \
@@ -163,11 +186,13 @@ HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq
 # Minimal, atomic permission hardening for OpenShift (arbitrary UID):
 # - Group 0 owns /app and /root
 # - Directories are group-writable and have SGID so new files inherit GID 0
-RUN set -eux; \
+RUN if [ "$USE_PERMISSION_HARDENING" = "true" ]; then \
+    set -eux; \
     chgrp -R 0 /app /root || true; \
     chmod -R g+rwX /app /root || true; \
     find /app -type d -exec chmod g+s {} + || true; \
-    find /root -type d -exec chmod g+s {} + || true
+    find /root -type d -exec chmod g+s {} + || true; \
+    fi
 
 USER $UID:$GID
 

INSTALLATION.md

@@ -1,35 +0,0 @@
-### Installing Both Ollama and Open WebUI Using Kustomize
-
-For cpu-only pod
-
-```bash
-kubectl apply -f ./kubernetes/manifest/base
-```
-
-For gpu-enabled pod
-
-```bash
-kubectl apply -k ./kubernetes/manifest
-```
-
-### Installing Both Ollama and Open WebUI Using Helm
-
-Package Helm file first
-
-```bash
-helm package ./kubernetes/helm/
-```
-
-For cpu-only pod
-
-```bash
-helm install ollama-webui ./ollama-webui-*.tgz
-```
-
-For gpu-enabled pod
-
-```bash
-helm install ollama-webui ./ollama-webui-*.tgz --set ollama.resources.limits.nvidia.com/gpu="1"
-```
-
-Check the `kubernetes/helm/values.yaml` file to know which parameters are available for customization

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2023-2025 Timothy Jaeryang Baek (Open WebUI)
+Copyright (c) 2023- Open WebUI Inc. [Created by Timothy Jaeryang Baek]
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

LICENSE_NOTICE

@@ -0,0 +1,11 @@
+# Open WebUI Multi-License Notice
+
+This repository contains code governed by multiple licenses based on the date and origin of contribution:
+
+1. All code committed prior to commit a76068d69cd59568b920dfab85dc573dbbb8f131 is licensed under the MIT License (see LICENSE_HISTORY).
+
+2. All code committed from commit a76068d69cd59568b920dfab85dc573dbbb8f131 up to and including commit 60d84a3aae9802339705826e9095e272e3c83623 is licensed under the BSD 3-Clause License (see LICENSE_HISTORY).
+
+3. All code contributed or modified after commit 60d84a3aae9802339705826e9095e272e3c83623 is licensed under the Open WebUI License (see LICENSE).
+
+For details on which commits are covered by which license, refer to LICENSE_HISTORY.

README.md

@@ -10,14 +10,16 @@
 [![Discord](https://img.shields.io/badge/Discord-Open_WebUI-blue?logo=discord&logoColor=white)](https://discord.gg/5rJgQTnV4s)
 [![](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/tjbck)
 
+![Open WebUI Banner](./banner.png)
+
 **Open WebUI is an [extensible](https://docs.openwebui.com/features/plugin/), feature-rich, and user-friendly self-hosted AI platform designed to operate entirely offline.** It supports various LLM runners like **Ollama** and **OpenAI-compatible APIs**, with **built-in inference engine** for RAG, making it a **powerful AI deployment solution**.
 
 Passionate about open-source AI? [Join our team →](https://careers.openwebui.com/)
 
-![Open WebUI Demo](./demo.gif)
+![Open WebUI Demo](./demo.png)
 
 > [!TIP]  
-> **Looking for an [Enterprise Plan](https://docs.openwebui.com/enterprise)?** – **[Speak with Our Sales Team Today!](mailto:sales@openwebui.com)**
+> **Looking for an [Enterprise Plan](https://docs.openwebui.com/enterprise)?** – **[Speak with Our Sales Team Today!](https://docs.openwebui.com/enterprise)**
 >
 > Get **enhanced capabilities**, including **custom theming and branding**, **Service Level Agreement (SLA) support**, **Long-Term Support (LTS) versions**, and **more!**
 
@@ -31,32 +33,44 @@ For more information, be sure to check out our [Open WebUI Documentation](https:
 
 - 🛡️ **Granular Permissions and User Groups**: By allowing administrators to create detailed user roles and permissions, we ensure a secure user environment. This granularity not only enhances security but also allows for customized user experiences, fostering a sense of ownership and responsibility amongst users.
 
-- 🔄 **SCIM 2.0 Support**: Enterprise-grade user and group provisioning through SCIM 2.0 protocol, enabling seamless integration with identity providers like Okta, Azure AD, and Google Workspace for automated user lifecycle management.
-
 - 📱 **Responsive Design**: Enjoy a seamless experience across Desktop PC, Laptop, and Mobile devices.
 
 - 📱 **Progressive Web App (PWA) for Mobile**: Enjoy a native app-like experience on your mobile device with our PWA, providing offline access on localhost and a seamless user interface.
 
 - ✒️🔢 **Full Markdown and LaTeX Support**: Elevate your LLM experience with comprehensive Markdown and LaTeX capabilities for enriched interaction.
 
-- 🎤📹 **Hands-Free Voice/Video Call**: Experience seamless communication with integrated hands-free voice and video call features, allowing for a more dynamic and interactive chat environment.
+- 🎤📹 **Hands-Free Voice/Video Call**: Experience seamless communication with integrated hands-free voice and video call features using multiple Speech-to-Text providers (Local Whisper, OpenAI, Deepgram, Azure) and Text-to-Speech engines (Azure, ElevenLabs, OpenAI, Transformers, WebAPI), allowing for dynamic and interactive chat environments.
 
 - 🛠️ **Model Builder**: Easily create Ollama models via the Web UI. Create and add custom characters/agents, customize chat elements, and import models effortlessly through [Open WebUI Community](https://openwebui.com/) integration.
 
 - 🐍 **Native Python Function Calling Tool**: Enhance your LLMs with built-in code editor support in the tools workspace. Bring Your Own Function (BYOF) by simply adding your pure Python functions, enabling seamless integration with LLMs.
 
-- 📚 **Local RAG Integration**: Dive into the future of chat interactions with groundbreaking Retrieval Augmented Generation (RAG) support. This feature seamlessly integrates document interactions into your chat experience. You can load documents directly into the chat or add files to your document library, effortlessly accessing them using the `#` command before a query.
+- 💾 **Persistent Artifact Storage**: Built-in key-value storage API for artifacts, enabling features like journals, trackers, leaderboards, and collaborative tools with both personal and shared data scopes across sessions.
 
-- 🔍 **Web Search for RAG**: Perform web searches using providers like `SearXNG`, `Google PSE`, `Brave Search`, `serpstack`, `serper`, `Serply`, `DuckDuckGo`, `TavilySearch`, `SearchApi` and `Bing` and inject the results directly into your chat experience.
+- 📚 **Local RAG Integration**: Dive into the future of chat interactions with groundbreaking Retrieval Augmented Generation (RAG) support using your choice of 9 vector databases and multiple content extraction engines (Tika, Docling, Document Intelligence, Mistral OCR, External loaders). Load documents directly into chat or add files to your document library, effortlessly accessing them using the `#` command before a query.
+
+- 🔍 **Web Search for RAG**: Perform web searches using 15+ providers including `SearXNG`, `Google PSE`, `Brave Search`, `Kagi`, `Mojeek`, `Tavily`, `Perplexity`, `serpstack`, `serper`, `Serply`, `DuckDuckGo`, `SearchApi`, `SerpApi`, `Bing`, `Jina`, `Exa`, `Sougou`, `Azure AI Search`, and `Ollama Cloud`, injecting results directly into your chat experience.
 
 - 🌐 **Web Browsing Capability**: Seamlessly integrate websites into your chat experience using the `#` command followed by a URL. This feature allows you to incorporate web content directly into your conversations, enhancing the richness and depth of your interactions.
 
-- 🎨 **Image Generation Integration**: Seamlessly incorporate image generation capabilities using options such as AUTOMATIC1111 API or ComfyUI (local), and OpenAI's DALL-E (external), enriching your chat experience with dynamic visual content.
+- 🎨 **Image Generation & Editing Integration**: Create and edit images using multiple engines including OpenAI's DALL-E, Gemini, ComfyUI (local), and AUTOMATIC1111 (local), with support for both generation and prompt-based editing workflows.
 
 - ⚙️ **Many Models Conversations**: Effortlessly engage with various models simultaneously, harnessing their unique strengths for optimal responses. Enhance your experience by leveraging a diverse set of models in parallel.
 
 - 🔐 **Role-Based Access Control (RBAC)**: Ensure secure access with restricted permissions; only authorized individuals can access your Ollama, and exclusive model creation/pulling rights are reserved for administrators.
 
+- 🗄️ **Flexible Database & Storage Options**: Choose from SQLite (with optional encryption), PostgreSQL, or configure cloud storage backends (S3, Google Cloud Storage, Azure Blob Storage) for scalable deployments.
+
+- 🔍 **Advanced Vector Database Support**: Select from 9 vector database options including ChromaDB, PGVector, Qdrant, Milvus, Elasticsearch, OpenSearch, Pinecone, S3Vector, and Oracle 23ai for optimal RAG performance.
+
+- 🔐 **Enterprise Authentication**: Full support for LDAP/Active Directory integration, SCIM 2.0 automated provisioning, and SSO via trusted headers alongside OAuth providers. Enterprise-grade user and group provisioning through SCIM 2.0 protocol, enabling seamless integration with identity providers like Okta, Azure AD, and Google Workspace for automated user lifecycle management.
+
+- ☁️ **Cloud-Native Integration**: Native support for Google Drive and OneDrive/SharePoint file picking, enabling seamless document import from enterprise cloud storage.
+
+- 📊 **Production Observability**: Built-in OpenTelemetry support for traces, metrics, and logs, enabling comprehensive monitoring with your existing observability stack.
+
+- ⚖️ **Horizontal Scalability**: Redis-backed session management and WebSocket support for multi-worker and multi-node deployments behind load balancers.
+
 - 🌐🌍 **Multilingual Support**: Experience Open WebUI in your preferred language with our internationalization (i18n) support. Join us in expanding our supported languages! We're actively seeking contributors!
 
 - 🧩 **Pipelines, Open WebUI Plugin Support**: Seamlessly integrate custom logic and Python libraries into Open WebUI using [Pipelines Plugin Framework](https://github.com/open-webui/pipelines). Launch your Pipelines instance, set the OpenAI URL to the Pipelines URL, and explore endless possibilities. [Examples](https://github.com/open-webui/pipelines/tree/main/examples) include **Function Calling**, User **Rate Limiting** to control access, **Usage Monitoring** with tools like Langfuse, **Live Translation with LibreTranslate** for multilingual support, **Toxic Message Filtering** and much more.
@@ -65,43 +79,6 @@ For more information, be sure to check out our [Open WebUI Documentation](https:
 
 Want to learn more about Open WebUI's features? Check out our [Open WebUI documentation](https://docs.openwebui.com/features) for a comprehensive overview!
 
-## Sponsors 🙌
-
-#### Emerald
-
-<table>
-  <!-- <tr>
-    <td>
-      <a href="https://n8n.io/" target="_blank">
-        <img src="https://docs.openwebui.com/sponsors/logos/n8n.png" alt="n8n" style="width: 8rem; height: 8rem; border-radius: .75rem;" />
-      </a>
-    </td>
-    <td>
-      <a href="https://n8n.io/">n8n</a> • Does your interface have a backend yet?<br>Try <a href="https://n8n.io/">n8n</a>
-    </td>
-  </tr> -->
-  <tr>
-    <td>
-      <a href="https://tailscale.com/blog/self-host-a-local-ai-stack/?utm_source=OpenWebUI&utm_medium=paid-ad-placement&utm_campaign=OpenWebUI-Docs" target="_blank">
-        <img src="https://docs.openwebui.com/sponsors/logos/tailscale.png" alt="Tailscale" style="width: 8rem; height: 8rem; border-radius: .75rem;" />
-      </a>
-    </td>
-    <td>
-      <a href="https://tailscale.com/blog/self-host-a-local-ai-stack/?utm_source=OpenWebUI&utm_medium=paid-ad-placement&utm_campaign=OpenWebUI-Docs">Tailscale</a> • Connect self-hosted AI to any device with Tailscale
-    </td>
-  </tr>
-   <tr>
-    <td>
-      <a href="https://warp.dev/open-webui" target="_blank">
-        <img src="https://docs.openwebui.com/sponsors/logos/warp.png" alt="Warp" style="width: 8rem; height: 8rem; border-radius: .75rem;" />
-      </a>
-    </td>
-    <td>
-      <a href="https://warp.dev/open-webui">Warp</a> • The intelligent terminal for developers
-    </td>
-  </tr>
-</table>
-
 ---
 
 We are incredibly grateful for the generous support of our sponsors. Their contributions help us to maintain and improve our project, ensuring we can continue to deliver quality work to our community. Thank you!
@@ -213,14 +190,6 @@ docker run -d --network=host -v open-webui:/app/backend/data -e OLLAMA_BASE_URL=
 
 ### Keeping Your Docker Installation Up-to-Date
 
-In case you want to update your local Docker installation to the latest version, you can do it with [Watchtower](https://containrrr.dev/watchtower/):
-
-```bash
-docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower --run-once open-webui
-```
-
-In the last part of the command, replace `open-webui` with your container name if it is different.
-
 Check our Updating Guide available in our [Open WebUI Documentation](https://docs.openwebui.com/getting-started/updating).
 
 ### Using the Dev Branch 🌙
@@ -248,7 +217,7 @@ Discover upcoming features on our roadmap in the [Open WebUI Documentation](http
 
 ## License 📜
 
-This project is licensed under the [Open WebUI License](LICENSE), a revised BSD-3-Clause license. You receive all the same rights as the classic BSD-3 license: you can use, modify, and distribute the software, including in proprietary and commercial products, with minimal restrictions. The only additional requirement is to preserve the "Open WebUI" branding, as detailed in the LICENSE file. For full terms, see the [LICENSE](LICENSE) document. 📄
+This project contains code under multiple licenses. The current codebase includes components licensed under the Open WebUI License with an additional requirement to preserve the "Open WebUI" branding, as well as prior contributions under their respective original licenses. For a detailed record of license changes and the applicable terms for each section of the code, please refer to [LICENSE_HISTORY](./LICENSE_HISTORY). For complete and updated licensing details, please see the [LICENSE](./LICENSE) and [LICENSE_HISTORY](./LICENSE_HISTORY) files.
 
 ## Support 💬
 

backend/dev.sh

@@ -1,3 +1,3 @@
-export CORS_ALLOW_ORIGIN="http://localhost:5173"
+export CORS_ALLOW_ORIGIN="http://localhost:5173;http://localhost:8080"
 PORT="${PORT:-8080}"
 uvicorn open_webui.main:app --port $PORT --host 0.0.0.0 --forwarded-allow-ips '*' --reload

backend/open_webui/constants.py

@@ -38,13 +38,14 @@ class ERROR_MESSAGES(str, Enum):
     ID_TAKEN = "Uh-oh! This id is already registered. Please choose another id string."
     MODEL_ID_TAKEN = "Uh-oh! This model id is already registered. Please choose another model id string."
     NAME_TAG_TAKEN = "Uh-oh! This name tag is already registered. Please choose another name tag string."
+    MODEL_ID_TOO_LONG = "The model id is too long. Please make sure your model id is less than 256 characters long."
 
     INVALID_TOKEN = (
         "Your session has expired or the token is invalid. Please sign in again."
     )
     INVALID_CRED = "The email or password provided is incorrect. Please check for typos and try logging in again."
     INVALID_EMAIL_FORMAT = "The email format you entered is invalid. Please double-check and make sure you're using a valid email address (e.g., yourname@example.com)."
-    INVALID_PASSWORD = (
+    INCORRECT_PASSWORD = (
         "The password provided is incorrect. Please check for typos and try again."
     )
     INVALID_TRUSTED_HEADER = "Your provider has not provided a trusted header. Please contact your administrator for assistance."
@@ -104,6 +105,10 @@ class ERROR_MESSAGES(str, Enum):
     )
     FILE_NOT_PROCESSED = "Extracted content is not available for this file. Please ensure that the file is processed before proceeding."
 
+    INVALID_PASSWORD = lambda err="": (
+        err if err else "The password does not meet the required validation criteria."
+    )
+
 
 class TASKS(str, Enum):
     def __str__(self) -> str:

backend/open_webui/env.py

@@ -8,6 +8,8 @@ import shutil
 from uuid import uuid4
 from pathlib import Path
 from cryptography.hazmat.primitives import serialization
+import re
+
 
 import markdown
 from bs4 import BeautifulSoup
@@ -83,32 +85,7 @@ if "cuda_error" in locals():
     log.exception(cuda_error)
     del cuda_error
 
-log_sources = [
-    "AUDIO",
-    "COMFYUI",
-    "CONFIG",
-    "DB",
-    "IMAGES",
-    "MAIN",
-    "MODELS",
-    "OLLAMA",
-    "OPENAI",
-    "RAG",
-    "WEBHOOK",
-    "SOCKET",
-    "OAUTH",
-]
-
-SRC_LOG_LEVELS = {}
-
-for source in log_sources:
-    log_env_var = source + "_LOG_LEVEL"
-    SRC_LOG_LEVELS[source] = os.environ.get(log_env_var, "").upper()
-    if SRC_LOG_LEVELS[source] not in logging.getLevelNamesMapping():
-        SRC_LOG_LEVELS[source] = GLOBAL_LOG_LEVEL
-    log.info(f"{log_env_var}: {SRC_LOG_LEVELS[source]}")
-
-log.setLevel(SRC_LOG_LEVELS["CONFIG"])
+SRC_LOG_LEVELS = {}  # Legacy variable, do not remove
 
 WEBUI_NAME = os.environ.get("WEBUI_NAME", "Open WebUI")
 if WEBUI_NAME != "Open WebUI":
@@ -135,8 +112,13 @@ else:
         PACKAGE_DATA = {"version": "0.0.0"}
 
 VERSION = PACKAGE_DATA["version"]
+
+
+DEPLOYMENT_ID = os.environ.get("DEPLOYMENT_ID", "")
 INSTANCE_ID = os.environ.get("INSTANCE_ID", str(uuid4()))
 
+ENABLE_DB_MIGRATIONS = os.environ.get("ENABLE_DB_MIGRATIONS", "True").lower() == "true"
+
 
 # Function to parse each section
 def parse_section(section):
@@ -212,6 +194,35 @@ ENABLE_FORWARD_USER_INFO_HEADERS = (
     os.environ.get("ENABLE_FORWARD_USER_INFO_HEADERS", "False").lower() == "true"
 )
 
+# Header names for user info forwarding (customizable via environment variables)
+FORWARD_USER_INFO_HEADER_USER_NAME = os.environ.get(
+    "FORWARD_USER_INFO_HEADER_USER_NAME", "X-OpenWebUI-User-Name"
+)
+FORWARD_USER_INFO_HEADER_USER_ID = os.environ.get(
+    "FORWARD_USER_INFO_HEADER_USER_ID", "X-OpenWebUI-User-Id"
+)
+FORWARD_USER_INFO_HEADER_USER_EMAIL = os.environ.get(
+    "FORWARD_USER_INFO_HEADER_USER_EMAIL", "X-OpenWebUI-User-Email"
+)
+FORWARD_USER_INFO_HEADER_USER_ROLE = os.environ.get(
+    "FORWARD_USER_INFO_HEADER_USER_ROLE", "X-OpenWebUI-User-Role"
+)
+
+# Header name for chat ID forwarding (customizable via environment variable)
+FORWARD_SESSION_INFO_HEADER_MESSAGE_ID = os.environ.get(
+    "FORWARD_SESSION_INFO_HEADER_MESSAGE_ID", "X-OpenWebUI-Message-Id"
+)
+FORWARD_SESSION_INFO_HEADER_CHAT_ID = os.environ.get(
+    "FORWARD_SESSION_INFO_HEADER_CHAT_ID", "X-OpenWebUI-Chat-Id"
+)
+
+# Experimental feature, may be removed in future
+ENABLE_STAR_SESSIONS_MIDDLEWARE = (
+    os.environ.get("ENABLE_STAR_SESSIONS_MIDDLEWARE", "False").lower() == "true"
+)
+
+ENABLE_EASTER_EGGS = os.environ.get("ENABLE_EASTER_EGGS", "True").lower() == "true"
+
 ####################################
 # WEBUI_BUILD_HASH
 ####################################
@@ -354,6 +365,16 @@ if DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL is not None:
     except Exception:
         DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL = 0.0
 
+# When enabled, get_db_context reuses existing sessions; set to False to always create new sessions
+DATABASE_ENABLE_SESSION_SHARING = (
+    os.environ.get("DATABASE_ENABLE_SESSION_SHARING", "False").lower() == "true"
+)
+
+# Enable public visibility of active user count (when disabled, only admins can see it)
+ENABLE_PUBLIC_ACTIVE_USERS_COUNT = (
+    os.environ.get("ENABLE_PUBLIC_ACTIVE_USERS_COUNT", "True").lower() == "true"
+)
+
 RESET_CONFIG_ON_START = (
     os.environ.get("RESET_CONFIG_ON_START", "False").lower() == "true"
 )
@@ -362,6 +383,10 @@ ENABLE_REALTIME_CHAT_SAVE = (
     os.environ.get("ENABLE_REALTIME_CHAT_SAVE", "False").lower() == "true"
 )
 
+ENABLE_QUERIES_CACHE = os.environ.get("ENABLE_QUERIES_CACHE", "False").lower() == "true"
+
+RAG_SYSTEM_CONTEXT = os.environ.get("RAG_SYSTEM_CONTEXT", "False").lower() == "true"
+
 ####################################
 # REDIS
 ####################################
@@ -383,6 +408,25 @@ try:
 except ValueError:
     REDIS_SENTINEL_MAX_RETRY_COUNT = 2
 
+
+REDIS_SOCKET_CONNECT_TIMEOUT = os.environ.get("REDIS_SOCKET_CONNECT_TIMEOUT", "")
+try:
+    REDIS_SOCKET_CONNECT_TIMEOUT = float(REDIS_SOCKET_CONNECT_TIMEOUT)
+except ValueError:
+    REDIS_SOCKET_CONNECT_TIMEOUT = None
+
+REDIS_RECONNECT_DELAY = os.environ.get("REDIS_RECONNECT_DELAY", "")
+
+if REDIS_RECONNECT_DELAY == "":
+    REDIS_RECONNECT_DELAY = None
+else:
+    try:
+        REDIS_RECONNECT_DELAY = float(REDIS_RECONNECT_DELAY)
+        if REDIS_RECONNECT_DELAY < 0:
+            REDIS_RECONNECT_DELAY = None
+    except Exception:
+        REDIS_RECONNECT_DELAY = None
+
 ####################################
 # UVICORN WORKERS
 ####################################
@@ -402,10 +446,24 @@ except ValueError:
 ####################################
 
 WEBUI_AUTH = os.environ.get("WEBUI_AUTH", "True").lower() == "true"
+
+ENABLE_INITIAL_ADMIN_SIGNUP = (
+    os.environ.get("ENABLE_INITIAL_ADMIN_SIGNUP", "False").lower() == "true"
+)
 ENABLE_SIGNUP_PASSWORD_CONFIRMATION = (
     os.environ.get("ENABLE_SIGNUP_PASSWORD_CONFIRMATION", "False").lower() == "true"
 )
 
+####################################
+# Admin Account Runtime Creation
+####################################
+
+# Optional env vars for creating an admin account on startup
+# Useful for headless/automated deployments
+WEBUI_ADMIN_EMAIL = os.environ.get("WEBUI_ADMIN_EMAIL", "")
+WEBUI_ADMIN_PASSWORD = os.environ.get("WEBUI_ADMIN_PASSWORD", "")
+WEBUI_ADMIN_NAME = os.environ.get("WEBUI_ADMIN_NAME", "Admin")
+
 WEBUI_AUTH_TRUSTED_EMAIL_HEADER = os.environ.get(
     "WEBUI_AUTH_TRUSTED_EMAIL_HEADER", None
 )
@@ -415,6 +473,27 @@ WEBUI_AUTH_TRUSTED_GROUPS_HEADER = os.environ.get(
 )
 
 
+ENABLE_PASSWORD_VALIDATION = (
+    os.environ.get("ENABLE_PASSWORD_VALIDATION", "False").lower() == "true"
+)
+PASSWORD_VALIDATION_REGEX_PATTERN = os.environ.get(
+    "PASSWORD_VALIDATION_REGEX_PATTERN",
+    r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$",
+)
+
+
+try:
+    PASSWORD_VALIDATION_REGEX_PATTERN = rf"{PASSWORD_VALIDATION_REGEX_PATTERN}"
+    PASSWORD_VALIDATION_REGEX_PATTERN = re.compile(PASSWORD_VALIDATION_REGEX_PATTERN)
+except Exception as e:
+    log.error(f"Invalid PASSWORD_VALIDATION_REGEX_PATTERN: {e}")
+    PASSWORD_VALIDATION_REGEX_PATTERN = re.compile(
+        r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$"
+    )
+
+PASSWORD_VALIDATION_HINT = os.environ.get("PASSWORD_VALIDATION_HINT", "")
+
+
 BYPASS_MODEL_ACCESS_CONTROL = (
     os.environ.get("BYPASS_MODEL_ACCESS_CONTROL", "False").lower() == "true"
 )
@@ -459,13 +538,48 @@ ENABLE_COMPRESSION_MIDDLEWARE = (
     os.environ.get("ENABLE_COMPRESSION_MIDDLEWARE", "True").lower() == "true"
 )
 
+####################################
+# OAUTH Configuration
+####################################
+ENABLE_OAUTH_EMAIL_FALLBACK = (
+    os.environ.get("ENABLE_OAUTH_EMAIL_FALLBACK", "False").lower() == "true"
+)
+
+ENABLE_OAUTH_ID_TOKEN_COOKIE = (
+    os.environ.get("ENABLE_OAUTH_ID_TOKEN_COOKIE", "True").lower() == "true"
+)
+
+OAUTH_CLIENT_INFO_ENCRYPTION_KEY = os.environ.get(
+    "OAUTH_CLIENT_INFO_ENCRYPTION_KEY", WEBUI_SECRET_KEY
+)
+
+OAUTH_SESSION_TOKEN_ENCRYPTION_KEY = os.environ.get(
+    "OAUTH_SESSION_TOKEN_ENCRYPTION_KEY", WEBUI_SECRET_KEY
+)
+
+# Token Exchange Configuration
+# Allows external apps to exchange OAuth tokens for OpenWebUI tokens
+ENABLE_OAUTH_TOKEN_EXCHANGE = (
+    os.environ.get("ENABLE_OAUTH_TOKEN_EXCHANGE", "False").lower() == "true"
+)
 
 ####################################
 # SCIM Configuration
 ####################################
 
-SCIM_ENABLED = os.environ.get("SCIM_ENABLED", "False").lower() == "true"
+ENABLE_SCIM = (
+    os.environ.get("ENABLE_SCIM", os.environ.get("SCIM_ENABLED", "False")).lower()
+    == "true"
+)
 SCIM_TOKEN = os.environ.get("SCIM_TOKEN", "")
+SCIM_AUTH_PROVIDER = os.environ.get("SCIM_AUTH_PROVIDER", "")
+
+if ENABLE_SCIM and not SCIM_AUTH_PROVIDER:
+    log.warning(
+        "SCIM is enabled but SCIM_AUTH_PROVIDER is not set. "
+        "Set SCIM_AUTH_PROVIDER to the OAuth provider name (e.g. 'microsoft', 'oidc') "
+        "to enable externalId storage."
+    )
 
 ####################################
 # LICENSE_KEY
@@ -483,21 +597,21 @@ LICENSE_PUBLIC_KEY = os.environ.get("LICENSE_PUBLIC_KEY", "")
 
 pk = None
 if LICENSE_PUBLIC_KEY:
-    pk = serialization.load_pem_public_key(
-        f"""
+    pk = serialization.load_pem_public_key(f"""
 -----BEGIN PUBLIC KEY-----
 {LICENSE_PUBLIC_KEY}
 -----END PUBLIC KEY-----
-""".encode(
-            "utf-8"
-        )
-    )
+""".encode("utf-8"))
 
 
 ####################################
 # MODELS
 ####################################
 
+ENABLE_CUSTOM_MODEL_FALLBACK = (
+    os.environ.get("ENABLE_CUSTOM_MODEL_FALLBACK", "False").lower() == "true"
+)
+
 MODELS_CACHE_TTL = os.environ.get("MODELS_CACHE_TTL", "1")
 if MODELS_CACHE_TTL == "":
     MODELS_CACHE_TTL = None
@@ -512,6 +626,11 @@ else:
 # CHAT
 ####################################
 
+ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION = (
+    os.environ.get("ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION", "False").lower()
+    == "true"
+)
+
 CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE = os.environ.get(
     "CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE", "1"
 )
@@ -527,6 +646,34 @@ else:
         CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE = 1
 
 
+CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES = os.environ.get(
+    "CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES", "30"
+)
+
+if CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES == "":
+    CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES = 30
+else:
+    try:
+        CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES = int(CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES)
+    except Exception:
+        CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES = 30
+
+
+CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE = os.environ.get(
+    "CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE", ""
+)
+
+if CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE == "":
+    CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE = None
+else:
+    try:
+        CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE = int(
+            CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE
+        )
+    except Exception:
+        CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE = None
+
+
 ####################################
 # WEBSOCKET SUPPORT
 ####################################
@@ -538,6 +685,24 @@ ENABLE_WEBSOCKET_SUPPORT = (
 
 WEBSOCKET_MANAGER = os.environ.get("WEBSOCKET_MANAGER", "")
 
+WEBSOCKET_REDIS_OPTIONS = os.environ.get("WEBSOCKET_REDIS_OPTIONS", "")
+
+
+if WEBSOCKET_REDIS_OPTIONS == "":
+    if REDIS_SOCKET_CONNECT_TIMEOUT:
+        WEBSOCKET_REDIS_OPTIONS = {
+            "socket_connect_timeout": REDIS_SOCKET_CONNECT_TIMEOUT
+        }
+    else:
+        log.debug("No WEBSOCKET_REDIS_OPTIONS provided, defaulting to None")
+        WEBSOCKET_REDIS_OPTIONS = None
+else:
+    try:
+        WEBSOCKET_REDIS_OPTIONS = json.loads(WEBSOCKET_REDIS_OPTIONS)
+    except Exception:
+        log.warning("Invalid WEBSOCKET_REDIS_OPTIONS, defaulting to None")
+        WEBSOCKET_REDIS_OPTIONS = None
+
 WEBSOCKET_REDIS_URL = os.environ.get("WEBSOCKET_REDIS_URL", REDIS_URL)
 WEBSOCKET_REDIS_CLUSTER = (
     os.environ.get("WEBSOCKET_REDIS_CLUSTER", str(REDIS_CLUSTER)).lower() == "true"
@@ -552,7 +717,30 @@ except ValueError:
 
 WEBSOCKET_SENTINEL_HOSTS = os.environ.get("WEBSOCKET_SENTINEL_HOSTS", "")
 WEBSOCKET_SENTINEL_PORT = os.environ.get("WEBSOCKET_SENTINEL_PORT", "26379")
+WEBSOCKET_SERVER_LOGGING = (
+    os.environ.get("WEBSOCKET_SERVER_LOGGING", "False").lower() == "true"
+)
+WEBSOCKET_SERVER_ENGINEIO_LOGGING = (
+    os.environ.get(
+        "WEBSOCKET_SERVER_ENGINEIO_LOGGING",
+        os.environ.get("WEBSOCKET_SERVER_LOGGING", "False"),
+    ).lower()
+    == "true"
+)
+WEBSOCKET_SERVER_PING_TIMEOUT = os.environ.get("WEBSOCKET_SERVER_PING_TIMEOUT", "20")
+try:
+    WEBSOCKET_SERVER_PING_TIMEOUT = int(WEBSOCKET_SERVER_PING_TIMEOUT)
+except ValueError:
+    WEBSOCKET_SERVER_PING_TIMEOUT = 20
 
+WEBSOCKET_SERVER_PING_INTERVAL = os.environ.get("WEBSOCKET_SERVER_PING_INTERVAL", "25")
+try:
+    WEBSOCKET_SERVER_PING_INTERVAL = int(WEBSOCKET_SERVER_PING_INTERVAL)
+except ValueError:
+    WEBSOCKET_SERVER_PING_INTERVAL = 25
+
+
+REQUESTS_VERIFY = os.environ.get("REQUESTS_VERIFY", "True").lower() == "true"
 
 AIOHTTP_CLIENT_TIMEOUT = os.environ.get("AIOHTTP_CLIENT_TIMEOUT", "")
 
@@ -603,6 +791,17 @@ AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL = (
 )
 
 
+RAG_EMBEDDING_TIMEOUT = os.environ.get("RAG_EMBEDDING_TIMEOUT", "")
+
+if RAG_EMBEDDING_TIMEOUT == "":
+    RAG_EMBEDDING_TIMEOUT = None
+else:
+    try:
+        RAG_EMBEDDING_TIMEOUT = int(RAG_EMBEDDING_TIMEOUT)
+    except Exception:
+        RAG_EMBEDDING_TIMEOUT = None
+
+
 ####################################
 # SENTENCE TRANSFORMERS
 ####################################
@@ -647,6 +846,16 @@ else:
     except Exception:
         SENTENCE_TRANSFORMERS_CROSS_ENCODER_MODEL_KWARGS = None
 
+# Whether to apply sigmoid normalization to CrossEncoder reranking scores.
+# When enabled (default), scores are normalized to 0-1 range for proper
+# relevance threshold behavior with MS MARCO models.
+SENTENCE_TRANSFORMERS_CROSS_ENCODER_SIGMOID_ACTIVATION_FUNCTION = (
+    os.environ.get(
+        "SENTENCE_TRANSFORMERS_CROSS_ENCODER_SIGMOID_ACTIVATION_FUNCTION", "True"
+    ).lower()
+    == "true"
+)
+
 ####################################
 # OFFLINE_MODE
 ####################################
@@ -663,8 +872,15 @@ if OFFLINE_MODE:
 ####################################
 # AUDIT LOGGING
 ####################################
+
+
+ENABLE_AUDIT_STDOUT = os.getenv("ENABLE_AUDIT_STDOUT", "False").lower() == "true"
+ENABLE_AUDIT_LOGS_FILE = os.getenv("ENABLE_AUDIT_LOGS_FILE", "True").lower() == "true"
+
 # Where to store log file
-AUDIT_LOGS_FILE_PATH = f"{DATA_DIR}/audit.log"
+# Defaults to the DATA_DIR/audit.log. To set AUDIT_LOGS_FILE_PATH you need to
+# provide the whole path, like: /app/audit.log
+AUDIT_LOGS_FILE_PATH = os.getenv("AUDIT_LOGS_FILE_PATH", f"{DATA_DIR}/audit.log")
 # Maximum size of a file before rotating into a new log file
 AUDIT_LOG_FILE_ROTATION_SIZE = os.getenv("AUDIT_LOG_FILE_ROTATION_SIZE", "10MB")
 

backend/open_webui/functions.py

@@ -19,6 +19,7 @@ from fastapi import (
 from starlette.responses import Response, StreamingResponse
 
 
+from open_webui.constants import ERROR_MESSAGES
 from open_webui.socket.main import (
     get_event_call,
     get_event_emitter,
@@ -34,9 +35,8 @@ from open_webui.utils.plugin import (
     get_function_module_from_cache,
 )
 from open_webui.utils.tools import get_tools
-from open_webui.utils.access_control import has_access
 
-from open_webui.env import SRC_LOG_LEVELS, GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL
 
 from open_webui.utils.misc import (
     add_or_update_system_message,
@@ -50,18 +50,28 @@ from open_webui.utils.payload import (
     apply_system_prompt_to_body,
 )
 
-
 logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MAIN"])
 
 
 def get_function_module_by_id(request: Request, pipe_id: str):
     function_module, _, _ = get_function_module_from_cache(request, pipe_id)
 
     if hasattr(function_module, "valves") and hasattr(function_module, "Valves"):
+        Valves = function_module.Valves
         valves = Functions.get_function_valves_by_id(pipe_id)
-        function_module.valves = function_module.Valves(**(valves if valves else {}))
+
+        if valves:
+            try:
+                function_module.valves = Valves(
+                    **{k: v for k, v in valves.items() if v is not None}
+                )
+            except Exception as e:
+                log.exception(f"Error loading valves for function {pipe_id}: {e}")
+                raise e
+        else:
+            function_module.valves = Valves()
+
     return function_module
 
 
@@ -70,65 +80,75 @@ async def get_function_models(request):
     pipe_models = []
 
     for pipe in pipes:
-        function_module = get_function_module_by_id(request, pipe.id)
+        try:
+            function_module = get_function_module_by_id(request, pipe.id)
 
-        # Check if function is a manifold
-        if hasattr(function_module, "pipes"):
-            sub_pipes = []
+            has_user_valves = False
+            if hasattr(function_module, "UserValves"):
+                has_user_valves = True
 
-            # Handle pipes being a list, sync function, or async function
-            try:
-                if callable(function_module.pipes):
-                    if asyncio.iscoroutinefunction(function_module.pipes):
-                        sub_pipes = await function_module.pipes()
-                    else:
-                        sub_pipes = function_module.pipes()
-                else:
-                    sub_pipes = function_module.pipes
-            except Exception as e:
-                log.exception(e)
+            # Check if function is a manifold
+            if hasattr(function_module, "pipes"):
                 sub_pipes = []
 
-            log.debug(
-                f"get_function_models: function '{pipe.id}' is a manifold of {sub_pipes}"
-            )
+                # Handle pipes being a list, sync function, or async function
+                try:
+                    if callable(function_module.pipes):
+                        if asyncio.iscoroutinefunction(function_module.pipes):
+                            sub_pipes = await function_module.pipes()
+                        else:
+                            sub_pipes = function_module.pipes()
+                    else:
+                        sub_pipes = function_module.pipes
+                except Exception as e:
+                    log.exception(e)
+                    sub_pipes = []
 
-            for p in sub_pipes:
-                sub_pipe_id = f'{pipe.id}.{p["id"]}'
-                sub_pipe_name = p["name"]
+                log.debug(
+                    f"get_function_models: function '{pipe.id}' is a manifold of {sub_pipes}"
+                )
 
-                if hasattr(function_module, "name"):
-                    sub_pipe_name = f"{function_module.name}{sub_pipe_name}"
+                for p in sub_pipes:
+                    sub_pipe_id = f'{pipe.id}.{p["id"]}'
+                    sub_pipe_name = p["name"]
 
-                pipe_flag = {"type": pipe.type}
+                    if hasattr(function_module, "name"):
+                        sub_pipe_name = f"{function_module.name}{sub_pipe_name}"
+
+                    pipe_flag = {"type": pipe.type}
+
+                    pipe_models.append(
+                        {
+                            "id": sub_pipe_id,
+                            "name": sub_pipe_name,
+                            "object": "model",
+                            "created": pipe.created_at,
+                            "owned_by": "openai",
+                            "pipe": pipe_flag,
+                            "has_user_valves": has_user_valves,
+                        }
+                    )
+            else:
+                pipe_flag = {"type": "pipe"}
+
+                log.debug(
+                    f"get_function_models: function '{pipe.id}' is a single pipe {{ 'id': {pipe.id}, 'name': {pipe.name} }}"
+                )
 
                 pipe_models.append(
                     {
-                        "id": sub_pipe_id,
-                        "name": sub_pipe_name,
+                        "id": pipe.id,
+                        "name": pipe.name,
                         "object": "model",
                         "created": pipe.created_at,
                         "owned_by": "openai",
                         "pipe": pipe_flag,
+                        "has_user_valves": has_user_valves,
                     }
                 )
-        else:
-            pipe_flag = {"type": "pipe"}
-
-            log.debug(
-                f"get_function_models: function '{pipe.id}' is a single pipe {{ 'id': {pipe.id}, 'name': {pipe.name} }}"
-            )
-
-            pipe_models.append(
-                {
-                    "id": pipe.id,
-                    "name": pipe.name,
-                    "object": "model",
-                    "created": pipe.created_at,
-                    "owned_by": "openai",
-                    "pipe": pipe_flag,
-                }
-            )
+        except Exception as e:
+            log.exception(e)
+            continue
 
     return pipe_models
 
@@ -219,6 +239,16 @@ async def generate_function_chat_completion(
         __task__ = metadata.get("task", None)
         __task_body__ = metadata.get("task_body", None)
 
+    oauth_token = None
+    try:
+        if request.cookies.get("oauth_session_id", None):
+            oauth_token = await request.app.state.oauth_manager.get_oauth_token(
+                user.id,
+                request.cookies.get("oauth_session_id", None),
+            )
+    except Exception as e:
+        log.error(f"Error getting OAuth token: {e}")
+
     extra_params = {
         "__event_emitter__": __event_emitter__,
         "__event_call__": __event_call__,
@@ -230,9 +260,10 @@ async def generate_function_chat_completion(
         "__files__": files,
         "__user__": user.model_dump() if isinstance(user, UserModel) else {},
         "__metadata__": metadata,
+        "__oauth_token__": oauth_token,
         "__request__": request,
     }
-    extra_params["__tools__"] = get_tools(
+    extra_params["__tools__"] = await get_tools(
         request,
         tool_ids,
         user,

backend/open_webui/internal/db.py

@@ -9,23 +9,23 @@ from open_webui.env import (
     OPEN_WEBUI_DIR,
     DATABASE_URL,
     DATABASE_SCHEMA,
-    SRC_LOG_LEVELS,
     DATABASE_POOL_MAX_OVERFLOW,
     DATABASE_POOL_RECYCLE,
     DATABASE_POOL_SIZE,
     DATABASE_POOL_TIMEOUT,
     DATABASE_ENABLE_SQLITE_WAL,
+    DATABASE_ENABLE_SESSION_SHARING,
+    ENABLE_DB_MIGRATIONS,
 )
 from peewee_migrate import Router
 from sqlalchemy import Dialect, create_engine, MetaData, event, types
 from sqlalchemy.ext.declarative import declarative_base
-from sqlalchemy.orm import scoped_session, sessionmaker
+from sqlalchemy.orm import scoped_session, sessionmaker, Session
 from sqlalchemy.pool import QueuePool, NullPool
 from sqlalchemy.sql.type_api import _T
 from typing_extensions import Self
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["DB"])
 
 
 class JSONField(types.TypeDecorator):
@@ -77,7 +77,8 @@ def handle_peewee_migration(DATABASE_URL):
         assert db.is_closed(), "Database connection is still open."
 
 
-handle_peewee_migration(DATABASE_URL)
+if ENABLE_DB_MIGRATIONS:
+    handle_peewee_migration(DATABASE_URL)
 
 
 SQLALCHEMY_DATABASE_URL = DATABASE_URL
@@ -92,8 +93,6 @@ if SQLALCHEMY_DATABASE_URL.startswith("sqlite+sqlcipher://"):
 
     # Extract database path from SQLCipher URL
     db_path = SQLALCHEMY_DATABASE_URL.replace("sqlite+sqlcipher://", "")
-    if db_path.startswith("/"):
-        db_path = db_path[1:]  # Remove leading slash for relative paths
 
     # Create a custom creator function that uses sqlcipher3
     def create_sqlcipher_connection():
@@ -150,7 +149,7 @@ SessionLocal = sessionmaker(
 )
 metadata_obj = MetaData(schema=DATABASE_SCHEMA)
 Base = declarative_base(metadata=metadata_obj)
-Session = scoped_session(SessionLocal)
+ScopedSession = scoped_session(SessionLocal)
 
 
 def get_session():
@@ -162,3 +161,12 @@ def get_session():
 
 
 get_db = contextmanager(get_session)
+
+
+@contextmanager
+def get_db_context(db: Optional[Session] = None):
+    if isinstance(db, Session) and DATABASE_ENABLE_SESSION_SHARING:
+        yield db
+    else:
+        with get_db() as session:
+            yield session

backend/open_webui/internal/migrations/001_initial_schema.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/002_add_local_sharing.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/003_add_auth_api_key.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/004_add_archived.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/005_add_updated_at.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/006_migrate_timestamps_and_charfields.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/007_add_user_last_active_at.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/008_add_memory.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/009_add_models.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/011_add_user_settings.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/012_add_tools.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/013_add_user_info.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/014_add_files.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/015_add_functions.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/016_add_valves_and_is_active.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/017_add_user_oauth_sub.py

@@ -25,7 +25,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/migrations/018_add_function_is_global.py

@@ -29,7 +29,6 @@ from contextlib import suppress
 import peewee as pw
 from peewee_migrate import Migrator
 
-
 with suppress(ImportError):
     import playhouse.postgres_ext as pw_pext
 

backend/open_webui/internal/wrappers.py

@@ -2,7 +2,6 @@ import logging
 import os
 from contextvars import ContextVar
 
-from open_webui.env import SRC_LOG_LEVELS
 from peewee import *
 from peewee import InterfaceError as PeeWeeInterfaceError
 from peewee import PostgresqlDatabase
@@ -10,7 +9,6 @@ from playhouse.db_url import connect, parse
 from playhouse.shortcuts import ReconnectMixin
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["DB"])
 
 db_state_default = {"closed": None, "conn": None, "ctx": None, "transactions": None}
 db_state = ContextVar("db_state", default=db_state_default.copy())
@@ -56,8 +54,6 @@ def register_connection(db_url):
         # Parse the database path from SQLCipher URL
         # Convert sqlite+sqlcipher:///path/to/db.sqlite to /path/to/db.sqlite
         db_path = db_url.replace("sqlite+sqlcipher://", "")
-        if db_path.startswith("/"):
-            db_path = db_path[1:]  # Remove leading slash for relative paths
 
         # Use Peewee's native SqlCipherDatabase with encryption
         db = SqlCipherDatabase(db_path, passphrase=database_password)

backend/open_webui/migrations/versions/2f1211949ecc_update_message_and_channel_member_table.py

@@ -0,0 +1,102 @@
+"""Update messages and channel member table
+
+Revision ID: 2f1211949ecc
+Revises: 37f288994c47
+Create Date: 2025-11-27 03:07:56.200231
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+# revision identifiers, used by Alembic.
+revision: str = "2f1211949ecc"
+down_revision: Union[str, None] = "37f288994c47"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # New columns to be added to channel_member table
+    op.add_column("channel_member", sa.Column("status", sa.Text(), nullable=True))
+    op.add_column(
+        "channel_member",
+        sa.Column(
+            "is_active",
+            sa.Boolean(),
+            nullable=False,
+            default=True,
+            server_default=sa.sql.expression.true(),
+        ),
+    )
+
+    op.add_column(
+        "channel_member",
+        sa.Column(
+            "is_channel_muted",
+            sa.Boolean(),
+            nullable=False,
+            default=False,
+            server_default=sa.sql.expression.false(),
+        ),
+    )
+    op.add_column(
+        "channel_member",
+        sa.Column(
+            "is_channel_pinned",
+            sa.Boolean(),
+            nullable=False,
+            default=False,
+            server_default=sa.sql.expression.false(),
+        ),
+    )
+
+    op.add_column("channel_member", sa.Column("data", sa.JSON(), nullable=True))
+    op.add_column("channel_member", sa.Column("meta", sa.JSON(), nullable=True))
+
+    op.add_column(
+        "channel_member", sa.Column("joined_at", sa.BigInteger(), nullable=False)
+    )
+    op.add_column(
+        "channel_member", sa.Column("left_at", sa.BigInteger(), nullable=True)
+    )
+
+    op.add_column(
+        "channel_member", sa.Column("last_read_at", sa.BigInteger(), nullable=True)
+    )
+
+    op.add_column(
+        "channel_member", sa.Column("updated_at", sa.BigInteger(), nullable=True)
+    )
+
+    # New columns to be added to message table
+    op.add_column(
+        "message",
+        sa.Column(
+            "is_pinned",
+            sa.Boolean(),
+            nullable=False,
+            default=False,
+            server_default=sa.sql.expression.false(),
+        ),
+    )
+    op.add_column("message", sa.Column("pinned_at", sa.BigInteger(), nullable=True))
+    op.add_column("message", sa.Column("pinned_by", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("channel_member", "updated_at")
+    op.drop_column("channel_member", "last_read_at")
+
+    op.drop_column("channel_member", "meta")
+    op.drop_column("channel_member", "data")
+
+    op.drop_column("channel_member", "is_channel_pinned")
+    op.drop_column("channel_member", "is_channel_muted")
+
+    op.drop_column("message", "pinned_by")
+    op.drop_column("message", "pinned_at")
+    op.drop_column("message", "is_pinned")

backend/open_webui/migrations/versions/374d2f66af06_add_prompt_history_table.py

@@ -0,0 +1,247 @@
+"""Add prompt history table
+
+Revision ID: 374d2f66af06
+Revises: c440947495f3
+Create Date: 2026-01-23 17:15:00.000000
+
+"""
+
+from typing import Sequence, Union
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "374d2f66af06"
+down_revision: Union[str, None] = "c440947495f3"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Step 1: Read existing data from OLD table (schema likely command as PK)
+    # We use batch_alter previously, but we want to move to new table.
+    # We need to assume the OLD structure.
+
+    old_prompt_table = sa.table(
+        "prompt",
+        sa.column("command", sa.Text()),
+        sa.column("user_id", sa.Text()),
+        sa.column("title", sa.Text()),
+        sa.column("content", sa.Text()),
+        sa.column("timestamp", sa.BigInteger()),
+        sa.column("access_control", sa.JSON()),
+    )
+
+    # Check if table exists/read data
+    try:
+        existing_prompts = conn.execute(
+            sa.select(
+                old_prompt_table.c.command,
+                old_prompt_table.c.user_id,
+                old_prompt_table.c.title,
+                old_prompt_table.c.content,
+                old_prompt_table.c.timestamp,
+                old_prompt_table.c.access_control,
+            )
+        ).fetchall()
+    except Exception:
+        # Fallback if table doesn't exist (new install)
+        existing_prompts = []
+
+    # Step 2: Create new prompt table with 'id' as PRIMARY KEY
+    op.create_table(
+        "prompt_new",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("command", sa.String(), unique=True, index=True),
+        sa.Column("user_id", sa.String(), nullable=False),
+        sa.Column("name", sa.Text(), nullable=False),
+        sa.Column("content", sa.Text(), nullable=False),
+        sa.Column("data", sa.JSON(), nullable=True),
+        sa.Column("meta", sa.JSON(), nullable=True),
+        sa.Column("access_control", sa.JSON(), nullable=True),
+        sa.Column("is_active", sa.Boolean(), nullable=False, server_default="1"),
+        sa.Column("version_id", sa.Text(), nullable=True),
+        sa.Column("tags", sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+    )
+
+    # Step 3: Create prompt_history table
+    op.create_table(
+        "prompt_history",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("prompt_id", sa.Text(), nullable=False, index=True),
+        sa.Column("parent_id", sa.Text(), nullable=True),
+        sa.Column("snapshot", sa.JSON(), nullable=False),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column("commit_message", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+    )
+
+    # Step 4: Migrate data
+    prompt_new_table = sa.table(
+        "prompt_new",
+        sa.column("id", sa.Text()),
+        sa.column("command", sa.String()),
+        sa.column("user_id", sa.String()),
+        sa.column("name", sa.Text()),
+        sa.column("content", sa.Text()),
+        sa.column("data", sa.JSON()),
+        sa.column("meta", sa.JSON()),
+        sa.column("access_control", sa.JSON()),
+        sa.column("is_active", sa.Boolean()),
+        sa.column("version_id", sa.Text()),
+        sa.column("tags", sa.JSON()),
+        sa.column("created_at", sa.BigInteger()),
+        sa.column("updated_at", sa.BigInteger()),
+    )
+
+    prompt_history_table = sa.table(
+        "prompt_history",
+        sa.column("id", sa.Text()),
+        sa.column("prompt_id", sa.Text()),
+        sa.column("parent_id", sa.Text()),
+        sa.column("snapshot", sa.JSON()),
+        sa.column("user_id", sa.Text()),
+        sa.column("commit_message", sa.Text()),
+        sa.column("created_at", sa.BigInteger()),
+    )
+
+    for row in existing_prompts:
+        command = row[0]
+        user_id = row[1]
+        title = row[2]
+        content = row[3]
+        timestamp = row[4]
+        access_control = row[5]
+
+        new_uuid = str(uuid.uuid4())
+        history_uuid = str(uuid.uuid4())
+        clean_command = command[1:] if command and command.startswith("/") else command
+
+        # Insert into prompt_new
+        conn.execute(
+            sa.insert(prompt_new_table).values(
+                id=new_uuid,
+                command=clean_command,
+                user_id=user_id,
+                name=title,
+                content=content,
+                data={},
+                meta={},
+                access_control=access_control,
+                is_active=True,
+                version_id=history_uuid,
+                tags=[],
+                created_at=timestamp,
+                updated_at=timestamp,
+            )
+        )
+
+        # Create initial history entry
+        conn.execute(
+            sa.insert(prompt_history_table).values(
+                id=history_uuid,
+                prompt_id=new_uuid,
+                parent_id=None,
+                snapshot={
+                    "name": title,
+                    "content": content,
+                    "command": clean_command,
+                    "data": {},
+                    "meta": {},
+                    "access_control": access_control,
+                },
+                user_id=user_id,
+                commit_message=None,
+                created_at=timestamp,
+            )
+        )
+
+    # Step 5: Replace old table with new one
+    op.drop_table("prompt")
+    op.rename_table("prompt_new", "prompt")
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+
+    # Step 1: Read new data
+    prompt_table = sa.table(
+        "prompt",
+        sa.column("command", sa.String()),
+        sa.column("name", sa.Text()),
+        sa.column("created_at", sa.BigInteger()),
+        sa.column("user_id", sa.Text()),
+        sa.column("content", sa.Text()),
+        sa.column("access_control", sa.JSON()),
+    )
+
+    try:
+        current_data = conn.execute(
+            sa.select(
+                prompt_table.c.command,
+                prompt_table.c.name,
+                prompt_table.c.created_at,
+                prompt_table.c.user_id,
+                prompt_table.c.content,
+                prompt_table.c.access_control,
+            )
+        ).fetchall()
+    except Exception:
+        current_data = []
+
+    # Step 2: Drop history and table
+    op.drop_table("prompt_history")
+    op.drop_table("prompt")
+
+    # Step 3: Recreate old table (command as PK?)
+    # Assuming old schema:
+    op.create_table(
+        "prompt",
+        sa.Column("command", sa.String(), primary_key=True),
+        sa.Column("user_id", sa.String()),
+        sa.Column("title", sa.Text()),
+        sa.Column("content", sa.Text()),
+        sa.Column("timestamp", sa.BigInteger()),
+        sa.Column("access_control", sa.JSON()),
+        sa.Column("id", sa.Integer(), nullable=True),
+    )
+
+    # Step 4: Restore data
+    old_prompt_table = sa.table(
+        "prompt",
+        sa.column("command", sa.String()),
+        sa.column("user_id", sa.String()),
+        sa.column("title", sa.Text()),
+        sa.column("content", sa.Text()),
+        sa.column("timestamp", sa.BigInteger()),
+        sa.column("access_control", sa.JSON()),
+    )
+
+    for row in current_data:
+        command = row[0]
+        name = row[1]
+        created_at = row[2]
+        user_id = row[3]
+        content = row[4]
+        access_control = row[5]
+
+        # Restore leading /
+        old_command = (
+            "/" + command if command and not command.startswith("/") else command
+        )
+
+        conn.execute(
+            sa.insert(old_prompt_table).values(
+                command=old_command,
+                user_id=user_id,
+                title=name,
+                content=content,
+                timestamp=created_at,
+                access_control=access_control,
+            )
+        )

