fix: enforce tool access and skip stale socket sessions

backend/open_webui/socket/main.py

@@ -22,6 +22,7 @@
     WEBSOCKET_SENTINEL_HOSTS,
 )
 from open_webui.utils.auth import decode_token
+from open_webui.socket.sessions import get_user_ids_from_session_ids
 from open_webui.socket.utils import RedisDict, RedisLock
 
 from open_webui.env import (
@@ -174,13 +175,7 @@ def get_user_ids_from_room(room):
         namespace="/",
         room=room,
     )
-
-    active_user_ids = list(
-        set(
-            [SESSION_POOL.get(session_id[0])["id"] for session_id in active_session_ids]
-        )
-    )
-    return active_user_ids
+    return get_user_ids_from_session_ids(active_session_ids, SESSION_POOL)
 
 
 def get_active_status_by_user_id(user_id):

backend/open_webui/socket/sessions.py

@@ -0,0 +1,24 @@
+from collections.abc import Iterable, Mapping
+from typing import Any
+
+
+def get_user_ids_from_session_ids(
+    active_session_ids: Iterable[Any], session_pool: Mapping[str, dict]
+) -> list[str]:
+    user_ids = set()
+
+    for session_id in active_session_ids:
+        try:
+            sid = session_id[0]
+        except (IndexError, TypeError):
+            continue
+
+        session = session_pool.get(sid)
+        if not session:
+            continue
+
+        user_id = session.get("id")
+        if user_id:
+            user_ids.add(user_id)
+
+    return list(user_ids)

backend/open_webui/utils/tool_access.py

@@ -0,0 +1,18 @@
+from collections.abc import Callable
+from typing import Optional
+
+
+def can_use_tool(
+    user_id: str,
+    user_role: str,
+    tool_owner_id: Optional[str],
+    access_control: Optional[dict],
+    has_access_func: Callable[[str, str, Optional[dict]], bool],
+) -> bool:
+    if user_role == "admin":
+        return True
+
+    if tool_owner_id is not None and tool_owner_id == user_id:
+        return True
+
+    return has_access_func(user_id, "read", access_control)

backend/open_webui/utils/tools.py

@@ -35,7 +35,9 @@
 
 from open_webui.models.tools import Tools
 from open_webui.models.users import UserModel
+from open_webui.utils.access_control import has_access
 from open_webui.utils.plugin import load_tool_module_by_id
+from open_webui.utils.tool_access import can_use_tool
 from open_webui.env import (
     SRC_LOG_LEVELS,
     AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER_DATA,
@@ -76,10 +78,23 @@ def get_tools(
         tool = Tools.get_tool_by_id(tool_id)
         if tool is None:
             if tool_id.startswith("server:"):
-                server_idx = int(tool_id.split(":")[1])
-                tool_server_connection = (
-                    request.app.state.config.TOOL_SERVER_CONNECTIONS[server_idx]
-                )
+                try:
+                    server_idx = int(tool_id.split(":")[1])
+                    tool_server_connection = (
+                        request.app.state.config.TOOL_SERVER_CONNECTIONS[server_idx]
+                    )
+                except (IndexError, TypeError, ValueError):
+                    continue
+
+                if not can_use_tool(
+                    user.id,
+                    user.role,
+                    None,
+                    tool_server_connection.get("config", {}).get("access_control", None),
+                    has_access,
+                ):
+                    continue
+
                 tool_server_data = None
                 for server in request.app.state.TOOL_SERVERS:
                     if server["idx"] == server_idx:
@@ -140,6 +155,11 @@ async def tool_function(**kwargs):
             else:
                 continue
         else:
+            if not can_use_tool(
+                user.id, user.role, tool.user_id, tool.access_control, has_access
+            ):
+                continue
+
             module = request.app.state.TOOLS.get(tool_id, None)
             if module is None:
                 module, _ = load_tool_module_by_id(tool_id)

tests/test_tool_and_socket_regressions.py

@@ -0,0 +1,63 @@
+import importlib.util
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def load_module(name: str, relative_path: str):
+    spec = importlib.util.spec_from_file_location(name, ROOT / relative_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module
+
+
+tool_access = load_module(
+    "tool_access", "backend/open_webui/utils/tool_access.py"
+)
+socket_sessions = load_module(
+    "socket_sessions", "backend/open_webui/socket/sessions.py"
+)
+
+
+def test_can_use_tool_allows_admin_owner_and_read_access():
+    denied = lambda user_id, permission, access_control: False
+    allowed = lambda user_id, permission, access_control: True
+
+    assert tool_access.can_use_tool("user-1", "admin", "owner", {}, denied)
+    assert tool_access.can_use_tool("user-1", "user", "user-1", {}, denied)
+    assert tool_access.can_use_tool(
+        "user-1", "user", "owner", {"read": {"user_ids": ["user-1"]}}, allowed
+    )
+
+
+def test_can_use_tool_denies_unshared_tools():
+    denied = lambda user_id, permission, access_control: False
+
+    assert not tool_access.can_use_tool(
+        "user-1", "user", "owner", {"read": {"user_ids": ["owner"]}}, denied
+    )
+
+
+def test_get_user_ids_from_session_ids_skips_stale_room_participants():
+    session_pool = {
+        "sid-1": {"id": "user-1"},
+        "sid-2": {"id": "user-2"},
+    }
+
+    user_ids = socket_sessions.get_user_ids_from_session_ids(
+        [("sid-1", "transport-1"), ("stale-sid", "transport-2"), ("sid-2",)],
+        session_pool,
+    )
+
+    assert set(user_ids) == {"user-1", "user-2"}
+
+
+def test_get_user_ids_from_session_ids_ignores_empty_sessions():
+    user_ids = socket_sessions.get_user_ids_from_session_ids(
+        [("empty",), ("missing-id",), (), None],
+        {"empty": None, "missing-id": {}},
+    )
+
+    assert user_ids == []