Merge branch 'dev' into ldap-features

.github/pull_request_template.md

@@ -10,6 +10,12 @@
 
 This is to ensure large feature PRs are discussed with the community first, before starting work on it. If the community does not want this feature or it is not relevant for Open WebUI as a project, it can be identified in the discussion before working on the feature and submitting the PR.
 
+<!--
+### ⚠️ Important: Your PR is a contribution, not a guarantee of merge.
+
+The most impactful way to contribute to Open WebUI is through well-written bug reports, detailed feature discussions, and thoughtful ideas. These directly shape the project. If you do open a pull request, please know that Open WebUI is held to the highest standard of code quality, consistency, and architectural coherence, and every line merged becomes something the core team must own, maintain, and support indefinitely. Submitted code may be refactored, rewritten, or used as inspiration for a different implementation. This is not a reflection of your work's quality. It is how we ensure that a small team can deeply understand and evolve every part of the codebase.
+-->
+
 **Before submitting, make sure you've checked the following:**
 
 - [ ] **Target branch:** Verify that the pull request targets the `dev` branch. **PRs targeting `main` will be immediately closed.**

CHANGELOG.md

@@ -5,6 +5,238 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.1] - 2026-04-21
+
+### Fixed
+
+- 🐛 **Missing `aiosqlite` dependency.** Fixed a startup crash (`ModuleNotFoundError: No module named 'aiosqlite'`) when installing Open WebUI via `pip` or `uv` by adding the missing `aiosqlite` package to `pyproject.toml`. The dependency was listed in `requirements.txt` but not in the published package metadata, so it was not installed automatically. [#23916](https://github.com/open-webui/open-webui/issues/23916)
+- 🐛 **Missing `asyncpg` dependency.** Added the missing `asyncpg` package to `pyproject.toml` to prevent the same startup crash for PostgreSQL users. Like `aiosqlite`, it was present in `requirements.txt` but absent from the published package dependencies.
+
+## [0.9.0] - 2026-04-20
+
+### Added
+
+- 🖥️ **Official Open WebUI Desktop App.** Open WebUI is now available as a native desktop app for Mac, Windows, and Linux. No Docker, no terminal, no setup. Runs Open WebUI locally without any server setup, or connects to your existing remote Open WebUI instances. Switch between multiple servers instantly from the sidebar. Comes with a system-wide floating chat bar (Shift+Cmd+I on macOS, Shift+Ctrl+I on Windows/Linux), system-wide push-to-talk, offline support after first launch, automatic updates, and zero telemetry. [#8262](https://github.com/open-webui/open-webui/issues/8262), [Desktop](https://github.com/open-webui/desktop)
+- 🤖 **Scheduled chat automations.** You can now schedule the AI to run tasks automatically on a recurring basis: daily digests, periodic reports, anything you'd otherwise need to remember to ask for. Create and manage automations from the Automations page or directly in chat, with full run history and manual trigger controls. [#23303](https://github.com/open-webui/open-webui/pull/23303), [Commit](https://github.com/open-webui/open-webui/commit/5a2ff8b2e5b6f55a20f7ed491f818490eb535ea7), [Commit](https://github.com/open-webui/open-webui/commit/d30a0531d4add045c21a2368d6321a9b1906865f), [Commit](https://github.com/open-webui/open-webui/commit/bae5ff938ac88a3a647cc31ca8db1101015ae18b), [Commit](https://github.com/open-webui/open-webui/commit/588b81eedaacbfd7394b707ae1600d9fb729b809..674695918e5e3e1811314ce2a082c5bbb42d76b2)
+- 🧰 **Automation tools in chat.** Built-in chat tools can now create, update, list, pause, and delete scheduled automations directly in conversation when automation access is enabled. [Commit](https://github.com/open-webui/open-webui/commit/588b81eedaacbfd7394b707ae1600d9fb729b809..674695918e5e3e1811314ce2a082c5bbb42d76b2)
+- ⏱️ **Automation scheduling limits.** Administrators can now set "AUTOMATION_MAX_COUNT" and "AUTOMATION_MIN_INTERVAL" to limit how many automations each non-admin user can create and prevent overly frequent schedules that could overload the system. [Commit](https://github.com/open-webui/open-webui/commit/406251c2f358ffabce4d631c98c6f2c879feae5c)
+- 📋 **Task management tool.** AI models can now create, update, and track tasks within a chat conversation, breaking down complex requests into manageable steps with real-time status updates. [Commit](https://github.com/open-webui/open-webui/commit/bcb71bb5206ac01d97a39fde8ecf0e0541dde636)
+- 🗓️ **Calendar workspace and event management.** Open WebUI now has a full Calendar workspace. Create and manage events, set up recurring schedules, get reminders via in-app toasts or browser notifications, and see your scheduled automations alongside your calendar. [#23880](https://github.com/open-webui/open-webui/pull/23880)
+- 🔔 **Calendar reminders and alerts.** Calendar events now support reminder options from no alert up to one hour before start time, with upcoming alerts delivered through in-app toasts, browser notifications, and optional webhooks while avoiding duplicate sends. [Commit](https://github.com/open-webui/open-webui/commit/e5b5a174265d6710e986f6534ee7e3b2923233be)
+- ⚙️ **Scheduler reminder configuration.** Administrators can now configure calendar reminder processing with "SCHEDULER_POLL_INTERVAL" and "CALENDAR_ALERT_LOOKAHEAD_MINUTES", while existing "AUTOMATION_POLL_INTERVAL" setups continue to work as a legacy fallback. [Commit](https://github.com/open-webui/open-webui/commit/e5b5a174265d6710e986f6534ee7e3b2923233be)
+- ☁️ **Azure responses support.** Azure OpenAI connections now support the newer "/openai/v1" format, enabling chat, responses, and proxy calls to work correctly with that endpoint style. [#23484](https://github.com/open-webui/open-webui/pull/23484)
+- 🤖 **Ollama responses support.** The Ollama proxy now supports the Responses API, letting clients use "/v1/responses" directly with Ollama-hosted models through Open WebUI. [#23483](https://github.com/open-webui/open-webui/pull/23483)
+- 🧩 **Responses tool output rendering.** Built-in tool outputs in Responses API flows now render more consistently so downstream chat output is easier to interpret. [Commit](https://github.com/open-webui/open-webui/commit/e695d854f2d11fada84d5fbec8d3edea4e468e19), [#23482](https://github.com/open-webui/open-webui/pull/23482)
+- 🔎 **Responses citation visibility.** Responses API flows now emit citation sources more consistently, making linked references easier to preserve and display in chat output. [Commit](https://github.com/open-webui/open-webui/commit/e695d854f2d11fada84d5fbec8d3edea4e468e19), [#23774](https://github.com/open-webui/open-webui/issues/23774)
+- 📎 **Attach previously uploaded files.** The chat input menu now includes a Files tab for browsing and attaching previously uploaded files, eliminating the need to re-upload files you have already shared. [Commit](https://github.com/open-webui/open-webui/commit/edb8971c7dbd974322c3207c4655ff66479c3ee2)
+- 🧷 **Default model terminal selection.** Workspace model editors can now preselect an Open Terminal connection, so new chats automatically start with the model’s configured terminal ready to use. [Commit](https://github.com/open-webui/open-webui/commit/47d413ce7b2a006a8126f4a9055b13e5fcb33a1d), [#23605](https://github.com/open-webui/open-webui/issues/23605)
+- 🎙️ **Mistral TTS support.** Mistral can now be used as a text-to-speech provider, with admin settings for the API key, base URL, voices, and model selection. [Commit](https://github.com/open-webui/open-webui/commit/4cee67e2be0c80a0b501073ea49a80d13efd1c41)
+- 🎧 **STT preprocessing bypass option.** Administrators can now enable "AUDIO_STT_SKIP_PREPROCESSING" to send audio files directly to the speech-to-text backend, reducing memory and CPU consumption during large uploads for better transcription performance and stability on constrained deployments. [#23661](https://github.com/open-webui/open-webui/pull/23661)
+- 🗑️ **Admin model deletion.** Administrators can now delete Ollama models directly from the model selector menu, making it easier to clean up unused or unwanted models. [Commit](https://github.com/open-webui/open-webui/commit/2388dd7dc3530b5dd5419c5d0bb1bcdcb7544099)
+- 🔌 **Backend outlet filters for local and persisted chats.** Pipeline and function outlet filters now run reliably in backend completion flows for persisted chats and temporary local chats. [#3237](https://github.com/open-webui/open-webui/issues/3237), [Commit](https://github.com/open-webui/open-webui/commit/cf4218e688def6f11d195aeda6665ae5b5376b67)
+- 🎨 **Emoji shortcode support.** Typing a colon in the chat input now opens an emoji suggestion menu, making it easier to insert emojis using shortcodes like :wave:. [Commit](https://github.com/open-webui/open-webui/commit/2040095050056d01c61aa597c5010445449a42c7)
+- 📌 **Recently used emojis.** The emoji picker now shows your most recently used emojis at the top, making it faster to find emojis you use often. [Commit](https://github.com/open-webui/open-webui/commit/64da99a32218171d41b3af5acc14783de8dbdf49)
+- 👆 **Swipe to reply on mobile.** Swiping right on a message now triggers a reply, making it easier to respond on touch devices with a natural gesture. [Commit](https://github.com/open-webui/open-webui/commit/012ce95f27d57bea8911bd63bfb923443c5797ae)
+- 📱 **Screen-awake voice recording.** Voice recording now keeps the screen awake during active dictation and safely re-acquires wake lock after visibility changes, helping prevent long transcriptions from being cut off on mobile devices. [#23145](https://github.com/open-webui/open-webui/issues/23145)
+- 🔔 **Unread chat indicators.** Sidebar chats now show unread status and are marked as read when opened, making it easier to spot conversations with new activity. [Commit](https://github.com/open-webui/open-webui/commit/0638b9f56ce1ba8a496d0e84da2e7fa178b01a3f)
+- 🔌 **WebSocket reconnect status feedback.** Open WebUI now warns when the real-time connection drops and confirms when it reconnects, while avoiding a reconnect message on the initial page load. [Commit](https://github.com/open-webui/open-webui/commit/1824e69a70e756cfcf543a9fbe4b0780d9b57292)
+- 📍 **Pinned notes in sidebar.** Notes can now be pinned to the sidebar for quick access, and you can also create a new note directly from the pinned notes section. [Commit](https://github.com/open-webui/open-webui/commit/ecd74f220c7dd671d5705189a3f4493a3868c8bf), [Commit](https://github.com/open-webui/open-webui/commit/f1be85d997439b49fc143d2bcd2dc710f44446c8)
+- 🗂️ **Model selector focus.** The model selector now resets its search only when it opens, making the popup feel more predictable while still focusing the search field automatically. [Commit](https://github.com/open-webui/open-webui/commit/b89019a8e1f96e01dc8e19a81ef8fb4f4eae3eef)
+- 🗂️ **Model selector layout.** The model selector now behaves more predictably as a custom popup, and the completions playground uses a simpler model picker for easier selection. [Commit](https://github.com/open-webui/open-webui/commit/c40ea7f29d34fa9535cdf9ffe599f4429ff3f455)
+- 🎚️ **Active filter valve shortcut.** Active filter badges now expose valve configuration directly in the chat input area, so filter tuning is faster during conversations. [Commit](https://github.com/open-webui/open-webui/commit/3c22afc5a67404047797921185aca984b10b45cd), [#23811](https://github.com/open-webui/open-webui/issues/23811), [#23813](https://github.com/open-webui/open-webui/pull/23813)
+- 🎨 **Theme updates.** Other windows can now update the app theme directly, keeping the interface in sync when theme changes are triggered externally. [Commit](https://github.com/open-webui/open-webui/commit/9f1b279e88bd22dfff4d2531209536dea6a2f65e)
+- 🚀 **Async performance and responsiveness improvements.** The core backend database and request paths now run asynchronously across the application, massively improving responsiveness and performance under concurrent load and reducing request blocking during heavy activity. [Commit](https://github.com/open-webui/open-webui/commit/27169124f220e5cea21c88601c731c3749496ab0), [Commit](https://github.com/open-webui/open-webui/commit/8936721414a17832852a90f3ee592af5a8b7232d)
+- ⚡ **Drawer performance and memory optimization.** Drawer interactions now stay smoother over long sessions by removing stale keyboard listeners on teardown, which reduces memory growth and avoids accumulated event handling overhead. [#23724](https://github.com/open-webui/open-webui/pull/23724#issuecomment-4245840810)
+- 🚀 **Chat history memory culling.** Long conversations now stay responsive no matter how many messages they contain. Off-screen messages are unloaded automatically and reloaded as you scroll, keeping memory usage low and the UI smooth on both desktop and mobile. [#23067](https://github.com/open-webui/open-webui/issues/23067), [Commit](https://github.com/open-webui/open-webui/commit/026903399be73ac4b6c226647110e5662d043a50), [Commit](https://github.com/open-webui/open-webui/commit/9dccd29c94875e6f0ac373c5802cb183296e47ff)
+- 🧵 **Async file and knowledge processing performance.** File processing, knowledge reindexing, and channel message helper paths now consistently await async operations, preventing skipped processing steps and improving reliability and performance of indexing and tool responses. [Commit](https://github.com/open-webui/open-webui/commit/de27a121511a31606f250ba4033490797216a0eb)
+- 🚀 **Persistent chat payload efficiency.** Persisted chats now use server-side history loading instead of repeatedly resending full message payloads, improving multimodal performance and reducing stale-history overwrite risk across devices. [#19064](https://github.com/open-webui/open-webui/issues/19064), [Commit](https://github.com/open-webui/open-webui/commit/18fe17127a7175579506e7456d3e5aba201371e6), [Commit](https://github.com/open-webui/open-webui/commit/cf4218e688def6f11d195aeda6665ae5b5376b67)
+- 🧵 **Non-blocking file storage operations.** Uploading, reading, transcribing, and deleting files now offloads storage I/O to background threads, keeping the application responsive during file-heavy workflows. [Commit](https://github.com/open-webui/open-webui/commit/4866bec0f238198a721c952fe18dd04ba643be33)
+- 🏎️ **Streaming response performance.** Streaming responses now process each output line in a single step instead of two separate yields, reducing async overhead and improving responsiveness during long-running generations. [#23266](https://github.com/open-webui/open-webui/pull/23266)
+- 🔎 **Faster mention parsing.** Chat text with HTML-like content, file paths, or tool output now parses mentions more efficiently, which helps keep typing and rendering responsive in messages that contain many '<' characters. [#23551](https://github.com/open-webui/open-webui/pull/23551)
+- 🧪 **Code block rendering performance.** Code blocks now reuse a shared HTML unescape helper, reducing extra browser work when displaying encoded output in chat. [#23553](https://github.com/open-webui/open-webui/pull/23553)
+- 🚀 **Inline code rendering performance.** Inline code tokens in streaming responses now fade in with a lightweight CSS animation, making chat output feel smoother while reducing interface overhead during rapid token updates. [#23258](https://github.com/open-webui/open-webui/pull/23258)
+- 🎞️ **Streaming text token animation performance.** Streaming text tokens now use a lightweight CSS intro animation, making output feel smoother while reducing transition overhead and preventing tokens from fading out when generation completes. [#23257](https://github.com/open-webui/open-webui/pull/23257)
+- 🎯 **Template token scan optimization.** Streaming responses now skip unnecessary token-replacement processing when no template markers are present, reducing per-update overhead and keeping chat output smoother during rapid generation. [#23161](https://github.com/open-webui/open-webui/pull/23161)
+- 🔬 **Chinese text processing guard performance.** Streaming responses without Chinese characters now skip unnecessary Chinese-format processing checks, reducing per-update overhead and keeping output smoother during rapid generation. [#23162](https://github.com/open-webui/open-webui/pull/23162)
+- 🧠 **HTML entity decode performance.** Streaming text decoding now avoids repeated document parsing for HTML entity handling, reducing memory churn and improving responsiveness in token-heavy chat output. [#23165](https://github.com/open-webui/open-webui/pull/23165)
+- 🏷️ **Chat title update performance.** Chat title updates now run in a single database operation instead of multiple round trips, improving responsiveness and reducing overhead when titles are generated or renamed. [#23214](https://github.com/open-webui/open-webui/pull/23214)
+- 📂 **Faster chat list queries performance.** Chat and folder lists now load more efficiently by fetching only the fields needed for sidebar views, improving responsiveness when browsing large conversation histories. [Commit](https://github.com/open-webui/open-webui/commit/0e5696de74cc0ba55b24cfc3d02efa83f08d7d3f)
+- 📈 **Sidebar memory optimization.** Sidebar chat items now use shared drag-preview resources and safer listener cleanup, reducing memory growth and keeping large chat lists more responsive during long sessions. [#23209](https://github.com/open-webui/open-webui/pull/23209)
+- 🧠 **Image viewer memory optimization.** Viewing images and SVGs now uses significantly less memory and performs faster, keeping the application snappy and responsive even when browsing through many media files during extended sessions. [#23236](https://github.com/open-webui/open-webui/pull/23236)
+- 📡 **Optimized user activity tracking performance.** User activity updates now use a single database query instead of multiple operations, improving response times across all authenticated requests. [#23215](https://github.com/open-webui/open-webui/pull/23215)
+- 👥 **Faster channel thread author loading.** Channel thread responses now load author details in a single batch query, reducing database overhead and improving responsiveness in threads with many participants. [#23795](https://github.com/open-webui/open-webui/pull/23795)
+- 💨 **Optimized shared chat deletion.** Deleting shared chats by user is now faster and more memory-efficient by only loading necessary data. [#23216](https://github.com/open-webui/open-webui/pull/23216)
+- 🗃️ **Faster chat tag loading.** Chat tag lookups now load only the metadata needed instead of full chat payloads, improving responsiveness for chats with large histories. [#23798](https://github.com/open-webui/open-webui/pull/23798)
+- 📎 **Faster chat file deduplication.** Attaching files to chat messages now checks duplicates more efficiently, reducing overhead when handling larger file lists. [#23800](https://github.com/open-webui/open-webui/pull/23800)
+- 📈 **Faster message diff checks.** Chat message and status updates now compare content more efficiently during streaming, making active conversations feel smoother and more responsive. [#23370](https://github.com/open-webui/open-webui/pull/23370)
+- ⚖️ **Faster deep equality checks.** Chat message updates, model selection, note editing, code block refreshes, and rich text state comparisons now use deep equality checks that reduce unnecessary UI work and improve responsiveness in active sessions. [#23845](https://github.com/open-webui/open-webui/pull/23845)
+- 🏃 **Faster knowledge access updates.** Updating access grants for knowledge items now completes with less backend overhead, making permission changes apply more quickly. [#23799](https://github.com/open-webui/open-webui/pull/23799)
+- 🧹 **Mermaid render cleanup performance.** Mermaid diagrams now always clean up temporary render elements after failures, reducing DOM buildup and keeping repeated rendering more stable over time. [#23727](https://github.com/open-webui/open-webui/pull/23727)
+- 🖼️ **Model image lookup efficiency.** Model profile image requests now reuse the current request database session, reducing per-request overhead and improving response efficiency. [#23796](https://github.com/open-webui/open-webui/pull/23796)
+- 👤 **User endpoint query reduction.** Session-based user settings and status endpoints now avoid redundant user re-fetches, reducing unnecessary database load while preserving behavior. [#23794](https://github.com/open-webui/open-webui/pull/23794)
+- 🚦 **Faster startup performance.** Open WebUI now checks for Torch MPS support only on macOS, avoiding unnecessary startup work on other platforms. [#23438](https://github.com/open-webui/open-webui/pull/23438)
+- 🛡️ **Redis timeout consistency.** Redis connections now honor the "REDIS_SOCKET_CONNECT_TIMEOUT" setting across standard and cluster setups, helping workers fail faster when Redis is unreachable. [#23572](https://github.com/open-webui/open-webui/pull/23572)
+- 🧰 **AIOHTTP pool controls.** Administrators can now tune shared outbound HTTP connection behavior with "AIOHTTP_POOL_CONNECTIONS", "AIOHTTP_POOL_CONNECTIONS_PER_HOST", and "AIOHTTP_POOL_DNS_TTL" for better control under high concurrency. [Commit](https://github.com/open-webui/open-webui/commit/c47dd7b7717c4186e0f0549ca3c8cb4d9bb38135)
+- ⏱️ **MCP tool server timeout configuration.** Administrators can now configure request timeouts for MCP tool server connections via the AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER environment variable. [Commit](https://github.com/open-webui/open-webui/commit/10b4b86ada93cd62d994c3179ff14dfd1a6e56f0)
+- 🎫 **Static OAuth tool authentication.** Tool server authentication now works reliably for both "oauth_2.1" and "oauth_2.1_static" connection types, so OAuth-backed tool access is correctly detected and forwarded during chat requests. [Commit](https://github.com/open-webui/open-webui/commit/60676bfdcfbce1a69b3e97f2013f0cfd63371737)
+- 🗄️ **Configurable storage local cache.** Administrators can now disable persistent local caching for cloud-backed uploads with the "STORAGE_LOCAL_CACHE" setting, reducing local disk usage by cleaning temporary upload copies after processing. [Commit](https://github.com/open-webui/open-webui/commit/8172c7e3d56918d1372be06b9369b58a3a88f6b1)
+- 🚪 **Back-channel logout.** OpenID Connect providers can now trigger centralized logout through the "ENABLE_OAUTH_BACKCHANNEL_LOGOUT" setting, helping administrators invalidate user sessions more reliably across connected devices. [Commit](https://github.com/open-webui/open-webui/commit/0dd9f462ffb2f160bc4aebad182047f41874d250)
+- 🛡️ **Expanded security header controls.** Administrators can now configure additional browser security headers, including "CONTENT_SECURITY_POLICY_REPORT_ONLY", "CROSS_ORIGIN_EMBEDDER_POLICY", "CROSS_ORIGIN_OPENER_POLICY", and "CROSS_ORIGIN_RESOURCE_POLICY", for stricter and more flexible deployment hardening. [Commit](https://github.com/open-webui/open-webui/commit/f246a66810fa4995d9494da3599c0fb297fb0213)
+- 🖼️ **Image MIME fallback option.** Administrators can now enable "ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK" so image-to-base64 conversion can still detect common image types by file extension when MIME metadata is missing, improving compatibility on minimal container images and older file records. [Commit](https://github.com/open-webui/open-webui/commit/5127354b3eb4eaa71bc4ad68da69729e2196e7a4)
+- 🛡️ **Public sharing permissions.** Public channels, models, notes, prompts, and tools now respect allowed access grants more consistently, helping administrators control who can share content more safely. [Commit](https://github.com/open-webui/open-webui/commit/9d3e0637c86292b8b92e7607097a83f1075d7cd8)
+- 🆔 **Skill lookup by ID.** Skill instructions now include each skill’s ID, and the skill viewer now finds skills by ID in a case-insensitive way so attached skills are identified more reliably in chats. [Commit](https://github.com/open-webui/open-webui/commit/65ee771fd0d62d785ecbcf189e3f5b63858c11e6)
+- 🏷️ **Source context metadata.** Retrieval source context now includes each source’s resource type and resource ID metadata, helping downstream model workflows preserve richer source identity during processing. [Commit](https://github.com/open-webui/open-webui/commit/c3c8c605d76a3b0ee067307f9cef6d081658e287)
+- 🗂️ **Feedback filtering.** Administrators can now filter feedback history by model and export only the feedback they need. [Commit](https://github.com/open-webui/open-webui/commit/60e4d7517463690b3a87de38babc9ac561897c61)
+- 📤 **CSV feedback export.** Feedback history can now be exported as either JSON or CSV, making it easier to analyze feedback in spreadsheet tools. [Commit](https://github.com/open-webui/open-webui/commit/342582676a5212bf196a69d11825cb407992f257)
+- 📝 **Optional GET audit logging.** Administrators can now enable auditing for GET requests with the "ENABLE_AUDIT_GET_REQUESTS" setting when they need fuller request visibility. [Commit](https://github.com/open-webui/open-webui/commit/5ee791d5d28f236755243cb7d16d8737bb69ce36)
+- 🕒 **Model access updates.** Changing a model’s access grants now updates its timestamp, so recently modified models stay easier to find and sort correctly. [Commit](https://github.com/open-webui/open-webui/commit/53eadb7df7281f5661cbe22c8b26b5aedaba3083)
+- 💬 **Queued message handling.** Queued chat messages now send more reliably without advancing the queue too early, keeping follow-up prompts in the intended order. [Commit](https://github.com/open-webui/open-webui/commit/730e52a431d157dc62d72260668087437f1d52f4)
+- 🔒 **Rendered content safety.** Placeholder descriptions and the pending account notice now render markdown with safer sanitization ordering, reducing the risk of unsafe HTML appearing in these views. [Commit](https://github.com/open-webui/open-webui/commit/253f416de3f2d3a939a6feef2a56413fd61cc70b)
+- 🛡️ **Safer placeholder rendering.** Chat placeholder descriptions and the pending account notice now sanitize rendered markdown more consistently, reducing the risk of unsafe content being shown in these views. [Commit](https://github.com/open-webui/open-webui/commit/ae0316a30e01a2e5ff3f9d2f9f759c1cd6410f34)
+- 🧮 **Usage analytics accuracy.** Token usage is now normalized before chat messages are saved, so model and user usage reports stay accurate across OpenAI-compatible providers. [Commit](https://github.com/open-webui/open-webui/commit/4dea4fdf54e00ebaba8e3178128bf8709453d2a2)
+- 🧩 **Richer Anthropic tool results.** Anthropic-compatible tool calls now preserve more tool result content types, including images and structured search or document outputs, so models can use fuller tool context instead of receiving only plain text fragments. [#23188](https://github.com/open-webui/open-webui/issues/23188), [Commit](https://github.com/open-webui/open-webui/commit/40f5b3d135190dc9a2d8e94dbb1b2cbcbd829132)
+- 🖼️ **ComfyUI request reliability.** ComfyUI image generation and editing now use shared async connections with consistent SSL handling, making image uploads and workflow runs more reliable under concurrent load. [Commit](https://github.com/open-webui/open-webui/commit/5944eda0ff25a284f7157252683bccede741cbe7)
+- 🎛️ **Reranking batch size control.** Administrators can now set "RAG_RERANKING_BATCH_SIZE" in Documents settings to control reranking workload size, helping balance retrieval speed and resource usage for their deployment. [Commit](https://github.com/open-webui/open-webui/commit/4d2f18981051205016bd24d39521e25a33581225)
+- 🔗 **Shared chat access controls.** You can now control who has access to a shared chat by granting access to specific users or groups, instead of sharing with anyone who has the link.
+- 🔄 **General improvements.** Various improvements were implemented across the application to enhance performance, stability, and security.
+- 🌐 **Translation updates.** Translations for Irish, Catalan, German, Simplified Chinese, Hindi, and Portuguese (Brazil) were enhanced and expanded.
+
+### Fixed
+
+- 🛡️ **Model description XSS protection.** Model descriptions shown in chat placeholders are now sanitized before rendering, preventing malicious links from executing scripts and helping protect user sessions from takeover. [#23621](https://github.com/open-webui/open-webui/pull/23621)
+- 🧠 **Memory search filtering.** Memory search now correctly filters by the query text instead of returning unrelated results. [Commit](https://github.com/open-webui/open-webui/commit/43e5905c133049036353978704b0abd179716749), [#23826](https://github.com/open-webui/open-webui/issues/23826)
+- 📊 **Shared chat analytics consistency.** Usage and message-count analytics now count assistant activity consistently across regular and shared chats, improving accuracy in model, user, chat, and time-based reporting views. [Commit](https://github.com/open-webui/open-webui/commit/e29d145a1cff23122de16123a4cfda1b84abffbb)
+- 🧭 **Safer in-flight chat navigation.** Sending a message no longer overwrites your active chat or causes duplicate background notifications when you switch conversations before a response finishes. [Commit](https://github.com/open-webui/open-webui/commit/dc6df52a917b49fa1264ac81a8cc74603f6155b3)
+- 🗣️ **Pipeline error detail visibility.** Pipeline inlet and outlet failures now preserve and surface provider error details more reliably in chat error messages, making troubleshooting failed requests much clearer. [Commit](https://github.com/open-webui/open-webui/commit/d5e69f182cd7a6371ab25248f6432b277f83ef23)
+- 📨 **Shared chat event routing.** Message update and send events now target the chat owner’s event channel, so shared chats receive the correct real-time updates instead of routing events to the acting user. [Commit](https://github.com/open-webui/open-webui/commit/47329b5032ba29716a7e7e973b07c6d9894968e0)
+- 🔐 **Consistent outbound SSL handling.** External requests for tools, functions, terminals, webhooks, retrieval loaders, audio provider discovery, and OpenAI-compatible embedding calls now consistently apply the configured SSL client setting, improving reliability for deployments that require custom certificate or verification behavior. [Commit](https://github.com/open-webui/open-webui/commit/fd25152076ea7c310e42c9bacc5cd2b544eeae48), [Commit](https://github.com/open-webui/open-webui/commit/56c5bc1d3487020ab886d3332aacc1644c1d6123)
+- 🖼️ **Image SSL setting support.** Image generation now respects the configured SSL session setting, preventing avoidable connection failures in strict certificate environments. [Commit](https://github.com/open-webui/open-webui/commit/128cf41fcedf2638fc8a6acd850d8b0409be1c4e), [#23777](https://github.com/open-webui/open-webui/issues/23777)
+- 🗂️ **Folder ownership assignment hardening.** Folder create and update inputs now reject unexpected extra fields, preventing clients from overriding protected values like ownership through mass-assignment payloads. [#23648](https://github.com/open-webui/open-webui/pull/23648)
+- 🔐 **Knowledge file deletion ownership checks.** Collaborators with knowledge base write access can no longer permanently delete files they do not own, preventing unintended file removal across other linked chats and knowledge bases. [Commit](https://github.com/open-webui/open-webui/commit/914ccf07ef158afe5588b97ed42778c93c439938), [#23636](https://github.com/open-webui/open-webui/pull/23636#issuecomment-4232439454)
+- 🗑️ **Knowledge deletion reliability.** Deleting a knowledge base by ID now completes reliably without unexpected failures. [Commit](https://github.com/open-webui/open-webui/commit/7e453de4f7794ff386e285aa5951b94e926ec273), [#23776](https://github.com/open-webui/open-webui/issues/23776), [#23814](https://github.com/open-webui/open-webui/pull/23814)
+- 🔐 **OAuth 2.1 PKCE enforcement.** OAuth 2.1 providers now default to S256 PKCE even when discovery metadata omits supported challenge methods, preventing login failures with providers that require PKCE by default. [#23667](https://github.com/open-webui/open-webui/issues/23667), [Commit](https://github.com/open-webui/open-webui/commit/050c4b97a95addc5eaeef86ba00631673a90dec4)
+- 🔐 **Static OAuth scope handling.** Static OAuth credential flows now prioritize administrator-defined scopes and handle OAuth 2.1 static flow behavior more reliably. [Commit](https://github.com/open-webui/open-webui/commit/349ea4ea9e577f2cbfb4917ef5f52e5ac53c5b70), [#23668](https://github.com/open-webui/open-webui/issues/23668), [#23696](https://github.com/open-webui/open-webui/pull/23696), [#23783](https://github.com/open-webui/open-webui/pull/23783)
+- 🔐 **Static OAuth tool registration reliability.** Static OAuth tool server registration now resolves and uses saved admin credentials more reliably, preventing registration failures when valid client credentials are provided. [#23670](https://github.com/open-webui/open-webui/issues/23670), [Commit](https://github.com/open-webui/open-webui/commit/2943955c529138c0e530fd07b6333a0052e3684e), [Commit](https://github.com/open-webui/open-webui/commit/c767bcaa739f76b1a4337dfd9d6be47adb504825)
+- ⏳ **OAuth token expiry fallback.** OAuth sessions now always store a safe expiry value even when providers omit "expires_in" or "expires_at", so token refresh checks continue working and tool calls are less likely to fail later with unexpected authorization errors. [#23669](https://github.com/open-webui/open-webui/issues/23669), [Commit](https://github.com/open-webui/open-webui/commit/31406caa795173a59d5843d3601b891bf617cbaa)
+- 🔑 **Anthropic x-api-key model access.** Anthropic-compatible clients can now authenticate with the "x-api-key" header across all relevant API routes, so model listing requests like GET "/api/v1/models" no longer fail with unauthorized errors. [#23319](https://github.com/open-webui/open-webui/issues/23319), [Commit](https://github.com/open-webui/open-webui/commit/611fe0c8a938539b73b559e84964f40c30bf436d)
+- 🔑 **SSO password option visibility.** Account settings now hide password change controls when password-change access is disabled, avoiding misleading password options for SSO-focused setups. [#15292](https://github.com/open-webui/open-webui/issues/15292), [Commit](https://github.com/open-webui/open-webui/commit/cced77b584d6ea46c58fecddb2b3dd5e955c8417)
+- 🔑 **Open Terminal MCP authentication.** Open Terminal MCP tool calls now include the configured API key when calling internal routes, preventing unauthorized errors for commands like file reads and command execution. [#106](https://github.com/open-webui/open-terminal/pull/106)
+- 🧯 **Provider error freeze recovery.** Task-based chat requests now surface provider HTTP errors through normal failure handling, so content-filter and other upstream 4xx responses no longer leave chats stuck in a perpetual loading state. [#23663](https://github.com/open-webui/open-webui/issues/23663), [Commit](https://github.com/open-webui/open-webui/commit/96265cf042c8ab97dbec5d0efcce8010d0cd76e5)
+- 🔄 **Immediate outlet filter updates.** Assistant messages modified by outlet filters now appear correctly as soon as streaming completes, without requiring a page refresh. [#23829](https://github.com/open-webui/open-webui/pull/23829)