backend/open_webui/migrations/versions/37f288994c47_add_group_member_table.py

@@ -0,0 +1,145 @@
+"""add_group_member_table
+
+Revision ID: 37f288994c47
+Revises: a5c220713937
+Create Date: 2025-11-17 03:45:25.123939
+
+"""
+
+import uuid
+import time
+import json
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "37f288994c47"
+down_revision: Union[str, None] = "a5c220713937"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 1. Create new table
+    op.create_table(
+        "group_member",
+        sa.Column("id", sa.Text(), primary_key=True, unique=True, nullable=False),
+        sa.Column(
+            "group_id",
+            sa.Text(),
+            sa.ForeignKey("group.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Text(),
+            sa.ForeignKey("user.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.BigInteger(), nullable=True),
+        sa.Column("updated_at", sa.BigInteger(), nullable=True),
+        sa.UniqueConstraint("group_id", "user_id", name="uq_group_member_group_user"),
+    )
+
+    connection = op.get_bind()
+
+    # 2. Read existing group with user_ids JSON column
+    group_table = sa.Table(
+        "group",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("user_ids", sa.JSON()),  # JSON stored as text in SQLite + PG
+    )
+
+    results = connection.execute(
+        sa.select(group_table.c.id, group_table.c.user_ids)
+    ).fetchall()
+
+    print(results)
+
+    # 3. Insert members into group_member table
+    gm_table = sa.Table(
+        "group_member",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("group_id", sa.Text()),
+        sa.Column("user_id", sa.Text()),
+        sa.Column("created_at", sa.BigInteger()),
+        sa.Column("updated_at", sa.BigInteger()),
+    )
+
+    now = int(time.time())
+    for group_id, user_ids in results:
+        if not user_ids:
+            continue
+
+        if isinstance(user_ids, str):
+            try:
+                user_ids = json.loads(user_ids)
+            except Exception:
+                continue  # skip invalid JSON
+
+        if not isinstance(user_ids, list):
+            continue
+
+        rows = [
+            {
+                "id": str(uuid.uuid4()),
+                "group_id": group_id,
+                "user_id": uid,
+                "created_at": now,
+                "updated_at": now,
+            }
+            for uid in user_ids
+        ]
+
+        if rows:
+            connection.execute(gm_table.insert(), rows)
+
+    # 4. Optionally drop the old column
+    with op.batch_alter_table("group") as batch:
+        batch.drop_column("user_ids")
+
+
+def downgrade():
+    # Reverse: restore user_ids column
+    with op.batch_alter_table("group") as batch:
+        batch.add_column(sa.Column("user_ids", sa.JSON()))
+
+    connection = op.get_bind()
+    gm_table = sa.Table(
+        "group_member",
+        sa.MetaData(),
+        sa.Column("group_id", sa.Text()),
+        sa.Column("user_id", sa.Text()),
+        sa.Column("created_at", sa.BigInteger()),
+        sa.Column("updated_at", sa.BigInteger()),
+    )
+
+    group_table = sa.Table(
+        "group",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("user_ids", sa.JSON()),
+    )
+
+    # Build JSON arrays again
+    results = connection.execute(sa.select(group_table.c.id)).fetchall()
+
+    for (group_id,) in results:
+        members = connection.execute(
+            sa.select(gm_table.c.user_id).where(gm_table.c.group_id == group_id)
+        ).fetchall()
+
+        member_ids = [m[0] for m in members]
+
+        connection.execute(
+            group_table.update()
+            .where(group_table.c.id == group_id)
+            .values(user_ids=member_ids)
+        )
+
+    # Drop the new table
+    op.drop_table("group_member")

backend/open_webui/migrations/versions/38d63c18f30f_add_oauth_session_table.py

@@ -0,0 +1,79 @@
+"""Add oauth_session table
+
+Revision ID: 38d63c18f30f
+Revises: 3af16a1c9fb6
+Create Date: 2025-09-08 14:19:59.583921
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "38d63c18f30f"
+down_revision: Union[str, None] = "3af16a1c9fb6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Ensure 'id' column in 'user' table is unique and primary key (ForeignKey constraint)
+    inspector = sa.inspect(op.get_bind())
+    columns = inspector.get_columns("user")
+
+    pk_columns = inspector.get_pk_constraint("user")["constrained_columns"]
+    id_column = next((col for col in columns if col["name"] == "id"), None)
+
+    if id_column and not id_column.get("unique", False):
+        unique_constraints = inspector.get_unique_constraints("user")
+        unique_columns = {tuple(u["column_names"]) for u in unique_constraints}
+
+        with op.batch_alter_table("user") as batch_op:
+            # If primary key is wrong, drop it
+            if pk_columns and pk_columns != ["id"]:
+                batch_op.drop_constraint(
+                    inspector.get_pk_constraint("user")["name"], type_="primary"
+                )
+
+            # Add unique constraint if missing
+            if ("id",) not in unique_columns:
+                batch_op.create_unique_constraint("uq_user_id", ["id"])
+
+            # Re-create correct primary key
+            batch_op.create_primary_key("pk_user_id", ["id"])
+
+    # Create oauth_session table
+    op.create_table(
+        "oauth_session",
+        sa.Column("id", sa.Text(), primary_key=True, nullable=False, unique=True),
+        sa.Column(
+            "user_id",
+            sa.Text(),
+            sa.ForeignKey("user.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("provider", sa.Text(), nullable=False),
+        sa.Column("token", sa.Text(), nullable=False),
+        sa.Column("expires_at", sa.BigInteger(), nullable=False),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+    )
+
+    # Create indexes for better performance
+    op.create_index("idx_oauth_session_user_id", "oauth_session", ["user_id"])
+    op.create_index("idx_oauth_session_expires_at", "oauth_session", ["expires_at"])
+    op.create_index(
+        "idx_oauth_session_user_provider", "oauth_session", ["user_id", "provider"]
+    )
+
+
+def downgrade() -> None:
+    # Drop indexes first
+    op.drop_index("idx_oauth_session_user_provider", table_name="oauth_session")
+    op.drop_index("idx_oauth_session_expires_at", table_name="oauth_session")
+    op.drop_index("idx_oauth_session_user_id", table_name="oauth_session")
+
+    # Drop the table
+    op.drop_table("oauth_session")

backend/open_webui/migrations/versions/3e0e00844bb0_add_knowledge_file_table.py

@@ -0,0 +1,169 @@
+"""Add knowledge_file table
+
+Revision ID: 3e0e00844bb0
+Revises: 90ef40d4714e
+Create Date: 2025-12-02 06:54:19.401334
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy import inspect
+import open_webui.internal.db
+
+import time
+import json
+import uuid
+
+# revision identifiers, used by Alembic.
+revision: str = "3e0e00844bb0"
+down_revision: Union[str, None] = "90ef40d4714e"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "knowledge_file",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column(
+            "knowledge_id",
+            sa.Text(),
+            sa.ForeignKey("knowledge.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "file_id",
+            sa.Text(),
+            sa.ForeignKey("file.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+        # indexes
+        sa.Index("ix_knowledge_file_knowledge_id", "knowledge_id"),
+        sa.Index("ix_knowledge_file_file_id", "file_id"),
+        sa.Index("ix_knowledge_file_user_id", "user_id"),
+        # unique constraints
+        sa.UniqueConstraint(
+            "knowledge_id", "file_id", name="uq_knowledge_file_knowledge_file"
+        ),  # prevent duplicate entries
+    )
+
+    connection = op.get_bind()
+
+    # 2. Read existing group with user_ids JSON column
+    knowledge_table = sa.Table(
+        "knowledge",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("user_id", sa.Text()),
+        sa.Column("data", sa.JSON()),  # JSON stored as text in SQLite + PG
+    )
+
+    results = connection.execute(
+        sa.select(
+            knowledge_table.c.id, knowledge_table.c.user_id, knowledge_table.c.data
+        )
+    ).fetchall()
+
+    # 3. Insert members into group_member table
+    kf_table = sa.Table(
+        "knowledge_file",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("user_id", sa.Text()),
+        sa.Column("knowledge_id", sa.Text()),
+        sa.Column("file_id", sa.Text()),
+        sa.Column("created_at", sa.BigInteger()),
+        sa.Column("updated_at", sa.BigInteger()),
+    )
+
+    file_table = sa.Table(
+        "file",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+    )
+
+    now = int(time.time())
+    for knowledge_id, user_id, data in results:
+        if not data:
+            continue
+
+        if isinstance(data, str):
+            try:
+                data = json.loads(data)
+            except Exception:
+                continue  # skip invalid JSON
+
+        if not isinstance(data, dict):
+            continue
+
+        file_ids = data.get("file_ids", [])
+
+        for file_id in file_ids:
+            file_exists = connection.execute(
+                sa.select(file_table.c.id).where(file_table.c.id == file_id)
+            ).fetchone()
+
+            if not file_exists:
+                continue  # skip non-existing files
+
+            row = {
+                "id": str(uuid.uuid4()),
+                "user_id": user_id,
+                "knowledge_id": knowledge_id,
+                "file_id": file_id,
+                "created_at": now,
+                "updated_at": now,
+            }
+            connection.execute(kf_table.insert().values(**row))
+
+    with op.batch_alter_table("knowledge") as batch:
+        batch.drop_column("data")
+
+
+def downgrade() -> None:
+    # 1. Add back the old data column
+    op.add_column("knowledge", sa.Column("data", sa.JSON(), nullable=True))
+
+    connection = op.get_bind()
+
+    # 2. Read knowledge_file entries and reconstruct data JSON
+    knowledge_table = sa.Table(
+        "knowledge",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("data", sa.JSON()),
+    )
+
+    kf_table = sa.Table(
+        "knowledge_file",
+        sa.MetaData(),
+        sa.Column("id", sa.Text()),
+        sa.Column("knowledge_id", sa.Text()),
+        sa.Column("file_id", sa.Text()),
+    )
+
+    results = connection.execute(sa.select(knowledge_table.c.id)).fetchall()
+
+    for (knowledge_id,) in results:
+        file_ids = connection.execute(
+            sa.select(kf_table.c.file_id).where(kf_table.c.knowledge_id == knowledge_id)
+        ).fetchall()
+
+        file_ids_list = [fid for (fid,) in file_ids]
+
+        data_json = {"file_ids": file_ids_list}
+
+        connection.execute(
+            knowledge_table.update()
+            .where(knowledge_table.c.id == knowledge_id)
+            .values(data=data_json)
+        )
+
+    # 3. Drop the knowledge_file table
+    op.drop_table("knowledge_file")

backend/open_webui/migrations/versions/6283dc0e4d8d_add_channel_file_table.py

@@ -0,0 +1,53 @@
+"""Add channel file table
+
+Revision ID: 6283dc0e4d8d
+Revises: 3e0e00844bb0
+Create Date: 2025-12-10 15:11:39.424601
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+# revision identifiers, used by Alembic.
+revision: str = "6283dc0e4d8d"
+down_revision: Union[str, None] = "3e0e00844bb0"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "channel_file",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column(
+            "channel_id",
+            sa.Text(),
+            sa.ForeignKey("channel.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "file_id",
+            sa.Text(),
+            sa.ForeignKey("file.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+        # indexes
+        sa.Index("ix_channel_file_channel_id", "channel_id"),
+        sa.Index("ix_channel_file_file_id", "file_id"),
+        sa.Index("ix_channel_file_user_id", "user_id"),
+        # unique constraints
+        sa.UniqueConstraint(
+            "channel_id", "file_id", name="uq_channel_file_channel_file"
+        ),  # prevent duplicate entries
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("channel_file")

backend/open_webui/migrations/versions/6a39f3d8e55c_add_knowledge_table.py

@@ -11,7 +11,6 @@ import sqlalchemy as sa
 from sqlalchemy.sql import table, column, select
 import json
 
-
 revision = "6a39f3d8e55c"
 down_revision = "c0fbf31ca0db"
 branch_labels = None

backend/open_webui/migrations/versions/81cc2ce44d79_update_channel_file_and_knowledge_table.py

@@ -0,0 +1,48 @@
+"""Update channel file and knowledge table
+
+Revision ID: 81cc2ce44d79
+Revises: 6283dc0e4d8d
+Create Date: 2025-12-10 16:07:58.001282
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+# revision identifiers, used by Alembic.
+revision: str = "81cc2ce44d79"
+down_revision: Union[str, None] = "6283dc0e4d8d"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Add message_id column to channel_file table
+    with op.batch_alter_table("channel_file", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "message_id",
+                sa.Text(),
+                sa.ForeignKey(
+                    "message.id", ondelete="CASCADE", name="fk_channel_file_message_id"
+                ),
+                nullable=True,
+            )
+        )
+
+    # Add data column to knowledge table
+    with op.batch_alter_table("knowledge", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("data", sa.JSON(), nullable=True))
+
+
+def downgrade() -> None:
+    # Remove message_id column from channel_file table
+    with op.batch_alter_table("channel_file", schema=None) as batch_op:
+        batch_op.drop_column("message_id")
+
+    # Remove data column from knowledge table
+    with op.batch_alter_table("knowledge", schema=None) as batch_op:
+        batch_op.drop_column("data")

backend/open_webui/migrations/versions/8452d01d26d7_add_chat_message_table.py

@@ -0,0 +1,177 @@
+"""Add chat_message table
+
+Revision ID: 8452d01d26d7
+Revises: 374d2f66af06
+Create Date: 2026-02-01 04:00:00.000000
+
+"""
+
+import time
+import json
+import logging
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+log = logging.getLogger(__name__)
+
+revision: str = "8452d01d26d7"
+down_revision: Union[str, None] = "374d2f66af06"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Step 1: Create table
+    op.create_table(
+        "chat_message",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("chat_id", sa.Text(), nullable=False, index=True),
+        sa.Column("user_id", sa.Text(), index=True),
+        sa.Column("role", sa.Text(), nullable=False),
+        sa.Column("parent_id", sa.Text(), nullable=True),
+        sa.Column("content", sa.JSON(), nullable=True),
+        sa.Column("output", sa.JSON(), nullable=True),
+        sa.Column("model_id", sa.Text(), nullable=True, index=True),
+        sa.Column("files", sa.JSON(), nullable=True),
+        sa.Column("sources", sa.JSON(), nullable=True),
+        sa.Column("embeds", sa.JSON(), nullable=True),
+        sa.Column("done", sa.Boolean(), default=True),
+        sa.Column("status_history", sa.JSON(), nullable=True),
+        sa.Column("error", sa.JSON(), nullable=True),
+        sa.Column("usage", sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), index=True),
+        sa.Column("updated_at", sa.BigInteger()),
+        sa.ForeignKeyConstraint(["chat_id"], ["chat.id"], ondelete="CASCADE"),
+    )
+
+    # Create composite indexes
+    op.create_index(
+        "chat_message_chat_parent_idx", "chat_message", ["chat_id", "parent_id"]
+    )
+    op.create_index(
+        "chat_message_model_created_idx", "chat_message", ["model_id", "created_at"]
+    )
+    op.create_index(
+        "chat_message_user_created_idx", "chat_message", ["user_id", "created_at"]
+    )
+
+    # Step 2: Backfill from existing chats
+    conn = op.get_bind()
+
+    chat_table = sa.table(
+        "chat",
+        sa.column("id", sa.Text()),
+        sa.column("user_id", sa.Text()),
+        sa.column("chat", sa.JSON()),
+    )
+
+    chat_message_table = sa.table(
+        "chat_message",
+        sa.column("id", sa.Text()),
+        sa.column("chat_id", sa.Text()),
+        sa.column("user_id", sa.Text()),
+        sa.column("role", sa.Text()),
+        sa.column("parent_id", sa.Text()),
+        sa.column("content", sa.JSON()),
+        sa.column("output", sa.JSON()),
+        sa.column("model_id", sa.Text()),
+        sa.column("files", sa.JSON()),
+        sa.column("sources", sa.JSON()),
+        sa.column("embeds", sa.JSON()),
+        sa.column("done", sa.Boolean()),
+        sa.column("status_history", sa.JSON()),
+        sa.column("error", sa.JSON()),
+        sa.column("usage", sa.JSON()),
+        sa.column("created_at", sa.BigInteger()),
+        sa.column("updated_at", sa.BigInteger()),
+    )
+
+    # Fetch all chats (excluding shared chats which have user_id starting with 'shared-')
+    chats = conn.execute(
+        sa.select(chat_table.c.id, chat_table.c.user_id, chat_table.c.chat).where(
+            ~chat_table.c.user_id.like("shared-%")
+        )
+    ).fetchall()
+
+    now = int(time.time())
+    messages_inserted = 0
+    messages_failed = 0
+
+    for chat_row in chats:
+        chat_id = chat_row[0]
+        user_id = chat_row[1]
+        chat_data = chat_row[2]
+
+        if not chat_data:
+            continue
+
+        # Handle both string and dict chat data
+        if isinstance(chat_data, str):
+            try:
+                chat_data = json.loads(chat_data)
+            except Exception:
+                continue
+
+        history = chat_data.get("history", {})
+        messages = history.get("messages", {})
+
+        for message_id, message in messages.items():
+            if not isinstance(message, dict):
+                continue
+
+            role = message.get("role")
+            if not role:
+                continue
+
+            timestamp = message.get("timestamp", now)
+
+            # Normalize timestamp: convert ms to seconds, validate range
+            if timestamp > 10_000_000_000:
+                timestamp = timestamp // 1000
+            # Must be after 2020 and not too far in the future
+            if timestamp < 1577836800 or timestamp > now + 86400:
+                timestamp = now
+
+            # Use savepoint to allow individual insert failures without aborting transaction
+            savepoint = conn.begin_nested()
+            try:
+                conn.execute(
+                    sa.insert(chat_message_table).values(
+                        id=f"{chat_id}-{message_id}",
+                        chat_id=chat_id,
+                        user_id=user_id,
+                        role=role,
+                        parent_id=message.get("parentId"),
+                        content=message.get("content"),
+                        output=message.get("output"),
+                        model_id=message.get("model"),
+                        files=message.get("files"),
+                        sources=message.get("sources"),
+                        embeds=message.get("embeds"),
+                        done=message.get("done", True),
+                        status_history=message.get("statusHistory"),
+                        error=message.get("error"),
+                        created_at=timestamp,
+                        updated_at=timestamp,
+                    )
+                )
+                savepoint.commit()
+                messages_inserted += 1
+            except Exception as e:
+                savepoint.rollback()
+                messages_failed += 1
+                log.warning(f"Failed to insert message {message_id}: {e}")
+                continue
+
+    log.info(
+        f"Backfilled {messages_inserted} messages into chat_message table ({messages_failed} failed)"
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("chat_message_user_created_idx", table_name="chat_message")
+    op.drop_index("chat_message_model_created_idx", table_name="chat_message")
+    op.drop_index("chat_message_chat_parent_idx", table_name="chat_message")
+    op.drop_table("chat_message")

backend/open_webui/migrations/versions/90ef40d4714e_update_channel_and_channel_members_table.py

@@ -0,0 +1,80 @@
+"""Update channel and channel members table
+
+Revision ID: 90ef40d4714e
+Revises: b10670c03dd5
+Create Date: 2025-11-30 06:33:38.790341
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+# revision identifiers, used by Alembic.
+revision: str = "90ef40d4714e"
+down_revision: Union[str, None] = "b10670c03dd5"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Update 'channel' table
+    op.add_column("channel", sa.Column("is_private", sa.Boolean(), nullable=True))
+
+    op.add_column("channel", sa.Column("archived_at", sa.BigInteger(), nullable=True))
+    op.add_column("channel", sa.Column("archived_by", sa.Text(), nullable=True))
+
+    op.add_column("channel", sa.Column("deleted_at", sa.BigInteger(), nullable=True))
+    op.add_column("channel", sa.Column("deleted_by", sa.Text(), nullable=True))
+
+    op.add_column("channel", sa.Column("updated_by", sa.Text(), nullable=True))
+
+    # Update 'channel_member' table
+    op.add_column("channel_member", sa.Column("role", sa.Text(), nullable=True))
+    op.add_column("channel_member", sa.Column("invited_by", sa.Text(), nullable=True))
+    op.add_column(
+        "channel_member", sa.Column("invited_at", sa.BigInteger(), nullable=True)
+    )
+
+    #  Create 'channel_webhook' table
+    op.create_table(
+        "channel_webhook",
+        sa.Column("id", sa.Text(), primary_key=True, unique=True, nullable=False),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column(
+            "channel_id",
+            sa.Text(),
+            sa.ForeignKey("channel.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("name", sa.Text(), nullable=False),
+        sa.Column("profile_image_url", sa.Text(), nullable=True),
+        sa.Column("token", sa.Text(), nullable=False),
+        sa.Column("last_used_at", sa.BigInteger(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+    )
+
+    pass
+
+
+def downgrade() -> None:
+    # Downgrade 'channel' table
+    op.drop_column("channel", "is_private")
+    op.drop_column("channel", "archived_at")
+    op.drop_column("channel", "archived_by")
+    op.drop_column("channel", "deleted_at")
+    op.drop_column("channel", "deleted_by")
+    op.drop_column("channel", "updated_by")
+
+    # Downgrade 'channel_member' table
+    op.drop_column("channel_member", "role")
+    op.drop_column("channel_member", "invited_by")
+    op.drop_column("channel_member", "invited_at")
+
+    # Drop 'channel_webhook' table
+    op.drop_table("channel_webhook")
+
+    pass

backend/open_webui/migrations/versions/a1b2c3d4e5f6_add_skill_table.py

@@ -0,0 +1,45 @@
+"""Add skill table
+
+Revision ID: a1b2c3d4e5f6
+Revises: f1e2d3c4b5a6
+Create Date: 2026-02-11 09:30:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+from open_webui.migrations.util import get_existing_tables
+
+revision: str = "a1b2c3d4e5f6"
+down_revision: Union[str, None] = "f1e2d3c4b5a6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    existing_tables = set(get_existing_tables())
+
+    if "skill" not in existing_tables:
+        op.create_table(
+            "skill",
+            sa.Column("id", sa.String(), nullable=False, primary_key=True),
+            sa.Column("user_id", sa.String(), nullable=False),
+            sa.Column("name", sa.Text(), nullable=False, unique=True),
+            sa.Column("description", sa.Text(), nullable=True),
+            sa.Column("content", sa.Text(), nullable=False),
+            sa.Column("meta", sa.JSON(), nullable=True),
+            sa.Column("is_active", sa.Boolean(), nullable=False),
+            sa.Column("updated_at", sa.BigInteger(), nullable=False),
+            sa.Column("created_at", sa.BigInteger(), nullable=False),
+        )
+        op.create_index("idx_skill_user_id", "skill", ["user_id"])
+        op.create_index("idx_skill_updated_at", "skill", ["updated_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("idx_skill_updated_at", table_name="skill")
+    op.drop_index("idx_skill_user_id", table_name="skill")
+    op.drop_table("skill")

backend/open_webui/migrations/versions/a5c220713937_add_reply_to_id_column_to_message.py

@@ -0,0 +1,34 @@
+"""Add reply_to_id column to message
+
+Revision ID: a5c220713937
+Revises: 38d63c18f30f
+Create Date: 2025-09-27 02:24:18.058455
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "a5c220713937"
+down_revision: Union[str, None] = "38d63c18f30f"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Add 'reply_to_id' column to the 'message' table for replying to messages
+    op.add_column(
+        "message",
+        sa.Column("reply_to_id", sa.Text(), nullable=True),
+    )
+    pass
+
+
+def downgrade() -> None:
+    # Remove 'reply_to_id' column from the 'message' table
+    op.drop_column("message", "reply_to_id")
+
+    pass

backend/open_webui/migrations/versions/b10670c03dd5_update_user_table.py

@@ -0,0 +1,249 @@
+"""Update user table
+
+Revision ID: b10670c03dd5
+Revises: 2f1211949ecc
+Create Date: 2025-11-28 04:55:31.737538
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+import open_webui.internal.db
+import json
+import time
+
+# revision identifiers, used by Alembic.
+revision: str = "b10670c03dd5"
+down_revision: Union[str, None] = "2f1211949ecc"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _drop_sqlite_indexes_for_column(table_name, column_name, conn):
+    """
+    SQLite requires manual removal of any indexes referencing a column
+    before ALTER TABLE ... DROP COLUMN can succeed.
+    """
+    indexes = conn.execute(sa.text(f"PRAGMA index_list('{table_name}')")).fetchall()
+
+    for idx in indexes:
+        index_name = idx[1]  # index name
+        # Get indexed columns
+        idx_info = conn.execute(
+            sa.text(f"PRAGMA index_info('{index_name}')")
+        ).fetchall()
+
+        indexed_cols = [row[2] for row in idx_info]  # col names
+        if column_name in indexed_cols:
+            conn.execute(sa.text(f"DROP INDEX IF EXISTS {index_name}"))
+
+
+def _convert_column_to_json(table: str, column: str):
+    conn = op.get_bind()
+    dialect = conn.dialect.name
+
+    # SQLite cannot ALTER COLUMN → must recreate column
+    if dialect == "sqlite":
+        # 1. Add temporary column
+        op.add_column(table, sa.Column(f"{column}_json", sa.JSON(), nullable=True))
+
+        # 2. Load old data
+        rows = conn.execute(sa.text(f'SELECT id, {column} FROM "{table}"')).fetchall()
+
+        for row in rows:
+            uid, raw = row
+            if raw is None:
+                parsed = None
+            else:
+                try:
+                    parsed = json.loads(raw)
+                except Exception:
+                    parsed = None  # fallback safe behavior
+
+            conn.execute(
+                sa.text(f'UPDATE "{table}" SET {column}_json = :val WHERE id = :id'),
+                {"val": json.dumps(parsed) if parsed else None, "id": uid},
+            )
+
+        # 3. Drop old TEXT column
+        op.drop_column(table, column)
+
+        # 4. Rename new JSON column → original name
+        op.alter_column(table, f"{column}_json", new_column_name=column)
+
+    else:
+        # PostgreSQL supports direct CAST
+        op.alter_column(
+            table,
+            column,
+            type_=sa.JSON(),
+            postgresql_using=f"{column}::json",
+        )
+
+
+def _convert_column_to_text(table: str, column: str):
+    conn = op.get_bind()
+    dialect = conn.dialect.name
+
+    if dialect == "sqlite":
+        op.add_column(table, sa.Column(f"{column}_text", sa.Text(), nullable=True))
+
+        rows = conn.execute(sa.text(f'SELECT id, {column} FROM "{table}"')).fetchall()
+
+        for uid, raw in rows:
+            conn.execute(
+                sa.text(f'UPDATE "{table}" SET {column}_text = :val WHERE id = :id'),
+                {"val": json.dumps(raw) if raw else None, "id": uid},
+            )
+
+        op.drop_column(table, column)
+        op.alter_column(table, f"{column}_text", new_column_name=column)
+
+    else:
+        op.alter_column(
+            table,
+            column,
+            type_=sa.Text(),
+            postgresql_using=f"to_json({column})::text",
+        )
+
+
+def upgrade() -> None:
+    op.add_column(
+        "user", sa.Column("profile_banner_image_url", sa.Text(), nullable=True)
+    )
+    op.add_column("user", sa.Column("timezone", sa.String(), nullable=True))
+
+    op.add_column("user", sa.Column("presence_state", sa.String(), nullable=True))
+    op.add_column("user", sa.Column("status_emoji", sa.String(), nullable=True))
+    op.add_column("user", sa.Column("status_message", sa.Text(), nullable=True))
+    op.add_column(
+        "user", sa.Column("status_expires_at", sa.BigInteger(), nullable=True)
+    )
+
+    op.add_column("user", sa.Column("oauth", sa.JSON(), nullable=True))
+
+    # Convert info (TEXT/JSONField) → JSON
+    _convert_column_to_json("user", "info")
+    # Convert settings (TEXT/JSONField) → JSON
+    _convert_column_to_json("user", "settings")
+
+    op.create_table(
+        "api_key",
+        sa.Column("id", sa.Text(), primary_key=True, unique=True),
+        sa.Column("user_id", sa.Text(), sa.ForeignKey("user.id", ondelete="CASCADE")),
+        sa.Column("key", sa.Text(), unique=True, nullable=False),
+        sa.Column("data", sa.JSON(), nullable=True),
+        sa.Column("expires_at", sa.BigInteger(), nullable=True),
+        sa.Column("last_used_at", sa.BigInteger(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+    )
+
+    conn = op.get_bind()
+    users = conn.execute(
+        sa.text('SELECT id, oauth_sub FROM "user" WHERE oauth_sub IS NOT NULL')
+    ).fetchall()
+
+    for uid, oauth_sub in users:
+        if oauth_sub:
+            # Example formats supported:
+            #   provider@sub
+            #   plain sub (stored as {"oidc": {"sub": sub}})
+            if "@" in oauth_sub:
+                provider, sub = oauth_sub.split("@", 1)
+            else:
+                provider, sub = "oidc", oauth_sub
+
+            oauth_json = json.dumps({provider: {"sub": sub}})
+            conn.execute(
+                sa.text('UPDATE "user" SET oauth = :oauth WHERE id = :id'),
+                {"oauth": oauth_json, "id": uid},
+            )
+
+    users_with_keys = conn.execute(
+        sa.text('SELECT id, api_key FROM "user" WHERE api_key IS NOT NULL')
+    ).fetchall()
+    now = int(time.time())
+
+    for uid, api_key in users_with_keys:
+        if api_key:
+            conn.execute(
+                sa.text("""
+                    INSERT INTO api_key (id, user_id, key, created_at, updated_at)
+                    VALUES (:id, :user_id, :key, :created_at, :updated_at)
+                """),
+                {
+                    "id": f"key_{uid}",
+                    "user_id": uid,
+                    "key": api_key,
+                    "created_at": now,
+                    "updated_at": now,
+                },
+            )
+
+    if conn.dialect.name == "sqlite":
+        _drop_sqlite_indexes_for_column("user", "api_key", conn)
+        _drop_sqlite_indexes_for_column("user", "oauth_sub", conn)
+
+    with op.batch_alter_table("user") as batch_op:
+        batch_op.drop_column("api_key")
+        batch_op.drop_column("oauth_sub")
+
+
+def downgrade() -> None:
+    # --- 1. Restore old oauth_sub column ---
+    op.add_column("user", sa.Column("oauth_sub", sa.Text(), nullable=True))
+
+    conn = op.get_bind()
+    users = conn.execute(
+        sa.text('SELECT id, oauth FROM "user" WHERE oauth IS NOT NULL')
+    ).fetchall()
+
+    for uid, oauth in users:
+        try:
+            data = json.loads(oauth)
+            provider = list(data.keys())[0]
+            sub = data[provider].get("sub")
+            oauth_sub = f"{provider}@{sub}"
+        except Exception:
+            oauth_sub = None
+
+        conn.execute(
+            sa.text('UPDATE "user" SET oauth_sub = :oauth_sub WHERE id = :id'),
+            {"oauth_sub": oauth_sub, "id": uid},
+        )
+
+    op.drop_column("user", "oauth")
+
+    # --- 2. Restore api_key field ---
+    op.add_column("user", sa.Column("api_key", sa.String(), nullable=True))
+
+    # Restore values from api_key
+    keys = conn.execute(sa.text("SELECT user_id, key FROM api_key")).fetchall()
+    for uid, key in keys:
+        conn.execute(
+            sa.text('UPDATE "user" SET api_key = :key WHERE id = :id'),
+            {"key": key, "id": uid},
+        )
+
+    # Drop new table
+    op.drop_table("api_key")
+
+    with op.batch_alter_table("user") as batch_op:
+        batch_op.drop_column("profile_banner_image_url")
+        batch_op.drop_column("timezone")
+
+        batch_op.drop_column("presence_state")
+        batch_op.drop_column("status_emoji")
+        batch_op.drop_column("status_message")
+        batch_op.drop_column("status_expires_at")
+
+    # Convert info (JSON) → TEXT
+    _convert_column_to_text("user", "info")
+    # Convert settings (JSON) → TEXT
+    _convert_column_to_text("user", "settings")

backend/open_webui/migrations/versions/b2c3d4e5f6a7_add_scim_column_to_user_table.py

@@ -0,0 +1,26 @@
+"""add scim column to user table
+
+Revision ID: b2c3d4e5f6a7
+Revises: a1b2c3d4e5f6
+Create Date: 2026-02-13 14:19:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "b2c3d4e5f6a7"
+down_revision: Union[str, None] = "a1b2c3d4e5f6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("user", sa.Column("scim", sa.JSON(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("user", "scim")

backend/open_webui/migrations/versions/c29facfe716b_update_file_table_path.py

@@ -12,7 +12,6 @@ import json
 from sqlalchemy.sql import table, column
 from sqlalchemy import String, Text, JSON, and_
 
-
 revision = "c29facfe716b"
 down_revision = "c69f45358db4"
 branch_labels = None

backend/open_webui/migrations/versions/c440947495f3_add_chat_file_table.py

@@ -0,0 +1,56 @@
+"""Add chat_file table
+
+Revision ID: c440947495f3
+Revises: 81cc2ce44d79
+Create Date: 2025-12-21 20:27:41.694897
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "c440947495f3"
+down_revision: Union[str, None] = "81cc2ce44d79"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "chat_file",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column(
+            "chat_id",
+            sa.Text(),
+            sa.ForeignKey("chat.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "file_id",
+            sa.Text(),
+            sa.ForeignKey("file.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("message_id", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+        # indexes
+        sa.Index("ix_chat_file_chat_id", "chat_id"),
+        sa.Index("ix_chat_file_file_id", "file_id"),
+        sa.Index("ix_chat_file_message_id", "message_id"),
+        sa.Index("ix_chat_file_user_id", "user_id"),
+        # unique constraints
+        sa.UniqueConstraint(
+            "chat_id", "file_id", name="uq_chat_file_chat_file"
+        ),  # prevent duplicate entries
+    )
+    pass
+
+
+def downgrade() -> None:
+    op.drop_table("chat_file")
+    pass

backend/open_webui/migrations/versions/f1e2d3c4b5a6_add_access_grant_table.py

@@ -0,0 +1,369 @@
+"""Add access_grant table
+
+Revision ID: f1e2d3c4b5a6
+Revises: 8452d01d26d7
+Create Date: 2026-02-05 10:00:00.000000
+
+Migrates from JSON access_control columns to normalized access_grant table.
+Access control semantics:
+- NULL: Public access (all users can read) -> insert user:* for read
+- {}: Private/owner-only (no grants) -> insert nothing
+- {read: {...}, write: {...}}: Custom permissions -> insert specific grants
+"""
+
+from typing import Sequence, Union
+import time
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+from open_webui.migrations.util import get_existing_tables
+
+revision: str = "f1e2d3c4b5a6"
+down_revision: Union[str, None] = "8452d01d26d7"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    existing_tables = set(get_existing_tables())
+
+    # Create access_grant table
+    if "access_grant" not in existing_tables:
+        op.create_table(
+            "access_grant",
+            sa.Column("id", sa.Text(), nullable=False, primary_key=True),
+            sa.Column("resource_type", sa.Text(), nullable=False),
+            sa.Column("resource_id", sa.Text(), nullable=False),
+            sa.Column("principal_type", sa.Text(), nullable=False),
+            sa.Column("principal_id", sa.Text(), nullable=False),
+            sa.Column("permission", sa.Text(), nullable=False),
+            sa.Column("created_at", sa.BigInteger(), nullable=False),
+            sa.UniqueConstraint(
+                "resource_type",
+                "resource_id",
+                "principal_type",
+                "principal_id",
+                "permission",
+                name="uq_access_grant_grant",
+            ),
+        )
+        op.create_index(
+            "idx_access_grant_resource",
+            "access_grant",
+            ["resource_type", "resource_id"],
+        )
+        op.create_index(
+            "idx_access_grant_principal",
+            "access_grant",
+            ["principal_type", "principal_id"],
+        )
+
+    # Backfill existing access_control JSON data
+    conn = op.get_bind()
+
+    # Tables with access_control JSON columns: (table_name, resource_type)
+    resource_tables = [
+        ("knowledge", "knowledge"),
+        ("prompt", "prompt"),
+        ("tool", "tool"),
+        ("model", "model"),
+        ("note", "note"),
+        ("channel", "channel"),
+        ("file", "file"),
+    ]
+
+    now = int(time.time())
+    inserted = set()
+
+    for table_name, resource_type in resource_tables:
+        if table_name not in existing_tables:
+            continue
+
+        # Query all rows
+        try:
+            result = conn.execute(
+                sa.text(f'SELECT id, access_control FROM "{table_name}"')
+            )
+            rows = result.fetchall()
+        except Exception:
+            continue
+
+        for row in rows:
+            resource_id = row[0]
+            access_control_json = row[1]
+
+            # Handle NULL or JSON "null" = public access (user:* for read)
+            # Could be Python None (SQL NULL) or string "null" (JSON null)
+            # EXCEPTION: files with NULL are PRIVATE (owner-only), not public
+            is_null = (
+                access_control_json is None
+                or access_control_json == "null"
+                or (
+                    isinstance(access_control_json, str)
+                    and access_control_json.strip().lower() == "null"
+                )
+            )
+            if is_null:
+                # Files: NULL = private (no entry needed, owner has implicit access)
+                # Other resources: NULL = public (insert user:* for read)
+                if resource_type == "file":
+                    continue  # Private - no entry needed
+
+                key = (resource_type, resource_id, "user", "*", "read")
+                if key not in inserted:
+                    try:
+                        conn.execute(
+                            sa.text("""
+                                INSERT INTO access_grant (id, resource_type, resource_id, principal_type, principal_id, permission, created_at)
+                                VALUES (:id, :resource_type, :resource_id, :principal_type, :principal_id, :permission, :created_at)
+                            """),
+                            {
+                                "id": str(uuid.uuid4()),
+                                "resource_type": resource_type,
+                                "resource_id": resource_id,
+                                "principal_type": "user",
+                                "principal_id": "*",
+                                "permission": "read",
+                                "created_at": now,
+                            },
+                        )
+                        inserted.add(key)
+                    except Exception:
+                        pass
+                continue
+
+            # Handle JSON parsing
+            if isinstance(access_control_json, str):
+                import json
+
+                try:
+                    access_control_json = json.loads(access_control_json)
+                except Exception:
+                    continue
+
+            # Handle {} = private/owner-only - NO entries needed
+            # Owner access is implicit, no grants to store
+            if not access_control_json or not isinstance(access_control_json, dict):
+                continue
+
+            # Check if it's effectively empty (no read/write keys with content)
+            read_data = access_control_json.get("read", {})
+            write_data = access_control_json.get("write", {})
+
+            has_read_grants = read_data.get("group_ids", []) or read_data.get(
+                "user_ids", []
+            )
+            has_write_grants = write_data.get("group_ids", []) or write_data.get(
+                "user_ids", []
+            )
+
+            if not has_read_grants and not has_write_grants:
+                # Empty permissions = private, no grants needed
+                continue
+
+            # Extract permissions and insert into access_grant table
+            for permission in ["read", "write"]:
+                perm_data = access_control_json.get(permission, {})
+                if not perm_data:
+                    continue
+
+                for group_id in perm_data.get("group_ids", []):
+                    key = (resource_type, resource_id, "group", group_id, permission)
+                    if key in inserted:
+                        continue
+                    try:
+                        conn.execute(
+                            sa.text("""
+                                INSERT INTO access_grant (id, resource_type, resource_id, principal_type, principal_id, permission, created_at)
+                                VALUES (:id, :resource_type, :resource_id, :principal_type, :principal_id, :permission, :created_at)
+                            """),
+                            {
+                                "id": str(uuid.uuid4()),
+                                "resource_type": resource_type,
+                                "resource_id": resource_id,
+                                "principal_type": "group",
+                                "principal_id": group_id,
+                                "permission": permission,
+                                "created_at": now,
+                            },
+                        )
+                        inserted.add(key)
+                    except Exception:
+                        pass
+
+                for user_id in perm_data.get("user_ids", []):
+                    key = (resource_type, resource_id, "user", user_id, permission)
+                    if key in inserted:
+                        continue
+                    try:
+                        conn.execute(
+                            sa.text("""
+                                INSERT INTO access_grant (id, resource_type, resource_id, principal_type, principal_id, permission, created_at)
+                                VALUES (:id, :resource_type, :resource_id, :principal_type, :principal_id, :permission, :created_at)
+                            """),
+                            {
+                                "id": str(uuid.uuid4()),
+                                "resource_type": resource_type,
+                                "resource_id": resource_id,
+                                "principal_type": "user",
+                                "principal_id": user_id,
+                                "permission": permission,
+                                "created_at": now,
+                            },
+                        )
+                        inserted.add(key)
+                    except Exception:
+                        pass
+
+    # Drop access_control columns from resource tables
+    for table_name, _ in resource_tables:
+        if table_name not in existing_tables:
+            continue
+        try:
+            with op.batch_alter_table(table_name) as batch:
+                batch.drop_column("access_control")
+        except Exception:
+            pass
+
+
+def downgrade() -> None:
+    import json
+
+    conn = op.get_bind()
+
+    # Resource tables mapping: (table_name, resource_type)
+    resource_tables = [
+        ("knowledge", "knowledge"),
+        ("prompt", "prompt"),
+        ("tool", "tool"),
+        ("model", "model"),
+        ("note", "note"),
+        ("channel", "channel"),
+        ("file", "file"),
+    ]
+
+    # Step 1: Re-add access_control columns to resource tables
+    for table_name, _ in resource_tables:
+        try:
+            with op.batch_alter_table(table_name) as batch:
+                batch.add_column(sa.Column("access_control", sa.JSON(), nullable=True))
+        except Exception:
+            pass
+
+    # Step 2: Query access_grant table and reconstruct JSON for each resource
+    for table_name, resource_type in resource_tables:
+        try:
+            # Get all grants for this resource type
+            result = conn.execute(
+                sa.text("""
+                    SELECT resource_id, principal_type, principal_id, permission
+                    FROM access_grant
+                    WHERE resource_type = :resource_type
+                """),
+                {"resource_type": resource_type},
+            )
+            rows = result.fetchall()
+        except Exception:
+            continue
+
+        # Group by resource_id and reconstruct JSON structure
+        resource_grants = {}
+        for row in rows:
+            resource_id = row[0]
+            principal_type = row[1]
+            principal_id = row[2]
+            permission = row[3]
+
+            if resource_id not in resource_grants:
+                resource_grants[resource_id] = {
+                    "is_public": False,
+                    "read": {"group_ids": [], "user_ids": []},
+                    "write": {"group_ids": [], "user_ids": []},
+                }
+
+            # Handle public access (user:* for read)
+            if (
+                principal_type == "user"
+                and principal_id == "*"
+                and permission == "read"
+            ):
+                resource_grants[resource_id]["is_public"] = True
+                continue
+
+            # Add to appropriate list
+            if permission in ["read", "write"]:
+                if principal_type == "group":
+                    if (
+                        principal_id
+                        not in resource_grants[resource_id][permission]["group_ids"]
+                    ):
+                        resource_grants[resource_id][permission]["group_ids"].append(
+                            principal_id
+                        )
+                elif principal_type == "user":
+                    if (
+                        principal_id
+                        not in resource_grants[resource_id][permission]["user_ids"]
+                    ):
+                        resource_grants[resource_id][permission]["user_ids"].append(
+                            principal_id
+                        )
+
+        # Step 3: Update each resource with reconstructed JSON
+        for resource_id, grants in resource_grants.items():
+            if grants["is_public"]:
+                # Public = NULL
+                access_control_value = None
+            elif (
+                not grants["read"]["group_ids"]
+                and not grants["read"]["user_ids"]
+                and not grants["write"]["group_ids"]
+                and not grants["write"]["user_ids"]
+            ):
+                # No grants = should not happen (would mean no entries), default to {}
+                access_control_value = json.dumps({})
+            else:
+                # Custom permissions
+                access_control_value = json.dumps(
+                    {
+                        "read": grants["read"],
+                        "write": grants["write"],
+                    }
+                )
+
+            try:
+                conn.execute(
+                    sa.text(
+                        f'UPDATE "{table_name}" SET access_control = :access_control WHERE id = :id'
+                    ),
+                    {"access_control": access_control_value, "id": resource_id},
+                )
+            except Exception:
+                pass
+
+        # Step 4: Set all resources WITHOUT entries to private
+        # For files: NULL means private (owner-only), so leave as NULL
+        # For other resources: {} means private, so update to {}
+        if resource_type != "file":
+            try:
+                conn.execute(
+                    sa.text(f"""
+                        UPDATE "{table_name}" 
+                        SET access_control = :private_value
+                        WHERE id NOT IN (
+                            SELECT DISTINCT resource_id FROM access_grant WHERE resource_type = :resource_type
+                        )
+                        AND access_control IS NULL
+                    """),
+                    {"private_value": json.dumps({}), "resource_type": resource_type},
+                )
+            except Exception:
+                pass
+        # For files, NULL stays NULL - no action needed
+
+    # Step 5: Drop the access_grant table
+    op.drop_index("idx_access_grant_principal", table_name="access_grant")
+    op.drop_index("idx_access_grant_resource", table_name="access_grant")
+    op.drop_table("access_grant")

