From 2e16a761eea7ece1edcc489220aa4f7403ad9328 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:44:45 +0200
Subject: [PATCH] refactor: scope tool export to tools the caller can write
 (#29310)

The bulk tool export returned every tool the caller could read, while the per-tool export path returns only what the caller can write. This aligns the two, matching how model export already scopes its query.

Callers still export their own tools and any tool shared with them for writing; admins running with BYPASS_ADMIN_ACCESS_CONTROL are unaffected.
---
 backend/open_webui/routers/tools.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/open_webui/routers/tools.py b/backend/open_webui/routers/tools.py
index 2e25d28ef3..86860237aa 100644
--- a/backend/open_webui/routers/tools.py
+++ b/backend/open_webui/routers/tools.py
@@ -339,6 +339,7 @@ async def export_tools(
     return await Tools.get_tools(
         db=db,
         user_id=None if bypass_access_control else user.id,
+        permission='write',
     )