+- 🌊 **Middleware cancellation reliability.** Long-running requests now complete more reliably by preventing middleware-level cancellations from interrupting in-flight database and embedding work, reducing unexpected failures and noisy error logs when connections close early. [#23709](https://github.com/open-webui/open-webui/pull/23709)
+- 🚦 **Async vector search responsiveness.** File processing, memory updates, and knowledge retrieval no longer block the server event loop during vector database operations, so other chats and requests stay responsive while indexing or search is running. [#23706](https://github.com/open-webui/open-webui/pull/23706)
+- 🗒️ **Notes chat llama.cpp compatibility.** Notes AI chat no longer sends empty assistant prefill messages that can conflict with reasoning-enabled llama.cpp responses, preventing immediate 400 errors in Notes conversations. [Commit](https://github.com/open-webui/open-webui/commit/fd93bd3414a1725219e14561bc5640b62f9fd4a1), [#23703](https://github.com/open-webui/open-webui/issues/23703#issuecomment-4243907629)
+- 🧩 **Ollama thinking field preservation.** Messages modified by filters now keep the Ollama "thinking" field when sent to the model, so reasoning-aware workflows and custom filter-based passthrough setups work reliably. [Commit](https://github.com/open-webui/open-webui/commit/8bd23b91459914eb7df5b5a66567d3544e0da168), [#22508](https://github.com/open-webui/open-webui/issues/22508)
+- 🧾 **Reasoning content preservation.** Assistant tool-call messages now retain reasoning content across turns, improving reliability for reasoning-heavy model workflows. [Commit](https://github.com/open-webui/open-webui/commit/3dd8255816898467246c81cba3c9bc48bc18d86d), [#23175](https://github.com/open-webui/open-webui/issues/23175), [#23742](https://github.com/open-webui/open-webui/pull/23742)
+- 🧭 **Background task scoping for new chats.** Chat title and auto-tag generation now run only for the first message of a new conversation and only once in multi-model responses, preventing duplicate or incorrectly triggered background tasks in follow-up flows. [Commit](https://github.com/open-webui/open-webui/commit/f102060a6d85db4acd3d0bf5c25e976f36cd5533..a4ed16999eec9a654a37c2bb4c15ba5ecd1fa3b7)
+- 📚 **Channel document context retention.** Channel conversations now preserve and load the correct stored message history so model responses can use uploaded and retrieved document context more reliably. [#23686](https://github.com/open-webui/open-webui/issues/23686), [Commit](https://github.com/open-webui/open-webui/commit/cf4218e688def6f11d195aeda6665ae5b5376b67), [Commit](https://github.com/open-webui/open-webui/commit/18fe17127a7175579506e7456d3e5aba201371e6)
+- ⏳ **Interrupted response recovery.** Assistant placeholder messages now start as incomplete and recover more safely after interrupted generations, preventing silent empty replies after refreshes or dropped requests. [#23176](https://github.com/open-webui/open-webui/issues/23176), [Commit](https://github.com/open-webui/open-webui/commit/c8ef7b028931263e8773cb60a7111d80d9572d26), [Commit](https://github.com/open-webui/open-webui/commit/cf4218e688def6f11d195aeda6665ae5b5376b67)
+- 🧰 **Large tool result rendering.** Tool call details now display large result payloads reliably in chat instead of intermittently showing empty output for bigger tool responses. [#18743](https://github.com/open-webui/open-webui/issues/18743), [Commit](https://github.com/open-webui/open-webui/commit/45e49d33e51f7720c00b564215484aff9b48b20c)
+- 🧼 **Null-byte document sanitization.** PDF and other document ingests now sanitize null bytes and invalid surrogate characters before pgvector writes, preventing PostgreSQL upload failures and allowing affected files to index successfully. [#22992](https://github.com/open-webui/open-webui/issues/22992), [Commit](https://github.com/open-webui/open-webui/commit/8dba798cce9fb1efc5f6acc5f37b152662db78d7)
+- 📝 **Knowledge text editor stability.** The Knowledge "Add Text Content" modal now uses a plain text editor, avoiding current rich text editor issues and keeping drafting behavior consistent with existing knowledge editing flows. [Commit](https://github.com/open-webui/open-webui/commit/cd55c3e21237e000c13c6f396bb95b261f3bda82)
+- 🎤 **STT SSL setting consistency.** Speech and related outbound media requests now consistently use shared async HTTP sessions and honor the configured SSL verification setting, improving compatibility with self-signed deployments. [#23672](https://github.com/open-webui/open-webui/issues/23672), [Commit](https://github.com/open-webui/open-webui/commit/2ddcb30b9a519885422ba1f36cc3485a7d897bf8)
+- 🎙️ **Mistral speech input format.** Mistral speech-to-text requests now use the correct chat-completions audio input format for better compatibility. [Commit](https://github.com/open-webui/open-webui/commit/34d569d564a8ef2702c647dbad83eac840b76b2e), [#23822](https://github.com/open-webui/open-webui/issues/23822)
+- 🖼️ **Optional image size parameter.** Image generation no longer sends the "size" field when no size is configured, improving compatibility with providers that reject unsupported size arguments. [#23611](https://github.com/open-webui/open-webui/issues/23611), [Commit](https://github.com/open-webui/open-webui/commit/869cf9e848b741705dc058550fa1b3f70db47fe8)
+- 🔎 **FireCrawl timeout reliability.** FireCrawl web loading now uses direct scrape requests and improved timeout handling for single-URL fetches, reducing empty results and premature timeout failures with local FireCrawl setups. [#23411](https://github.com/open-webui/open-webui/issues/23411), [Commit](https://github.com/open-webui/open-webui/commit/9c64d84ad90804bf7d891e4a5097c03c4d7044c3)
+- 🖱️ **Custom action icon drag prevention.** Custom user-added action icons in chat responses are no longer accidentally draggable, so clicks and hover interactions behave consistently with built-in action icons. [#23412](https://github.com/open-webui/open-webui/pull/23412)
+- 🖼️ **Image URL conversion reliability.** Sending image URLs to AI models no longer fails with "cannot pickle 'coroutine' object" errors, so image inputs now convert to base64 reliably during request processing. [#23685](https://github.com/open-webui/open-webui/pull/23685#issuecomment-4240424635)
+- 📂 **Channel input menu dismissal.** In Workspace Channels, the message input dropdown now closes immediately after selecting "Upload Files" or "Capture", matching normal chat input behavior and preventing the menu from staying open unnecessarily. [#23684](https://github.com/open-webui/open-webui/pull/23684)
+- 📋 **Clipboard copy scroll stability.** Copying content with the fallback clipboard method no longer triggers unwanted page scrolling during focus, keeping your current reading position stable. [Commit](https://github.com/open-webui/open-webui/commit/fc98000aa8d439bbff21a70370f5e962bf23f4bc)
+- 🖼️ **Profile image URL validation.** Profile saves now accept valid Open WebUI profile-image paths, trusted external HTTP(S) avatar URLs, and safe raster data-image formats while rejecting unsafe URL patterns that could be abused. [#23389](https://github.com/open-webui/open-webui/pull/23389)
+- 👤 **Partial user profile updates.** User update API requests can now modify only the fields you provide, so administrators no longer need to resubmit unchanged name, email, and profile image values when changing a single setting like role. [#23424](https://github.com/open-webui/open-webui/issues/23424), [Commit](https://github.com/open-webui/open-webui/commit/3c2c611ba91d794a1e73134ec41b0de2b3927677)
+- 🚨 **Provider SSE error visibility.** Provider failures returned with streaming content types are now surfaced as proper API errors and logged clearly, so issues like context-window limits no longer fail silently during chat generation. [#23379](https://github.com/open-webui/open-webui/pull/23379)
+- 🧵 **Queued prompt race prevention.** Chat request queues now prevent overlapping processing for the same chat, avoiding duplicate queue handling when multiple queue-processing triggers fire close together. [#23181](https://github.com/open-webui/open-webui/issues/23181), [Commit](https://github.com/open-webui/open-webui/commit/e10a00132eed54a0108fb6ac120e8229deef3656)
+- 🛑 **Cancellation event delivery reliability.** Cancelled chat processing now safely emits task-cancel and error events only when an event emitter is available, while provider HTTP errors now also route through task-cancel handling so chats recover from blocked-loading states more reliably. [#23663](https://github.com/open-webui/open-webui/issues/23663), [Commit](https://github.com/open-webui/open-webui/commit/51765b619c8584b042af68c3a5c87525a105ccd8), [Commit](https://github.com/open-webui/open-webui/commit/96265cf042c8ab97dbec5d0efcce8010d0cd76e5)
+- 🔑 **OIDC key-rotation recovery.** OIDC login now retries token authorization with refreshed provider signing keys after a bad-signature failure, so logins recover automatically after identity-provider key rotation without requiring a service restart. [#23582](https://github.com/open-webui/open-webui/issues/23582), [Commit](https://github.com/open-webui/open-webui/commit/facb194a07486e847f0725a0a839e99b5864d37b)
+- 🌍 **Non-ASCII tag filtering.** Prompt and model tag filters now handle non-Latin tags more reliably across SQLite and PostgreSQL, so tags like Cyrillic values return the expected items in Workspace lists. [#23381](https://github.com/open-webui/open-webui/issues/23381), [#23427](https://github.com/open-webui/open-webui/pull/23427), [Commit](https://github.com/open-webui/open-webui/commit/57784706e4fee75dec67e20b0d89a97351ac6256)
+- 🏷️ **Prompt tag query accuracy.** Prompt tag filtering now uses JSON-element-aware queries so tag-based lookups return the correct prompts. [Commit](https://github.com/open-webui/open-webui/commit/e7e752f8e74e7b01fe2e6cb56f06e99312e1afe7), [#23386](https://github.com/open-webui/open-webui/pull/23386)
+- 🗃️ **SQLite async pool compatibility.** SQLite async database setup no longer forces an explicit queue pool class, avoiding pool configuration conflicts in SQLite deployments. [Commit](https://github.com/open-webui/open-webui/commit/26b8ca5b5eeb144fae3fe6eaeae826150d8af826)
+- 🧠 **Knowledge embedding deadlock prevention.** Knowledge file processing now runs blocking vector-save work in a worker thread while keeping async status updates reliable, preventing file processing from stalling during long embedding operations. [Commit](https://github.com/open-webui/open-webui/commit/d4b90f93bda2413ec8f040e61959acdb7b242061), [Commit](https://github.com/open-webui/open-webui/commit/22cfb3c673cbfa4a6bce26fde8e2e2754ce4963b)
+- 🤖 **Automation worker async DB handling.** Automation claiming and run recording now use async database sessions consistently, improving worker stability for scheduled automations. [Commit](https://github.com/open-webui/open-webui/commit/cb6e77be3ec6ce00dd1f5b9ce3a655e6f65bc5da)
+- 🕒 **Automation timezone scheduling.** Scheduled automations now calculate each user’s next run time using that user’s saved timezone, preventing run drift caused by server-time fallback. [Commit](https://github.com/open-webui/open-webui/commit/a4d62253df55c6307112eb76a6bfa29a7f538e21)
+- 🔎 **Notes search matching.** Notes search now handles multi-word and hyphenated queries more reliably, so relevant notes and snippets are easier to find from partial phrase searches. [Commit](https://github.com/open-webui/open-webui/commit/a35926261646f8897ba71da1572ed5dff802e3be)
+- 📐 **Display math rendering.** Chat markdown now correctly recognizes and renders "$$...$$" expressions as display math, improving reliability for multiline and escaped KaTeX content while keeping malformed delimiters from disrupting message rendering. [#23526](https://github.com/open-webui/open-webui/issues/23526), [Commit](https://github.com/open-webui/open-webui/commit/15b89b9218b7d2c7239c579aa3d23c2892227ac6)
+- 🚫 **LDAP empty-password rejection.** LDAP login now rejects empty or whitespace-only passwords before bind attempts, preventing unauthenticated simple-bind behavior from granting access on permissive LDAP server configurations. [#23633](https://github.com/open-webui/open-webui/pull/23633)
+- 🌐 **IPv6 SSRF address blocking.** URL validation now uses standard IP address checks for both IPv4 and IPv6, preventing private, loopback, link-local, reserved, and mapped-address SSRF bypasses through IPv6 hostname resolution. [#23453](https://github.com/open-webui/open-webui/pull/23453)
+- 🔒 **API key endpoint restriction bypass.** API key endpoint restrictions are now enforced regardless of whether the key is sent through Authorization headers, cookies, or "x-api-key", preventing bypass through alternate key transport paths. [#23637](https://github.com/open-webui/open-webui/pull/23637)
+- 🔐 **Channel sharing permission enforcement.** Channel creation and updates now enforce allowed access grant rules for public sharing, preventing unauthorized wildcard sharing on group channels. [#23638](https://github.com/open-webui/open-webui/pull/23638)
+- 🛑 **Socket role invalidation.** Socket sessions now disconnect automatically when a user is demoted or deleted, preventing stale admin privileges from persisting until reconnect. [#23642](https://github.com/open-webui/open-webui/pull/23642)
+- 🛂 **Tool server access checks.** Tool listing now correctly awaits server access checks, preventing users from seeing server-backed tools they do not have permission to use. [Commit](https://github.com/open-webui/open-webui/commit/d40f31982be3eed37e55e3f67b1eea9a5dc8c525)
+- 🛑 **Task endpoint access control.** Global task listing and direct task stop endpoints are now restricted to administrators, while regular users can stop only their own chat tasks through a scoped chat endpoint. [#23454](https://github.com/open-webui/open-webui/pull/23454)
+- 🧱 **Redis cache key isolation.** Tool server and terminal server cache entries now include the Redis key prefix, preventing multiple Open WebUI instances that share one Redis database from overwriting each other’s cached connection data. [#23649](https://github.com/open-webui/open-webui/pull/23649)
+- 🧠 **Client session leak prevention.** Outbound provider requests now use a shared session pool with safer response cleanup and shutdown handling, preventing aiohttp session buildup and reducing memory growth during heavy concurrent API traffic. [#23540](https://github.com/open-webui/open-webui/issues/23540), [Commit](https://github.com/open-webui/open-webui/commit/c47dd7b7717c4186e0f0549ca3c8cb4d9bb38135)
+- 🧩 **Tool enum value handling.** Tool schema generation now safely handles enum values as strings, preventing failures when OpenAPI parameters include non-string enum entries. [#23597](https://github.com/open-webui/open-webui/issues/23597), [Commit](https://github.com/open-webui/open-webui/commit/4498e6faf2b1bdd1caa0e2c1c15d90a2790cd721)
+- 🧷 **Responses model access control.** The OpenAI-compatible Responses endpoint now enforces per-model permissions, preventing non-admin users from accessing models they are not allowed to use. [#23481](https://github.com/open-webui/open-webui/pull/23481)
+- 🛡️ **Collection process endpoint permissions.** Collection processing endpoints now enforce collection ownership checks for web and text processing requests. [Commit](https://github.com/open-webui/open-webui/commit/ba83613ff297bc82db660b5273f04672d744902f), [#23634](https://github.com/open-webui/open-webui/pull/23634)
+- 📚 **Knowledge query access enforcement.** Knowledge-base collection queries now block unauthorized enumeration and require read access before returning results. [Commit](https://github.com/open-webui/open-webui/commit/860b90fd17d14ba00674621edd294dee150491d2), [#23635](https://github.com/open-webui/open-webui/pull/23635), [#23452](https://github.com/open-webui/open-webui/pull/23452)
+- 🔍 **RAG collection query permissions.** Vector search collection queries now enforce access checks before retrieval results are returned. [Commit](https://github.com/open-webui/open-webui/commit/f44b7a01f5b854f47c1594a1ab5f72096f736262), [#23627](https://github.com/open-webui/open-webui/pull/23627)
+- 🔗 **Chained base model access checks.** Chained base model execution now enforces per-model access rules to prevent unauthorized model usage. [Commit](https://github.com/open-webui/open-webui/commit/8acce144f99992b75c25f0e5038b16881ce9f066), [Commit](https://github.com/open-webui/open-webui/commit/50363ba66b19613a2fc0cab6a3f7f724a825135e), [#23647](https://github.com/open-webui/open-webui/pull/23647)
+- ✍️ **Collaborative document write checks.** Collaborative document updates now require proper write permission before changes are accepted. [Commit](https://github.com/open-webui/open-webui/commit/638c7ab80216452910bdc59a19eb90e6b7244c6c), [Commit](https://github.com/open-webui/open-webui/commit/3271b013a8b30a882364679dcb40ffc9a89f037e), [#23624](https://github.com/open-webui/open-webui/pull/23624)
+- 📥 **Model import ownership validation.** Model import now enforces ownership and access grant checks to prevent unauthorized imports. [Commit](https://github.com/open-webui/open-webui/commit/499129625bf96b2c03a6d057a2f91fdf07fd1c49), [#23628](https://github.com/open-webui/open-webui/pull/23628)
+- 🚫 **Inactive member channel access.** Deactivated group members can no longer read or write channel content through direct API calls, so channel permissions now match active membership status. [#23623](https://github.com/open-webui/open-webui/pull/23623)
+- 🎛️ **Ollama endpoint model permissions.** Restricted models are now protected on Ollama show, generate, embed, and embeddings endpoints, preventing authenticated users from using private models without read access. [#23631](https://github.com/open-webui/open-webui/pull/23631)
+- 🧭 **Azure deployment path validation.** Azure model names are now validated and safely encoded before request URL construction, preventing path traversal attempts from reaching unintended Azure endpoints. [#23629](https://github.com/open-webui/open-webui/pull/23629)
+- 👥 **Private channel member list access.** Standard channel member lists now require proper read permission, preventing unauthorized users from enumerating members of private channels by direct API calls. [#23625](https://github.com/open-webui/open-webui/pull/23625)
+- 🌀 **Tool server schema recursion safety.** Tool server OpenAPI conversion now handles circular request schema references safely, preventing conversion crashes and ensuring one bad tool server spec does not break the full tool server list. [#23588](https://github.com/open-webui/open-webui/pull/23588), [Commit](https://github.com/open-webui/open-webui/commit/d3df8f1f372411314be9121fbf61d107939fa258)
+- 🧱 **Safer file path handling.** File upload, transcription cache, and model download paths now use safer path construction helpers to reduce path parsing risks and improve cross-platform path safety. [Commit](https://github.com/open-webui/open-webui/commit/15f9a8f3f13f112c96cb1b16f88859f65de58346)
+- 🧾 **Prompt save error feedback.** Saving prompt edits now shows a clear error toast if the save fails, so failed updates are visible instead of silently failing in the editor flow. [Commit](https://github.com/open-webui/open-webui/commit/36a81ad43b7c0d450079f818a7546eaa517e3d95)
+- 🧾 **Tool call JSON rendering.** Tool call arguments and structured results now render as plain formatted JSON blocks instead of markdown code fences, preventing formatting quirks and making tool output easier to read consistently. [Commit](https://github.com/open-webui/open-webui/commit/a7d4c53f3adb80768b67e4a410b486b04a581521)
+- 👥 **First-user admin race protection.** Concurrent first-time LDAP or OAuth registrations can no longer create multiple admin accounts, so only the true first account is promoted during initial setup. [#23626](https://github.com/open-webui/open-webui/pull/23626)
+- 🔒 **SCIM token checks.** SCIM authentication now compares tokens in a safer way, helping prevent timing-based token guessing attacks. [#23577](https://github.com/open-webui/open-webui/pull/23577)
+- 🔒 **Safer file access checks.** HTML file previews now treat missing or non-admin owners as inaccessible, preventing accidental access to files that should not be shown. [Commit](https://github.com/open-webui/open-webui/commit/6acaaea59a50ec26da03e6144017a2fd86241ce9)
+- 🖼️ **ComfyUI request hangs.** Concurrent image generation and editing requests to ComfyUI now complete reliably instead of getting stuck when the same user starts multiple requests at once. [#23592](https://github.com/open-webui/open-webui/pull/23592), [#23591](https://github.com/open-webui/open-webui/issues/23591)
+- 🧭 **Permission-aware built-in tools.** Built-in tools now consistently respect user feature permissions for memories, web search, image generation, code interpreter, notes, channels, and automations, preventing tools from being exposed to users without access. [Commit](https://github.com/open-webui/open-webui/commit/588b81eedaacbfd7394b707ae1600d9fb729b809..674695918e5e3e1811314ce2a082c5bbb42d76b2)
+- 🛑 **Interrupted MCP cleanup stability.** Interrupted MCP tool calls no longer leave runaway cleanup behavior that can drive container CPU usage to 100%, keeping instances stable after cancellations or dropped connections. [#23143](https://github.com/open-webui/open-webui/issues/23143)
+- 🚪 **OAuth redirect URI reliability.** OAuth login redirects now use provider client metadata more consistently, preventing incorrect HTTP callback URLs behind reverse proxies and improving sign-in reliability for providers such as Feishu. [#23203](https://github.com/open-webui/open-webui/pull/23203), [#23128](https://github.com/open-webui/open-webui/issues/23128)
+- 🌐 **OAuth redirect handling.** OAuth provider token exchange now follows redirects automatically, improving sign-in reliability with identity providers that redirect token endpoint requests. [#23409](https://github.com/open-webui/open-webui/issues/23409), [Commit](https://github.com/open-webui/open-webui/commit/498ff8cdc3dd47000cdc60e5adcf36f4adfbe07d)
+- ☁️ **OneDrive picker redirect handling.** OneDrive file picker authentication now uses the current app origin as the redirect URI, improving sign-in reliability when launching the picker from deployed environments. [#23450](https://github.com/open-webui/open-webui/issues/23450), [Commit](https://github.com/open-webui/open-webui/commit/21cc8281323d505d7d084cc496bd433063315c86)
+- 🍪 **OAuth session cookie persistence.** OIDC sign-in now correctly sets the "oauth_session_id" cookie, so "system_oauth" connections can forward user OAuth tokens to upstream providers as expected. [#23251](https://github.com/open-webui/open-webui/pull/23251), [#23250](https://github.com/open-webui/open-webui/issues/23250)
+- 🔑 **OAuth session cookie handling.** OAuth callback processing no longer fails on undefined cookie expiry data, so OAuth session cookies are stored correctly after sign-in. [#23207](https://github.com/open-webui/open-webui/pull/23207), [#23197](https://github.com/open-webui/open-webui/issues/23197)
+- 🔏 **Ollama SSL handling.** Ollama model management and file uploads now respect the configured SSL verification setting, so self-signed certificates work when SSL verification is disabled. [#23503](https://github.com/open-webui/open-webui/issues/23503), [Commit](https://github.com/open-webui/open-webui/commit/e51b661af0e71a24f041428f328fcc6e97a15262)
+- 🛡️ **OAuth avatar URL validation.** OAuth sign-in now validates profile picture URLs before fetching them, preventing invalid image links from causing login-time errors. [#23356](https://github.com/open-webui/open-webui/pull/23356)
+- 🔑 **User invite token expiry.** New user invite logins now respect the configured "JWT_EXPIRES_IN" setting, so signup tokens expire as expected instead of using the default lifetime. [#23576](https://github.com/open-webui/open-webui/pull/23576)
+- 🚪 **Channel access checks.** Channel actions now verify the current user when checking access, improving permission enforcement across channel views and message actions. [Commit](https://github.com/open-webui/open-webui/commit/4632f200a9ac98c915aee412b34e86c3d3c58bb1)
+- 📣 **Channel message lookups.** Channel message details and pinning now work more reliably when the sender account is missing, avoiding failures in those views. [Commit](https://github.com/open-webui/open-webui/commit/6acaaea59a50ec26da03e6144017a2fd86241ce9)
+- 📌 **Pinned webhook message handling.** Viewing pinned webhook messages now works reliably even when webhook profile data is missing, preventing server errors and frontend crashes in channel pinned message dialogs. [#23414](https://github.com/open-webui/open-webui/pull/23414)
+- 🛡️ **Note edit permission enforcement.** Note saving now requires write access instead of read access, preventing unauthorized users from modifying notes while preserving expected collaboration permissions. [Commit](https://github.com/open-webui/open-webui/commit/584a9a0920d8c8c72fc89ccbac83c970b5a4bd4a)
+- 🗂️ **Archived chats menu visibility.** The 'Archived Chats' option in the user menu is now shown reliably for all users, so non-admin accounts can consistently access archived conversations. [Commit](https://github.com/open-webui/open-webui/commit/07262fa62c2323fc7948389e5b5b8a5d1b72fade)
+- 💾 **Error message persistence.** LLM errors that occur during streaming are now saved to the database even if the connection drops, so users can see what went wrong when they reconnect. [#23231](https://github.com/open-webui/open-webui/pull/23231)
+- 🚫 **Missing message completion guard.** Chat completion finalization now skips invalid requests without a message identifier, preventing unnecessary error toasts caused by rare frontend concurrency timing. [#23184](https://github.com/open-webui/open-webui/pull/23184)
+- 🧠 **Active message completion accuracy.** Switching chats or refreshing during generation no longer marks the currently streaming assistant message as finished too early, so thinking blocks and action buttons appear at the correct time. [#23171](https://github.com/open-webui/open-webui/issues/23171)
+- 📞 **Call overlay visibility.** Incoming call events now open the call overlay and controls reliably, preventing cases where the call interface briefly appeared and then disappeared. [Commit](https://github.com/open-webui/open-webui/commit/ee9db91df02120e1e3651e8881734966b710ad52)
+- 💬 **Prompt submission handling.** Chat messages now preserve attached files more reliably when prompts are sent, including queued messages and shared prompt actions. [Commit](https://github.com/open-webui/open-webui/commit/6d6dfbf02c893d72d85d4490cb41f1665b1f9f95)
+- 🧾 **Prompt variable form saving.** Prompt variable forms now save reliably without runtime errors or an unresponsive save action, so input values and placeholders work correctly when applying prompt templates with variables. [#23225](https://github.com/open-webui/open-webui/issues/23225), [#23480](https://github.com/open-webui/open-webui/issues/23480)
+- 🛟 **Task model fallback safety.** Task routing now handles missing default model entries safely, preventing task execution failures when the previously selected model is no longer available. [#23169](https://github.com/open-webui/open-webui/pull/23169)
+- 📊 **Usage statistic preservation.** Follow-up generation no longer overwrites existing token usage fields, so stored usage statistics remain accurate for the main response. [#23152](https://github.com/open-webui/open-webui/issues/23152)
+- 📝 **Writing block parsing reliability.** ":::writing" blocks now parse more reliably when headers or extra inline text are present, preventing malformed rendering and duplicate output artifacts. [#23174](https://github.com/open-webui/open-webui/issues/23174)
+- 🧾 **Code block line break reliability.** Blank lines in submitted code blocks are now preserved more reliably instead of being collapsed. [Commit](https://github.com/open-webui/open-webui/commit/1be9627dd27ffe75957729a4a0d1682a98684f01), [#20302](https://github.com/open-webui/open-webui/issues/20302), [#23451](https://github.com/open-webui/open-webui/pull/23451)
+- ✂️ **Citation spacing cleanup.** When citations are disabled for a model, citation markers and their leftover spacing are now removed together so punctuation and copied text remain cleanly formatted. [#23141](https://github.com/open-webui/open-webui/issues/23141)
+- 🧰 **Pipe tool access.** Pipe functions now receive built-in and MCP tools in **tools**, so tools like Web Search and code execution are available when enabled. [#23365](https://github.com/open-webui/open-webui/issues/23365)
+- 📚 **Batch file processing database handling.** Batch knowledge file processing now consistently uses the active database session, preventing failures caused by missing database context during file ownership checks and update writes. [#23137](https://github.com/open-webui/open-webui/issues/23137)
+- ⚙️ **Default model parameter loading.** The "DEFAULT_MODEL_PARAMS" environment variable is now parsed and applied correctly, so default generation settings are honored reliably without being ignored at startup. [#23223](https://github.com/open-webui/open-webui/pull/23223)
+- 🔧 **Web search settings save reliability.** Saving web search configuration now works without server errors, so administrators can update "WEB_FETCH_MAX_CONTENT_LENGTH" and related retrieval settings successfully from the admin interface. [Commit](https://github.com/open-webui/open-webui/commit/36d02aa1477aa1b4e7fb59d022f99693ebfa8667), [#23127](https://github.com/open-webui/open-webui/issues/23127)
+- 🔍 **Web search result count.** The built-in search_web tool now respects the admin-configured "Search Result Count" setting instead of always returning 5 results when using Native Function Calling mode. [#23488](https://github.com/open-webui/open-webui/pull/23488), [#23485](https://github.com/open-webui/open-webui/issues/23485)
+- 🖼️ **Open Terminal file response handling.** Open Terminal tool responses now preserve binary content types in user-side connections, so image and non-text file reads work consistently instead of being forced into plain text. [#23125](https://github.com/open-webui/open-webui/issues/23125)
+- 🖥️ **Terminal label casing.** Terminal names in the chat input now display exactly as stored instead of being automatically capitalized, so domain-style server names appear correctly. [#23518](https://github.com/open-webui/open-webui/pull/23518)
+- 🖼️ **Gravatar profile photo saving.** Gravatar profile images can now be saved successfully from account settings, with clearer validation and error handling instead of failing with generic object errors. [#23156](https://github.com/open-webui/open-webui/issues/23156)
+- 🪟 **Details expansion preference.** Tool call detail groups now honor the 'Always Expand Details' chat setting, so they open expanded by default when that preference is enabled. [#23262](https://github.com/open-webui/open-webui/pull/23262), [#23255](https://github.com/open-webui/open-webui/issues/23255)
+- 🖱️ **Rapid sidebar action protection.** Archive and delete actions in the chat sidebar now ignore repeated clicks while a request is in progress, preventing duplicate requests and stacked error toasts. [#23172](https://github.com/open-webui/open-webui/issues/23172)
+- 📲 **Mobile model selector positioning.** The mobile model selector dropdown now applies a constrained viewport width and left offset, preventing overflow and making model selection easier on small screens. [#23310](https://github.com/open-webui/open-webui/pull/23310)
+- 🔽 **Task list toggle icons.** The task list collapse button now shows the correct arrow direction, making task sections easier to expand and collapse at a glance. [Commit](https://github.com/open-webui/open-webui/commit/f66b67c8b86b6f9d896a23c7bb53907c2e6b15d3), [#23354](https://github.com/open-webui/open-webui/issues/23354)
+- ➕ **Attachment menu auto-close.** The chat attachment menu now closes immediately after selecting upload actions like file upload, camera capture, web attach, Google Drive, or OneDrive, preventing the menu from lingering on screen. [Commit](https://github.com/open-webui/open-webui/commit/4764dd5d3765c22384ed38cbc97a8170daa7a75f), [#23320](https://github.com/open-webui/open-webui/issues/23320)
+- 🧹 **Per-chat draft clearing.** Sent message drafts are now cleared using the active chat key, so sent text no longer reappears in the input after a refresh. [Commit](https://github.com/open-webui/open-webui/commit/124b7e9154d7f3ca8a16f2b90621209ac8d6b8c1), [#23296](https://github.com/open-webui/open-webui/issues/23296)
+- ✉️ **Context-aware input action button.** The input now shows the send action when text or files are present during generation, while keeping stop controls for truly empty input states to avoid action confusion. [Commit](https://github.com/open-webui/open-webui/commit/86472bb4453af7ea4e5ddc8d127b14d8e67733bc), [#23306](https://github.com/open-webui/open-webui/issues/23306)
+- 📉 **Pyodide prompt cache stability.** Pyodide code interpreter context is now appended to the system prompt instead of user messages, preserving stable prefix caching across turns and reducing repeated token costs in long native tool-calling chats. [#23269](https://github.com/open-webui/open-webui/issues/23269)
+- 🧪 **Temp chat outlet filtering.** Outlet filters now process temporary chats more reliably, preserving assistant output and usage data so local chat responses stay consistent when filter pipelines are enabled. [Commit](https://github.com/open-webui/open-webui/commit/70a6a24f143b221c787bc50b72582ee1e0c2dac0)
+
+### Changed
+
+- ⚠️ **Database Migrations**: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
+- 🧨 **Plugin async migration required.** Custom plugins for Tools, Functions, and Pipelines may require migration to the new async backend signatures after upgrading, so plugin maintainers should update handlers and database call patterns for compatibility and follow the 0.9.0 plugin migration guide. [Migration Guide](https://docs.openwebui.com/features/extensibility/plugin/migration/to-0.9.0)
+- 🔄 **Automation terminal source.** Automations now use the terminal configured on the selected model instead of a separate per-automation terminal picker, keeping terminal behavior consistent between chat and scheduled runs. [Commit](https://github.com/open-webui/open-webui/commit/47d413ce7b2a006a8126f4a9055b13e5fcb33a1d)
+- 🚧 **OpenAI passthrough now opt-in.** Direct OpenAI catch-all proxy requests are now disabled by default and require enabling "ENABLE_OPENAI_API_PASSTHROUGH", so deployments relying on passthrough must explicitly turn it on after upgrading. [#23640](https://github.com/open-webui/open-webui/pull/23640)
+- 🗄️ **SQLite WAL default enabled.** SQLite deployments now default to enabling write-ahead logging, improving concurrent read and write behavior without requiring manual configuration. [Commit](https://github.com/open-webui/open-webui/commit/2f9e326dba3b1087932cb6b8075ed1881bd1c6d6)
+
 ## [0.8.12] - 2026-03-26
 
 ### Added

LICENSE

@@ -1,3 +1,5 @@
+Open WebUI License
+
 Copyright (c) 2023- Open WebUI Inc. [Created by Timothy Jaeryang Baek]
 All rights reserved.
 