backend/open_webui/models/access_grants.py

@@ -0,0 +1,838 @@
+import logging
+import time
+import uuid
+from typing import Optional
+
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db_context
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import BigInteger, Column, Text, UniqueConstraint, or_, and_
+from sqlalchemy.dialects.postgresql import JSONB
+
+log = logging.getLogger(__name__)
+
+
+####################
+# AccessGrant DB Schema
+####################
+
+
+class AccessGrant(Base):
+    __tablename__ = "access_grant"
+
+    id = Column(Text, primary_key=True)
+    resource_type = Column(
+        Text, nullable=False
+    )  # "knowledge", "model", "prompt", "tool", "note", "channel", "file"
+    resource_id = Column(Text, nullable=False)
+    principal_type = Column(Text, nullable=False)  # "user" or "group"
+    principal_id = Column(
+        Text, nullable=False
+    )  # user_id, group_id, or "*" (wildcard for public)
+    permission = Column(Text, nullable=False)  # "read" or "write"
+    created_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint(
+            "resource_type",
+            "resource_id",
+            "principal_type",
+            "principal_id",
+            "permission",
+            name="uq_access_grant_grant",
+        ),
+    )
+
+
+class AccessGrantModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    resource_type: str
+    resource_id: str
+    principal_type: str
+    principal_id: str
+    permission: str
+    created_at: int
+
+
+class AccessGrantResponse(BaseModel):
+    """Slim grant model for API responses — resource context is implicit from the parent."""
+
+    id: str
+    principal_type: str
+    principal_id: str
+    permission: str
+
+    @classmethod
+    def from_grant(cls, grant: "AccessGrantModel") -> "AccessGrantResponse":
+        return cls(
+            id=grant.id,
+            principal_type=grant.principal_type,
+            principal_id=grant.principal_id,
+            permission=grant.permission,
+        )
+
+
+####################
+# Conversion utilities
+####################
+
+
+def access_control_to_grants(
+    resource_type: str,
+    resource_id: str,
+    access_control: Optional[dict],
+) -> list[dict]:
+    """
+    Convert an old-style access_control JSON dict to a flat list of grant dicts.
+
+    Semantics:
+    - None  → public read (user:* read) — except files which are private
+    - {}    → private/owner-only (no grants)
+    - {read: {group_ids, user_ids}, write: {group_ids, user_ids}} → specific grants
+
+    Returns a list of dicts with keys: resource_type, resource_id, principal_type, principal_id, permission
+    """
+    grants = []
+
+    if access_control is None:
+        # NULL → public read (user:* for read)
+        # Exception: files with NULL are private (owner-only), no grants needed
+        if resource_type != "file":
+            grants.append(
+                {
+                    "resource_type": resource_type,
+                    "resource_id": resource_id,
+                    "principal_type": "user",
+                    "principal_id": "*",
+                    "permission": "read",
+                }
+            )
+        return grants
+
+    # {} → private/owner-only, no grants
+    if not access_control:
+        return grants
+
+    # Parse structured permissions
+    for permission in ["read", "write"]:
+        perm_data = access_control.get(permission, {})
+        if not perm_data:
+            continue
+
+        for group_id in perm_data.get("group_ids", []):
+            grants.append(
+                {
+                    "resource_type": resource_type,
+                    "resource_id": resource_id,
+                    "principal_type": "group",
+                    "principal_id": group_id,
+                    "permission": permission,
+                }
+            )
+
+        for user_id in perm_data.get("user_ids", []):
+            grants.append(
+                {
+                    "resource_type": resource_type,
+                    "resource_id": resource_id,
+                    "principal_type": "user",
+                    "principal_id": user_id,
+                    "permission": permission,
+                }
+            )
+
+    return grants
+
+
+def normalize_access_grants(access_grants: Optional[list]) -> list[dict]:
+    """
+    Normalize direct access_grants payloads from API forms.
+
+    Keeps only valid grants and removes duplicates by
+    (principal_type, principal_id, permission).
+    """
+    if not access_grants:
+        return []
+
+    deduped = {}
+    for grant in access_grants:
+        if isinstance(grant, BaseModel):
+            grant = grant.model_dump()
+        if not isinstance(grant, dict):
+            continue
+
+        principal_type = grant.get("principal_type")
+        principal_id = grant.get("principal_id")
+        permission = grant.get("permission")
+
+        if principal_type not in ("user", "group"):
+            continue
+        if permission not in ("read", "write"):
+            continue
+        if not isinstance(principal_id, str) or not principal_id:
+            continue
+
+        key = (principal_type, principal_id, permission)
+        deduped[key] = {
+            "id": (
+                grant.get("id")
+                if isinstance(grant.get("id"), str) and grant.get("id")
+                else str(uuid.uuid4())
+            ),
+            "principal_type": principal_type,
+            "principal_id": principal_id,
+            "permission": permission,
+        }
+
+    return list(deduped.values())
+
+
+def has_public_read_access_grant(access_grants: Optional[list]) -> bool:
+    """
+    Returns True when a direct grant list includes wildcard public-read.
+    """
+    for grant in normalize_access_grants(access_grants):
+        if (
+            grant["principal_type"] == "user"
+            and grant["principal_id"] == "*"
+            and grant["permission"] == "read"
+        ):
+            return True
+    return False
+
+
+def grants_to_access_control(grants: list) -> Optional[dict]:
+    """
+    Convert a list of grant objects (AccessGrantModel or AccessGrantResponse)
+    back to the old-style access_control JSON dict for backward compatibility.
+
+    Semantics:
+    - [] (empty) → {} (private/owner-only)
+    - Contains user:*:read → None (public), but write grants are preserved
+    - Otherwise → {read: {group_ids, user_ids}, write: {group_ids, user_ids}}
+
+    Note: "public" (user:*:read) still allows additional write permissions
+    to coexist.  When the wildcard read is present the function returns None
+    for the legacy dict, so callers that need write info should inspect the
+    grants list directly.
+    """
+    if not grants:
+        return {}  # No grants = private/owner-only
+
+    result = {
+        "read": {"group_ids": [], "user_ids": []},
+        "write": {"group_ids": [], "user_ids": []},
+    }
+
+    is_public = False
+    for grant in grants:
+        if (
+            grant.principal_type == "user"
+            and grant.principal_id == "*"
+            and grant.permission == "read"
+        ):
+            is_public = True
+            continue  # Don't add wildcard to user_ids list
+
+        if grant.permission not in ("read", "write"):
+            continue
+
+        if grant.principal_type == "group":
+            if grant.principal_id not in result[grant.permission]["group_ids"]:
+                result[grant.permission]["group_ids"].append(grant.principal_id)
+        elif grant.principal_type == "user":
+            if grant.principal_id not in result[grant.permission]["user_ids"]:
+                result[grant.permission]["user_ids"].append(grant.principal_id)
+
+    if is_public:
+        return None  # Public read access
+
+    return result
+
+
+####################
+# Table Operations
+####################
+
+
+class AccessGrantsTable:
+    def grant_access(
+        self,
+        resource_type: str,
+        resource_id: str,
+        principal_type: str,
+        principal_id: str,
+        permission: str,
+        db: Optional[Session] = None,
+    ) -> Optional[AccessGrantModel]:
+        """Add a single access grant. Idempotent (ignores duplicates)."""
+        with get_db_context(db) as db:
+            # Check for existing grant
+            existing = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                    principal_type=principal_type,
+                    principal_id=principal_id,
+                    permission=permission,
+                )
+                .first()
+            )
+            if existing:
+                return AccessGrantModel.model_validate(existing)
+
+            grant = AccessGrant(
+                id=str(uuid.uuid4()),
+                resource_type=resource_type,
+                resource_id=resource_id,
+                principal_type=principal_type,
+                principal_id=principal_id,
+                permission=permission,
+                created_at=int(time.time()),
+            )
+            db.add(grant)
+            db.commit()
+            db.refresh(grant)
+            return AccessGrantModel.model_validate(grant)
+
+    def revoke_access(
+        self,
+        resource_type: str,
+        resource_id: str,
+        principal_type: str,
+        principal_id: str,
+        permission: str,
+        db: Optional[Session] = None,
+    ) -> bool:
+        """Remove a single access grant."""
+        with get_db_context(db) as db:
+            deleted = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                    principal_type=principal_type,
+                    principal_id=principal_id,
+                    permission=permission,
+                )
+                .delete()
+            )
+            db.commit()
+            return deleted > 0
+
+    def revoke_all_access(
+        self,
+        resource_type: str,
+        resource_id: str,
+        db: Optional[Session] = None,
+    ) -> int:
+        """Remove all access grants for a resource."""
+        with get_db_context(db) as db:
+            deleted = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                )
+                .delete()
+            )
+            db.commit()
+            return deleted
+
+    def set_access_control(
+        self,
+        resource_type: str,
+        resource_id: str,
+        access_control: Optional[dict],
+        db: Optional[Session] = None,
+    ) -> list[AccessGrantModel]:
+        """
+        Replace all grants for a resource from an access_control JSON dict.
+        This is the primary bridge for backward compat with the frontend.
+        """
+        with get_db_context(db) as db:
+            # Delete all existing grants for this resource
+            db.query(AccessGrant).filter_by(
+                resource_type=resource_type,
+                resource_id=resource_id,
+            ).delete()
+
+            # Convert JSON to grant dicts
+            grant_dicts = access_control_to_grants(
+                resource_type, resource_id, access_control
+            )
+
+            # Insert new grants
+            results = []
+            for grant_dict in grant_dicts:
+                grant = AccessGrant(
+                    id=str(uuid.uuid4()),
+                    **grant_dict,
+                    created_at=int(time.time()),
+                )
+                db.add(grant)
+                results.append(grant)
+
+            db.commit()
+
+            return [AccessGrantModel.model_validate(g) for g in results]
+
+    def set_access_grants(
+        self,
+        resource_type: str,
+        resource_id: str,
+        access_grants: Optional[list],
+        db: Optional[Session] = None,
+    ) -> list[AccessGrantModel]:
+        """
+        Replace all grants for a resource from a direct access_grants list.
+        """
+        with get_db_context(db) as db:
+            db.query(AccessGrant).filter_by(
+                resource_type=resource_type,
+                resource_id=resource_id,
+            ).delete()
+
+            normalized_grants = normalize_access_grants(access_grants)
+
+            results = []
+            for grant_dict in normalized_grants:
+                grant = AccessGrant(
+                    id=grant_dict["id"],
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                    principal_type=grant_dict["principal_type"],
+                    principal_id=grant_dict["principal_id"],
+                    permission=grant_dict["permission"],
+                    created_at=int(time.time()),
+                )
+                db.add(grant)
+                results.append(grant)
+
+            db.commit()
+            return [AccessGrantModel.model_validate(g) for g in results]
+
+    def get_access_control(
+        self,
+        resource_type: str,
+        resource_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[dict]:
+        """
+        Reconstruct the old-style access_control JSON dict from grants.
+        For backward compat with the frontend.
+        """
+        with get_db_context(db) as db:
+            grants = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                )
+                .all()
+            )
+            grant_models = [AccessGrantModel.model_validate(g) for g in grants]
+            return grants_to_access_control(grant_models)
+
+    def get_grants_by_resource(
+        self,
+        resource_type: str,
+        resource_id: str,
+        db: Optional[Session] = None,
+    ) -> list[AccessGrantModel]:
+        """Get all grants for a specific resource."""
+        with get_db_context(db) as db:
+            grants = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                )
+                .all()
+            )
+            return [AccessGrantModel.model_validate(g) for g in grants]
+
+    def has_access(
+        self,
+        user_id: str,
+        resource_type: str,
+        resource_id: str,
+        permission: str = "read",
+        user_group_ids: Optional[set[str]] = None,
+        db: Optional[Session] = None,
+    ) -> bool:
+        """
+        Check if a user has the specified permission on a resource.
+
+        Access is granted if any of the following is true:
+        - There's a grant for user:* (public) with the requested permission
+        - There's a grant for the specific user with the requested permission
+        - There's a grant for any of the user's groups with the requested permission
+        """
+        with get_db_context(db) as db:
+            # Build conditions for matching grants
+            conditions = [
+                # Public access
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == "*",
+                ),
+                # Direct user access
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == user_id,
+                ),
+            ]
+
+            # Group access
+            if user_group_ids is None:
+                from open_webui.models.groups import Groups
+
+                user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+                user_group_ids = {group.id for group in user_groups}
+
+            if user_group_ids:
+                conditions.append(
+                    and_(
+                        AccessGrant.principal_type == "group",
+                        AccessGrant.principal_id.in_(user_group_ids),
+                    )
+                )
+
+            exists = (
+                db.query(AccessGrant)
+                .filter(
+                    AccessGrant.resource_type == resource_type,
+                    AccessGrant.resource_id == resource_id,
+                    AccessGrant.permission == permission,
+                    or_(*conditions),
+                )
+                .first()
+            )
+            return exists is not None
+
+    def get_accessible_resource_ids(
+        self,
+        user_id: str,
+        resource_type: str,
+        resource_ids: list[str],
+        permission: str = "read",
+        user_group_ids: Optional[set[str]] = None,
+        db: Optional[Session] = None,
+    ) -> set[str]:
+        """
+        Batch check: return the subset of resource_ids that the user can access.
+
+        This replaces calling has_access() in a loop (N+1) with a single query.
+        """
+        if not resource_ids:
+            return set()
+
+        with get_db_context(db) as db:
+            conditions = [
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == "*",
+                ),
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == user_id,
+                ),
+            ]
+
+            if user_group_ids is None:
+                from open_webui.models.groups import Groups
+
+                user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+                user_group_ids = {group.id for group in user_groups}
+
+            if user_group_ids:
+                conditions.append(
+                    and_(
+                        AccessGrant.principal_type == "group",
+                        AccessGrant.principal_id.in_(user_group_ids),
+                    )
+                )
+
+            rows = (
+                db.query(AccessGrant.resource_id)
+                .filter(
+                    AccessGrant.resource_type == resource_type,
+                    AccessGrant.resource_id.in_(resource_ids),
+                    AccessGrant.permission == permission,
+                    or_(*conditions),
+                )
+                .distinct()
+                .all()
+            )
+            return {row[0] for row in rows}
+
+    def get_users_with_access(
+        self,
+        resource_type: str,
+        resource_id: str,
+        permission: str = "read",
+        db: Optional[Session] = None,
+    ) -> list:
+        """
+        Get all users who have the specified permission on a resource.
+        Returns a list of UserModel instances.
+        """
+        from open_webui.models.users import Users, UserModel
+        from open_webui.models.groups import Groups
+
+        with get_db_context(db) as db:
+            grants = (
+                db.query(AccessGrant)
+                .filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                    permission=permission,
+                )
+                .all()
+            )
+
+            # Check for public access
+            for grant in grants:
+                if grant.principal_type == "user" and grant.principal_id == "*":
+                    result = Users.get_users(filter={"roles": ["!pending"]}, db=db)
+                    return result.get("users", [])
+
+            user_ids_with_access = set()
+
+            for grant in grants:
+                if grant.principal_type == "user":
+                    user_ids_with_access.add(grant.principal_id)
+                elif grant.principal_type == "group":
+                    group_user_ids = Groups.get_group_user_ids_by_id(
+                        grant.principal_id, db=db
+                    )
+                    if group_user_ids:
+                        user_ids_with_access.update(group_user_ids)
+
+            if not user_ids_with_access:
+                return []
+
+            return Users.get_users_by_user_ids(list(user_ids_with_access), db=db)
+
+    def has_permission_filter(
+        self,
+        db,
+        query,
+        DocumentModel,
+        filter: dict,
+        resource_type: str,
+        permission: str = "read",
+    ):
+        """
+        Apply access control filtering to a SQLAlchemy query by JOINing with access_grant.
+
+        This replaces the old JSON-column-based filtering with a proper relational JOIN.
+        """
+        group_ids = filter.get("group_ids", [])
+        user_id = filter.get("user_id")
+
+        if permission == "read_only":
+            return self._has_read_only_permission_filter(
+                db, query, DocumentModel, filter, resource_type
+            )
+
+        # Build principal conditions
+        principal_conditions = []
+
+        if group_ids or user_id:
+            # Public access: user:* read
+            principal_conditions.append(
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == "*",
+                )
+            )
+
+        if user_id:
+            # Owner always has access
+            principal_conditions.append(DocumentModel.user_id == user_id)
+
+            # Direct user grant
+            principal_conditions.append(
+                and_(
+                    AccessGrant.principal_type == "user",
+                    AccessGrant.principal_id == user_id,
+                )
+            )
+
+        if group_ids:
+            # Group grants
+            principal_conditions.append(
+                and_(
+                    AccessGrant.principal_type == "group",
+                    AccessGrant.principal_id.in_(group_ids),
+                )
+            )
+
+        if not principal_conditions:
+            return query
+
+        # LEFT JOIN access_grant and filter
+        # We use a subquery approach to avoid duplicates from multiple matching grants
+        from sqlalchemy import exists as sa_exists, select
+
+        grant_exists = (
+            select(AccessGrant.id)
+            .where(
+                AccessGrant.resource_type == resource_type,
+                AccessGrant.resource_id == DocumentModel.id,
+                AccessGrant.permission == permission,
+                or_(
+                    and_(
+                        AccessGrant.principal_type == "user",
+                        AccessGrant.principal_id == "*",
+                    ),
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "user",
+                                AccessGrant.principal_id == user_id,
+                            )
+                        ]
+                        if user_id
+                        else []
+                    ),
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "group",
+                                AccessGrant.principal_id.in_(group_ids),
+                            )
+                        ]
+                        if group_ids
+                        else []
+                    ),
+                ),
+            )
+            .correlate(DocumentModel)
+            .exists()
+        )
+
+        # Owner OR has a matching grant
+        owner_or_grant = [grant_exists]
+        if user_id:
+            owner_or_grant.append(DocumentModel.user_id == user_id)
+
+        query = query.filter(or_(*owner_or_grant))
+        return query
+
+    def _has_read_only_permission_filter(
+        self,
+        db,
+        query,
+        DocumentModel,
+        filter: dict,
+        resource_type: str,
+    ):
+        """
+        Filter for items where user has read BUT NOT write access.
+        Public items are NOT considered read_only.
+        """
+        group_ids = filter.get("group_ids", [])
+        user_id = filter.get("user_id")
+
+        from sqlalchemy import exists as sa_exists, select
+
+        # Has read grant (not public)
+        read_grant_exists = (
+            select(AccessGrant.id)
+            .where(
+                AccessGrant.resource_type == resource_type,
+                AccessGrant.resource_id == DocumentModel.id,
+                AccessGrant.permission == "read",
+                or_(
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "user",
+                                AccessGrant.principal_id == user_id,
+                            )
+                        ]
+                        if user_id
+                        else []
+                    ),
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "group",
+                                AccessGrant.principal_id.in_(group_ids),
+                            )
+                        ]
+                        if group_ids
+                        else []
+                    ),
+                ),
+            )
+            .correlate(DocumentModel)
+            .exists()
+        )
+
+        # Does NOT have write grant
+        write_grant_exists = (
+            select(AccessGrant.id)
+            .where(
+                AccessGrant.resource_type == resource_type,
+                AccessGrant.resource_id == DocumentModel.id,
+                AccessGrant.permission == "write",
+                or_(
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "user",
+                                AccessGrant.principal_id == user_id,
+                            )
+                        ]
+                        if user_id
+                        else []
+                    ),
+                    *(
+                        [
+                            and_(
+                                AccessGrant.principal_type == "group",
+                                AccessGrant.principal_id.in_(group_ids),
+                            )
+                        ]
+                        if group_ids
+                        else []
+                    ),
+                ),
+            )
+            .correlate(DocumentModel)
+            .exists()
+        )
+
+        # Is NOT public
+        public_grant_exists = (
+            select(AccessGrant.id)
+            .where(
+                AccessGrant.resource_type == resource_type,
+                AccessGrant.resource_id == DocumentModel.id,
+                AccessGrant.permission == "read",
+                AccessGrant.principal_type == "user",
+                AccessGrant.principal_id == "*",
+            )
+            .correlate(DocumentModel)
+            .exists()
+        )
+
+        conditions = [read_grant_exists, ~write_grant_exists, ~public_grant_exists]
+
+        # Not owner
+        if user_id:
+            conditions.append(DocumentModel.user_id != user_id)
+
+        query = query.filter(and_(*conditions))
+        return query
+
+
+AccessGrants = AccessGrantsTable()

backend/open_webui/models/auths.py

@@ -2,15 +2,14 @@ import logging
 import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
-from open_webui.models.users import UserModel, Users
-from open_webui.env import SRC_LOG_LEVELS
-from pydantic import BaseModel
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from open_webui.models.users import User, UserModel, UserProfileImageResponse, Users
+from open_webui.utils.validate import validate_profile_image_url
+from pydantic import BaseModel, field_validator
 from sqlalchemy import Boolean, Column, String, Text
-from open_webui.utils.auth import verify_password
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # DB MODEL
@@ -20,7 +19,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 class Auth(Base):
     __tablename__ = "auth"
 
-    id = Column(String, primary_key=True)
+    id = Column(String, primary_key=True, unique=True)
     email = Column(String)
     password = Column(Text)
     active = Column(Boolean)
@@ -47,15 +46,7 @@ class ApiKey(BaseModel):
     api_key: Optional[str] = None
 
 
-class UserResponse(BaseModel):
-    id: str
-    email: str
-    name: str
-    role: str
-    profile_image_url: str
-
-
-class SigninResponse(Token, UserResponse):
+class SigninResponse(Token, UserProfileImageResponse):
     pass
 
 
@@ -84,6 +75,13 @@ class SignupForm(BaseModel):
     password: str
     profile_image_url: Optional[str] = "/user.png"
 
+    @field_validator("profile_image_url")
+    @classmethod
+    def check_profile_image_url(cls, v: Optional[str]) -> Optional[str]:
+        if v is not None:
+            return validate_profile_image_url(v)
+        return v
+
 
 class AddUserForm(SignupForm):
     role: Optional[str] = "pending"
@@ -97,9 +95,10 @@ class AuthsTable:
         name: str,
         profile_image_url: str = "/user.png",
         role: str = "pending",
-        oauth_sub: Optional[str] = None,
+        oauth: Optional[dict] = None,
+        db: Optional[Session] = None,
     ) -> Optional[UserModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             log.info("insert_new_auth")
 
             id = str(uuid.uuid4())
@@ -111,7 +110,7 @@ class AuthsTable:
             db.add(result)
 
             user = Users.insert_new_user(
-                id, name, email, profile_image_url, role, oauth_sub
+                id, name, email, profile_image_url, role, oauth=oauth, db=db
             )
 
             db.commit()
@@ -122,18 +121,20 @@ class AuthsTable:
             else:
                 return None
 
-    def authenticate_user(self, email: str, password: str) -> Optional[UserModel]:
+    def authenticate_user(
+        self, email: str, verify_password: callable, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         log.info(f"authenticate_user: {email}")
 
-        user = Users.get_user_by_email(email)
+        user = Users.get_user_by_email(email, db=db)
         if not user:
             return None
 
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 auth = db.query(Auth).filter_by(id=user.id, active=True).first()
                 if auth:
-                    if verify_password(password, auth.password):
+                    if verify_password(auth.password):
                         return user
                     else:
                         return None
@@ -142,32 +143,45 @@ class AuthsTable:
         except Exception:
             return None
 
-    def authenticate_user_by_api_key(self, api_key: str) -> Optional[UserModel]:
+    def authenticate_user_by_api_key(
+        self, api_key: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         log.info(f"authenticate_user_by_api_key: {api_key}")
         # if no api_key, return None
         if not api_key:
             return None
 
         try:
-            user = Users.get_user_by_api_key(api_key)
+            user = Users.get_user_by_api_key(api_key, db=db)
             return user if user else None
         except Exception:
             return False
 
-    def authenticate_user_by_email(self, email: str) -> Optional[UserModel]:
+    def authenticate_user_by_email(
+        self, email: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         log.info(f"authenticate_user_by_email: {email}")
         try:
-            with get_db() as db:
-                auth = db.query(Auth).filter_by(email=email, active=True).first()
-                if auth:
-                    user = Users.get_user_by_id(auth.id)
-                    return user
+            with get_db_context(db) as db:
+                # Single JOIN query instead of two separate queries
+                result = (
+                    db.query(Auth, User)
+                    .join(User, Auth.id == User.id)
+                    .filter(Auth.email == email, Auth.active == True)
+                    .first()
+                )
+                if result:
+                    _, user = result
+                    return UserModel.model_validate(user)
+                return None
         except Exception:
             return None
 
-    def update_user_password_by_id(self, id: str, new_password: str) -> bool:
+    def update_user_password_by_id(
+        self, id: str, new_password: str, db: Optional[Session] = None
+    ) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 result = (
                     db.query(Auth).filter_by(id=id).update({"password": new_password})
                 )
@@ -176,20 +190,22 @@ class AuthsTable:
         except Exception:
             return False
 
-    def update_email_by_id(self, id: str, email: str) -> bool:
+    def update_email_by_id(
+        self, id: str, email: str, db: Optional[Session] = None
+    ) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 result = db.query(Auth).filter_by(id=id).update({"email": email})
                 db.commit()
                 return True if result == 1 else False
         except Exception:
             return False
 
-    def delete_auth_by_id(self, id: str) -> bool:
+    def delete_auth_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 # Delete User
-                result = Users.delete_user_by_id(id)
+                result = Users.delete_user_by_id(id, db=db)
 
                 if result:
                     db.query(Auth).filter_by(id=id).delete()

backend/open_webui/models/chat_messages.py

@@ -0,0 +1,644 @@
+import json
+import time
+import uuid
+from typing import Any, Optional
+
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db_context
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import (
+    BigInteger,
+    Boolean,
+    Column,
+    ForeignKey,
+    Text,
+    JSON,
+    Index,
+    func,
+)
+
+####################
+# Helpers
+####################
+
+
+def _normalize_timestamp(timestamp: int) -> float:
+    """Normalize and validate timestamp. Returns current time if invalid."""
+    now = time.time()
+
+    # Convert milliseconds to seconds if needed
+    if timestamp > 10_000_000_000:
+        timestamp = timestamp / 1000
+
+    # Validate: must be after 2020 and not in the future (with 1 day tolerance)
+    min_valid = 1577836800  # 2020-01-01 00:00:00 UTC
+    max_valid = now + 86400  # 1 day in the future (clock skew tolerance)
+
+    if timestamp < min_valid or timestamp > max_valid:
+        return now
+
+    return timestamp
+
+
+####################
+# ChatMessage DB Schema
+####################
+
+
+class ChatMessage(Base):
+    __tablename__ = "chat_message"
+
+    # Identity
+    id = Column(Text, primary_key=True)
+    chat_id = Column(
+        Text, ForeignKey("chat.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(Text, index=True)
+
+    # Structure
+    role = Column(Text, nullable=False)  # user, assistant, system
+    parent_id = Column(Text, nullable=True)
+
+    # Content
+    content = Column(JSON, nullable=True)  # Can be str or list of blocks
+    output = Column(JSON, nullable=True)
+
+    # Model (for assistant messages)
+    model_id = Column(Text, nullable=True, index=True)
+
+    # Attachments
+    files = Column(JSON, nullable=True)
+    sources = Column(JSON, nullable=True)
+    embeds = Column(JSON, nullable=True)
+
+    # Status
+    done = Column(Boolean, default=True)
+    status_history = Column(JSON, nullable=True)
+    error = Column(JSON, nullable=True)
+
+    # Usage (tokens, timing, etc.)
+    usage = Column(JSON, nullable=True)
+
+    # Timestamps
+    created_at = Column(BigInteger, index=True)
+    updated_at = Column(BigInteger)
+
+    __table_args__ = (
+        Index("chat_message_chat_parent_idx", "chat_id", "parent_id"),
+        Index("chat_message_model_created_idx", "model_id", "created_at"),
+        Index("chat_message_user_created_idx", "user_id", "created_at"),
+    )
+
+
+####################
+# Pydantic Models
+####################
+
+
+class ChatMessageModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    chat_id: str
+    user_id: str
+    role: str
+    parent_id: Optional[str] = None
+    content: Optional[Any] = None  # str or list of blocks
+    output: Optional[list] = None
+    model_id: Optional[str] = None
+    files: Optional[list] = None
+    sources: Optional[list] = None
+    embeds: Optional[list] = None
+    done: bool = True
+    status_history: Optional[list] = None
+    error: Optional[dict | str] = None
+    usage: Optional[dict] = None
+    created_at: int
+    updated_at: int
+
+
+####################
+# Table Operations
+####################
+
+
+class ChatMessageTable:
+    def upsert_message(
+        self,
+        message_id: str,
+        chat_id: str,
+        user_id: str,
+        data: dict,
+        db: Optional[Session] = None,
+    ) -> Optional[ChatMessageModel]:
+        """Insert or update a chat message."""
+        with get_db_context(db) as db:
+            now = int(time.time())
+            timestamp = data.get("timestamp", now)
+
+            # Use composite ID: {chat_id}-{message_id}
+            composite_id = f"{chat_id}-{message_id}"
+
+            existing = db.get(ChatMessage, composite_id)
+            if existing:
+                # Update existing
+                if "role" in data:
+                    existing.role = data["role"]
+                if "parent_id" in data:
+                    existing.parent_id = data.get("parent_id") or data.get("parentId")
+                if "content" in data:
+                    existing.content = data.get("content")
+                if "output" in data:
+                    existing.output = data.get("output")
+                if "model_id" in data or "model" in data:
+                    existing.model_id = data.get("model_id") or data.get("model")
+                if "files" in data:
+                    existing.files = data.get("files")
+                if "sources" in data:
+                    existing.sources = data.get("sources")
+                if "embeds" in data:
+                    existing.embeds = data.get("embeds")
+                if "done" in data:
+                    existing.done = data.get("done", True)
+                if "status_history" in data or "statusHistory" in data:
+                    existing.status_history = data.get("status_history") or data.get(
+                        "statusHistory"
+                    )
+                if "error" in data:
+                    existing.error = data.get("error")
+                # Extract usage - check direct field first, then info.usage
+                usage = data.get("usage")
+                if not usage:
+                    info = data.get("info", {})
+                    usage = info.get("usage") if info else None
+                if usage:
+                    existing.usage = usage
+                existing.updated_at = now
+                db.commit()
+                db.refresh(existing)
+                return ChatMessageModel.model_validate(existing)
+            else:
+                # Insert new
+                # Extract usage - check direct field first, then info.usage
+                usage = data.get("usage")
+                if not usage:
+                    info = data.get("info", {})
+                    usage = info.get("usage") if info else None
+                message = ChatMessage(
+                    id=composite_id,
+                    chat_id=chat_id,
+                    user_id=user_id,
+                    role=data.get("role", "user"),
+                    parent_id=data.get("parent_id") or data.get("parentId"),
+                    content=data.get("content"),
+                    output=data.get("output"),
+                    model_id=data.get("model_id") or data.get("model"),
+                    files=data.get("files"),
+                    sources=data.get("sources"),
+                    embeds=data.get("embeds"),
+                    done=data.get("done", True),
+                    status_history=data.get("status_history")
+                    or data.get("statusHistory"),
+                    error=data.get("error"),
+                    usage=usage,
+                    created_at=timestamp,
+                    updated_at=now,
+                )
+                db.add(message)
+                db.commit()
+                db.refresh(message)
+                return ChatMessageModel.model_validate(message)
+
+    def get_message_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[ChatMessageModel]:
+        with get_db_context(db) as db:
+            message = db.get(ChatMessage, id)
+            return ChatMessageModel.model_validate(message) if message else None
+
+    def get_messages_by_chat_id(
+        self, chat_id: str, db: Optional[Session] = None
+    ) -> list[ChatMessageModel]:
+        with get_db_context(db) as db:
+            messages = (
+                db.query(ChatMessage)
+                .filter_by(chat_id=chat_id)
+                .order_by(ChatMessage.created_at.asc())
+                .all()
+            )
+            return [ChatMessageModel.model_validate(message) for message in messages]
+
+    def get_messages_by_user_id(
+        self,
+        user_id: str,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
+    ) -> list[ChatMessageModel]:
+        with get_db_context(db) as db:
+            messages = (
+                db.query(ChatMessage)
+                .filter_by(user_id=user_id)
+                .order_by(ChatMessage.created_at.desc())
+                .offset(skip)
+                .limit(limit)
+                .all()
+            )
+            return [ChatMessageModel.model_validate(message) for message in messages]
+
+    def get_messages_by_model_id(
+        self,
+        model_id: str,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        skip: int = 0,
+        limit: int = 100,
+        db: Optional[Session] = None,
+    ) -> list[ChatMessageModel]:
+        with get_db_context(db) as db:
+            query = db.query(ChatMessage).filter_by(model_id=model_id)
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            messages = (
+                query.order_by(ChatMessage.created_at.desc())
+                .offset(skip)
+                .limit(limit)
+                .all()
+            )
+            return [ChatMessageModel.model_validate(message) for message in messages]
+
+    def get_chat_ids_by_model_id(
+        self,
+        model_id: str,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
+    ) -> list[str]:
+        """Get distinct chat_ids that used a specific model."""
+
+        with get_db_context(db) as db:
+            query = db.query(
+                ChatMessage.chat_id,
+                func.max(ChatMessage.created_at).label("last_message_at"),
+            ).filter(ChatMessage.model_id == model_id)
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+
+            # Group by chat_id and order by most recent message in each chat
+            chat_ids = (
+                query.group_by(ChatMessage.chat_id)
+                .order_by(func.max(ChatMessage.created_at).desc())
+                .offset(skip)
+                .limit(limit)
+                .all()
+            )
+            return [chat_id for chat_id, _ in chat_ids]
+
+    def delete_messages_by_chat_id(
+        self, chat_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
+            db.query(ChatMessage).filter_by(chat_id=chat_id).delete()
+            db.commit()
+            return True
+
+    # Analytics methods
+    def get_message_count_by_model(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        group_id: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, int]:
+        with get_db_context(db) as db:
+            from sqlalchemy import func
+            from open_webui.models.groups import GroupMember
+
+            query = db.query(
+                ChatMessage.model_id, func.count(ChatMessage.id).label("count")
+            ).filter(
+                ChatMessage.role == "assistant",
+                ChatMessage.model_id.isnot(None),
+                ~ChatMessage.user_id.like("shared-%"),
+            )
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            if group_id:
+                group_users = (
+                    db.query(GroupMember.user_id)
+                    .filter(GroupMember.group_id == group_id)
+                    .subquery()
+                )
+                query = query.filter(ChatMessage.user_id.in_(group_users))
+
+            results = query.group_by(ChatMessage.model_id).all()
+            return {row.model_id: row.count for row in results}
+
+    def get_token_usage_by_model(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        group_id: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, dict]:
+        """Aggregate token usage by model using database-level aggregation."""
+        with get_db_context(db) as db:
+            from sqlalchemy import func, cast, Integer
+            from open_webui.models.groups import GroupMember
+
+            dialect = db.bind.dialect.name
+
+            if dialect == "sqlite":
+                input_tokens = cast(
+                    func.json_extract(ChatMessage.usage, "$.input_tokens"), Integer
+                )
+                output_tokens = cast(
+                    func.json_extract(ChatMessage.usage, "$.output_tokens"), Integer
+                )
+            elif dialect == "postgresql":
+                # Use json_extract_path_text for PostgreSQL JSON columns
+                input_tokens = cast(
+                    func.json_extract_path_text(ChatMessage.usage, "input_tokens"),
+                    Integer,
+                )
+                output_tokens = cast(
+                    func.json_extract_path_text(ChatMessage.usage, "output_tokens"),
+                    Integer,
+                )
+            else:
+                raise NotImplementedError(f"Unsupported dialect: {dialect}")
+
+            query = db.query(
+                ChatMessage.model_id,
+                func.coalesce(func.sum(input_tokens), 0).label("input_tokens"),
+                func.coalesce(func.sum(output_tokens), 0).label("output_tokens"),
+                func.count(ChatMessage.id).label("message_count"),
+            ).filter(
+                ChatMessage.role == "assistant",
+                ChatMessage.model_id.isnot(None),
+                ChatMessage.usage.isnot(None),
+                ~ChatMessage.user_id.like("shared-%"),
+            )
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            if group_id:
+                group_users = (
+                    db.query(GroupMember.user_id)
+                    .filter(GroupMember.group_id == group_id)
+                    .subquery()
+                )
+                query = query.filter(ChatMessage.user_id.in_(group_users))
+
+            results = query.group_by(ChatMessage.model_id).all()
+
+            return {
+                row.model_id: {
+                    "input_tokens": row.input_tokens,
+                    "output_tokens": row.output_tokens,
+                    "total_tokens": row.input_tokens + row.output_tokens,
+                    "message_count": row.message_count,
+                }
+                for row in results
+            }
+
+    def get_token_usage_by_user(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, dict]:
+        """Aggregate token usage by user using database-level aggregation."""
+        with get_db_context(db) as db:
+            from sqlalchemy import func, cast, Integer
+
+            dialect = db.bind.dialect.name
+
+            if dialect == "sqlite":
+                input_tokens = cast(
+                    func.json_extract(ChatMessage.usage, "$.input_tokens"), Integer
+                )
+                output_tokens = cast(
+                    func.json_extract(ChatMessage.usage, "$.output_tokens"), Integer
+                )
+            elif dialect == "postgresql":
+                # Use json_extract_path_text for PostgreSQL JSON columns
+                input_tokens = cast(
+                    func.json_extract_path_text(ChatMessage.usage, "input_tokens"),
+                    Integer,
+                )
+                output_tokens = cast(
+                    func.json_extract_path_text(ChatMessage.usage, "output_tokens"),
+                    Integer,
+                )
+            else:
+                raise NotImplementedError(f"Unsupported dialect: {dialect}")
+
+            query = db.query(
+                ChatMessage.user_id,
+                func.coalesce(func.sum(input_tokens), 0).label("input_tokens"),
+                func.coalesce(func.sum(output_tokens), 0).label("output_tokens"),
+                func.count(ChatMessage.id).label("message_count"),
+            ).filter(
+                ChatMessage.role == "assistant",
+                ChatMessage.user_id.isnot(None),
+                ChatMessage.usage.isnot(None),
+                ~ChatMessage.user_id.like("shared-%"),
+            )
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+
+            results = query.group_by(ChatMessage.user_id).all()
+
+            return {
+                row.user_id: {
+                    "input_tokens": row.input_tokens,
+                    "output_tokens": row.output_tokens,
+                    "total_tokens": row.input_tokens + row.output_tokens,
+                    "message_count": row.message_count,
+                }
+                for row in results
+            }
+
+    def get_message_count_by_user(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        group_id: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, int]:
+        with get_db_context(db) as db:
+            from sqlalchemy import func
+            from open_webui.models.groups import GroupMember
+
+            query = db.query(
+                ChatMessage.user_id, func.count(ChatMessage.id).label("count")
+            ).filter(~ChatMessage.user_id.like("shared-%"))
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            if group_id:
+                group_users = (
+                    db.query(GroupMember.user_id)
+                    .filter(GroupMember.group_id == group_id)
+                    .subquery()
+                )
+                query = query.filter(ChatMessage.user_id.in_(group_users))
+
+            results = query.group_by(ChatMessage.user_id).all()
+            return {row.user_id: row.count for row in results}
+
+    def get_message_count_by_chat(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        group_id: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, int]:
+        with get_db_context(db) as db:
+            from sqlalchemy import func
+            from open_webui.models.groups import GroupMember
+
+            query = db.query(
+                ChatMessage.chat_id, func.count(ChatMessage.id).label("count")
+            ).filter(~ChatMessage.user_id.like("shared-%"))
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            if group_id:
+                group_users = (
+                    db.query(GroupMember.user_id)
+                    .filter(GroupMember.group_id == group_id)
+                    .subquery()
+                )
+                query = query.filter(ChatMessage.user_id.in_(group_users))
+
+            results = query.group_by(ChatMessage.chat_id).all()
+            return {row.chat_id: row.count for row in results}
+
+    def get_daily_message_counts_by_model(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        group_id: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, dict[str, int]]:
+        """Get message counts grouped by day and model."""
+        with get_db_context(db) as db:
+            from datetime import datetime, timedelta
+            from open_webui.models.groups import GroupMember
+
+            query = db.query(ChatMessage.created_at, ChatMessage.model_id).filter(
+                ChatMessage.role == "assistant",
+                ChatMessage.model_id.isnot(None),
+                ~ChatMessage.user_id.like("shared-%"),
+            )
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+            if group_id:
+                group_users = (
+                    db.query(GroupMember.user_id)
+                    .filter(GroupMember.group_id == group_id)
+                    .subquery()
+                )
+                query = query.filter(ChatMessage.user_id.in_(group_users))
+
+            results = query.all()
+
+            # Group by date -> model -> count
+            daily_counts: dict[str, dict[str, int]] = {}
+            for timestamp, model_id in results:
+                date_str = datetime.fromtimestamp(
+                    _normalize_timestamp(timestamp)
+                ).strftime("%Y-%m-%d")
+                if date_str not in daily_counts:
+                    daily_counts[date_str] = {}
+                daily_counts[date_str][model_id] = (
+                    daily_counts[date_str].get(model_id, 0) + 1
+                )
+
+            # Fill in missing days
+            if start_date and end_date:
+                current = datetime.fromtimestamp(_normalize_timestamp(start_date))
+                end_dt = datetime.fromtimestamp(_normalize_timestamp(end_date))
+                while current <= end_dt:
+                    date_str = current.strftime("%Y-%m-%d")
+                    if date_str not in daily_counts:
+                        daily_counts[date_str] = {}
+                    current += timedelta(days=1)
+
+            return daily_counts
+
+    def get_hourly_message_counts_by_model(
+        self,
+        start_date: Optional[int] = None,
+        end_date: Optional[int] = None,
+        db: Optional[Session] = None,
+    ) -> dict[str, dict[str, int]]:
+        """Get message counts grouped by hour and model."""
+        with get_db_context(db) as db:
+            from datetime import datetime, timedelta
+
+            query = db.query(ChatMessage.created_at, ChatMessage.model_id).filter(
+                ChatMessage.role == "assistant",
+                ChatMessage.model_id.isnot(None),
+                ~ChatMessage.user_id.like("shared-%"),
+            )
+
+            if start_date:
+                query = query.filter(ChatMessage.created_at >= start_date)
+            if end_date:
+                query = query.filter(ChatMessage.created_at <= end_date)
+
+            results = query.all()
+
+            # Group by hour -> model -> count
+            hourly_counts: dict[str, dict[str, int]] = {}
+            for timestamp, model_id in results:
+                hour_str = datetime.fromtimestamp(
+                    _normalize_timestamp(timestamp)
+                ).strftime("%Y-%m-%d %H:00")
+                if hour_str not in hourly_counts:
+                    hourly_counts[hour_str] = {}
+                hourly_counts[hour_str][model_id] = (
+                    hourly_counts[hour_str].get(model_id, 0) + 1
+                )
+
+            # Fill in missing hours
+            if start_date and end_date:
+                current = datetime.fromtimestamp(
+                    _normalize_timestamp(start_date)
+                ).replace(minute=0, second=0, microsecond=0)
+                end_dt = datetime.fromtimestamp(_normalize_timestamp(end_date))
+                while current <= end_dt:
+                    hour_str = current.strftime("%Y-%m-%d %H:00")
+                    if hour_str not in hourly_counts:
+                        hourly_counts[hour_str] = {}
+                    current += timedelta(hours=1)
+
+            return hourly_counts
+
+
+ChatMessages = ChatMessageTable()

backend/open_webui/models/feedbacks.py

@@ -3,15 +3,14 @@ import time
 import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
-from open_webui.models.chats import Chats
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from open_webui.models.users import User
 
-from open_webui.env import SRC_LOG_LEVELS
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, Text, JSON, Boolean
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 
 ####################
@@ -21,7 +20,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 class Feedback(Base):
     __tablename__ = "feedback"
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
     user_id = Column(Text)
     version = Column(BigInteger, default=0)
     type = Column(Text)
@@ -62,6 +61,20 @@ class FeedbackResponse(BaseModel):
     updated_at: int
 
 
+class FeedbackIdResponse(BaseModel):
+    id: str
+    user_id: str
+    created_at: int
+    updated_at: int
+
+
+class LeaderboardFeedbackData(BaseModel):
+    """Minimal feedback data for leaderboard computation (excludes snapshot/meta)."""
+
+    id: str
+    data: Optional[dict] = None
+
+
 class RatingData(BaseModel):
     rating: Optional[str | int] = None
     model_id: Optional[str] = None
@@ -92,11 +105,44 @@ class FeedbackForm(BaseModel):
     model_config = ConfigDict(extra="allow")
 
 
+class UserResponse(BaseModel):
+    id: str
+    name: str
+    email: str
+    role: str = "pending"
+
+    last_active_at: int  # timestamp in epoch
+    updated_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class FeedbackUserResponse(FeedbackResponse):
+    user: Optional[UserResponse] = None
+
+
+class FeedbackListResponse(BaseModel):
+    items: list[FeedbackUserResponse]
+    total: int
+
+
+class ModelHistoryEntry(BaseModel):
+    date: str
+    won: int
+    lost: int
+
+
+class ModelHistoryResponse(BaseModel):
+    model_id: str
+    history: list[ModelHistoryEntry]
+
+
 class FeedbackTable:
     def insert_new_feedback(
-        self, user_id: str, form_data: FeedbackForm
+        self, user_id: str, form_data: FeedbackForm, db: Optional[Session] = None
     ) -> Optional[FeedbackModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             id = str(uuid.uuid4())
             feedback = FeedbackModel(
                 **{
@@ -121,9 +167,11 @@ class FeedbackTable:
                 log.exception(f"Error creating a new feedback: {e}")
                 return None
 
-    def get_feedback_by_id(self, id: str) -> Optional[FeedbackModel]:
+    def get_feedback_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[FeedbackModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 feedback = db.query(Feedback).filter_by(id=id).first()
                 if not feedback:
                     return None
@@ -132,10 +180,10 @@ class FeedbackTable:
             return None
 
     def get_feedback_by_id_and_user_id(
-        self, id: str, user_id: str
+        self, id: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[FeedbackModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
                 if not feedback:
                     return None
@@ -143,8 +191,93 @@ class FeedbackTable:
         except Exception:
             return None
 
-    def get_all_feedbacks(self) -> list[FeedbackModel]:
-        with get_db() as db:
+    def get_feedbacks_by_chat_id(
+        self, chat_id: str, db: Optional[Session] = None
+    ) -> list[FeedbackModel]:
+        """Get all feedbacks for a specific chat."""
+        try:
+            with get_db_context(db) as db:
+                # meta.chat_id stores the chat reference
+                feedbacks = (
+                    db.query(Feedback)
+                    .filter(Feedback.meta["chat_id"].as_string() == chat_id)
+                    .order_by(Feedback.created_at.desc())
+                    .all()
+                )
+                return [FeedbackModel.model_validate(fb) for fb in feedbacks]
+        except Exception:
+            return []
+
+    def get_feedback_items(
+        self,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> FeedbackListResponse:
+        with get_db_context(db) as db:
+            query = db.query(Feedback, User).join(User, Feedback.user_id == User.id)
+
+            if filter:
+                order_by = filter.get("order_by")
+                direction = filter.get("direction")
+
+                if order_by == "username":
+                    if direction == "asc":
+                        query = query.order_by(User.name.asc())
+                    else:
+                        query = query.order_by(User.name.desc())
+                elif order_by == "model_id":
+                    # it's stored in feedback.data['model_id']
+                    if direction == "asc":
+                        query = query.order_by(
+                            Feedback.data["model_id"].as_string().asc()
+                        )
+                    else:
+                        query = query.order_by(
+                            Feedback.data["model_id"].as_string().desc()
+                        )
+                elif order_by == "rating":
+                    # it's stored in feedback.data['rating']
+                    if direction == "asc":
+                        query = query.order_by(
+                            Feedback.data["rating"].as_string().asc()
+                        )
+                    else:
+                        query = query.order_by(
+                            Feedback.data["rating"].as_string().desc()
+                        )
+                elif order_by == "updated_at":
+                    if direction == "asc":
+                        query = query.order_by(Feedback.updated_at.asc())
+                    else:
+                        query = query.order_by(Feedback.updated_at.desc())
+
+            else:
+                query = query.order_by(Feedback.created_at.desc())
+
+            # Count BEFORE pagination
+            total = query.count()
+
+            if skip:
+                query = query.offset(skip)
+            if limit:
+                query = query.limit(limit)
+
+            items = query.all()
+
+            feedbacks = []
+            for feedback, user in items:
+                feedback_model = FeedbackModel.model_validate(feedback)
+                user_model = UserResponse.model_validate(user)
+                feedbacks.append(
+                    FeedbackUserResponse(**feedback_model.model_dump(), user=user_model)
+                )
+
+            return FeedbackListResponse(items=feedbacks, total=total)
+
+    def get_all_feedbacks(self, db: Optional[Session] = None) -> list[FeedbackModel]:
+        with get_db_context(db) as db:
             return [
                 FeedbackModel.model_validate(feedback)
                 for feedback in db.query(Feedback)
@@ -152,8 +285,110 @@ class FeedbackTable:
                 .all()
             ]
 
-    def get_feedbacks_by_type(self, type: str) -> list[FeedbackModel]:
-        with get_db() as db:
+    def get_all_feedback_ids(
+        self, db: Optional[Session] = None
+    ) -> list[FeedbackIdResponse]:
+        with get_db_context(db) as db:
+            return [
+                FeedbackIdResponse(
+                    id=row.id,
+                    user_id=row.user_id,
+                    created_at=row.created_at,
+                    updated_at=row.updated_at,
+                )
+                for row in db.query(
+                    Feedback.id,
+                    Feedback.user_id,
+                    Feedback.created_at,
+                    Feedback.updated_at,
+                )
+                .order_by(Feedback.updated_at.desc())
+                .all()
+            ]
+
+    def get_feedbacks_for_leaderboard(
+        self, db: Optional[Session] = None
+    ) -> list[LeaderboardFeedbackData]:
+        """Fetch only id and data for leaderboard computation (excludes snapshot/meta)."""
+        with get_db_context(db) as db:
+            return [
+                LeaderboardFeedbackData(id=row.id, data=row.data)
+                for row in db.query(Feedback.id, Feedback.data).all()
+            ]
+
+    def get_model_evaluation_history(
+        self, model_id: str, days: int = 30, db: Optional[Session] = None
+    ) -> list[ModelHistoryEntry]:
+        """
+        Get daily wins/losses for a specific model over the past N days.
+        If days=0, returns all time data starting from first feedback.
+        Returns: [{"date": "2026-01-08", "won": 5, "lost": 2}, ...]
+        """
+        from datetime import datetime, timedelta
+        from collections import defaultdict
+
+        with get_db_context(db) as db:
+            if days == 0:
+                # All time - no cutoff
+                rows = db.query(Feedback.created_at, Feedback.data).all()
+            else:
+                cutoff = int(time.time()) - (days * 86400)
+                rows = (
+                    db.query(Feedback.created_at, Feedback.data)
+                    .filter(Feedback.created_at >= cutoff)
+                    .all()
+                )
+
+        daily_counts = defaultdict(lambda: {"won": 0, "lost": 0})
+        first_date = None
+
+        for created_at, data in rows:
+            if not data:
+                continue
+            if data.get("model_id") != model_id:
+                continue
+
+            rating_str = str(data.get("rating", ""))
+            if rating_str not in ("1", "-1"):
+                continue
+
+            date_str = datetime.fromtimestamp(created_at).strftime("%Y-%m-%d")
+            if rating_str == "1":
+                daily_counts[date_str]["won"] += 1
+            else:
+                daily_counts[date_str]["lost"] += 1
+
+            # Track first date for this model
+            if first_date is None or date_str < first_date:
+                first_date = date_str
+
+        # Generate date range
+        result = []
+        today = datetime.now().date()
+
+        if days == 0 and first_date:
+            # All time: start from first feedback date
+            start_date = datetime.strptime(first_date, "%Y-%m-%d").date()
+            num_days = (today - start_date).days + 1
+        else:
+            # Fixed range
+            num_days = days
+            start_date = today - timedelta(days=days - 1)
+
+        for i in range(num_days):
+            d = start_date + timedelta(days=i)
+            date_str = d.strftime("%Y-%m-%d")
+            counts = daily_counts.get(date_str, {"won": 0, "lost": 0})
+            result.append(
+                ModelHistoryEntry(date=date_str, won=counts["won"], lost=counts["lost"])
+            )
+
+        return result
+
+    def get_feedbacks_by_type(
+        self, type: str, db: Optional[Session] = None
+    ) -> list[FeedbackModel]:
+        with get_db_context(db) as db:
             return [
                 FeedbackModel.model_validate(feedback)
                 for feedback in db.query(Feedback)
@@ -162,8 +397,10 @@ class FeedbackTable:
                 .all()
             ]
 
-    def get_feedbacks_by_user_id(self, user_id: str) -> list[FeedbackModel]:
-        with get_db() as db:
+    def get_feedbacks_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[FeedbackModel]:
+        with get_db_context(db) as db:
             return [
                 FeedbackModel.model_validate(feedback)
                 for feedback in db.query(Feedback)
@@ -173,9 +410,9 @@ class FeedbackTable:
             ]
 
     def update_feedback_by_id(
-        self, id: str, form_data: FeedbackForm
+        self, id: str, form_data: FeedbackForm, db: Optional[Session] = None
     ) -> Optional[FeedbackModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             feedback = db.query(Feedback).filter_by(id=id).first()
             if not feedback:
                 return None
@@ -193,9 +430,13 @@ class FeedbackTable:
             return FeedbackModel.model_validate(feedback)
 
     def update_feedback_by_id_and_user_id(
-        self, id: str, user_id: str, form_data: FeedbackForm
+        self,
+        id: str,
+        user_id: str,
+        form_data: FeedbackForm,
+        db: Optional[Session] = None,
     ) -> Optional[FeedbackModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
             if not feedback:
                 return None
@@ -212,8 +453,8 @@ class FeedbackTable:
             db.commit()
             return FeedbackModel.model_validate(feedback)
 
-    def delete_feedback_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_feedback_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             feedback = db.query(Feedback).filter_by(id=id).first()
             if not feedback:
                 return False
@@ -221,8 +462,10 @@ class FeedbackTable:
             db.commit()
             return True
 
-    def delete_feedback_by_id_and_user_id(self, id: str, user_id: str) -> bool:
-        with get_db() as db:
+    def delete_feedback_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
             feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
             if not feedback:
                 return False
@@ -230,25 +473,19 @@ class FeedbackTable:
             db.commit()
             return True
 
-    def delete_feedbacks_by_user_id(self, user_id: str) -> bool:
-        with get_db() as db:
-            feedbacks = db.query(Feedback).filter_by(user_id=user_id).all()
-            if not feedbacks:
-                return False
-            for feedback in feedbacks:
-                db.delete(feedback)
+    def delete_feedbacks_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
+            result = db.query(Feedback).filter_by(user_id=user_id).delete()
             db.commit()
-            return True
+            return result > 0
 
-    def delete_all_feedbacks(self) -> bool:
-        with get_db() as db:
-            feedbacks = db.query(Feedback).all()
-            if not feedbacks:
-                return False
-            for feedback in feedbacks:
-                db.delete(feedback)
+    def delete_all_feedbacks(self, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
+            result = db.query(Feedback).delete()
             db.commit()
-            return True
+            return result > 0
 
 
 Feedbacks = FeedbackTable()

backend/open_webui/models/files.py

@@ -2,13 +2,12 @@ import logging
 import time
 from typing import Optional
 
-from open_webui.internal.db import Base, JSONField, get_db
-from open_webui.env import SRC_LOG_LEVELS
-from pydantic import BaseModel, ConfigDict
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from pydantic import BaseModel, ConfigDict, model_validator
 from sqlalchemy import BigInteger, Column, String, Text, JSON
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # Files DB Schema
@@ -17,7 +16,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 class File(Base):
     __tablename__ = "file"
-    id = Column(String, primary_key=True)
+    id = Column(String, primary_key=True, unique=True)
     user_id = Column(String)
     hash = Column(Text, nullable=True)
 
@@ -27,8 +26,6 @@ class File(Base):
     data = Column(JSON, nullable=True)
     meta = Column(JSON, nullable=True)
 
-    access_control = Column(JSON, nullable=True)
-
     created_at = Column(BigInteger)
     updated_at = Column(BigInteger)
 
@@ -46,8 +43,6 @@ class FileModel(BaseModel):
     data: Optional[dict] = None
     meta: Optional[dict] = None
 
-    access_control: Optional[dict] = None
-
     created_at: Optional[int]  # timestamp in epoch
     updated_at: Optional[int]  # timestamp in epoch
 
@@ -64,6 +59,25 @@ class FileMeta(BaseModel):
 
     model_config = ConfigDict(extra="allow")
 
+    @model_validator(mode="before")
+    @classmethod
+    def sanitize_meta(cls, data):
+        """Sanitize metadata fields to handle malformed legacy data."""
+        if not isinstance(data, dict):
+            return data
+
+        # Handle content_type that may be a list like ['application/pdf', None]
+        content_type = data.get("content_type")
+        if isinstance(content_type, list):
+            # Extract first non-None string value
+            data["content_type"] = next(
+                (item for item in content_type if isinstance(item, str)), None
+            )
+        elif content_type is not None and not isinstance(content_type, str):
+            data["content_type"] = None
+
+        return data
+
 
 class FileModelResponse(BaseModel):
     id: str
@@ -75,14 +89,15 @@ class FileModelResponse(BaseModel):
     meta: FileMeta
 
     created_at: int  # timestamp in epoch
-    updated_at: int  # timestamp in epoch
+    updated_at: Optional[int] = None  # timestamp in epoch, optional for legacy files
 
     model_config = ConfigDict(extra="allow")
 
 
 class FileMetadataResponse(BaseModel):
     id: str
-    meta: dict
+    hash: Optional[str] = None
+    meta: Optional[dict] = None
     created_at: int  # timestamp in epoch
     updated_at: int  # timestamp in epoch
 
@@ -94,12 +109,24 @@ class FileForm(BaseModel):
     path: str
     data: dict = {}
     meta: dict = {}
-    access_control: Optional[dict] = None
+
+
+class FileUpdateForm(BaseModel):
+    hash: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+
+
+class FileListResponse(BaseModel):
+    items: list[FileModel]
+    total: int
 
 
 class FilesTable:
-    def insert_new_file(self, user_id: str, form_data: FileForm) -> Optional[FileModel]:
-        with get_db() as db:
+    def insert_new_file(
+        self, user_id: str, form_data: FileForm, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
             file = FileModel(
                 **{
                     **form_data.model_dump(),
@@ -122,20 +149,41 @@ class FilesTable:
                 log.exception(f"Error inserting a new file: {e}")
                 return None
 
-    def get_file_by_id(self, id: str) -> Optional[FileModel]:
-        with get_db() as db:
+    def get_file_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        try:
+            with get_db_context(db) as db:
+                try:
+                    file = db.get(File, id)
+                    return FileModel.model_validate(file)
+                except Exception:
+                    return None
+        except Exception:
+            return None
+
+    def get_file_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
             try:
-                file = db.get(File, id)
-                return FileModel.model_validate(file)
+                file = db.query(File).filter_by(id=id, user_id=user_id).first()
+                if file:
+                    return FileModel.model_validate(file)
+                else:
+                    return None
             except Exception:
                 return None
 
-    def get_file_metadata_by_id(self, id: str) -> Optional[FileMetadataResponse]:
-        with get_db() as db:
+    def get_file_metadata_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[FileMetadataResponse]:
+        with get_db_context(db) as db:
             try:
                 file = db.get(File, id)
                 return FileMetadataResponse(
                     id=file.id,
+                    hash=file.hash,
                     meta=file.meta,
                     created_at=file.created_at,
                     updated_at=file.updated_at,
@@ -143,12 +191,25 @@ class FilesTable:
             except Exception:
                 return None
 
-    def get_files(self) -> list[FileModel]:
-        with get_db() as db:
+    def get_files(self, db: Optional[Session] = None) -> list[FileModel]:
+        with get_db_context(db) as db:
             return [FileModel.model_validate(file) for file in db.query(File).all()]
 
-    def get_files_by_ids(self, ids: list[str]) -> list[FileModel]:
-        with get_db() as db:
+    def check_access_by_user_id(
+        self, id, user_id, permission="write", db: Optional[Session] = None
+    ) -> bool:
+        file = self.get_file_by_id(id, db=db)
+        if not file:
+            return False
+        if file.user_id == user_id:
+            return True
+        # Implement additional access control logic here as needed
+        return False
+
+    def get_files_by_ids(
+        self, ids: list[str], db: Optional[Session] = None
+    ) -> list[FileModel]:
+        with get_db_context(db) as db:
             return [
                 FileModel.model_validate(file)
                 for file in db.query(File)
@@ -157,62 +218,165 @@ class FilesTable:
                 .all()
             ]
 
-    def get_file_metadatas_by_ids(self, ids: list[str]) -> list[FileMetadataResponse]:
-        with get_db() as db:
+    def get_file_metadatas_by_ids(
+        self, ids: list[str], db: Optional[Session] = None
+    ) -> list[FileMetadataResponse]:
+        with get_db_context(db) as db:
             return [
                 FileMetadataResponse(
                     id=file.id,
+                    hash=file.hash,
                     meta=file.meta,
                     created_at=file.created_at,
                     updated_at=file.updated_at,
                 )
-                for file in db.query(File)
+                for file in db.query(
+                    File.id, File.hash, File.meta, File.created_at, File.updated_at
+                )
                 .filter(File.id.in_(ids))
                 .order_by(File.updated_at.desc())
                 .all()
             ]
 
-    def get_files_by_user_id(self, user_id: str) -> list[FileModel]:
-        with get_db() as db:
+    def get_files_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[FileModel]:
+        with get_db_context(db) as db:
             return [
                 FileModel.model_validate(file)
                 for file in db.query(File).filter_by(user_id=user_id).all()
             ]
 
-    def update_file_hash_by_id(self, id: str, hash: str) -> Optional[FileModel]:
-        with get_db() as db:
+    @staticmethod
+    def _glob_to_like_pattern(glob: str) -> str:
+        """
+        Convert a glob/fnmatch pattern to a SQL LIKE pattern.
+
+        Escapes SQL special characters and converts glob wildcards:
+        - `*` becomes `%` (match any sequence of characters)
+        - `?` becomes `_` (match exactly one character)
+
+        Args:
+            glob: A glob pattern (e.g., "*.txt", "file?.doc")
+
+        Returns:
+            A SQL LIKE compatible pattern with proper escaping.
+        """
+        # Escape SQL special characters first, then convert glob wildcards
+        pattern = glob.replace("\\", "\\\\")
+        pattern = pattern.replace("%", "\\%")
+        pattern = pattern.replace("_", "\\_")
+        pattern = pattern.replace("*", "%")
+        pattern = pattern.replace("?", "_")
+        return pattern
+
+    def search_files(
+        self,
+        user_id: Optional[str] = None,
+        filename: str = "*",
+        skip: int = 0,
+        limit: int = 100,
+        db: Optional[Session] = None,
+    ) -> list[FileModel]:
+        """
+        Search files with glob pattern matching, optional user filter, and pagination.
+
+        Args:
+            user_id: Filter by user ID. If None, returns files for all users.
+            filename: Glob pattern to match filenames (e.g., "*.txt"). Default "*" matches all.
+            skip: Number of results to skip for pagination.
+            limit: Maximum number of results to return.
+            db: Optional database session.
+
+        Returns:
+            List of matching FileModel objects, ordered by updated_at descending.
+        """
+        with get_db_context(db) as db:
+            query = db.query(File)
+
+            if user_id:
+                query = query.filter_by(user_id=user_id)
+
+            pattern = self._glob_to_like_pattern(filename)
+            if pattern != "%":
+                query = query.filter(File.filename.ilike(pattern, escape="\\"))
+
+            return [
+                FileModel.model_validate(file)
+                for file in query.order_by(File.updated_at.desc())
+                .offset(skip)
+                .limit(limit)
+                .all()
+            ]
+
+    def update_file_by_id(
+        self, id: str, form_data: FileUpdateForm, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
+            try:
+                file = db.query(File).filter_by(id=id).first()
+
+                if form_data.hash is not None:
+                    file.hash = form_data.hash
+
+                if form_data.data is not None:
+                    file.data = {**(file.data if file.data else {}), **form_data.data}
+
+                if form_data.meta is not None:
+                    file.meta = {**(file.meta if file.meta else {}), **form_data.meta}
+
+                file.updated_at = int(time.time())
+                db.commit()
+                return FileModel.model_validate(file)
+            except Exception as e:
+                log.exception(f"Error updating file completely by id: {e}")
+                return None
+
+    def update_file_hash_by_id(
+        self, id: str, hash: Optional[str], db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
             try:
                 file = db.query(File).filter_by(id=id).first()
                 file.hash = hash
+                file.updated_at = int(time.time())
                 db.commit()
 
                 return FileModel.model_validate(file)
             except Exception:
                 return None
 
-    def update_file_data_by_id(self, id: str, data: dict) -> Optional[FileModel]:
-        with get_db() as db:
+    def update_file_data_by_id(
+        self, id: str, data: dict, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
             try:
                 file = db.query(File).filter_by(id=id).first()
                 file.data = {**(file.data if file.data else {}), **data}
+                file.updated_at = int(time.time())
                 db.commit()
                 return FileModel.model_validate(file)
             except Exception as e:
 
                 return None
 
-    def update_file_metadata_by_id(self, id: str, meta: dict) -> Optional[FileModel]:
-        with get_db() as db:
+    def update_file_metadata_by_id(
+        self, id: str, meta: dict, db: Optional[Session] = None
+    ) -> Optional[FileModel]:
+        with get_db_context(db) as db:
             try:
                 file = db.query(File).filter_by(id=id).first()
                 file.meta = {**(file.meta if file.meta else {}), **meta}
+                file.updated_at = int(time.time())
                 db.commit()
                 return FileModel.model_validate(file)
             except Exception:
                 return None
 
-    def delete_file_by_id(self, id: str) -> bool:
-        with get_db() as db:
+                return False
+
+    def delete_file_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(File).filter_by(id=id).delete()
                 db.commit()
@@ -221,8 +385,8 @@ class FilesTable:
             except Exception:
                 return False
 
-    def delete_all_files(self) -> bool:
-        with get_db() as db:
+    def delete_all_files(self, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(File).delete()
                 db.commit()

backend/open_webui/models/folders.py

@@ -7,13 +7,11 @@ import re
 
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, Text, JSON, Boolean, func
+from sqlalchemy.orm import Session
 
-from open_webui.internal.db import Base, get_db
-from open_webui.env import SRC_LOG_LEVELS
-
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 
 ####################
@@ -23,7 +21,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 class Folder(Base):
     __tablename__ = "folder"
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
     parent_id = Column(Text, nullable=True)
     user_id = Column(Text)
     name = Column(Text)
@@ -50,6 +48,20 @@ class FolderModel(BaseModel):
     model_config = ConfigDict(from_attributes=True)
 
 
+class FolderMetadataResponse(BaseModel):
+    icon: Optional[str] = None
+
+
+class FolderNameIdResponse(BaseModel):
+    id: str
+    name: str
+    meta: Optional[FolderMetadataResponse] = None
+    parent_id: Optional[str] = None
+    is_expanded: bool = False
+    created_at: int
+    updated_at: int
+
+
 ####################
 # Forms
 ####################
@@ -58,14 +70,26 @@ class FolderModel(BaseModel):
 class FolderForm(BaseModel):
     name: str
     data: Optional[dict] = None
+    meta: Optional[dict] = None
+    model_config = ConfigDict(extra="allow")
+
+
+class FolderUpdateForm(BaseModel):
+    name: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
     model_config = ConfigDict(extra="allow")
 
 
 class FolderTable:
     def insert_new_folder(
-        self, user_id: str, form_data: FolderForm, parent_id: Optional[str] = None
+        self,
+        user_id: str,
+        form_data: FolderForm,
+        parent_id: Optional[str] = None,
+        db: Optional[Session] = None,
     ) -> Optional[FolderModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             id = str(uuid.uuid4())
             folder = FolderModel(
                 **{
@@ -91,10 +115,10 @@ class FolderTable:
                 return None
 
     def get_folder_by_id_and_user_id(
-        self, id: str, user_id: str
+        self, id: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[FolderModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
 
                 if not folder:
@@ -105,15 +129,15 @@ class FolderTable:
             return None
 
     def get_children_folders_by_id_and_user_id(
-        self, id: str, user_id: str
+        self, id: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[list[FolderModel]]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folders = []
 
                 def get_children(folder):
                     children = self.get_folders_by_parent_id_and_user_id(
-                        folder.id, user_id
+                        folder.id, user_id, db=db
                     )
                     for child in children:
                         get_children(child)
@@ -128,18 +152,24 @@ class FolderTable:
         except Exception:
             return None
 
-    def get_folders_by_user_id(self, user_id: str) -> list[FolderModel]:
-        with get_db() as db:
+    def get_folders_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[FolderModel]:
+        with get_db_context(db) as db:
             return [
                 FolderModel.model_validate(folder)
                 for folder in db.query(Folder).filter_by(user_id=user_id).all()
             ]
 
     def get_folder_by_parent_id_and_user_id_and_name(
-        self, parent_id: Optional[str], user_id: str, name: str
+        self,
+        parent_id: Optional[str],
+        user_id: str,
+        name: str,
+        db: Optional[Session] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 # Check if folder exists
                 folder = (
                     db.query(Folder)
@@ -157,9 +187,9 @@ class FolderTable:
             return None
 
     def get_folders_by_parent_id_and_user_id(
-        self, parent_id: Optional[str], user_id: str
+        self, parent_id: Optional[str], user_id: str, db: Optional[Session] = None
     ) -> list[FolderModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             return [
                 FolderModel.model_validate(folder)
                 for folder in db.query(Folder)
@@ -172,9 +202,10 @@ class FolderTable:
         id: str,
         user_id: str,
         parent_id: str,
+        db: Optional[Session] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
 
                 if not folder:
@@ -191,10 +222,14 @@ class FolderTable:
             return
 
     def update_folder_by_id_and_user_id(
-        self, id: str, user_id: str, form_data: FolderForm
+        self,
+        id: str,
+        user_id: str,
+        form_data: FolderUpdateForm,
+        db: Optional[Session] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
 
                 if not folder:
@@ -222,8 +257,13 @@ class FolderTable:
                         **form_data["data"],
                     }
 
-                folder.updated_at = int(time.time())
+                if "meta" in form_data:
+                    folder.meta = {
+                        **(folder.meta or {}),
+                        **form_data["meta"],
+                    }
 
+                folder.updated_at = int(time.time())
                 db.commit()
 
                 return FolderModel.model_validate(folder)
@@ -232,10 +272,10 @@ class FolderTable:
             return
 
     def update_folder_is_expanded_by_id_and_user_id(
-        self, id: str, user_id: str, is_expanded: bool
+        self, id: str, user_id: str, is_expanded: bool, db: Optional[Session] = None
     ) -> Optional[FolderModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
 
                 if not folder:
@@ -251,10 +291,12 @@ class FolderTable:
             log.error(f"update_folder: {e}")
             return
 
-    def delete_folder_by_id_and_user_id(self, id: str, user_id: str) -> list[str]:
+    def delete_folder_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[Session] = None
+    ) -> list[str]:
         try:
             folder_ids = []
-            with get_db() as db:
+            with get_db_context(db) as db:
                 folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
                 if not folder:
                     return folder_ids
@@ -264,7 +306,7 @@ class FolderTable:
                 # Delete all children folders
                 def delete_children(folder):
                     folder_children = self.get_folders_by_parent_id_and_user_id(
-                        folder.id, user_id
+                        folder.id, user_id, db=db
                     )
                     for folder_child in folder_children:
 
@@ -289,7 +331,7 @@ class FolderTable:
         return name.strip().lower()
 
     def search_folders_by_names(
-        self, user_id: str, queries: list[str]
+        self, user_id: str, queries: list[str], db: Optional[Session] = None
     ) -> list[FolderModel]:
         """
         Search for folders for a user where the name matches any of the queries, treating _ and space as equivalent, case-insensitive.
@@ -299,7 +341,7 @@ class FolderTable:
             return []
 
         results = {}
-        with get_db() as db:
+        with get_db_context(db) as db:
             folders = db.query(Folder).filter_by(user_id=user_id).all()
             for folder in folders:
                 if self.normalize_folder_name(folder.name) in normalized_queries:
@@ -307,7 +349,7 @@ class FolderTable:
 
                     # get children folders
                     children = self.get_children_folders_by_id_and_user_id(
-                        folder.id, user_id
+                        folder.id, user_id, db=db
                     )
                     for child in children:
                         results[child.id] = child
@@ -320,14 +362,14 @@ class FolderTable:
             return results
 
     def search_folders_by_name_contains(
-        self, user_id: str, query: str
+        self, user_id: str, query: str, db: Optional[Session] = None
     ) -> list[FolderModel]:
         """
         Partial match: normalized name contains (as substring) the normalized query.
         """
         normalized_query = self.normalize_folder_name(query)
         results = []
-        with get_db() as db:
+        with get_db_context(db) as db:
             folders = db.query(Folder).filter_by(user_id=user_id).all()
             for folder in folders:
                 norm_name = self.normalize_folder_name(folder.name)

backend/open_webui/models/functions.py

@@ -2,14 +2,13 @@ import logging
 import time
 from typing import Optional
 
-from open_webui.internal.db import Base, JSONField, get_db
-from open_webui.models.users import Users
-from open_webui.env import SRC_LOG_LEVELS
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from open_webui.models.users import Users, UserModel
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Boolean, Column, String, Text, Index
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # Functions DB Schema
@@ -19,7 +18,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 class Function(Base):
     __tablename__ = "function"
 
-    id = Column(String, primary_key=True)
+    id = Column(String, primary_key=True, unique=True)
     user_id = Column(String)
     name = Column(Text)
     type = Column(Text)
@@ -37,6 +36,7 @@ class Function(Base):
 class FunctionMeta(BaseModel):
     description: Optional[str] = None
     manifest: Optional[dict] = {}
+    model_config = ConfigDict(extra="allow")
 
 
 class FunctionModel(BaseModel):
@@ -54,11 +54,31 @@ class FunctionModel(BaseModel):
     model_config = ConfigDict(from_attributes=True)
 
 
+class FunctionWithValvesModel(BaseModel):
+    id: str
+    user_id: str
+    name: str
+    type: str
+    content: str
+    meta: FunctionMeta
+    valves: Optional[dict] = None
+    is_active: bool = False
+    is_global: bool = False
+    updated_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
+
 ####################
 # Forms
 ####################
 
 
+class FunctionUserResponse(FunctionModel):
+    user: Optional[UserModel] = None
+
+
 class FunctionResponse(BaseModel):
     id: str
     user_id: str
@@ -84,7 +104,11 @@ class FunctionValves(BaseModel):
 
 class FunctionsTable:
     def insert_new_function(
-        self, user_id: str, type: str, form_data: FunctionForm
+        self,
+        user_id: str,
+        type: str,
+        form_data: FunctionForm,
+        db: Optional[Session] = None,
     ) -> Optional[FunctionModel]:
         function = FunctionModel(
             **{
@@ -97,7 +121,7 @@ class FunctionsTable:
         )
 
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 result = Function(**function.model_dump())
                 db.add(result)
                 db.commit()
@@ -111,11 +135,14 @@ class FunctionsTable:
             return None
 
     def sync_functions(
-        self, user_id: str, functions: list[FunctionModel]
-    ) -> list[FunctionModel]:
+        self,
+        user_id: str,
+        functions: list[FunctionWithValvesModel],
+        db: Optional[Session] = None,
+    ) -> list[FunctionWithValvesModel]:
         # Synchronize functions for a user by updating existing ones, inserting new ones, and removing those that are no longer present.
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 # Get existing functions
                 existing_functions = db.query(Function).all()
                 existing_ids = {func.id for func in existing_functions}
@@ -158,31 +185,83 @@ class FunctionsTable:
             log.exception(f"Error syncing functions for user {user_id}: {e}")
             return []
 
-    def get_function_by_id(self, id: str) -> Optional[FunctionModel]:
+    def get_function_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[FunctionModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 function = db.get(Function, id)
                 return FunctionModel.model_validate(function)
         except Exception:
             return None
 
-    def get_functions(self, active_only=False) -> list[FunctionModel]:
-        with get_db() as db:
+    def get_functions_by_ids(
+        self, ids: list[str], db: Optional[Session] = None
+    ) -> list[FunctionModel]:
+        """
+        Batch fetch multiple functions by their IDs in a single query.
+        Returns functions in the same order as the input IDs (None entries filtered out).
+        """
+        if not ids:
+            return []
+        try:
+            with get_db_context(db) as db:
+                functions = db.query(Function).filter(Function.id.in_(ids)).all()
+                # Create a dict for O(1) lookup
+                func_dict = {f.id: FunctionModel.model_validate(f) for f in functions}
+                # Return in original order, filtering out any not found
+                return [func_dict[id] for id in ids if id in func_dict]
+        except Exception:
+            return []
+
+    def get_functions(
+        self, active_only=False, include_valves=False, db: Optional[Session] = None
+    ) -> list[FunctionModel | FunctionWithValvesModel]:
+        with get_db_context(db) as db:
             if active_only:
+                functions = db.query(Function).filter_by(is_active=True).all()
+
+            else:
+                functions = db.query(Function).all()
+
+            if include_valves:
                 return [
-                    FunctionModel.model_validate(function)
-                    for function in db.query(Function).filter_by(is_active=True).all()
+                    FunctionWithValvesModel.model_validate(function)
+                    for function in functions
                 ]
             else:
                 return [
-                    FunctionModel.model_validate(function)
-                    for function in db.query(Function).all()
+                    FunctionModel.model_validate(function) for function in functions
                 ]
 
+    def get_function_list(
+        self, db: Optional[Session] = None
+    ) -> list[FunctionUserResponse]:
+        with get_db_context(db) as db:
+            functions = db.query(Function).order_by(Function.updated_at.desc()).all()
+            user_ids = list(set(func.user_id for func in functions))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
+            return [
+                FunctionUserResponse.model_validate(
+                    {
+                        **FunctionModel.model_validate(func).model_dump(),
+                        "user": (
+                            users_dict.get(func.user_id).model_dump()
+                            if func.user_id in users_dict
+                            else None
+                        ),
+                    }
+                )
+                for func in functions
+            ]
+
     def get_functions_by_type(
-        self, type: str, active_only=False
+        self, type: str, active_only=False, db: Optional[Session] = None
     ) -> list[FunctionModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             if active_only:
                 return [
                     FunctionModel.model_validate(function)
@@ -196,8 +275,10 @@ class FunctionsTable:
                     for function in db.query(Function).filter_by(type=type).all()
                 ]
 
-    def get_global_filter_functions(self) -> list[FunctionModel]:
-        with get_db() as db:
+    def get_global_filter_functions(
+        self, db: Optional[Session] = None
+    ) -> list[FunctionModel]:
+        with get_db_context(db) as db:
             return [
                 FunctionModel.model_validate(function)
                 for function in db.query(Function)
@@ -205,8 +286,10 @@ class FunctionsTable:
                 .all()
             ]
 
-    def get_global_action_functions(self) -> list[FunctionModel]:
-        with get_db() as db:
+    def get_global_action_functions(
+        self, db: Optional[Session] = None
+    ) -> list[FunctionModel]:
+        with get_db_context(db) as db:
             return [
                 FunctionModel.model_validate(function)
                 for function in db.query(Function)
@@ -214,8 +297,10 @@ class FunctionsTable:
                 .all()
             ]
 
-    def get_function_valves_by_id(self, id: str) -> Optional[dict]:
-        with get_db() as db:
+    def get_function_valves_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[dict]:
+        with get_db_context(db) as db:
             try:
                 function = db.get(Function, id)
                 return function.valves if function.valves else {}
@@ -224,24 +309,47 @@ class FunctionsTable:
                 return None
 
     def update_function_valves_by_id(
-        self, id: str, valves: dict
+        self, id: str, valves: dict, db: Optional[Session] = None
     ) -> Optional[FunctionValves]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             try:
                 function = db.get(Function, id)
                 function.valves = valves
                 function.updated_at = int(time.time())
                 db.commit()
                 db.refresh(function)
-                return self.get_function_by_id(id)
+                return FunctionModel.model_validate(function)
             except Exception:
                 return None
 
+    def update_function_metadata_by_id(
+        self, id: str, metadata: dict, db: Optional[Session] = None
+    ) -> Optional[FunctionModel]:
+        with get_db_context(db) as db:
+            try:
+                function = db.get(Function, id)
+
+                if function:
+                    if function.meta:
+                        function.meta = {**function.meta, **metadata}
+                    else:
+                        function.meta = metadata
+
+                    function.updated_at = int(time.time())
+                    db.commit()
+                    db.refresh(function)
+                    return FunctionModel.model_validate(function)
+                else:
+                    return None
+            except Exception as e:
+                log.exception(f"Error updating function metadata by id {id}: {e}")
+                return None
+
     def get_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str
+        self, id: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id)
+            user = Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "functions" and "valves" settings
@@ -256,10 +364,10 @@ class FunctionsTable:
             return None
 
     def update_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str, valves: dict
+        self, id: str, user_id: str, valves: dict, db: Optional[Session] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id)
+            user = Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "functions" and "valves" settings
@@ -271,7 +379,7 @@ class FunctionsTable:
             user_settings["functions"]["valves"][id] = valves
 
             # Update the user settings in the database
-            Users.update_user_by_id(user_id, {"settings": user_settings})
+            Users.update_user_by_id(user_id, {"settings": user_settings}, db=db)
 
             return user_settings["functions"]["valves"][id]
         except Exception as e:
@@ -280,8 +388,10 @@ class FunctionsTable:
             )
             return None
 
-    def update_function_by_id(self, id: str, updated: dict) -> Optional[FunctionModel]:
-        with get_db() as db:
+    def update_function_by_id(
+        self, id: str, updated: dict, db: Optional[Session] = None
+    ) -> Optional[FunctionModel]:
+        with get_db_context(db) as db:
             try:
                 db.query(Function).filter_by(id=id).update(
                     {
@@ -290,12 +400,13 @@ class FunctionsTable:
                     }
                 )
                 db.commit()
-                return self.get_function_by_id(id)
+                function = db.get(Function, id)
+                return FunctionModel.model_validate(function) if function else None
             except Exception:
                 return None
 
-    def deactivate_all_functions(self) -> Optional[bool]:
-        with get_db() as db:
+    def deactivate_all_functions(self, db: Optional[Session] = None) -> Optional[bool]:
+        with get_db_context(db) as db:
             try:
                 db.query(Function).update(
                     {
@@ -308,8 +419,8 @@ class FunctionsTable:
             except Exception:
                 return None
 
-    def delete_function_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_function_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(Function).filter_by(id=id).delete()
                 db.commit()

backend/open_webui/models/groups.py

@@ -4,18 +4,28 @@ import time
 from typing import Optional
 import uuid
 
-from open_webui.internal.db import Base, get_db
-from open_webui.env import SRC_LOG_LEVELS
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
 from open_webui.models.files import FileMetadataResponse
 
 
 from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, String, Text, JSON, func
-
+from sqlalchemy import (
+    BigInteger,
+    Column,
+    String,
+    Text,
+    JSON,
+    and_,
+    func,
+    ForeignKey,
+    cast,
+    or_,
+    select,
+)
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # UserGroup DB Schema
@@ -35,14 +45,12 @@ class Group(Base):
     meta = Column(JSON, nullable=True)
 
     permissions = Column(JSON, nullable=True)
-    user_ids = Column(JSON, nullable=True)
 
     created_at = Column(BigInteger)
     updated_at = Column(BigInteger)
 
 
 class GroupModel(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
     id: str
     user_id: str
 
@@ -53,49 +61,79 @@ class GroupModel(BaseModel):
     meta: Optional[dict] = None
 
     permissions: Optional[dict] = None
-    user_ids: list[str] = []
 
     created_at: int  # timestamp in epoch
     updated_at: int  # timestamp in epoch
 
+    model_config = ConfigDict(from_attributes=True)
+
+
+class GroupMember(Base):
+    __tablename__ = "group_member"
+
+    id = Column(Text, unique=True, primary_key=True)
+    group_id = Column(
+        Text,
+        ForeignKey("group.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    user_id = Column(Text, nullable=False)
+    created_at = Column(BigInteger, nullable=True)
+    updated_at = Column(BigInteger, nullable=True)
+
+
+class GroupMemberModel(BaseModel):
+    id: str
+    group_id: str
+    user_id: str
+    created_at: Optional[int] = None  # timestamp in epoch
+    updated_at: Optional[int] = None  # timestamp in epoch
+
 
 ####################
 # Forms
 ####################
 
 
-class GroupResponse(BaseModel):
+class GroupResponse(GroupModel):
+    member_count: Optional[int] = None
+
+
+class GroupInfoResponse(BaseModel):
     id: str
     user_id: str
     name: str
     description: str
-    permissions: Optional[dict] = None
-    data: Optional[dict] = None
-    meta: Optional[dict] = None
-    user_ids: list[str] = []
-    created_at: int  # timestamp in epoch
-    updated_at: int  # timestamp in epoch
+    member_count: Optional[int] = None
+    created_at: int
+    updated_at: int
 
 
 class GroupForm(BaseModel):
     name: str
     description: str
     permissions: Optional[dict] = None
+    data: Optional[dict] = None
 
 
 class UserIdsForm(BaseModel):
     user_ids: Optional[list[str]] = None
 
 
-class GroupUpdateForm(GroupForm, UserIdsForm):
+class GroupUpdateForm(GroupForm):
     pass
 
 
+class GroupListResponse(BaseModel):
+    items: list[GroupResponse] = []
+    total: int = 0
+
+
 class GroupTable:
     def insert_new_group(
-        self, user_id: str, form_data: GroupForm
+        self, user_id: str, form_data: GroupForm, db: Optional[Session] = None
     ) -> Optional[GroupModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             group = GroupModel(
                 **{
                     **form_data.model_dump(exclude_none=True),
@@ -119,48 +157,253 @@ class GroupTable:
             except Exception:
                 return None
 
-    def get_groups(self) -> list[GroupModel]:
-        with get_db() as db:
+    def get_all_groups(self, db: Optional[Session] = None) -> list[GroupModel]:
+        with get_db_context(db) as db:
+            groups = db.query(Group).order_by(Group.updated_at.desc()).all()
+            return [GroupModel.model_validate(group) for group in groups]
+
+    def get_groups(self, filter, db: Optional[Session] = None) -> list[GroupResponse]:
+        with get_db_context(db) as db:
+            query = db.query(Group)
+
+            if filter:
+                if "query" in filter:
+                    query = query.filter(Group.name.ilike(f"%{filter['query']}%"))
+
+                # When share filter is present, member check is handled in the share logic
+                if "share" in filter:
+                    share_value = filter["share"]
+                    member_id = filter.get("member_id")
+                    json_share = Group.data["config"]["share"]
+                    json_share_str = json_share.as_string()
+                    json_share_lower = func.lower(json_share_str)
+
+                    if share_value:
+                        # Groups open to anyone: data is null, config.share is null, or share is true
+                        # Use case-insensitive string comparison to handle variations like "True", "TRUE"
+                        # Handle potential JSON boolean to string casting issues by checking for both string 'true' and boolean equivalence if possible,
+                        anyone_can_share = or_(
+                            Group.data.is_(None),
+                            json_share_str.is_(None),
+                            json_share_lower == "true",
+                            json_share_lower == "1",  # Handle SQLite boolean true
+                        )
+
+                        if member_id:
+                            # Also include member-only groups where user is a member
+                            member_groups_select = select(GroupMember.group_id).where(
+                                GroupMember.user_id == member_id
+                            )
+                            members_only_and_is_member = and_(
+                                json_share_lower == "members",
+                                Group.id.in_(member_groups_select),
+                            )
+                            query = query.filter(
+                                or_(anyone_can_share, members_only_and_is_member)
+                            )
+                        else:
+                            query = query.filter(anyone_can_share)
+                    else:
+                        query = query.filter(
+                            and_(Group.data.isnot(None), json_share_lower == "false")
+                        )
+
+                else:
+                    # Only apply member_id filter when share filter is NOT present
+                    if "member_id" in filter:
+                        query = query.join(
+                            GroupMember, GroupMember.group_id == Group.id
+                        ).filter(GroupMember.user_id == filter["member_id"])
+
+            groups = query.order_by(Group.updated_at.desc()).all()
+            group_ids = [group.id for group in groups]
+            member_counts = self.get_group_member_counts_by_ids(group_ids, db=db)
             return [
-                GroupModel.model_validate(group)
-                for group in db.query(Group).order_by(Group.updated_at.desc()).all()
+                GroupResponse.model_validate(
+                    {
+                        **GroupModel.model_validate(group).model_dump(),
+                        "member_count": member_counts.get(group.id, 0),
+                    }
+                )
+                for group in groups
             ]
 
-    def get_groups_by_member_id(self, user_id: str) -> list[GroupModel]:
-        with get_db() as db:
+    def search_groups(
+        self,
+        filter: Optional[dict] = None,
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> GroupListResponse:
+        with get_db_context(db) as db:
+            query = db.query(Group)
+
+            if filter:
+                if "query" in filter:
+                    query = query.filter(Group.name.ilike(f"%{filter['query']}%"))
+                if "member_id" in filter:
+                    query = query.join(
+                        GroupMember, GroupMember.group_id == Group.id
+                    ).filter(GroupMember.user_id == filter["member_id"])
+
+                if "share" in filter:
+                    #  'share' is stored in data JSON, support both sqlite and postgres
+                    share_value = filter["share"]
+                    print("Filtering by share:", share_value)
+                    query = query.filter(
+                        Group.data.op("->>")("share") == str(share_value)
+                    )
+
+            total = query.count()
+            query = query.order_by(Group.updated_at.desc())
+            groups = query.offset(skip).limit(limit).all()
+            group_ids = [group.id for group in groups]
+            member_counts = self.get_group_member_counts_by_ids(group_ids, db=db)
+
+            return {
+                "items": [
+                    GroupResponse.model_validate(
+                        **GroupModel.model_validate(group).model_dump(),
+                        member_count=member_counts.get(group.id, 0),
+                    )
+                    for group in groups
+                ],
+                "total": total,
+            }
+
+    def get_groups_by_member_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[GroupModel]:
+        with get_db_context(db) as db:
             return [
                 GroupModel.model_validate(group)
                 for group in db.query(Group)
-                .filter(
-                    func.json_array_length(Group.user_ids) > 0
-                )  # Ensure array exists
-                .filter(
-                    Group.user_ids.cast(String).like(f'%"{user_id}"%')
-                )  # String-based check
+                .join(GroupMember, GroupMember.group_id == Group.id)
+                .filter(GroupMember.user_id == user_id)
                 .order_by(Group.updated_at.desc())
                 .all()
             ]
 
-    def get_group_by_id(self, id: str) -> Optional[GroupModel]:
+    def get_groups_by_member_ids(
+        self, user_ids: list[str], db: Optional[Session] = None
+    ) -> dict[str, list[GroupModel]]:
+        """Fetch groups for multiple users in a single query to avoid N+1."""
+        with get_db_context(db) as db:
+            # Query GroupMember joined with Group, filtering by user_ids
+            results = (
+                db.query(GroupMember.user_id, Group)
+                .join(Group, Group.id == GroupMember.group_id)
+                .filter(GroupMember.user_id.in_(user_ids))
+                .order_by(Group.updated_at.desc())
+                .all()
+            )
+
+            # Group groups by user_id
+            user_groups: dict[str, list[GroupModel]] = {uid: [] for uid in user_ids}
+            for user_id, group in results:
+                user_groups[user_id].append(GroupModel.model_validate(group))
+
+            return user_groups
+
+    def get_group_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[GroupModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 group = db.query(Group).filter_by(id=id).first()
                 return GroupModel.model_validate(group) if group else None
         except Exception:
             return None
 
-    def get_group_user_ids_by_id(self, id: str) -> Optional[str]:
-        group = self.get_group_by_id(id)
-        if group:
-            return group.user_ids
-        else:
-            return None
+    def get_group_user_ids_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> list[str]:
+        with get_db_context(db) as db:
+            members = (
+                db.query(GroupMember.user_id).filter(GroupMember.group_id == id).all()
+            )
+
+            if not members:
+                return []
+
+            return [m[0] for m in members]
+
+    def get_group_user_ids_by_ids(
+        self, group_ids: list[str], db: Optional[Session] = None
+    ) -> dict[str, list[str]]:
+        with get_db_context(db) as db:
+            members = (
+                db.query(GroupMember.group_id, GroupMember.user_id)
+                .filter(GroupMember.group_id.in_(group_ids))
+                .all()
+            )
+
+            group_user_ids: dict[str, list[str]] = {
+                group_id: [] for group_id in group_ids
+            }
+
+            for group_id, user_id in members:
+                group_user_ids[group_id].append(user_id)
+
+            return group_user_ids
+
+    def set_group_user_ids_by_id(
+        self, group_id: str, user_ids: list[str], db: Optional[Session] = None
+    ) -> None:
+        with get_db_context(db) as db:
+            # Delete existing members
+            db.query(GroupMember).filter(GroupMember.group_id == group_id).delete()
+
+            # Insert new members
+            now = int(time.time())
+            new_members = [
+                GroupMember(
+                    id=str(uuid.uuid4()),
+                    group_id=group_id,
+                    user_id=user_id,
+                    created_at=now,
+                    updated_at=now,
+                )
+                for user_id in user_ids
+            ]
+
+            db.add_all(new_members)
+            db.commit()
+
+    def get_group_member_count_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> int:
+        with get_db_context(db) as db:
+            count = (
+                db.query(func.count(GroupMember.user_id))
+                .filter(GroupMember.group_id == id)
+                .scalar()
+            )
+            return count if count else 0
+
+    def get_group_member_counts_by_ids(
+        self, ids: list[str], db: Optional[Session] = None
+    ) -> dict[str, int]:
+        if not ids:
+            return {}
+        with get_db_context(db) as db:
+            rows = (
+                db.query(GroupMember.group_id, func.count(GroupMember.user_id))
+                .filter(GroupMember.group_id.in_(ids))
+                .group_by(GroupMember.group_id)
+                .all()
+            )
+            return {group_id: count for group_id, count in rows}
 
     def update_group_by_id(
-        self, id: str, form_data: GroupUpdateForm, overwrite: bool = False
+        self,
+        id: str,
+        form_data: GroupUpdateForm,
+        overwrite: bool = False,
+        db: Optional[Session] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 db.query(Group).filter_by(id=id).update(
                     {
                         **form_data.model_dump(exclude_none=True),
@@ -168,22 +411,22 @@ class GroupTable:
                     }
                 )
                 db.commit()
-                return self.get_group_by_id(id=id)
+                return self.get_group_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def delete_group_by_id(self, id: str) -> bool:
+    def delete_group_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 db.query(Group).filter_by(id=id).delete()
                 db.commit()
                 return True
         except Exception:
             return False
 
-    def delete_all_groups(self) -> bool:
-        with get_db() as db:
+    def delete_all_groups(self, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(Group).delete()
                 db.commit()
@@ -192,36 +435,47 @@ class GroupTable:
             except Exception:
                 return False
 
-    def remove_user_from_all_groups(self, user_id: str) -> bool:
-        with get_db() as db:
+    def remove_user_from_all_groups(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
             try:
-                groups = self.get_groups_by_member_id(user_id)
+                # Find all groups the user belongs to
+                groups = (
+                    db.query(Group)
+                    .join(GroupMember, GroupMember.group_id == Group.id)
+                    .filter(GroupMember.user_id == user_id)
+                    .all()
+                )
 
+                # Remove the user from each group
                 for group in groups:
-                    group.user_ids.remove(user_id)
-                    db.query(Group).filter_by(id=group.id).update(
-                        {
-                            "user_ids": group.user_ids,
-                            "updated_at": int(time.time()),
-                        }
-                    )
-                    db.commit()
+                    db.query(GroupMember).filter(
+                        GroupMember.group_id == group.id, GroupMember.user_id == user_id
+                    ).delete()
 
+                    db.query(Group).filter_by(id=group.id).update(
+                        {"updated_at": int(time.time())}
+                    )
+
+                db.commit()
                 return True
+
             except Exception:
+                db.rollback()
                 return False
 
     def create_groups_by_group_names(
-        self, user_id: str, group_names: list[str]
+        self, user_id: str, group_names: list[str], db: Optional[Session] = None
     ) -> list[GroupModel]:
 
         # check for existing groups
-        existing_groups = self.get_groups()
+        existing_groups = self.get_all_groups(db=db)
         existing_group_names = {group.name for group in existing_groups}
 
         new_groups = []
 
-        with get_db() as db:
+        with get_db_context(db) as db:
             for group_name in group_names:
                 if group_name not in existing_group_names:
                     new_group = GroupModel(
@@ -243,86 +497,136 @@ class GroupTable:
                         continue
             return new_groups
 
-    def sync_groups_by_group_names(self, user_id: str, group_names: list[str]) -> bool:
-        with get_db() as db:
+    def sync_groups_by_group_names(
+        self, user_id: str, group_names: list[str], db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
             try:
-                groups = db.query(Group).filter(Group.name.in_(group_names)).all()
-                group_ids = [group.id for group in groups]
+                now = int(time.time())
 
-                # Remove user from groups not in the new list
-                existing_groups = self.get_groups_by_member_id(user_id)
+                # 1. Groups that SHOULD contain the user
+                target_groups = (
+                    db.query(Group).filter(Group.name.in_(group_names)).all()
+                )
+                target_group_ids = {g.id for g in target_groups}
 
-                for group in existing_groups:
-                    if group.id not in group_ids:
-                        group.user_ids.remove(user_id)
-                        db.query(Group).filter_by(id=group.id).update(
-                            {
-                                "user_ids": group.user_ids,
-                                "updated_at": int(time.time()),
-                            }
+                # 2. Groups the user is CURRENTLY in
+                existing_group_ids = {
+                    g.id
+                    for g in db.query(Group)
+                    .join(GroupMember, GroupMember.group_id == Group.id)
+                    .filter(GroupMember.user_id == user_id)
+                    .all()
+                }
+
+                # 3. Determine adds + removals
+                groups_to_add = target_group_ids - existing_group_ids
+                groups_to_remove = existing_group_ids - target_group_ids
+
+                # 4. Remove in one bulk delete
+                if groups_to_remove:
+                    db.query(GroupMember).filter(
+                        GroupMember.user_id == user_id,
+                        GroupMember.group_id.in_(groups_to_remove),
+                    ).delete(synchronize_session=False)
+
+                    db.query(Group).filter(Group.id.in_(groups_to_remove)).update(
+                        {"updated_at": now}, synchronize_session=False
+                    )
+
+                # 5. Bulk insert missing memberships
+                for group_id in groups_to_add:
+                    db.add(
+                        GroupMember(
+                            id=str(uuid.uuid4()),
+                            group_id=group_id,
+                            user_id=user_id,
+                            created_at=now,
+                            updated_at=now,
                         )
+                    )
 
-                # Add user to new groups
-                for group in groups:
-                    if user_id not in group.user_ids:
-                        group.user_ids.append(user_id)
-                        db.query(Group).filter_by(id=group.id).update(
-                            {
-                                "user_ids": group.user_ids,
-                                "updated_at": int(time.time()),
-                            }
-                        )
+                if groups_to_add:
+                    db.query(Group).filter(Group.id.in_(groups_to_add)).update(
+                        {"updated_at": now}, synchronize_session=False
+                    )
 
                 db.commit()
                 return True
+
             except Exception as e:
                 log.exception(e)
+                db.rollback()
                 return False
 
     def add_users_to_group(
-        self, id: str, user_ids: Optional[list[str]] = None
+        self,
+        id: str,
+        user_ids: Optional[list[str]] = None,
+        db: Optional[Session] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 group = db.query(Group).filter_by(id=id).first()
                 if not group:
                     return None
 
-                if not group.user_ids:
-                    group.user_ids = []
+                now = int(time.time())
 
-                for user_id in user_ids:
-                    if user_id not in group.user_ids:
-                        group.user_ids.append(user_id)
+                for user_id in user_ids or []:
+                    try:
+                        db.add(
+                            GroupMember(
+                                id=str(uuid.uuid4()),
+                                group_id=id,
+                                user_id=user_id,
+                                created_at=now,
+                                updated_at=now,
+                            )
+                        )
+                        db.flush()  # Detect unique constraint violation early
+                    except Exception:
+                        db.rollback()  # Clear failed INSERT
+                        db.begin()  # Start a new transaction
+                        continue  # Duplicate → ignore
 
-                group.updated_at = int(time.time())
+                group.updated_at = now
                 db.commit()
                 db.refresh(group)
+
                 return GroupModel.model_validate(group)
+
         except Exception as e:
             log.exception(e)
             return None
 
     def remove_users_from_group(
-        self, id: str, user_ids: Optional[list[str]] = None
+        self,
+        id: str,
+        user_ids: Optional[list[str]] = None,
+        db: Optional[Session] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 group = db.query(Group).filter_by(id=id).first()
                 if not group:
                     return None
 
-                if not group.user_ids:
+                if not user_ids:
                     return GroupModel.model_validate(group)
 
-                for user_id in user_ids:
-                    if user_id in group.user_ids:
-                        group.user_ids.remove(user_id)
+                # Remove users from group_member in batch
+                db.query(GroupMember).filter(
+                    GroupMember.group_id == id, GroupMember.user_id.in_(user_ids)
+                ).delete(synchronize_session=False)
 
+                # Update group timestamp
                 group.updated_at = int(time.time())
+
                 db.commit()
                 db.refresh(group)
                 return GroupModel.model_validate(group)
+
         except Exception as e:
             log.exception(e)
             return None

backend/open_webui/models/knowledge.py

@@ -4,20 +4,33 @@ import time
 from typing import Optional
 import uuid
 
-from open_webui.internal.db import Base, get_db
-from open_webui.env import SRC_LOG_LEVELS
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
-from open_webui.models.files import FileMetadataResponse
-from open_webui.models.users import Users, UserResponse
+from open_webui.models.files import (
+    File,
+    FileModel,
+    FileMetadataResponse,
+    FileModelResponse,
+)
+from open_webui.models.groups import Groups
+from open_webui.models.users import User, UserModel, Users, UserResponse
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, String, Text, JSON
-
-from open_webui.utils.access_control import has_access
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import (
+    BigInteger,
+    Column,
+    ForeignKey,
+    String,
+    Text,
+    JSON,
+    UniqueConstraint,
+    or_,
+)
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # Knowledge DB Schema
@@ -33,26 +46,8 @@ class Knowledge(Base):
     name = Column(Text)
     description = Column(Text)
 
-    data = Column(JSON, nullable=True)
     meta = Column(JSON, nullable=True)
 
-    access_control = Column(JSON, nullable=True)  # Controls data access levels.
-    # Defines access control rules for this entry.
-    # - `None`: Public access, available to all users with the "user" role.
-    # - `{}`: Private access, restricted exclusively to the owner.
-    # - Custom permissions: Specific access control for reading and writing;
-    #   Can specify group or user-level restrictions:
-    #   {
-    #      "read": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      },
-    #      "write": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      }
-    #   }
-
     created_at = Column(BigInteger)
     updated_at = Column(BigInteger)
 
@@ -66,20 +61,50 @@ class KnowledgeModel(BaseModel):
     name: str
     description: str
 
-    data: Optional[dict] = None
     meta: Optional[dict] = None
 
-    access_control: Optional[dict] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
     created_at: int  # timestamp in epoch
     updated_at: int  # timestamp in epoch
 
 
+class KnowledgeFile(Base):
+    __tablename__ = "knowledge_file"
+
+    id = Column(Text, unique=True, primary_key=True)
+
+    knowledge_id = Column(
+        Text, ForeignKey("knowledge.id", ondelete="CASCADE"), nullable=False
+    )
+    file_id = Column(Text, ForeignKey("file.id", ondelete="CASCADE"), nullable=False)
+    user_id = Column(Text, nullable=False)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint(
+            "knowledge_id", "file_id", name="uq_knowledge_file_knowledge_file"
+        ),
+    )
+
+
+class KnowledgeFileModel(BaseModel):
+    id: str
+    knowledge_id: str
+    file_id: str
+    user_id: str
+
+    created_at: int  # timestamp in epoch
+    updated_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
+
 ####################
 # Forms
 ####################
-
-
 class KnowledgeUserModel(KnowledgeModel):
     user: Optional[UserResponse] = None
 
@@ -89,103 +114,544 @@ class KnowledgeResponse(KnowledgeModel):
 
 
 class KnowledgeUserResponse(KnowledgeUserModel):
-    files: Optional[list[FileMetadataResponse | dict]] = None
+    pass
 
 
 class KnowledgeForm(BaseModel):
     name: str
     description: str
-    data: Optional[dict] = None
-    access_control: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
+
+
+class FileUserResponse(FileModelResponse):
+    user: Optional[UserResponse] = None
+
+
+class KnowledgeListResponse(BaseModel):
+    items: list[KnowledgeUserModel]
+    total: int
+
+
+class KnowledgeFileListResponse(BaseModel):
+    items: list[FileUserResponse]
+    total: int
 
 
 class KnowledgeTable:
+    def _get_access_grants(
+        self, knowledge_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("knowledge", knowledge_id, db=db)
+
+    def _to_knowledge_model(
+        self, knowledge: Knowledge, db: Optional[Session] = None
+    ) -> KnowledgeModel:
+        knowledge_data = KnowledgeModel.model_validate(knowledge).model_dump(
+            exclude={"access_grants"}
+        )
+        knowledge_data["access_grants"] = self._get_access_grants(
+            knowledge_data["id"], db=db
+        )
+        return KnowledgeModel.model_validate(knowledge_data)
+
     def insert_new_knowledge(
-        self, user_id: str, form_data: KnowledgeForm
+        self, user_id: str, form_data: KnowledgeForm, db: Optional[Session] = None
     ) -> Optional[KnowledgeModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             knowledge = KnowledgeModel(
                 **{
-                    **form_data.model_dump(),
+                    **form_data.model_dump(exclude={"access_grants"}),
                     "id": str(uuid.uuid4()),
                     "user_id": user_id,
                     "created_at": int(time.time()),
                     "updated_at": int(time.time()),
+                    "access_grants": [],
+                }
+            )
+
+            try:
+                result = Knowledge(**knowledge.model_dump(exclude={"access_grants"}))
+                db.add(result)
+                db.commit()
+                db.refresh(result)
+                AccessGrants.set_access_grants(
+                    "knowledge", result.id, form_data.access_grants, db=db
+                )
+                if result:
+                    return self._to_knowledge_model(result, db=db)
+                else:
+                    return None
+            except Exception:
+                return None
+
+    def get_knowledge_bases(
+        self, skip: int = 0, limit: int = 30, db: Optional[Session] = None
+    ) -> list[KnowledgeUserModel]:
+        with get_db_context(db) as db:
+            all_knowledge = (
+                db.query(Knowledge).order_by(Knowledge.updated_at.desc()).all()
+            )
+            user_ids = list(set(knowledge.user_id for knowledge in all_knowledge))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
+            knowledge_bases = []
+            for knowledge in all_knowledge:
+                user = users_dict.get(knowledge.user_id)
+                knowledge_bases.append(
+                    KnowledgeUserModel.model_validate(
+                        {
+                            **self._to_knowledge_model(knowledge, db=db).model_dump(),
+                            "user": user.model_dump() if user else None,
+                        }
+                    )
+                )
+            return knowledge_bases
+
+    def search_knowledge_bases(
+        self,
+        user_id: str,
+        filter: dict,
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> KnowledgeListResponse:
+        try:
+            with get_db_context(db) as db:
+                query = db.query(Knowledge, User).outerjoin(
+                    User, User.id == Knowledge.user_id
+                )
+
+                if filter:
+                    query_key = filter.get("query")
+                    if query_key:
+                        query = query.filter(
+                            or_(
+                                Knowledge.name.ilike(f"%{query_key}%"),
+                                Knowledge.description.ilike(f"%{query_key}%"),
+                                User.name.ilike(f"%{query_key}%"),
+                                User.email.ilike(f"%{query_key}%"),
+                                User.username.ilike(f"%{query_key}%"),
+                            )
+                        )
+
+                    view_option = filter.get("view_option")
+                    if view_option == "created":
+                        query = query.filter(Knowledge.user_id == user_id)
+                    elif view_option == "shared":
+                        query = query.filter(Knowledge.user_id != user_id)
+
+                    query = AccessGrants.has_permission_filter(
+                        db=db,
+                        query=query,
+                        DocumentModel=Knowledge,
+                        filter=filter,
+                        resource_type="knowledge",
+                        permission="read",
+                    )
+
+                query = query.order_by(Knowledge.updated_at.desc(), Knowledge.id.asc())
+
+                total = query.count()
+                if skip:
+                    query = query.offset(skip)
+                if limit:
+                    query = query.limit(limit)
+
+                items = query.all()
+
+                knowledge_bases = []
+                for knowledge_base, user in items:
+                    knowledge_bases.append(
+                        KnowledgeUserModel.model_validate(
+                            {
+                                **self._to_knowledge_model(
+                                    knowledge_base, db=db
+                                ).model_dump(),
+                                "user": (
+                                    UserModel.model_validate(user).model_dump()
+                                    if user
+                                    else None
+                                ),
+                            }
+                        )
+                    )
+
+                return KnowledgeListResponse(items=knowledge_bases, total=total)
+        except Exception as e:
+            print(e)
+            return KnowledgeListResponse(items=[], total=0)
+
+    def search_knowledge_files(
+        self, filter: dict, skip: int = 0, limit: int = 30, db: Optional[Session] = None
+    ) -> KnowledgeFileListResponse:
+        """
+        Scalable version: search files across all knowledge bases the user has
+        READ access to, without loading all KBs or using large IN() lists.
+        """
+        try:
+            with get_db_context(db) as db:
+                # Base query: join Knowledge → KnowledgeFile → File
+                query = (
+                    db.query(File, User, Knowledge)
+                    .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
+                    .join(Knowledge, KnowledgeFile.knowledge_id == Knowledge.id)
+                    .outerjoin(User, User.id == KnowledgeFile.user_id)
+                )
+
+                # Apply access-control directly to the joined query
+                # This makes the database handle filtering, even with 10k+ KBs
+                query = AccessGrants.has_permission_filter(
+                    db=db,
+                    query=query,
+                    DocumentModel=Knowledge,
+                    filter=filter,
+                    resource_type="knowledge",
+                    permission="read",
+                )
+
+                # Apply filename search
+                if filter:
+                    q = filter.get("query")
+                    if q:
+                        query = query.filter(File.filename.ilike(f"%{q}%"))
+
+                # Order by file changes
+                query = query.order_by(File.updated_at.desc(), File.id.asc())
+
+                # Count before pagination
+                total = query.count()
+
+                if skip:
+                    query = query.offset(skip)
+                if limit:
+                    query = query.limit(limit)
+
+                rows = query.all()
+
+                items = []
+                for file, user, knowledge in rows:
+                    items.append(
+                        FileUserResponse(
+                            **FileModel.model_validate(file).model_dump(),
+                            user=(
+                                UserResponse(
+                                    **UserModel.model_validate(user).model_dump()
+                                )
+                                if user
+                                else None
+                            ),
+                            collection=self._to_knowledge_model(
+                                knowledge, db=db
+                            ).model_dump(),
+                        )
+                    )
+
+                return KnowledgeFileListResponse(items=items, total=total)
+
+        except Exception as e:
+            print("search_knowledge_files error:", e)
+            return KnowledgeFileListResponse(items=[], total=0)
+
+    def check_access_by_user_id(
+        self, id, user_id, permission="write", db: Optional[Session] = None
+    ) -> bool:
+        knowledge = self.get_knowledge_by_id(id, db=db)
+        if not knowledge:
+            return False
+        if knowledge.user_id == user_id:
+            return True
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
+        return AccessGrants.has_access(
+            user_id=user_id,
+            resource_type="knowledge",
+            resource_id=knowledge.id,
+            permission=permission,
+            user_group_ids=user_group_ids,
+            db=db,
+        )
+
+    def get_knowledge_bases_by_user_id(
+        self, user_id: str, permission: str = "write", db: Optional[Session] = None
+    ) -> list[KnowledgeUserModel]:
+        knowledge_bases = self.get_knowledge_bases(db=db)
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
+        return [
+            knowledge_base
+            for knowledge_base in knowledge_bases
+            if knowledge_base.user_id == user_id
+            or AccessGrants.has_access(
+                user_id=user_id,
+                resource_type="knowledge",
+                resource_id=knowledge_base.id,
+                permission=permission,
+                user_group_ids=user_group_ids,
+                db=db,
+            )
+        ]
+
+    def get_knowledge_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[KnowledgeModel]:
+        try:
+            with get_db_context(db) as db:
+                knowledge = db.query(Knowledge).filter_by(id=id).first()
+                return self._to_knowledge_model(knowledge, db=db) if knowledge else None
+        except Exception:
+            return None
+
+    def get_knowledge_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[Session] = None
+    ) -> Optional[KnowledgeModel]:
+        knowledge = self.get_knowledge_by_id(id, db=db)
+        if not knowledge:
+            return None
+
+        if knowledge.user_id == user_id:
+            return knowledge
+
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
+        if AccessGrants.has_access(
+            user_id=user_id,
+            resource_type="knowledge",
+            resource_id=knowledge.id,
+            permission="write",
+            user_group_ids=user_group_ids,
+            db=db,
+        ):
+            return knowledge
+        return None
+
+    def get_knowledges_by_file_id(
+        self, file_id: str, db: Optional[Session] = None
+    ) -> list[KnowledgeModel]:
+        try:
+            with get_db_context(db) as db:
+                knowledges = (
+                    db.query(Knowledge)
+                    .join(KnowledgeFile, Knowledge.id == KnowledgeFile.knowledge_id)
+                    .filter(KnowledgeFile.file_id == file_id)
+                    .all()
+                )
+                return [
+                    self._to_knowledge_model(knowledge, db=db)
+                    for knowledge in knowledges
+                ]
+        except Exception:
+            return []
+
+    def search_files_by_id(
+        self,
+        knowledge_id: str,
+        user_id: str,
+        filter: dict,
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> KnowledgeFileListResponse:
+        try:
+            with get_db_context(db) as db:
+                query = (
+                    db.query(File, User)
+                    .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
+                    .outerjoin(User, User.id == KnowledgeFile.user_id)
+                    .filter(KnowledgeFile.knowledge_id == knowledge_id)
+                )
+
+                # Default sort: updated_at descending
+                primary_sort = File.updated_at.desc()
+
+                if filter:
+                    query_key = filter.get("query")
+                    if query_key:
+                        query = query.filter(or_(File.filename.ilike(f"%{query_key}%")))
+
+                    view_option = filter.get("view_option")
+                    if view_option == "created":
+                        query = query.filter(KnowledgeFile.user_id == user_id)
+                    elif view_option == "shared":
+                        query = query.filter(KnowledgeFile.user_id != user_id)
+
+                    order_by = filter.get("order_by")
+                    direction = filter.get("direction")
+                    is_asc = direction == "asc"
+
+                    if order_by == "name":
+                        primary_sort = (
+                            File.filename.asc() if is_asc else File.filename.desc()
+                        )
+                    elif order_by == "created_at":
+                        primary_sort = (
+                            File.created_at.asc() if is_asc else File.created_at.desc()
+                        )
+                    elif order_by == "updated_at":
+                        primary_sort = (
+                            File.updated_at.asc() if is_asc else File.updated_at.desc()
+                        )
+
+                # Apply sort with secondary key for deterministic pagination
+                query = query.order_by(primary_sort, File.id.asc())
+
+                # Count BEFORE pagination
+                total = query.count()
+
+                if skip:
+                    query = query.offset(skip)
+                if limit:
+                    query = query.limit(limit)
+
+                items = query.all()
+
+                files = []
+                for file, user in items:
+                    files.append(
+                        FileUserResponse(
+                            **FileModel.model_validate(file).model_dump(),
+                            user=(
+                                UserResponse(
+                                    **UserModel.model_validate(user).model_dump()
+                                )
+                                if user
+                                else None
+                            ),
+                        )
+                    )
+
+                return KnowledgeFileListResponse(items=files, total=total)
+        except Exception as e:
+            print(e)
+            return KnowledgeFileListResponse(items=[], total=0)
+
+    def get_files_by_id(
+        self, knowledge_id: str, db: Optional[Session] = None
+    ) -> list[FileModel]:
+        try:
+            with get_db_context(db) as db:
+                files = (
+                    db.query(File)
+                    .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
+                    .filter(KnowledgeFile.knowledge_id == knowledge_id)
+                    .all()
+                )
+                return [FileModel.model_validate(file) for file in files]
+        except Exception:
+            return []
+
+    def get_file_metadatas_by_id(
+        self, knowledge_id: str, db: Optional[Session] = None
+    ) -> list[FileMetadataResponse]:
+        try:
+            with get_db_context(db) as db:
+                files = self.get_files_by_id(knowledge_id, db=db)
+                return [FileMetadataResponse(**file.model_dump()) for file in files]
+        except Exception:
+            return []
+
+    def add_file_to_knowledge_by_id(
+        self,
+        knowledge_id: str,
+        file_id: str,
+        user_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[KnowledgeFileModel]:
+        with get_db_context(db) as db:
+            knowledge_file = KnowledgeFileModel(
+                **{
+                    "id": str(uuid.uuid4()),
+                    "knowledge_id": knowledge_id,
+                    "file_id": file_id,
+                    "user_id": user_id,
+                    "created_at": int(time.time()),
+                    "updated_at": int(time.time()),
                 }
             )
 
             try:
-                result = Knowledge(**knowledge.model_dump())
+                result = KnowledgeFile(**knowledge_file.model_dump())
                 db.add(result)
                 db.commit()
                 db.refresh(result)
                 if result:
-                    return KnowledgeModel.model_validate(result)
+                    return KnowledgeFileModel.model_validate(result)
                 else:
                     return None
             except Exception:
                 return None
 