@@ -15,11 +17,27 @@ modification, are permitted provided that the following conditions are met:
    contributors may be used to endorse or promote products derived from
    this software without specific prior written permission.
 
-4. Notwithstanding any other provision of this License, and as a material condition of the rights granted herein, licensees are strictly prohibited from altering, removing, obscuring, or replacing any "Open WebUI" branding, including but not limited to the name, logo, or any visual, textual, or symbolic identifiers that distinguish the software and its interfaces, in any deployment or distribution, regardless of the number of users, except as explicitly set forth in Clauses 5 and 6 below.
+4. Notwithstanding any other provision of this License, and as a material
+   condition of the rights granted herein, licensees are strictly prohibited
+   from altering, removing, obscuring, or replacing any "Open WebUI"
+   branding, including but not limited to the name, logo, or any visual,
+   textual, or symbolic identifiers that distinguish the software and its
+   interfaces, in any deployment or distribution, except in the following
+   circumstances: (i) deployments or distributions where the total number
+   of end users (defined as individual natural persons with direct access
+   to the application) does not exceed fifty (50) within any rolling
+   thirty (30) day period; (ii) the licensee has obtained specific prior
+   written permission from the copyright holder; or (iii) where the
+   licensee has obtained a duly executed enterprise license expressly
+   permitting such modification. For all other cases, any removal or
+   alteration of the "Open WebUI" branding shall constitute a material
+   breach of license.
 
-5. The branding restriction enumerated in Clause 4 shall not apply in the following limited circumstances: (i) deployments or distributions where the total number of end users (defined as individual natural persons with direct access to the application) does not exceed fifty (50) within any rolling thirty (30) day period; (ii) cases in which the licensee is an official contributor to the codebase—with a substantive code change successfully merged into the main branch of the official codebase maintained by the copyright holder—who has obtained specific prior written permission for branding adjustment from the copyright holder; or (iii) where the licensee has obtained a duly executed enterprise license expressly permitting such modification. For all other cases, any removal or alteration of the "Open WebUI" branding shall constitute a material breach of license.
+Materials governed by prior licenses retain those original license
+terms, as specified in LICENSE_HISTORY.
 
-6. All code, modifications, or derivative works incorporated into this project prior to the incorporation of this branding clause remain licensed under the BSD 3-Clause License, and prior contributors retain all BSD-3 rights therein; if any such contributor requests the removal of their BSD-3-licensed code, the copyright holder will do so, and any replacement code will be licensed under the project's primary license then in effect. By contributing after this clause's adoption, you agree to the project's Contributor License Agreement (CLA) and to these updated terms for all new contributions.
+By contributing to this project, you agree to the project's Contributor
+License Agreement (CONTRIBUTOR_LICENSE_AGREEMENT).
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

README.md

@@ -172,8 +172,6 @@ After installation, you can access Open WebUI at [http://localhost:3000](http://
 
 We offer various installation alternatives, including non-Docker native installation methods, Docker Compose, Kustomize, and Helm. Visit our [Open WebUI Documentation](https://docs.openwebui.com/getting-started/) or join our [Discord community](https://discord.gg/5rJgQTnV4s) for comprehensive guidance.
 
-Look at the [Local Development Guide](https://docs.openwebui.com/getting-started/development) for instructions on setting up a local development environment.
-
 ### Troubleshooting
 
 Encountering connection issues? Our [Open WebUI Documentation](https://docs.openwebui.com/troubleshooting/) has got you covered. For further assistance and to join our vibrant community, visit the [Open WebUI Discord](https://discord.gg/5rJgQTnV4s).

backend/open_webui/config.py

@@ -1,3 +1,4 @@
+import asyncio
 import json
 import logging
 import os
@@ -35,7 +36,7 @@ from open_webui.env import (
     WEBUI_NAME,
     log,
 )
-from open_webui.internal.db import Base, get_db
+from open_webui.internal.db import Base, get_db, get_async_db
 from open_webui.utils.redis import get_redis_connection
 
 
@@ -90,6 +91,7 @@ def load_json_config():
 
 
 def save_to_db(data):
+    """Sync save — used ONLY at startup/import time."""
     with get_db() as db:
         existing_config = db.query(Config).first()
         if not existing_config:
@@ -102,12 +104,39 @@ def save_to_db(data):
         db.commit()
 
 
+async def async_save_to_db(data):
+    """Async save — used for ALL runtime config persistence."""
+    from sqlalchemy import select
+
+    async with get_async_db() as db:
+        result = await db.execute(select(Config).limit(1))
+        existing_config = result.scalars().first()
+        if not existing_config:
+            new_config = Config(data=data, version=0)
+            db.add(new_config)
+        else:
+            existing_config.data = data
+            existing_config.updated_at = datetime.now()
+            db.add(existing_config)
+        await db.commit()
+
+
 def reset_config():
+    """Sync reset — used ONLY at startup."""
     with get_db() as db:
         db.query(Config).delete()
         db.commit()
 
 
+async def async_reset_config():
+    """Async reset — used at runtime."""
+    from sqlalchemy import delete as sa_delete
+
+    async with get_async_db() as db:
+        await db.execute(sa_delete(Config))
+        await db.commit()
+
+
 # When initializing, check if config.json exists and migrate it to the database
 if os.path.exists(f'{DATA_DIR}/config.json'):
     data = load_json_config()
@@ -144,6 +173,7 @@ PERSISTENT_CONFIG_REGISTRY = []
 
 
 def save_config(config):
+    """Sync save — used ONLY at startup/import time."""
     global CONFIG_DATA
     global PERSISTENT_CONFIG_REGISTRY
     try:
@@ -159,6 +189,23 @@ def save_config(config):
     return True
 
 
+async def async_save_config(config):
+    """Async save — used for ALL runtime config persistence."""
+    global CONFIG_DATA
+    global PERSISTENT_CONFIG_REGISTRY
+    try:
+        await async_save_to_db(config)
+        CONFIG_DATA = config
+
+        # Trigger updates on all registered PersistentConfig entries
+        for config_item in PERSISTENT_CONFIG_REGISTRY:
+            config_item.update()
+    except Exception as e:
+        log.exception(e)
+        return False
+    return True
+
+
 T = TypeVar('T')
 
 ENABLE_PERSISTENT_CONFIG = os.environ.get('ENABLE_PERSISTENT_CONFIG', 'True').lower() == 'true'
@@ -202,6 +249,7 @@ class PersistentConfig(Generic[T]):
             log.info(f'Updated {self.env_name} to new value {self.value}')
 
     def save(self):
+        """Sync save — used ONLY at startup/import time."""
         log.info(f"Saving '{self.env_name}' to the database")
         path_parts = self.config_path.split('.')
         sub_config = CONFIG_DATA
@@ -213,6 +261,19 @@ class PersistentConfig(Generic[T]):
         save_to_db(CONFIG_DATA)
         self.config_value = self.value
 
+    async def async_save(self):
+        """Async save — used for ALL runtime config persistence."""
+        log.info(f"Saving '{self.env_name}' to the database")
+        path_parts = self.config_path.split('.')
+        sub_config = CONFIG_DATA
+        for key in path_parts[:-1]:
+            if key not in sub_config:
+                sub_config[key] = {}
+            sub_config = sub_config[key]
+        sub_config[path_parts[-1]] = self.value
+        await async_save_to_db(CONFIG_DATA)
+        self.config_value = self.value
+
 
 class AppConfig:
     _redis: Union[redis.Redis, redis.cluster.RedisCluster] = None
@@ -246,12 +307,27 @@ class AppConfig:
             self._state[key] = value
         else:
             self._state[key].value = value
-            self._state[key].save()
+
+            # At runtime (inside the event loop) persist via the async engine
+            # to avoid blocking the loop and contending with the async DB pool.
+            # At startup/import time, fall back to sync.
+            try:
+                loop = asyncio.get_running_loop()
+                loop.create_task(self._async_persist(key))
+            except RuntimeError:
+                self._state[key].save()
 
             if self._redis and ENABLE_PERSISTENT_CONFIG:
                 redis_key = f'{self._redis_key_prefix}:config:{key}'
                 self._redis.set(redis_key, json.dumps(self._state[key].value))
 
+    async def _async_persist(self, key):
+        """Persist a single config key via the async engine."""
+        try:
+            await self._state[key].async_save()
+        except Exception as e:
+            log.error(f'Failed to async-persist config key {key}: {e}')
+
     def __getattr__(self, key):
         if key not in self._state:
             raise AttributeError(f"Config key '{key}' not found")
@@ -687,7 +763,6 @@ def load_oauth_providers():
             return client
 
         OAUTH_PROVIDERS['google'] = {
-            'redirect_uri': GOOGLE_REDIRECT_URI.value,
             'register': google_oauth_register,
         }
 
@@ -708,7 +783,6 @@ def load_oauth_providers():
             return client
 
         OAUTH_PROVIDERS['microsoft'] = {
-            'redirect_uri': MICROSOFT_REDIRECT_URI.value,
             'picture_url': MICROSOFT_CLIENT_PICTURE_URL.value,
             'register': microsoft_oauth_register,
         }
@@ -733,7 +807,6 @@ def load_oauth_providers():
             return client
 
         OAUTH_PROVIDERS['github'] = {
-            'redirect_uri': GITHUB_CLIENT_REDIRECT_URI.value,
             'register': github_oauth_register,
             'sub_claim': 'id',
         }
@@ -775,7 +848,6 @@ def load_oauth_providers():
 
         OAUTH_PROVIDERS['oidc'] = {
             'name': OAUTH_PROVIDER_NAME.value,
-            'redirect_uri': OPENID_REDIRECT_URI.value,
             'register': oidc_oauth_register,
         }
 
@@ -919,6 +991,7 @@ if CUSTOM_NAME:
 ####################################
 
 STORAGE_PROVIDER = os.environ.get('STORAGE_PROVIDER', 'local')  # defaults to local, s3
+STORAGE_LOCAL_CACHE = os.environ.get('STORAGE_LOCAL_CACHE', 'true').lower() == 'true'
 
 S3_ACCESS_KEY_ID = os.environ.get('S3_ACCESS_KEY_ID', None)
 S3_SECRET_ACCESS_KEY = os.environ.get('S3_SECRET_ACCESS_KEY', None)
@@ -1152,10 +1225,16 @@ ENABLE_SIGNUP = PersistentConfig(
 
 ENABLE_LOGIN_FORM = PersistentConfig(
     'ENABLE_LOGIN_FORM',
-    'ui.ENABLE_LOGIN_FORM',
+    'ui.enable_login_form',
     os.environ.get('ENABLE_LOGIN_FORM', 'True').lower() == 'true',
 )
 
+ENABLE_PASSWORD_CHANGE_FORM = PersistentConfig(
+    'ENABLE_PASSWORD_CHANGE_FORM',
+    'ui.enable_password_change_form',
+    os.environ.get('ENABLE_PASSWORD_CHANGE_FORM', 'True').lower() == 'true',
+)
+
 ENABLE_PASSWORD_AUTH = os.environ.get('ENABLE_PASSWORD_AUTH', 'True').lower() == 'true'
 
 DEFAULT_LOCALE = PersistentConfig(
@@ -1226,10 +1305,16 @@ DEFAULT_MODEL_METADATA = PersistentConfig(
     {},
 )
 
+try:
+    default_model_params = json.loads(os.environ.get('DEFAULT_MODEL_PARAMS', '{}'))
+except Exception as e:
+    log.exception(f'Error loading DEFAULT_MODEL_PARAMS: {e}')
+    default_model_params = {}
+
 DEFAULT_MODEL_PARAMS = PersistentConfig(
     'DEFAULT_MODEL_PARAMS',
     'models.default_params',
-    {},
+    default_model_params,
 )
 
 DEFAULT_USER_ROLE = PersistentConfig(
@@ -1435,6 +1520,12 @@ USER_PERMISSIONS_FEATURES_API_KEYS = os.environ.get('USER_PERMISSIONS_FEATURES_A
 
 USER_PERMISSIONS_FEATURES_MEMORIES = os.environ.get('USER_PERMISSIONS_FEATURES_MEMORIES', 'True').lower() == 'true'
 
+USER_PERMISSIONS_FEATURES_AUTOMATIONS = (
+    os.environ.get('USER_PERMISSIONS_FEATURES_AUTOMATIONS', 'False').lower() == 'true'
+)
+
+USER_PERMISSIONS_FEATURES_CALENDAR = os.environ.get('USER_PERMISSIONS_FEATURES_CALENDAR', 'True').lower() == 'true'
+
 
 USER_PERMISSIONS_SETTINGS_INTERFACE = os.environ.get('USER_PERMISSIONS_SETTINGS_INTERFACE', 'True').lower() == 'true'
 
@@ -1504,6 +1595,8 @@ DEFAULT_USER_PERMISSIONS = {
         'image_generation': USER_PERMISSIONS_FEATURES_IMAGE_GENERATION,
         'code_interpreter': USER_PERMISSIONS_FEATURES_CODE_INTERPRETER,
         'memories': USER_PERMISSIONS_FEATURES_MEMORIES,
+        'automations': USER_PERMISSIONS_FEATURES_AUTOMATIONS,
+        'calendar': USER_PERMISSIONS_FEATURES_CALENDAR,
     },
     'settings': {
         'interface': USER_PERMISSIONS_SETTINGS_INTERFACE,
@@ -1534,6 +1627,30 @@ ENABLE_CHANNELS = PersistentConfig(
     os.environ.get('ENABLE_CHANNELS', 'False').lower() == 'true',
 )
 
+ENABLE_CALENDAR = PersistentConfig(
+    'ENABLE_CALENDAR',
+    'calendar.enable',
+    os.environ.get('ENABLE_CALENDAR', 'True').lower() == 'true',
+)
+
+ENABLE_AUTOMATIONS = PersistentConfig(
+    'ENABLE_AUTOMATIONS',
+    'automations.enable',
+    os.environ.get('ENABLE_AUTOMATIONS', 'True').lower() == 'true',
+)
+
+AUTOMATION_MAX_COUNT = PersistentConfig(
+    'AUTOMATION_MAX_COUNT',
+    'automations.max_count',
+    os.environ.get('AUTOMATION_MAX_COUNT', ''),
+)
+
+AUTOMATION_MIN_INTERVAL = PersistentConfig(
+    'AUTOMATION_MIN_INTERVAL',
+    'automations.min_interval',
+    os.environ.get('AUTOMATION_MIN_INTERVAL', ''),
+)
+
 ENABLE_NOTES = PersistentConfig(
     'ENABLE_NOTES',
     'notes.enable',
@@ -2863,6 +2980,12 @@ RAG_RERANKING_MODEL_TRUST_REMOTE_CODE = (
     os.environ.get('RAG_RERANKING_MODEL_TRUST_REMOTE_CODE', 'True').lower() == 'true'
 )
 
+RAG_RERANKING_BATCH_SIZE = PersistentConfig(
+    'RAG_RERANKING_BATCH_SIZE',
+    'rag.reranking_batch_size',
+    int(os.environ.get('RAG_RERANKING_BATCH_SIZE', '32')),
+)
+
 RAG_EXTERNAL_RERANKER_URL = PersistentConfig(
     'RAG_EXTERNAL_RERANKER_URL',
     'rag.external_reranker_url',
@@ -3084,7 +3207,7 @@ WEB_SEARCH_CONCURRENT_REQUESTS = PersistentConfig(
 
 WEB_FETCH_MAX_CONTENT_LENGTH = PersistentConfig(
     'WEB_FETCH_MAX_CONTENT_LENGTH',
-    'rag.web.search.fetch_url_max_content_length',
+    'rag.web.fetch.max_content_length',
     (int(os.environ.get('WEB_FETCH_MAX_CONTENT_LENGTH')) if os.environ.get('WEB_FETCH_MAX_CONTENT_LENGTH') else None),
 )
 
@@ -3933,6 +4056,18 @@ AUDIO_TTS_AZURE_SPEECH_OUTPUT_FORMAT = PersistentConfig(
     os.getenv('AUDIO_TTS_AZURE_SPEECH_OUTPUT_FORMAT', 'audio-24khz-160kbitrate-mono-mp3'),
 )
 
+AUDIO_TTS_MISTRAL_API_KEY = PersistentConfig(
+    'AUDIO_TTS_MISTRAL_API_KEY',
+    'audio.tts.mistral.api_key',
+    os.getenv('AUDIO_TTS_MISTRAL_API_KEY', ''),
+)
+
+AUDIO_TTS_MISTRAL_API_BASE_URL = PersistentConfig(
+    'AUDIO_TTS_MISTRAL_API_BASE_URL',
+    'audio.tts.mistral.api_base_url',
+    os.getenv('AUDIO_TTS_MISTRAL_API_BASE_URL', 'https://api.mistral.ai/v1'),
+)
+
 
 ####################################
 # LDAP

backend/open_webui/constants.py

@@ -91,6 +91,17 @@ class ERROR_MESSAGES(str, Enum):
 
     INVALID_PASSWORD = lambda err='': err if err else 'The password does not meet the required validation criteria.'
 
+    AUTOMATION_LIMIT_EXCEEDED = lambda size='': f'Automation limit reached ({size})'
+    AUTOMATION_TOO_FREQUENT = lambda interval='': f'Schedule too frequent. Minimum interval is {interval} seconds.'
+    AUTOMATION_INVALID_RRULE = lambda err='': f'Invalid RRULE: {err}'
+    AUTOMATION_NO_FUTURE_RUNS = 'RRULE has no future occurrences'
+
+    FEATURE_DISABLED = lambda name='': f'{name} is disabled'
+    INPUT_TOO_LONG = lambda size='': f'Input prompt exceeds maximum length of {size}'
+    SERVER_CONNECTION_ERROR = 'Open WebUI: Server Connection Error'
+    REQUIRED_FIELD_EMPTY = lambda name='': f'Required field {name} is empty'
+    OAUTH_NOT_CONFIGURED = lambda name='': f"Provider '{name}' is not configured"
+
 
 class TASKS(str, Enum):
     def __str__(self) -> str:

backend/open_webui/env.py

@@ -60,13 +60,14 @@ if USE_CUDA.lower() == 'true':
 else:
     DEVICE_TYPE = 'cpu'
 
-try:
-    import torch
+if sys.platform == 'darwin':
+    try:
+        import torch
 
-    if torch.backends.mps.is_available() and torch.backends.mps.is_built():
-        DEVICE_TYPE = 'mps'
-except Exception:
-    pass
+        if torch.backends.mps.is_available() and torch.backends.mps.is_built():
+            DEVICE_TYPE = 'mps'
+    except Exception:
+        pass
 
 ####################################
 # LOGGING
@@ -374,7 +375,35 @@ else:
     except Exception:
         DATABASE_POOL_RECYCLE = 3600
 
-DATABASE_ENABLE_SQLITE_WAL = os.environ.get('DATABASE_ENABLE_SQLITE_WAL', 'False').lower() == 'true'
+DATABASE_ENABLE_SQLITE_WAL = os.environ.get('DATABASE_ENABLE_SQLITE_WAL', 'True').lower() == 'true'
+
+# SQLite PRAGMA tuning — these defaults are optimised for WAL-mode web-server
+# workloads.  Each can be overridden via its environment variable.
+# Set any value to an empty string to skip that PRAGMA entirely.
+
+# PRAGMA synchronous: NORMAL (1) is safe with WAL and avoids an fsync per
+# transaction.  Valid values: OFF (0), NORMAL (1), FULL (2), EXTRA (3).
+DATABASE_SQLITE_PRAGMA_SYNCHRONOUS = os.environ.get('DATABASE_SQLITE_PRAGMA_SYNCHRONOUS', 'NORMAL')
+
+# PRAGMA busy_timeout (ms): how long a connection waits for a write lock
+# before raising SQLITE_BUSY.
+DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT = os.environ.get('DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT', '5000')
+
+# PRAGMA cache_size: negative value = KiB.  -65536 ≈ 64 MB page cache.
+DATABASE_SQLITE_PRAGMA_CACHE_SIZE = os.environ.get('DATABASE_SQLITE_PRAGMA_CACHE_SIZE', '-65536')
+
+# PRAGMA temp_store: MEMORY (2) keeps temp tables and indices in RAM.
+# Valid values: DEFAULT (0), FILE (1), MEMORY (2).
+DATABASE_SQLITE_PRAGMA_TEMP_STORE = os.environ.get('DATABASE_SQLITE_PRAGMA_TEMP_STORE', 'MEMORY')
+
+# PRAGMA mmap_size (bytes): memory-mapped I/O size.  268435456 ≈ 256 MB.
+# Set to 0 to disable mmap.
+DATABASE_SQLITE_PRAGMA_MMAP_SIZE = os.environ.get('DATABASE_SQLITE_PRAGMA_MMAP_SIZE', '268435456')
+
+# PRAGMA journal_size_limit (bytes): caps the WAL file size after checkpoint.
+# Without this the WAL grows unbounded during write bursts and is never
+# truncated.  67108864 ≈ 64 MB.  Set to -1 for no limit (SQLite default).
+DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT = os.environ.get('DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT', '67108864')
 
 DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL = os.environ.get('DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL', None)
 if DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL is not None:
@@ -425,6 +454,27 @@ try:
 except ValueError:
     REDIS_SOCKET_CONNECT_TIMEOUT = None
 
+# Whether to enable TCP SO_KEEPALIVE on Redis client sockets. Opt-in:
+# defaults to off so behavior is unchanged for existing deployments. When
+# enabled, the kernel sends TCP keepalive probes on idle connections so
+# half-closed sockets (e.g. after a silent firewall/LB reset or a NIC
+# flap) are detected before the next command lands on them.
+REDIS_SOCKET_KEEPALIVE = os.environ.get('REDIS_SOCKET_KEEPALIVE', 'False').lower() == 'true'
+
+# How often (in seconds) redis-py should PING an idle pooled connection
+# before reusing it. Opt-in: defaults to unset (empty string) so behavior
+# is unchanged for existing deployments. When set, should be shorter than
+# the Redis server `timeout` setting and any firewall/LB idle timeout on
+# the path to Redis, so stale connections are detected before a real
+# command lands on them. Set to 0 or empty to disable.
+REDIS_HEALTH_CHECK_INTERVAL = os.environ.get('REDIS_HEALTH_CHECK_INTERVAL', '')
+try:
+    REDIS_HEALTH_CHECK_INTERVAL = int(REDIS_HEALTH_CHECK_INTERVAL)
+    if REDIS_HEALTH_CHECK_INTERVAL <= 0:
+        REDIS_HEALTH_CHECK_INTERVAL = None
+except ValueError:
+    REDIS_HEALTH_CHECK_INTERVAL = None
+
 REDIS_RECONNECT_DELAY = os.environ.get('REDIS_RECONNECT_DELAY', '')
 
 if REDIS_RECONNECT_DELAY == '':
@@ -495,6 +545,16 @@ PASSWORD_VALIDATION_HINT = os.environ.get('PASSWORD_VALIDATION_HINT', '')
 
 BYPASS_MODEL_ACCESS_CONTROL = os.environ.get('BYPASS_MODEL_ACCESS_CONTROL', 'False').lower() == 'true'
 
+# When enabled, skips pydub-based preprocessing (format conversion, compression,
+# and chunked splitting) before sending files to processing engines. Useful when
+# the upstream provider handles these steps or when ffmpeg is unavailable.
+BYPASS_PYDUB_PREPROCESSING = os.environ.get('BYPASS_PYDUB_PREPROCESSING', 'False').lower() == 'true'
+
+# When disabled (default), the OpenAI catch-all proxy endpoint (/{path:path})
+# is blocked. Enable only if you need direct passthrough to upstream OpenAI-
+# compatible APIs for endpoints not natively handled by Open WebUI.
+ENABLE_OPENAI_API_PASSTHROUGH = os.environ.get('ENABLE_OPENAI_API_PASSTHROUGH', 'False').lower() == 'true'
+
 WEBUI_AUTH_SIGNOUT_REDIRECT_URL = os.environ.get('WEBUI_AUTH_SIGNOUT_REDIRECT_URL', None)
 
 ####################################
@@ -544,6 +604,12 @@ OAUTH_MAX_SESSIONS_PER_USER = int(os.environ.get('OAUTH_MAX_SESSIONS_PER_USER',
 # Allows external apps to exchange OAuth tokens for OpenWebUI tokens
 ENABLE_OAUTH_TOKEN_EXCHANGE = os.environ.get('ENABLE_OAUTH_TOKEN_EXCHANGE', 'False').lower() == 'true'
 
+# Back-Channel Logout Configuration
+# When enabled, exposes POST /oauth/backchannel-logout for IdP-initiated logout
+# per OpenID Connect Back-Channel Logout 1.0 spec.
+# Requires Redis for JWT revocation.
+ENABLE_OAUTH_BACKCHANNEL_LOGOUT = os.environ.get('ENABLE_OAUTH_BACKCHANNEL_LOGOUT', 'False').lower() == 'true'
+
 ####################################
 # SCIM Configuration
 ####################################
@@ -608,6 +674,15 @@ ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION = (
     os.environ.get('ENABLE_CHAT_RESPONSE_BASE64_IMAGE_URL_CONVERSION', 'False').lower() == 'true'
 )
 
+# When enabled, uses a hardcoded extension-to-MIME dictionary as a last-resort
+# fallback when both mimetypes.guess_type() and file.meta.content_type fail to
+# determine the content type. This can help on minimal container images (e.g.
+# wolfi-base) that lack /etc/mime.types AND have legacy files without stored
+# content_type metadata.
+ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK = (
+    os.environ.get('ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK', 'False').lower() == 'true'
+)
+
 CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE = os.environ.get('CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE', '1')
 
 if CHAT_RESPONSE_STREAM_DELTA_CHUNK_SIZE == '':
@@ -771,6 +846,36 @@ else:
         AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER = AIOHTTP_CLIENT_TIMEOUT
 
 
+####################################
+# AIOHTTP Connection Pool
+####################################
+
+AIOHTTP_POOL_CONNECTIONS = os.environ.get('AIOHTTP_POOL_CONNECTIONS', '')
+if AIOHTTP_POOL_CONNECTIONS == '':
+    AIOHTTP_POOL_CONNECTIONS = None
+else:
+    try:
+        AIOHTTP_POOL_CONNECTIONS = int(AIOHTTP_POOL_CONNECTIONS)
+    except ValueError:
+        AIOHTTP_POOL_CONNECTIONS = None
+
+AIOHTTP_POOL_CONNECTIONS_PER_HOST = os.environ.get('AIOHTTP_POOL_CONNECTIONS_PER_HOST', '')
+if AIOHTTP_POOL_CONNECTIONS_PER_HOST == '':
+    AIOHTTP_POOL_CONNECTIONS_PER_HOST = None
+else:
+    try:
+        AIOHTTP_POOL_CONNECTIONS_PER_HOST = int(AIOHTTP_POOL_CONNECTIONS_PER_HOST)
+    except ValueError:
+        AIOHTTP_POOL_CONNECTIONS_PER_HOST = None
+
+AIOHTTP_POOL_DNS_TTL = os.environ.get('AIOHTTP_POOL_DNS_TTL', '300')
+try:
+    AIOHTTP_POOL_DNS_TTL = int(AIOHTTP_POOL_DNS_TTL)
+    if AIOHTTP_POOL_DNS_TTL < 0:
+        AIOHTTP_POOL_DNS_TTL = 300
+except ValueError:
+    AIOHTTP_POOL_DNS_TTL = 300
+
 RAG_EMBEDDING_TIMEOUT = os.environ.get('RAG_EMBEDDING_TIMEOUT', '')
 
 if RAG_EMBEDDING_TIMEOUT == '':
@@ -874,6 +979,9 @@ AUDIT_INCLUDED_PATHS = os.getenv('AUDIT_INCLUDED_PATHS', '').split(',')
 AUDIT_INCLUDED_PATHS = [path.strip() for path in AUDIT_INCLUDED_PATHS]
 AUDIT_INCLUDED_PATHS = [path.lstrip('/') for path in AUDIT_INCLUDED_PATHS if path]
 
+# When enabled, GET requests are also audited (disabled by default to avoid log noise)
+ENABLE_AUDIT_GET_REQUESTS = os.getenv('ENABLE_AUDIT_GET_REQUESTS', 'False').lower() == 'true'
+
 
 ####################################
 # OPENTELEMETRY

backend/open_webui/functions.py

@@ -34,9 +34,10 @@ from open_webui.utils.plugin import (
     load_function_module_by_id,
     get_function_module_from_cache,
 )
-from open_webui.utils.tools import get_tools
+from open_webui.utils.access_control import check_model_access
 
-from open_webui.env import GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL, BYPASS_MODEL_ACCESS_CONTROL
+from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
 
 from open_webui.utils.misc import (
     add_or_update_system_message,
@@ -54,12 +55,12 @@ logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
 
 
-def get_function_module_by_id(request: Request, pipe_id: str):
-    function_module, _, _ = get_function_module_from_cache(request, pipe_id)
+async def get_function_module_by_id(request: Request, pipe_id: str):
+    function_module, _, _ = await get_function_module_from_cache(request, pipe_id)
 
     if hasattr(function_module, 'valves') and hasattr(function_module, 'Valves'):
         Valves = function_module.Valves
-        valves = Functions.get_function_valves_by_id(pipe_id)
+        valves = await Functions.get_function_valves_by_id(pipe_id)
 
         if valves:
             try:
@@ -74,12 +75,12 @@ def get_function_module_by_id(request: Request, pipe_id: str):
 
 
 async def get_function_models(request):
-    pipes = Functions.get_functions_by_type('pipe', active_only=True)
+    pipes = await Functions.get_functions_by_type('pipe', active_only=True)
     pipe_models = []
 
     for pipe in pipes:
         try:
-            function_module = get_function_module_by_id(request, pipe.id)
+            function_module = await get_function_module_by_id(request, pipe.id)
 
             has_user_valves = False
             if hasattr(function_module, 'UserValves'):
@@ -188,7 +189,7 @@ async def generate_function_chat_completion(request, form_data, user, models: di
             pipe_id, _ = pipe_id.split('.', 1)
         return pipe_id
 
-    def get_function_params(function_module, form_data, user, extra_params=None):
+    async def get_function_params(function_module, form_data, user, extra_params=None):
         if extra_params is None:
             extra_params = {}
 
@@ -199,7 +200,7 @@ async def generate_function_chat_completion(request, form_data, user, models: di
         params = {'body': form_data} | {k: v for k, v in extra_params.items() if k in sig.parameters}
 
         if '__user__' in params and hasattr(function_module, 'UserValves'):
-            user_valves = Functions.get_user_valves_by_id_and_user_id(pipe_id, user.id)
+            user_valves = await Functions.get_user_valves_by_id_and_user_id(pipe_id, user.id)
             try:
                 params['__user__']['valves'] = function_module.UserValves(**user_valves)
             except Exception as e:
@@ -209,7 +210,7 @@ async def generate_function_chat_completion(request, form_data, user, models: di
         return params
 
     model_id = form_data.get('model')
-    model_info = Models.get_model_by_id(model_id)
+    model_info = await Models.get_model_by_id(model_id)
 
     metadata = form_data.pop('metadata', {})
 
@@ -226,18 +227,31 @@ async def generate_function_chat_completion(request, form_data, user, models: di
 
     if metadata:
         if all(k in metadata for k in ('session_id', 'chat_id', 'message_id')):
-            __event_emitter__ = get_event_emitter(metadata)
-            __event_call__ = get_event_call(metadata)
+            __event_emitter__ = await get_event_emitter(metadata)
+            __event_call__ = await get_event_call(metadata)
         __task__ = metadata.get('task', None)
         __task_body__ = metadata.get('task_body', None)
 
     oauth_token = None
     try:
-        if request.cookies.get('oauth_session_id', None):
+        oauth_session_id = request.cookies.get('oauth_session_id', None)
+        if oauth_session_id:
             oauth_token = await request.app.state.oauth_manager.get_oauth_token(
                 user.id,
-                request.cookies.get('oauth_session_id', None),
+                oauth_session_id,
             )
+
+        # Fallback: no cookie (automation, API key, etc.) — use most recent session
+        if oauth_token is None:
+            from open_webui.models.oauth_sessions import OAuthSessions
+
+            sessions = await OAuthSessions.get_sessions_by_user_id(user.id)
+            if sessions:
+                best = max(sessions, key=lambda s: s.updated_at)
+                oauth_token = await request.app.state.oauth_manager.get_oauth_token(
+                    user.id,
+                    best.id,
+                )
     except Exception as e:
         log.error(f'Error getting OAuth token: {e}')
 