-    def get_knowledge_bases(self) -> list[KnowledgeUserModel]:
-        with get_db() as db:
-            knowledge_bases = []
-            for knowledge in (
-                db.query(Knowledge).order_by(Knowledge.updated_at.desc()).all()
-            ):
-                user = Users.get_user_by_id(knowledge.user_id)
-                knowledge_bases.append(
-                    KnowledgeUserModel.model_validate(
-                        {
-                            **KnowledgeModel.model_validate(knowledge).model_dump(),
-                            "user": user.model_dump() if user else None,
-                        }
-                    )
-                )
-            return knowledge_bases
-
-    def get_knowledge_bases_by_user_id(
-        self, user_id: str, permission: str = "write"
-    ) -> list[KnowledgeUserModel]:
-        knowledge_bases = self.get_knowledge_bases()
-        return [
-            knowledge_base
-            for knowledge_base in knowledge_bases
-            if knowledge_base.user_id == user_id
-            or has_access(user_id, permission, knowledge_base.access_control)
-        ]
-
-    def get_knowledge_by_id(self, id: str) -> Optional[KnowledgeModel]:
+    def remove_file_from_knowledge_by_id(
+        self, knowledge_id: str, file_id: str, db: Optional[Session] = None
+    ) -> bool:
         try:
-            with get_db() as db:
-                knowledge = db.query(Knowledge).filter_by(id=id).first()
-                return KnowledgeModel.model_validate(knowledge) if knowledge else None
+            with get_db_context(db) as db:
+                db.query(KnowledgeFile).filter_by(
+                    knowledge_id=knowledge_id, file_id=file_id
+                ).delete()
+                db.commit()
+                return True
         except Exception:
-            return None
+            return False
 
-    def update_knowledge_by_id(
-        self, id: str, form_data: KnowledgeForm, overwrite: bool = False
+    def reset_knowledge_by_id(
+        self, id: str, db: Optional[Session] = None
     ) -> Optional[KnowledgeModel]:
         try:
-            with get_db() as db:
-                knowledge = self.get_knowledge_by_id(id=id)
+            with get_db_context(db) as db:
+                # Delete all knowledge_file entries for this knowledge_id
+                db.query(KnowledgeFile).filter_by(knowledge_id=id).delete()
+                db.commit()
+
+                # Update the knowledge entry's updated_at timestamp
                 db.query(Knowledge).filter_by(id=id).update(
                     {
-                        **form_data.model_dump(),
                         "updated_at": int(time.time()),
                     }
                 )
                 db.commit()
-                return self.get_knowledge_by_id(id=id)
+
+                return self.get_knowledge_by_id(id=id, db=db)
+        except Exception as e:
+            log.exception(e)
+            return None
+
+    def update_knowledge_by_id(
+        self,
+        id: str,
+        form_data: KnowledgeForm,
+        overwrite: bool = False,
+        db: Optional[Session] = None,
+    ) -> Optional[KnowledgeModel]:
+        try:
+            with get_db_context(db) as db:
+                knowledge = self.get_knowledge_by_id(id=id, db=db)
+                db.query(Knowledge).filter_by(id=id).update(
+                    {
+                        **form_data.model_dump(exclude={"access_grants"}),
+                        "updated_at": int(time.time()),
+                    }
+                )
+                db.commit()
+                if form_data.access_grants is not None:
+                    AccessGrants.set_access_grants(
+                        "knowledge", id, form_data.access_grants, db=db
+                    )
+                return self.get_knowledge_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
     def update_knowledge_data_by_id(
-        self, id: str, data: dict
+        self, id: str, data: dict, db: Optional[Session] = None
     ) -> Optional[KnowledgeModel]:
         try:
-            with get_db() as db:
-                knowledge = self.get_knowledge_by_id(id=id)
+            with get_db_context(db) as db:
+                knowledge = self.get_knowledge_by_id(id=id, db=db)
                 db.query(Knowledge).filter_by(id=id).update(
                     {
                         "data": data,
@@ -193,23 +659,27 @@ class KnowledgeTable:
                     }
                 )
                 db.commit()
-                return self.get_knowledge_by_id(id=id)
+                return self.get_knowledge_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def delete_knowledge_by_id(self, id: str) -> bool:
+    def delete_knowledge_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
+                AccessGrants.revoke_all_access("knowledge", id, db=db)
                 db.query(Knowledge).filter_by(id=id).delete()
                 db.commit()
                 return True
         except Exception:
             return False
 
-    def delete_all_knowledge(self) -> bool:
-        with get_db() as db:
+    def delete_all_knowledge(self, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
+                knowledge_ids = [row[0] for row in db.query(Knowledge.id).all()]
+                for knowledge_id in knowledge_ids:
+                    AccessGrants.revoke_all_access("knowledge", knowledge_id, db=db)
                 db.query(Knowledge).delete()
                 db.commit()
 

backend/open_webui/models/memories.py

@@ -2,7 +2,8 @@ import time
 import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db, get_db_context
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, String, Text
 
@@ -14,7 +15,7 @@ from sqlalchemy import BigInteger, Column, String, Text
 class Memory(Base):
     __tablename__ = "memory"
 
-    id = Column(String, primary_key=True)
+    id = Column(String, primary_key=True, unique=True)
     user_id = Column(String)
     content = Column(Text)
     updated_at = Column(BigInteger)
@@ -41,8 +42,9 @@ class MemoriesTable:
         self,
         user_id: str,
         content: str,
+        db: Optional[Session] = None,
     ) -> Optional[MemoryModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             id = str(uuid.uuid4())
 
             memory = MemoryModel(
@@ -68,8 +70,9 @@ class MemoriesTable:
         id: str,
         user_id: str,
         content: str,
+        db: Optional[Session] = None,
     ) -> Optional[MemoryModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             try:
                 memory = db.get(Memory, id)
                 if not memory or memory.user_id != user_id:
@@ -79,36 +82,41 @@ class MemoriesTable:
                 memory.updated_at = int(time.time())
 
                 db.commit()
-                return self.get_memory_by_id(id)
+                db.refresh(memory)
+                return MemoryModel.model_validate(memory)
             except Exception:
                 return None
 
-    def get_memories(self) -> list[MemoryModel]:
-        with get_db() as db:
+    def get_memories(self, db: Optional[Session] = None) -> list[MemoryModel]:
+        with get_db_context(db) as db:
             try:
                 memories = db.query(Memory).all()
                 return [MemoryModel.model_validate(memory) for memory in memories]
             except Exception:
                 return None
 
-    def get_memories_by_user_id(self, user_id: str) -> list[MemoryModel]:
-        with get_db() as db:
+    def get_memories_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[MemoryModel]:
+        with get_db_context(db) as db:
             try:
                 memories = db.query(Memory).filter_by(user_id=user_id).all()
                 return [MemoryModel.model_validate(memory) for memory in memories]
             except Exception:
                 return None
 
-    def get_memory_by_id(self, id: str) -> Optional[MemoryModel]:
-        with get_db() as db:
+    def get_memory_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[MemoryModel]:
+        with get_db_context(db) as db:
             try:
                 memory = db.get(Memory, id)
                 return MemoryModel.model_validate(memory)
             except Exception:
                 return None
 
-    def delete_memory_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_memory_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(Memory).filter_by(id=id).delete()
                 db.commit()
@@ -118,8 +126,10 @@ class MemoriesTable:
             except Exception:
                 return False
 
-    def delete_memories_by_user_id(self, user_id: str) -> bool:
-        with get_db() as db:
+    def delete_memories_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
             try:
                 db.query(Memory).filter_by(user_id=user_id).delete()
                 db.commit()
@@ -128,8 +138,10 @@ class MemoriesTable:
             except Exception:
                 return False
 
-    def delete_memory_by_id_and_user_id(self, id: str, user_id: str) -> bool:
-        with get_db() as db:
+    def delete_memory_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        with get_db_context(db) as db:
             try:
                 memory = db.get(Memory, id)
                 if not memory or memory.user_id != user_id:

backend/open_webui/models/messages.py

@@ -3,11 +3,14 @@ import time
 import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 from open_webui.models.tags import TagModel, Tag, Tags
+from open_webui.models.users import Users, User, UserNameResponse
+from open_webui.models.channels import Channels, ChannelMember
 
 
-from pydantic import BaseModel, ConfigDict
+from pydantic import BaseModel, ConfigDict, field_validator
 from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON
 from sqlalchemy import or_, func, select, and_, text
 from sqlalchemy.sql import exists
@@ -19,7 +22,7 @@ from sqlalchemy.sql import exists
 
 class MessageReaction(Base):
     __tablename__ = "message_reaction"
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
     user_id = Column(Text)
     message_id = Column(Text)
     name = Column(Text)
@@ -38,13 +41,19 @@ class MessageReactionModel(BaseModel):
 
 class Message(Base):
     __tablename__ = "message"
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
 
     user_id = Column(Text)
     channel_id = Column(Text, nullable=True)
 
+    reply_to_id = Column(Text, nullable=True)
     parent_id = Column(Text, nullable=True)
 
+    # Pins
+    is_pinned = Column(Boolean, nullable=False, default=False)
+    pinned_at = Column(BigInteger, nullable=True)
+    pinned_by = Column(Text, nullable=True)
+
     content = Column(Text)
     data = Column(JSON, nullable=True)
     meta = Column(JSON, nullable=True)
@@ -60,14 +69,20 @@ class MessageModel(BaseModel):
     user_id: str
     channel_id: Optional[str] = None
 
+    reply_to_id: Optional[str] = None
     parent_id: Optional[str] = None
 
+    # Pins
+    is_pinned: bool = False
+    pinned_by: Optional[str] = None
+    pinned_at: Optional[int] = None  # timestamp in epoch (time_ns)
+
     content: str
     data: Optional[dict] = None
     meta: Optional[dict] = None
 
-    created_at: int  # timestamp in epoch
-    updated_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch (time_ns)
+    updated_at: int  # timestamp in epoch (time_ns)
 
 
 ####################
@@ -76,7 +91,9 @@ class MessageModel(BaseModel):
 
 
 class MessageForm(BaseModel):
+    temp_id: Optional[str] = None
     content: str
+    reply_to_id: Optional[str] = None
     parent_id: Optional[str] = None
     data: Optional[dict] = None
     meta: Optional[dict] = None
@@ -84,11 +101,36 @@ class MessageForm(BaseModel):
 
 class Reactions(BaseModel):
     name: str
-    user_ids: list[str]
+    users: list[dict]
     count: int
 
 
-class MessageResponse(MessageModel):
+class MessageUserResponse(MessageModel):
+    user: Optional[UserNameResponse] = None
+
+
+class MessageUserSlimResponse(MessageUserResponse):
+    data: bool | None = None
+
+    @field_validator("data", mode="before")
+    def convert_data_to_bool(cls, v):
+        # No data or not a dict → False
+        if not isinstance(v, dict):
+            return False
+
+        # True if ANY value in the dict is non-empty
+        return any(bool(val) for val in v.values())
+
+
+class MessageReplyToResponse(MessageUserResponse):
+    reply_to_message: Optional[MessageUserSlimResponse] = None
+
+
+class MessageWithReactionsResponse(MessageUserSlimResponse):
+    reactions: list[Reactions]
+
+
+class MessageResponse(MessageReplyToResponse):
     latest_reply_at: Optional[int]
     reply_count: int
     reactions: list[Reactions]
@@ -96,18 +138,28 @@ class MessageResponse(MessageModel):
 
 class MessageTable:
     def insert_new_message(
-        self, form_data: MessageForm, channel_id: str, user_id: str
+        self,
+        form_data: MessageForm,
+        channel_id: str,
+        user_id: str,
+        db: Optional[Session] = None,
     ) -> Optional[MessageModel]:
-        with get_db() as db:
-            id = str(uuid.uuid4())
+        with get_db_context(db) as db:
+            channel_member = Channels.join_channel(channel_id, user_id)
 
+            id = str(uuid.uuid4())
             ts = int(time.time_ns())
+
             message = MessageModel(
                 **{
                     "id": id,
                     "user_id": user_id,
                     "channel_id": channel_id,
+                    "reply_to_id": form_data.reply_to_id,
                     "parent_id": form_data.parent_id,
+                    "is_pinned": False,
+                    "pinned_at": None,
+                    "pinned_by": None,
                     "content": form_data.content,
                     "data": form_data.data,
                     "meta": form_data.meta,
@@ -115,52 +167,145 @@ class MessageTable:
                     "updated_at": ts,
                 }
             )
-
             result = Message(**message.model_dump())
+
             db.add(result)
             db.commit()
             db.refresh(result)
             return MessageModel.model_validate(result) if result else None
 
-    def get_message_by_id(self, id: str) -> Optional[MessageResponse]:
-        with get_db() as db:
+    def get_message_by_id(
+        self,
+        id: str,
+        include_thread_replies: Optional[bool] = True,
+        db: Optional[Session] = None,
+    ) -> Optional[MessageResponse]:
+        with get_db_context(db) as db:
             message = db.get(Message, id)
             if not message:
                 return None
 
-            reactions = self.get_reactions_by_message_id(id)
-            replies = self.get_replies_by_message_id(id)
+            reply_to_message = (
+                self.get_message_by_id(
+                    message.reply_to_id, include_thread_replies=False, db=db
+                )
+                if message.reply_to_id
+                else None
+            )
 
-            return MessageResponse(
-                **{
+            reactions = self.get_reactions_by_message_id(id, db=db)
+
+            thread_replies = []
+            if include_thread_replies:
+                thread_replies = self.get_thread_replies_by_message_id(id, db=db)
+
+            # Check if message was sent by webhook (webhook info in meta takes precedence)
+            webhook_info = message.meta.get("webhook") if message.meta else None
+            if webhook_info and webhook_info.get("id"):
+                # Look up webhook by ID to get current name
+                webhook = Channels.get_webhook_by_id(webhook_info.get("id"), db=db)
+                if webhook:
+                    user_info = {
+                        "id": webhook.id,
+                        "name": webhook.name,
+                        "role": "webhook",
+                    }
+                else:
+                    # Webhook was deleted, use placeholder
+                    user_info = {
+                        "id": webhook_info.get("id"),
+                        "name": "Deleted Webhook",
+                        "role": "webhook",
+                    }
+            else:
+                user = Users.get_user_by_id(message.user_id, db=db)
+                user_info = user.model_dump() if user else None
+
+            return MessageResponse.model_validate(
+                {
                     **MessageModel.model_validate(message).model_dump(),
-                    "latest_reply_at": replies[0].created_at if replies else None,
-                    "reply_count": len(replies),
+                    "user": user_info,
+                    "reply_to_message": (
+                        reply_to_message.model_dump() if reply_to_message else None
+                    ),
+                    "latest_reply_at": (
+                        thread_replies[0].created_at if thread_replies else None
+                    ),
+                    "reply_count": len(thread_replies),
                     "reactions": reactions,
                 }
             )
 
-    def get_replies_by_message_id(self, id: str) -> list[MessageModel]:
-        with get_db() as db:
+    def get_thread_replies_by_message_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> list[MessageReplyToResponse]:
+        with get_db_context(db) as db:
             all_messages = (
                 db.query(Message)
                 .filter_by(parent_id=id)
                 .order_by(Message.created_at.desc())
                 .all()
             )
-            return [MessageModel.model_validate(message) for message in all_messages]
 
-    def get_reply_user_ids_by_message_id(self, id: str) -> list[str]:
-        with get_db() as db:
+            messages = []
+            for message in all_messages:
+                reply_to_message = (
+                    self.get_message_by_id(
+                        message.reply_to_id, include_thread_replies=False, db=db
+                    )
+                    if message.reply_to_id
+                    else None
+                )
+
+                webhook_info = message.meta.get("webhook") if message.meta else None
+                user_info = None
+                if webhook_info and webhook_info.get("id"):
+                    webhook = Channels.get_webhook_by_id(webhook_info.get("id"), db=db)
+                    if webhook:
+                        user_info = {
+                            "id": webhook.id,
+                            "name": webhook.name,
+                            "role": "webhook",
+                        }
+                    else:
+                        user_info = {
+                            "id": webhook_info.get("id"),
+                            "name": "Deleted Webhook",
+                            "role": "webhook",
+                        }
+
+                messages.append(
+                    MessageReplyToResponse.model_validate(
+                        {
+                            **MessageModel.model_validate(message).model_dump(),
+                            "user": user_info,
+                            "reply_to_message": (
+                                reply_to_message.model_dump()
+                                if reply_to_message
+                                else None
+                            ),
+                        }
+                    )
+                )
+            return messages
+
+    def get_reply_user_ids_by_message_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> list[str]:
+        with get_db_context(db) as db:
             return [
                 message.user_id
                 for message in db.query(Message).filter_by(parent_id=id).all()
             ]
 
     def get_messages_by_channel_id(
-        self, channel_id: str, skip: int = 0, limit: int = 50
-    ) -> list[MessageModel]:
-        with get_db() as db:
+        self,
+        channel_id: str,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
+    ) -> list[MessageReplyToResponse]:
+        with get_db_context(db) as db:
             all_messages = (
                 db.query(Message)
                 .filter_by(channel_id=channel_id, parent_id=None)
@@ -169,12 +314,58 @@ class MessageTable:
                 .limit(limit)
                 .all()
             )
-            return [MessageModel.model_validate(message) for message in all_messages]
+
+            messages = []
+            for message in all_messages:
+                reply_to_message = (
+                    self.get_message_by_id(
+                        message.reply_to_id, include_thread_replies=False, db=db
+                    )
+                    if message.reply_to_id
+                    else None
+                )
+
+                webhook_info = message.meta.get("webhook") if message.meta else None
+                user_info = None
+                if webhook_info and webhook_info.get("id"):
+                    webhook = Channels.get_webhook_by_id(webhook_info.get("id"), db=db)
+                    if webhook:
+                        user_info = {
+                            "id": webhook.id,
+                            "name": webhook.name,
+                            "role": "webhook",
+                        }
+                    else:
+                        user_info = {
+                            "id": webhook_info.get("id"),
+                            "name": "Deleted Webhook",
+                            "role": "webhook",
+                        }
+
+                messages.append(
+                    MessageReplyToResponse.model_validate(
+                        {
+                            **MessageModel.model_validate(message).model_dump(),
+                            "user": user_info,
+                            "reply_to_message": (
+                                reply_to_message.model_dump()
+                                if reply_to_message
+                                else None
+                            ),
+                        }
+                    )
+                )
+            return messages
 
     def get_messages_by_parent_id(
-        self, channel_id: str, parent_id: str, skip: int = 0, limit: int = 50
-    ) -> list[MessageModel]:
-        with get_db() as db:
+        self,
+        channel_id: str,
+        parent_id: str,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
+    ) -> list[MessageReplyToResponse]:
+        with get_db_context(db) as db:
             message = db.get(Message, parent_id)
 
             if not message:
@@ -193,25 +384,143 @@ class MessageTable:
             if len(all_messages) < limit:
                 all_messages.append(message)
 
+            messages = []
+            for message in all_messages:
+                reply_to_message = (
+                    self.get_message_by_id(
+                        message.reply_to_id, include_thread_replies=False, db=db
+                    )
+                    if message.reply_to_id
+                    else None
+                )
+
+                webhook_info = message.meta.get("webhook") if message.meta else None
+                user_info = None
+                if webhook_info and webhook_info.get("id"):
+                    webhook = Channels.get_webhook_by_id(webhook_info.get("id"), db=db)
+                    if webhook:
+                        user_info = {
+                            "id": webhook.id,
+                            "name": webhook.name,
+                            "role": "webhook",
+                        }
+                    else:
+                        user_info = {
+                            "id": webhook_info.get("id"),
+                            "name": "Deleted Webhook",
+                            "role": "webhook",
+                        }
+
+                messages.append(
+                    MessageReplyToResponse.model_validate(
+                        {
+                            **MessageModel.model_validate(message).model_dump(),
+                            "user": user_info,
+                            "reply_to_message": (
+                                reply_to_message.model_dump()
+                                if reply_to_message
+                                else None
+                            ),
+                        }
+                    )
+                )
+            return messages
+
+    def get_last_message_by_channel_id(
+        self, channel_id: str, db: Optional[Session] = None
+    ) -> Optional[MessageModel]:
+        with get_db_context(db) as db:
+            message = (
+                db.query(Message)
+                .filter_by(channel_id=channel_id)
+                .order_by(Message.created_at.desc())
+                .first()
+            )
+            return MessageModel.model_validate(message) if message else None
+
+    def get_pinned_messages_by_channel_id(
+        self,
+        channel_id: str,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
+    ) -> list[MessageModel]:
+        with get_db_context(db) as db:
+            all_messages = (
+                db.query(Message)
+                .filter_by(channel_id=channel_id, is_pinned=True)
+                .order_by(Message.pinned_at.desc())
+                .offset(skip)
+                .limit(limit)
+                .all()
+            )
             return [MessageModel.model_validate(message) for message in all_messages]
 
     def update_message_by_id(
-        self, id: str, form_data: MessageForm
+        self, id: str, form_data: MessageForm, db: Optional[Session] = None
     ) -> Optional[MessageModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             message = db.get(Message, id)
             message.content = form_data.content
-            message.data = form_data.data
-            message.meta = form_data.meta
+            message.data = {
+                **(message.data if message.data else {}),
+                **(form_data.data if form_data.data else {}),
+            }
+            message.meta = {
+                **(message.meta if message.meta else {}),
+                **(form_data.meta if form_data.meta else {}),
+            }
             message.updated_at = int(time.time_ns())
             db.commit()
             db.refresh(message)
             return MessageModel.model_validate(message) if message else None
 
+    def update_is_pinned_by_id(
+        self,
+        id: str,
+        is_pinned: bool,
+        pinned_by: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> Optional[MessageModel]:
+        with get_db_context(db) as db:
+            message = db.get(Message, id)
+            message.is_pinned = is_pinned
+            message.pinned_at = int(time.time_ns()) if is_pinned else None
+            message.pinned_by = pinned_by if is_pinned else None
+            db.commit()
+            db.refresh(message)
+            return MessageModel.model_validate(message) if message else None
+
+    def get_unread_message_count(
+        self,
+        channel_id: str,
+        user_id: str,
+        last_read_at: Optional[int] = None,
+        db: Optional[Session] = None,
+    ) -> int:
+        with get_db_context(db) as db:
+            query = db.query(Message).filter(
+                Message.channel_id == channel_id,
+                Message.parent_id == None,  # only count top-level messages
+                Message.created_at > (last_read_at if last_read_at else 0),
+            )
+            if user_id:
+                query = query.filter(Message.user_id != user_id)
+            return query.count()
+
     def add_reaction_to_message(
-        self, id: str, user_id: str, name: str
+        self, id: str, user_id: str, name: str, db: Optional[Session] = None
     ) -> Optional[MessageReactionModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
+            # check for existing reaction
+            existing_reaction = (
+                db.query(MessageReaction)
+                .filter_by(message_id=id, user_id=user_id, name=name)
+                .first()
+            )
+            if existing_reaction:
+                return MessageReactionModel.model_validate(existing_reaction)
+
             reaction_id = str(uuid.uuid4())
             reaction = MessageReactionModel(
                 id=reaction_id,
@@ -226,47 +535,62 @@ class MessageTable:
             db.refresh(result)
             return MessageReactionModel.model_validate(result) if result else None
 
-    def get_reactions_by_message_id(self, id: str) -> list[Reactions]:
-        with get_db() as db:
-            all_reactions = db.query(MessageReaction).filter_by(message_id=id).all()
+    def get_reactions_by_message_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> list[Reactions]:
+        with get_db_context(db) as db:
+            # JOIN User so all user info is fetched in one query
+            results = (
+                db.query(MessageReaction, User)
+                .join(User, MessageReaction.user_id == User.id)
+                .filter(MessageReaction.message_id == id)
+                .all()
+            )
 
             reactions = {}
-            for reaction in all_reactions:
+
+            for reaction, user in results:
                 if reaction.name not in reactions:
                     reactions[reaction.name] = {
                         "name": reaction.name,
-                        "user_ids": [],
+                        "users": [],
                         "count": 0,
                     }
-                reactions[reaction.name]["user_ids"].append(reaction.user_id)
+
+                reactions[reaction.name]["users"].append(
+                    {
+                        "id": user.id,
+                        "name": user.name,
+                    }
+                )
                 reactions[reaction.name]["count"] += 1
 
             return [Reactions(**reaction) for reaction in reactions.values()]
 
     def remove_reaction_by_id_and_user_id_and_name(
-        self, id: str, user_id: str, name: str
+        self, id: str, user_id: str, name: str, db: Optional[Session] = None
     ) -> bool:
-        with get_db() as db:
+        with get_db_context(db) as db:
             db.query(MessageReaction).filter_by(
                 message_id=id, user_id=user_id, name=name
             ).delete()
             db.commit()
             return True
 
-    def delete_reactions_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_reactions_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             db.query(MessageReaction).filter_by(message_id=id).delete()
             db.commit()
             return True
 
-    def delete_replies_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_replies_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             db.query(Message).filter_by(parent_id=id).delete()
             db.commit()
             return True
 
-    def delete_message_by_id(self, id: str) -> bool:
-        with get_db() as db:
+    def delete_message_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             db.query(Message).filter_by(id=id).delete()
 
             # Delete all reactions to this message
@@ -275,5 +599,35 @@ class MessageTable:
             db.commit()
             return True
 
+    def search_messages_by_channel_ids(
+        self,
+        channel_ids: list[str],
+        query: str,
+        start_timestamp: Optional[int] = None,
+        end_timestamp: Optional[int] = None,
+        limit: int = 10,
+        db: Optional[Session] = None,
+    ) -> list[MessageModel]:
+        """Search messages in specified channels by content."""
+        with get_db_context(db) as db:
+            query_builder = db.query(Message).filter(
+                Message.channel_id.in_(channel_ids),
+                Message.content.ilike(f"%{query}%"),
+            )
+
+            if start_timestamp:
+                query_builder = query_builder.filter(
+                    Message.created_at >= start_timestamp
+                )
+            if end_timestamp:
+                query_builder = query_builder.filter(
+                    Message.created_at <= end_timestamp
+                )
+
+            messages = (
+                query_builder.order_by(Message.created_at.desc()).limit(limit).all()
+            )
+            return [MessageModel.model_validate(msg) for msg in messages]
+
 
 Messages = MessageTable()

backend/open_webui/models/models.py

@@ -2,24 +2,23 @@ import logging
 import time
 from typing import Optional
 
-from open_webui.internal.db import Base, JSONField, get_db
-from open_webui.env import SRC_LOG_LEVELS
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
-from open_webui.models.users import Users, UserResponse
+from open_webui.models.groups import Groups
+from open_webui.models.users import User, UserModel, Users, UserResponse
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 
-from pydantic import BaseModel, ConfigDict
+from pydantic import BaseModel, ConfigDict, Field
 
-from sqlalchemy import or_, and_, func
+from sqlalchemy import String, cast, or_, and_, func
 from sqlalchemy.dialects import postgresql, sqlite
-from sqlalchemy import BigInteger, Column, Text, JSON, Boolean
-
-
-from open_webui.utils.access_control import has_access
 
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy import BigInteger, Column, Text, Boolean
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 
 ####################
@@ -52,7 +51,7 @@ class ModelMeta(BaseModel):
 class Model(Base):
     __tablename__ = "model"
 
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
     """
         The model's id as used in the API. If set to an existing model, it will override the model.
     """
@@ -78,23 +77,6 @@ class Model(Base):
         Holds a JSON encoded blob of metadata, see `ModelMeta`.
     """
 
-    access_control = Column(JSON, nullable=True)  # Controls data access levels.
-    # Defines access control rules for this entry.
-    # - `None`: Public access, available to all users with the "user" role.
-    # - `{}`: Private access, restricted exclusively to the owner.
-    # - Custom permissions: Specific access control for reading and writing;
-    #   Can specify group or user-level restrictions:
-    #   {
-    #      "read": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      },
-    #      "write": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      }
-    #   }
-
     is_active = Column(Boolean, default=True)
 
     updated_at = Column(BigInteger)
@@ -110,7 +92,7 @@ class ModelModel(BaseModel):
     params: ModelParams
     meta: ModelMeta
 
-    access_control: Optional[dict] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
     is_active: bool
     updated_at: int  # timestamp in epoch
@@ -128,130 +110,298 @@ class ModelUserResponse(ModelModel):
     user: Optional[UserResponse] = None
 
 
+class ModelAccessResponse(ModelUserResponse):
+    write_access: Optional[bool] = False
+
+
 class ModelResponse(ModelModel):
     pass
 
 
+class ModelListResponse(BaseModel):
+    items: list[ModelUserResponse]
+    total: int
+
+
+class ModelAccessListResponse(BaseModel):
+    items: list[ModelAccessResponse]
+    total: int
+
+
 class ModelForm(BaseModel):
     id: str
     base_model_id: Optional[str] = None
     name: str
     meta: ModelMeta
     params: ModelParams
-    access_control: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
     is_active: bool = True
 
 
 class ModelsTable:
-    def insert_new_model(
-        self, form_data: ModelForm, user_id: str
-    ) -> Optional[ModelModel]:
-        model = ModelModel(
-            **{
-                **form_data.model_dump(),
-                "user_id": user_id,
-                "created_at": int(time.time()),
-                "updated_at": int(time.time()),
-            }
+    def _get_access_grants(
+        self, model_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("model", model_id, db=db)
+
+    def _to_model_model(self, model: Model, db: Optional[Session] = None) -> ModelModel:
+        model_data = ModelModel.model_validate(model).model_dump(
+            exclude={"access_grants"}
         )
+        model_data["access_grants"] = self._get_access_grants(model_data["id"], db=db)
+        return ModelModel.model_validate(model_data)
+
+    def insert_new_model(
+        self, form_data: ModelForm, user_id: str, db: Optional[Session] = None
+    ) -> Optional[ModelModel]:
         try:
-            with get_db() as db:
-                result = Model(**model.model_dump())
+            with get_db_context(db) as db:
+                result = Model(
+                    **{
+                        **form_data.model_dump(exclude={"access_grants"}),
+                        "user_id": user_id,
+                        "created_at": int(time.time()),
+                        "updated_at": int(time.time()),
+                    }
+                )
                 db.add(result)
                 db.commit()
                 db.refresh(result)
+                AccessGrants.set_access_grants(
+                    "model", result.id, form_data.access_grants, db=db
+                )
 
                 if result:
-                    return ModelModel.model_validate(result)
+                    return self._to_model_model(result, db=db)
                 else:
                     return None
         except Exception as e:
             log.exception(f"Failed to insert a new model: {e}")
             return None
 
-    def get_all_models(self) -> list[ModelModel]:
-        with get_db() as db:
-            return [ModelModel.model_validate(model) for model in db.query(Model).all()]
+    def get_all_models(self, db: Optional[Session] = None) -> list[ModelModel]:
+        with get_db_context(db) as db:
+            return [
+                self._to_model_model(model, db=db) for model in db.query(Model).all()
+            ]
+
+    def get_models(self, db: Optional[Session] = None) -> list[ModelUserResponse]:
+        with get_db_context(db) as db:
+            all_models = db.query(Model).filter(Model.base_model_id != None).all()
+
+            user_ids = list(set(model.user_id for model in all_models))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
 
-    def get_models(self) -> list[ModelUserResponse]:
-        with get_db() as db:
             models = []
-            for model in db.query(Model).filter(Model.base_model_id != None).all():
-                user = Users.get_user_by_id(model.user_id)
+            for model in all_models:
+                user = users_dict.get(model.user_id)
                 models.append(
                     ModelUserResponse.model_validate(
                         {
-                            **ModelModel.model_validate(model).model_dump(),
+                            **self._to_model_model(model, db=db).model_dump(),
                             "user": user.model_dump() if user else None,
                         }
                     )
                 )
             return models
 
-    def get_base_models(self) -> list[ModelModel]:
-        with get_db() as db:
+    def get_base_models(self, db: Optional[Session] = None) -> list[ModelModel]:
+        with get_db_context(db) as db:
             return [
-                ModelModel.model_validate(model)
+                self._to_model_model(model, db=db)
                 for model in db.query(Model).filter(Model.base_model_id == None).all()
             ]
 
     def get_models_by_user_id(
-        self, user_id: str, permission: str = "write"
+        self, user_id: str, permission: str = "write", db: Optional[Session] = None
     ) -> list[ModelUserResponse]:
-        models = self.get_models()
+        models = self.get_models(db=db)
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
         return [
             model
             for model in models
             if model.user_id == user_id
-            or has_access(user_id, permission, model.access_control)
+            or AccessGrants.has_access(
+                user_id=user_id,
+                resource_type="model",
+                resource_id=model.id,
+                permission=permission,
+                user_group_ids=user_group_ids,
+                db=db,
+            )
         ]
 
-    def get_model_by_id(self, id: str) -> Optional[ModelModel]:
+    def _has_permission(self, db, query, filter: dict, permission: str = "read"):
+        return AccessGrants.has_permission_filter(
+            db=db,
+            query=query,
+            DocumentModel=Model,
+            filter=filter,
+            resource_type="model",
+            permission=permission,
+        )
+
+    def search_models(
+        self,
+        user_id: str,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> ModelListResponse:
+        with get_db_context(db) as db:
+            # Join GroupMember so we can order by group_id when requested
+            query = db.query(Model, User).outerjoin(User, User.id == Model.user_id)
+            query = query.filter(Model.base_model_id != None)
+
+            if filter:
+                query_key = filter.get("query")
+                if query_key:
+                    query = query.filter(
+                        or_(
+                            Model.name.ilike(f"%{query_key}%"),
+                            Model.base_model_id.ilike(f"%{query_key}%"),
+                            User.name.ilike(f"%{query_key}%"),
+                            User.email.ilike(f"%{query_key}%"),
+                            User.username.ilike(f"%{query_key}%"),
+                        )
+                    )
+
+                view_option = filter.get("view_option")
+                if view_option == "created":
+                    query = query.filter(Model.user_id == user_id)
+                elif view_option == "shared":
+                    query = query.filter(Model.user_id != user_id)
+
+                # Apply access control filtering
+                query = self._has_permission(
+                    db,
+                    query,
+                    filter,
+                    permission="read",
+                )
+
+                tag = filter.get("tag")
+                if tag:
+                    # TODO: This is a simple implementation and should be improved for performance
+                    like_pattern = f'%"{tag.lower()}"%'  # `"tag"` inside JSON array
+                    meta_text = func.lower(cast(Model.meta, String))
+
+                    query = query.filter(meta_text.like(like_pattern))
+
+                order_by = filter.get("order_by")
+                direction = filter.get("direction")
+
+                if order_by == "name":
+                    if direction == "asc":
+                        query = query.order_by(Model.name.asc())
+                    else:
+                        query = query.order_by(Model.name.desc())
+                elif order_by == "created_at":
+                    if direction == "asc":
+                        query = query.order_by(Model.created_at.asc())
+                    else:
+                        query = query.order_by(Model.created_at.desc())
+                elif order_by == "updated_at":
+                    if direction == "asc":
+                        query = query.order_by(Model.updated_at.asc())
+                    else:
+                        query = query.order_by(Model.updated_at.desc())
+
+            else:
+                query = query.order_by(Model.created_at.desc())
+
+            # Count BEFORE pagination
+            total = query.count()
+
+            if skip:
+                query = query.offset(skip)
+            if limit:
+                query = query.limit(limit)
+
+            items = query.all()
+
+            models = []
+            for model, user in items:
+                models.append(
+                    ModelUserResponse(
+                        **self._to_model_model(model, db=db).model_dump(),
+                        user=(
+                            UserResponse(**UserModel.model_validate(user).model_dump())
+                            if user
+                            else None
+                        ),
+                    )
+                )
+
+            return ModelListResponse(items=models, total=total)
+
+    def get_model_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[ModelModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 model = db.get(Model, id)
-                return ModelModel.model_validate(model)
+                return self._to_model_model(model, db=db) if model else None
         except Exception:
             return None
 
-    def toggle_model_by_id(self, id: str) -> Optional[ModelModel]:
-        with get_db() as db:
+    def get_models_by_ids(
+        self, ids: list[str], db: Optional[Session] = None
+    ) -> list[ModelModel]:
+        try:
+            with get_db_context(db) as db:
+                models = db.query(Model).filter(Model.id.in_(ids)).all()
+                return [self._to_model_model(model, db=db) for model in models]
+        except Exception:
+            return []
+
+    def toggle_model_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[ModelModel]:
+        with get_db_context(db) as db:
             try:
-                is_active = db.query(Model).filter_by(id=id).first().is_active
+                model = db.query(Model).filter_by(id=id).first()
+                if not model:
+                    return None
 
-                db.query(Model).filter_by(id=id).update(
-                    {
-                        "is_active": not is_active,
-                        "updated_at": int(time.time()),
-                    }
-                )
+                model.is_active = not model.is_active
+                model.updated_at = int(time.time())
                 db.commit()
+                db.refresh(model)
 
-                return self.get_model_by_id(id)
+                return self._to_model_model(model, db=db)
             except Exception:
                 return None
 
-    def update_model_by_id(self, id: str, model: ModelForm) -> Optional[ModelModel]:
+    def update_model_by_id(
+        self, id: str, model: ModelForm, db: Optional[Session] = None
+    ) -> Optional[ModelModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 # update only the fields that are present in the model
-                result = (
-                    db.query(Model)
-                    .filter_by(id=id)
-                    .update(model.model_dump(exclude={"id"}))
-                )
-                db.commit()
+                data = model.model_dump(exclude={"id", "access_grants"})
+                result = db.query(Model).filter_by(id=id).update(data)
 
-                model = db.get(Model, id)
-                db.refresh(model)
-                return ModelModel.model_validate(model)
+                db.commit()
+                if model.access_grants is not None:
+                    AccessGrants.set_access_grants(
+                        "model", id, model.access_grants, db=db
+                    )
+
+                return self.get_model_by_id(id, db=db)
         except Exception as e:
             log.exception(f"Failed to update the model by id {id}: {e}")
             return None
 
-    def delete_model_by_id(self, id: str) -> bool:
+    def delete_model_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
+                AccessGrants.revoke_all_access("model", id, db=db)
                 db.query(Model).filter_by(id=id).delete()
                 db.commit()
 
@@ -259,9 +409,12 @@ class ModelsTable:
         except Exception:
             return False
 
-    def delete_all_models(self) -> bool:
+    def delete_all_models(self, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
+                model_ids = [row[0] for row in db.query(Model.id).all()]
+                for model_id in model_ids:
+                    AccessGrants.revoke_all_access("model", model_id, db=db)
                 db.query(Model).delete()
                 db.commit()
 
@@ -269,9 +422,11 @@ class ModelsTable:
         except Exception:
             return False
 
-    def sync_models(self, user_id: str, models: list[ModelModel]) -> list[ModelModel]:
+    def sync_models(
+        self, user_id: str, models: list[ModelModel], db: Optional[Session] = None
+    ) -> list[ModelModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 # Get existing models
                 existing_models = db.query(Model).all()
                 existing_ids = {model.id for model in existing_models}
@@ -284,7 +439,7 @@ class ModelsTable:
                     if model.id in existing_ids:
                         db.query(Model).filter_by(id=model.id).update(
                             {
-                                **model.model_dump(),
+                                **model.model_dump(exclude={"access_grants"}),
                                 "user_id": user_id,
                                 "updated_at": int(time.time()),
                             }
@@ -292,22 +447,27 @@ class ModelsTable:
                     else:
                         new_model = Model(
                             **{
-                                **model.model_dump(),
+                                **model.model_dump(exclude={"access_grants"}),
                                 "user_id": user_id,
                                 "updated_at": int(time.time()),
                             }
                         )
                         db.add(new_model)
+                    AccessGrants.set_access_grants(
+                        "model", model.id, model.access_grants, db=db
+                    )
 
                 # Remove models that are no longer present
                 for model in existing_models:
                     if model.id not in new_model_ids:
+                        AccessGrants.revoke_all_access("model", model.id, db=db)
                         db.delete(model)
 
                 db.commit()
 
                 return [
-                    ModelModel.model_validate(model) for model in db.query(Model).all()
+                    self._to_model_model(model, db=db)
+                    for model in db.query(Model).all()
                 ]
         except Exception as e:
             log.exception(f"Error syncing models for user {user_id}: {e}")

backend/open_webui/models/notes.py

@@ -2,16 +2,18 @@ import json
 import time
 import uuid
 from typing import Optional
+from functools import lru_cache
 
-from open_webui.internal.db import Base, get_db
-from open_webui.utils.access_control import has_access
-from open_webui.models.users import Users, UserResponse
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db, get_db_context
+from open_webui.models.groups import Groups
+from open_webui.models.users import User, UserModel, Users, UserResponse
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON
-from sqlalchemy import or_, func, select, and_, text
-from sqlalchemy.sql import exists
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import BigInteger, Column, Text, JSON
+from sqlalchemy import or_, func, cast
 
 ####################
 # Note DB Schema
@@ -21,15 +23,13 @@ from sqlalchemy.sql import exists
 class Note(Base):
     __tablename__ = "note"
 
-    id = Column(Text, primary_key=True)
+    id = Column(Text, primary_key=True, unique=True)
     user_id = Column(Text)
 
     title = Column(Text)
     data = Column(JSON, nullable=True)
     meta = Column(JSON, nullable=True)
 
-    access_control = Column(JSON, nullable=True)
-
     created_at = Column(BigInteger)
     updated_at = Column(BigInteger)
 
@@ -44,7 +44,7 @@ class NoteModel(BaseModel):
     data: Optional[dict] = None
     meta: Optional[dict] = None
 
-    access_control: Optional[dict] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
     created_at: int  # timestamp in epoch
     updated_at: int  # timestamp in epoch
@@ -59,68 +59,226 @@ class NoteForm(BaseModel):
     title: str
     data: Optional[dict] = None
     meta: Optional[dict] = None
-    access_control: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
 
 
 class NoteUpdateForm(BaseModel):
     title: Optional[str] = None
     data: Optional[dict] = None
     meta: Optional[dict] = None
-    access_control: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
 
 
 class NoteUserResponse(NoteModel):
     user: Optional[UserResponse] = None
 
 
+class NoteItemResponse(BaseModel):
+    id: str
+    title: str
+    data: Optional[dict]
+    updated_at: int
+    created_at: int
+    user: Optional[UserResponse] = None
+
+
+class NoteListResponse(BaseModel):
+    items: list[NoteUserResponse]
+    total: int
+
+
 class NoteTable:
+    def _get_access_grants(
+        self, note_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("note", note_id, db=db)
+
+    def _to_note_model(self, note: Note, db: Optional[Session] = None) -> NoteModel:
+        note_data = NoteModel.model_validate(note).model_dump(exclude={"access_grants"})
+        note_data["access_grants"] = self._get_access_grants(note_data["id"], db=db)
+        return NoteModel.model_validate(note_data)
+
+    def _has_permission(self, db, query, filter: dict, permission: str = "read"):
+        return AccessGrants.has_permission_filter(
+            db=db,
+            query=query,
+            DocumentModel=Note,
+            filter=filter,
+            resource_type="note",
+            permission=permission,
+        )
+
     def insert_new_note(
-        self,
-        form_data: NoteForm,
-        user_id: str,
+        self, user_id: str, form_data: NoteForm, db: Optional[Session] = None
     ) -> Optional[NoteModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             note = NoteModel(
                 **{
                     "id": str(uuid.uuid4()),
                     "user_id": user_id,
-                    **form_data.model_dump(),
+                    **form_data.model_dump(exclude={"access_grants"}),
                     "created_at": int(time.time_ns()),
                     "updated_at": int(time.time_ns()),
+                    "access_grants": [],
                 }
             )
 
-            new_note = Note(**note.model_dump())
+            new_note = Note(**note.model_dump(exclude={"access_grants"}))
 
             db.add(new_note)
             db.commit()
-            return note
+            AccessGrants.set_access_grants(
+                "note", note.id, form_data.access_grants, db=db
+            )
+            return self._to_note_model(new_note, db=db)
 
-    def get_notes(self) -> list[NoteModel]:
-        with get_db() as db:
-            notes = db.query(Note).order_by(Note.updated_at.desc()).all()
-            return [NoteModel.model_validate(note) for note in notes]
+    def get_notes(
+        self, skip: int = 0, limit: int = 50, db: Optional[Session] = None
+    ) -> list[NoteModel]:
+        with get_db_context(db) as db:
+            query = db.query(Note).order_by(Note.updated_at.desc())
+            if skip is not None:
+                query = query.offset(skip)
+            if limit is not None:
+                query = query.limit(limit)
+            notes = query.all()
+            return [self._to_note_model(note, db=db) for note in notes]
+
+    def search_notes(
+        self,
+        user_id: str,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> NoteListResponse:
+        with get_db_context(db) as db:
+            query = db.query(Note, User).outerjoin(User, User.id == Note.user_id)
+            if filter:
+                query_key = filter.get("query")
+                if query_key:
+                    # Normalize search by removing hyphens and spaces (e.g., "todo" matches "to-do" and "to do")
+                    normalized_query = query_key.replace("-", "").replace(" ", "")
+                    query = query.filter(
+                        or_(
+                            func.replace(
+                                func.replace(Note.title, "-", ""), " ", ""
+                            ).ilike(f"%{normalized_query}%"),
+                            func.replace(
+                                func.replace(
+                                    cast(Note.data["content"]["md"], Text), "-", ""
+                                ),
+                                " ",
+                                "",
+                            ).ilike(f"%{normalized_query}%"),
+                        )
+                    )
+
+                view_option = filter.get("view_option")
+                if view_option == "created":
+                    query = query.filter(Note.user_id == user_id)
+                elif view_option == "shared":
+                    query = query.filter(Note.user_id != user_id)
+
+                # Apply access control filtering
+                if "permission" in filter:
+                    permission = filter["permission"]
+                else:
+                    permission = "write"
+
+                query = self._has_permission(
+                    db,
+                    query,
+                    filter,
+                    permission=permission,
+                )
+
+                order_by = filter.get("order_by")
+                direction = filter.get("direction")
+
+                if order_by == "name":
+                    if direction == "asc":
+                        query = query.order_by(Note.title.asc())
+                    else:
+                        query = query.order_by(Note.title.desc())
+                elif order_by == "created_at":
+                    if direction == "asc":
+                        query = query.order_by(Note.created_at.asc())
+                    else:
+                        query = query.order_by(Note.created_at.desc())
+                elif order_by == "updated_at":
+                    if direction == "asc":
+                        query = query.order_by(Note.updated_at.asc())
+                    else:
+                        query = query.order_by(Note.updated_at.desc())
+                else:
+                    query = query.order_by(Note.updated_at.desc())
+
+            else:
+                query = query.order_by(Note.updated_at.desc())
+
+            # Count BEFORE pagination
+            total = query.count()
+
+            if skip:
+                query = query.offset(skip)
+            if limit:
+                query = query.limit(limit)
+
+            items = query.all()
+
+            notes = []
+            for note, user in items:
+                notes.append(
+                    NoteUserResponse(
+                        **self._to_note_model(note, db=db).model_dump(),
+                        user=(
+                            UserResponse(**UserModel.model_validate(user).model_dump())
+                            if user
+                            else None
+                        ),
+                    )
+                )
+
+            return NoteListResponse(items=notes, total=total)
 
     def get_notes_by_user_id(
-        self, user_id: str, permission: str = "write"
+        self,
+        user_id: str,
+        permission: str = "read",
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[Session] = None,
     ) -> list[NoteModel]:
-        notes = self.get_notes()
-        return [
-            note
-            for note in notes
-            if note.user_id == user_id
-            or has_access(user_id, permission, note.access_control)
-        ]
+        with get_db_context(db) as db:
+            user_group_ids = [
+                group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+            ]
 
-    def get_note_by_id(self, id: str) -> Optional[NoteModel]:
-        with get_db() as db:
+            query = db.query(Note).order_by(Note.updated_at.desc())
+            query = self._has_permission(
+                db, query, {"user_id": user_id, "group_ids": user_group_ids}, permission
+            )
+
+            if skip is not None:
+                query = query.offset(skip)
+            if limit is not None:
+                query = query.limit(limit)
+
+            notes = query.all()
+            return [self._to_note_model(note, db=db) for note in notes]
+
+    def get_note_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[NoteModel]:
+        with get_db_context(db) as db:
             note = db.query(Note).filter(Note.id == id).first()
-            return NoteModel.model_validate(note) if note else None
+            return self._to_note_model(note, db=db) if note else None
 
     def update_note_by_id(
-        self, id: str, form_data: NoteUpdateForm
+        self, id: str, form_data: NoteUpdateForm, db: Optional[Session] = None
     ) -> Optional[NoteModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             note = db.query(Note).filter(Note.id == id).first()
             if not note:
                 return None
@@ -134,19 +292,25 @@ class NoteTable:
             if "meta" in form_data:
                 note.meta = {**note.meta, **form_data["meta"]}
 
-            if "access_control" in form_data:
-                note.access_control = form_data["access_control"]
+            if "access_grants" in form_data:
+                AccessGrants.set_access_grants(
+                    "note", id, form_data["access_grants"], db=db
+                )
 
             note.updated_at = int(time.time_ns())
 
             db.commit()
-            return NoteModel.model_validate(note) if note else None
+            return self._to_note_model(note, db=db) if note else None
 
-    def delete_note_by_id(self, id: str):
-        with get_db() as db:
-            db.query(Note).filter(Note.id == id).delete()
-            db.commit()
-            return True
+    def delete_note_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        try:
+            with get_db_context(db) as db:
+                AccessGrants.revoke_all_access("note", id, db=db)
+                db.query(Note).filter(Note.id == id).delete()
+                db.commit()
+                return True
+        except Exception:
+            return False
 