@@ -255,22 +269,16 @@ async def generate_function_chat_completion(request, form_data, user, models: di
         '__oauth_token__': oauth_token,
         '__request__': request,
     }
-    extra_params['__tools__'] = await get_tools(
-        request,
-        tool_ids,
-        user,
-        {
-            **extra_params,
-            '__model__': models.get(form_data['model'], None),
-            '__messages__': form_data['messages'],
-            '__files__': files,
-        },
-    )
+    extra_params['__tools__'] = metadata.get('tools', {})
 
     if model_info:
         if model_info.base_model_id:
             form_data['model'] = model_info.base_model_id
 
+        if not BYPASS_MODEL_ACCESS_CONTROL:
+            bypass = isinstance(user, UserModel) and user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL
+            await check_model_access(user if isinstance(user, UserModel) else UserModel(**user), model_info, bypass)
+
         params = model_info.params.model_dump()
 
         if params:
@@ -279,10 +287,10 @@ async def generate_function_chat_completion(request, form_data, user, models: di
             form_data = apply_system_prompt_to_body(system, form_data, metadata, user)
 
     pipe_id = get_pipe_id(form_data)
-    function_module = get_function_module_by_id(request, pipe_id)
+    function_module = await get_function_module_by_id(request, pipe_id)
 
     pipe = function_module.pipe
-    params = get_function_params(function_module, form_data, user, extra_params)
+    params = await get_function_params(function_module, form_data, user, extra_params)
 
     if form_data.get('stream', False):
 

backend/open_webui/internal/db.py

@@ -1,8 +1,10 @@
 import os
 import json
 import logging
-from contextlib import contextmanager
+import ssl as _stdlib_ssl
+from contextlib import asynccontextmanager, contextmanager
 from typing import Any, Optional
+from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
 
 from open_webui.internal.wrappers import register_connection
 from open_webui.env import (
@@ -15,10 +17,17 @@ from open_webui.env import (
     DATABASE_POOL_TIMEOUT,
     DATABASE_ENABLE_SQLITE_WAL,
     DATABASE_ENABLE_SESSION_SHARING,
+    DATABASE_SQLITE_PRAGMA_SYNCHRONOUS,
+    DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT,
+    DATABASE_SQLITE_PRAGMA_CACHE_SIZE,
+    DATABASE_SQLITE_PRAGMA_TEMP_STORE,
+    DATABASE_SQLITE_PRAGMA_MMAP_SIZE,
+    DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT,
     ENABLE_DB_MIGRATIONS,
 )
 from peewee_migrate import Router
 from sqlalchemy import Dialect, create_engine, MetaData, event, types
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
 from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.orm import scoped_session, sessionmaker, Session
 from sqlalchemy.pool import QueuePool, NullPool
@@ -28,6 +37,92 @@ from typing_extensions import Self
 log = logging.getLogger(__name__)
 
 
+def extract_ssl_mode_from_url(url: str) -> tuple[str, str | None]:
+    """Strip SSL query-string parameters from a PostgreSQL URL.
+
+    asyncpg and psycopg2 use different query-string keys for SSL
+    (``ssl`` vs ``sslmode``).  This helper removes **both** from the
+    URL so that each driver can receive the correct parameter through
+    its own mechanism (query-string re-injection for psycopg2,
+    ``connect_args`` for asyncpg).
+
+    Returns
+    -------
+    (url_without_ssl, ssl_mode)
+        *url_without_ssl* is the original URL with ``ssl`` / ``sslmode``
+        query parameters removed.  *ssl_mode* is the extracted mode
+        string (e.g. ``'require'``), or ``None`` if neither parameter
+        was present.
+
+    Non-PostgreSQL URLs are returned unchanged with ``ssl_mode=None``.
+    """
+    if not url or not any(url.startswith(prefix) for prefix in ('postgresql://', 'postgresql+', 'postgres://')):
+        return url, None
+
+    parsed = urlparse(url)
+    query_params = parse_qs(parsed.query, keep_blank_values=True)
+
+    # Prefer sslmode (libpq canonical) over the asyncpg-only ssl key.
+    ssl_mode: str | None = None
+    for key in ('sslmode', 'ssl'):
+        values = query_params.pop(key, None)
+        if values and ssl_mode is None:
+            ssl_mode = values[0]
+
+    if ssl_mode is None:
+        # Nothing to strip — return the URL untouched.
+        return url, None
+
+    # Rebuild the query string without the SSL keys.
+    remaining_query = urlencode(query_params, doseq=True)
+    url_without_ssl = urlunparse(parsed._replace(query=remaining_query))
+    return url_without_ssl, ssl_mode
+
+
+def build_asyncpg_ssl_args(ssl_mode: str | None) -> dict:
+    """Convert a libpq-style SSL mode value to asyncpg ``connect_args``.
+
+    Returns a dict suitable for unpacking into
+    ``create_async_engine(..., connect_args=...)``.
+    """
+    if ssl_mode is None:
+        return {}
+
+    mode = ssl_mode.lower()
+    if mode == 'disable':
+        return {'connect_args': {'ssl': False}}
+    if mode in ('allow', 'prefer'):
+        # asyncpg has no direct equivalent — omit to let it try without.
+        return {}
+    if mode == 'require':
+        # SSL required but no certificate verification (matches libpq).
+        ctx = _stdlib_ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = _stdlib_ssl.CERT_NONE
+        return {'connect_args': {'ssl': ctx}}
+    if mode in ('verify-ca', 'verify-full'):
+        # Full verification — use the system trust store.
+        ctx = _stdlib_ssl.create_default_context()
+        if mode == 'verify-ca':
+            ctx.check_hostname = False
+        return {'connect_args': {'ssl': ctx}}
+
+    # Unknown value — pass through as-is and let asyncpg decide.
+    return {'connect_args': {'ssl': ssl_mode}}
+
+
+def reattach_ssl_mode_to_url(url_without_ssl: str, ssl_mode: str | None) -> str:
+    """Re-append ``sslmode=<value>`` to a cleaned PostgreSQL URL.
+
+    Used for psycopg2 / libpq consumers that expect the canonical
+    ``sslmode`` query-string key.
+    """
+    if ssl_mode is None:
+        return url_without_ssl
+    separator = '&' if '?' in url_without_ssl else '?'
+    return f'{url_without_ssl}{separator}sslmode={ssl_mode}'
+
+
 class JSONField(types.TypeDecorator):
     impl = types.Text
     cache_ok = True
@@ -53,10 +148,14 @@ class JSONField(types.TypeDecorator):
 # Workaround to handle the peewee migration
 # This is required to ensure the peewee migration is handled before the alembic migration
 def handle_peewee_migration(DATABASE_URL):
-    # db = None
+    db = None
     try:
+        # Normalize SSL params so psycopg2 always sees `sslmode=` (never `ssl=`).
+        url_without_ssl, ssl_mode = extract_ssl_mode_from_url(DATABASE_URL)
+        normalized_url = reattach_ssl_mode_to_url(url_without_ssl, ssl_mode)
+
         # Replace the postgresql:// with postgres:// to handle the peewee migration
-        db = register_connection(DATABASE_URL.replace('postgresql://', 'postgres://'))
+        db = register_connection(normalized_url.replace('postgresql://', 'postgres://'))
         migrate_dir = OPEN_WEBUI_DIR / 'internal' / 'migrations'
         router = Router(db, logger=log, migrate_dir=migrate_dir)
         router.run()
@@ -72,14 +171,48 @@ def handle_peewee_migration(DATABASE_URL):
             db.close()
 
         # Assert if db connection has been closed
-        assert db.is_closed(), 'Database connection is still open.'
+        if db is not None:
+            assert db.is_closed(), 'Database connection is still open.'
 
 
 if ENABLE_DB_MIGRATIONS:
     handle_peewee_migration(DATABASE_URL)
 
 
-SQLALCHEMY_DATABASE_URL = DATABASE_URL
+# Normalize SSL params from the URL once; each engine branch re-injects
+# the driver-appropriate form.
+DATABASE_URL_WITHOUT_SSL, DATABASE_SSL_MODE = extract_ssl_mode_from_url(DATABASE_URL)
+
+# For psycopg2 (sync engine), re-append sslmode=<value>.
+SQLALCHEMY_DATABASE_URL = (
+    reattach_ssl_mode_to_url(DATABASE_URL_WITHOUT_SSL, DATABASE_SSL_MODE) if DATABASE_SSL_MODE else DATABASE_URL
+)
+
+
+def _make_async_url(url: str) -> str:
+    """Convert a sync database URL to its async driver equivalent."""
+    if url.startswith('sqlite+sqlcipher://'):
+        # SQLCipher has no async driver — not supported for async
+        raise ValueError(
+            'sqlite+sqlcipher:// URLs are not supported with async engine. '
+            'Use standard sqlite:// or postgresql:// instead.'
+        )
+    if url.startswith('sqlite:///') or url.startswith('sqlite://'):
+        return url.replace('sqlite://', 'sqlite+aiosqlite://', 1)
+    if url.startswith('postgresql+psycopg2://'):
+        return url.replace('postgresql+psycopg2://', 'postgresql+asyncpg://', 1)
+    if url.startswith('postgresql://'):
+        return url.replace('postgresql://', 'postgresql+asyncpg://', 1)
+    if url.startswith('postgres://'):
+        return url.replace('postgres://', 'postgresql+asyncpg://', 1)
+    # For other dialects, return as-is and let SQLAlchemy handle it
+    return url
+
+
+# ============================================================
+# SYNC ENGINE (used only for: startup migrations, config loading,
+#              Alembic, peewee migration, health checks)
+# ============================================================
 
 # Handle SQLCipher URLs
 if SQLALCHEMY_DATABASE_URL.startswith('sqlite+sqlcipher://'):
@@ -128,14 +261,32 @@ if SQLALCHEMY_DATABASE_URL.startswith('sqlite+sqlcipher://'):
 elif 'sqlite' in SQLALCHEMY_DATABASE_URL:
     engine = create_engine(SQLALCHEMY_DATABASE_URL, connect_args={'check_same_thread': False})
 
-    def on_connect(dbapi_connection, connection_record):
+    def _apply_sqlite_pragmas(dbapi_connection):
+        """Apply all configured SQLite PRAGMAs to a raw DBAPI connection."""
         cursor = dbapi_connection.cursor()
         if DATABASE_ENABLE_SQLITE_WAL:
             cursor.execute('PRAGMA journal_mode=WAL')
         else:
             cursor.execute('PRAGMA journal_mode=DELETE')
+
+        # Each PRAGMA is skipped when its env var is empty, allowing opt-out.
+        if DATABASE_SQLITE_PRAGMA_SYNCHRONOUS:
+            cursor.execute(f'PRAGMA synchronous={DATABASE_SQLITE_PRAGMA_SYNCHRONOUS}')
+        if DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT:
+            cursor.execute(f'PRAGMA busy_timeout={DATABASE_SQLITE_PRAGMA_BUSY_TIMEOUT}')
+        if DATABASE_SQLITE_PRAGMA_CACHE_SIZE:
+            cursor.execute(f'PRAGMA cache_size={DATABASE_SQLITE_PRAGMA_CACHE_SIZE}')
+        if DATABASE_SQLITE_PRAGMA_TEMP_STORE:
+            cursor.execute(f'PRAGMA temp_store={DATABASE_SQLITE_PRAGMA_TEMP_STORE}')
+        if DATABASE_SQLITE_PRAGMA_MMAP_SIZE:
+            cursor.execute(f'PRAGMA mmap_size={DATABASE_SQLITE_PRAGMA_MMAP_SIZE}')
+        if DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT:
+            cursor.execute(f'PRAGMA journal_size_limit={DATABASE_SQLITE_PRAGMA_JOURNAL_SIZE_LIMIT}')
         cursor.close()
 
+    def on_connect(dbapi_connection, connection_record):
+        _apply_sqlite_pragmas(dbapi_connection)
+
     event.listen(engine, 'connect', on_connect)
 else:
     if isinstance(DATABASE_POOL_SIZE, int):
@@ -155,6 +306,7 @@ else:
         engine = create_engine(SQLALCHEMY_DATABASE_URL, pool_pre_ping=True)
 
 
+# Sync session — used ONLY for startup config loading (config.py runs at import time)
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine, expire_on_commit=False)
 metadata_obj = MetaData(schema=DATABASE_SCHEMA)
 Base = declarative_base(metadata=metadata_obj)
@@ -162,6 +314,7 @@ ScopedSession = scoped_session(SessionLocal)
 
 
 def get_session():
+    """Sync session generator — used ONLY for startup/config operations."""
     db = SessionLocal()
     try:
         yield db
@@ -172,10 +325,94 @@ def get_session():
 get_db = contextmanager(get_session)
 
 
-@contextmanager
-def get_db_context(db: Optional[Session] = None):
-    if isinstance(db, Session) and DATABASE_ENABLE_SESSION_SHARING:
+# ============================================================
+# ASYNC ENGINE (used for ALL runtime database operations)
+# ============================================================
+
+# Use the SSL-stripped URL for asyncpg — SSL is injected via connect_args.
+ASYNC_SQLALCHEMY_DATABASE_URL = _make_async_url(
+    DATABASE_URL_WITHOUT_SSL if DATABASE_SSL_MODE else SQLALCHEMY_DATABASE_URL
+)
+
+if 'sqlite' in ASYNC_SQLALCHEMY_DATABASE_URL:
+    # Generous default — async coroutines + no session sharing = high connection demand.
+    _sqlite_pool_size = DATABASE_POOL_SIZE if isinstance(DATABASE_POOL_SIZE, int) and DATABASE_POOL_SIZE > 0 else 512
+    async_engine = create_async_engine(
+        ASYNC_SQLALCHEMY_DATABASE_URL,
+        connect_args={'check_same_thread': False},
+        pool_size=_sqlite_pool_size,
+        pool_timeout=DATABASE_POOL_TIMEOUT,
+        pool_recycle=DATABASE_POOL_RECYCLE,
+        pool_pre_ping=True,
+    )
+
+    @event.listens_for(async_engine.sync_engine, 'connect')
+    def _set_sqlite_pragmas(dbapi_connection, connection_record):
+        _apply_sqlite_pragmas(dbapi_connection)
+else:
+    # Inject asyncpg-compatible SSL connect_args when the user specified
+    # sslmode/ssl in DATABASE_URL.
+    asyncpg_ssl_args = build_asyncpg_ssl_args(DATABASE_SSL_MODE)
+
+    if isinstance(DATABASE_POOL_SIZE, int):
+        if DATABASE_POOL_SIZE > 0:
+            async_engine = create_async_engine(
+                ASYNC_SQLALCHEMY_DATABASE_URL,
+                pool_size=DATABASE_POOL_SIZE,
+                max_overflow=DATABASE_POOL_MAX_OVERFLOW,
+                pool_timeout=DATABASE_POOL_TIMEOUT,
+                pool_recycle=DATABASE_POOL_RECYCLE,
+                pool_pre_ping=True,
+                **asyncpg_ssl_args,
+            )
+        else:
+            async_engine = create_async_engine(
+                ASYNC_SQLALCHEMY_DATABASE_URL,
+                pool_pre_ping=True,
+                poolclass=NullPool,
+                **asyncpg_ssl_args,
+            )
+    else:
+        async_engine = create_async_engine(
+            ASYNC_SQLALCHEMY_DATABASE_URL,
+            pool_pre_ping=True,
+            **asyncpg_ssl_args,
+        )
+
+
+AsyncSessionLocal = async_sessionmaker(
+    bind=async_engine,
+    class_=AsyncSession,
+    autocommit=False,
+    autoflush=False,
+    expire_on_commit=False,
+)
+
+
+async def get_async_session():
+    """Async session generator for FastAPI Depends()."""
+    async with AsyncSessionLocal() as db:
+        try:
+            yield db
+        finally:
+            await db.close()
+
+
+@asynccontextmanager
+async def get_async_db():
+    """Async context manager for use outside of FastAPI dependency injection."""
+    async with AsyncSessionLocal() as db:
+        try:
+            yield db
+        finally:
+            await db.close()
+
+
+@asynccontextmanager
+async def get_async_db_context(db: Optional[AsyncSession] = None):
+    """Async context manager that reuses an existing session if provided and session sharing is enabled."""
+    if isinstance(db, AsyncSession) and DATABASE_ENABLE_SESSION_SHARING:
         yield db
     else:
-        with get_db() as session:
+        async with get_async_db() as session:
             yield session

backend/open_webui/migrations/env.py

@@ -3,7 +3,9 @@ from logging.config import fileConfig
 
 from alembic import context
 from open_webui.models.auths import Auth
+from open_webui.models.calendar import Calendar, CalendarEvent, CalendarEventAttendee  # noqa: F401
 from open_webui.env import DATABASE_URL, DATABASE_PASSWORD, LOG_FORMAT
+from open_webui.internal.db import extract_ssl_mode_from_url, reattach_ssl_mode_to_url
 from sqlalchemy import engine_from_config, pool, create_engine
 
 # this is the Alembic Config object, which provides
@@ -35,6 +37,10 @@ target_metadata = Auth.metadata
 
 DB_URL = DATABASE_URL
 
+# Normalize SSL query params for psycopg2 (Alembic uses psycopg2, not asyncpg).
+url_without_ssl, ssl_mode = extract_ssl_mode_from_url(DB_URL)
+DB_URL = reattach_ssl_mode_to_url(url_without_ssl, ssl_mode) if ssl_mode else DB_URL
+
 if DB_URL:
     config.set_main_option('sqlalchemy.url', DB_URL.replace('%', '%%'))
 

backend/open_webui/migrations/versions/56359461a091_add_calendar_tables.py

@@ -0,0 +1,83 @@
+"""add calendar tables
+
+Revision ID: 56359461a091
+Revises: c1d2e3f4a5b6
+Create Date: 2026-04-19 16:20:58.162045
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '56359461a091'
+down_revision: Union[str, None] = 'c1d2e3f4a5b6'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'calendar',
+        sa.Column('id', sa.Text(), nullable=False),
+        sa.Column('user_id', sa.Text(), nullable=False),
+        sa.Column('name', sa.Text(), nullable=False),
+        sa.Column('color', sa.Text(), nullable=True),
+        sa.Column('is_default', sa.Boolean(), nullable=False),
+        sa.Column('data', sa.JSON(), nullable=True),
+        sa.Column('meta', sa.JSON(), nullable=True),
+        sa.Column('created_at', sa.BigInteger(), nullable=False),
+        sa.Column('updated_at', sa.BigInteger(), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    op.create_index('ix_calendar_user', 'calendar', ['user_id'], unique=False)
+
+    op.create_table(
+        'calendar_event',
+        sa.Column('id', sa.Text(), nullable=False),
+        sa.Column('calendar_id', sa.Text(), nullable=False),
+        sa.Column('user_id', sa.Text(), nullable=False),
+        sa.Column('title', sa.Text(), nullable=False),
+        sa.Column('description', sa.Text(), nullable=True),
+        sa.Column('start_at', sa.BigInteger(), nullable=False),
+        sa.Column('end_at', sa.BigInteger(), nullable=True),
+        sa.Column('all_day', sa.Boolean(), nullable=False),
+        sa.Column('rrule', sa.Text(), nullable=True),
+        sa.Column('color', sa.Text(), nullable=True),
+        sa.Column('location', sa.Text(), nullable=True),
+        sa.Column('data', sa.JSON(), nullable=True),
+        sa.Column('meta', sa.JSON(), nullable=True),
+        sa.Column('is_cancelled', sa.Boolean(), nullable=False),
+        sa.Column('created_at', sa.BigInteger(), nullable=False),
+        sa.Column('updated_at', sa.BigInteger(), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    op.create_index('ix_calendar_event_calendar', 'calendar_event', ['calendar_id', 'start_at'], unique=False)
+    op.create_index('ix_calendar_event_user_date', 'calendar_event', ['user_id', 'start_at'], unique=False)
+
+    op.create_table(
+        'calendar_event_attendee',
+        sa.Column('id', sa.Text(), nullable=False),
+        sa.Column('event_id', sa.Text(), nullable=False),
+        sa.Column('user_id', sa.Text(), nullable=False),
+        sa.Column('status', sa.Text(), nullable=False),
+        sa.Column('meta', sa.JSON(), nullable=True),
+        sa.Column('created_at', sa.BigInteger(), nullable=False),
+        sa.Column('updated_at', sa.BigInteger(), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('event_id', 'user_id', name='uq_event_attendee'),
+    )
+    op.create_index('ix_calendar_event_attendee_user', 'calendar_event_attendee', ['user_id', 'status'], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index('ix_calendar_event_attendee_user', table_name='calendar_event_attendee')
+    op.drop_table('calendar_event_attendee')
+    op.drop_index('ix_calendar_event_user_date', table_name='calendar_event')
+    op.drop_index('ix_calendar_event_calendar', table_name='calendar_event')
+    op.drop_table('calendar_event')
+    op.drop_index('ix_calendar_user', table_name='calendar')
+    op.drop_table('calendar')

backend/open_webui/migrations/versions/b7c8d9e0f1a2_add_last_read_at_to_chat.py

@@ -0,0 +1,27 @@
+"""add last_read_at to chat
+
+Revision ID: b7c8d9e0f1a2
+Revises: d4e5f6a7b8c9
+Create Date: 2026-04-01 04:00:00.000000
+
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'b7c8d9e0f1a2'
+down_revision = 'd4e5f6a7b8c9'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column('chat', sa.Column('last_read_at', sa.BigInteger(), nullable=True))
+    # Set existing chats to be marked as read
+    op.execute('UPDATE chat SET last_read_at = updated_at')
+
+
+def downgrade():
+    op.drop_column('chat', 'last_read_at')

backend/open_webui/migrations/versions/c1d2e3f4a5b6_add_shared_chat_table.py

@@ -0,0 +1,164 @@
+"""Add shared_chat table and migrate existing shares
+
+Revision ID: c1d2e3f4a5b6
+Revises: e1f2a3b4c5d6
+Create Date: 2026-04-16 23:00:00.000000
+
+"""
+
+import time
+import uuid
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'c1d2e3f4a5b6'
+down_revision = 'e1f2a3b4c5d6'
+branch_labels = None
+depends_on = None
+
+# Lightweight table references for data migration (no ORM models needed)
+chat_t = sa.table(
+    'chat',
+    sa.column('id', sa.Text),
+    sa.column('user_id', sa.Text),
+    sa.column('title', sa.Text),
+    sa.column('chat', sa.JSON),
+    sa.column('share_id', sa.Text),
+    sa.column('created_at', sa.BigInteger),
+    sa.column('updated_at', sa.BigInteger),
+    sa.column('archived', sa.Boolean),
+    sa.column('meta', sa.JSON),
+)
+
+shared_chat_t = sa.table(
+    'shared_chat',
+    sa.column('id', sa.Text),
+    sa.column('chat_id', sa.Text),
+    sa.column('user_id', sa.Text),
+    sa.column('title', sa.Text),
+    sa.column('chat', sa.JSON),
+    sa.column('created_at', sa.BigInteger),
+    sa.column('updated_at', sa.BigInteger),
+)
+
+chat_message_t = sa.table(
+    'chat_message',
+    sa.column('chat_id', sa.Text),
+)
+
+access_grant_t = sa.table(
+    'access_grant',
+    sa.column('id', sa.Text),
+    sa.column('resource_type', sa.Text),
+    sa.column('resource_id', sa.Text),
+    sa.column('principal_type', sa.Text),
+    sa.column('principal_id', sa.Text),
+    sa.column('permission', sa.Text),
+    sa.column('created_at', sa.BigInteger),
+)
+
+
+def upgrade():
+    conn = op.get_bind()
+
+    # 1. Create shared_chat table
+    op.create_table(
+        'shared_chat',
+        sa.Column('id', sa.Text(), primary_key=True),
+        sa.Column('chat_id', sa.Text(), sa.ForeignKey('chat.id', ondelete='CASCADE'), nullable=False),
+        sa.Column('user_id', sa.Text(), nullable=False),
+        sa.Column('title', sa.Text(), nullable=True),
+        sa.Column('chat', sa.JSON(), nullable=True),
+        sa.Column('created_at', sa.BigInteger(), nullable=True),
+        sa.Column('updated_at', sa.BigInteger(), nullable=True),
+    )
+
+    # 2. Migrate existing shared-* rows
+    shared_rows = conn.execute(
+        sa.select(
+            chat_t.c.id,
+            chat_t.c.user_id,
+            chat_t.c.title,
+            chat_t.c.chat,
+            chat_t.c.created_at,
+            chat_t.c.updated_at,
+        ).where(chat_t.c.user_id.like('shared-%'))
+    ).fetchall()
+
+    for row in shared_rows:
+        share_token = row.id
+        original_chat_id = row.user_id.replace('shared-', '', 1)
+
+        # Verify original chat still exists
+        original = conn.execute(sa.select(chat_t.c.user_id).where(chat_t.c.id == original_chat_id)).fetchone()
+
+        if not original:
+            continue
+
+        # Insert snapshot into shared_chat
+        conn.execute(
+            shared_chat_t.insert().values(
+                id=share_token,
+                chat_id=original_chat_id,
+                user_id=original.user_id,
+                title=row.title,
+                chat=row.chat,
+                created_at=row.created_at,
+                updated_at=row.updated_at,
+            )
+        )
+
+        # Create user:*:read grant for backward compat
+        conn.execute(
+            access_grant_t.insert().values(
+                id=str(uuid.uuid4()),
+                resource_type='shared_chat',
+                resource_id=original_chat_id,
+                principal_type='user',
+                principal_id='*',
+                permission='read',
+                created_at=row.created_at or int(time.time()),
+            )
+        )
+
+    # 3. Clean up old phantom rows
+    conn.execute(
+        chat_message_t.delete().where(
+            chat_message_t.c.chat_id.in_(sa.select(chat_t.c.id).where(chat_t.c.user_id.like('shared-%')))
+        )
+    )
+    conn.execute(chat_t.delete().where(chat_t.c.user_id.like('shared-%')))
+
+
+def downgrade():
+    conn = op.get_bind()
+
+    shared_rows = conn.execute(
+        sa.select(
+            shared_chat_t.c.id,
+            shared_chat_t.c.chat_id,
+            shared_chat_t.c.user_id,
+            shared_chat_t.c.title,
+            shared_chat_t.c.chat,
+            shared_chat_t.c.created_at,
+            shared_chat_t.c.updated_at,
+        )
+    ).fetchall()
+
+    for row in shared_rows:
+        conn.execute(
+            chat_t.insert().values(
+                id=row.id,
+                user_id=f'shared-{row.chat_id}',
+                title=row.title,
+                chat=row.chat,
+                created_at=row.created_at,
+                updated_at=row.updated_at,
+                archived=False,
+                meta={},
+            )
+        )
+
+    conn.execute(access_grant_t.delete().where(access_grant_t.c.resource_type == 'shared_chat'))
+    op.drop_table('shared_chat')

backend/open_webui/migrations/versions/d4e5f6a7b8c9_add_automation_tables.py

@@ -0,0 +1,55 @@
+"""add automation tables
+
+Revision ID: d4e5f6a7b8c9
+Revises: f1e2d3c4b5a6
+Create Date: 2026-03-30
+"""
+
+from typing import Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = 'd4e5f6a7b8c9'
+down_revision: Union[str, None] = 'a3dd5bedd151'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'automation',
+        sa.Column('id', sa.Text(), primary_key=True),
+        sa.Column('user_id', sa.Text(), nullable=False),
+        sa.Column('name', sa.Text(), nullable=False),
+        sa.Column('data', sa.JSON(), nullable=False),
+        sa.Column('meta', sa.JSON(), nullable=True),
+        sa.Column('is_active', sa.Boolean(), nullable=False, default=True),
+        sa.Column('last_run_at', sa.BigInteger(), nullable=True),
+        sa.Column('next_run_at', sa.BigInteger(), nullable=True),
+        sa.Column('created_at', sa.BigInteger(), nullable=False),
+        sa.Column('updated_at', sa.BigInteger(), nullable=False),
+    )
+    op.create_index('ix_automation_next_run', 'automation', ['next_run_at'])
+
+    op.create_table(
+        'automation_run',
+        sa.Column('id', sa.Text(), primary_key=True),
+        sa.Column('automation_id', sa.Text(), nullable=False),
+        sa.Column('chat_id', sa.Text(), nullable=True),
+        sa.Column('status', sa.Text(), nullable=False),
+        sa.Column('error', sa.Text(), nullable=True),
+        sa.Column('created_at', sa.BigInteger(), nullable=False),
+    )
+    op.create_index(
+        'ix_automation_run_automation_id',
+        'automation_run',
+        ['automation_id'],
+    )
+
+
+def downgrade():
+    op.drop_index('ix_automation_run_automation_id')
+    op.drop_table('automation_run')
+    op.drop_index('ix_automation_next_run')
+    op.drop_table('automation')

backend/open_webui/migrations/versions/e1f2a3b4c5d6_add_is_pinned_to_note.py

@@ -0,0 +1,23 @@
+"""Add is_pinned to note table
+
+Revision ID: e1f2a3b4c5d6
+Revises: b7c8d9e0f1a2
+Create Date: 2026-04-14 22:00:00.000000
+
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'e1f2a3b4c5d6'
+down_revision = 'b7c8d9e0f1a2'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column('note', sa.Column('is_pinned', sa.Boolean(), nullable=True))
+
+
+def downgrade():
+    op.drop_column('note', 'is_pinned')

backend/open_webui/models/access_grants.py

@@ -3,8 +3,9 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db_context
+from sqlalchemy import select, delete
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
 
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, Text, UniqueConstraint, or_, and_
@@ -281,29 +282,28 @@ def grants_to_access_control(grants: list) -> Optional[dict]:
 
 
 class AccessGrantsTable:
-    def grant_access(
+    async def grant_access(
         self,
         resource_type: str,
         resource_id: str,
         principal_type: str,
         principal_id: str,
         permission: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[AccessGrantModel]:
         """Add a single access grant. Idempotent (ignores duplicates)."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # Check for existing grant
-            existing = (
-                db.query(AccessGrant)
-                .filter_by(
+            result = await db.execute(
+                select(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                     principal_type=principal_type,
                     principal_id=principal_id,
                     permission=permission,
                 )
-                .first()
             )
+            existing = result.scalars().first()
             if existing:
                 return AccessGrantModel.model_validate(existing)
 
@@ -317,71 +317,69 @@ class AccessGrantsTable:
                 created_at=int(time.time()),
             )
             db.add(grant)
-            db.commit()
-            db.refresh(grant)
+            await db.commit()
+            await db.refresh(grant)
             return AccessGrantModel.model_validate(grant)
 
-    def revoke_access(
+    async def revoke_access(
         self,
         resource_type: str,
         resource_id: str,
         principal_type: str,
         principal_id: str,
         permission: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
         """Remove a single access grant."""
-        with get_db_context(db) as db:
-            deleted = (
-                db.query(AccessGrant)
-                .filter_by(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                delete(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                     principal_type=principal_type,
                     principal_id=principal_id,
                     permission=permission,
                 )
-                .delete()
             )
-            db.commit()
-            return deleted > 0
+            await db.commit()
+            return result.rowcount > 0
 
-    def revoke_all_access(
+    async def revoke_all_access(
         self,
         resource_type: str,
         resource_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> int:
         """Remove all access grants for a resource."""
-        with get_db_context(db) as db:
-            deleted = (
-                db.query(AccessGrant)
-                .filter_by(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                delete(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                 )
-                .delete()
             )
-            db.commit()
-            return deleted
+            await db.commit()
+            return result.rowcount
 
-    def set_access_control(
+    async def set_access_control(
         self,
         resource_type: str,
         resource_id: str,
         access_control: Optional[dict],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[AccessGrantModel]:
         """
         Replace all grants for a resource from an access_control JSON dict.
         This is the primary bridge for backward compat with the frontend.
         """
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # Delete all existing grants for this resource
-            db.query(AccessGrant).filter_by(
-                resource_type=resource_type,
-                resource_id=resource_id,
-            ).delete()
+            await db.execute(
+                delete(AccessGrant).filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                )
+            )
 
             # Convert JSON to grant dicts
             grant_dicts = access_control_to_grants(resource_type, resource_id, access_control)
@@ -397,25 +395,27 @@ class AccessGrantsTable:
                 db.add(grant)
                 results.append(grant)
 
-            db.commit()
+            await db.commit()
 
             return [AccessGrantModel.model_validate(g) for g in results]
 
-    def set_access_grants(
+    async def set_access_grants(
         self,
         resource_type: str,
         resource_id: str,
         access_grants: Optional[list],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[AccessGrantModel]:
         """
         Replace all grants for a resource from a direct access_grants list.
         """
-        with get_db_context(db) as db:
-            db.query(AccessGrant).filter_by(
-                resource_type=resource_type,
-                resource_id=resource_id,
-            ).delete()
+        async with get_async_db_context(db) as db:
+            await db.execute(
+                delete(AccessGrant).filter_by(
+                    resource_type=resource_type,
+                    resource_id=resource_id,
+                )
+            )
 
             normalized_grants = normalize_access_grants(access_grants)
 