 
 Notes = NoteTable()

backend/open_webui/models/oauth_sessions.py

@@ -0,0 +1,288 @@
+import time
+import logging
+import uuid
+from typing import Optional, List
+import base64
+import hashlib
+import json
+
+from cryptography.fernet import Fernet
+
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db, get_db_context
+from open_webui.env import OAUTH_SESSION_TOKEN_ENCRYPTION_KEY
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import BigInteger, Column, String, Text, Index
+
+log = logging.getLogger(__name__)
+
+####################
+# DB MODEL
+####################
+
+
+class OAuthSession(Base):
+    __tablename__ = "oauth_session"
+
+    id = Column(Text, primary_key=True, unique=True)
+    user_id = Column(Text, nullable=False)
+    provider = Column(Text, nullable=False)
+    token = Column(
+        Text, nullable=False
+    )  # JSON with access_token, id_token, refresh_token
+    expires_at = Column(BigInteger, nullable=False)
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    # Add indexes for better performance
+    __table_args__ = (
+        Index("idx_oauth_session_user_id", "user_id"),
+        Index("idx_oauth_session_expires_at", "expires_at"),
+        Index("idx_oauth_session_user_provider", "user_id", "provider"),
+    )
+
+
+class OAuthSessionModel(BaseModel):
+    id: str
+    user_id: str
+    provider: str
+    token: dict
+    expires_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch
+    updated_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+####################
+# Forms
+####################
+
+
+class OAuthSessionResponse(BaseModel):
+    id: str
+    user_id: str
+    provider: str
+    expires_at: int
+
+
+class OAuthSessionTable:
+    def __init__(self):
+        self.encryption_key = OAUTH_SESSION_TOKEN_ENCRYPTION_KEY
+        if not self.encryption_key:
+            raise Exception("OAUTH_SESSION_TOKEN_ENCRYPTION_KEY is not set")
+
+        # check if encryption key is in the right format for Fernet (32 url-safe base64-encoded bytes)
+        if len(self.encryption_key) != 44:
+            key_bytes = hashlib.sha256(self.encryption_key.encode()).digest()
+            self.encryption_key = base64.urlsafe_b64encode(key_bytes)
+        else:
+            self.encryption_key = self.encryption_key.encode()
+
+        try:
+            self.fernet = Fernet(self.encryption_key)
+        except Exception as e:
+            log.error(f"Error initializing Fernet with provided key: {e}")
+            raise
+
+    def _encrypt_token(self, token) -> str:
+        """Encrypt OAuth tokens for storage"""
+        try:
+            token_json = json.dumps(token)
+            encrypted = self.fernet.encrypt(token_json.encode()).decode()
+            return encrypted
+        except Exception as e:
+            log.error(f"Error encrypting tokens: {e}")
+            raise
+
+    def _decrypt_token(self, token: str):
+        """Decrypt OAuth tokens from storage"""
+        try:
+            decrypted = self.fernet.decrypt(token.encode()).decode()
+            return json.loads(decrypted)
+        except Exception as e:
+            log.error(f"Error decrypting tokens: {e}")
+            raise
+
+    def create_session(
+        self,
+        user_id: str,
+        provider: str,
+        token: dict,
+        db: Optional[Session] = None,
+    ) -> Optional[OAuthSessionModel]:
+        """Create a new OAuth session"""
+        try:
+            with get_db_context(db) as db:
+                current_time = int(time.time())
+                id = str(uuid.uuid4())
+
+                result = OAuthSession(
+                    **{
+                        "id": id,
+                        "user_id": user_id,
+                        "provider": provider,
+                        "token": self._encrypt_token(token),
+                        "expires_at": token.get("expires_at"),
+                        "created_at": current_time,
+                        "updated_at": current_time,
+                    }
+                )
+
+                db.add(result)
+                db.commit()
+                db.refresh(result)
+
+                if result:
+                    result.token = token  # Return decrypted token
+                    return OAuthSessionModel.model_validate(result)
+                else:
+                    return None
+        except Exception as e:
+            log.error(f"Error creating OAuth session: {e}")
+            return None
+
+    def get_session_by_id(
+        self, session_id: str, db: Optional[Session] = None
+    ) -> Optional[OAuthSessionModel]:
+        """Get OAuth session by ID"""
+        try:
+            with get_db_context(db) as db:
+                session = db.query(OAuthSession).filter_by(id=session_id).first()
+                if session:
+                    session.token = self._decrypt_token(session.token)
+                    return OAuthSessionModel.model_validate(session)
+
+                return None
+        except Exception as e:
+            log.error(f"Error getting OAuth session by ID: {e}")
+            return None
+
+    def get_session_by_id_and_user_id(
+        self, session_id: str, user_id: str, db: Optional[Session] = None
+    ) -> Optional[OAuthSessionModel]:
+        """Get OAuth session by ID and user ID"""
+        try:
+            with get_db_context(db) as db:
+                session = (
+                    db.query(OAuthSession)
+                    .filter_by(id=session_id, user_id=user_id)
+                    .first()
+                )
+                if session:
+                    session.token = self._decrypt_token(session.token)
+                    return OAuthSessionModel.model_validate(session)
+
+                return None
+        except Exception as e:
+            log.error(f"Error getting OAuth session by ID: {e}")
+            return None
+
+    def get_session_by_provider_and_user_id(
+        self, provider: str, user_id: str, db: Optional[Session] = None
+    ) -> Optional[OAuthSessionModel]:
+        """Get OAuth session by provider and user ID"""
+        try:
+            with get_db_context(db) as db:
+                session = (
+                    db.query(OAuthSession)
+                    .filter_by(provider=provider, user_id=user_id)
+                    .first()
+                )
+                if session:
+                    session.token = self._decrypt_token(session.token)
+                    return OAuthSessionModel.model_validate(session)
+
+                return None
+        except Exception as e:
+            log.error(f"Error getting OAuth session by provider and user ID: {e}")
+            return None
+
+    def get_sessions_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> List[OAuthSessionModel]:
+        """Get all OAuth sessions for a user"""
+        try:
+            with get_db_context(db) as db:
+                sessions = db.query(OAuthSession).filter_by(user_id=user_id).all()
+
+                results = []
+                for session in sessions:
+                    session.token = self._decrypt_token(session.token)
+                    results.append(OAuthSessionModel.model_validate(session))
+
+                return results
+
+        except Exception as e:
+            log.error(f"Error getting OAuth sessions by user ID: {e}")
+            return []
+
+    def update_session_by_id(
+        self, session_id: str, token: dict, db: Optional[Session] = None
+    ) -> Optional[OAuthSessionModel]:
+        """Update OAuth session tokens"""
+        try:
+            with get_db_context(db) as db:
+                current_time = int(time.time())
+
+                db.query(OAuthSession).filter_by(id=session_id).update(
+                    {
+                        "token": self._encrypt_token(token),
+                        "expires_at": token.get("expires_at"),
+                        "updated_at": current_time,
+                    }
+                )
+                db.commit()
+                session = db.query(OAuthSession).filter_by(id=session_id).first()
+
+                if session:
+                    session.token = self._decrypt_token(session.token)
+                    return OAuthSessionModel.model_validate(session)
+
+                return None
+        except Exception as e:
+            log.error(f"Error updating OAuth session tokens: {e}")
+            return None
+
+    def delete_session_by_id(
+        self, session_id: str, db: Optional[Session] = None
+    ) -> bool:
+        """Delete an OAuth session"""
+        try:
+            with get_db_context(db) as db:
+                result = db.query(OAuthSession).filter_by(id=session_id).delete()
+                db.commit()
+                return result > 0
+        except Exception as e:
+            log.error(f"Error deleting OAuth session: {e}")
+            return False
+
+    def delete_sessions_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> bool:
+        """Delete all OAuth sessions for a user"""
+        try:
+            with get_db_context(db) as db:
+                result = db.query(OAuthSession).filter_by(user_id=user_id).delete()
+                db.commit()
+                return True
+        except Exception as e:
+            log.error(f"Error deleting OAuth sessions by user ID: {e}")
+            return False
+
+    def delete_sessions_by_provider(
+        self, provider: str, db: Optional[Session] = None
+    ) -> bool:
+        """Delete all OAuth sessions for a provider"""
+        try:
+            with get_db_context(db) as db:
+                db.query(OAuthSession).filter_by(provider=provider).delete()
+                db.commit()
+                return True
+        except Exception as e:
+            log.error(f"Error deleting OAuth sessions by provider {provider}: {e}")
+            return False
+
+
+OAuthSessions = OAuthSessionTable()

backend/open_webui/models/prompt_history.py

@@ -0,0 +1,234 @@
+"""Prompt history model for version tracking."""
+
+import time
+import uuid
+from typing import Optional
+import json
+import difflib
+
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db_context
+from open_webui.models.users import Users, UserResponse
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import BigInteger, Column, Text, JSON, Index
+
+####################
+# PromptHistory DB Schema
+####################
+
+
+class PromptHistory(Base):
+    __tablename__ = "prompt_history"
+
+    id = Column(Text, primary_key=True)
+    prompt_id = Column(Text, nullable=False, index=True)
+    parent_id = Column(Text, nullable=True)  # Reference to parent commit
+    snapshot = Column(JSON, nullable=False)
+    user_id = Column(Text, nullable=False)
+    commit_message = Column(Text, nullable=True)
+    created_at = Column(BigInteger, nullable=False)
+
+
+class PromptHistoryModel(BaseModel):
+    id: str
+    prompt_id: str
+    parent_id: Optional[str] = None
+    snapshot: dict
+    user_id: str
+    commit_message: Optional[str] = None
+    created_at: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class PromptHistoryResponse(PromptHistoryModel):
+    """Response model with user info."""
+
+    user: Optional[UserResponse] = None
+
+
+class PromptHistoryTable:
+    def create_history_entry(
+        self,
+        prompt_id: str,
+        snapshot: dict,
+        user_id: str,
+        parent_id: Optional[str] = None,
+        commit_message: Optional[str] = None,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptHistoryModel]:
+        """Create a new history entry (commit) for a prompt."""
+        with get_db_context(db) as db:
+            history = PromptHistory(
+                id=str(uuid.uuid4()),
+                prompt_id=prompt_id,
+                parent_id=parent_id,
+                snapshot=snapshot,
+                user_id=user_id,
+                commit_message=commit_message,
+                created_at=int(time.time()),
+            )
+            db.add(history)
+            db.commit()
+            db.refresh(history)
+            return PromptHistoryModel.model_validate(history)
+
+    def get_history_by_prompt_id(
+        self,
+        prompt_id: str,
+        limit: int = 50,
+        offset: int = 0,
+        db: Optional[Session] = None,
+    ) -> list[PromptHistoryResponse]:
+        """Get all history entries for a prompt, ordered by created_at desc."""
+        with get_db_context(db) as db:
+            entries = (
+                db.query(PromptHistory)
+                .filter(PromptHistory.prompt_id == prompt_id)
+                .order_by(PromptHistory.created_at.desc())
+                .offset(offset)
+                .limit(limit)
+                .all()
+            )
+
+            # Get user info for each entry
+            user_ids = list(set(e.user_id for e in entries))
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
+            return [
+                PromptHistoryResponse(
+                    **PromptHistoryModel.model_validate(entry).model_dump(),
+                    user=(
+                        users_dict.get(entry.user_id).model_dump()
+                        if users_dict.get(entry.user_id)
+                        else None
+                    ),
+                )
+                for entry in entries
+            ]
+
+    def get_history_entry_by_id(
+        self,
+        history_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptHistoryModel]:
+        """Get a specific history entry by ID."""
+        with get_db_context(db) as db:
+            entry = (
+                db.query(PromptHistory).filter(PromptHistory.id == history_id).first()
+            )
+            if entry:
+                return PromptHistoryModel.model_validate(entry)
+            return None
+
+    def get_latest_history_entry(
+        self,
+        prompt_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptHistoryModel]:
+        """Get the most recent history entry for a prompt."""
+        with get_db_context(db) as db:
+            entry = (
+                db.query(PromptHistory)
+                .filter(PromptHistory.prompt_id == prompt_id)
+                .order_by(PromptHistory.created_at.desc())
+                .first()
+            )
+            if entry:
+                return PromptHistoryModel.model_validate(entry)
+            return None
+
+    def get_history_count(
+        self,
+        prompt_id: str,
+        db: Optional[Session] = None,
+    ) -> int:
+        """Get the number of history entries for a prompt."""
+        with get_db_context(db) as db:
+            return (
+                db.query(PromptHistory)
+                .filter(PromptHistory.prompt_id == prompt_id)
+                .count()
+            )
+
+    def compute_diff(
+        self,
+        from_id: str,
+        to_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[dict]:
+        """Compute diff between two history entries."""
+        with get_db_context(db) as db:
+            from_entry = (
+                db.query(PromptHistory).filter(PromptHistory.id == from_id).first()
+            )
+            to_entry = db.query(PromptHistory).filter(PromptHistory.id == to_id).first()
+
+            if not from_entry or not to_entry:
+                return None
+
+            from_snapshot = from_entry.snapshot
+            to_snapshot = to_entry.snapshot
+
+            # Compute diff for content field
+            from_content = from_snapshot.get("content", "")
+            to_content = to_snapshot.get("content", "")
+
+            diff_lines = list(
+                difflib.unified_diff(
+                    from_content.splitlines(keepends=True),
+                    to_content.splitlines(keepends=True),
+                    fromfile=f"v{from_id[:8]}",
+                    tofile=f"v{to_id[:8]}",
+                    lineterm="",
+                )
+            )
+
+            return {
+                "from_id": from_id,
+                "to_id": to_id,
+                "from_snapshot": from_snapshot,
+                "to_snapshot": to_snapshot,
+                "content_diff": diff_lines,
+                "name_changed": from_snapshot.get("name") != to_snapshot.get("name"),
+            }
+
+    def delete_history_by_prompt_id(
+        self,
+        prompt_id: str,
+        db: Optional[Session] = None,
+    ) -> bool:
+        """Delete all history entries for a prompt."""
+        with get_db_context(db) as db:
+            db.query(PromptHistory).filter(
+                PromptHistory.prompt_id == prompt_id
+            ).delete()
+            db.commit()
+            return True
+
+    def delete_history_entry(
+        self,
+        history_id: str,
+        db: Optional[Session] = None,
+    ) -> bool:
+        """Delete a history entry and reparent its children to grandparent."""
+        with get_db_context(db) as db:
+            entry = db.query(PromptHistory).filter_by(id=history_id).first()
+            if not entry:
+                return False
+
+            # Find children that reference this entry as parent
+            children = db.query(PromptHistory).filter_by(parent_id=history_id).all()
+
+            # Reparent children to grandparent
+            for child in children:
+                child.parent_id = entry.parent_id
+
+            db.delete(entry)
+            db.commit()
+            return True
+
+
+PromptHistories = PromptHistoryTable()

backend/open_webui/models/prompts.py

@@ -1,13 +1,17 @@
 import time
+import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from open_webui.models.groups import Groups
 from open_webui.models.users import Users, UserResponse
+from open_webui.models.prompt_history import PromptHistories
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, String, Text, JSON
 
-from open_webui.utils.access_control import has_access
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON, or_, func, cast
 
 ####################
 # Prompts DB Schema
@@ -17,38 +21,35 @@ from open_webui.utils.access_control import has_access
 class Prompt(Base):
     __tablename__ = "prompt"
 
-    command = Column(String, primary_key=True)
+    id = Column(Text, primary_key=True)
+    command = Column(String, unique=True, index=True)
     user_id = Column(String)
-    title = Column(Text)
+    name = Column(Text)
     content = Column(Text)
-    timestamp = Column(BigInteger)
-
-    access_control = Column(JSON, nullable=True)  # Controls data access levels.
-    # Defines access control rules for this entry.
-    # - `None`: Public access, available to all users with the "user" role.
-    # - `{}`: Private access, restricted exclusively to the owner.
-    # - Custom permissions: Specific access control for reading and writing;
-    #   Can specify group or user-level restrictions:
-    #   {
-    #      "read": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      },
-    #      "write": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      }
-    #   }
+    data = Column(JSON, nullable=True)
+    meta = Column(JSON, nullable=True)
+    tags = Column(JSON, nullable=True)
+    is_active = Column(Boolean, default=True)
+    version_id = Column(Text, nullable=True)  # Points to active history entry
+    created_at = Column(BigInteger, nullable=True)
+    updated_at = Column(BigInteger, nullable=True)
 
 
 class PromptModel(BaseModel):
+    id: Optional[str] = None
     command: str
     user_id: str
-    title: str
+    name: str
     content: str
-    timestamp: int  # timestamp in epoch
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    tags: Optional[list[str]] = None
+    is_active: Optional[bool] = True
+    version_id: Optional[str] = None
+    created_at: Optional[int] = None
+    updated_at: Optional[int] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
-    access_control: Optional[dict] = None
     model_config = ConfigDict(from_attributes=True)
 
 
@@ -61,56 +62,161 @@ class PromptUserResponse(PromptModel):
     user: Optional[UserResponse] = None
 
 
+class PromptAccessResponse(PromptUserResponse):
+    write_access: Optional[bool] = False
+
+
+class PromptListResponse(BaseModel):
+    items: list[PromptUserResponse]
+    total: int
+
+
+class PromptAccessListResponse(BaseModel):
+    items: list[PromptAccessResponse]
+    total: int
+
+
 class PromptForm(BaseModel):
+
     command: str
-    title: str
+    name: str  # Changed from title
     content: str
-    access_control: Optional[dict] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    tags: Optional[list[str]] = None
+    access_grants: Optional[list[dict]] = None
+    version_id: Optional[str] = None  # Active version
+    commit_message: Optional[str] = None  # For history tracking
+    is_production: Optional[bool] = True  # Whether to set new version as production
 
 
 class PromptsTable:
+    def _get_access_grants(
+        self, prompt_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("prompt", prompt_id, db=db)
+
+    def _to_prompt_model(
+        self, prompt: Prompt, db: Optional[Session] = None
+    ) -> PromptModel:
+        prompt_data = PromptModel.model_validate(prompt).model_dump(
+            exclude={"access_grants"}
+        )
+        prompt_data["access_grants"] = self._get_access_grants(prompt_data["id"], db=db)
+        return PromptModel.model_validate(prompt_data)
+
     def insert_new_prompt(
-        self, user_id: str, form_data: PromptForm
+        self, user_id: str, form_data: PromptForm, db: Optional[Session] = None
     ) -> Optional[PromptModel]:
+        now = int(time.time())
+        prompt_id = str(uuid.uuid4())
+
         prompt = PromptModel(
-            **{
-                "user_id": user_id,
-                **form_data.model_dump(),
-                "timestamp": int(time.time()),
-            }
+            id=prompt_id,
+            user_id=user_id,
+            command=form_data.command,
+            name=form_data.name,
+            content=form_data.content,
+            data=form_data.data or {},
+            meta=form_data.meta or {},
+            tags=form_data.tags or [],
+            access_grants=[],
+            is_active=True,
+            created_at=now,
+            updated_at=now,
         )
 
         try:
-            with get_db() as db:
-                result = Prompt(**prompt.model_dump())
+            with get_db_context(db) as db:
+                result = Prompt(**prompt.model_dump(exclude={"access_grants"}))
                 db.add(result)
                 db.commit()
                 db.refresh(result)
+                AccessGrants.set_access_grants(
+                    "prompt", prompt_id, form_data.access_grants, db=db
+                )
+
                 if result:
-                    return PromptModel.model_validate(result)
+                    current_access_grants = self._get_access_grants(prompt_id, db=db)
+                    snapshot = {
+                        "name": form_data.name,
+                        "content": form_data.content,
+                        "command": form_data.command,
+                        "data": form_data.data or {},
+                        "meta": form_data.meta or {},
+                        "tags": form_data.tags or [],
+                        "access_grants": [
+                            grant.model_dump() for grant in current_access_grants
+                        ],
+                    }
+
+                    history_entry = PromptHistories.create_history_entry(
+                        prompt_id=prompt_id,
+                        snapshot=snapshot,
+                        user_id=user_id,
+                        parent_id=None,  # Initial commit has no parent
+                        commit_message=form_data.commit_message or "Initial version",
+                        db=db,
+                    )
+
+                    # Set the initial version as the production version
+                    if history_entry:
+                        result.version_id = history_entry.id
+                        db.commit()
+                        db.refresh(result)
+
+                    return self._to_prompt_model(result, db=db)
                 else:
                     return None
         except Exception:
             return None
 
-    def get_prompt_by_command(self, command: str) -> Optional[PromptModel]:
+    def get_prompt_by_id(
+        self, prompt_id: str, db: Optional[Session] = None
+    ) -> Optional[PromptModel]:
+        """Get prompt by UUID."""
         try:
-            with get_db() as db:
-                prompt = db.query(Prompt).filter_by(command=command).first()
-                return PromptModel.model_validate(prompt)
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+                if prompt:
+                    return self._to_prompt_model(prompt, db=db)
+                return None
         except Exception:
             return None
 
-    def get_prompts(self) -> list[PromptUserResponse]:
-        with get_db() as db:
-            prompts = []
+    def get_prompt_by_command(
+        self, command: str, db: Optional[Session] = None
+    ) -> Optional[PromptModel]:
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(command=command).first()
+                if prompt:
+                    return self._to_prompt_model(prompt, db=db)
+                return None
+        except Exception:
+            return None
 
-            for prompt in db.query(Prompt).order_by(Prompt.timestamp.desc()).all():
-                user = Users.get_user_by_id(prompt.user_id)
+    def get_prompts(self, db: Optional[Session] = None) -> list[PromptUserResponse]:
+        with get_db_context(db) as db:
+            all_prompts = (
+                db.query(Prompt)
+                .filter(Prompt.is_active == True)
+                .order_by(Prompt.updated_at.desc())
+                .all()
+            )
+
+            user_ids = list(set(prompt.user_id for prompt in all_prompts))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
+            prompts = []
+            for prompt in all_prompts:
+                user = users_dict.get(prompt.user_id)
                 prompts.append(
                     PromptUserResponse.model_validate(
                         {
-                            **PromptModel.model_validate(prompt).model_dump(),
+                            **self._to_prompt_model(prompt, db=db).model_dump(),
                             "user": user.model_dump() if user else None,
                         }
                     )
@@ -119,41 +225,411 @@ class PromptsTable:
             return prompts
 
     def get_prompts_by_user_id(
-        self, user_id: str, permission: str = "write"
+        self, user_id: str, permission: str = "write", db: Optional[Session] = None
     ) -> list[PromptUserResponse]:
-        prompts = self.get_prompts()
+        prompts = self.get_prompts(db=db)
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
 
         return [
             prompt
             for prompt in prompts
             if prompt.user_id == user_id
-            or has_access(user_id, permission, prompt.access_control)
+            or AccessGrants.has_access(
+                user_id=user_id,
+                resource_type="prompt",
+                resource_id=prompt.id,
+                permission=permission,
+                user_group_ids=user_group_ids,
+                db=db,
+            )
         ]
 
+    def search_prompts(
+        self,
+        user_id: str,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> PromptListResponse:
+        with get_db_context(db) as db:
+            from open_webui.models.users import User, UserModel
+
+            # Join with User table for user filtering and sorting
+            query = db.query(Prompt, User).outerjoin(User, User.id == Prompt.user_id)
+            query = query.filter(Prompt.is_active == True)
+
+            if filter:
+                query_key = filter.get("query")
+                if query_key:
+                    query = query.filter(
+                        or_(
+                            Prompt.name.ilike(f"%{query_key}%"),
+                            Prompt.command.ilike(f"%{query_key}%"),
+                            Prompt.content.ilike(f"%{query_key}%"),
+                            User.name.ilike(f"%{query_key}%"),
+                            User.email.ilike(f"%{query_key}%"),
+                        )
+                    )
+
+                view_option = filter.get("view_option")
+                if view_option == "created":
+                    query = query.filter(Prompt.user_id == user_id)
+                elif view_option == "shared":
+                    query = query.filter(Prompt.user_id != user_id)
+
+                # Apply access grant filtering
+                query = AccessGrants.has_permission_filter(
+                    db=db,
+                    query=query,
+                    DocumentModel=Prompt,
+                    filter=filter,
+                    resource_type="prompt",
+                    permission="read",
+                )
+
+                tag = filter.get("tag")
+                if tag:
+                    # Search for tag in JSON array field
+                    like_pattern = f'%"{tag.lower()}"%'
+                    tags_text = func.lower(cast(Prompt.tags, String))
+                    query = query.filter(tags_text.like(like_pattern))
+
+                order_by = filter.get("order_by")
+                direction = filter.get("direction")
+
+                if order_by == "name":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.name.asc())
+                    else:
+                        query = query.order_by(Prompt.name.desc())
+                elif order_by == "created_at":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.created_at.asc())
+                    else:
+                        query = query.order_by(Prompt.created_at.desc())
+                elif order_by == "updated_at":
+                    if direction == "asc":
+                        query = query.order_by(Prompt.updated_at.asc())
+                    else:
+                        query = query.order_by(Prompt.updated_at.desc())
+                else:
+                    query = query.order_by(Prompt.updated_at.desc())
+            else:
+                query = query.order_by(Prompt.updated_at.desc())
+
+            # Count BEFORE pagination
+            total = query.count()
+
+            if skip:
+                query = query.offset(skip)
+            if limit:
+                query = query.limit(limit)
+
+            items = query.all()
+
+            prompts = []
+            for prompt, user in items:
+                prompts.append(
+                    PromptUserResponse(
+                        **self._to_prompt_model(prompt, db=db).model_dump(),
+                        user=(
+                            UserResponse(**UserModel.model_validate(user).model_dump())
+                            if user
+                            else None
+                        ),
+                    )
+                )
+
+            return PromptListResponse(items=prompts, total=total)
+
     def update_prompt_by_command(
-        self, command: str, form_data: PromptForm
+        self,
+        command: str,
+        form_data: PromptForm,
+        user_id: str,
+        db: Optional[Session] = None,
     ) -> Optional[PromptModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 prompt = db.query(Prompt).filter_by(command=command).first()
-                prompt.title = form_data.title
+                if not prompt:
+                    return None
+
+                latest_history = PromptHistories.get_latest_history_entry(
+                    prompt.id, db=db
+                )
+                parent_id = latest_history.id if latest_history else None
+                current_access_grants = self._get_access_grants(prompt.id, db=db)
+
+                # Check if content changed to decide on history creation
+                content_changed = (
+                    prompt.name != form_data.name
+                    or prompt.content != form_data.content
+                    or form_data.access_grants is not None
+                )
+
+                # Update prompt fields
+                prompt.name = form_data.name
                 prompt.content = form_data.content
-                prompt.access_control = form_data.access_control
-                prompt.timestamp = int(time.time())
+                prompt.data = form_data.data or prompt.data
+                prompt.meta = form_data.meta or prompt.meta
+                prompt.updated_at = int(time.time())
+                if form_data.access_grants is not None:
+                    AccessGrants.set_access_grants(
+                        "prompt", prompt.id, form_data.access_grants, db=db
+                    )
+                    current_access_grants = self._get_access_grants(prompt.id, db=db)
+
                 db.commit()
-                return PromptModel.model_validate(prompt)
+
+                # Create history entry only if content changed
+                if content_changed:
+                    snapshot = {
+                        "name": form_data.name,
+                        "content": form_data.content,
+                        "command": command,
+                        "data": form_data.data or {},
+                        "meta": form_data.meta or {},
+                        "access_grants": [
+                            grant.model_dump() for grant in current_access_grants
+                        ],
+                    }
+
+                    history_entry = PromptHistories.create_history_entry(
+                        prompt_id=prompt.id,
+                        snapshot=snapshot,
+                        user_id=user_id,
+                        parent_id=parent_id,
+                        commit_message=form_data.commit_message,
+                        db=db,
+                    )
+
+                    # Set as production if flag is True (default)
+                    if form_data.is_production and history_entry:
+                        prompt.version_id = history_entry.id
+                        db.commit()
+
+                return self._to_prompt_model(prompt, db=db)
         except Exception:
             return None
 
-    def delete_prompt_by_command(self, command: str) -> bool:
+    def update_prompt_by_id(
+        self,
+        prompt_id: str,
+        form_data: PromptForm,
+        user_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptModel]:
         try:
-            with get_db() as db:
-                db.query(Prompt).filter_by(command=command).delete()
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+                if not prompt:
+                    return None
+
+                latest_history = PromptHistories.get_latest_history_entry(
+                    prompt.id, db=db
+                )
+                parent_id = latest_history.id if latest_history else None
+                current_access_grants = self._get_access_grants(prompt.id, db=db)
+
+                # Check if content changed to decide on history creation
+                content_changed = (
+                    prompt.name != form_data.name
+                    or prompt.command != form_data.command
+                    or prompt.content != form_data.content
+                    or form_data.access_grants is not None
+                    or (form_data.tags is not None and prompt.tags != form_data.tags)
+                )
+
+                # Update prompt fields
+                prompt.name = form_data.name
+                prompt.command = form_data.command
+                prompt.content = form_data.content
+                prompt.data = form_data.data or prompt.data
+                prompt.meta = form_data.meta or prompt.meta
+
+                if form_data.tags is not None:
+                    prompt.tags = form_data.tags
+
+                if form_data.access_grants is not None:
+                    AccessGrants.set_access_grants(
+                        "prompt", prompt.id, form_data.access_grants, db=db
+                    )
+                    current_access_grants = self._get_access_grants(prompt.id, db=db)
+
+                prompt.updated_at = int(time.time())
+
                 db.commit()
 
-                return True
+                # Create history entry only if content changed
+                if content_changed:
+                    snapshot = {
+                        "name": form_data.name,
+                        "content": form_data.content,
+                        "command": prompt.command,
+                        "data": form_data.data or {},
+                        "meta": form_data.meta or {},
+                        "tags": prompt.tags or [],
+                        "access_grants": [
+                            grant.model_dump() for grant in current_access_grants
+                        ],
+                    }
+
+                    history_entry = PromptHistories.create_history_entry(
+                        prompt_id=prompt.id,
+                        snapshot=snapshot,
+                        user_id=user_id,
+                        parent_id=parent_id,
+                        commit_message=form_data.commit_message,
+                        db=db,
+                    )
+
+                    # Set as production if flag is True (default)
+                    if form_data.is_production and history_entry:
+                        prompt.version_id = history_entry.id
+                        db.commit()
+
+                return self._to_prompt_model(prompt, db=db)
+        except Exception:
+            return None
+
+    def update_prompt_metadata(
+        self,
+        prompt_id: str,
+        name: str,
+        command: str,
+        tags: Optional[list[str]] = None,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptModel]:
+        """Update only name, command, and tags (no history created)."""
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+                if not prompt:
+                    return None
+
+                prompt.name = name
+                prompt.command = command
+
+                if tags is not None:
+                    prompt.tags = tags
+
+                prompt.updated_at = int(time.time())
+                db.commit()
+
+                return self._to_prompt_model(prompt, db=db)
+        except Exception:
+            return None
+
+    def update_prompt_version(
+        self,
+        prompt_id: str,
+        version_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[PromptModel]:
+        """Set the active version of a prompt and restore content from that version's snapshot."""
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+                if not prompt:
+                    return None
+
+                history_entry = PromptHistories.get_history_entry_by_id(
+                    version_id, db=db
+                )
+
+                if not history_entry:
+                    return None
+
+                # Restore prompt content from the snapshot
+                snapshot = history_entry.snapshot
+                if snapshot:
+                    prompt.name = snapshot.get("name", prompt.name)
+                    prompt.content = snapshot.get("content", prompt.content)
+                    prompt.data = snapshot.get("data", prompt.data)
+                    prompt.meta = snapshot.get("meta", prompt.meta)
+                    prompt.tags = snapshot.get("tags", prompt.tags)
+                    # Note: command and access_grants are not restored from snapshot
+
+                prompt.version_id = version_id
+                prompt.updated_at = int(time.time())
+                db.commit()
+
+                return self._to_prompt_model(prompt, db=db)
+        except Exception:
+            return None
+
+    def delete_prompt_by_command(
+        self, command: str, db: Optional[Session] = None
+    ) -> bool:
+        """Soft delete a prompt by setting is_active to False."""
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(command=command).first()
+                if prompt:
+                    PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
+                    AccessGrants.revoke_all_access("prompt", prompt.id, db=db)
+
+                    prompt.is_active = False
+                    prompt.updated_at = int(time.time())
+                    db.commit()
+                    return True
+                return False
         except Exception:
             return False
 
+    def delete_prompt_by_id(self, prompt_id: str, db: Optional[Session] = None) -> bool:
+        """Soft delete a prompt by setting is_active to False."""
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+                if prompt:
+                    PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
+                    AccessGrants.revoke_all_access("prompt", prompt.id, db=db)
+
+                    prompt.is_active = False
+                    prompt.updated_at = int(time.time())
+                    db.commit()
+                    return True
+                return False
+        except Exception:
+            return False
+
+    def hard_delete_prompt_by_command(
+        self, command: str, db: Optional[Session] = None
+    ) -> bool:
+        """Permanently delete a prompt and its history."""
+        try:
+            with get_db_context(db) as db:
+                prompt = db.query(Prompt).filter_by(command=command).first()
+                if prompt:
+                    PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
+                    AccessGrants.revoke_all_access("prompt", prompt.id, db=db)
+
+                    # Delete prompt
+                    db.query(Prompt).filter_by(command=command).delete()
+                    db.commit()
+                    return True
+                return False
+        except Exception:
+            return False
+
+    def get_tags(self, db: Optional[Session] = None) -> list[str]:
+        try:
+            with get_db_context(db) as db:
+                prompts = db.query(Prompt).filter_by(is_active=True).all()
+                tags = set()
+                for prompt in prompts:
+                    if prompt.tags:
+                        for tag in prompt.tags:
+                            if tag:
+                                tags.add(tag)
+                return sorted(list(tags))
+        except Exception:
+            return []
+
 
 Prompts = PromptsTable()

backend/open_webui/models/skills.py

@@ -0,0 +1,339 @@
+import logging
+import time
+from typing import Optional
+
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, get_db, get_db_context
+from open_webui.models.users import Users, UserResponse
+from open_webui.models.groups import Groups
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
+
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import JSON, BigInteger, Boolean, Column, String, Text, or_
+
+log = logging.getLogger(__name__)
+
+####################
+# Skills DB Schema
+####################
+
+
+class Skill(Base):
+    __tablename__ = "skill"
+
+    id = Column(String, primary_key=True, unique=True)
+    user_id = Column(String)
+    name = Column(Text, unique=True)
+    description = Column(Text, nullable=True)
+    content = Column(Text)
+    meta = Column(JSON)
+    is_active = Column(Boolean, default=True)
+
+    updated_at = Column(BigInteger)
+    created_at = Column(BigInteger)
+
+
+class SkillMeta(BaseModel):
+    tags: Optional[list[str]] = []
+
+
+class SkillModel(BaseModel):
+    id: str
+    user_id: str
+    name: str
+    description: Optional[str] = None
+    content: str
+    meta: SkillMeta
+    is_active: bool = True
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
+
+    updated_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+####################
+# Forms
+####################
+
+
+class SkillUserModel(SkillModel):
+    user: Optional[UserResponse] = None
+
+
+class SkillResponse(BaseModel):
+    id: str
+    user_id: str
+    name: str
+    description: Optional[str] = None
+    meta: SkillMeta
+    is_active: bool = True
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
+    updated_at: int  # timestamp in epoch
+    created_at: int  # timestamp in epoch
+
+
+class SkillUserResponse(SkillResponse):
+    user: Optional[UserResponse] = None
+
+    model_config = ConfigDict(extra="allow")
+
+
+class SkillAccessResponse(SkillUserResponse):
+    write_access: Optional[bool] = False
+
+
+class SkillForm(BaseModel):
+    id: str
+    name: str
+    description: Optional[str] = None
+    content: str
+    meta: SkillMeta = SkillMeta()
+    is_active: bool = True
+    access_grants: Optional[list[dict]] = None
+
+
+class SkillListResponse(BaseModel):
+    items: list[SkillUserResponse] = []
+    total: int = 0
+
+
+class SkillAccessListResponse(BaseModel):
+    items: list[SkillAccessResponse] = []
+    total: int = 0
+
+
+class SkillsTable:
+    def _get_access_grants(
+        self, skill_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("skill", skill_id, db=db)
+
+    def _to_skill_model(self, skill: Skill, db: Optional[Session] = None) -> SkillModel:
+        skill_data = SkillModel.model_validate(skill).model_dump(
+            exclude={"access_grants"}
+        )
+        skill_data["access_grants"] = self._get_access_grants(skill_data["id"], db=db)
+        return SkillModel.model_validate(skill_data)
+
+    def insert_new_skill(
+        self,
+        user_id: str,
+        form_data: SkillForm,
+        db: Optional[Session] = None,
+    ) -> Optional[SkillModel]:
+        with get_db_context(db) as db:
+            try:
+                result = Skill(
+                    **{
+                        **form_data.model_dump(exclude={"access_grants"}),
+                        "user_id": user_id,
+                        "updated_at": int(time.time()),
+                        "created_at": int(time.time()),
+                    }
+                )
+                db.add(result)
+                db.commit()
+                db.refresh(result)
+                AccessGrants.set_access_grants(
+                    "skill", result.id, form_data.access_grants, db=db
+                )
+                if result:
+                    return self._to_skill_model(result, db=db)
+                else:
+                    return None
+            except Exception as e:
+                log.exception(f"Error creating a new skill: {e}")
+                return None
+
+    def get_skill_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[SkillModel]:
+        try:
+            with get_db_context(db) as db:
+                skill = db.get(Skill, id)
+                return self._to_skill_model(skill, db=db) if skill else None
+        except Exception:
+            return None
+
+    def get_skill_by_name(
+        self, name: str, db: Optional[Session] = None
+    ) -> Optional[SkillModel]:
+        try:
+            with get_db_context(db) as db:
+                skill = db.query(Skill).filter_by(name=name).first()
+                return self._to_skill_model(skill, db=db) if skill else None
+        except Exception:
+            return None
+
+    def get_skills(self, db: Optional[Session] = None) -> list[SkillUserModel]:
+        with get_db_context(db) as db:
+            all_skills = db.query(Skill).order_by(Skill.updated_at.desc()).all()
+
+            user_ids = list(set(skill.user_id for skill in all_skills))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
+            skills = []
+            for skill in all_skills:
+                user = users_dict.get(skill.user_id)
+                skills.append(
+                    SkillUserModel.model_validate(
+                        {
+                            **self._to_skill_model(skill, db=db).model_dump(),
+                            "user": user.model_dump() if user else None,
+                        }
+                    )
+                )
+            return skills
+
+    def get_skills_by_user_id(
+        self, user_id: str, permission: str = "write", db: Optional[Session] = None
+    ) -> list[SkillUserModel]:
+        skills = self.get_skills(db=db)
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
+
+        return [
+            skill
+            for skill in skills
+            if skill.user_id == user_id
+            or AccessGrants.has_access(
+                user_id=user_id,
+                resource_type="skill",
+                resource_id=skill.id,
+                permission=permission,
+                user_group_ids=user_group_ids,
+                db=db,
+            )
+        ]
+
+    def search_skills(
+        self,
+        user_id: str,
+        filter: dict = {},
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[Session] = None,
+    ) -> SkillListResponse:
+        try:
+            with get_db_context(db) as db:
+                from open_webui.models.users import User, UserModel
+
+                # Join with User table for user filtering
+                query = db.query(Skill, User).outerjoin(User, User.id == Skill.user_id)
+
+                if filter:
+                    query_key = filter.get("query")
+                    if query_key:
+                        query = query.filter(
+                            or_(
+                                Skill.name.ilike(f"%{query_key}%"),
+                                Skill.description.ilike(f"%{query_key}%"),
+                                Skill.id.ilike(f"%{query_key}%"),
+                                User.name.ilike(f"%{query_key}%"),
+                                User.email.ilike(f"%{query_key}%"),
+                            )
+                        )
+
+                    view_option = filter.get("view_option")
+                    if view_option == "created":
+                        query = query.filter(Skill.user_id == user_id)
+                    elif view_option == "shared":
+                        query = query.filter(Skill.user_id != user_id)
+
+                    # Apply access grant filtering
+                    query = AccessGrants.has_permission_filter(
+                        db=db,
+                        query=query,
+                        DocumentModel=Skill,
+                        filter=filter,
+                        resource_type="skill",
+                        permission="read",
+                    )
+
+                query = query.order_by(Skill.updated_at.desc())
+
+                # Count BEFORE pagination
+                total = query.count()
+
+                if skip:
+                    query = query.offset(skip)
+                if limit:
+                    query = query.limit(limit)
+
+                items = query.all()
+
+                skills = []
+                for skill, user in items:
+                    skills.append(
+                        SkillUserResponse(
+                            **self._to_skill_model(skill, db=db).model_dump(),
+                            user=(
+                                UserResponse(
+                                    **UserModel.model_validate(user).model_dump()
+                                )
+                                if user
+                                else None
+                            ),
+                        )
+                    )
+
+                return SkillListResponse(items=skills, total=total)
+        except Exception as e:
+            log.exception(f"Error searching skills: {e}")
+            return SkillListResponse(items=[], total=0)
+
+    def update_skill_by_id(
+        self, id: str, updated: dict, db: Optional[Session] = None
+    ) -> Optional[SkillModel]:
+        try:
+            with get_db_context(db) as db:
+                access_grants = updated.pop("access_grants", None)
+                db.query(Skill).filter_by(id=id).update(
+                    {**updated, "updated_at": int(time.time())}
+                )
+                db.commit()
+                if access_grants is not None:
+                    AccessGrants.set_access_grants("skill", id, access_grants, db=db)
+
+                skill = db.query(Skill).get(id)
+                db.refresh(skill)
+                return self._to_skill_model(skill, db=db)
+        except Exception:
+            return None
+
+    def toggle_skill_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[SkillModel]:
+        with get_db_context(db) as db:
+            try:
+                skill = db.query(Skill).filter_by(id=id).first()
+                if not skill:
+                    return None
+
+                skill.is_active = not skill.is_active
+                skill.updated_at = int(time.time())
+                db.commit()
+                db.refresh(skill)
+
+                return self._to_skill_model(skill, db=db)
+            except Exception:
+                return None
+
+    def delete_skill_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        try:
+            with get_db_context(db) as db:
+                AccessGrants.revoke_all_access("skill", id, db=db)
+                db.query(Skill).filter_by(id=id).delete()
+                db.commit()
+
+                return True
+        except Exception:
+            return False
+
+
+Skills = SkillsTable()

backend/open_webui/models/tags.py

@@ -3,15 +3,14 @@ import time
 import uuid
 from typing import Optional
 
-from open_webui.internal.db import Base, get_db
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
 
-from open_webui.env import SRC_LOG_LEVELS
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, String, JSON, PrimaryKeyConstraint, Index
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 
 ####################
@@ -52,8 +51,10 @@ class TagChatIdForm(BaseModel):
 
 
 class TagTable:
-    def insert_new_tag(self, name: str, user_id: str) -> Optional[TagModel]:
-        with get_db() as db:
+    def insert_new_tag(
+        self, name: str, user_id: str, db: Optional[Session] = None
+    ) -> Optional[TagModel]:
+        with get_db_context(db) as db:
             id = name.replace(" ", "_").lower()
             tag = TagModel(**{"id": id, "user_id": user_id, "name": name})
             try:
@@ -70,27 +71,29 @@ class TagTable:
                 return None
 
     def get_tag_by_name_and_user_id(
-        self, name: str, user_id: str
+        self, name: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[TagModel]:
         try:
             id = name.replace(" ", "_").lower()
-            with get_db() as db:
+            with get_db_context(db) as db:
                 tag = db.query(Tag).filter_by(id=id, user_id=user_id).first()
                 return TagModel.model_validate(tag)
         except Exception:
             return None
 
-    def get_tags_by_user_id(self, user_id: str) -> list[TagModel]:
-        with get_db() as db:
+    def get_tags_by_user_id(
+        self, user_id: str, db: Optional[Session] = None
+    ) -> list[TagModel]:
+        with get_db_context(db) as db:
             return [
                 TagModel.model_validate(tag)
                 for tag in (db.query(Tag).filter_by(user_id=user_id).all())
             ]
 
     def get_tags_by_ids_and_user_id(
-        self, ids: list[str], user_id: str
+        self, ids: list[str], user_id: str, db: Optional[Session] = None
     ) -> list[TagModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             return [
                 TagModel.model_validate(tag)
                 for tag in (
@@ -98,9 +101,11 @@ class TagTable:
                 )
             ]
 
-    def delete_tag_by_name_and_user_id(self, name: str, user_id: str) -> bool:
+    def delete_tag_by_name_and_user_id(
+        self, name: str, user_id: str, db: Optional[Session] = None
+    ) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 id = name.replace(" ", "_").lower()
                 res = db.query(Tag).filter_by(id=id, user_id=user_id).delete()
                 log.debug(f"res: {res}")

backend/open_webui/models/tools.py

@@ -2,17 +2,16 @@ import logging
 import time
 from typing import Optional
 
-from open_webui.internal.db import Base, JSONField, get_db
+from sqlalchemy.orm import Session
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 from open_webui.models.users import Users, UserResponse
-from open_webui.env import SRC_LOG_LEVELS
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, String, Text, JSON
-
-from open_webui.utils.access_control import has_access
+from open_webui.models.groups import Groups
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import BigInteger, Column, String, Text
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["MODELS"])
 
 ####################
 # Tools DB Schema
@@ -22,7 +21,7 @@ log.setLevel(SRC_LOG_LEVELS["MODELS"])
 class Tool(Base):
     __tablename__ = "tool"
 
-    id = Column(String, primary_key=True)
+    id = Column(String, primary_key=True, unique=True)
     user_id = Column(String)
     name = Column(Text)
     content = Column(Text)
@@ -30,23 +29,6 @@ class Tool(Base):
     meta = Column(JSONField)
     valves = Column(JSONField)
 
-    access_control = Column(JSON, nullable=True)  # Controls data access levels.
-    # Defines access control rules for this entry.
-    # - `None`: Public access, available to all users with the "user" role.
-    # - `{}`: Private access, restricted exclusively to the owner.
-    # - Custom permissions: Specific access control for reading and writing;
-    #   Can specify group or user-level restrictions:
-    #   {
-    #      "read": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      },
-    #      "write": {
-    #          "group_ids": ["group_id1", "group_id2"],
-    #          "user_ids":  ["user_id1", "user_id2"]
-    #      }
-    #   }
-
     updated_at = Column(BigInteger)
     created_at = Column(BigInteger)
 
@@ -63,7 +45,7 @@ class ToolModel(BaseModel):
     content: str
     specs: list[dict]
     meta: ToolMeta
-    access_control: Optional[dict] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
     updated_at: int  # timestamp in epoch
     created_at: int  # timestamp in epoch
@@ -85,7 +67,7 @@ class ToolResponse(BaseModel):
     user_id: str
     name: str
     meta: ToolMeta
-    access_control: Optional[dict] = None
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
     updated_at: int  # timestamp in epoch
     created_at: int  # timestamp in epoch
 
@@ -93,13 +75,19 @@ class ToolResponse(BaseModel):
 class ToolUserResponse(ToolResponse):
     user: Optional[UserResponse] = None
 
+    model_config = ConfigDict(extra="allow")
+
+
+class ToolAccessResponse(ToolUserResponse):
+    write_access: Optional[bool] = False
+
 
 class ToolForm(BaseModel):
     id: str
     name: str
     content: str
     meta: ToolMeta
-    access_control: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
 
 
 class ToolValves(BaseModel):
@@ -107,50 +95,74 @@ class ToolValves(BaseModel):
 
 
 class ToolsTable:
-    def insert_new_tool(
-        self, user_id: str, form_data: ToolForm, specs: list[dict]
-    ) -> Optional[ToolModel]:
-        with get_db() as db:
-            tool = ToolModel(
-                **{
-                    **form_data.model_dump(),
-                    "specs": specs,
-                    "user_id": user_id,
-                    "updated_at": int(time.time()),
-                    "created_at": int(time.time()),
-                }
-            )
+    def _get_access_grants(
+        self, tool_id: str, db: Optional[Session] = None
+    ) -> list[AccessGrantModel]:
+        return AccessGrants.get_grants_by_resource("tool", tool_id, db=db)
 
+    def _to_tool_model(self, tool: Tool, db: Optional[Session] = None) -> ToolModel:
+        tool_data = ToolModel.model_validate(tool).model_dump(exclude={"access_grants"})
+        tool_data["access_grants"] = self._get_access_grants(tool_data["id"], db=db)
+        return ToolModel.model_validate(tool_data)
+
+    def insert_new_tool(
+        self,
+        user_id: str,
+        form_data: ToolForm,
+        specs: list[dict],
+        db: Optional[Session] = None,
+    ) -> Optional[ToolModel]:
+        with get_db_context(db) as db:
             try:
-                result = Tool(**tool.model_dump())
+                result = Tool(
+                    **{
+                        **form_data.model_dump(exclude={"access_grants"}),
+                        "specs": specs,
+                        "user_id": user_id,
+                        "updated_at": int(time.time()),
+                        "created_at": int(time.time()),
+                    }
+                )
                 db.add(result)
                 db.commit()
                 db.refresh(result)
+                AccessGrants.set_access_grants(
+                    "tool", result.id, form_data.access_grants, db=db
+                )
                 if result:
-                    return ToolModel.model_validate(result)
+                    return self._to_tool_model(result, db=db)
                 else:
                     return None
             except Exception as e:
                 log.exception(f"Error creating a new tool: {e}")
                 return None
 
-    def get_tool_by_id(self, id: str) -> Optional[ToolModel]:
+    def get_tool_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[ToolModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 tool = db.get(Tool, id)
-                return ToolModel.model_validate(tool)
+                return self._to_tool_model(tool, db=db) if tool else None
         except Exception:
             return None
 
-    def get_tools(self) -> list[ToolUserModel]:
-        with get_db() as db:
+    def get_tools(self, db: Optional[Session] = None) -> list[ToolUserModel]:
+        with get_db_context(db) as db:
+            all_tools = db.query(Tool).order_by(Tool.updated_at.desc()).all()
+
+            user_ids = list(set(tool.user_id for tool in all_tools))
+
+            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users_dict = {user.id: user for user in users}
+
             tools = []
-            for tool in db.query(Tool).order_by(Tool.updated_at.desc()).all():
-                user = Users.get_user_by_id(tool.user_id)
+            for tool in all_tools:
+                user = users_dict.get(tool.user_id)
                 tools.append(
                     ToolUserModel.model_validate(
                         {
-                            **ToolModel.model_validate(tool).model_dump(),
+                            **self._to_tool_model(tool, db=db).model_dump(),
                             "user": user.model_dump() if user else None,
                         }
                     )
@@ -158,42 +170,56 @@ class ToolsTable:
             return tools
 
     def get_tools_by_user_id(
-        self, user_id: str, permission: str = "write"
+        self, user_id: str, permission: str = "write", db: Optional[Session] = None
     ) -> list[ToolUserModel]:
-        tools = self.get_tools()
+        tools = self.get_tools(db=db)
+        user_group_ids = {
+            group.id for group in Groups.get_groups_by_member_id(user_id, db=db)
+        }
 
         return [
             tool
             for tool in tools
             if tool.user_id == user_id
-            or has_access(user_id, permission, tool.access_control)
+            or AccessGrants.has_access(
+                user_id=user_id,
+                resource_type="tool",
+                resource_id=tool.id,
+                permission=permission,
+                user_group_ids=user_group_ids,
+                db=db,
+            )
         ]
 
-    def get_tool_valves_by_id(self, id: str) -> Optional[dict]:
+    def get_tool_valves_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[dict]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 tool = db.get(Tool, id)
                 return tool.valves if tool.valves else {}
         except Exception as e:
             log.exception(f"Error getting tool valves by id {id}")
             return None
 
-    def update_tool_valves_by_id(self, id: str, valves: dict) -> Optional[ToolValves]:
+    def update_tool_valves_by_id(
+        self, id: str, valves: dict, db: Optional[Session] = None
+    ) -> Optional[ToolValves]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 db.query(Tool).filter_by(id=id).update(
                     {"valves": valves, "updated_at": int(time.time())}
                 )
                 db.commit()
-                return self.get_tool_by_id(id)
+                return self.get_tool_by_id(id, db=db)
         except Exception:
             return None
 
     def get_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str
+        self, id: str, user_id: str, db: Optional[Session] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id)
+            user = Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "tools" and "valves" settings
@@ -210,10 +236,10 @@ class ToolsTable:
             return None
 
     def update_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str, valves: dict
+        self, id: str, user_id: str, valves: dict, db: Optional[Session] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id)
+            user = Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "tools" and "valves" settings
@@ -225,7 +251,7 @@ class ToolsTable:
             user_settings["tools"]["valves"][id] = valves
 
             # Update the user settings in the database
-            Users.update_user_by_id(user_id, {"settings": user_settings})
+            Users.update_user_by_id(user_id, {"settings": user_settings}, db=db)
 
             return user_settings["tools"]["valves"][id]
         except Exception as e:
@@ -234,23 +260,29 @@ class ToolsTable:
             )
             return None
 
-    def update_tool_by_id(self, id: str, updated: dict) -> Optional[ToolModel]:
+    def update_tool_by_id(
+        self, id: str, updated: dict, db: Optional[Session] = None
+    ) -> Optional[ToolModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
+                access_grants = updated.pop("access_grants", None)
                 db.query(Tool).filter_by(id=id).update(
                     {**updated, "updated_at": int(time.time())}
                 )
                 db.commit()
+                if access_grants is not None:
+                    AccessGrants.set_access_grants("tool", id, access_grants, db=db)
 
                 tool = db.query(Tool).get(id)
                 db.refresh(tool)
-                return ToolModel.model_validate(tool)
+                return self._to_tool_model(tool, db=db)
         except Exception:
             return None
 
-    def delete_tool_by_id(self, id: str) -> bool:
+    def delete_tool_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
+                AccessGrants.revoke_all_access("tool", id, db=db)
                 db.query(Tool).filter_by(id=id).delete()
                 db.commit()
 

backend/open_webui/models/users.py

@@ -1,18 +1,35 @@
 import time
 from typing import Optional
 
-from open_webui.internal.db import Base, JSONField, get_db
+from sqlalchemy.orm import Session, defer
+from open_webui.internal.db import Base, JSONField, get_db, get_db_context
 
 
 from open_webui.env import DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL
+
 from open_webui.models.chats import Chats
-from open_webui.models.groups import Groups
+from open_webui.models.groups import Groups, GroupMember
+from open_webui.models.channels import ChannelMember
+
 from open_webui.utils.misc import throttle
+from open_webui.utils.validate import validate_profile_image_url
 
 
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, String, Text, Date
-from sqlalchemy import or_
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
+from sqlalchemy import (
+    BigInteger,
+    JSON,
+    Column,
+    String,
+    Boolean,
+    Text,
+    Date,
+    exists,
+    select,
+    cast,
+)
+from sqlalchemy import or_, case, func
+from sqlalchemy.dialects.postgresql import JSONB
 
 import datetime
 
@@ -21,59 +38,73 @@ import datetime
 ####################
 
 
-class User(Base):
-    __tablename__ = "user"
-
-    id = Column(String, primary_key=True)
-    name = Column(String)
-
-    email = Column(String)
-    username = Column(String(50), nullable=True)
-
-    role = Column(String)
-    profile_image_url = Column(Text)
-
-    bio = Column(Text, nullable=True)
-    gender = Column(Text, nullable=True)
-    date_of_birth = Column(Date, nullable=True)
-
-    info = Column(JSONField, nullable=True)
-    settings = Column(JSONField, nullable=True)
-
-    api_key = Column(String, nullable=True, unique=True)
-    oauth_sub = Column(Text, unique=True)
-
-    last_active_at = Column(BigInteger)
-
-    updated_at = Column(BigInteger)
-    created_at = Column(BigInteger)
-
-
 class UserSettings(BaseModel):
     ui: Optional[dict] = {}
     model_config = ConfigDict(extra="allow")
     pass
 
 
+class User(Base):
+    __tablename__ = "user"
+
+    id = Column(String, primary_key=True, unique=True)
+    email = Column(String)
+    username = Column(String(50), nullable=True)
+    role = Column(String)
+
+    name = Column(String)
+
+    profile_image_url = Column(Text)
+    profile_banner_image_url = Column(Text, nullable=True)
+
+    bio = Column(Text, nullable=True)
+    gender = Column(Text, nullable=True)
+    date_of_birth = Column(Date, nullable=True)
+    timezone = Column(String, nullable=True)
+
+    presence_state = Column(String, nullable=True)
+    status_emoji = Column(String, nullable=True)
+    status_message = Column(Text, nullable=True)
+    status_expires_at = Column(BigInteger, nullable=True)
+
+    info = Column(JSON, nullable=True)
+    settings = Column(JSON, nullable=True)
+
+    oauth = Column(JSON, nullable=True)
+    scim = Column(JSON, nullable=True)
+
+    last_active_at = Column(BigInteger)
+    updated_at = Column(BigInteger)
+    created_at = Column(BigInteger)
+
+
 class UserModel(BaseModel):
     id: str
-    name: str
 
     email: str
     username: Optional[str] = None
-
     role: str = "pending"
-    profile_image_url: str
+
+    name: str
+
+    profile_image_url: Optional[str] = None
+    profile_banner_image_url: Optional[str] = None
 
     bio: Optional[str] = None
     gender: Optional[str] = None
     date_of_birth: Optional[datetime.date] = None
+    timezone: Optional[str] = None
+
+    presence_state: Optional[str] = None
+    status_emoji: Optional[str] = None
+    status_message: Optional[str] = None
+    status_expires_at: Optional[int] = None
 
     info: Optional[dict] = None
     settings: Optional[UserSettings] = None
 
-    api_key: Optional[str] = None
-    oauth_sub: Optional[str] = None
+    oauth: Optional[dict] = None
+    scim: Optional[dict] = None
 
     last_active_at: int  # timestamp in epoch
     updated_at: int  # timestamp in epoch
@@ -81,6 +112,44 @@ class UserModel(BaseModel):
 
     model_config = ConfigDict(from_attributes=True)
 