@@ -433,80 +433,77 @@ class AccessGrantsTable:
                 db.add(grant)
                 results.append(grant)
 
-            db.commit()
+            await db.commit()
             return [AccessGrantModel.model_validate(g) for g in results]
 
-    def get_access_control(
+    async def get_access_control(
         self,
         resource_type: str,
         resource_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[dict]:
         """
         Reconstruct the old-style access_control JSON dict from grants.
         For backward compat with the frontend.
         """
-        with get_db_context(db) as db:
-            grants = (
-                db.query(AccessGrant)
-                .filter_by(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                 )
-                .all()
             )
+            grants = result.scalars().all()
             grant_models = [AccessGrantModel.model_validate(g) for g in grants]
             return grants_to_access_control(grant_models)
 
-    def get_grants_by_resource(
+    async def get_grants_by_resource(
         self,
         resource_type: str,
         resource_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[AccessGrantModel]:
         """Get all grants for a specific resource."""
-        with get_db_context(db) as db:
-            grants = (
-                db.query(AccessGrant)
-                .filter_by(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                 )
-                .all()
             )
+            grants = result.scalars().all()
             return [AccessGrantModel.model_validate(g) for g in grants]
 
-    def get_grants_by_resources(
+    async def get_grants_by_resources(
         self,
         resource_type: str,
         resource_ids: list[str],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, list[AccessGrantModel]]:
         """Batch-fetch grants for multiple resources. Returns {resource_id: [grants]}."""
         if not resource_ids:
             return {}
-        with get_db_context(db) as db:
-            grants = (
-                db.query(AccessGrant)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AccessGrant).filter(
                     AccessGrant.resource_type == resource_type,
                     AccessGrant.resource_id.in_(resource_ids),
                 )
-                .all()
             )
-            result: dict[str, list[AccessGrantModel]] = {rid: [] for rid in resource_ids}
+            grants = result.scalars().all()
+            result_dict: dict[str, list[AccessGrantModel]] = {rid: [] for rid in resource_ids}
             for g in grants:
-                result[g.resource_id].append(AccessGrantModel.model_validate(g))
-            return result
+                result_dict[g.resource_id].append(AccessGrantModel.model_validate(g))
+            return result_dict
 
-    def has_access(
+    async def has_access(
         self,
         user_id: str,
         resource_type: str,
         resource_id: str,
         permission: str = 'read',
         user_group_ids: Optional[set[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
         """
         Check if a user has the specified permission on a resource.
@@ -516,7 +513,7 @@ class AccessGrantsTable:
         - There's a grant for the specific user with the requested permission
         - There's a grant for any of the user's groups with the requested permission
         """
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # Build conditions for matching grants
             conditions = [
                 # Public access
@@ -535,7 +532,7 @@ class AccessGrantsTable:
             if user_group_ids is None:
                 from open_webui.models.groups import Groups
 
-                user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+                user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
                 user_group_ids = {group.id for group in user_groups}
 
             if user_group_ids:
@@ -546,26 +543,27 @@ class AccessGrantsTable:
                     )
                 )
 
-            exists = (
-                db.query(AccessGrant)
+            result = await db.execute(
+                select(AccessGrant)
                 .filter(
                     AccessGrant.resource_type == resource_type,
                     AccessGrant.resource_id == resource_id,
                     AccessGrant.permission == permission,
                     or_(*conditions),
                 )
-                .first()
+                .limit(1)
             )
-            return exists is not None
+            grant = result.scalars().first()
+            return grant is not None
 
-    def get_accessible_resource_ids(
+    async def get_accessible_resource_ids(
         self,
         user_id: str,
         resource_type: str,
         resource_ids: list[str],
         permission: str = 'read',
         user_group_ids: Optional[set[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> set[str]:
         """
         Batch check: return the subset of resource_ids that the user can access.
@@ -575,7 +573,7 @@ class AccessGrantsTable:
         if not resource_ids:
             return set()
 
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             conditions = [
                 and_(
                     AccessGrant.principal_type == 'user',
@@ -590,7 +588,7 @@ class AccessGrantsTable:
             if user_group_ids is None:
                 from open_webui.models.groups import Groups
 
-                user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+                user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
                 user_group_ids = {group.id for group in user_groups}
 
             if user_group_ids:
@@ -601,8 +599,8 @@ class AccessGrantsTable:
                     )
                 )
 
-            rows = (
-                db.query(AccessGrant.resource_id)
+            result = await db.execute(
+                select(AccessGrant.resource_id)
                 .filter(
                     AccessGrant.resource_type == resource_type,
                     AccessGrant.resource_id.in_(resource_ids),
@@ -610,16 +608,16 @@ class AccessGrantsTable:
                     or_(*conditions),
                 )
                 .distinct()
-                .all()
             )
+            rows = result.all()
             return {row[0] for row in rows}
 
-    def get_users_with_access(
+    async def get_users_with_access(
         self,
         resource_type: str,
         resource_id: str,
         permission: str = 'read',
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list:
         """
         Get all users who have the specified permission on a resource.
@@ -628,21 +626,20 @@ class AccessGrantsTable:
         from open_webui.models.users import Users, UserModel
         from open_webui.models.groups import Groups
 
-        with get_db_context(db) as db:
-            grants = (
-                db.query(AccessGrant)
-                .filter_by(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AccessGrant).filter_by(
                     resource_type=resource_type,
                     resource_id=resource_id,
                     permission=permission,
                 )
-                .all()
             )
+            grants = result.scalars().all()
 
             # Check for public access
             for grant in grants:
                 if grant.principal_type == 'user' and grant.principal_id == '*':
-                    result = Users.get_users(filter={'roles': ['!pending']}, db=db)
+                    result = await Users.get_users(filter={'roles': ['!pending']}, db=db)
                     return result.get('users', [])
 
             user_ids_with_access = set()
@@ -651,14 +648,14 @@ class AccessGrantsTable:
                 if grant.principal_type == 'user':
                     user_ids_with_access.add(grant.principal_id)
                 elif grant.principal_type == 'group':
-                    group_user_ids = Groups.get_group_user_ids_by_id(grant.principal_id, db=db)
+                    group_user_ids = await Groups.get_group_user_ids_by_id(grant.principal_id, db=db)
                     if group_user_ids:
                         user_ids_with_access.update(group_user_ids)
 
             if not user_ids_with_access:
                 return []
 
-            return Users.get_users_by_user_ids(list(user_ids_with_access), db=db)
+            return await Users.get_users_by_user_ids(list(user_ids_with_access), db=db)
 
     def has_permission_filter(
         self,
@@ -673,6 +670,10 @@ class AccessGrantsTable:
         Apply access control filtering to a SQLAlchemy query by JOINing with access_grant.
 
         This replaces the old JSON-column-based filtering with a proper relational JOIN.
+
+        Note: This method builds SQLAlchemy expressions and does NOT perform I/O itself,
+        so it remains synchronous. The caller is responsible for executing the query
+        asynchronously with `await db.execute(...)`.
         """
         group_ids = filter.get('group_ids', [])
         user_id = filter.get('user_id')
@@ -718,7 +719,7 @@ class AccessGrantsTable:
 
         # LEFT JOIN access_grant and filter
         # We use a subquery approach to avoid duplicates from multiple matching grants
-        from sqlalchemy import exists as sa_exists, select
+        from sqlalchemy import exists as sa_exists
 
         grant_exists = (
             select(AccessGrant.id)
@@ -776,11 +777,15 @@ class AccessGrantsTable:
         """
         Filter for items where user has read BUT NOT write access.
         Public items are NOT considered read_only.
+
+        Note: This method builds SQLAlchemy expressions and does NOT perform I/O itself,
+        so it remains synchronous. The caller is responsible for executing the query
+        asynchronously with `await db.execute(...)`.
         """
         group_ids = filter.get('group_ids', [])
         user_id = filter.get('user_id')
 
-        from sqlalchemy import exists as sa_exists, select
+        from sqlalchemy import exists as sa_exists
 
         # Has read grant (not public)
         read_grant_exists = (

backend/open_webui/models/auths.py

@@ -2,9 +2,9 @@ import logging
 import uuid
 from typing import Optional
 
-from sqlalchemy.exc import IntegrityError
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.users import User, UserModel, UserProfileImageResponse, Users
 from open_webui.utils.validate import validate_profile_image_url
 from pydantic import BaseModel, field_validator
@@ -89,7 +89,7 @@ class AddUserForm(SignupForm):
 
 
 class AuthsTable:
-    def insert_new_auth(
+    async def insert_new_auth(
         self,
         email: str,
         password: str,
@@ -97,10 +97,10 @@ class AuthsTable:
         profile_image_url: str = '/user.png',
         role: str = 'pending',
         oauth: Optional[dict] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
         id: Optional[str] = None,
     ) -> Optional[UserModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             log.info('insert_new_auth')
 
             if id is None:
@@ -111,10 +111,10 @@ class AuthsTable:
                 result = Auth(**auth.model_dump())
                 db.add(result)
 
-                user = Users.insert_new_user(id, name, email, profile_image_url, role, oauth=oauth, db=db)
+            user = await Users.insert_new_user(id, name, email, profile_image_url, role, oauth=oauth, db=db)
 
-                db.commit()
-                db.refresh(result)
+            await db.commit()
+            await db.refresh(result)
 
                 if result and user:
                     return user
@@ -157,18 +157,19 @@ class AuthsTable:
                     log.error(f'Failed to insert auth: {str(e)}')
                     return None
 
-    def authenticate_user(
-        self, email: str, verify_password: callable, db: Optional[Session] = None
+    async def authenticate_user(
+        self, email: str, verify_password: callable, db: Optional[AsyncSession] = None
     ) -> Optional[UserModel]:
         log.info(f'authenticate_user: {email}')
 
-        user = Users.get_user_by_email(email, db=db)
+        user = await Users.get_user_by_email(email, db=db)
         if not user:
             return None
 
         try:
-            with get_db_context(db) as db:
-                auth = db.query(Auth).filter_by(id=user.id, active=True).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Auth).filter_by(id=user.id, active=True))
+                auth = result.scalars().first()
                 if auth:
                     if verify_password(auth.password):
                         return user
@@ -179,66 +180,66 @@ class AuthsTable:
         except Exception:
             return None
 
-    def authenticate_user_by_api_key(self, api_key: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def authenticate_user_by_api_key(
+        self, api_key: str, db: Optional[AsyncSession] = None
+    ) -> Optional[UserModel]:
         log.info(f'authenticate_user_by_api_key')
         # if no api_key, return None
         if not api_key:
             return None
 
         try:
-            user = Users.get_user_by_api_key(api_key, db=db)
+            user = await Users.get_user_by_api_key(api_key, db=db)
             return user if user else None
         except Exception:
             return False
 
-    def authenticate_user_by_email(self, email: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def authenticate_user_by_email(self, email: str, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
         log.info(f'authenticate_user_by_email: {email}')
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Single JOIN query instead of two separate queries
-                result = (
-                    db.query(Auth, User)
-                    .join(User, Auth.id == User.id)
-                    .filter(Auth.email == email, Auth.active == True)
-                    .first()
+                result = await db.execute(
+                    select(Auth, User).join(User, Auth.id == User.id).filter(Auth.email == email, Auth.active == True)
                 )
-                if result:
-                    _, user = result
+                row = result.first()
+                if row:
+                    _, user = row
                     return UserModel.model_validate(user)
                 return None
         except Exception:
             return None
 
-    def update_user_password_by_id(self, id: str, new_password: str, db: Optional[Session] = None) -> bool:
+    async def update_user_password_by_id(self, id: str, new_password: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                result = db.query(Auth).filter_by(id=id).update({'password': new_password})
-                db.commit()
-                return True if result == 1 else False
+            async with get_async_db_context(db) as db:
+                result = await db.execute(update(Auth).filter_by(id=id).values(password=new_password))
+                await db.commit()
+                return True if result.rowcount == 1 else False
         except Exception:
             return False
 
-    def update_email_by_id(self, id: str, email: str, db: Optional[Session] = None) -> bool:
+    async def update_email_by_id(self, id: str, email: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                result = db.query(Auth).filter_by(id=id).update({'email': email})
-                db.commit()
-                if result == 1:
-                    Users.update_user_by_id(id, {'email': email}, db=db)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(update(Auth).filter_by(id=id).values(email=email))
+                await db.commit()
+                if result.rowcount == 1:
+                    await Users.update_user_by_id(id, {'email': email}, db=db)
                     return True
                 return False
         except Exception:
             return False
 
-    def delete_auth_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_auth_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Delete User
-                result = Users.delete_user_by_id(id, db=db)
+                result = await Users.delete_user_by_id(id, db=db)
 
                 if result:
-                    db.query(Auth).filter_by(id=id).delete()
-                    db.commit()
+                    await db.execute(delete(Auth).filter_by(id=id))
+                    await db.commit()
 
                     return True
                 else:

backend/open_webui/models/automations.py

@@ -0,0 +1,421 @@
+import time
+import logging
+from typing import Optional
+from uuid import uuid4
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import Column, Text, JSON, Boolean, BigInteger, Index, select, or_, func, cast, String, delete, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from open_webui.internal.db import Base, get_async_db_context
+
+log = logging.getLogger(__name__)
+
+
+####################
+# Automation DB Schema
+####################
+
+
+class Automation(Base):
+    __tablename__ = 'automation'
+
+    id = Column(Text, primary_key=True)
+    user_id = Column(Text, nullable=False)
+    name = Column(Text, nullable=False)
+    data = Column(JSON, nullable=False)  # {prompt, model_id, rrule}
+    meta = Column(JSON, nullable=True)
+    is_active = Column(Boolean, nullable=False, default=True)
+    last_run_at = Column(BigInteger, nullable=True)
+    next_run_at = Column(BigInteger, nullable=True)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (Index('ix_automation_next_run', 'next_run_at'),)
+
+
+class AutomationRun(Base):
+    __tablename__ = 'automation_run'
+
+    id = Column(Text, primary_key=True)
+    automation_id = Column(Text, nullable=False)
+    chat_id = Column(Text, nullable=True)
+    status = Column(Text, nullable=False)  # success | error
+    error = Column(Text, nullable=True)
+    created_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        Index('ix_automation_run_automation_id', 'automation_id'),
+        Index('ix_automation_run_aid_created', 'automation_id', 'created_at'),
+    )
+
+
+####################
+# Pydantic Models
+####################
+
+
+class AutomationTerminalConfig(BaseModel):
+    server_id: str
+    cwd: Optional[str] = None
+
+
+class AutomationData(BaseModel):
+    prompt: str
+    model_id: str
+    rrule: str
+    terminal: Optional[AutomationTerminalConfig] = None
+
+
+class AutomationModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    user_id: str
+    name: str
+    data: dict
+    meta: Optional[dict] = None
+    is_active: bool
+    last_run_at: Optional[int] = None
+    next_run_at: Optional[int] = None
+
+    created_at: int
+    updated_at: int
+
+
+class AutomationRunModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    automation_id: str
+    chat_id: Optional[str] = None
+    status: str
+    error: Optional[str] = None
+    created_at: int
+
+
+class AutomationForm(BaseModel):
+    name: str
+    data: AutomationData
+    meta: Optional[dict] = None
+    is_active: Optional[bool] = True
+
+
+class AutomationResponse(AutomationModel):
+    last_run: Optional[AutomationRunModel] = None
+    next_runs: Optional[list[int]] = None
+
+
+class AutomationListResponse(BaseModel):
+    items: list[AutomationModel]
+    total: int
+
+
+####################
+# AutomationTable
+####################
+
+
+class AutomationTable:
+    async def insert(
+        self,
+        user_id: str,
+        form: AutomationForm,
+        next_run_at: int,
+        db: Optional[AsyncSession] = None,
+    ) -> AutomationModel:
+        async with get_async_db_context(db) as db:
+            now = int(time.time_ns())
+            row = Automation(
+                id=str(uuid4()),
+                user_id=user_id,
+                name=form.name,
+                data=form.data.model_dump(),
+                meta=form.meta,
+                is_active=form.is_active,
+                next_run_at=next_run_at,
+                created_at=now,
+                updated_at=now,
+            )
+            db.add(row)
+            await db.commit()
+            await db.refresh(row)
+            return AutomationModel.model_validate(row)
+
+    async def count_by_user(self, user_id: str, db: Optional[AsyncSession] = None) -> int:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(func.count()).select_from(Automation).filter_by(user_id=user_id))
+            return result.scalar()
+
+    async def get_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[AutomationModel]:
+        async with get_async_db_context(db) as db:
+            row = await db.get(Automation, id)
+            return AutomationModel.model_validate(row) if row else None
+
+    async def get_active_by_user(self, user_id: str, db: Optional[AsyncSession] = None) -> list[AutomationModel]:
+        """Get active automations for a user (for calendar RRULE expansion)."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Automation).filter_by(user_id=user_id, is_active=True).order_by(Automation.created_at.desc())
+            )
+            return [AutomationModel.model_validate(r) for r in result.scalars().all()]
+
+    async def search_automations(
+        self,
+        user_id: str,
+        query: Optional[str] = None,
+        status: Optional[str] = None,
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[AsyncSession] = None,
+    ) -> 'AutomationListResponse':
+        async with get_async_db_context(db) as db:
+            stmt = select(Automation).filter_by(user_id=user_id)
+
+            if query:
+                search = f'%{query}%'
+                # Search in name and prompt inside JSON data
+                stmt = stmt.filter(
+                    or_(
+                        Automation.name.ilike(search),
+                        cast(Automation.data, String).ilike(search),
+                    )
+                )
+
+            if status == 'active':
+                stmt = stmt.filter(Automation.is_active == True)
+            elif status == 'paused':
+                stmt = stmt.filter(Automation.is_active == False)
+
+            stmt = stmt.order_by(Automation.created_at.desc())
+
+            # Get total count
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
+
+            if skip:
+                stmt = stmt.offset(skip)
+            if limit:
+                stmt = stmt.limit(limit)
+
+            result = await db.execute(stmt)
+            rows = result.scalars().all()
+            return AutomationListResponse(
+                items=[AutomationModel.model_validate(r) for r in rows],
+                total=total,
+            )
+
+    async def update_by_id(
+        self,
+        id: str,
+        form: AutomationForm,
+        next_run_at: int,
+        db: Optional[AsyncSession] = None,
+    ) -> Optional[AutomationModel]:
+        async with get_async_db_context(db) as db:
+            row = await db.get(Automation, id)
+            if not row:
+                return None
+            row.name = form.name
+            row.data = form.data.model_dump()
+            row.meta = form.meta
+            if form.is_active is not None:
+                row.is_active = form.is_active
+            row.next_run_at = next_run_at
+            row.updated_at = int(time.time_ns())
+            await db.commit()
+            await db.refresh(row)
+            return AutomationModel.model_validate(row)
+
+    async def toggle(
+        self,
+        id: str,
+        next_run_at: Optional[int],
+        db: Optional[AsyncSession] = None,
+    ) -> Optional[AutomationModel]:
+        async with get_async_db_context(db) as db:
+            row = await db.get(Automation, id)
+            if not row:
+                return None
+            row.is_active = not row.is_active
+            row.next_run_at = next_run_at if row.is_active else None
+            row.updated_at = int(time.time_ns())
+            await db.commit()
+            await db.refresh(row)
+            return AutomationModel.model_validate(row)
+
+    async def delete(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            row = await db.get(Automation, id)
+            if not row:
+                return False
+            await db.delete(row)
+            await db.commit()
+            return True
+
+    async def claim_due(self, now_ns: int, limit: int = 10, db: Optional[AsyncSession] = None) -> list[AutomationModel]:
+        """
+        Atomically claim due automations for execution.
+
+        Advances next_run_at immediately so the row can never be
+        double-claimed. On PostgreSQL, uses FOR UPDATE SKIP LOCKED
+        for zero-contention distributed work claiming.
+        """
+        async with get_async_db_context(db) as db:
+            stmt = (
+                select(Automation)
+                .where(
+                    Automation.is_active == True,
+                    Automation.next_run_at <= now_ns,
+                )
+                .order_by(Automation.next_run_at)
+                .limit(limit)
+            )
+
+            if db.bind.dialect.name == 'postgresql':
+                stmt = stmt.with_for_update(skip_locked=True)
+
+            result = await db.execute(stmt)
+            rows = result.scalars().all()
+
+            from open_webui.utils.automations import next_run_ns
+
+            # Batch-fetch user timezones so rescheduling respects each
+            # user's local timezone instead of falling back to server time.
+            user_ids = list({row.user_id for row in rows})
+            timezone_by_user_id: dict[str, Optional[str]] = {}
+            if user_ids:
+                from open_webui.models.users import User
+
+                tz_result = await db.execute(select(User.id, User.timezone).where(User.id.in_(user_ids)))
+                timezone_by_user_id = {uid: tz for uid, tz in tz_result.all()}
+
+            for row in rows:
+                row.last_run_at = now_ns
+                row.next_run_at = next_run_ns(row.data.get('rrule', ''), tz=timezone_by_user_id.get(row.user_id))
+
+            await db.commit()
+
+            return [AutomationModel.model_validate(r) for r in rows]
+
+
+####################
+# AutomationRunTable
+####################
+
+
+class AutomationRunTable:
+    async def insert(
+        self,
+        automation_id: str,
+        status: str,
+        chat_id: Optional[str] = None,
+        error: Optional[str] = None,
+        db: Optional[AsyncSession] = None,
+    ) -> AutomationRunModel:
+        async with get_async_db_context(db) as db:
+            row = AutomationRun(
+                id=str(uuid4()),
+                automation_id=automation_id,
+                chat_id=chat_id,
+                status=status,
+                error=error,
+                created_at=int(time.time_ns()),
+            )
+            db.add(row)
+            await db.commit()
+            await db.refresh(row)
+            return AutomationRunModel.model_validate(row)
+
+    async def get_latest(self, automation_id: str, db: Optional[AsyncSession] = None) -> Optional[AutomationRunModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AutomationRun)
+                .filter_by(automation_id=automation_id)
+                .order_by(AutomationRun.created_at.desc())
+                .limit(1)
+            )
+            row = result.scalars().first()
+            return AutomationRunModel.model_validate(row) if row else None
+
+    async def get_latest_batch(
+        self, automation_ids: list[str], db: Optional[AsyncSession] = None
+    ) -> dict[str, AutomationRunModel]:
+        """Fetch the latest run for each automation in a single query."""
+        if not automation_ids:
+            return {}
+        async with get_async_db_context(db) as db:
+            # Subquery: max created_at per automation_id
+            subq = (
+                select(
+                    AutomationRun.automation_id,
+                    func.max(AutomationRun.created_at).label('max_created'),
+                )
+                .filter(AutomationRun.automation_id.in_(automation_ids))
+                .group_by(AutomationRun.automation_id)
+                .subquery()
+            )
+            result = await db.execute(
+                select(AutomationRun).join(
+                    subq,
+                    (AutomationRun.automation_id == subq.c.automation_id)
+                    & (AutomationRun.created_at == subq.c.max_created),
+                )
+            )
+            rows = result.scalars().all()
+            return {row.automation_id: AutomationRunModel.model_validate(row) for row in rows}
+
+    async def get_by_automation(
+        self,
+        automation_id: str,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[AsyncSession] = None,
+    ) -> list[AutomationRunModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AutomationRun)
+                .filter_by(automation_id=automation_id)
+                .order_by(AutomationRun.created_at.desc())
+                .offset(skip)
+                .limit(limit)
+            )
+            rows = result.scalars().all()
+            return [AutomationRunModel.model_validate(r) for r in rows]
+
+    async def delete_by_automation(self, automation_id: str, db: Optional[AsyncSession] = None) -> int:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(delete(AutomationRun).filter_by(automation_id=automation_id))
+            await db.commit()
+            return result.rowcount
+
+    async def get_runs_by_user_range(
+        self,
+        user_id: str,
+        start_ns: int,
+        end_ns: int,
+        limit: int = 500,
+        db: Optional[AsyncSession] = None,
+    ) -> list[tuple['AutomationRunModel', 'AutomationModel']]:
+        """Get runs within a date range for a user, joined with parent automation."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(AutomationRun, Automation)
+                .join(Automation, Automation.id == AutomationRun.automation_id)
+                .filter(
+                    Automation.user_id == user_id,
+                    AutomationRun.created_at >= start_ns,
+                    AutomationRun.created_at < end_ns,
+                )
+                .order_by(AutomationRun.created_at.desc())
+                .limit(limit)
+            )
+            return [
+                (AutomationRunModel.model_validate(run), AutomationModel.model_validate(auto))
+                for run, auto in result.all()
+            ]
+
+
+Automations = AutomationTable()
+AutomationRuns = AutomationRunTable()