+    @model_validator(mode="after")
+    def set_profile_image_url(self):
+        if not self.profile_image_url:
+            self.profile_image_url = f"/api/v1/users/{self.id}/profile/image"
+        return self
+
+
+class UserStatusModel(UserModel):
+    is_active: bool = False
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class ApiKey(Base):
+    __tablename__ = "api_key"
+
+    id = Column(Text, primary_key=True, unique=True)
+    user_id = Column(Text, nullable=False)
+    key = Column(Text, unique=True, nullable=False)
+    data = Column(JSON, nullable=True)
+    expires_at = Column(BigInteger, nullable=True)
+    last_used_at = Column(BigInteger, nullable=True)
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+
+class ApiKeyModel(BaseModel):
+    id: str
+    user_id: str
+    key: str
+    data: Optional[dict] = None
+    expires_at: Optional[int] = None
+    last_used_at: Optional[int] = None
+    created_at: int  # timestamp in epoch
+    updated_at: int  # timestamp in epoch
+
+    model_config = ConfigDict(from_attributes=True)
+
 
 ####################
 # Forms
@@ -94,17 +163,55 @@ class UpdateProfileForm(BaseModel):
     gender: Optional[str] = None
     date_of_birth: Optional[datetime.date] = None
 
+    @field_validator("profile_image_url")
+    @classmethod
+    def check_profile_image_url(cls, v: str) -> str:
+        return validate_profile_image_url(v)
+
+
+class UserGroupIdsModel(UserModel):
+    group_ids: list[str] = []
+
+
+class UserModelResponse(UserModel):
+    model_config = ConfigDict(extra="allow")
+
 
 class UserListResponse(BaseModel):
-    users: list[UserModel]
+    users: list[UserModelResponse]
     total: int
 
 
-class UserInfoResponse(BaseModel):
+class UserGroupIdsListResponse(BaseModel):
+    users: list[UserGroupIdsModel]
+    total: int
+
+
+class UserStatus(BaseModel):
+    status_emoji: Optional[str] = None
+    status_message: Optional[str] = None
+    status_expires_at: Optional[int] = None
+
+
+class UserInfoResponse(UserStatus):
     id: str
     name: str
     email: str
     role: str
+    bio: Optional[str] = None
+    groups: Optional[list] = []
+    is_active: bool = False
+
+
+class UserIdNameResponse(BaseModel):
+    id: str
+    name: str
+
+
+class UserIdNameStatusResponse(UserStatus):
+    id: str
+    name: str
+    is_active: Optional[bool] = None
 
 
 class UserInfoListResponse(BaseModel):
@@ -112,18 +219,23 @@ class UserInfoListResponse(BaseModel):
     total: int
 
 
-class UserResponse(BaseModel):
-    id: str
-    name: str
-    email: str
-    role: str
-    profile_image_url: str
+class UserIdNameListResponse(BaseModel):
+    users: list[UserIdNameResponse]
+    total: int
 
 
 class UserNameResponse(BaseModel):
     id: str
     name: str
     role: str
+
+
+class UserResponse(UserNameResponse):
+    email: str
+
+
+class UserProfileImageResponse(UserNameResponse):
+    email: str
     profile_image_url: str
 
 
@@ -139,6 +251,11 @@ class UserUpdateForm(BaseModel):
     profile_image_url: str
     password: Optional[str] = None
 
+    @field_validator("profile_image_url")
+    @classmethod
+    def check_profile_image_url(cls, v: str) -> str:
+        return validate_profile_image_url(v)
+
 
 class UsersTable:
     def insert_new_user(
@@ -148,20 +265,23 @@ class UsersTable:
         email: str,
         profile_image_url: str = "/user.png",
         role: str = "pending",
-        oauth_sub: Optional[str] = None,
+        username: Optional[str] = None,
+        oauth: Optional[dict] = None,
+        db: Optional[Session] = None,
     ) -> Optional[UserModel]:
-        with get_db() as db:
+        with get_db_context(db) as db:
             user = UserModel(
                 **{
                     "id": id,
-                    "name": name,
                     "email": email,
+                    "name": name,
                     "role": role,
                     "profile_image_url": profile_image_url,
                     "last_active_at": int(time.time()),
                     "created_at": int(time.time()),
                     "updated_at": int(time.time()),
-                    "oauth_sub": oauth_sub,
+                    "username": username,
+                    "oauth": oauth,
                 }
             )
             result = User(**user.model_dump())
@@ -173,35 +293,86 @@ class UsersTable:
             else:
                 return None
 
-    def get_user_by_id(self, id: str) -> Optional[UserModel]:
+    def get_user_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 user = db.query(User).filter_by(id=id).first()
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def get_user_by_api_key(self, api_key: str) -> Optional[UserModel]:
+    def get_user_by_api_key(
+        self, api_key: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                user = db.query(User).filter_by(api_key=api_key).first()
-                return UserModel.model_validate(user)
+            with get_db_context(db) as db:
+                user = (
+                    db.query(User)
+                    .join(ApiKey, User.id == ApiKey.user_id)
+                    .filter(ApiKey.key == api_key)
+                    .first()
+                )
+                return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_user_by_email(self, email: str) -> Optional[UserModel]:
+    def get_user_by_email(
+        self, email: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                user = db.query(User).filter_by(email=email).first()
-                return UserModel.model_validate(user)
+            with get_db_context(db) as db:
+                user = (
+                    db.query(User)
+                    .filter(func.lower(User.email) == email.lower())
+                    .first()
+                )
+                return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_user_by_oauth_sub(self, sub: str) -> Optional[UserModel]:
+    def get_user_by_oauth_sub(
+        self, provider: str, sub: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                user = db.query(User).filter_by(oauth_sub=sub).first()
-                return UserModel.model_validate(user)
+            with get_db_context(db) as db:  # type: Session
+                dialect_name = db.bind.dialect.name
+
+                query = db.query(User)
+                if dialect_name == "sqlite":
+                    query = query.filter(User.oauth.contains({provider: {"sub": sub}}))
+                elif dialect_name == "postgresql":
+                    query = query.filter(
+                        User.oauth[provider].cast(JSONB)["sub"].astext == sub
+                    )
+
+                user = query.first()
+                return UserModel.model_validate(user) if user else None
+        except Exception as e:
+            # You may want to log the exception here
+            return None
+
+    def get_user_by_scim_external_id(
+        self, provider: str, external_id: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
+        try:
+            with get_db_context(db) as db:  # type: Session
+                dialect_name = db.bind.dialect.name
+
+                query = db.query(User)
+                if dialect_name == "sqlite":
+                    query = query.filter(
+                        User.scim.contains({provider: {"external_id": external_id}})
+                    )
+                elif dialect_name == "postgresql":
+                    query = query.filter(
+                        User.scim[provider].cast(JSONB)["external_id"].astext
+                        == external_id
+                    )
+
+                user = query.first()
+                return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
@@ -210,9 +381,11 @@ class UsersTable:
         filter: Optional[dict] = None,
         skip: Optional[int] = None,
         limit: Optional[int] = None,
-    ) -> UserListResponse:
-        with get_db() as db:
-            query = db.query(User)
+        db: Optional[Session] = None,
+    ) -> dict:
+        with get_db_context(db) as db:
+            # Join GroupMember so we can order by group_id when requested
+            query = db.query(User).options(defer(User.profile_image_url))
 
             if filter:
                 query_key = filter.get("query")
@@ -224,14 +397,76 @@ class UsersTable:
                         )
                     )
 
+                channel_id = filter.get("channel_id")
+                if channel_id:
+                    query = query.filter(
+                        exists(
+                            select(ChannelMember.id).where(
+                                ChannelMember.user_id == User.id,
+                                ChannelMember.channel_id == channel_id,
+                            )
+                        )
+                    )
+
+                user_ids = filter.get("user_ids")
+                group_ids = filter.get("group_ids")
+
+                if isinstance(user_ids, list) and isinstance(group_ids, list):
+                    # If both are empty lists, return no users
+                    if not user_ids and not group_ids:
+                        return {"users": [], "total": 0}
+
+                if user_ids:
+                    query = query.filter(User.id.in_(user_ids))
+
+                if group_ids:
+                    query = query.filter(
+                        exists(
+                            select(GroupMember.id).where(
+                                GroupMember.user_id == User.id,
+                                GroupMember.group_id.in_(group_ids),
+                            )
+                        )
+                    )
+
+                roles = filter.get("roles")
+                if roles:
+                    include_roles = [role for role in roles if not role.startswith("!")]
+                    exclude_roles = [role[1:] for role in roles if role.startswith("!")]
+
+                    if include_roles:
+                        query = query.filter(User.role.in_(include_roles))
+                    if exclude_roles:
+                        query = query.filter(~User.role.in_(exclude_roles))
+
                 order_by = filter.get("order_by")
                 direction = filter.get("direction")
 
-                if order_by == "name":
+                if order_by and order_by.startswith("group_id:"):
+                    group_id = order_by.split(":", 1)[1]
+
+                    # Subquery that checks if the user belongs to the group
+                    membership_exists = exists(
+                        select(GroupMember.id).where(
+                            GroupMember.user_id == User.id,
+                            GroupMember.group_id == group_id,
+                        )
+                    )
+
+                    # CASE: user in group → 1, user not in group → 0
+                    group_sort = case((membership_exists, 1), else_=0)
+
+                    if direction == "asc":
+                        query = query.order_by(group_sort.asc(), User.name.asc())
+                    else:
+                        query = query.order_by(group_sort.desc(), User.name.asc())
+
+                elif order_by == "name":
                     if direction == "asc":
                         query = query.order_by(User.name.asc())
                     else:
                         query = query.order_by(User.name.desc())
+
                 elif order_by == "email":
                     if direction == "asc":
                         query = query.order_by(User.email.asc())
@@ -264,41 +499,67 @@ class UsersTable:
             else:
                 query = query.order_by(User.created_at.desc())
 
-            if skip:
+            # Count BEFORE pagination
+            total = query.count()
+
+            # correct pagination logic
+            if skip is not None:
                 query = query.offset(skip)
-            if limit:
+            if limit is not None:
                 query = query.limit(limit)
 
             users = query.all()
             return {
                 "users": [UserModel.model_validate(user) for user in users],
-                "total": db.query(User).count(),
+                "total": total,
             }
 
-    def get_users_by_user_ids(self, user_ids: list[str]) -> list[UserModel]:
-        with get_db() as db:
-            users = db.query(User).filter(User.id.in_(user_ids)).all()
+    def get_users_by_group_id(
+        self, group_id: str, db: Optional[Session] = None
+    ) -> list[UserModel]:
+        with get_db_context(db) as db:
+            users = (
+                db.query(User)
+                .options(defer(User.profile_image_url))
+                .join(GroupMember, User.id == GroupMember.user_id)
+                .filter(GroupMember.group_id == group_id)
+                .all()
+            )
             return [UserModel.model_validate(user) for user in users]
 
-    def get_num_users(self) -> Optional[int]:
-        with get_db() as db:
+    def get_users_by_user_ids(
+        self, user_ids: list[str], db: Optional[Session] = None
+    ) -> list[UserStatusModel]:
+        with get_db_context(db) as db:
+            users = (
+                db.query(User)
+                .options(defer(User.profile_image_url))
+                .filter(User.id.in_(user_ids))
+                .all()
+            )
+            return [UserModel.model_validate(user) for user in users]
+
+    def get_num_users(self, db: Optional[Session] = None) -> Optional[int]:
+        with get_db_context(db) as db:
             return db.query(User).count()
 
-    def has_users(self) -> bool:
-        with get_db() as db:
+    def has_users(self, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
             return db.query(db.query(User).exists()).scalar()
 
-    def get_first_user(self) -> UserModel:
+    def get_first_user(self, db: Optional[Session] = None) -> UserModel:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 user = db.query(User).order_by(User.created_at).first()
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def get_user_webhook_url_by_id(self, id: str) -> Optional[str]:
+    def get_user_webhook_url_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[str]:
         try:
-            with get_db() as db:
+            with get_db_context(db) as db:
                 user = db.query(User).filter_by(id=id).first()
 
                 if user.settings is None:
@@ -312,75 +573,168 @@ class UsersTable:
         except Exception:
             return None
 
-    def update_user_role_by_id(self, id: str, role: str) -> Optional[UserModel]:
+    def get_num_users_active_today(self, db: Optional[Session] = None) -> Optional[int]:
+        with get_db_context(db) as db:
+            current_timestamp = int(datetime.datetime.now().timestamp())
+            today_midnight_timestamp = current_timestamp - (current_timestamp % 86400)
+            query = db.query(User).filter(
+                User.last_active_at > today_midnight_timestamp
+            )
+            return query.count()
+
+    def update_user_role_by_id(
+        self, id: str, role: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                db.query(User).filter_by(id=id).update({"role": role})
-                db.commit()
+            with get_db_context(db) as db:
                 user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+                user.role = role
+                db.commit()
+                db.refresh(user)
+                return UserModel.model_validate(user)
+        except Exception:
+            return None
+
+    def update_user_status_by_id(
+        self, id: str, form_data: UserStatus, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
+        try:
+            with get_db_context(db) as db:
+                user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+                for key, value in form_data.model_dump(exclude_none=True).items():
+                    setattr(user, key, value)
+                db.commit()
+                db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
     def update_user_profile_image_url_by_id(
-        self, id: str, profile_image_url: str
+        self, id: str, profile_image_url: str, db: Optional[Session] = None
     ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                db.query(User).filter_by(id=id).update(
-                    {"profile_image_url": profile_image_url}
-                )
-                db.commit()
-
+            with get_db_context(db) as db:
                 user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+                user.profile_image_url = profile_image_url
+                db.commit()
+                db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
     @throttle(DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL)
-    def update_user_last_active_by_id(self, id: str) -> Optional[UserModel]:
-        try:
-            with get_db() as db:
-                db.query(User).filter_by(id=id).update(
-                    {"last_active_at": int(time.time())}
-                )
-                db.commit()
-
-                user = db.query(User).filter_by(id=id).first()
-                return UserModel.model_validate(user)
-        except Exception:
-            return None
-
-    def update_user_oauth_sub_by_id(
-        self, id: str, oauth_sub: str
+    def update_last_active_by_id(
+        self, id: str, db: Optional[Session] = None
     ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                db.query(User).filter_by(id=id).update({"oauth_sub": oauth_sub})
-                db.commit()
-
+            with get_db_context(db) as db:
                 user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+                user.last_active_at = int(time.time())
+                db.commit()
+                db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def update_user_by_id(self, id: str, updated: dict) -> Optional[UserModel]:
+    def update_user_oauth_by_id(
+        self, id: str, provider: str, sub: str, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
+        """
+        Update or insert an OAuth provider/sub pair into the user's oauth JSON field.
+        Example resulting structure:
+            {
+                "google": { "sub": "123" },
+                "github": { "sub": "abc" }
+            }
+        """
         try:
-            with get_db() as db:
-                db.query(User).filter_by(id=id).update(updated)
+            with get_db_context(db) as db:
+                user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+
+                # Load existing oauth JSON or create empty
+                oauth = user.oauth or {}
+
+                # Update or insert provider entry
+                oauth[provider] = {"sub": sub}
+
+                # Persist updated JSON
+                db.query(User).filter_by(id=id).update({"oauth": oauth})
                 db.commit()
 
-                user = db.query(User).filter_by(id=id).first()
                 return UserModel.model_validate(user)
-                # return UserModel(**user.dict())
+
+        except Exception:
+            return None
+
+    def update_user_scim_by_id(
+        self,
+        id: str,
+        provider: str,
+        external_id: str,
+        db: Optional[Session] = None,
+    ) -> Optional[UserModel]:
+        """
+        Update or insert a SCIM provider/external_id pair into the user's scim JSON field.
+        Example resulting structure:
+            {
+                "microsoft": { "external_id": "abc" },
+                "okta": { "external_id": "def" }
+            }
+        """
+        try:
+            with get_db_context(db) as db:
+                user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+
+                scim = user.scim or {}
+                scim[provider] = {"external_id": external_id}
+
+                db.query(User).filter_by(id=id).update({"scim": scim})
+                db.commit()
+
+                return UserModel.model_validate(user)
+
+        except Exception:
+            return None
+
+    def update_user_by_id(
+        self, id: str, updated: dict, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
+        try:
+            with get_db_context(db) as db:
+                user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+                for key, value in updated.items():
+                    setattr(user, key, value)
+                db.commit()
+                db.refresh(user)
+                return UserModel.model_validate(user)
         except Exception as e:
             print(e)
             return None
 
-    def update_user_settings_by_id(self, id: str, updated: dict) -> Optional[UserModel]:
+    def update_user_settings_by_id(
+        self, id: str, updated: dict, db: Optional[Session] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db() as db:
-                user_settings = db.query(User).filter_by(id=id).first().settings
+            with get_db_context(db) as db:
+                user = db.query(User).filter_by(id=id).first()
+                if not user:
+                    return None
+
+                user_settings = user.settings
 
                 if user_settings is None:
                     user_settings = {}
@@ -395,15 +749,15 @@ class UsersTable:
         except Exception:
             return None
 
-    def delete_user_by_id(self, id: str) -> bool:
+    def delete_user_by_id(self, id: str, db: Optional[Session] = None) -> bool:
         try:
             # Remove User from Groups
             Groups.remove_user_from_all_groups(id)
 
             # Delete User Chats
-            result = Chats.delete_chats_by_user_id(id)
+            result = Chats.delete_chats_by_user_id(id, db=db)
             if result:
-                with get_db() as db:
+                with get_db_context(db) as db:
                     # Delete User
                     db.query(User).filter_by(id=id).delete()
                     db.commit()
@@ -414,35 +768,89 @@ class UsersTable:
         except Exception:
             return False
 
-    def update_user_api_key_by_id(self, id: str, api_key: str) -> bool:
+    def get_user_api_key_by_id(
+        self, id: str, db: Optional[Session] = None
+    ) -> Optional[str]:
         try:
-            with get_db() as db:
-                result = db.query(User).filter_by(id=id).update({"api_key": api_key})
-                db.commit()
-                return True if result == 1 else False
-        except Exception:
-            return False
-
-    def get_user_api_key_by_id(self, id: str) -> Optional[str]:
-        try:
-            with get_db() as db:
-                user = db.query(User).filter_by(id=id).first()
-                return user.api_key
+            with get_db_context(db) as db:
+                api_key = db.query(ApiKey).filter_by(user_id=id).first()
+                return api_key.key if api_key else None
         except Exception:
             return None
 
-    def get_valid_user_ids(self, user_ids: list[str]) -> list[str]:
-        with get_db() as db:
+    def update_user_api_key_by_id(
+        self, id: str, api_key: str, db: Optional[Session] = None
+    ) -> bool:
+        try:
+            with get_db_context(db) as db:
+                db.query(ApiKey).filter_by(user_id=id).delete()
+                db.commit()
+
+                now = int(time.time())
+                new_api_key = ApiKey(
+                    id=f"key_{id}",
+                    user_id=id,
+                    key=api_key,
+                    created_at=now,
+                    updated_at=now,
+                )
+                db.add(new_api_key)
+                db.commit()
+
+                return True
+
+        except Exception:
+            return False
+
+    def delete_user_api_key_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+        try:
+            with get_db_context(db) as db:
+                db.query(ApiKey).filter_by(user_id=id).delete()
+                db.commit()
+                return True
+        except Exception:
+            return False
+
+    def get_valid_user_ids(
+        self, user_ids: list[str], db: Optional[Session] = None
+    ) -> list[str]:
+        with get_db_context(db) as db:
             users = db.query(User).filter(User.id.in_(user_ids)).all()
             return [user.id for user in users]
 
-    def get_super_admin_user(self) -> Optional[UserModel]:
-        with get_db() as db:
+    def get_super_admin_user(self, db: Optional[Session] = None) -> Optional[UserModel]:
+        with get_db_context(db) as db:
             user = db.query(User).filter_by(role="admin").first()
             if user:
                 return UserModel.model_validate(user)
             else:
                 return None
 
+    def get_active_user_count(self, db: Optional[Session] = None) -> int:
+        with get_db_context(db) as db:
+            # Consider user active if last_active_at within the last 3 minutes
+            three_minutes_ago = int(time.time()) - 180
+            count = (
+                db.query(User).filter(User.last_active_at >= three_minutes_ago).count()
+            )
+            return count
+
+    @staticmethod
+    def is_active(user: UserModel) -> bool:
+        """Compute active status from an already-loaded UserModel (no DB hit)."""
+        if user.last_active_at:
+            three_minutes_ago = int(time.time()) - 180
+            return user.last_active_at >= three_minutes_ago
+        return False
+
+    def is_user_active(self, user_id: str, db: Optional[Session] = None) -> bool:
+        with get_db_context(db) as db:
+            user = db.query(User).filter_by(id=user_id).first()
+            if user and user.last_active_at:
+                # Consider user active if last_active_at within the last 3 minutes
+                three_minutes_ago = int(time.time()) - 180
+                return user.last_active_at >= three_minutes_ago
+            return False
+
 
 Users = UsersTable()

backend/open_webui/retrieval/loaders/datalab_marker.py

@@ -64,7 +64,7 @@ class DatalabMarkerLoader:
         return mime_map.get(ext, "application/octet-stream")
 
     def check_marker_request_status(self, request_id: str) -> dict:
-        url = f"{self.api_base_url}/marker/{request_id}"
+        url = f"{self.api_base_url}/{request_id}"
         headers = {"X-Api-Key": self.api_key}
         try:
             response = requests.get(url, headers=headers)
@@ -111,7 +111,7 @@ class DatalabMarkerLoader:
             with open(self.file_path, "rb") as f:
                 files = {"file": (filename, f, mime_type)}
                 response = requests.post(
-                    f"{self.api_base_url}/marker",
+                    f"{self.api_base_url}",
                     data=form_data,
                     files=files,
                     headers=headers,

backend/open_webui/retrieval/loaders/external_document.py

@@ -1,13 +1,13 @@
 import requests
 import logging, os
 from typing import Iterator, List, Union
+from urllib.parse import quote
 
 from langchain_core.document_loaders import BaseLoader
 from langchain_core.documents import Document
-from open_webui.env import SRC_LOG_LEVELS
+from open_webui.utils.headers import include_user_info_headers
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class ExternalDocumentLoader(BaseLoader):
@@ -17,6 +17,7 @@ class ExternalDocumentLoader(BaseLoader):
         url: str,
         api_key: str,
         mime_type=None,
+        user=None,
         **kwargs,
     ) -> None:
         self.url = url
@@ -25,6 +26,8 @@ class ExternalDocumentLoader(BaseLoader):
         self.file_path = file_path
         self.mime_type = mime_type
 
+        self.user = user
+
     def load(self) -> List[Document]:
         with open(self.file_path, "rb") as f:
             data = f.read()
@@ -37,10 +40,13 @@ class ExternalDocumentLoader(BaseLoader):
             headers["Authorization"] = f"Bearer {self.api_key}"
 
         try:
-            headers["X-Filename"] = os.path.basename(self.file_path)
+            headers["X-Filename"] = quote(os.path.basename(self.file_path))
         except:
             pass
 
+        if self.user is not None:
+            headers = include_user_info_headers(headers, self.user)
+
         url = self.url
         if url.endswith("/"):
             url = url[:-1]

backend/open_webui/retrieval/loaders/external_web.py

@@ -4,10 +4,8 @@ from typing import Iterator, List, Union
 
 from langchain_core.document_loaders import BaseLoader
 from langchain_core.documents import Document
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class ExternalWebLoader(BaseLoader):

backend/open_webui/retrieval/loaders/main.py

@@ -4,6 +4,7 @@ import ftfy
 import sys
 import json
 
+from azure.identity import DefaultAzureCredential
 from langchain_community.document_loaders import (
     AzureAIDocumentIntelligenceLoader,
     BSHTMLLoader,
@@ -26,13 +27,13 @@ from open_webui.retrieval.loaders.external_document import ExternalDocumentLoade
 
 from open_webui.retrieval.loaders.mistral import MistralLoader
 from open_webui.retrieval.loaders.datalab_marker import DatalabMarkerLoader
+from open_webui.retrieval.loaders.mineru import MinerULoader
 
 
-from open_webui.env import SRC_LOG_LEVELS, GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL, REQUESTS_VERIFY
 
 logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 known_source_ext = [
     "go",
@@ -113,7 +114,7 @@ class TikaLoader:
             endpoint += "/"
         endpoint += "tika/text"
 
-        r = requests.put(endpoint, data=data, headers=headers)
+        r = requests.put(endpoint, data=data, headers=headers, verify=REQUESTS_VERIFY)
 
         if r.ok:
             raw_metadata = r.json()
@@ -130,8 +131,9 @@ class TikaLoader:
 
 
 class DoclingLoader:
-    def __init__(self, url, file_path=None, mime_type=None, params=None):
+    def __init__(self, url, api_key=None, file_path=None, mime_type=None, params=None):
         self.url = url.rstrip("/")
+        self.api_key = api_key
         self.file_path = file_path
         self.mime_type = mime_type
 
@@ -139,51 +141,25 @@ class DoclingLoader:
 
     def load(self) -> list[Document]:
         with open(self.file_path, "rb") as f:
-            files = {
-                "files": (
-                    self.file_path,
-                    f,
-                    self.mime_type or "application/octet-stream",
-                )
-            }
+            headers = {}
+            if self.api_key:
+                headers["X-Api-Key"] = f"{self.api_key}"
 
-            params = {"image_export_mode": "placeholder", "table_mode": "accurate"}
-
-            if self.params:
-                if self.params.get("do_picture_description"):
-                    params["do_picture_description"] = self.params.get(
-                        "do_picture_description"
+            r = requests.post(
+                f"{self.url}/v1/convert/file",
+                files={
+                    "files": (
+                        self.file_path,
+                        f,
+                        self.mime_type or "application/octet-stream",
                     )
-
-                    picture_description_mode = self.params.get(
-                        "picture_description_mode", ""
-                    ).lower()
-
-                    if picture_description_mode == "local" and self.params.get(
-                        "picture_description_local", {}
-                    ):
-                        params["picture_description_local"] = json.dumps(
-                            self.params.get("picture_description_local", {})
-                        )
-
-                    elif picture_description_mode == "api" and self.params.get(
-                        "picture_description_api", {}
-                    ):
-                        params["picture_description_api"] = json.dumps(
-                            self.params.get("picture_description_api", {})
-                        )
-
-                if self.params.get("ocr_engine") and self.params.get("ocr_lang"):
-                    params["ocr_engine"] = self.params.get("ocr_engine")
-                    params["ocr_lang"] = [
-                        lang.strip()
-                        for lang in self.params.get("ocr_lang").split(",")
-                        if lang.strip()
-                    ]
-
-            endpoint = f"{self.url}/v1/convert/file"
-            r = requests.post(endpoint, files=files, data=params)
-
+                },
+                data={
+                    "image_export_mode": "placeholder",
+                    **self.params,
+                },
+                headers=headers,
+            )
         if r.ok:
             result = r.json()
             document_data = result.get("document", {})
@@ -192,7 +168,6 @@ class DoclingLoader:
             metadata = {"Content-Type": self.mime_type} if self.mime_type else {}
 
             log.debug("Docling extracted text: %s", text)
-
             return [Document(page_content=text, metadata=metadata)]
         else:
             error_msg = f"Error calling Docling API: {r.reason}"
@@ -209,6 +184,7 @@ class DoclingLoader:
 class Loader:
     def __init__(self, engine: str = "", **kwargs):
         self.engine = engine
+        self.user = kwargs.get("user", None)
         self.kwargs = kwargs
 
     def load(
@@ -245,6 +221,7 @@ class Loader:
                 url=self.kwargs.get("EXTERNAL_DOCUMENT_LOADER_URL"),
                 api_key=self.kwargs.get("EXTERNAL_DOCUMENT_LOADER_API_KEY"),
                 mime_type=file_content_type,
+                user=self.user,
             )
         elif self.engine == "tika" and self.kwargs.get("TIKA_SERVER_URL"):
             if self._is_text_file(file_ext, file_content_type):
@@ -253,7 +230,6 @@ class Loader:
                 loader = TikaLoader(
                     url=self.kwargs.get("TIKA_SERVER_URL"),
                     file_path=file_path,
-                    mime_type=file_content_type,
                     extract_images=self.kwargs.get("PDF_EXTRACT_IMAGES"),
                 )
         elif (
@@ -283,7 +259,7 @@ class Loader:
         ):
             api_base_url = self.kwargs.get("DATALAB_MARKER_API_BASE_URL", "")
             if not api_base_url or api_base_url.strip() == "":
-                api_base_url = "https://www.datalab.to/api/v1"
+                api_base_url = "https://www.datalab.to/api/v1/marker"  # https://github.com/open-webui/open-webui/pull/16867#issuecomment-3218424349
 
             loader = DatalabMarkerLoader(
                 file_path=file_path,
@@ -320,6 +296,7 @@ class Loader:
 
                 loader = DoclingLoader(
                     url=self.kwargs.get("DOCLING_SERVER_URL"),
+                    api_key=self.kwargs.get("DOCLING_API_KEY", None),
                     file_path=file_path,
                     mime_type=file_content_type,
                     params=params,
@@ -327,23 +304,48 @@ class Loader:
         elif (
             self.engine == "document_intelligence"
             and self.kwargs.get("DOCUMENT_INTELLIGENCE_ENDPOINT") != ""
-            and self.kwargs.get("DOCUMENT_INTELLIGENCE_KEY") != ""
             and (
-                file_ext in ["pdf", "xls", "xlsx", "docx", "ppt", "pptx"]
+                file_ext in ["pdf", "docx", "ppt", "pptx"]
                 or file_content_type
                 in [
-                    "application/vnd.ms-excel",
-                    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
                     "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                     "application/vnd.ms-powerpoint",
                     "application/vnd.openxmlformats-officedocument.presentationml.presentation",
                 ]
             )
         ):
-            loader = AzureAIDocumentIntelligenceLoader(
+            if self.kwargs.get("DOCUMENT_INTELLIGENCE_KEY") != "":
+                loader = AzureAIDocumentIntelligenceLoader(
+                    file_path=file_path,
+                    api_endpoint=self.kwargs.get("DOCUMENT_INTELLIGENCE_ENDPOINT"),
+                    api_key=self.kwargs.get("DOCUMENT_INTELLIGENCE_KEY"),
+                    api_model=self.kwargs.get("DOCUMENT_INTELLIGENCE_MODEL"),
+                )
+            else:
+                loader = AzureAIDocumentIntelligenceLoader(
+                    file_path=file_path,
+                    api_endpoint=self.kwargs.get("DOCUMENT_INTELLIGENCE_ENDPOINT"),
+                    azure_credential=DefaultAzureCredential(),
+                    api_model=self.kwargs.get("DOCUMENT_INTELLIGENCE_MODEL"),
+                )
+        elif self.engine == "mineru" and file_ext in [
+            "pdf"
+        ]:  # MinerU currently only supports PDF
+
+            mineru_timeout = self.kwargs.get("MINERU_API_TIMEOUT", 300)
+            if mineru_timeout:
+                try:
+                    mineru_timeout = int(mineru_timeout)
+                except ValueError:
+                    mineru_timeout = 300
+
+            loader = MinerULoader(
                 file_path=file_path,
-                api_endpoint=self.kwargs.get("DOCUMENT_INTELLIGENCE_ENDPOINT"),
-                api_key=self.kwargs.get("DOCUMENT_INTELLIGENCE_KEY"),
+                api_mode=self.kwargs.get("MINERU_API_MODE", "local"),
+                api_url=self.kwargs.get("MINERU_API_URL", "http://localhost:8000"),
+                api_key=self.kwargs.get("MINERU_API_KEY", ""),
+                params=self.kwargs.get("MINERU_PARAMS", {}),
+                timeout=mineru_timeout,
             )
         elif (
             self.engine == "mistral_ocr"
@@ -352,21 +354,16 @@ class Loader:
             in ["pdf"]  # Mistral OCR currently only supports PDF and images
         ):
             loader = MistralLoader(
-                api_key=self.kwargs.get("MISTRAL_OCR_API_KEY"), file_path=file_path
-            )
-        elif (
-            self.engine == "external"
-            and self.kwargs.get("MISTRAL_OCR_API_KEY") != ""
-            and file_ext
-            in ["pdf"]  # Mistral OCR currently only supports PDF and images
-        ):
-            loader = MistralLoader(
-                api_key=self.kwargs.get("MISTRAL_OCR_API_KEY"), file_path=file_path
+                base_url=self.kwargs.get("MISTRAL_OCR_API_BASE_URL"),
+                api_key=self.kwargs.get("MISTRAL_OCR_API_KEY"),
+                file_path=file_path,
             )
         else:
             if file_ext == "pdf":
                 loader = PyPDFLoader(
-                    file_path, extract_images=self.kwargs.get("PDF_EXTRACT_IMAGES")
+                    file_path,
+                    extract_images=self.kwargs.get("PDF_EXTRACT_IMAGES"),
+                    mode=self.kwargs.get("PDF_LOADER_MODE", "page"),
                 )
             elif file_ext == "csv":
                 loader = CSVLoader(file_path, autodetect_encoding=True)

backend/open_webui/retrieval/loaders/mineru.py

@@ -0,0 +1,524 @@
+import os
+import time
+import requests
+import logging
+import tempfile
+import zipfile
+from typing import List, Optional
+from langchain_core.documents import Document
+from fastapi import HTTPException, status
+
+log = logging.getLogger(__name__)
+
+
+class MinerULoader:
+    """
+    MinerU document parser loader supporting both Cloud API and Local API modes.
+
+    Cloud API: Uses MinerU managed service with async task-based processing
+    Local API: Uses self-hosted MinerU API with synchronous processing
+    """
+
+    def __init__(
+        self,
+        file_path: str,
+        api_mode: str = "local",
+        api_url: str = "http://localhost:8000",
+        api_key: str = "",
+        params: dict = None,
+        timeout: Optional[int] = 300,
+    ):
+        self.file_path = file_path
+        self.api_mode = api_mode.lower()
+        self.api_url = api_url.rstrip("/")
+        self.api_key = api_key
+        self.timeout = timeout
+
+        # Parse params dict with defaults
+        self.params = params or {}
+        self.enable_ocr = params.get("enable_ocr", False)
+        self.enable_formula = params.get("enable_formula", True)
+        self.enable_table = params.get("enable_table", True)
+        self.language = params.get("language", "en")
+        self.model_version = params.get("model_version", "pipeline")
+
+        self.page_ranges = self.params.pop("page_ranges", "")
+
+        # Validate API mode
+        if self.api_mode not in ["local", "cloud"]:
+            raise ValueError(
+                f"Invalid API mode: {self.api_mode}. Must be 'local' or 'cloud'"
+            )
+
+        # Validate Cloud API requirements
+        if self.api_mode == "cloud" and not self.api_key:
+            raise ValueError("API key is required for Cloud API mode")
+
+    def load(self) -> List[Document]:
+        """
+        Main entry point for loading and parsing the document.
+        Routes to Cloud or Local API based on api_mode.
+        """
+        try:
+            if self.api_mode == "cloud":
+                return self._load_cloud_api()
+            else:
+                return self._load_local_api()
+        except Exception as e:
+            log.error(f"Error loading document with MinerU: {e}")
+            raise
+
+    def _load_local_api(self) -> List[Document]:
+        """
+        Load document using Local API (synchronous).
+        Posts file to /file_parse endpoint and gets immediate response.
+        """
+        log.info(f"Using MinerU Local API at {self.api_url}")
+
+        filename = os.path.basename(self.file_path)
+
+        # Build form data for Local API
+        form_data = {
+            **self.params,
+            "return_md": "true",
+        }
+
+        # Page ranges (Local API uses start_page_id and end_page_id)
+        if self.page_ranges:
+            # For simplicity, if page_ranges is specified, log a warning
+            # Full page range parsing would require parsing the string
+            log.warning(
+                f"Page ranges '{self.page_ranges}' specified but Local API uses different format. "
+                "Consider using start_page_id/end_page_id parameters if needed."
+            )
+
+        try:
+            with open(self.file_path, "rb") as f:
+                files = {"files": (filename, f, "application/octet-stream")}
+
+                log.info(f"Sending file to MinerU Local API: {filename}")
+                log.debug(f"Local API parameters: {form_data}")
+
+                response = requests.post(
+                    f"{self.api_url}/file_parse",
+                    data=form_data,
+                    files=files,
+                    timeout=self.timeout,
+                )
+                response.raise_for_status()
+
+        except FileNotFoundError:
+            raise HTTPException(
+                status.HTTP_404_NOT_FOUND, detail=f"File not found: {self.file_path}"
+            )
+        except requests.Timeout:
+            raise HTTPException(
+                status.HTTP_504_GATEWAY_TIMEOUT,
+                detail="MinerU Local API request timed out",
+            )
+        except requests.HTTPError as e:
+            error_detail = f"MinerU Local API request failed: {e}"
+            if e.response is not None:
+                try:
+                    error_data = e.response.json()
+                    error_detail += f" - {error_data}"
+                except:
+                    error_detail += f" - {e.response.text}"
+            raise HTTPException(status.HTTP_400_BAD_REQUEST, detail=error_detail)
+        except Exception as e:
+            raise HTTPException(
+                status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error calling MinerU Local API: {str(e)}",
+            )
+
+        # Parse response
+        try:
+            result = response.json()
+        except ValueError as e:
+            raise HTTPException(
+                status.HTTP_502_BAD_GATEWAY,
+                detail=f"Invalid JSON response from MinerU Local API: {e}",
+            )
+
+        # Extract markdown content from response
+        if "results" not in result:
+            raise HTTPException(
+                status.HTTP_502_BAD_GATEWAY,
+                detail="MinerU Local API response missing 'results' field",
+            )
+
+        results = result["results"]
+        if not results:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail="MinerU returned empty results",
+            )
+
+        # Get the first (and typically only) result
+        file_result = list(results.values())[0]
+        markdown_content = file_result.get("md_content", "")
+
+        if not markdown_content:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail="MinerU returned empty markdown content",
+            )
+
+        log.info(f"Successfully parsed document with MinerU Local API: {filename}")
+
+        # Create metadata
+        metadata = {
+            "source": filename,
+            "api_mode": "local",
+            "backend": result.get("backend", "unknown"),
+            "version": result.get("version", "unknown"),
+        }
+
+        return [Document(page_content=markdown_content, metadata=metadata)]
+
+    def _load_cloud_api(self) -> List[Document]:
+        """
+        Load document using Cloud API (asynchronous).
+        Uses batch upload endpoint to avoid need for public file URLs.
+        """
+        log.info(f"Using MinerU Cloud API at {self.api_url}")
+
+        filename = os.path.basename(self.file_path)
+
+        # Step 1: Request presigned upload URL
+        batch_id, upload_url = self._request_upload_url(filename)
+
+        # Step 2: Upload file to presigned URL
+        self._upload_to_presigned_url(upload_url)
+
+        # Step 3: Poll for results
+        result = self._poll_batch_status(batch_id, filename)
+
+        # Step 4: Download and extract markdown from ZIP
+        markdown_content = self._download_and_extract_zip(
+            result["full_zip_url"], filename
+        )
+
+        log.info(f"Successfully parsed document with MinerU Cloud API: {filename}")
+
+        # Create metadata
+        metadata = {
+            "source": filename,
+            "api_mode": "cloud",
+            "batch_id": batch_id,
+        }
+
+        return [Document(page_content=markdown_content, metadata=metadata)]
+
+    def _request_upload_url(self, filename: str) -> tuple:
+        """
+        Request presigned upload URL from Cloud API.
+        Returns (batch_id, upload_url).
+        """
+        headers = {
+            "Authorization": f"Bearer {self.api_key}",
+            "Content-Type": "application/json",
+        }
+
+        # Build request body
+        request_body = {
+            **self.params,
+            "files": [
+                {
+                    "name": filename,
+                    "is_ocr": self.enable_ocr,
+                }
+            ],
+        }
+
+        # Add page ranges if specified
+        if self.page_ranges:
+            request_body["files"][0]["page_ranges"] = self.page_ranges
+
+        log.info(f"Requesting upload URL for: {filename}")
+        log.debug(f"Cloud API request body: {request_body}")
+
+        try:
+            response = requests.post(
+                f"{self.api_url}/file-urls/batch",
+                headers=headers,
+                json=request_body,
+                timeout=30,
+            )
+            response.raise_for_status()
+        except requests.HTTPError as e:
+            error_detail = f"Failed to request upload URL: {e}"
+            if e.response is not None:
+                try:
+                    error_data = e.response.json()
+                    error_detail += f" - {error_data.get('msg', error_data)}"
+                except:
+                    error_detail += f" - {e.response.text}"
+            raise HTTPException(status.HTTP_400_BAD_REQUEST, detail=error_detail)
+        except Exception as e:
+            raise HTTPException(
+                status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error requesting upload URL: {str(e)}",
+            )
+
+        try:
+            result = response.json()
+        except ValueError as e:
+            raise HTTPException(
+                status.HTTP_502_BAD_GATEWAY,
+                detail=f"Invalid JSON response: {e}",
+            )
+
+        # Check for API error response
+        if result.get("code") != 0:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail=f"MinerU Cloud API error: {result.get('msg', 'Unknown error')}",
+            )
+
+        data = result.get("data", {})
+        batch_id = data.get("batch_id")
+        file_urls = data.get("file_urls", [])
+
+        if not batch_id or not file_urls:
+            raise HTTPException(
+                status.HTTP_502_BAD_GATEWAY,
+                detail="MinerU Cloud API response missing batch_id or file_urls",
+            )
+
+        upload_url = file_urls[0]
+        log.info(f"Received upload URL for batch: {batch_id}")
+
+        return batch_id, upload_url
+
+    def _upload_to_presigned_url(self, upload_url: str) -> None:
+        """
+        Upload file to presigned URL (no authentication needed).
+        """
+        log.info(f"Uploading file to presigned URL")
+
+        try:
+            with open(self.file_path, "rb") as f:
+                response = requests.put(
+                    upload_url,
+                    data=f,
+                    timeout=self.timeout,
+                )
+                response.raise_for_status()
+        except FileNotFoundError:
+            raise HTTPException(
+                status.HTTP_404_NOT_FOUND, detail=f"File not found: {self.file_path}"
+            )
+        except requests.Timeout:
+            raise HTTPException(
+                status.HTTP_504_GATEWAY_TIMEOUT,
+                detail="File upload to presigned URL timed out",
+            )
+        except requests.HTTPError as e:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail=f"Failed to upload file to presigned URL: {e}",
+            )
+        except Exception as e:
+            raise HTTPException(
+                status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error uploading file: {str(e)}",
+            )
+
+        log.info("File uploaded successfully")
+
+    def _poll_batch_status(self, batch_id: str, filename: str) -> dict:
+        """
+        Poll batch status until completion.
+        Returns the result dict for the file.
+        """
+        headers = {
+            "Authorization": f"Bearer {self.api_key}",
+        }
+
+        max_iterations = 300  # 10 minutes max (2 seconds per iteration)
+        poll_interval = 2  # seconds
+
+        log.info(f"Polling batch status: {batch_id}")
+
+        for iteration in range(max_iterations):
+            try:
+                response = requests.get(
+                    f"{self.api_url}/extract-results/batch/{batch_id}",
+                    headers=headers,
+                    timeout=30,
+                )
+                response.raise_for_status()
+            except requests.HTTPError as e:
+                error_detail = f"Failed to poll batch status: {e}"
+                if e.response is not None:
+                    try:
+                        error_data = e.response.json()
+                        error_detail += f" - {error_data.get('msg', error_data)}"
+                    except:
+                        error_detail += f" - {e.response.text}"
+                raise HTTPException(status.HTTP_400_BAD_REQUEST, detail=error_detail)
+            except Exception as e:
+                raise HTTPException(
+                    status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail=f"Error polling batch status: {str(e)}",
+                )
+
+            try:
+                result = response.json()
+            except ValueError as e:
+                raise HTTPException(
+                    status.HTTP_502_BAD_GATEWAY,
+                    detail=f"Invalid JSON response while polling: {e}",
+                )
+
+            # Check for API error response
+            if result.get("code") != 0:
+                raise HTTPException(
+                    status.HTTP_400_BAD_REQUEST,
+                    detail=f"MinerU Cloud API error: {result.get('msg', 'Unknown error')}",
+                )
+
+            data = result.get("data", {})
+            extract_result = data.get("extract_result", [])
+
+            # Find our file in the batch results
+            file_result = None
+            for item in extract_result:
+                if item.get("file_name") == filename:
+                    file_result = item
+                    break
+
+            if not file_result:
+                raise HTTPException(
+                    status.HTTP_502_BAD_GATEWAY,
+                    detail=f"File {filename} not found in batch results",
+                )
+
+            state = file_result.get("state")
+
+            if state == "done":
+                log.info(f"Processing complete for {filename}")
+                return file_result
+            elif state == "failed":
+                error_msg = file_result.get("err_msg", "Unknown error")
+                raise HTTPException(
+                    status.HTTP_400_BAD_REQUEST,
+                    detail=f"MinerU processing failed: {error_msg}",
+                )
+            elif state in ["waiting-file", "pending", "running", "converting"]:
+                # Still processing
+                if iteration % 10 == 0:  # Log every 20 seconds
+                    log.info(
+                        f"Processing status: {state} (iteration {iteration + 1}/{max_iterations})"
+                    )
+                time.sleep(poll_interval)
+            else:
+                log.warning(f"Unknown state: {state}")
+                time.sleep(poll_interval)
+
+        # Timeout
+        raise HTTPException(
+            status.HTTP_504_GATEWAY_TIMEOUT,
+            detail="MinerU processing timed out after 10 minutes",
+        )
+
+    def _download_and_extract_zip(self, zip_url: str, filename: str) -> str:
+        """
+        Download ZIP file from CDN and extract markdown content.
+        Returns the markdown content as a string.
+        """
+        log.info(f"Downloading results from: {zip_url}")
+
+        try:
+            response = requests.get(zip_url, timeout=60)
+            response.raise_for_status()
+        except requests.HTTPError as e:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail=f"Failed to download results ZIP: {e}",
+            )
+        except Exception as e:
+            raise HTTPException(
+                status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error downloading results: {str(e)}",
+            )
+
+        # Save ZIP to temporary file and extract
+        try:
+            with tempfile.NamedTemporaryFile(delete=False, suffix=".zip") as tmp_zip:
+                tmp_zip.write(response.content)
+                tmp_zip_path = tmp_zip.name
+
+            with tempfile.TemporaryDirectory() as tmp_dir:
+                # Extract ZIP
+                with zipfile.ZipFile(tmp_zip_path, "r") as zip_ref:
+                    zip_ref.extractall(tmp_dir)
+
+                # Find markdown file - search recursively for any .md file
+                markdown_content = None
+                found_md_path = None
+
+                # First, list all files in the ZIP for debugging
+                all_files = []
+                for root, dirs, files in os.walk(tmp_dir):
+                    for file in files:
+                        full_path = os.path.join(root, file)
+                        all_files.append(full_path)
+                        # Look for any .md file
+                        if file.endswith(".md"):
+                            found_md_path = full_path
+                            log.info(f"Found markdown file at: {full_path}")
+                            try:
+                                with open(full_path, "r", encoding="utf-8") as f:
+                                    markdown_content = f.read()
+                                if (
+                                    markdown_content
+                                ):  # Use the first non-empty markdown file
+                                    break
+                            except Exception as e:
+                                log.warning(f"Failed to read {full_path}: {e}")
+                    if markdown_content:
+                        break
+
+                if markdown_content is None:
+                    log.error(f"Available files in ZIP: {all_files}")
+                    # Try to provide more helpful error message
+                    md_files = [f for f in all_files if f.endswith(".md")]
+                    if md_files:
+                        error_msg = (
+                            f"Found .md files but couldn't read them: {md_files}"
+                        )
+                    else:
+                        error_msg = (
+                            f"No .md files found in ZIP. Available files: {all_files}"
+                        )
+                    raise HTTPException(
+                        status.HTTP_502_BAD_GATEWAY,
+                        detail=error_msg,
+                    )
+
+            # Clean up temporary ZIP file
+            os.unlink(tmp_zip_path)
+
+        except zipfile.BadZipFile as e:
+            raise HTTPException(
+                status.HTTP_502_BAD_GATEWAY,
+                detail=f"Invalid ZIP file received: {e}",
+            )
+        except Exception as e:
+            raise HTTPException(
+                status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error extracting ZIP: {str(e)}",
+            )
+
+        if not markdown_content:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                detail="Extracted markdown content is empty",
+            )
+
+        log.info(
+            f"Successfully extracted markdown content ({len(markdown_content)} characters)"
+        )
+        return markdown_content

backend/open_webui/retrieval/loaders/mistral.py

@@ -9,11 +9,10 @@ from typing import List, Dict, Any
 from contextlib import asynccontextmanager
 
 from langchain_core.documents import Document
-from open_webui.env import SRC_LOG_LEVELS, GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL
 
 logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class MistralLoader:
@@ -30,10 +29,9 @@ class MistralLoader:
     - Enhanced error handling with retryable error classification
     """
 
-    BASE_API_URL = "https://api.mistral.ai/v1"
-
     def __init__(
         self,
+        base_url: str,
         api_key: str,
         file_path: str,
         timeout: int = 300,  # 5 minutes default
@@ -55,6 +53,9 @@ class MistralLoader:
         if not os.path.exists(file_path):
             raise FileNotFoundError(f"File not found at {file_path}")
 
+        self.base_url = (
+            base_url.rstrip("/") if base_url else "https://api.mistral.ai/v1"
+        )
         self.api_key = api_key
         self.file_path = file_path
         self.timeout = timeout
@@ -240,7 +241,7 @@ class MistralLoader:
         in a context manager to minimize memory usage duration.
         """
         log.info("Uploading file to Mistral API")
-        url = f"{self.BASE_API_URL}/files"
+        url = f"{self.base_url}/files"
 
         def upload_request():
             # MEMORY OPTIMIZATION: Use context manager to minimize file handle lifetime
@@ -275,7 +276,7 @@ class MistralLoader:
 
     async def _upload_file_async(self, session: aiohttp.ClientSession) -> str:
         """Async file upload with streaming for better memory efficiency."""
-        url = f"{self.BASE_API_URL}/files"
+        url = f"{self.base_url}/files"
 
         async def upload_request():
             # Create multipart writer for streaming upload
@@ -321,7 +322,7 @@ class MistralLoader:
     def _get_signed_url(self, file_id: str) -> str:
         """Retrieves a temporary signed URL for the uploaded file (sync version)."""
         log.info(f"Getting signed URL for file ID: {file_id}")
-        url = f"{self.BASE_API_URL}/files/{file_id}/url"
+        url = f"{self.base_url}/files/{file_id}/url"
         params = {"expiry": 1}
         signed_url_headers = {**self.headers, "Accept": "application/json"}
 
@@ -346,7 +347,7 @@ class MistralLoader:
         self, session: aiohttp.ClientSession, file_id: str
     ) -> str:
         """Async signed URL retrieval."""
-        url = f"{self.BASE_API_URL}/files/{file_id}/url"
+        url = f"{self.base_url}/files/{file_id}/url"
         params = {"expiry": 1}
 
         headers = {**self.headers, "Accept": "application/json"}
@@ -373,7 +374,7 @@ class MistralLoader:
     def _process_ocr(self, signed_url: str) -> Dict[str, Any]:
         """Sends the signed URL to the OCR endpoint for processing (sync version)."""
         log.info("Processing OCR via Mistral API")
-        url = f"{self.BASE_API_URL}/ocr"
+        url = f"{self.base_url}/ocr"
         ocr_headers = {
             **self.headers,
             "Content-Type": "application/json",
@@ -407,7 +408,7 @@ class MistralLoader:
         self, session: aiohttp.ClientSession, signed_url: str
     ) -> Dict[str, Any]:
         """Async OCR processing with timing metrics."""
-        url = f"{self.BASE_API_URL}/ocr"
+        url = f"{self.base_url}/ocr"
 
         headers = {
             **self.headers,
@@ -446,7 +447,7 @@ class MistralLoader:
     def _delete_file(self, file_id: str) -> None:
         """Deletes the file from Mistral storage (sync version)."""
         log.info(f"Deleting uploaded file ID: {file_id}")
-        url = f"{self.BASE_API_URL}/files/{file_id}"
+        url = f"{self.base_url}/files/{file_id}"
 
         try:
             response = requests.delete(
@@ -467,7 +468,7 @@ class MistralLoader:
             async def delete_request():
                 self._debug_log(f"Deleting file ID: {file_id}")
                 async with session.delete(
-                    url=f"{self.BASE_API_URL}/files/{file_id}",
+                    url=f"{self.base_url}/files/{file_id}",
                     headers=self.headers,
                     timeout=aiohttp.ClientTimeout(
                         total=self.cleanup_timeout

backend/open_webui/retrieval/loaders/tavily.py

@@ -4,10 +4,8 @@ from typing import Iterator, List, Literal, Union
 
 from langchain_core.document_loaders import BaseLoader
 from langchain_core.documents import Document
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class TavilyLoader(BaseLoader):

backend/open_webui/retrieval/loaders/youtube.py

@@ -4,10 +4,8 @@ from xml.etree.ElementTree import ParseError
 from typing import Any, Dict, Generator, List, Optional, Sequence, Union
 from urllib.parse import parse_qs, urlparse
 from langchain_core.documents import Document
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 ALLOWED_SCHEMES = {"http", "https"}
 ALLOWED_NETLOCS = {
@@ -83,6 +81,7 @@ class YoutubeLoader:
                 TranscriptsDisabled,
                 YouTubeTranscriptApi,
             )
+            from youtube_transcript_api.proxies import GenericProxyConfig
         except ImportError:
             raise ImportError(
                 'Could not import "youtube_transcript_api" Python package. '
@@ -90,18 +89,16 @@ class YoutubeLoader:
             )
 
         if self.proxy_url:
-            youtube_proxies = {
-                "http": self.proxy_url,
-                "https": self.proxy_url,
-            }
+            youtube_proxies = GenericProxyConfig(
+                http_url=self.proxy_url, https_url=self.proxy_url
+            )
             log.debug(f"Using proxy URL: {self.proxy_url[:14]}...")
         else:
             youtube_proxies = None
 
+        transcript_api = YouTubeTranscriptApi(proxy_config=youtube_proxies)
         try:
-            transcript_list = YouTubeTranscriptApi.list_transcripts(
-                self.video_id, proxies=youtube_proxies
-            )
+            transcript_list = transcript_api.list(self.video_id)
         except Exception as e:
             log.exception("Loading YouTube transcript failed")
             return []
@@ -158,3 +155,10 @@ class YoutubeLoader:
             f"No transcript found for any of the specified languages: {languages_tried}. Verify if the video has transcripts, add more languages if needed."
         )
         raise NoTranscriptFound(self.video_id, self.language, list(transcript_list))
+
+    async def aload(self) -> Generator[Document, None, None]:
+        """Asynchronously load YouTube transcripts into `Document` objects."""
+        import asyncio
+
+        loop = asyncio.get_event_loop()
+        return await loop.run_in_executor(None, self.load)

backend/open_webui/retrieval/models/colbert.py

@@ -5,12 +5,10 @@ import numpy as np
 from colbert.infra import ColBERTConfig
 from colbert.modeling.checkpoint import Checkpoint
 