backend/open_webui/models/calendar.py

@@ -0,0 +1,822 @@
+import time
+import logging
+from typing import Optional
+from uuid import uuid4
+
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import (
+    Column,
+    Text,
+    JSON,
+    Boolean,
+    BigInteger,
+    Index,
+    UniqueConstraint,
+    select,
+    or_,
+    exists,
+    func,
+    delete,
+    update,
+)
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from open_webui.internal.db import Base, get_async_db_context
+from open_webui.models.access_grants import AccessGrantModel, AccessGrants
+from open_webui.models.groups import Groups
+from open_webui.models.users import User, UserModel, UserResponse
+
+log = logging.getLogger(__name__)
+
+
+####################
+# Calendar DB Schema
+####################
+
+
+class Calendar(Base):
+    __tablename__ = 'calendar'
+
+    id = Column(Text, primary_key=True)
+    user_id = Column(Text, nullable=False)
+    name = Column(Text, nullable=False)
+    color = Column(Text, nullable=True)
+    is_default = Column(Boolean, nullable=False, default=False)
+    data = Column(JSON, nullable=True)
+    meta = Column(JSON, nullable=True)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (Index('ix_calendar_user', 'user_id'),)
+
+
+class CalendarEvent(Base):
+    __tablename__ = 'calendar_event'
+
+    id = Column(Text, primary_key=True)
+    calendar_id = Column(Text, nullable=False)
+    user_id = Column(Text, nullable=False)
+    title = Column(Text, nullable=False)
+    description = Column(Text, nullable=True)
+    start_at = Column(BigInteger, nullable=False)
+    end_at = Column(BigInteger, nullable=True)
+    all_day = Column(Boolean, nullable=False, default=False)
+    rrule = Column(Text, nullable=True)
+    color = Column(Text, nullable=True)
+    location = Column(Text, nullable=True)
+    data = Column(JSON, nullable=True)
+    meta = Column(JSON, nullable=True)
+    is_cancelled = Column(Boolean, nullable=False, default=False)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        Index('ix_calendar_event_calendar', 'calendar_id', 'start_at'),
+        Index('ix_calendar_event_user_date', 'user_id', 'start_at'),
+    )
+
+
+class CalendarEventAttendee(Base):
+    __tablename__ = 'calendar_event_attendee'
+
+    id = Column(Text, primary_key=True)
+    event_id = Column(Text, nullable=False)
+    user_id = Column(Text, nullable=False)
+    status = Column(Text, nullable=False, default='pending')
+    meta = Column(JSON, nullable=True)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint('event_id', 'user_id', name='uq_event_attendee'),
+        Index('ix_calendar_event_attendee_user', 'user_id', 'status'),
+    )
+
+
+####################
+# Pydantic Models
+####################
+
+
+class CalendarModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    user_id: str
+    name: str
+    color: Optional[str] = None
+    is_default: bool = False
+    is_system: bool = False
+
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+
+    access_grants: list[AccessGrantModel] = Field(default_factory=list)
+
+    created_at: int
+    updated_at: int
+
+
+class CalendarEventModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True, extra='allow')
+
+    id: str
+    calendar_id: str
+    user_id: str
+    title: str
+    description: Optional[str] = None
+    start_at: int
+    end_at: Optional[int] = None
+    all_day: bool = False
+    rrule: Optional[str] = None
+    color: Optional[str] = None
+    location: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    is_cancelled: bool = False
+
+    attendees: list['CalendarEventAttendeeModel'] = Field(default_factory=list)
+
+    created_at: int
+    updated_at: int
+
+
+class CalendarEventAttendeeModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    event_id: str
+    user_id: str
+    status: str = 'pending'
+    meta: Optional[dict] = None
+
+    created_at: int
+    updated_at: int
+
+
+####################
+# Forms
+####################
+
+
+class CalendarForm(BaseModel):
+    name: str
+    color: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
+
+
+class CalendarUpdateForm(BaseModel):
+    name: Optional[str] = None
+    color: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    access_grants: Optional[list[dict]] = None
+
+
+class CalendarEventForm(BaseModel):
+    calendar_id: str
+    title: str
+    description: Optional[str] = None
+    start_at: int
+    end_at: Optional[int] = None
+    all_day: bool = False
+    rrule: Optional[str] = None
+    color: Optional[str] = None
+    location: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    attendees: Optional[list[dict]] = None
+
+
+class CalendarEventUpdateForm(BaseModel):
+    calendar_id: Optional[str] = None
+    title: Optional[str] = None
+    description: Optional[str] = None
+    start_at: Optional[int] = None
+    end_at: Optional[int] = None
+    all_day: Optional[bool] = None
+    rrule: Optional[str] = None
+    color: Optional[str] = None
+    location: Optional[str] = None
+    data: Optional[dict] = None
+    meta: Optional[dict] = None
+    is_cancelled: Optional[bool] = None
+    attendees: Optional[list[dict]] = None
+
+
+class RSVPForm(BaseModel):
+    status: str  # 'accepted' | 'declined' | 'tentative' | 'pending'
+
+
+####################
+# Response Models
+####################
+
+
+class CalendarEventUserResponse(CalendarEventModel):
+    user: Optional[UserResponse] = None
+
+
+class CalendarEventListResponse(BaseModel):
+    items: list[CalendarEventUserResponse]
+    total: int
+
+
+####################
+# Table Operations
+####################
+
+
+class CalendarTable:
+    async def _get_access_grants(self, calendar_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('calendar', calendar_id, db=db)
+
+    async def _to_calendar_model(
+        self,
+        cal: Calendar,
+        access_grants: Optional[list[AccessGrantModel]] = None,
+        db: Optional[AsyncSession] = None,
+    ) -> CalendarModel:
+        cal_data = CalendarModel.model_validate(cal).model_dump(exclude={'access_grants'})
+        cal_data['access_grants'] = (
+            access_grants if access_grants is not None else await self._get_access_grants(cal_data['id'], db=db)
+        )
+        return CalendarModel.model_validate(cal_data)
+
+    async def get_or_create_defaults(self, user_id: str, db: Optional[AsyncSession] = None) -> list[CalendarModel]:
+        """Return user's calendars, creating 'Personal' default if none exist."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Calendar).filter(Calendar.user_id == user_id).order_by(Calendar.created_at.asc())
+            )
+            calendars = result.scalars().all()
+
+            if calendars:
+                return [CalendarModel.model_validate(c) for c in calendars]
+
+            now = int(time.time_ns())
+            cal = Calendar(
+                id=str(uuid4()),
+                user_id=user_id,
+                name='Personal',
+                color='#3b82f6',
+                is_default=True,
+                created_at=now,
+                updated_at=now,
+            )
+            db.add(cal)
+            await db.commit()
+            return [CalendarModel.model_validate(cal)]
+
+    async def get_calendars_by_user(self, user_id: str, db: Optional[AsyncSession] = None) -> list[CalendarModel]:
+        """Owned + shared calendars."""
+        async with get_async_db_context(db) as db:
+            user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+            user_group_ids = [g.id for g in user_groups]
+
+            stmt = select(Calendar)
+            stmt = AccessGrants.has_permission_filter(
+                db=db,
+                query=stmt,
+                DocumentModel=Calendar,
+                filter={'user_id': user_id, 'group_ids': user_group_ids},
+                resource_type='calendar',
+                permission='read',
+            )
+            stmt = stmt.order_by(Calendar.created_at.asc())
+
+            result = await db.execute(stmt)
+            calendars = result.scalars().all()
+
+            if not calendars:
+                return await self.get_or_create_defaults(user_id, db=db)
+
+            cal_ids = [c.id for c in calendars]
+            grants_map = await AccessGrants.get_grants_by_resources('calendar', cal_ids, db=db)
+
+            return [await self._to_calendar_model(c, access_grants=grants_map.get(c.id, []), db=db) for c in calendars]
+
+    async def get_calendar_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[CalendarModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Calendar).filter(Calendar.id == id))
+            cal = result.scalars().first()
+            return await self._to_calendar_model(cal, db=db) if cal else None
+
+    async def insert_new_calendar(
+        self, user_id: str, form_data: CalendarForm, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarModel]:
+        async with get_async_db_context(db) as db:
+            now = int(time.time_ns())
+            cal = Calendar(
+                id=str(uuid4()),
+                user_id=user_id,
+                name=form_data.name,
+                color=form_data.color,
+                is_default=False,
+                data=form_data.data,
+                meta=form_data.meta,
+                created_at=now,
+                updated_at=now,
+            )
+            db.add(cal)
+            await db.commit()
+            if form_data.access_grants is not None:
+                await AccessGrants.set_access_grants('calendar', cal.id, form_data.access_grants, db=db)
+            return await self._to_calendar_model(cal, db=db)
+
+    async def update_calendar_by_id(
+        self, id: str, form_data: CalendarUpdateForm, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Calendar).filter(Calendar.id == id))
+            cal = result.scalars().first()
+            if not cal:
+                return None
+
+            update_data = form_data.model_dump(exclude_unset=True)
+            if 'name' in update_data:
+                cal.name = update_data['name']
+            if 'color' in update_data:
+                cal.color = update_data['color']
+            if 'data' in update_data:
+                cal.data = {**(cal.data or {}), **update_data['data']}
+            if 'meta' in update_data:
+                cal.meta = {**(cal.meta or {}), **update_data['meta']}
+            if 'access_grants' in update_data:
+                await AccessGrants.set_access_grants('calendar', id, update_data['access_grants'], db=db)
+
+            cal.updated_at = int(time.time_ns())
+            await db.commit()
+            return await self._to_calendar_model(cal, db=db)
+
+    async def set_default_calendar(
+        self, user_id: str, calendar_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarModel]:
+        """Set a calendar as the user's default, clearing all others."""
+        async with get_async_db_context(db) as db:
+            # Clear all defaults for this user
+            await db.execute(
+                update(Calendar)
+                .where(Calendar.user_id == user_id, Calendar.is_default == True)
+                .values(is_default=False)
+            )
+            # Set the new default
+            result = await db.execute(select(Calendar).filter(Calendar.id == calendar_id, Calendar.user_id == user_id))
+            cal = result.scalars().first()
+            if not cal:
+                return None
+            cal.is_default = True
+            cal.updated_at = int(time.time_ns())
+            await db.commit()
+            return await self._to_calendar_model(cal, db=db)
+
+    async def delete_calendar_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        """Delete a non-default calendar. Cascades to events, attendees, and grants."""
+        try:
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Calendar).filter(Calendar.id == id))
+                cal = result.scalars().first()
+                if not cal or cal.is_default:
+                    return False
+
+                # Delete attendees for all events in this calendar
+                event_ids_result = await db.execute(select(CalendarEvent.id).filter(CalendarEvent.calendar_id == id))
+                event_ids = [r[0] for r in event_ids_result.all()]
+                if event_ids:
+                    await db.execute(
+                        delete(CalendarEventAttendee).filter(CalendarEventAttendee.event_id.in_(event_ids))
+                    )
+
+                # Delete events
+                await db.execute(delete(CalendarEvent).filter(CalendarEvent.calendar_id == id))
+
+                # Delete access grants
+                await AccessGrants.revoke_all_access('calendar', id, db=db)
+
+                # Delete calendar
+                await db.execute(delete(Calendar).filter(Calendar.id == id))
+                await db.commit()
+                return True
+        except Exception:
+            return False
+
+
+class CalendarEventTable:
+    async def _get_attendees(
+        self, event_id: str, db: Optional[AsyncSession] = None
+    ) -> list[CalendarEventAttendeeModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(CalendarEventAttendee).filter(CalendarEventAttendee.event_id == event_id))
+            rows = result.scalars().all()
+            return [CalendarEventAttendeeModel.model_validate(r) for r in rows]
+
+    async def _to_event_model(
+        self,
+        event: CalendarEvent,
+        attendees: Optional[list[CalendarEventAttendeeModel]] = None,
+        db: Optional[AsyncSession] = None,
+    ) -> CalendarEventModel:
+        event_data = CalendarEventModel.model_validate(event).model_dump(exclude={'attendees'})
+        event_data['attendees'] = (
+            attendees if attendees is not None else await self._get_attendees(event_data['id'], db=db)
+        )
+        return CalendarEventModel.model_validate(event_data)
+
+    async def insert_new_event(
+        self, user_id: str, form_data: CalendarEventForm, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarEventModel]:
+        async with get_async_db_context(db) as db:
+            now = int(time.time_ns())
+            event = CalendarEvent(
+                id=str(uuid4()),
+                calendar_id=form_data.calendar_id,
+                user_id=user_id,
+                title=form_data.title,
+                description=form_data.description,
+                start_at=form_data.start_at,
+                end_at=form_data.end_at,
+                all_day=form_data.all_day,
+                rrule=form_data.rrule,
+                color=form_data.color,
+                location=form_data.location,
+                data=form_data.data,
+                meta=form_data.meta,
+                is_cancelled=False,
+                created_at=now,
+                updated_at=now,
+            )
+            db.add(event)
+            await db.commit()
+
+            # Add attendees
+            if form_data.attendees:
+                await CalendarEventAttendees.set_attendees(event.id, form_data.attendees, db=db)
+
+            return await self._to_event_model(event, db=db)
+
+    async def get_event_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[CalendarEventModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(CalendarEvent).filter(CalendarEvent.id == id))
+            event = result.scalars().first()
+            return await self._to_event_model(event, db=db) if event else None
+
+    async def get_events_by_range(
+        self,
+        user_id: str,
+        start: int,
+        end: int,
+        calendar_ids: Optional[list[str]] = None,
+        db: Optional[AsyncSession] = None,
+    ) -> list[CalendarEventUserResponse]:
+        """Fetch events visible to user within a date range.
+
+        Visible events = events in owned/shared calendars + events user attends.
+        Recurring events are fetched if they have any rrule (expansion in Python).
+        """
+        async with get_async_db_context(db) as db:
+            user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+            user_group_ids = [g.id for g in user_groups]
+
+            # Get calendar IDs accessible to user
+            cal_stmt = select(Calendar.id)
+            cal_stmt = AccessGrants.has_permission_filter(
+                db=db,
+                query=cal_stmt,
+                DocumentModel=Calendar,
+                filter={'user_id': user_id, 'group_ids': user_group_ids},
+                resource_type='calendar',
+                permission='read',
+            )
+            cal_result = await db.execute(cal_stmt)
+            accessible_cal_ids = [r[0] for r in cal_result.all()]
+
+            if calendar_ids:
+                # Filter to requested calendars only
+                accessible_cal_ids = [c for c in accessible_cal_ids if c in calendar_ids]
+
+            # Also get event IDs where user is an attendee
+            attendee_event_ids_result = await db.execute(
+                select(CalendarEventAttendee.event_id).filter(CalendarEventAttendee.user_id == user_id)
+            )
+            attendee_event_ids = [r[0] for r in attendee_event_ids_result.all()]
+
+            # Build conditions for accessible events
+            conditions = []
+            if accessible_cal_ids:
+                conditions.append(CalendarEvent.calendar_id.in_(accessible_cal_ids))
+            if attendee_event_ids:
+                conditions.append(CalendarEvent.id.in_(attendee_event_ids))
+
+            if not conditions:
+                return []
+
+            # Build event query
+            stmt = (
+                select(CalendarEvent, User)
+                .outerjoin(User, User.id == CalendarEvent.user_id)
+                .filter(
+                    CalendarEvent.is_cancelled == False,
+                    or_(*conditions),
+                    or_(
+                        # Non-recurring: overlaps the range
+                        (
+                            CalendarEvent.rrule.is_(None)
+                            & (CalendarEvent.start_at < end)
+                            & or_(
+                                CalendarEvent.end_at.is_(None) & (CalendarEvent.start_at >= start),
+                                CalendarEvent.end_at.isnot(None) & (CalendarEvent.end_at > start),
+                            )
+                        ),
+                        # Recurring: fetch all (expansion in Python)
+                        CalendarEvent.rrule.isnot(None),
+                    ),
+                )
+                .order_by(CalendarEvent.start_at.asc())
+            )
+
+            result = await db.execute(stmt)
+            items = result.all()
+
+            if not items:
+                return []
+
+            # Batch-load attendees for all events in one query (avoid N+1)
+            event_ids = [event.id for event, _user in items]
+            att_result = await db.execute(
+                select(CalendarEventAttendee).filter(CalendarEventAttendee.event_id.in_(event_ids))
+            )
+            att_rows = att_result.scalars().all()
+            att_map: dict[str, list[CalendarEventAttendeeModel]] = {}
+            for a in att_rows:
+                att_map.setdefault(a.event_id, []).append(CalendarEventAttendeeModel.model_validate(a))
+
+            events = []
+            for event, user in items:
+                event_data = CalendarEventModel.model_validate(event).model_dump(exclude={'attendees'})
+                event_data['attendees'] = att_map.get(event.id, [])
+                events.append(
+                    CalendarEventUserResponse(
+                        **event_data,
+                        user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
+                    )
+                )
+
+            return events
+
+    async def search_events(
+        self,
+        user_id: str,
+        query: Optional[str] = None,
+        skip: int = 0,
+        limit: int = 30,
+        db: Optional[AsyncSession] = None,
+    ) -> CalendarEventListResponse:
+        async with get_async_db_context(db) as db:
+            user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+            user_group_ids = [g.id for g in user_groups]
+
+            # Get accessible calendar IDs
+            cal_stmt = select(Calendar.id)
+            cal_stmt = AccessGrants.has_permission_filter(
+                db=db,
+                query=cal_stmt,
+                DocumentModel=Calendar,
+                filter={'user_id': user_id, 'group_ids': user_group_ids},
+                resource_type='calendar',
+                permission='read',
+            )
+            cal_result = await db.execute(cal_stmt)
+            accessible_cal_ids = [r[0] for r in cal_result.all()]
+            if not accessible_cal_ids:
+                return CalendarEventListResponse(items=[], total=0)
+
+            stmt = (
+                select(CalendarEvent, User)
+                .outerjoin(User, User.id == CalendarEvent.user_id)
+                .filter(
+                    CalendarEvent.is_cancelled == False,
+                    CalendarEvent.calendar_id.in_(accessible_cal_ids),
+                )
+            )
+
+            if query:
+                search = f'%{query}%'
+                stmt = stmt.filter(
+                    or_(
+                        CalendarEvent.title.ilike(search),
+                        CalendarEvent.description.ilike(search),
+                        CalendarEvent.location.ilike(search),
+                    )
+                )
+
+            stmt = stmt.order_by(CalendarEvent.start_at.desc())
+
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
+
+            if skip:
+                stmt = stmt.offset(skip)
+            if limit:
+                stmt = stmt.limit(limit)
+
+            result = await db.execute(stmt)
+            items = result.all()
+
+            if not items:
+                return CalendarEventListResponse(items=[], total=total)
+
+            # Batch-load attendees
+            event_ids = [event.id for event, _user in items]
+            att_result = await db.execute(
+                select(CalendarEventAttendee).filter(CalendarEventAttendee.event_id.in_(event_ids))
+            )
+            att_rows = att_result.scalars().all()
+            att_map: dict[str, list[CalendarEventAttendeeModel]] = {}
+            for a in att_rows:
+                att_map.setdefault(a.event_id, []).append(CalendarEventAttendeeModel.model_validate(a))
+
+            events = []
+            for event, user in items:
+                event_data = CalendarEventModel.model_validate(event).model_dump(exclude={'attendees'})
+                event_data['attendees'] = att_map.get(event.id, [])
+                events.append(
+                    CalendarEventUserResponse(
+                        **event_data,
+                        user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
+                    )
+                )
+
+            return CalendarEventListResponse(items=events, total=total)
+
+    async def update_event_by_id(
+        self, id: str, form_data: CalendarEventUpdateForm, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarEventModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(CalendarEvent).filter(CalendarEvent.id == id))
+            event = result.scalars().first()
+            if not event:
+                return None
+
+            update_data = form_data.model_dump(exclude_unset=True)
+            for field in [
+                'calendar_id',
+                'title',
+                'description',
+                'start_at',
+                'end_at',
+                'all_day',
+                'rrule',
+                'color',
+                'location',
+                'is_cancelled',
+            ]:
+                if field in update_data:
+                    setattr(event, field, update_data[field])
+
+            if 'data' in update_data and update_data['data'] is not None:
+                event.data = {**(event.data or {}), **update_data['data']}
+            if 'meta' in update_data and update_data['meta'] is not None:
+                event.meta = {**(event.meta or {}), **update_data['meta']}
+
+            if 'attendees' in update_data and update_data['attendees'] is not None:
+                await CalendarEventAttendees.set_attendees(id, update_data['attendees'], db=db)
+
+            event.updated_at = int(time.time_ns())
+            await db.commit()
+            return await self._to_event_model(event, db=db)
+
+    async def get_upcoming_events(
+        self,
+        now_ns: int,
+        default_lookahead_ns: int,
+        db: Optional[AsyncSession] = None,
+    ) -> list[tuple[CalendarEventModel, Optional[str]]]:
+        """Events starting between now and now + lookahead, for alert processing.
+
+        Per-event lookahead is read from meta.alert_minutes (falls back to
+        default_lookahead_ns).  Returns (event, user_timezone) pairs.
+        """
+        from open_webui.models.users import User as UserRow
+
+        # Use the maximum possible lookahead (60 min) to cast a wide net;
+        # per-event filtering happens in Python after fetching.
+        max_lookahead_ns = max(default_lookahead_ns, 60 * 60 * 1_000_000_000)
+        upper = now_ns + max_lookahead_ns
+
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(CalendarEvent, UserRow.timezone)
+                .outerjoin(UserRow, UserRow.id == CalendarEvent.user_id)
+                .filter(
+                    CalendarEvent.is_cancelled == False,
+                    CalendarEvent.start_at >= now_ns,
+                    CalendarEvent.start_at <= upper,
+                )
+            )
+            rows = result.all()
+
+        events = []
+        for event, tz in rows:
+            model = CalendarEventModel.model_validate(event)
+            # Determine per-event alert window
+            alert_minutes = None
+            if model.meta and 'alert_minutes' in model.meta:
+                alert_minutes = model.meta['alert_minutes']
+
+            if alert_minutes is not None:
+                if alert_minutes < 0:
+                    # alert_minutes < 0 means "no alert"
+                    continue
+                event_lookahead_ns = alert_minutes * 60 * 1_000_000_000
+            else:
+                event_lookahead_ns = default_lookahead_ns
+
+            if model.start_at <= now_ns + event_lookahead_ns:
+                events.append((model, tz))
+
+        return events
+
+    async def delete_event_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        try:
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(CalendarEventAttendee).filter(CalendarEventAttendee.event_id == id))
+                await db.execute(delete(CalendarEvent).filter(CalendarEvent.id == id))
+                await db.commit()
+                return True
+        except Exception:
+            return False
+
+
+class CalendarEventAttendeeTable:
+    async def set_attendees(
+        self, event_id: str, attendees: list[dict], db: Optional[AsyncSession] = None
+    ) -> list[CalendarEventAttendeeModel]:
+        """Replace all attendees for an event.
+
+        Each dict in attendees: {user_id: str, status?: str, meta?: dict}
+        """
+        async with get_async_db_context(db) as db:
+            # Remove existing
+            await db.execute(delete(CalendarEventAttendee).filter(CalendarEventAttendee.event_id == event_id))
+
+            now = int(time.time_ns())
+            models = []
+            for att in attendees:
+                row = CalendarEventAttendee(
+                    id=str(uuid4()),
+                    event_id=event_id,
+                    user_id=att['user_id'],
+                    status=att.get('status', 'pending'),
+                    meta=att.get('meta'),
+                    created_at=now,
+                    updated_at=now,
+                )
+                db.add(row)
+                models.append(CalendarEventAttendeeModel.model_validate(row))
+
+            await db.commit()
+            return models
+
+    async def update_rsvp(
+        self, event_id: str, user_id: str, status: str, db: Optional[AsyncSession] = None
+    ) -> Optional[CalendarEventAttendeeModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(CalendarEventAttendee).filter(
+                    CalendarEventAttendee.event_id == event_id,
+                    CalendarEventAttendee.user_id == user_id,
+                )
+            )
+            att = result.scalars().first()
+            if not att:
+                return None
+
+            att.status = status
+            att.updated_at = int(time.time_ns())
+            await db.commit()
+            return CalendarEventAttendeeModel.model_validate(att)
+
+    async def get_attendees_by_event(
+        self, event_id: str, db: Optional[AsyncSession] = None
+    ) -> list[CalendarEventAttendeeModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(CalendarEventAttendee).filter(CalendarEventAttendee.event_id == event_id))
+            return [CalendarEventAttendeeModel.model_validate(r) for r in result.scalars().all()]
+
+    async def get_events_by_attendee(self, user_id: str, db: Optional[AsyncSession] = None) -> list[str]:
+        """Return event IDs where user is an attendee."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(CalendarEventAttendee.event_id).filter(CalendarEventAttendee.user_id == user_id)
+            )
+            return [r[0] for r in result.all()]
+
+
+Calendars = CalendarTable()
+CalendarEvents = CalendarEventTable()
+CalendarEventAttendees = CalendarEventAttendeeTable()

backend/open_webui/models/channels.py

@@ -4,8 +4,9 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update, func, case, or_, and_
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.groups import Groups
 from open_webui.models.access_grants import (
     AccessGrantModel,
@@ -25,11 +26,7 @@ from sqlalchemy import (
     Text,
     JSON,
     UniqueConstraint,
-    case,
-    cast,
 )
-from sqlalchemy import or_, func, select, and_, text
-from sqlalchemy.sql import exists
 
 ####################
 # Channel DB Schema
@@ -249,22 +246,22 @@ class ChannelWebhookForm(BaseModel):
 
 
 class ChannelTable:
-    def _get_access_grants(self, channel_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('channel', channel_id, db=db)
+    async def _get_access_grants(self, channel_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('channel', channel_id, db=db)
 
-    def _to_channel_model(
+    async def _to_channel_model(
         self,
         channel: Channel,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> ChannelModel:
         channel_data = ChannelModel.model_validate(channel).model_dump(exclude={'access_grants'})
         channel_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(channel_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(channel_data['id'], db=db)
         )
         return ChannelModel.model_validate(channel_data)
 
-    def _collect_unique_user_ids(
+    async def _collect_unique_user_ids(
         self,
         invited_by: str,
         user_ids: Optional[list[str]] = None,
@@ -281,7 +278,8 @@ class ChannelTable:
         users.add(invited_by)
 
         for group_id in group_ids or []:
-            users.update(Groups.get_group_user_ids_by_id(group_id))
+            group_user_ids = await Groups.get_group_user_ids_by_id(group_id)
+            users.update(group_user_ids)
 
         return users
 
@@ -321,10 +319,20 @@ class ChannelTable:
 
         return memberships
 
-    def insert_new_channel(
-        self, form_data: CreateChannelForm, user_id: str, db: Optional[Session] = None
+    def _has_permission(self, db, query, filter: dict, permission: str = 'read'):
+        return AccessGrants.has_permission_filter(
+            db=db,
+            query=query,
+            DocumentModel=Channel,
+            filter=filter,
+            resource_type='channel',
+            permission=permission,
+        )
+
+    async def insert_new_channel(
+        self, form_data: CreateChannelForm, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             channel = ChannelModel(
                 **{
                     **form_data.model_dump(exclude={'access_grants'}),
@@ -340,7 +348,7 @@ class ChannelTable:
             new_channel = Channel(**channel.model_dump(exclude={'access_grants'}))
 
             if form_data.type in ['group', 'dm']:
-                users = self._collect_unique_user_ids(
+                users = await self._collect_unique_user_ids(
                     invited_by=user_id,
                     user_ids=form_data.user_ids,
                     group_ids=form_data.group_ids,
@@ -353,17 +361,18 @@ class ChannelTable:
 
                 db.add_all(memberships)
             db.add(new_channel)
-            db.commit()
-            AccessGrants.set_access_grants('channel', new_channel.id, form_data.access_grants, db=db)
-            return self._to_channel_model(new_channel, db=db)
+            await db.commit()
+            await AccessGrants.set_access_grants('channel', new_channel.id, form_data.access_grants, db=db)
+            return await self._to_channel_model(new_channel, db=db)
 
-    def get_channels(self, db: Optional[Session] = None) -> list[ChannelModel]:
-        with get_db_context(db) as db:
-            channels = db.query(Channel).all()
+    async def get_channels(self, db: Optional[AsyncSession] = None) -> list[ChannelModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Channel))
+            channels = result.scalars().all()
             channel_ids = [channel.id for channel in channels]
-            grants_map = AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
             return [
-                self._to_channel_model(
+                await self._to_channel_model(
                     channel,
                     access_grants=grants_map.get(channel.id, []),
                     db=db,
@@ -371,22 +380,12 @@ class ChannelTable:
                 for channel in channels
             ]
 
-    def _has_permission(self, db, query, filter: dict, permission: str = 'read'):
-        return AccessGrants.has_permission_filter(
-            db=db,
-            query=query,
-            DocumentModel=Channel,
-            filter=filter,
-            resource_type='channel',
-            permission=permission,
-        )
+    async def get_channels_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[ChannelModel]:
+        async with get_async_db_context(db) as db:
+            user_group_ids = [group.id for group in await Groups.get_groups_by_member_id(user_id, db=db)]
 
-    def get_channels_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[ChannelModel]:
-        with get_db_context(db) as db:
-            user_group_ids = [group.id for group in Groups.get_groups_by_member_id(user_id, db=db)]
-
-            membership_channels = (
-                db.query(Channel)
+            result = await db.execute(
+                select(Channel)
                 .join(ChannelMember, Channel.id == ChannelMember.channel_id)
                 .filter(
                     Channel.deleted_at.is_(None),
@@ -395,10 +394,10 @@ class ChannelTable:
                     ChannelMember.user_id == user_id,
                     ChannelMember.is_active.is_(True),
                 )
-                .all()
             )
+            membership_channels = result.scalars().all()
 
-            query = db.query(Channel).filter(
+            stmt = select(Channel).filter(
                 Channel.deleted_at.is_(None),
                 Channel.archived_at.is_(None),
                 or_(
@@ -407,17 +406,22 @@ class ChannelTable:
                     and_(Channel.type != 'group', Channel.type != 'dm'),
                 ),
             )
-            query = self._has_permission(db, query, {'user_id': user_id, 'group_ids': user_group_ids})
+            stmt = self._has_permission(db, stmt, {'user_id': user_id, 'group_ids': user_group_ids})
 
-            standard_channels = query.all()
+            result = await db.execute(stmt)
+            standard_channels = result.scalars().all()
 
-            all_channels = membership_channels + standard_channels
+            all_channels = list(membership_channels) + list(standard_channels)
             channel_ids = [c.id for c in all_channels]
-            grants_map = AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
-            return [self._to_channel_model(c, access_grants=grants_map.get(c.id, []), db=db) for c in all_channels]
+            grants_map = await AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
+            return [
+                await self._to_channel_model(c, access_grants=grants_map.get(c.id, []), db=db) for c in all_channels
+            ]
 
-    def get_dm_channel_by_user_ids(self, user_ids: list[str], db: Optional[Session] = None) -> Optional[ChannelModel]:
-        with get_db_context(db) as db:
+    async def get_dm_channel_by_user_ids(
+        self, user_ids: list[str], db: Optional[AsyncSession] = None
+    ) -> Optional[ChannelModel]:
+        async with get_async_db_context(db) as db:
             # Ensure uniqueness in case a list with duplicates is passed
             unique_user_ids = list(set(user_ids))
 
@@ -429,7 +433,7 @@ class ChannelTable:
             )
 
             subquery = (
-                db.query(ChannelMember.channel_id)
+                select(ChannelMember.channel_id)
                 .group_by(ChannelMember.channel_id)
                 # 1. Channel must have exactly len(user_ids) members
                 .having(func.count(ChannelMember.user_id) == len(unique_user_ids))
@@ -438,33 +442,32 @@ class ChannelTable:
                 .subquery()
             )
 
-            channel = (
-                db.query(Channel)
+            result = await db.execute(
+                select(Channel)
                 .filter(
-                    Channel.id.in_(subquery),
+                    Channel.id.in_(select(subquery.c.channel_id)),
                     Channel.type == 'dm',
                 )
-                .first()
+                .limit(1)
             )
+            channel = result.scalars().first()
 
-            return self._to_channel_model(channel, db=db) if channel else None
+            return await self._to_channel_model(channel, db=db) if channel else None
 
-    def add_members_to_channel(
+    async def add_members_to_channel(
         self,
         channel_id: str,
         invited_by: str,
         user_ids: Optional[list[str]] = None,
         group_ids: Optional[list[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[ChannelMemberModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # 1. Collect all user_ids including groups + inviter
-            requested_users = self._collect_unique_user_ids(invited_by, user_ids, group_ids)
+            requested_users = await self._collect_unique_user_ids(invited_by, user_ids, group_ids)
 
-            existing_users = {
-                row.user_id
-                for row in db.query(ChannelMember.user_id).filter(ChannelMember.channel_id == channel_id).all()
-            }
+            result = await db.execute(select(ChannelMember.user_id).filter(ChannelMember.channel_id == channel_id))
+            existing_users = {row[0] for row in result.all()}
 
             new_user_ids = requested_users - existing_users
             if not new_user_ids:
@@ -473,58 +476,56 @@ class ChannelTable:
             new_memberships = self._create_membership_models(channel_id, invited_by, new_user_ids)
 
             db.add_all(new_memberships)
-            db.commit()
+            await db.commit()
 
             return [ChannelMemberModel.model_validate(membership) for membership in new_memberships]
 
-    def remove_members_from_channel(
+    async def remove_members_from_channel(
         self,
         channel_id: str,
         user_ids: list[str],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> int:
-        with get_db_context(db) as db:
-            result = (
-                db.query(ChannelMember)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                delete(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id.in_(user_ids),
                 )
-                .delete(synchronize_session=False)
             )
-            db.commit()
-            return result  # number of rows deleted
+            await db.commit()
+            return result.rowcount  # number of rows deleted
 
-    def is_user_channel_manager(self, channel_id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            # Check if the user is the creator of the channel
-            # or has a 'manager' role in ChannelMember
-            channel = db.query(Channel).filter(Channel.id == channel_id).first()
+    async def is_user_channel_manager(self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Channel).filter(Channel.id == channel_id))
+            channel = result.scalars().first()
             if channel and channel.user_id == user_id:
                 return True
 
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
+                    ChannelMember.is_active.is_(True),
                     ChannelMember.role == 'manager',
                 )
-                .first()
             )
+            membership = result.scalars().first()
             return membership is not None
 
-    def join_channel(self, channel_id: str, user_id: str, db: Optional[Session] = None) -> Optional[ChannelMemberModel]:
-        with get_db_context(db) as db:
+    async def join_channel(
+        self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[ChannelMemberModel]:
+        async with get_async_db_context(db) as db:
             # Check if the membership already exists
-            existing_membership = (
-                db.query(ChannelMember)
-                .filter(
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            existing_membership = result.scalars().first()
             if existing_membership:
                 return ChannelMemberModel.model_validate(existing_membership)
 
@@ -548,19 +549,18 @@ class ChannelTable:
             new_membership = ChannelMember(**channel_member.model_dump())
 
             db.add(new_membership)
-            db.commit()
+            await db.commit()
             return channel_member
 
-    def leave_channel(self, channel_id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+    async def leave_channel(self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            membership = result.scalars().first()
             if not membership:
                 return False
 
@@ -569,125 +569,131 @@ class ChannelTable:
             membership.left_at = int(time.time_ns())
             membership.updated_at = int(time.time_ns())
 
-            db.commit()
+            await db.commit()
             return True
 
-    def get_member_by_channel_and_user_id(
-        self, channel_id: str, user_id: str, db: Optional[Session] = None
+    async def get_member_by_channel_and_user_id(
+        self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelMemberModel]:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            membership = result.scalars().first()
             return ChannelMemberModel.model_validate(membership) if membership else None
 
-    def get_members_by_channel_id(self, channel_id: str, db: Optional[Session] = None) -> list[ChannelMemberModel]:
-        with get_db_context(db) as db:
-            memberships = db.query(ChannelMember).filter(ChannelMember.channel_id == channel_id).all()
+    async def get_members_by_channel_id(
+        self, channel_id: str, db: Optional[AsyncSession] = None
+    ) -> list[ChannelMemberModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelMember).filter(ChannelMember.channel_id == channel_id))
+            memberships = result.scalars().all()
             return [ChannelMemberModel.model_validate(membership) for membership in memberships]
 
-    def pin_channel(
+    async def pin_channel(
         self,
         channel_id: str,
         user_id: str,
         is_pinned: bool,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            membership = result.scalars().first()
             if not membership:
                 return False
 
             membership.is_channel_pinned = is_pinned
             membership.updated_at = int(time.time_ns())
 
-            db.commit()
+            await db.commit()
             return True
 
-    def update_member_last_read_at(self, channel_id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+    async def update_member_last_read_at(
+        self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            membership = result.scalars().first()
             if not membership:
                 return False
 
             membership.last_read_at = int(time.time_ns())
             membership.updated_at = int(time.time_ns())
 
-            db.commit()
+            await db.commit()
             return True
 
-    def update_member_active_status(
+    async def update_member_active_status(
         self,
         channel_id: str,
         user_id: str,
         is_active: bool,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember).filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
                 )
-                .first()
             )
+            membership = result.scalars().first()
             if not membership:
                 return False
 
             membership.is_active = is_active
             membership.updated_at = int(time.time_ns())
 
-            db.commit()
+            await db.commit()
             return True
 
-    def is_user_channel_member(self, channel_id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            membership = (
-                db.query(ChannelMember)
+    async def is_user_channel_member(self, channel_id: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelMember)
                 .filter(
                     ChannelMember.channel_id == channel_id,
                     ChannelMember.user_id == user_id,
+                    ChannelMember.is_active.is_(True),
                 )
-                .first()
+                .limit(1)
             )
+            membership = result.scalars().first()
             return membership is not None
 
-    def get_channel_by_id(self, id: str, db: Optional[Session] = None) -> Optional[ChannelModel]:
+    async def get_channel_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ChannelModel]:
         try:
-            with get_db_context(db) as db:
-                channel = db.query(Channel).filter(Channel.id == id).first()
-                return self._to_channel_model(channel, db=db) if channel else None
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Channel).filter(Channel.id == id))
+                channel = result.scalars().first()
+                return await self._to_channel_model(channel, db=db) if channel else None
         except Exception:
             return None
 
-    def get_channels_by_file_id(self, file_id: str, db: Optional[Session] = None) -> list[ChannelModel]:
-        with get_db_context(db) as db:
-            channel_files = db.query(ChannelFile).filter(ChannelFile.file_id == file_id).all()
+    async def get_channels_by_file_id(self, file_id: str, db: Optional[AsyncSession] = None) -> list[ChannelModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelFile).filter(ChannelFile.file_id == file_id))
+            channel_files = result.scalars().all()
             channel_ids = [cf.channel_id for cf in channel_files]
-            channels = db.query(Channel).filter(Channel.id.in_(channel_ids)).all()
-            grants_map = AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
+            result = await db.execute(select(Channel).filter(Channel.id.in_(channel_ids)))
+            channels = result.scalars().all()
+            grants_map = await AccessGrants.get_grants_by_resources('channel', channel_ids, db=db)
             return [
-                self._to_channel_model(
+                await self._to_channel_model(
                     channel,
                     access_grants=grants_map.get(channel.id, []),
                     db=db,
@@ -695,123 +701,127 @@ class ChannelTable:
                 for channel in channels
             ]
 
-    def get_channels_by_file_id_and_user_id(
-        self, file_id: str, user_id: str, db: Optional[Session] = None
+    async def get_channels_by_file_id_and_user_id(
+        self, file_id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> list[ChannelModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # 1. Determine which channels have this file
-            channel_file_rows = db.query(ChannelFile).filter(ChannelFile.file_id == file_id).all()
+            result = await db.execute(select(ChannelFile).filter(ChannelFile.file_id == file_id))
+            channel_file_rows = result.scalars().all()
             channel_ids = [row.channel_id for row in channel_file_rows]
 
             if not channel_ids:
                 return []
 
             # 2. Load all channel rows that still exist
-            channels = (
-                db.query(Channel)
-                .filter(
+            result = await db.execute(
+                select(Channel).filter(
                     Channel.id.in_(channel_ids),
                     Channel.deleted_at.is_(None),
                     Channel.archived_at.is_(None),
                 )
-                .all()
             )
+            channels = result.scalars().all()
             if not channels:
                 return []
 
             # Preload user's group membership
-            user_group_ids = [g.id for g in Groups.get_groups_by_member_id(user_id, db=db)]
+            user_group_ids = [g.id for g in await Groups.get_groups_by_member_id(user_id, db=db)]
 
             allowed_channels = []
 
             for channel in channels:
                 # --- Case A: group or dm => user must be an active member ---
                 if channel.type in ['group', 'dm']:
-                    membership = (
-                        db.query(ChannelMember)
+                    result = await db.execute(
+                        select(ChannelMember)
                         .filter(
                             ChannelMember.channel_id == channel.id,
                             ChannelMember.user_id == user_id,
                             ChannelMember.is_active.is_(True),
                         )
-                        .first()
+                        .limit(1)
                     )
+                    membership = result.scalars().first()
                     if membership:
-                        allowed_channels.append(self._to_channel_model(channel, db=db))
+                        allowed_channels.append(await self._to_channel_model(channel, db=db))
                     continue
 
                 # --- Case B: standard channel => rely on ACL permissions ---
-                query = db.query(Channel).filter(Channel.id == channel.id)
+                stmt = select(Channel).filter(Channel.id == channel.id)
 
-                query = self._has_permission(
+                stmt = self._has_permission(
                     db,
-                    query,
+                    stmt,
                     {'user_id': user_id, 'group_ids': user_group_ids},
                     permission='read',
                 )
 
-                allowed = query.first()
+                result = await db.execute(stmt)
+                allowed = result.scalars().first()
                 if allowed:
-                    allowed_channels.append(self._to_channel_model(allowed, db=db))
+                    allowed_channels.append(await self._to_channel_model(allowed, db=db))
 
             return allowed_channels
 
-    def get_channel_by_id_and_user_id(
-        self, id: str, user_id: str, db: Optional[Session] = None
+    async def get_channel_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # Fetch the channel
-            channel: Channel = (
-                db.query(Channel)
-                .filter(
+            result = await db.execute(
+                select(Channel).filter(
                     Channel.id == id,
                     Channel.deleted_at.is_(None),
                     Channel.archived_at.is_(None),
                 )
-                .first()
             )
+            channel = result.scalars().first()
 
             if not channel:
                 return None
 
             # If the channel is a group or dm, read access requires membership (active)
             if channel.type in ['group', 'dm']:
-                membership = (
-                    db.query(ChannelMember)
+                result = await db.execute(
+                    select(ChannelMember)
                     .filter(
                         ChannelMember.channel_id == id,
                         ChannelMember.user_id == user_id,
                         ChannelMember.is_active.is_(True),
                     )
-                    .first()
+                    .limit(1)
                 )
+                membership = result.scalars().first()
                 if membership:
-                    return self._to_channel_model(channel, db=db)
+                    return await self._to_channel_model(channel, db=db)
                 else:
                     return None
 
             # For channels that are NOT group/dm, fall back to ACL-based read access
-            query = db.query(Channel).filter(Channel.id == id)
+            stmt = select(Channel).filter(Channel.id == id)
 
             # Determine user groups
-            user_group_ids = [group.id for group in Groups.get_groups_by_member_id(user_id, db=db)]
+            user_group_ids = [group.id for group in await Groups.get_groups_by_member_id(user_id, db=db)]
 
             # Apply ACL rules
-            query = self._has_permission(
+            stmt = self._has_permission(
                 db,
-                query,
+                stmt,
                 {'user_id': user_id, 'group_ids': user_group_ids},
                 permission='read',
             )
 
-            channel_allowed = query.first()
-            return self._to_channel_model(channel_allowed, db=db) if channel_allowed else None
+            result = await db.execute(stmt)
+            channel_allowed = result.scalars().first()
+            return await self._to_channel_model(channel_allowed, db=db) if channel_allowed else None
 
-    def update_channel_by_id(
-        self, id: str, form_data: ChannelForm, db: Optional[Session] = None
+    async def update_channel_by_id(
+        self, id: str, form_data: ChannelForm, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelModel]:
-        with get_db_context(db) as db:
-            channel = db.query(Channel).filter(Channel.id == id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Channel).filter(Channel.id == id))
+            channel = result.scalars().first()
             if not channel:
                 return None
 
@@ -823,16 +833,16 @@ class ChannelTable:
             channel.meta = form_data.meta
 
             if form_data.access_grants is not None:
-                AccessGrants.set_access_grants('channel', id, form_data.access_grants, db=db)
+                await AccessGrants.set_access_grants('channel', id, form_data.access_grants, db=db)
             channel.updated_at = int(time.time_ns())
 
-            db.commit()
-            return self._to_channel_model(channel, db=db) if channel else None
+            await db.commit()
+            return await self._to_channel_model(channel, db=db) if channel else None
 
-    def add_file_to_channel_by_id(
-        self, channel_id: str, file_id: str, user_id: str, db: Optional[Session] = None
+    async def add_file_to_channel_by_id(
+        self, channel_id: str, file_id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelFileModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             channel_file = ChannelFileModel(
                 **{
                     'id': str(uuid.uuid4()),
@@ -847,8 +857,8 @@ class ChannelTable:
             try:
                 result = ChannelFile(**channel_file.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return ChannelFileModel.model_validate(result)
                 else:
@@ -856,55 +866,58 @@ class ChannelTable:
             except Exception:
                 return None
 
-    def set_file_message_id_in_channel_by_id(
+    async def set_file_message_id_in_channel_by_id(
         self,
         channel_id: str,
         file_id: str,
         message_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
         try:
-            with get_db_context(db) as db:
-                channel_file = db.query(ChannelFile).filter_by(channel_id=channel_id, file_id=file_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(ChannelFile).filter_by(channel_id=channel_id, file_id=file_id))
+                channel_file = result.scalars().first()
                 if not channel_file:
                     return False
 
                 channel_file.message_id = message_id
                 channel_file.updated_at = int(time.time())
 
-                db.commit()
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def remove_file_from_channel_by_id(self, channel_id: str, file_id: str, db: Optional[Session] = None) -> bool:
+    async def remove_file_from_channel_by_id(
+        self, channel_id: str, file_id: str, db: Optional[AsyncSession] = None
+    ) -> bool:
         try:
-            with get_db_context(db) as db:
-                db.query(ChannelFile).filter_by(channel_id=channel_id, file_id=file_id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(ChannelFile).filter_by(channel_id=channel_id, file_id=file_id))
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def delete_channel_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            AccessGrants.revoke_all_access('channel', id, db=db)
-            db.query(Channel).filter(Channel.id == id).delete()
-            db.commit()
+    async def delete_channel_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            await AccessGrants.revoke_all_access('channel', id, db=db)
+            await db.execute(delete(Channel).filter(Channel.id == id))
+            await db.commit()
             return True
 
     ####################
     # Webhook Methods
     ####################
 
-    def insert_webhook(
+    async def insert_webhook(
         self,
         channel_id: str,
         user_id: str,
         form_data: ChannelWebhookForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[ChannelWebhookModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             webhook = ChannelWebhookModel(
                 id=str(uuid.uuid4()),
                 channel_id=channel_id,
@@ -917,63 +930,70 @@ class ChannelTable:
                 updated_at=int(time.time_ns()),
             )
             db.add(ChannelWebhook(**webhook.model_dump()))
-            db.commit()
+            await db.commit()
             return webhook
 
-    def get_webhooks_by_channel_id(self, channel_id: str, db: Optional[Session] = None) -> list[ChannelWebhookModel]:
-        with get_db_context(db) as db:
-            webhooks = db.query(ChannelWebhook).filter(ChannelWebhook.channel_id == channel_id).all()
+    async def get_webhooks_by_channel_id(
+        self, channel_id: str, db: Optional[AsyncSession] = None
+    ) -> list[ChannelWebhookModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelWebhook).filter(ChannelWebhook.channel_id == channel_id))
+            webhooks = result.scalars().all()
             return [ChannelWebhookModel.model_validate(w) for w in webhooks]
 
-    def get_webhook_by_id(self, webhook_id: str, db: Optional[Session] = None) -> Optional[ChannelWebhookModel]:
-        with get_db_context(db) as db:
-            webhook = db.query(ChannelWebhook).filter(ChannelWebhook.id == webhook_id).first()
+    async def get_webhook_by_id(
+        self, webhook_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[ChannelWebhookModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelWebhook).filter(ChannelWebhook.id == webhook_id))
+            webhook = result.scalars().first()
             return ChannelWebhookModel.model_validate(webhook) if webhook else None
 
-    def get_webhook_by_id_and_token(
-        self, webhook_id: str, token: str, db: Optional[Session] = None
+    async def get_webhook_by_id_and_token(
+        self, webhook_id: str, token: str, db: Optional[AsyncSession] = None
     ) -> Optional[ChannelWebhookModel]:
-        with get_db_context(db) as db:
-            webhook = (
-                db.query(ChannelWebhook)
-                .filter(
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChannelWebhook).filter(
                     ChannelWebhook.id == webhook_id,
                     ChannelWebhook.token == token,
                 )
-                .first()
             )
+            webhook = result.scalars().first()
             return ChannelWebhookModel.model_validate(webhook) if webhook else None
 
-    def update_webhook_by_id(
+    async def update_webhook_by_id(
         self,
         webhook_id: str,
         form_data: ChannelWebhookForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[ChannelWebhookModel]:
-        with get_db_context(db) as db:
-            webhook = db.query(ChannelWebhook).filter(ChannelWebhook.id == webhook_id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelWebhook).filter(ChannelWebhook.id == webhook_id))
+            webhook = result.scalars().first()
             if not webhook:
                 return None
             webhook.name = form_data.name
             webhook.profile_image_url = form_data.profile_image_url
             webhook.updated_at = int(time.time_ns())
-            db.commit()
+            await db.commit()
             return ChannelWebhookModel.model_validate(webhook)
 
-    def update_webhook_last_used_at(self, webhook_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            webhook = db.query(ChannelWebhook).filter(ChannelWebhook.id == webhook_id).first()
+    async def update_webhook_last_used_at(self, webhook_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(ChannelWebhook).filter(ChannelWebhook.id == webhook_id))
+            webhook = result.scalars().first()
             if not webhook:
                 return False
             webhook.last_used_at = int(time.time_ns())
-            db.commit()
+            await db.commit()
             return True
 
-    def delete_webhook_by_id(self, webhook_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            result = db.query(ChannelWebhook).filter(ChannelWebhook.id == webhook_id).delete()
-            db.commit()
-            return result > 0
+    async def delete_webhook_by_id(self, webhook_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(delete(ChannelWebhook).filter(ChannelWebhook.id == webhook_id))
+            await db.commit()
+            return result.rowcount > 0
 
 
 Channels = ChannelTable()

backend/open_webui/models/chat_messages.py

@@ -3,8 +3,10 @@ import time
 import uuid
 from typing import Any, Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db_context
+from sqlalchemy import select, delete, func, cast, Integer
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
+from open_webui.utils.response import normalize_usage
 
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import (
@@ -15,7 +17,6 @@ from sqlalchemy import (
     Text,
     JSON,
     Index,
-    func,
 )
 
 ####################
@@ -41,6 +42,12 @@ def _normalize_timestamp(timestamp: int) -> float:
     return timestamp
 
 
+def get_usage(data: dict) -> Optional[dict]:
+    """Extract and normalize usage from message data."""
+    usage = data.get('usage') or (data.get('info') or {}).get('usage')
+    return normalize_usage(usage) if usage else None
+
+
 ####################
 # ChatMessage DB Schema
 ####################
@@ -122,23 +129,23 @@ class ChatMessageModel(BaseModel):
 
 
 class ChatMessageTable:
-    def upsert_message(
+    async def upsert_message(
         self,
         message_id: str,
         chat_id: str,
         user_id: str,
         data: dict,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[ChatMessageModel]:
         """Insert or update a chat message."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             now = int(time.time())
             timestamp = data.get('timestamp', now)
 
             # Use composite ID: {chat_id}-{message_id}
             composite_id = f'{chat_id}-{message_id}'
 
-            existing = db.get(ChatMessage, composite_id)
+            existing = await db.get(ChatMessage, composite_id)
             if existing:
                 # Update existing
                 if 'role' in data:
@@ -163,24 +170,21 @@ class ChatMessageTable:
                     existing.status_history = data.get('status_history') or data.get('statusHistory')
                 if 'error' in data:
                     existing.error = data.get('error')
-                # Extract usage - check direct field first, then info.usage
-                usage = data.get('usage')
-                if not usage:
-                    info = data.get('info', {})
-                    usage = info.get('usage') if info else None
+                # Extract and normalize usage
+                usage = get_usage(data)
                 if usage:
-                    existing.usage = usage
+                    # Deep-merge: preserve existing keys not present in new data
+                    # This prevents background tasks (follow-ups, title, tags)
+                    # from accidentally clearing the primary response's token counts
+                    existing.usage = {**(existing.usage or {}), **usage}
                 existing.updated_at = now
-                db.commit()
-                db.refresh(existing)
+                await db.commit()
+                await db.refresh(existing)
                 return ChatMessageModel.model_validate(existing)
             else:
                 # Insert new
-                # Extract usage - check direct field first, then info.usage
-                usage = data.get('usage')
-                if not usage:
-                    info = data.get('info', {})
-                    usage = info.get('usage') if info else None
+                # Extract and normalize usage
+                usage = get_usage(data)
                 message = ChatMessage(
                     id=composite_id,
                     chat_id=chat_id,
@@ -201,143 +205,148 @@ class ChatMessageTable:
                     updated_at=now,
                 )
                 db.add(message)
-                db.commit()
-                db.refresh(message)
+                await db.commit()
+                await db.refresh(message)
                 return ChatMessageModel.model_validate(message)
 
-    def get_message_by_id(self, id: str, db: Optional[Session] = None) -> Optional[ChatMessageModel]:
-        with get_db_context(db) as db:
-            message = db.get(ChatMessage, id)
+    async def get_message_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ChatMessageModel]:
+        async with get_async_db_context(db) as db:
+            message = await db.get(ChatMessage, id)
             return ChatMessageModel.model_validate(message) if message else None
 
-    def get_messages_by_chat_id(self, chat_id: str, db: Optional[Session] = None) -> list[ChatMessageModel]:
-        with get_db_context(db) as db:
-            messages = db.query(ChatMessage).filter_by(chat_id=chat_id).order_by(ChatMessage.created_at.asc()).all()
+    async def get_messages_by_chat_id(self, chat_id: str, db: Optional[AsyncSession] = None) -> list[ChatMessageModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChatMessage).filter_by(chat_id=chat_id).order_by(ChatMessage.created_at.asc())
+            )
+            messages = result.scalars().all()
             return [ChatMessageModel.model_validate(message) for message in messages]
 
-    def get_messages_by_user_id(
+    async def get_messages_by_user_id(
         self,
         user_id: str,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[ChatMessageModel]:
-        with get_db_context(db) as db:
-            messages = (
-                db.query(ChatMessage)
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(ChatMessage)
                 .filter_by(user_id=user_id)
                 .order_by(ChatMessage.created_at.desc())
                 .offset(skip)
                 .limit(limit)
-                .all()
             )
+            messages = result.scalars().all()
             return [ChatMessageModel.model_validate(message) for message in messages]
 
-    def get_messages_by_model_id(
+    async def get_messages_by_model_id(
         self,
         model_id: str,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         skip: int = 0,
         limit: int = 100,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[ChatMessageModel]:
-        with get_db_context(db) as db:
-            query = db.query(ChatMessage).filter_by(model_id=model_id)
+        async with get_async_db_context(db) as db:
+            stmt = select(ChatMessage).filter_by(model_id=model_id)
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
-            messages = query.order_by(ChatMessage.created_at.desc()).offset(skip).limit(limit).all()
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
+            stmt = stmt.order_by(ChatMessage.created_at.desc()).offset(skip).limit(limit)
+            result = await db.execute(stmt)
+            messages = result.scalars().all()
             return [ChatMessageModel.model_validate(message) for message in messages]
 
-    def get_chat_ids_by_model_id(
+    async def get_chat_ids_by_model_id(
         self,
         model_id: str,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[str]:
         """Get distinct chat_ids that used a specific model."""
 
-        with get_db_context(db) as db:
-            query = db.query(
+        async with get_async_db_context(db) as db:
+            stmt = select(
                 ChatMessage.chat_id,
                 func.max(ChatMessage.created_at).label('last_message_at'),
             ).filter(ChatMessage.model_id == model_id)
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
 
             # Group by chat_id and order by most recent message in each chat
             # Secondary sort on chat_id ensures deterministic pagination
-            # (prevents duplicates across pages when timestamps tie)
-            chat_ids = (
-                query.group_by(ChatMessage.chat_id)
+            stmt = (
+                stmt.group_by(ChatMessage.chat_id)
                 .order_by(func.max(ChatMessage.created_at).desc(), ChatMessage.chat_id)
                 .offset(skip)
                 .limit(limit)
-                .all()
             )
+            result = await db.execute(stmt)
+            chat_ids = result.all()
             return [chat_id for chat_id, _ in chat_ids]
 
-    def delete_messages_by_chat_id(self, chat_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            db.query(ChatMessage).filter_by(chat_id=chat_id).delete()
-            db.commit()
+    async def delete_messages_by_chat_id(self, chat_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(ChatMessage).filter_by(chat_id=chat_id))
+            await db.commit()
             return True
 
     # Analytics methods
-    def get_message_count_by_model(
+    async def get_message_count_by_model(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, int]:
-        with get_db_context(db) as db:
-            from sqlalchemy import func
+        async with get_async_db_context(db) as db:
             from open_webui.models.groups import GroupMember
 
-            query = db.query(ChatMessage.model_id, func.count(ChatMessage.id).label('count')).filter(
+            stmt = select(ChatMessage.model_id, func.count(ChatMessage.id).label('count')).filter(
                 ChatMessage.role == 'assistant',
                 ChatMessage.model_id.isnot(None),
-                ~ChatMessage.user_id.like('shared-%'),
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.group_by(ChatMessage.model_id).all()
-            return {row.model_id: row.count for row in results}
+            stmt = stmt.group_by(ChatMessage.model_id)
+            result = await db.execute(stmt)
+            return {row.model_id: row.count for row in result.all()}
 
-    def get_token_usage_by_model(
+    async def get_token_usage_by_model(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, dict]:
         """Aggregate token usage by model using database-level aggregation."""
-        with get_db_context(db) as db:
-            from sqlalchemy import func, cast, Integer
+        async with get_async_db_context(db) as db:
             from open_webui.models.groups import GroupMember
 
-            dialect = db.bind.dialect.name
+            # We need the dialect to determine JSON extraction syntax
+            # For async sessions, access via get_bind()
+            bind = await db.connection()
+            dialect = bind.dialect.name
 
             if dialect == 'sqlite':
                 input_tokens = cast(func.json_extract(ChatMessage.usage, '$.input_tokens'), Integer)
                 output_tokens = cast(func.json_extract(ChatMessage.usage, '$.output_tokens'), Integer)
             elif dialect == 'postgresql':
-                # Use json_extract_path_text for PostgreSQL JSON columns
                 input_tokens = cast(
                     func.json_extract_path_text(ChatMessage.usage, 'input_tokens'),
                     Integer,
@@ -349,7 +358,7 @@ class ChatMessageTable:
             else:
                 raise NotImplementedError(f'Unsupported dialect: {dialect}')
 
-            query = db.query(
+            stmt = select(
                 ChatMessage.model_id,
                 func.coalesce(func.sum(input_tokens), 0).label('input_tokens'),
                 func.coalesce(func.sum(output_tokens), 0).label('output_tokens'),
@@ -358,18 +367,18 @@ class ChatMessageTable:
                 ChatMessage.role == 'assistant',
                 ChatMessage.model_id.isnot(None),
                 ChatMessage.usage.isnot(None),
-                ~ChatMessage.user_id.like('shared-%'),
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.group_by(ChatMessage.model_id).all()
+            stmt = stmt.group_by(ChatMessage.model_id)
+            result = await db.execute(stmt)
 
             return {
                 row.model_id: {
@@ -378,28 +387,27 @@ class ChatMessageTable:
                     'total_tokens': row.input_tokens + row.output_tokens,
                     'message_count': row.message_count,
                 }
-                for row in results
+                for row in result.all()
             }
 
-    def get_token_usage_by_user(
+    async def get_token_usage_by_user(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, dict]:
         """Aggregate token usage by user using database-level aggregation."""
-        with get_db_context(db) as db:
-            from sqlalchemy import func, cast, Integer
+        async with get_async_db_context(db) as db:
             from open_webui.models.groups import GroupMember
 
-            dialect = db.bind.dialect.name
+            bind = await db.connection()
+            dialect = bind.dialect.name
 
             if dialect == 'sqlite':
                 input_tokens = cast(func.json_extract(ChatMessage.usage, '$.input_tokens'), Integer)
                 output_tokens = cast(func.json_extract(ChatMessage.usage, '$.output_tokens'), Integer)
             elif dialect == 'postgresql':
-                # Use json_extract_path_text for PostgreSQL JSON columns
                 input_tokens = cast(
                     func.json_extract_path_text(ChatMessage.usage, 'input_tokens'),
                     Integer,
@@ -411,7 +419,7 @@ class ChatMessageTable:
             else:
                 raise NotImplementedError(f'Unsupported dialect: {dialect}')
 
-            query = db.query(
+            stmt = select(
                 ChatMessage.user_id,
                 func.coalesce(func.sum(input_tokens), 0).label('input_tokens'),
                 func.coalesce(func.sum(output_tokens), 0).label('output_tokens'),
@@ -420,18 +428,18 @@ class ChatMessageTable:
                 ChatMessage.role == 'assistant',
                 ChatMessage.user_id.isnot(None),
                 ChatMessage.usage.isnot(None),
-                ~ChatMessage.user_id.like('shared-%'),
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.group_by(ChatMessage.user_id).all()
+            stmt = stmt.group_by(ChatMessage.user_id)
+            result = await db.execute(stmt)
 
             return {
                 row.user_id: {
@@ -440,88 +448,88 @@ class ChatMessageTable:
                     'total_tokens': row.input_tokens + row.output_tokens,
                     'message_count': row.message_count,
                 }
-                for row in results
+                for row in result.all()
             }
 
-    def get_message_count_by_user(
+    async def get_message_count_by_user(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, int]:
-        with get_db_context(db) as db:
-            from sqlalchemy import func
+        async with get_async_db_context(db) as db:
             from open_webui.models.groups import GroupMember
 
-            query = db.query(ChatMessage.user_id, func.count(ChatMessage.id).label('count')).filter(
-                ~ChatMessage.user_id.like('shared-%')
+            stmt = select(ChatMessage.user_id, func.count(ChatMessage.id).label('count')).filter(
+                ChatMessage.role == 'assistant',
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.group_by(ChatMessage.user_id).all()
-            return {row.user_id: row.count for row in results}
+            stmt = stmt.group_by(ChatMessage.user_id)
+            result = await db.execute(stmt)
+            return {row.user_id: row.count for row in result.all()}
 
-    def get_message_count_by_chat(
+    async def get_message_count_by_chat(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, int]:
-        with get_db_context(db) as db:
-            from sqlalchemy import func
+        async with get_async_db_context(db) as db:
             from open_webui.models.groups import GroupMember
 
-            query = db.query(ChatMessage.chat_id, func.count(ChatMessage.id).label('count')).filter(
-                ~ChatMessage.user_id.like('shared-%')
+            stmt = select(ChatMessage.chat_id, func.count(ChatMessage.id).label('count')).filter(
+                ChatMessage.role == 'assistant',
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.group_by(ChatMessage.chat_id).all()
-            return {row.chat_id: row.count for row in results}
+            stmt = stmt.group_by(ChatMessage.chat_id)
+            result = await db.execute(stmt)
+            return {row.chat_id: row.count for row in result.all()}
 
-    def get_daily_message_counts_by_model(
+    async def get_daily_message_counts_by_model(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
         group_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, dict[str, int]]:
         """Get message counts grouped by day and model."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             from datetime import datetime, timedelta
             from open_webui.models.groups import GroupMember
 
-            query = db.query(ChatMessage.created_at, ChatMessage.model_id).filter(
+            stmt = select(ChatMessage.created_at, ChatMessage.model_id).filter(
                 ChatMessage.role == 'assistant',
                 ChatMessage.model_id.isnot(None),
-                ~ChatMessage.user_id.like('shared-%'),
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
             if group_id:
-                group_users = db.query(GroupMember.user_id).filter(GroupMember.group_id == group_id).subquery()
-                query = query.filter(ChatMessage.user_id.in_(group_users))
+                group_users = select(GroupMember.user_id).filter(GroupMember.group_id == group_id).scalar_subquery()
+                stmt = stmt.filter(ChatMessage.user_id.in_(group_users))
 
-            results = query.all()
+            result = await db.execute(stmt)
+            results = result.all()
 
             # Group by date -> model -> count
             daily_counts: dict[str, dict[str, int]] = {}
@@ -543,28 +551,28 @@ class ChatMessageTable:
 
             return daily_counts
 
-    def get_hourly_message_counts_by_model(
+    async def get_hourly_message_counts_by_model(
         self,
         start_date: Optional[int] = None,
         end_date: Optional[int] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict[str, dict[str, int]]:
         """Get message counts grouped by hour and model."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             from datetime import datetime, timedelta
 
-            query = db.query(ChatMessage.created_at, ChatMessage.model_id).filter(
+            stmt = select(ChatMessage.created_at, ChatMessage.model_id).filter(
                 ChatMessage.role == 'assistant',
                 ChatMessage.model_id.isnot(None),
-                ~ChatMessage.user_id.like('shared-%'),
             )
 
             if start_date:
-                query = query.filter(ChatMessage.created_at >= start_date)
+                stmt = stmt.filter(ChatMessage.created_at >= start_date)
             if end_date:
-                query = query.filter(ChatMessage.created_at <= end_date)
+                stmt = stmt.filter(ChatMessage.created_at <= end_date)
 
-            results = query.all()
+            result = await db.execute(stmt)
+            results = result.all()
 
             # Group by hour -> model -> count
             hourly_counts: dict[str, dict[str, int]] = {}

backend/open_webui/models/feedbacks.py

@@ -3,9 +3,10 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
-from open_webui.models.users import User
+from sqlalchemy import select, delete, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
+from open_webui.models.users import User, UserModel
 
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, Text, JSON, Boolean
@@ -139,10 +140,10 @@ class ModelHistoryResponse(BaseModel):
 
 
 class FeedbackTable:
-    def insert_new_feedback(
-        self, user_id: str, form_data: FeedbackForm, db: Optional[Session] = None
+    async def insert_new_feedback(
+        self, user_id: str, form_data: FeedbackForm, db: Optional[AsyncSession] = None
     ) -> Optional[FeedbackModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             id = str(uuid.uuid4())
             feedback = FeedbackModel(
                 **{
@@ -157,8 +158,8 @@ class FeedbackTable:
             try:
                 result = Feedback(**feedback.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return FeedbackModel.model_validate(result)
                 else:
@@ -167,92 +168,99 @@ class FeedbackTable:
                 log.exception(f'Error creating a new feedback: {e}')
                 return None
 
-    def get_feedback_by_id(self, id: str, db: Optional[Session] = None) -> Optional[FeedbackModel]:
+    async def get_feedback_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[FeedbackModel]:
         try:
-            with get_db_context(db) as db:
-                feedback = db.query(Feedback).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Feedback).filter_by(id=id))
+                feedback = result.scalars().first()
                 if not feedback:
                     return None
                 return FeedbackModel.model_validate(feedback)
         except Exception:
             return None
 
-    def get_feedback_by_id_and_user_id(
-        self, id: str, user_id: str, db: Optional[Session] = None
+    async def get_feedback_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[FeedbackModel]:
         try:
-            with get_db_context(db) as db:
-                feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Feedback).filter_by(id=id, user_id=user_id))
+                feedback = result.scalars().first()
                 if not feedback:
                     return None
                 return FeedbackModel.model_validate(feedback)
         except Exception:
             return None
 
-    def get_feedbacks_by_chat_id(self, chat_id: str, db: Optional[Session] = None) -> list[FeedbackModel]:
+    async def get_feedbacks_by_chat_id(self, chat_id: str, db: Optional[AsyncSession] = None) -> list[FeedbackModel]:
         """Get all feedbacks for a specific chat."""
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # meta.chat_id stores the chat reference
-                feedbacks = (
-                    db.query(Feedback)
+                result = await db.execute(
+                    select(Feedback)
                     .filter(Feedback.meta['chat_id'].as_string() == chat_id)
                     .order_by(Feedback.created_at.desc())
-                    .all()
                 )
+                feedbacks = result.scalars().all()
                 return [FeedbackModel.model_validate(fb) for fb in feedbacks]
         except Exception:
             return []
 
-    def get_feedback_items(
+    async def get_feedback_items(
         self,
         filter: dict = {},
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> FeedbackListResponse:
-        with get_db_context(db) as db:
-            query = db.query(Feedback, User).join(User, Feedback.user_id == User.id)
+        async with get_async_db_context(db) as db:
+            stmt = select(Feedback, User).join(User, Feedback.user_id == User.id)
 
             if filter:
+                # Apply model_id filter (exact match)
+                model_id = filter.get('model_id')
+                if model_id:
+                    stmt = stmt.filter(Feedback.data['model_id'].as_string() == model_id)
+
                 order_by = filter.get('order_by')
                 direction = filter.get('direction')
 
                 if order_by == 'username':
                     if direction == 'asc':
-                        query = query.order_by(User.name.asc())
+                        stmt = stmt.order_by(User.name.asc())
                     else:
-                        query = query.order_by(User.name.desc())
+                        stmt = stmt.order_by(User.name.desc())
                 elif order_by == 'model_id':
-                    # it's stored in feedback.data['model_id']
                     if direction == 'asc':
-                        query = query.order_by(Feedback.data['model_id'].as_string().asc())
+                        stmt = stmt.order_by(Feedback.data['model_id'].as_string().asc())
                     else:
-                        query = query.order_by(Feedback.data['model_id'].as_string().desc())
+                        stmt = stmt.order_by(Feedback.data['model_id'].as_string().desc())
                 elif order_by == 'rating':
-                    # it's stored in feedback.data['rating']
                     if direction == 'asc':
-                        query = query.order_by(Feedback.data['rating'].as_string().asc())
+                        stmt = stmt.order_by(Feedback.data['rating'].as_string().asc())
                     else:
-                        query = query.order_by(Feedback.data['rating'].as_string().desc())
+                        stmt = stmt.order_by(Feedback.data['rating'].as_string().desc())
                 elif order_by == 'updated_at':
                     if direction == 'asc':
-                        query = query.order_by(Feedback.updated_at.asc())
+                        stmt = stmt.order_by(Feedback.updated_at.asc())
                     else:
-                        query = query.order_by(Feedback.updated_at.desc())
+                        stmt = stmt.order_by(Feedback.updated_at.desc())
 
             else:
-                query = query.order_by(Feedback.created_at.desc())
+                stmt = stmt.order_by(Feedback.created_at.desc())
 
             # Count BEFORE pagination
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
             if skip:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit:
-                query = query.limit(limit)
+                stmt = stmt.limit(limit)
 
-            items = query.all()
+            result = await db.execute(stmt)
+            items = result.all()
 
             feedbacks = []
             for feedback, user in items:
@@ -262,15 +270,18 @@ class FeedbackTable:
 
             return FeedbackListResponse(items=feedbacks, total=total)
 
-    def get_all_feedbacks(self, db: Optional[Session] = None) -> list[FeedbackModel]:
-        with get_db_context(db) as db:
-            return [
-                FeedbackModel.model_validate(feedback)
-                for feedback in db.query(Feedback).order_by(Feedback.updated_at.desc()).all()
-            ]
+    async def get_all_feedbacks(self, db: Optional[AsyncSession] = None) -> list[FeedbackModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).order_by(Feedback.updated_at.desc()))
+            return [FeedbackModel.model_validate(feedback) for feedback in result.scalars().all()]
 
-    def get_all_feedback_ids(self, db: Optional[Session] = None) -> list[FeedbackIdResponse]:
-        with get_db_context(db) as db:
+    async def get_all_feedback_ids(self, db: Optional[AsyncSession] = None) -> list[FeedbackIdResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Feedback.id, Feedback.user_id, Feedback.created_at, Feedback.updated_at).order_by(
+                    Feedback.updated_at.desc()
+                )
+            )
             return [
                 FeedbackIdResponse(
                     id=row.id,
@@ -278,25 +289,28 @@ class FeedbackTable:
                     created_at=row.created_at,
                     updated_at=row.updated_at,
                 )
-                for row in db.query(
-                    Feedback.id,
-                    Feedback.user_id,
-                    Feedback.created_at,
-                    Feedback.updated_at,
-                )
-                .order_by(Feedback.updated_at.desc())
-                .all()
+                for row in result.all()
             ]
 
-    def get_feedbacks_for_leaderboard(self, db: Optional[Session] = None) -> list[LeaderboardFeedbackData]:
+    async def get_distinct_model_ids(self, db: Optional[AsyncSession] = None) -> list[str]:
+        """Get distinct model_ids from feedback data for filter dropdowns."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Feedback.data['model_id'].as_string())
+                .filter(Feedback.data['model_id'].as_string().isnot(None))
+                .distinct()
+            )
+            rows = result.all()
+            return sorted([row[0] for row in rows if row[0]])
+
+    async def get_feedbacks_for_leaderboard(self, db: Optional[AsyncSession] = None) -> list[LeaderboardFeedbackData]:
         """Fetch only id and data for leaderboard computation (excludes snapshot/meta)."""
-        with get_db_context(db) as db:
-            return [
-                LeaderboardFeedbackData(id=row.id, data=row.data) for row in db.query(Feedback.id, Feedback.data).all()
-            ]
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback.id, Feedback.data))
+            return [LeaderboardFeedbackData(id=row.id, data=row.data) for row in result.all()]
 
-    def get_model_evaluation_history(
-        self, model_id: str, days: int = 30, db: Optional[Session] = None
+    async def get_model_evaluation_history(
+        self, model_id: str, days: int = 30, db: Optional[AsyncSession] = None
     ) -> list[ModelHistoryEntry]:
         """
         Get daily wins/losses for a specific model over the past N days.
@@ -306,13 +320,16 @@ class FeedbackTable:
         from datetime import datetime, timedelta
         from collections import defaultdict
 