-from open_webui.env import SRC_LOG_LEVELS
 
 from open_webui.retrieval.models.base_reranker import BaseReranker
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class ColBERT(BaseReranker):

backend/open_webui/retrieval/models/external.py

@@ -4,12 +4,11 @@ from typing import Optional, List, Tuple
 from urllib.parse import quote
 
 
-from open_webui.env import ENABLE_FORWARD_USER_INFO_HEADERS, SRC_LOG_LEVELS
+from open_webui.env import ENABLE_FORWARD_USER_INFO_HEADERS, REQUESTS_VERIFY
 from open_webui.retrieval.models.base_reranker import BaseReranker
-
+from open_webui.utils.headers import include_user_info_headers
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class ExternalReranker(BaseReranker):
@@ -18,10 +17,12 @@ class ExternalReranker(BaseReranker):
         api_key: str,
         url: str = "http://localhost:8080/v1/rerank",
         model: str = "reranker",
+        timeout: Optional[int] = None,
     ):
         self.api_key = api_key
         self.url = url
         self.model = model
+        self.timeout = timeout
 
     def predict(
         self, sentences: List[Tuple[str, str]], user=None
@@ -40,23 +41,20 @@ class ExternalReranker(BaseReranker):
             log.info(f"ExternalReranker:predict:model {self.model}")
             log.info(f"ExternalReranker:predict:query {query}")
 
+            headers = {
+                "Content-Type": "application/json",
+                "Authorization": f"Bearer {self.api_key}",
+            }
+
+            if ENABLE_FORWARD_USER_INFO_HEADERS and user:
+                headers = include_user_info_headers(headers, user)
+
             r = requests.post(
                 f"{self.url}",
-                headers={
-                    "Content-Type": "application/json",
-                    "Authorization": f"Bearer {self.api_key}",
-                    **(
-                        {
-                            "X-OpenWebUI-User-Name": quote(user.name, safe=" "),
-                            "X-OpenWebUI-User-Id": user.id,
-                            "X-OpenWebUI-User-Email": user.email,
-                            "X-OpenWebUI-User-Role": user.role,
-                        }
-                        if ENABLE_FORWARD_USER_INFO_HEADERS and user
-                        else {}
-                    ),
-                },
+                headers=headers,
                 json=payload,
+                timeout=self.timeout,
+                verify=REQUESTS_VERIFY,
             )
 
             r.raise_for_status()

backend/open_webui/retrieval/vector/dbs/chroma.py

@@ -11,7 +11,7 @@ from open_webui.retrieval.vector.main import (
     SearchResult,
     GetResult,
 )
-from open_webui.retrieval.vector.utils import stringify_metadata
+from open_webui.retrieval.vector.utils import process_metadata
 
 from open_webui.config import (
     CHROMA_DATA_PATH,
@@ -24,10 +24,8 @@ from open_webui.config import (
     CHROMA_CLIENT_AUTH_PROVIDER,
     CHROMA_CLIENT_AUTH_CREDENTIALS,
 )
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class ChromaClient(VectorDBBase):
@@ -71,7 +69,11 @@ class ChromaClient(VectorDBBase):
         return self.client.delete_collection(name=collection_name)
 
     def search(
-        self, collection_name: str, vectors: list[list[float | int]], limit: int
+        self,
+        collection_name: str,
+        vectors: list[list[float | int]],
+        filter: Optional[dict] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         # Search for the nearest neighbor items based on the vectors and return 'limit' number of results.
         try:
@@ -80,6 +82,7 @@ class ChromaClient(VectorDBBase):
                 result = collection.query(
                     query_embeddings=vectors,
                     n_results=limit,
+                    where=filter,
                 )
 
                 # chromadb has cosine distance, 2 (worst) -> 0 (best). Re-odering to 0 -> 1
@@ -146,7 +149,7 @@ class ChromaClient(VectorDBBase):
         ids = [item["id"] for item in items]
         documents = [item["text"] for item in items]
         embeddings = [item["vector"] for item in items]
-        metadatas = [stringify_metadata(item["metadata"]) for item in items]
+        metadatas = [process_metadata(item["metadata"]) for item in items]
 
         for batch in create_batches(
             api=self.client,
@@ -166,7 +169,7 @@ class ChromaClient(VectorDBBase):
         ids = [item["id"] for item in items]
         documents = [item["text"] for item in items]
         embeddings = [item["vector"] for item in items]
-        metadatas = [stringify_metadata(item["metadata"]) for item in items]
+        metadatas = [process_metadata(item["metadata"]) for item in items]
 
         collection.upsert(
             ids=ids, documents=documents, embeddings=embeddings, metadatas=metadatas

backend/open_webui/retrieval/vector/dbs/elasticsearch.py

@@ -3,7 +3,7 @@ from typing import Optional
 import ssl
 from elasticsearch.helpers import bulk, scan
 
-from open_webui.retrieval.vector.utils import stringify_metadata
+from open_webui.retrieval.vector.utils import process_metadata
 from open_webui.retrieval.vector.main import (
     VectorDBBase,
     VectorItem,
@@ -153,7 +153,11 @@ class ElasticsearchClient(VectorDBBase):
 
     # Status: works
     def search(
-        self, collection_name: str, vectors: list[list[float]], limit: int
+        self,
+        collection_name: str,
+        vectors: list[list[float]],
+        filter: Optional[dict] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         query = {
             "size": limit,
@@ -245,7 +249,7 @@ class ElasticsearchClient(VectorDBBase):
                         "collection": collection_name,
                         "vector": item["vector"],
                         "text": item["text"],
-                        "metadata": stringify_metadata(item["metadata"]),
+                        "metadata": process_metadata(item["metadata"]),
                     },
                 }
                 for item in batch
@@ -266,7 +270,7 @@ class ElasticsearchClient(VectorDBBase):
                         "collection": collection_name,
                         "vector": item["vector"],
                         "text": item["text"],
-                        "metadata": stringify_metadata(item["metadata"]),
+                        "metadata": process_metadata(item["metadata"]),
                     },
                     "doc_as_upsert": True,
                 }

backend/open_webui/retrieval/vector/dbs/milvus.py

@@ -6,7 +6,7 @@ import json
 import logging
 from typing import Optional
 
-from open_webui.retrieval.vector.utils import stringify_metadata
+from open_webui.retrieval.vector.utils import process_metadata
 from open_webui.retrieval.vector.main import (
     VectorDBBase,
     VectorItem,
@@ -22,11 +22,11 @@ from open_webui.config import (
     MILVUS_HNSW_M,
     MILVUS_HNSW_EFCONSTRUCTION,
     MILVUS_IVF_FLAT_NLIST,
+    MILVUS_DISKANN_MAX_DEGREE,
+    MILVUS_DISKANN_SEARCH_LIST_SIZE,
 )
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class MilvusClient(VectorDBBase):
@@ -131,12 +131,18 @@ class MilvusClient(VectorDBBase):
         elif index_type == "IVF_FLAT":
             index_creation_params = {"nlist": MILVUS_IVF_FLAT_NLIST}
             log.info(f"IVF_FLAT params: {index_creation_params}")
+        elif index_type == "DISKANN":
+            index_creation_params = {
+                "max_degree": MILVUS_DISKANN_MAX_DEGREE,
+                "search_list_size": MILVUS_DISKANN_SEARCH_LIST_SIZE,
+            }
+            log.info(f"DISKANN params: {index_creation_params}")
         elif index_type in ["FLAT", "AUTOINDEX"]:
             log.info(f"Using {index_type} index with no specific build-time params.")
         else:
             log.warning(
                 f"Unsupported MILVUS_INDEX_TYPE: '{index_type}'. "
-                f"Supported types: HNSW, IVF_FLAT, FLAT, AUTOINDEX. "
+                f"Supported types: HNSW, IVF_FLAT, DISKANN, FLAT, AUTOINDEX. "
                 f"Milvus will use its default for the collection if this type is not directly supported for index creation."
             )
             # For unsupported types, pass the type directly to Milvus; it might handle it or use a default.
@@ -173,7 +179,11 @@ class MilvusClient(VectorDBBase):
         )
 
     def search(
-        self, collection_name: str, vectors: list[list[float | int]], limit: int
+        self,
+        collection_name: str,
+        vectors: list[list[float | int]],
+        filter: Optional[dict] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         # Search for the nearest neighbor items based on the vectors and return 'limit' number of results.
         collection_name = collection_name.replace("-", "_")
@@ -189,26 +199,27 @@ class MilvusClient(VectorDBBase):
         )
         return self._result_to_search_result(result)
 
-    def query(self, collection_name: str, filter: dict, limit: Optional[int] = None):
+    def query(self, collection_name: str, filter: dict, limit: int = -1):
         connections.connect(uri=MILVUS_URI, token=MILVUS_TOKEN, db_name=MILVUS_DB)
 
-        # Construct the filter string for querying
         collection_name = collection_name.replace("-", "_")
         if not self.has_collection(collection_name):
             log.warning(
                 f"Query attempted on non-existent collection: {self.collection_prefix}_{collection_name}"
             )
             return None
-        filter_string = " && ".join(
-            [
-                f'metadata["{key}"] == {json.dumps(value)}'
-                for key, value in filter.items()
-            ]
-        )
+
+        filter_expressions = []
+        for key, value in filter.items():
+            if isinstance(value, str):
+                filter_expressions.append(f'metadata["{key}"] == "{value}"')
+            else:
+                filter_expressions.append(f'metadata["{key}"] == {value}')
+
+        filter_string = " && ".join(filter_expressions)
 
         collection = Collection(f"{self.collection_prefix}_{collection_name}")
         collection.load()
-        all_results = []
 
         try:
             log.info(
@@ -216,24 +227,25 @@ class MilvusClient(VectorDBBase):
             )
 
             iterator = collection.query_iterator(
-                filter=filter_string,
+                expr=filter_string,
                 output_fields=[
                     "id",
                     "data",
                     "metadata",
                 ],
-                limit=limit,  # Pass the limit directly; None means no limit.
+                limit=limit if limit > 0 else -1,
             )
 
+            all_results = []
             while True:
-                result = iterator.next()
-                if not result:
+                batch = iterator.next()
+                if not batch:
                     iterator.close()
                     break
-                all_results += result
+                all_results.extend(batch)
 
-            log.info(f"Total results from query: {len(all_results)}")
-            return self._result_to_get_result([all_results])
+            log.debug(f"Total results from query: {len(all_results)}")
+            return self._result_to_get_result([all_results] if all_results else [[]])
 
         except Exception as e:
             log.exception(
@@ -249,7 +261,7 @@ class MilvusClient(VectorDBBase):
         )
         # Using query with a trivial filter to get all items.
         # This will use the paginated query logic.
-        return self.query(collection_name=collection_name, filter={}, limit=None)
+        return self.query(collection_name=collection_name, filter={}, limit=-1)
 
     def insert(self, collection_name: str, items: list[VectorItem]):
         # Insert the items into the collection, if the collection does not exist, it will be created.
@@ -281,7 +293,7 @@ class MilvusClient(VectorDBBase):
                     "id": item["id"],
                     "vector": item["vector"],
                     "data": {"text": item["text"]},
-                    "metadata": stringify_metadata(item["metadata"]),
+                    "metadata": process_metadata(item["metadata"]),
                 }
                 for item in items
             ],
@@ -317,7 +329,7 @@ class MilvusClient(VectorDBBase):
                     "id": item["id"],
                     "vector": item["vector"],
                     "data": {"text": item["text"]},
-                    "metadata": stringify_metadata(item["metadata"]),
+                    "metadata": process_metadata(item["metadata"]),
                 }
                 for item in items
             ],

backend/open_webui/retrieval/vector/dbs/milvus_multitenancy.py

@@ -0,0 +1,291 @@
+import logging
+from typing import Optional, Tuple, List, Dict, Any
+
+from open_webui.config import (
+    MILVUS_URI,
+    MILVUS_TOKEN,
+    MILVUS_DB,
+    MILVUS_COLLECTION_PREFIX,
+    MILVUS_INDEX_TYPE,
+    MILVUS_METRIC_TYPE,
+    MILVUS_HNSW_M,
+    MILVUS_HNSW_EFCONSTRUCTION,
+    MILVUS_IVF_FLAT_NLIST,
+)
+from open_webui.retrieval.vector.main import (
+    GetResult,
+    SearchResult,
+    VectorDBBase,
+    VectorItem,
+)
+from pymilvus import (
+    connections,
+    utility,
+    Collection,
+    CollectionSchema,
+    FieldSchema,
+    DataType,
+)
+
+log = logging.getLogger(__name__)
+
+RESOURCE_ID_FIELD = "resource_id"
+
+
+class MilvusClient(VectorDBBase):
+    def __init__(self):
+        # Milvus collection names can only contain numbers, letters, and underscores.
+        self.collection_prefix = MILVUS_COLLECTION_PREFIX.replace("-", "_")
+        connections.connect(
+            alias="default",
+            uri=MILVUS_URI,
+            token=MILVUS_TOKEN,
+            db_name=MILVUS_DB,
+        )
+
+        # Main collection types for multi-tenancy
+        self.MEMORY_COLLECTION = f"{self.collection_prefix}_memories"
+        self.KNOWLEDGE_COLLECTION = f"{self.collection_prefix}_knowledge"
+        self.FILE_COLLECTION = f"{self.collection_prefix}_files"
+        self.WEB_SEARCH_COLLECTION = f"{self.collection_prefix}_web_search"
+        self.HASH_BASED_COLLECTION = f"{self.collection_prefix}_hash_based"
+        self.shared_collections = [
+            self.MEMORY_COLLECTION,
+            self.KNOWLEDGE_COLLECTION,
+            self.FILE_COLLECTION,
+            self.WEB_SEARCH_COLLECTION,
+            self.HASH_BASED_COLLECTION,
+        ]
+
+    def _get_collection_and_resource_id(self, collection_name: str) -> Tuple[str, str]:
+        """
+        Maps the traditional collection name to multi-tenant collection and resource ID.
+
+        WARNING: This mapping relies on current Open WebUI naming conventions for
+        collection names. If Open WebUI changes how it generates collection names
+        (e.g., "user-memory-" prefix, "file-" prefix, web search patterns, or hash
+        formats), this mapping will break and route data to incorrect collections.
+        POTENTIALLY CAUSING HUGE DATA CORRUPTION, DATA CONSISTENCY ISSUES AND INCORRECT
+        DATA MAPPING INSIDE THE DATABASE.
+        """
+        resource_id = collection_name
+
+        if collection_name.startswith("user-memory-"):
+            return self.MEMORY_COLLECTION, resource_id
+        elif collection_name.startswith("file-"):
+            return self.FILE_COLLECTION, resource_id
+        elif collection_name.startswith("web-search-"):
+            return self.WEB_SEARCH_COLLECTION, resource_id
+        elif len(collection_name) == 63 and all(
+            c in "0123456789abcdef" for c in collection_name
+        ):
+            return self.HASH_BASED_COLLECTION, resource_id
+        else:
+            return self.KNOWLEDGE_COLLECTION, resource_id
+
+    def _create_shared_collection(self, mt_collection_name: str, dimension: int):
+        fields = [
+            FieldSchema(
+                name="id",
+                dtype=DataType.VARCHAR,
+                is_primary=True,
+                auto_id=False,
+                max_length=36,
+            ),
+            FieldSchema(name="vector", dtype=DataType.FLOAT_VECTOR, dim=dimension),
+            FieldSchema(name="text", dtype=DataType.VARCHAR, max_length=65535),
+            FieldSchema(name="metadata", dtype=DataType.JSON),
+            FieldSchema(name=RESOURCE_ID_FIELD, dtype=DataType.VARCHAR, max_length=255),
+        ]
+        schema = CollectionSchema(fields, "Shared collection for multi-tenancy")
+        collection = Collection(mt_collection_name, schema)
+
+        index_params = {
+            "metric_type": MILVUS_METRIC_TYPE,
+            "index_type": MILVUS_INDEX_TYPE,
+            "params": {},
+        }
+        if MILVUS_INDEX_TYPE == "HNSW":
+            index_params["params"] = {
+                "M": MILVUS_HNSW_M,
+                "efConstruction": MILVUS_HNSW_EFCONSTRUCTION,
+            }
+        elif MILVUS_INDEX_TYPE == "IVF_FLAT":
+            index_params["params"] = {"nlist": MILVUS_IVF_FLAT_NLIST}
+
+        collection.create_index("vector", index_params)
+        collection.create_index(RESOURCE_ID_FIELD)
+        log.info(f"Created shared collection: {mt_collection_name}")
+        return collection
+
+    def _ensure_collection(self, mt_collection_name: str, dimension: int):
+        if not utility.has_collection(mt_collection_name):
+            self._create_shared_collection(mt_collection_name, dimension)
+
+    def has_collection(self, collection_name: str) -> bool:
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        if not utility.has_collection(mt_collection):
+            return False
+
+        collection = Collection(mt_collection)
+        collection.load()
+        res = collection.query(expr=f"{RESOURCE_ID_FIELD} == '{resource_id}'", limit=1)
+        return len(res) > 0
+
+    def upsert(self, collection_name: str, items: List[VectorItem]):
+        if not items:
+            return
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        dimension = len(items[0]["vector"])
+        self._ensure_collection(mt_collection, dimension)
+        collection = Collection(mt_collection)
+
+        entities = [
+            {
+                "id": item["id"],
+                "vector": item["vector"],
+                "text": item["text"],
+                "metadata": item["metadata"],
+                RESOURCE_ID_FIELD: resource_id,
+            }
+            for item in items
+        ]
+        collection.insert(entities)
+
+    def search(
+        self,
+        collection_name: str,
+        vectors: List[List[float]],
+        filter: Optional[Dict] = None,
+        limit: int = 10,
+    ) -> Optional[SearchResult]:
+        if not vectors:
+            return None
+
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        if not utility.has_collection(mt_collection):
+            return None
+
+        collection = Collection(mt_collection)
+        collection.load()
+
+        search_params = {"metric_type": MILVUS_METRIC_TYPE, "params": {}}
+        results = collection.search(
+            data=vectors,
+            anns_field="vector",
+            param=search_params,
+            limit=limit,
+            expr=f"{RESOURCE_ID_FIELD} == '{resource_id}'",
+            output_fields=["id", "text", "metadata"],
+        )
+
+        ids, documents, metadatas, distances = [], [], [], []
+        for hits in results:
+            batch_ids, batch_docs, batch_metadatas, batch_dists = [], [], [], []
+            for hit in hits:
+                batch_ids.append(hit.entity.get("id"))
+                batch_docs.append(hit.entity.get("text"))
+                batch_metadatas.append(hit.entity.get("metadata"))
+                batch_dists.append(hit.distance)
+            ids.append(batch_ids)
+            documents.append(batch_docs)
+            metadatas.append(batch_metadatas)
+            distances.append(batch_dists)
+
+        return SearchResult(
+            ids=ids, documents=documents, metadatas=metadatas, distances=distances
+        )
+
+    def delete(
+        self,
+        collection_name: str,
+        ids: Optional[List[str]] = None,
+        filter: Optional[Dict[str, Any]] = None,
+    ):
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        if not utility.has_collection(mt_collection):
+            return
+
+        collection = Collection(mt_collection)
+
+        # Build expression
+        expr = [f"{RESOURCE_ID_FIELD} == '{resource_id}'"]
+        if ids:
+            # Milvus expects a string list for 'in' operator
+            id_list_str = ", ".join([f"'{id_val}'" for id_val in ids])
+            expr.append(f"id in [{id_list_str}]")
+
+        if filter:
+            for key, value in filter.items():
+                expr.append(f"metadata['{key}'] == '{value}'")
+
+        collection.delete(" and ".join(expr))
+
+    def reset(self):
+        for collection_name in self.shared_collections:
+            if utility.has_collection(collection_name):
+                utility.drop_collection(collection_name)
+
+    def delete_collection(self, collection_name: str):
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        if not utility.has_collection(mt_collection):
+            return
+
+        collection = Collection(mt_collection)
+        collection.delete(f"{RESOURCE_ID_FIELD} == '{resource_id}'")
+
+    def query(
+        self, collection_name: str, filter: Dict[str, Any], limit: Optional[int] = None
+    ) -> Optional[GetResult]:
+        mt_collection, resource_id = self._get_collection_and_resource_id(
+            collection_name
+        )
+        if not utility.has_collection(mt_collection):
+            return None
+
+        collection = Collection(mt_collection)
+        collection.load()
+
+        expr = [f"{RESOURCE_ID_FIELD} == '{resource_id}'"]
+        if filter:
+            for key, value in filter.items():
+                if isinstance(value, str):
+                    expr.append(f"metadata['{key}'] == '{value}'")
+                else:
+                    expr.append(f"metadata['{key}'] == {value}")
+
+        iterator = collection.query_iterator(
+            expr=" and ".join(expr),
+            output_fields=["id", "text", "metadata"],
+            limit=limit if limit else -1,
+        )
+
+        all_results = []
+        while True:
+            batch = iterator.next()
+            if not batch:
+                iterator.close()
+                break
+            all_results.extend(batch)
+
+        ids = [res["id"] for res in all_results]
+        documents = [res["text"] for res in all_results]
+        metadatas = [res["metadata"] for res in all_results]
+
+        return GetResult(ids=[ids], documents=[documents], metadatas=[metadatas])
+
+    def get(self, collection_name: str) -> Optional[GetResult]:
+        return self.query(collection_name, filter={}, limit=None)
+
+    def insert(self, collection_name: str, items: List[VectorItem]):
+        return self.upsert(collection_name, items)

backend/open_webui/retrieval/vector/dbs/opengauss.py

@@ -0,0 +1,427 @@
+from typing import Optional, List, Dict, Any
+import logging
+import re
+import json
+from sqlalchemy import (
+    func,
+    literal,
+    cast,
+    column,
+    create_engine,
+    Column,
+    Integer,
+    MetaData,
+    LargeBinary,
+    select,
+    text,
+    Text,
+    Table,
+    values,
+)
+from sqlalchemy.sql import true
+from sqlalchemy.pool import NullPool, QueuePool
+
+from sqlalchemy.orm import declarative_base, scoped_session, sessionmaker
+from sqlalchemy.dialects.postgresql import JSONB, array
+from pgvector.sqlalchemy import Vector
+from sqlalchemy.ext.mutable import MutableDict
+from sqlalchemy.exc import NoSuchTableError
+
+from sqlalchemy.dialects.postgresql.psycopg2 import PGDialect_psycopg2
+from sqlalchemy.dialects import registry
+
+
+class OpenGaussDialect(PGDialect_psycopg2):
+    name = "opengauss"
+
+    def _get_server_version_info(self, connection):
+        try:
+            version = connection.exec_driver_sql("SELECT version()").scalar()
+            if not version:
+                return (9, 0, 0)
+
+            match = re.search(
+                r"openGauss\s+(\d+)\.(\d+)\.(\d+)(?:-\w+)?", version, re.IGNORECASE
+            )
+            if match:
+                return (int(match.group(1)), int(match.group(2)), int(match.group(3)))
+
+            return super()._get_server_version_info(connection)
+        except Exception:
+            return (9, 0, 0)
+
+
+# Register dialect
+registry.register("opengauss", __name__, "OpenGaussDialect")
+
+from open_webui.retrieval.vector.utils import process_metadata
+from open_webui.retrieval.vector.main import (
+    VectorDBBase,
+    VectorItem,
+    SearchResult,
+    GetResult,
+)
+from open_webui.config import (
+    OPENGAUSS_DB_URL,
+    OPENGAUSS_INITIALIZE_MAX_VECTOR_LENGTH,
+    OPENGAUSS_POOL_SIZE,
+    OPENGAUSS_POOL_MAX_OVERFLOW,
+    OPENGAUSS_POOL_TIMEOUT,
+    OPENGAUSS_POOL_RECYCLE,
+)
+
+from open_webui.env import SRC_LOG_LEVELS
+
+VECTOR_LENGTH = OPENGAUSS_INITIALIZE_MAX_VECTOR_LENGTH
+Base = declarative_base()
+
+log = logging.getLogger(__name__)
+log.setLevel(SRC_LOG_LEVELS["RAG"])
+
+
+class DocumentChunk(Base):
+    __tablename__ = "document_chunk"
+
+    id = Column(Text, primary_key=True)
+    vector = Column(Vector(dim=VECTOR_LENGTH), nullable=True)
+    collection_name = Column(Text, nullable=False)
+    text = Column(Text, nullable=True)
+    vmetadata = Column(MutableDict.as_mutable(JSONB), nullable=True)
+
+
+class OpenGaussClient(VectorDBBase):
+    def __init__(self) -> None:
+        if not OPENGAUSS_DB_URL:
+            from open_webui.internal.db import ScopedSession
+
+            self.session = ScopedSession
+        else:
+            engine_kwargs = {"pool_pre_ping": True, "dialect": OpenGaussDialect()}
+
+            if isinstance(OPENGAUSS_POOL_SIZE, int) and OPENGAUSS_POOL_SIZE > 0:
+                engine_kwargs.update(
+                    {
+                        "pool_size": OPENGAUSS_POOL_SIZE,
+                        "max_overflow": OPENGAUSS_POOL_MAX_OVERFLOW,
+                        "pool_timeout": OPENGAUSS_POOL_TIMEOUT,
+                        "pool_recycle": OPENGAUSS_POOL_RECYCLE,
+                        "poolclass": QueuePool,
+                    }
+                )
+            else:
+                engine_kwargs["poolclass"] = NullPool
+
+            engine = create_engine(OPENGAUSS_DB_URL, **engine_kwargs)
+
+            SessionLocal = sessionmaker(
+                autocommit=False, autoflush=False, bind=engine, expire_on_commit=False
+            )
+            self.session = scoped_session(SessionLocal)
+
+        try:
+            connection = self.session.connection()
+            Base.metadata.create_all(bind=connection)
+
+            self.session.execute(
+                text(
+                    "CREATE INDEX IF NOT EXISTS idx_document_chunk_vector "
+                    "ON document_chunk USING ivfflat (vector vector_cosine_ops) WITH (lists = 100);"
+                )
+            )
+            self.session.execute(
+                text(
+                    "CREATE INDEX IF NOT EXISTS idx_document_chunk_collection_name "
+                    "ON document_chunk (collection_name);"
+                )
+            )
+            self.session.commit()
+            log.info("OpenGauss vector database initialization completed.")
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"OpenGauss Initialization failed.: {e}")
+            raise
+
+    def check_vector_length(self) -> None:
+        metadata = MetaData()
+        try:
+            document_chunk_table = Table(
+                "document_chunk", metadata, autoload_with=self.session.bind
+            )
+        except NoSuchTableError:
+            return
+
+        if "vector" in document_chunk_table.columns:
+            vector_column = document_chunk_table.columns["vector"]
+            vector_type = vector_column.type
+            if isinstance(vector_type, Vector):
+                db_vector_length = vector_type.dim
+                if db_vector_length != VECTOR_LENGTH:
+                    raise Exception(
+                        f"Vector dimension mismatch: configured {VECTOR_LENGTH} vs. {db_vector_length} in the database."
+                    )
+            else:
+                raise Exception("The 'vector' column type is not Vector.")
+        else:
+            raise Exception(
+                "The 'vector' column does not exist in the 'document_chunk' table."
+            )
+
+    def adjust_vector_length(self, vector: List[float]) -> List[float]:
+        current_length = len(vector)
+        if current_length < VECTOR_LENGTH:
+            vector += [0.0] * (VECTOR_LENGTH - current_length)
+        elif current_length > VECTOR_LENGTH:
+            vector = vector[:VECTOR_LENGTH]
+        return vector
+
+    def insert(self, collection_name: str, items: List[VectorItem]) -> None:
+        try:
+            new_items = []
+            for item in items:
+                vector = self.adjust_vector_length(item["vector"])
+                new_chunk = DocumentChunk(
+                    id=item["id"],
+                    vector=vector,
+                    collection_name=collection_name,
+                    text=item["text"],
+                    vmetadata=process_metadata(item["metadata"]),
+                )
+                new_items.append(new_chunk)
+            self.session.bulk_save_objects(new_items)
+            self.session.commit()
+            log.info(
+                f"Inserting {len(new_items)} items into collection '{collection_name}'."
+            )
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Failed to insert data: {e}")
+            raise
+
+    def upsert(self, collection_name: str, items: List[VectorItem]) -> None:
+        try:
+            for item in items:
+                vector = self.adjust_vector_length(item["vector"])
+                existing = (
+                    self.session.query(DocumentChunk)
+                    .filter(DocumentChunk.id == item["id"])
+                    .first()
+                )
+                if existing:
+                    existing.vector = vector
+                    existing.text = item["text"]
+                    existing.vmetadata = process_metadata(item["metadata"])
+                    existing.collection_name = collection_name
+                else:
+                    new_chunk = DocumentChunk(
+                        id=item["id"],
+                        vector=vector,
+                        collection_name=collection_name,
+                        text=item["text"],
+                        vmetadata=process_metadata(item["metadata"]),
+                    )
+                    self.session.add(new_chunk)
+            self.session.commit()
+            log.info(
+                f"Inserting/updating {len(items)} items in collection '{collection_name}'."
+            )
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Failed to insert or update data.: {e}")
+            raise
+
+    def search(
+        self,
+        collection_name: str,
+        vectors: List[List[float]],
+        filter: Optional[Dict[str, Any]] = None,
+        limit: int = 10,
+    ) -> Optional[SearchResult]:
+        try:
+            if not vectors:
+                return None
+
+            vectors = [self.adjust_vector_length(vector) for vector in vectors]
+            num_queries = len(vectors)
+
+            def vector_expr(vector):
+                return cast(array(vector), Vector(VECTOR_LENGTH))
+
+            qid_col = column("qid", Integer)
+            q_vector_col = column("q_vector", Vector(VECTOR_LENGTH))
+            query_vectors = (
+                values(qid_col, q_vector_col)
+                .data(
+                    [(idx, vector_expr(vector)) for idx, vector in enumerate(vectors)]
+                )
+                .alias("query_vectors")
+            )
+
+            result_fields = [
+                DocumentChunk.id,
+                DocumentChunk.text,
+                DocumentChunk.vmetadata,
+                (DocumentChunk.vector.cosine_distance(query_vectors.c.q_vector)).label(
+                    "distance"
+                ),
+            ]
+
+            subq = (
+                select(*result_fields)
+                .where(DocumentChunk.collection_name == collection_name)
+                .order_by(
+                    DocumentChunk.vector.cosine_distance(query_vectors.c.q_vector)
+                )
+            )
+            if limit is not None:
+                subq = subq.limit(limit)
+            subq = subq.lateral("result")
+
+            stmt = (
+                select(
+                    query_vectors.c.qid,
+                    subq.c.id,
+                    subq.c.text,
+                    subq.c.vmetadata,
+                    subq.c.distance,
+                )
+                .select_from(query_vectors)
+                .join(subq, true())
+                .order_by(query_vectors.c.qid, subq.c.distance)
+            )
+
+            result_proxy = self.session.execute(stmt)
+            results = result_proxy.all()
+
+            ids = [[] for _ in range(num_queries)]
+            distances = [[] for _ in range(num_queries)]
+            documents = [[] for _ in range(num_queries)]
+            metadatas = [[] for _ in range(num_queries)]
+
+            for row in results:
+                qid = int(row.qid)
+                ids[qid].append(row.id)
+                distances[qid].append((2.0 - row.distance) / 2.0)
+                documents[qid].append(row.text)
+                metadatas[qid].append(row.vmetadata)
+
+            self.session.rollback()
+            return SearchResult(
+                ids=ids, distances=distances, documents=documents, metadatas=metadatas
+            )
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Vector search failed: {e}")
+            return None
+
+    def query(
+        self, collection_name: str, filter: Dict[str, Any], limit: Optional[int] = None
+    ) -> Optional[GetResult]:
+        try:
+            query = self.session.query(DocumentChunk).filter(
+                DocumentChunk.collection_name == collection_name
+            )
+
+            for key, value in filter.items():
+                query = query.filter(DocumentChunk.vmetadata[key].astext == str(value))
+
+            if limit is not None:
+                query = query.limit(limit)
+
+            results = query.all()
+
+            if not results:
+                return None
+
+            ids = [[result.id for result in results]]
+            documents = [[result.text for result in results]]
+            metadatas = [[result.vmetadata for result in results]]
+
+            self.session.rollback()
+            return GetResult(ids=ids, documents=documents, metadatas=metadatas)
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Conditional query failed: {e}")
+            return None
+
+    def get(
+        self, collection_name: str, limit: Optional[int] = None
+    ) -> Optional[GetResult]:
+        try:
+            query = self.session.query(DocumentChunk).filter(
+                DocumentChunk.collection_name == collection_name
+            )
+            if limit is not None:
+                query = query.limit(limit)
+
+            results = query.all()
+
+            if not results:
+                return None
+
+            ids = [[result.id for result in results]]
+            documents = [[result.text for result in results]]
+            metadatas = [[result.vmetadata for result in results]]
+
+            self.session.rollback()
+            return GetResult(ids=ids, documents=documents, metadatas=metadatas)
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Failed to retrieve data: {e}")
+            return None
+
+    def delete(
+        self,
+        collection_name: str,
+        ids: Optional[List[str]] = None,
+        filter: Optional[Dict[str, Any]] = None,
+    ) -> None:
+        try:
+            query = self.session.query(DocumentChunk).filter(
+                DocumentChunk.collection_name == collection_name
+            )
+            if ids:
+                query = query.filter(DocumentChunk.id.in_(ids))
+            if filter:
+                for key, value in filter.items():
+                    query = query.filter(
+                        DocumentChunk.vmetadata[key].astext == str(value)
+                    )
+            deleted = query.delete(synchronize_session=False)
+            self.session.commit()
+            log.info(f"Deleted {deleted} items from collection '{collection_name}'")
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Failed to delete data: {e}")
+            raise
+
+    def reset(self) -> None:
+        try:
+            deleted = self.session.query(DocumentChunk).delete()
+            self.session.commit()
+            log.info(f"Reset completed. Deleted {deleted} items")
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Reset failed: {e}")
+            raise
+
+    def close(self) -> None:
+        pass
+
+    def has_collection(self, collection_name: str) -> bool:
+        try:
+            exists = (
+                self.session.query(DocumentChunk)
+                .filter(DocumentChunk.collection_name == collection_name)
+                .first()
+                is not None
+            )
+            self.session.rollback()
+            return exists
+        except Exception as e:
+            self.session.rollback()
+            log.exception(f"Failed to check collection existence: {e}")
+            return False
+
+    def delete_collection(self, collection_name: str) -> None:
+        self.delete(collection_name)
+        log.info(f"Collection '{collection_name}' has been deleted")

backend/open_webui/retrieval/vector/dbs/opensearch.py

@@ -2,7 +2,7 @@ from opensearchpy import OpenSearch
 from opensearchpy.helpers import bulk
 from typing import Optional
 
-from open_webui.retrieval.vector.utils import stringify_metadata
+from open_webui.retrieval.vector.utils import process_metadata
 from open_webui.retrieval.vector.main import (
     VectorDBBase,
     VectorItem,
@@ -113,7 +113,11 @@ class OpenSearchClient(VectorDBBase):
         self.client.indices.delete(index=self._get_index_name(collection_name))
 
     def search(
-        self, collection_name: str, vectors: list[list[float | int]], limit: int
+        self,
+        collection_name: str,
+        vectors: list[list[float | int]],
+        filter: Optional[dict] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         try:
             if not self.has_collection(collection_name):
@@ -201,13 +205,13 @@ class OpenSearchClient(VectorDBBase):
                     "_source": {
                         "vector": item["vector"],
                         "text": item["text"],
-                        "metadata": stringify_metadata(item["metadata"]),
+                        "metadata": process_metadata(item["metadata"]),
                     },
                 }
                 for item in batch
             ]
             bulk(self.client, actions)
-        self.client.indices.refresh(self._get_index_name(collection_name))
+        self.client.indices.refresh(index=self._get_index_name(collection_name))
 
     def upsert(self, collection_name: str, items: list[VectorItem]):
         self._create_index_if_not_exists(
@@ -223,14 +227,14 @@ class OpenSearchClient(VectorDBBase):
                     "doc": {
                         "vector": item["vector"],
                         "text": item["text"],
-                        "metadata": stringify_metadata(item["metadata"]),
+                        "metadata": process_metadata(item["metadata"]),
                     },
                     "doc_as_upsert": True,
                 }
                 for item in batch
             ]
             bulk(self.client, actions)
-        self.client.indices.refresh(self._get_index_name(collection_name))
+        self.client.indices.refresh(index=self._get_index_name(collection_name))
 
     def delete(
         self,
@@ -259,7 +263,7 @@ class OpenSearchClient(VectorDBBase):
             self.client.delete_by_query(
                 index=self._get_index_name(collection_name), body=query_body
             )
-        self.client.indices.refresh(self._get_index_name(collection_name))
+        self.client.indices.refresh(index=self._get_index_name(collection_name))
 
     def reset(self):
         indices = self.client.indices.get(index=f"{self.index_prefix}_*")

backend/open_webui/retrieval/vector/dbs/oracle23ai.py

@@ -55,10 +55,8 @@ from open_webui.config import (
     ORACLE_DB_POOL_MAX,
     ORACLE_DB_POOL_INCREMENT,
 )
-from open_webui.env import SRC_LOG_LEVELS
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 class Oracle23aiClient(VectorDBBase):
@@ -258,8 +256,7 @@ class Oracle23aiClient(VectorDBBase):
         with connection.cursor() as cursor:
             try:
                 log.info("Creating Table document_chunk")
-                cursor.execute(
-                    """
+                cursor.execute("""
                     BEGIN
                         EXECUTE IMMEDIATE '
                             CREATE TABLE IF NOT EXISTS document_chunk (
@@ -276,12 +273,10 @@ class Oracle23aiClient(VectorDBBase):
                                 RAISE;
                             END IF;
                     END;
-                """
-                )
+                """)
 
                 log.info("Creating Index document_chunk_collection_name_idx")
-                cursor.execute(
-                    """
+                cursor.execute("""
                     BEGIN
                         EXECUTE IMMEDIATE '
                             CREATE INDEX IF NOT EXISTS document_chunk_collection_name_idx
@@ -293,12 +288,10 @@ class Oracle23aiClient(VectorDBBase):
                                 RAISE;
                             END IF;
                     END;
-                """
-                )
+                """)
 
                 log.info("Creating VECTOR INDEX document_chunk_vector_ivf_idx")
-                cursor.execute(
-                    """
+                cursor.execute("""
                     BEGIN
                         EXECUTE IMMEDIATE '
                             CREATE VECTOR INDEX IF NOT EXISTS document_chunk_vector_ivf_idx 
@@ -314,8 +307,7 @@ class Oracle23aiClient(VectorDBBase):
                                 RAISE;
                             END IF;
                     END;
-                """
-                )
+                """)
 
                 connection.commit()
                 log.info("Database initialization completed successfully.")
@@ -523,7 +515,11 @@ class Oracle23aiClient(VectorDBBase):
                 raise
 
     def search(
-        self, collection_name: str, vectors: List[List[Union[float, int]]], limit: int
+        self,
+        collection_name: str,
+        vectors: List[List[Union[float, int]]],
+        filter: Optional[dict] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         """
         Search for similar vectors in the database.
@@ -717,7 +713,7 @@ class Oracle23aiClient(VectorDBBase):
         )
 
         try:
-            limit = limit or 1000
+            limit = 1000  # Hardcoded limit for get operation
 
             with self.get_connection() as connection:
                 with connection.cursor() as cursor:

backend/open_webui/retrieval/vector/dbs/pgvector.py

@@ -1,4 +1,4 @@
-from typing import Optional, List, Dict, Any
+from typing import Optional, List, Dict, Any, Tuple
 import logging
 import json
 from sqlalchemy import (
@@ -22,12 +22,12 @@ from sqlalchemy.pool import NullPool, QueuePool
 
 from sqlalchemy.orm import declarative_base, scoped_session, sessionmaker
 from sqlalchemy.dialects.postgresql import JSONB, array
-from pgvector.sqlalchemy import Vector
+from pgvector.sqlalchemy import Vector, HALFVEC
 from sqlalchemy.ext.mutable import MutableDict
 from sqlalchemy.exc import NoSuchTableError
 
 
-from open_webui.retrieval.vector.utils import stringify_metadata
+from open_webui.retrieval.vector.utils import process_metadata
 from open_webui.retrieval.vector.main import (
     VectorDBBase,
     VectorItem,
@@ -37,21 +37,28 @@ from open_webui.retrieval.vector.main import (
 from open_webui.config import (
     PGVECTOR_DB_URL,
     PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH,
+    PGVECTOR_CREATE_EXTENSION,
     PGVECTOR_PGCRYPTO,
     PGVECTOR_PGCRYPTO_KEY,
     PGVECTOR_POOL_SIZE,
     PGVECTOR_POOL_MAX_OVERFLOW,
     PGVECTOR_POOL_TIMEOUT,
     PGVECTOR_POOL_RECYCLE,
+    PGVECTOR_INDEX_METHOD,
+    PGVECTOR_HNSW_M,
+    PGVECTOR_HNSW_EF_CONSTRUCTION,
+    PGVECTOR_IVFFLAT_LISTS,
+    PGVECTOR_USE_HALFVEC,
 )
 
-from open_webui.env import SRC_LOG_LEVELS
-
 VECTOR_LENGTH = PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH
+USE_HALFVEC = PGVECTOR_USE_HALFVEC
+
+VECTOR_TYPE_FACTORY = HALFVEC if USE_HALFVEC else Vector
+VECTOR_OPCLASS = "halfvec_cosine_ops" if USE_HALFVEC else "vector_cosine_ops"
 Base = declarative_base()
 
 log = logging.getLogger(__name__)
-log.setLevel(SRC_LOG_LEVELS["RAG"])
 
 
 def pgcrypto_encrypt(val, key):
@@ -66,7 +73,7 @@ class DocumentChunk(Base):
     __tablename__ = "document_chunk"
 
     id = Column(Text, primary_key=True)
-    vector = Column(Vector(dim=VECTOR_LENGTH), nullable=True)
+    vector = Column(VECTOR_TYPE_FACTORY(dim=VECTOR_LENGTH), nullable=True)
     collection_name = Column(Text, nullable=False)
 
     if PGVECTOR_PGCRYPTO:
@@ -82,9 +89,9 @@ class PgvectorClient(VectorDBBase):
 
         # if no pgvector uri, use the existing database connection
         if not PGVECTOR_DB_URL:
-            from open_webui.internal.db import Session
+            from open_webui.internal.db import ScopedSession
 
-            self.session = Session
+            self.session = ScopedSession
         else:
             if isinstance(PGVECTOR_POOL_SIZE, int):
                 if PGVECTOR_POOL_SIZE > 0:
@@ -112,34 +119,27 @@ class PgvectorClient(VectorDBBase):
         try:
             # Ensure the pgvector extension is available
             # Use a conditional check to avoid permission issues on Azure PostgreSQL
-            self.session.execute(
-                text(
-                    """
-                DO $$
-                BEGIN
-                   IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
-                      CREATE EXTENSION IF NOT EXISTS vector;
-                   END IF;
-                END $$;
-            """
-                )
-            )
+            if PGVECTOR_CREATE_EXTENSION:
+                self.session.execute(text("""
+                    DO $$
+                    BEGIN
+                    IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+                        CREATE EXTENSION IF NOT EXISTS vector;
+                    END IF;
+                    END $$;
+                """))
 
             if PGVECTOR_PGCRYPTO:
                 # Ensure the pgcrypto extension is available for encryption
                 # Use a conditional check to avoid permission issues on Azure PostgreSQL
-                self.session.execute(
-                    text(
-                        """
+                self.session.execute(text("""
                     DO $$
                     BEGIN
                        IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pgcrypto') THEN
                           CREATE EXTENSION IF NOT EXISTS pgcrypto;
                        END IF;
                     END $$;
-                """
-                    )
-                )
+                """))
 
                 if not PGVECTOR_PGCRYPTO_KEY:
                     raise ValueError(
@@ -155,13 +155,9 @@ class PgvectorClient(VectorDBBase):
             connection = self.session.connection()
             Base.metadata.create_all(bind=connection)
 
-            # Create an index on the vector column if it doesn't exist
-            self.session.execute(
-                text(
-                    "CREATE INDEX IF NOT EXISTS idx_document_chunk_vector "
-                    "ON document_chunk USING ivfflat (vector vector_cosine_ops) WITH (lists = 100);"
-                )
-            )
+            index_method, index_options = self._vector_index_configuration()
+            self._ensure_vector_index(index_method, index_options)
+
             self.session.execute(
                 text(
                     "CREATE INDEX IF NOT EXISTS idx_document_chunk_collection_name "
@@ -175,6 +171,76 @@ class PgvectorClient(VectorDBBase):
             log.exception(f"Error during initialization: {e}")
             raise
 
+    @staticmethod
+    def _extract_index_method(index_def: Optional[str]) -> Optional[str]:
+        if not index_def:
+            return None
+        try:
+            after_using = index_def.lower().split("using ", 1)[1]
+            return after_using.split()[0]
+        except (IndexError, AttributeError):
+            return None
+
+    def _vector_index_configuration(self) -> Tuple[str, str]:
+        if PGVECTOR_INDEX_METHOD:
+            index_method = PGVECTOR_INDEX_METHOD
+            log.info(
+                "Using vector index method '%s' from PGVECTOR_INDEX_METHOD.",
+                index_method,
+            )
+        elif USE_HALFVEC:
+            index_method = "hnsw"
+            log.info(
+                "VECTOR_LENGTH=%s exceeds 2000; using halfvec column type with hnsw index.",
+                VECTOR_LENGTH,
+            )
+        else:
+            index_method = "ivfflat"
+
+        if index_method == "hnsw":
+            index_options = f"WITH (m = {PGVECTOR_HNSW_M}, ef_construction = {PGVECTOR_HNSW_EF_CONSTRUCTION})"
+        else:
+            index_options = f"WITH (lists = {PGVECTOR_IVFFLAT_LISTS})"
+
+        return index_method, index_options
+
+    def _ensure_vector_index(self, index_method: str, index_options: str) -> None:
+        index_name = "idx_document_chunk_vector"
+        existing_index_def = self.session.execute(
+            text("""
+                SELECT indexdef
+                FROM pg_indexes
+                WHERE schemaname = current_schema()
+                  AND tablename = 'document_chunk'
+                  AND indexname = :index_name
+                """),
+            {"index_name": index_name},
+        ).scalar()
+
+        existing_method = self._extract_index_method(existing_index_def)
+        if existing_method and existing_method != index_method:
+            raise RuntimeError(
+                f"Existing pgvector index '{index_name}' uses method '{existing_method}' but configuration now "
+                f"requires '{index_method}'. Automatic rebuild is disabled to prevent long-running maintenance. "
+                "Drop the index manually (optionally after tuning maintenance_work_mem/max_parallel_maintenance_workers) "
+                "and recreate it with the new method before restarting Open WebUI."
+            )
+
+        if not existing_index_def:
+            index_sql = (
+                f"CREATE INDEX IF NOT EXISTS {index_name} "
+                f"ON document_chunk USING {index_method} (vector {VECTOR_OPCLASS})"
+            )
+            if index_options:
+                index_sql = f"{index_sql} {index_options}"
+            self.session.execute(text(index_sql))
+            log.info(
+                "Ensured vector index '%s' using %s%s.",
+                index_name,
+                index_method,
+                f" {index_options}" if index_options else "",
+            )
+
     def check_vector_length(self) -> None:
         """
         Check if the VECTOR_LENGTH matches the existing vector column dimension in the database.
@@ -194,16 +260,19 @@ class PgvectorClient(VectorDBBase):
         if "vector" in document_chunk_table.columns:
             vector_column = document_chunk_table.columns["vector"]
             vector_type = vector_column.type
-            if isinstance(vector_type, Vector):
-                db_vector_length = vector_type.dim
-                if db_vector_length != VECTOR_LENGTH:
-                    raise Exception(
-                        f"VECTOR_LENGTH {VECTOR_LENGTH} does not match existing vector column dimension {db_vector_length}. "
-                        "Cannot change vector size after initialization without migrating the data."
-                    )
-            else:
+            expected_type = HALFVEC if USE_HALFVEC else Vector
+
+            if not isinstance(vector_type, expected_type):
                 raise Exception(
-                    "The 'vector' column exists but is not of type 'Vector'."
+                    "The 'vector' column type does not match the expected type "
+                    f"('{expected_type.__name__}') for VECTOR_LENGTH {VECTOR_LENGTH}."
+                )
+
+            db_vector_length = getattr(vector_type, "dim", None)
+            if db_vector_length is not None and db_vector_length != VECTOR_LENGTH:
+                raise Exception(
+                    f"VECTOR_LENGTH {VECTOR_LENGTH} does not match existing vector column dimension {db_vector_length}. "
+                    "Cannot change vector size after initialization without migrating the data."
                 )
         else:
             raise Exception(
@@ -230,8 +299,7 @@ class PgvectorClient(VectorDBBase):
                     # Ensure metadata is converted to its JSON text representation
                     json_metadata = json.dumps(item["metadata"])
                     self.session.execute(
-                        text(
-                            """
+                        text("""
                             INSERT INTO document_chunk
                             (id, vector, collection_name, text, vmetadata)
                             VALUES (
@@ -240,8 +308,7 @@ class PgvectorClient(VectorDBBase):
                                 pgp_sym_encrypt(:metadata_text, :key)
                             )
                             ON CONFLICT (id) DO NOTHING
-                        """
-                        ),
+                        """),
                         {
                             "id": item["id"],
                             "vector": vector,
@@ -263,7 +330,7 @@ class PgvectorClient(VectorDBBase):
                         vector=vector,
                         collection_name=collection_name,
                         text=item["text"],
-                        vmetadata=stringify_metadata(item["metadata"]),
+                        vmetadata=process_metadata(item["metadata"]),
                     )
                     new_items.append(new_chunk)
                 self.session.bulk_save_objects(new_items)
@@ -283,8 +350,7 @@ class PgvectorClient(VectorDBBase):
                     vector = self.adjust_vector_length(item["vector"])
                     json_metadata = json.dumps(item["metadata"])
                     self.session.execute(
-                        text(
-                            """
+                        text("""
                             INSERT INTO document_chunk
                             (id, vector, collection_name, text, vmetadata)
                             VALUES (
@@ -297,8 +363,7 @@ class PgvectorClient(VectorDBBase):
                               collection_name = EXCLUDED.collection_name,
                               text = EXCLUDED.text,
                               vmetadata = EXCLUDED.vmetadata
-                        """
-                        ),
+                        """),
                         {
                             "id": item["id"],
                             "vector": vector,
@@ -321,7 +386,7 @@ class PgvectorClient(VectorDBBase):
                     if existing:
                         existing.vector = vector
                         existing.text = item["text"]
-                        existing.vmetadata = stringify_metadata(item["metadata"])
+                        existing.vmetadata = process_metadata(item["metadata"])
                         existing.collection_name = (
                             collection_name  # Update collection_name if necessary
                         )
@@ -331,7 +396,7 @@ class PgvectorClient(VectorDBBase):
                             vector=vector,
                             collection_name=collection_name,
                             text=item["text"],
-                            vmetadata=stringify_metadata(item["metadata"]),
+                            vmetadata=process_metadata(item["metadata"]),
                         )
                         self.session.add(new_chunk)
                 self.session.commit()
@@ -347,7 +412,8 @@ class PgvectorClient(VectorDBBase):
         self,
         collection_name: str,
         vectors: List[List[float]],
-        limit: Optional[int] = None,
+        filter: Optional[Dict[str, Any]] = None,
+        limit: int = 10,
     ) -> Optional[SearchResult]:
         try:
             if not vectors:
@@ -358,11 +424,11 @@ class PgvectorClient(VectorDBBase):
             num_queries = len(vectors)
 
             def vector_expr(vector):
-                return cast(array(vector), Vector(VECTOR_LENGTH))
+                return cast(array(vector), VECTOR_TYPE_FACTORY(VECTOR_LENGTH))
 
             # Create the values for query vectors
             qid_col = column("qid", Integer)
-            q_vector_col = column("q_vector", Vector(VECTOR_LENGTH))
+            q_vector_col = column("q_vector", VECTOR_TYPE_FACTORY(VECTOR_LENGTH))
             query_vectors = (
                 values(qid_col, q_vector_col)
                 .data(
@@ -395,9 +461,47 @@ class PgvectorClient(VectorDBBase):
             )
 
             # Build the lateral subquery for each query vector
+            where_clauses = [DocumentChunk.collection_name == collection_name]
+
+            # Apply metadata filter if provided
+            if filter:
+                for key, value in filter.items():
+                    if isinstance(value, dict) and "$in" in value:
+                        # Handle $in operator: {"field": {"$in": [values]}}
+                        in_values = value["$in"]
+                        if PGVECTOR_PGCRYPTO:
+                            where_clauses.append(
+                                pgcrypto_decrypt(
+                                    DocumentChunk.vmetadata,
+                                    PGVECTOR_PGCRYPTO_KEY,
+                                    JSONB,
+                                )[key].astext.in_([str(v) for v in in_values])
+                            )
+                        else:
+                            where_clauses.append(
+                                DocumentChunk.vmetadata[key].astext.in_(
+                                    [str(v) for v in in_values]
+                                )
+                            )
+                    else:
+                        # Handle simple equality: {"field": "value"}
+                        if PGVECTOR_PGCRYPTO:
+                            where_clauses.append(
+                                pgcrypto_decrypt(
+                                    DocumentChunk.vmetadata,
+                                    PGVECTOR_PGCRYPTO_KEY,
+                                    JSONB,
+                                )[key].astext
+                                == str(value)
+                            )
+                        else:
+                            where_clauses.append(
+                                DocumentChunk.vmetadata[key].astext == str(value)
+                            )
+
             subq = (
                 select(*result_fields)
-                .where(DocumentChunk.collection_name == collection_name)
+                .where(*where_clauses)
                 .order_by(
                     (DocumentChunk.vector.cosine_distance(query_vectors.c.q_vector))
                 )