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             if days == 0:
                 # All time - no cutoff
-                rows = db.query(Feedback.created_at, Feedback.data).all()
+                result = await db.execute(select(Feedback.created_at, Feedback.data))
             else:
                 cutoff = int(time.time()) - (days * 86400)
-                rows = db.query(Feedback.created_at, Feedback.data).filter(Feedback.created_at >= cutoff).all()
+                result = await db.execute(
+                    select(Feedback.created_at, Feedback.data).filter(Feedback.created_at >= cutoff)
+                )
+            rows = result.all()
 
         daily_counts = defaultdict(lambda: {'won': 0, 'lost': 0})
         first_date = None
@@ -358,25 +375,22 @@ class FeedbackTable:
 
         return result
 
-    def get_feedbacks_by_type(self, type: str, db: Optional[Session] = None) -> list[FeedbackModel]:
-        with get_db_context(db) as db:
-            return [
-                FeedbackModel.model_validate(feedback)
-                for feedback in db.query(Feedback).filter_by(type=type).order_by(Feedback.updated_at.desc()).all()
-            ]
+    async def get_feedbacks_by_type(self, type: str, db: Optional[AsyncSession] = None) -> list[FeedbackModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(type=type).order_by(Feedback.updated_at.desc()))
+            return [FeedbackModel.model_validate(feedback) for feedback in result.scalars().all()]
 
-    def get_feedbacks_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[FeedbackModel]:
-        with get_db_context(db) as db:
-            return [
-                FeedbackModel.model_validate(feedback)
-                for feedback in db.query(Feedback).filter_by(user_id=user_id).order_by(Feedback.updated_at.desc()).all()
-            ]
+    async def get_feedbacks_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[FeedbackModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(user_id=user_id).order_by(Feedback.updated_at.desc()))
+            return [FeedbackModel.model_validate(feedback) for feedback in result.scalars().all()]
 
-    def update_feedback_by_id(
-        self, id: str, form_data: FeedbackForm, db: Optional[Session] = None
+    async def update_feedback_by_id(
+        self, id: str, form_data: FeedbackForm, db: Optional[AsyncSession] = None
     ) -> Optional[FeedbackModel]:
-        with get_db_context(db) as db:
-            feedback = db.query(Feedback).filter_by(id=id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(id=id))
+            feedback = result.scalars().first()
             if not feedback:
                 return None
 
@@ -389,18 +403,19 @@ class FeedbackTable:
 
             feedback.updated_at = int(time.time())
 
-            db.commit()
+            await db.commit()
             return FeedbackModel.model_validate(feedback)
 
-    def update_feedback_by_id_and_user_id(
+    async def update_feedback_by_id_and_user_id(
         self,
         id: str,
         user_id: str,
         form_data: FeedbackForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FeedbackModel]:
-        with get_db_context(db) as db:
-            feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(id=id, user_id=user_id))
+            feedback = result.scalars().first()
             if not feedback:
                 return None
 
@@ -413,38 +428,40 @@ class FeedbackTable:
 
             feedback.updated_at = int(time.time())
 
-            db.commit()
+            await db.commit()
             return FeedbackModel.model_validate(feedback)
 
-    def delete_feedback_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            feedback = db.query(Feedback).filter_by(id=id).first()
+    async def delete_feedback_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(id=id))
+            feedback = result.scalars().first()
             if not feedback:
                 return False
-            db.delete(feedback)
-            db.commit()
+            await db.delete(feedback)
+            await db.commit()
             return True
 
-    def delete_feedback_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            feedback = db.query(Feedback).filter_by(id=id, user_id=user_id).first()
+    async def delete_feedback_by_id_and_user_id(self, id: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Feedback).filter_by(id=id, user_id=user_id))
+            feedback = result.scalars().first()
             if not feedback:
                 return False
-            db.delete(feedback)
-            db.commit()
+            await db.delete(feedback)
+            await db.commit()
             return True
 
-    def delete_feedbacks_by_user_id(self, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            result = db.query(Feedback).filter_by(user_id=user_id).delete()
-            db.commit()
-            return result > 0
+    async def delete_feedbacks_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(delete(Feedback).filter_by(user_id=user_id))
+            await db.commit()
+            return result.rowcount > 0
 
-    def delete_all_feedbacks(self, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            result = db.query(Feedback).delete()
-            db.commit()
-            return result > 0
+    async def delete_all_feedbacks(self, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(delete(Feedback))
+            await db.commit()
+            return result.rowcount > 0
 
 
 Feedbacks = FeedbackTable()

backend/open_webui/models/files.py

@@ -2,8 +2,9 @@ import logging
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.utils.misc import sanitize_metadata
 from pydantic import BaseModel, ConfigDict, model_validator
 from sqlalchemy import BigInteger, Column, String, Text, JSON
@@ -124,8 +125,10 @@ class FileUpdateForm(BaseModel):
 
 
 class FilesTable:
-    def insert_new_file(self, user_id: str, form_data: FileForm, db: Optional[Session] = None) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+    async def insert_new_file(
+        self, user_id: str, form_data: FileForm, db: Optional[AsyncSession] = None
+    ) -> Optional[FileModel]:
+        async with get_async_db_context(db) as db:
             file_data = form_data.model_dump()
 
             # Sanitize meta to remove non-JSON-serializable objects
@@ -145,8 +148,8 @@ class FilesTable:
             try:
                 result = File(**file.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return FileModel.model_validate(result)
                 else:
@@ -155,21 +158,24 @@ class FilesTable:
                 log.exception(f'Error inserting a new file: {e}')
                 return None
 
-    def get_file_by_id(self, id: str, db: Optional[Session] = None) -> Optional[FileModel]:
+    async def get_file_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[FileModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 try:
-                    file = db.get(File, id)
-                    return FileModel.model_validate(file)
+                    file = await db.get(File, id)
+                    return FileModel.model_validate(file) if file else None
                 except Exception:
                     return None
         except Exception:
             return None
 
-    def get_file_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+    async def get_file_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[FileModel]:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.query(File).filter_by(id=id, user_id=user_id).first()
+                result = await db.execute(select(File).filter_by(id=id, user_id=user_id))
+                file = result.scalars().first()
                 if file:
                     return FileModel.model_validate(file)
                 else:
@@ -177,10 +183,14 @@ class FilesTable:
             except Exception:
                 return None
 
-    def get_file_metadata_by_id(self, id: str, db: Optional[Session] = None) -> Optional[FileMetadataResponse]:
-        with get_db_context(db) as db:
+    async def get_file_metadata_by_id(
+        self, id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[FileMetadataResponse]:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.get(File, id)
+                file = await db.get(File, id)
+                if not file:
+                    return None
                 return FileMetadataResponse(
                     id=file.id,
                     hash=file.hash,
@@ -191,12 +201,13 @@ class FilesTable:
             except Exception:
                 return None
 
-    def get_files(self, db: Optional[Session] = None) -> list[FileModel]:
-        with get_db_context(db) as db:
-            return [FileModel.model_validate(file) for file in db.query(File).all()]
+    async def get_files(self, db: Optional[AsyncSession] = None) -> list[FileModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(File))
+            return [FileModel.model_validate(file) for file in result.scalars().all()]
 
-    def check_access_by_user_id(self, id, user_id, permission='write', db: Optional[Session] = None) -> bool:
-        file = self.get_file_by_id(id, db=db)
+    async def check_access_by_user_id(self, id, user_id, permission='write', db: Optional[AsyncSession] = None) -> bool:
+        file = await self.get_file_by_id(id, db=db)
         if not file:
             return False
         if file.user_id == user_id:
@@ -204,51 +215,53 @@ class FilesTable:
         # Implement additional access control logic here as needed
         return False
 
-    def get_files_by_ids(self, ids: list[str], db: Optional[Session] = None) -> list[FileModel]:
-        with get_db_context(db) as db:
-            return [
-                FileModel.model_validate(file)
-                for file in db.query(File).filter(File.id.in_(ids)).order_by(File.updated_at.desc()).all()
-            ]
+    async def get_files_by_ids(self, ids: list[str], db: Optional[AsyncSession] = None) -> list[FileModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(File).filter(File.id.in_(ids)).order_by(File.updated_at.desc()))
+            return [FileModel.model_validate(file) for file in result.scalars().all()]
 
-    def get_file_metadatas_by_ids(self, ids: list[str], db: Optional[Session] = None) -> list[FileMetadataResponse]:
-        with get_db_context(db) as db:
-            return [
-                FileMetadataResponse(
-                    id=file.id,
-                    hash=file.hash,
-                    meta=file.meta,
-                    created_at=file.created_at,
-                    updated_at=file.updated_at,
-                )
-                for file in db.query(File.id, File.hash, File.meta, File.created_at, File.updated_at)
+    async def get_file_metadatas_by_ids(
+        self, ids: list[str], db: Optional[AsyncSession] = None
+    ) -> list[FileMetadataResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(File.id, File.hash, File.meta, File.created_at, File.updated_at)
                 .filter(File.id.in_(ids))
                 .order_by(File.updated_at.desc())
-                .all()
+            )
+            return [
+                FileMetadataResponse(
+                    id=row.id,
+                    hash=row.hash,
+                    meta=row.meta,
+                    created_at=row.created_at,
+                    updated_at=row.updated_at,
+                )
+                for row in result.all()
             ]
 
-    def get_files_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[FileModel]:
-        with get_db_context(db) as db:
-            return [FileModel.model_validate(file) for file in db.query(File).filter_by(user_id=user_id).all()]
+    async def get_files_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[FileModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(File).filter_by(user_id=user_id))
+            return [FileModel.model_validate(file) for file in result.scalars().all()]
 
-    def get_file_list(
+    async def get_file_list(
         self,
         user_id: Optional[str] = None,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> 'FileListResponse':
-        with get_db_context(db) as db:
-            query = db.query(File)
+        async with get_async_db_context(db) as db:
+            stmt = select(File)
             if user_id:
-                query = query.filter_by(user_id=user_id)
+                stmt = stmt.filter_by(user_id=user_id)
 
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
-            items = [
-                FileModelResponse.model_validate(file, from_attributes=True)
-                for file in query.order_by(File.updated_at.desc(), File.id.desc()).offset(skip).limit(limit).all()
-            ]
+            result = await db.execute(stmt.order_by(File.updated_at.desc(), File.id.desc()).offset(skip).limit(limit))
+            items = [FileModelResponse.model_validate(file, from_attributes=True) for file in result.scalars().all()]
 
             return FileListResponse(items=items, total=total)
 
@@ -275,13 +288,13 @@ class FilesTable:
         pattern = pattern.replace('?', '_')
         return pattern
 
-    def search_files(
+    async def search_files(
         self,
         user_id: Optional[str] = None,
         filename: str = '*',
         skip: int = 0,
         limit: int = 100,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[FileModel]:
         """
         Search files with glob pattern matching, optional user filter, and pagination.
@@ -296,27 +309,26 @@ class FilesTable:
         Returns:
             List of matching FileModel objects, ordered by created_at descending.
         """
-        with get_db_context(db) as db:
-            query = db.query(File)
+        async with get_async_db_context(db) as db:
+            stmt = select(File)
 
             if user_id:
-                query = query.filter_by(user_id=user_id)
+                stmt = stmt.filter_by(user_id=user_id)
 
             pattern = self._glob_to_like_pattern(filename)
             if pattern != '%':
-                query = query.filter(File.filename.ilike(pattern, escape='\\'))
+                stmt = stmt.filter(File.filename.ilike(pattern, escape='\\'))
 
-            return [
-                FileModel.model_validate(file)
-                for file in query.order_by(File.created_at.desc(), File.id.desc()).offset(skip).limit(limit).all()
-            ]
+            result = await db.execute(stmt.order_by(File.created_at.desc(), File.id.desc()).offset(skip).limit(limit))
+            return [FileModel.model_validate(file) for file in result.scalars().all()]
 
-    def update_file_by_id(
-        self, id: str, form_data: FileUpdateForm, db: Optional[Session] = None
+    async def update_file_by_id(
+        self, id: str, form_data: FileUpdateForm, db: Optional[AsyncSession] = None
     ) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.query(File).filter_by(id=id).first()
+                result = await db.execute(select(File).filter_by(id=id))
+                file = result.scalars().first()
 
                 if form_data.hash is not None:
                     file.hash = form_data.hash
@@ -328,63 +340,70 @@ class FilesTable:
                     file.meta = {**(file.meta if file.meta else {}), **form_data.meta}
 
                 file.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
                 return FileModel.model_validate(file)
             except Exception as e:
                 log.exception(f'Error updating file completely by id: {e}')
                 return None
 
-    def update_file_hash_by_id(self, id: str, hash: Optional[str], db: Optional[Session] = None) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+    async def update_file_hash_by_id(
+        self, id: str, hash: Optional[str], db: Optional[AsyncSession] = None
+    ) -> Optional[FileModel]:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.query(File).filter_by(id=id).first()
+                result = await db.execute(select(File).filter_by(id=id))
+                file = result.scalars().first()
                 file.hash = hash
                 file.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
 
                 return FileModel.model_validate(file)
             except Exception:
                 return None
 
-    def update_file_data_by_id(self, id: str, data: dict, db: Optional[Session] = None) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+    async def update_file_data_by_id(
+        self, id: str, data: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[FileModel]:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.query(File).filter_by(id=id).first()
+                result = await db.execute(select(File).filter_by(id=id))
+                file = result.scalars().first()
                 file.data = {**(file.data if file.data else {}), **data}
                 file.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
                 return FileModel.model_validate(file)
             except Exception as e:
                 return None
 
-    def update_file_metadata_by_id(self, id: str, meta: dict, db: Optional[Session] = None) -> Optional[FileModel]:
-        with get_db_context(db) as db:
+    async def update_file_metadata_by_id(
+        self, id: str, meta: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[FileModel]:
+        async with get_async_db_context(db) as db:
             try:
-                file = db.query(File).filter_by(id=id).first()
+                result = await db.execute(select(File).filter_by(id=id))
+                file = result.scalars().first()
                 file.meta = {**(file.meta if file.meta else {}), **meta}
                 file.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
                 return FileModel.model_validate(file)
             except Exception:
                 return None
 
-                return False
-
-    def delete_file_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_file_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(File).filter_by(id=id).delete()
-                db.commit()
+                await db.execute(delete(File).filter_by(id=id))
+                await db.commit()
 
                 return True
             except Exception:
                 return False
 
-    def delete_all_files(self, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_all_files(self, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(File).delete()
-                db.commit()
+                await db.execute(delete(File))
+                await db.commit()
 
                 return True
             except Exception:

backend/open_webui/models/folders.py

@@ -6,10 +6,10 @@ import re
 
 
 from pydantic import BaseModel, ConfigDict
-from sqlalchemy import BigInteger, Column, Text, JSON, Boolean, func
-from sqlalchemy.orm import Session
+from sqlalchemy import BigInteger, Column, Text, JSON, Boolean, func, select, delete
+from sqlalchemy.ext.asyncio import AsyncSession
 
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 
 log = logging.getLogger(__name__)
 
@@ -74,25 +74,25 @@ class FolderForm(BaseModel):
     data: Optional[dict] = None
     meta: Optional[dict] = None
     parent_id: Optional[str] = None
-    model_config = ConfigDict(extra='allow')
+    model_config = ConfigDict(extra='forbid')
 
 
 class FolderUpdateForm(BaseModel):
     name: Optional[str] = None
     data: Optional[dict] = None
     meta: Optional[dict] = None
-    model_config = ConfigDict(extra='allow')
+    model_config = ConfigDict(extra='forbid')
 
 
 class FolderTable:
-    def insert_new_folder(
+    async def insert_new_folder(
         self,
         user_id: str,
         form_data: FolderForm,
         parent_id: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FolderModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             id = str(uuid.uuid4())
             folder = FolderModel(
                 **{
@@ -107,8 +107,8 @@ class FolderTable:
             try:
                 result = Folder(**folder.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return FolderModel.model_validate(result)
                 else:
@@ -117,12 +117,13 @@ class FolderTable:
                 log.exception(f'Error inserting a new folder: {e}')
                 return None
 
-    def get_folder_by_id_and_user_id(
-        self, id: str, user_id: str, db: Optional[Session] = None
+    async def get_folder_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[FolderModel]:
         try:
-            with get_db_context(db) as db:
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
 
                 if not folder:
                     return None
@@ -131,48 +132,48 @@ class FolderTable:
         except Exception:
             return None
 
-    def get_children_folders_by_id_and_user_id(
-        self, id: str, user_id: str, db: Optional[Session] = None
+    async def get_children_folders_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[list[FolderModel]]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 folders = []
 
-                def get_children(folder):
-                    children = self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)
+                async def get_children(folder):
+                    children = await self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)
                     for child in children:
-                        get_children(child)
+                        await get_children(child)
                         folders.append(child)
 
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
                 if not folder:
                     return None
 
-                get_children(folder)
+                await get_children(folder)
                 return folders
         except Exception:
             return None
 
-    def get_folders_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[FolderModel]:
-        with get_db_context(db) as db:
-            return [FolderModel.model_validate(folder) for folder in db.query(Folder).filter_by(user_id=user_id).all()]
+    async def get_folders_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[FolderModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Folder).filter_by(user_id=user_id))
+            return [FolderModel.model_validate(folder) for folder in result.scalars().all()]
 
-    def get_folder_by_parent_id_and_user_id_and_name(
+    async def get_folder_by_parent_id_and_user_id_and_name(
         self,
         parent_id: Optional[str],
         user_id: str,
         name: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Check if folder exists
-                folder = (
-                    db.query(Folder)
-                    .filter_by(parent_id=parent_id, user_id=user_id)
-                    .filter(Folder.name.ilike(name))
-                    .first()
+                result = await db.execute(
+                    select(Folder).filter_by(parent_id=parent_id, user_id=user_id).filter(Folder.name.ilike(name))
                 )
+                folder = result.scalars().first()
 
                 if not folder:
                     return None
@@ -182,25 +183,24 @@ class FolderTable:
             log.error(f'get_folder_by_parent_id_and_user_id_and_name: {e}')
             return None
 
-    def get_folders_by_parent_id_and_user_id(
-        self, parent_id: Optional[str], user_id: str, db: Optional[Session] = None
+    async def get_folders_by_parent_id_and_user_id(
+        self, parent_id: Optional[str], user_id: str, db: Optional[AsyncSession] = None
     ) -> list[FolderModel]:
-        with get_db_context(db) as db:
-            return [
-                FolderModel.model_validate(folder)
-                for folder in db.query(Folder).filter_by(parent_id=parent_id, user_id=user_id).all()
-            ]
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Folder).filter_by(parent_id=parent_id, user_id=user_id))
+            return [FolderModel.model_validate(folder) for folder in result.scalars().all()]
 
-    def update_folder_parent_id_by_id_and_user_id(
+    async def update_folder_parent_id_by_id_and_user_id(
         self,
         id: str,
         user_id: str,
         parent_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db_context(db) as db:
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
 
                 if not folder:
                     return None
@@ -208,38 +208,38 @@ class FolderTable:
                 folder.parent_id = parent_id
                 folder.updated_at = int(time.time())
 
-                db.commit()
+                await db.commit()
 
                 return FolderModel.model_validate(folder)
         except Exception as e:
             log.error(f'update_folder: {e}')
             return
 
-    def update_folder_by_id_and_user_id(
+    async def update_folder_by_id_and_user_id(
         self,
         id: str,
         user_id: str,
         form_data: FolderUpdateForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FolderModel]:
         try:
-            with get_db_context(db) as db:
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
 
                 if not folder:
                     return None
 
                 form_data = form_data.model_dump(exclude_unset=True)
 
-                existing_folder = (
-                    db.query(Folder)
-                    .filter_by(
+                existing_result = await db.execute(
+                    select(Folder).filter_by(
                         name=form_data.get('name'),
                         parent_id=folder.parent_id,
                         user_id=user_id,
                     )
-                    .first()
                 )
+                existing_folder = existing_result.scalars().first()
 
                 if existing_folder and existing_folder.id != id:
                     return None
@@ -258,19 +258,20 @@ class FolderTable:
                     }
 
                 folder.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
 
                 return FolderModel.model_validate(folder)
         except Exception as e:
             log.error(f'update_folder: {e}')
             return
 
-    def update_folder_is_expanded_by_id_and_user_id(
-        self, id: str, user_id: str, is_expanded: bool, db: Optional[Session] = None
+    async def update_folder_is_expanded_by_id_and_user_id(
+        self, id: str, user_id: str, is_expanded: bool, db: Optional[AsyncSession] = None
     ) -> Optional[FolderModel]:
         try:
-            with get_db_context(db) as db:
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
 
                 if not folder:
                     return None
@@ -278,37 +279,41 @@ class FolderTable:
                 folder.is_expanded = is_expanded
                 folder.updated_at = int(time.time())
 
-                db.commit()
+                await db.commit()
 
                 return FolderModel.model_validate(folder)
         except Exception as e:
             log.error(f'update_folder: {e}')
             return
 
-    def delete_folder_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> list[str]:
+    async def delete_folder_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> list[str]:
         try:
             folder_ids = []
-            with get_db_context(db) as db:
-                folder = db.query(Folder).filter_by(id=id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Folder).filter_by(id=id, user_id=user_id))
+                folder = result.scalars().first()
                 if not folder:
                     return folder_ids
 
                 folder_ids.append(folder.id)
 
                 # Delete all children folders
-                def delete_children(folder):
-                    folder_children = self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)
+                async def delete_children(folder):
+                    folder_children = await self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)
                     for folder_child in folder_children:
-                        delete_children(folder_child)
+                        await delete_children(folder_child)
                         folder_ids.append(folder_child.id)
 
-                        folder = db.query(Folder).filter_by(id=folder_child.id).first()
-                        db.delete(folder)
-                        db.commit()
+                        child_result = await db.execute(select(Folder).filter_by(id=folder_child.id))
+                        child_folder = child_result.scalars().first()
+                        await db.delete(child_folder)
+                        await db.commit()
 
-                delete_children(folder)
-                db.delete(folder)
-                db.commit()
+                await delete_children(folder)
+                await db.delete(folder)
+                await db.commit()
                 return folder_ids
         except Exception as e:
             log.error(f'delete_folder: {e}')
@@ -319,8 +324,8 @@ class FolderTable:
         name = re.sub(r'[\s_]+', ' ', name)
         return name.strip().lower()
 
-    def search_folders_by_names(
-        self, user_id: str, queries: list[str], db: Optional[Session] = None
+    async def search_folders_by_names(
+        self, user_id: str, queries: list[str], db: Optional[AsyncSession] = None
     ) -> list[FolderModel]:
         """
         Search for folders for a user where the name matches any of the queries, treating _ and space as equivalent, case-insensitive.
@@ -330,16 +335,18 @@ class FolderTable:
             return []
 
         results = {}
-        with get_db_context(db) as db:
-            folders = db.query(Folder).filter_by(user_id=user_id).all()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Folder).filter_by(user_id=user_id))
+            folders = result.scalars().all()
             for folder in folders:
                 if self.normalize_folder_name(folder.name) in normalized_queries:
                     results[folder.id] = FolderModel.model_validate(folder)
 
                     # get children folders
-                    children = self.get_children_folders_by_id_and_user_id(folder.id, user_id, db=db)
-                    for child in children:
-                        results[child.id] = child
+                    children = await self.get_children_folders_by_id_and_user_id(folder.id, user_id, db=db)
+                    if children:
+                        for child in children:
+                            results[child.id] = child
 
         # Return the results as a list
         if not results:
@@ -348,16 +355,17 @@ class FolderTable:
             results = list(results.values())
             return results
 
-    def search_folders_by_name_contains(
-        self, user_id: str, query: str, db: Optional[Session] = None
+    async def search_folders_by_name_contains(
+        self, user_id: str, query: str, db: Optional[AsyncSession] = None
     ) -> list[FolderModel]:
         """
         Partial match: normalized name contains (as substring) the normalized query.
         """
         normalized_query = self.normalize_folder_name(query)
         results = []
-        with get_db_context(db) as db:
-            folders = db.query(Folder).filter_by(user_id=user_id).all()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Folder).filter_by(user_id=user_id))
+            folders = result.scalars().all()
             for folder in folders:
                 norm_name = self.normalize_folder_name(folder.name)
                 if normalized_query in norm_name:

backend/open_webui/models/functions.py

@@ -2,8 +2,9 @@ import logging
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session, defer
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.users import Users, UserModel, UserResponse
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Boolean, Column, String, Text, Index
@@ -107,12 +108,12 @@ class FunctionValves(BaseModel):
 
 
 class FunctionsTable:
-    def insert_new_function(
+    async def insert_new_function(
         self,
         user_id: str,
         type: str,
         form_data: FunctionForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[FunctionModel]:
         function = FunctionModel(
             **{
@@ -125,11 +126,11 @@ class FunctionsTable:
         )
 
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 result = Function(**function.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return FunctionModel.model_validate(result)
                 else:
@@ -138,17 +139,18 @@ class FunctionsTable:
             log.exception(f'Error creating a new function: {e}')
             return None
 
-    def sync_functions(
+    async def sync_functions(
         self,
         user_id: str,
         functions: list[FunctionWithValvesModel],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[FunctionWithValvesModel]:
         # Synchronize functions for a user by updating existing ones, inserting new ones, and removing those that are no longer present.
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Get existing functions
-                existing_functions = db.query(Function).all()
+                result = await db.execute(select(Function))
+                existing_functions = result.scalars().all()
                 existing_ids = {func.id for func in existing_functions}
 
                 # Prepare a set of new function IDs
@@ -157,12 +159,14 @@ class FunctionsTable:
                 # Update or insert functions
                 for func in functions:
                     if func.id in existing_ids:
-                        db.query(Function).filter_by(id=func.id).update(
-                            {
+                        await db.execute(
+                            update(Function)
+                            .filter_by(id=func.id)
+                            .values(
                                 **func.model_dump(),
-                                'user_id': user_id,
-                                'updated_at': int(time.time()),
-                            }
+                                user_id=user_id,
+                                updated_at=int(time.time()),
+                            )
                         )
                     else:
                         new_func = Function(
@@ -177,24 +181,25 @@ class FunctionsTable:
                 # Remove functions that are no longer present
                 for func in existing_functions:
                     if func.id not in new_function_ids:
-                        db.delete(func)
+                        await db.delete(func)
 
-                db.commit()
+                await db.commit()
 
-                return [FunctionModel.model_validate(func) for func in db.query(Function).all()]
+                result = await db.execute(select(Function))
+                return [FunctionModel.model_validate(func) for func in result.scalars().all()]
         except Exception as e:
             log.exception(f'Error syncing functions for user {user_id}: {e}')
             return []
 
-    def get_function_by_id(self, id: str, db: Optional[Session] = None) -> Optional[FunctionModel]:
+    async def get_function_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[FunctionModel]:
         try:
-            with get_db_context(db) as db:
-                function = db.get(Function, id)
-                return FunctionModel.model_validate(function)
+            async with get_async_db_context(db) as db:
+                function = await db.get(Function, id)
+                return FunctionModel.model_validate(function) if function else None
         except Exception:
             return None
 
-    def get_functions_by_ids(self, ids: list[str], db: Optional[Session] = None) -> list[FunctionModel]:
+    async def get_functions_by_ids(self, ids: list[str], db: Optional[AsyncSession] = None) -> list[FunctionModel]:
         """
         Batch fetch multiple functions by their IDs in a single query.
         Returns functions in the same order as the input IDs (None entries filtered out).
@@ -202,8 +207,9 @@ class FunctionsTable:
         if not ids:
             return []
         try:
-            with get_db_context(db) as db:
-                functions = db.query(Function).filter(Function.id.in_(ids)).all()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Function).filter(Function.id.in_(ids)))
+                functions = result.scalars().all()
                 # Create a dict for O(1) lookup
                 func_dict = {f.id: FunctionModel.model_validate(f) for f in functions}
                 # Return in original order, filtering out any not found
@@ -211,27 +217,29 @@ class FunctionsTable:
         except Exception:
             return []
 
-    def get_functions(
-        self, active_only=False, include_valves=False, db: Optional[Session] = None
+    async def get_functions(
+        self, active_only=False, include_valves=False, db: Optional[AsyncSession] = None
     ) -> list[FunctionModel | FunctionWithValvesModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             if active_only:
-                functions = db.query(Function).filter_by(is_active=True).all()
-
+                result = await db.execute(select(Function).filter_by(is_active=True))
             else:
-                functions = db.query(Function).all()
+                result = await db.execute(select(Function))
+
+            functions = result.scalars().all()
 
             if include_valves:
                 return [FunctionWithValvesModel.model_validate(function) for function in functions]
             else:
                 return [FunctionModel.model_validate(function) for function in functions]
 
-    def get_function_list(self, db: Optional[Session] = None) -> list[FunctionUserResponse]:
-        with get_db_context(db) as db:
-            functions = db.query(Function).options(defer(Function.content)).order_by(Function.updated_at.desc()).all()
+    async def get_function_list(self, db: Optional[AsyncSession] = None) -> list[FunctionUserResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Function).order_by(Function.updated_at.desc()))
+            functions = result.scalars().all()
             user_ids = list(set(func.user_id for func in functions))
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
 
             return [
@@ -253,42 +261,36 @@ class FunctionsTable:
                 for func in functions
             ]
 
-    def get_functions_by_type(self, type: str, active_only=False, db: Optional[Session] = None) -> list[FunctionModel]:
-        with get_db_context(db) as db:
+    async def get_functions_by_type(
+        self, type: str, active_only=False, db: Optional[AsyncSession] = None
+    ) -> list[FunctionModel]:
+        async with get_async_db_context(db) as db:
             if active_only:
-                return [
-                    FunctionModel.model_validate(function)
-                    for function in db.query(Function).filter_by(type=type, is_active=True).all()
-                ]
+                result = await db.execute(select(Function).filter_by(type=type, is_active=True))
             else:
-                return [
-                    FunctionModel.model_validate(function) for function in db.query(Function).filter_by(type=type).all()
-                ]
+                result = await db.execute(select(Function).filter_by(type=type))
+            return [FunctionModel.model_validate(function) for function in result.scalars().all()]
 
-    def get_global_filter_functions(self, db: Optional[Session] = None) -> list[FunctionModel]:
-        with get_db_context(db) as db:
-            return [
-                FunctionModel.model_validate(function)
-                for function in db.query(Function).filter_by(type='filter', is_active=True, is_global=True).all()
-            ]
+    async def get_global_filter_functions(self, db: Optional[AsyncSession] = None) -> list[FunctionModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Function).filter_by(type='filter', is_active=True, is_global=True))
+            return [FunctionModel.model_validate(function) for function in result.scalars().all()]
 
-    def get_global_action_functions(self, db: Optional[Session] = None) -> list[FunctionModel]:
-        with get_db_context(db) as db:
-            return [
-                FunctionModel.model_validate(function)
-                for function in db.query(Function).filter_by(type='action', is_active=True, is_global=True).all()
-            ]
+    async def get_global_action_functions(self, db: Optional[AsyncSession] = None) -> list[FunctionModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Function).filter_by(type='action', is_active=True, is_global=True))
+            return [FunctionModel.model_validate(function) for function in result.scalars().all()]
 
-    def get_function_valves_by_id(self, id: str, db: Optional[Session] = None) -> Optional[dict]:
-        with get_db_context(db) as db:
+    async def get_function_valves_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[dict]:
+        async with get_async_db_context(db) as db:
             try:
-                function = db.get(Function, id)
+                function = await db.get(Function, id)
                 return function.valves if function.valves else {}
             except Exception as e:
                 log.exception(f'Error getting function valves by id {id}: {e}')
                 return None
 
-    def get_function_valves_by_ids(self, ids: list[str], db: Optional[Session] = None) -> dict[str, dict]:
+    async def get_function_valves_by_ids(self, ids: list[str], db: Optional[AsyncSession] = None) -> dict[str, dict]:
         """
         Batch fetch valves for multiple functions in a single query.
         Returns a dict mapping function_id -> valves dict.
@@ -297,33 +299,34 @@ class FunctionsTable:
         if not ids:
             return {}
         try:
-            with get_db_context(db) as db:
-                functions = db.query(Function.id, Function.valves).filter(Function.id.in_(ids)).all()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Function.id, Function.valves).filter(Function.id.in_(ids)))
+                functions = result.all()
                 return {f.id: (f.valves if f.valves else {}) for f in functions}
         except Exception as e:
             log.exception(f'Error batch-fetching function valves: {e}')
             return {}
 
-    def update_function_valves_by_id(
-        self, id: str, valves: dict, db: Optional[Session] = None
+    async def update_function_valves_by_id(
+        self, id: str, valves: dict, db: Optional[AsyncSession] = None
     ) -> Optional[FunctionValves]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
-                function = db.get(Function, id)
+                function = await db.get(Function, id)
                 function.valves = valves
                 function.updated_at = int(time.time())
-                db.commit()
-                db.refresh(function)
+                await db.commit()
+                await db.refresh(function)
                 return FunctionModel.model_validate(function)
             except Exception:
                 return None
 
-    def update_function_metadata_by_id(
-        self, id: str, metadata: dict, db: Optional[Session] = None
+    async def update_function_metadata_by_id(
+        self, id: str, metadata: dict, db: Optional[AsyncSession] = None
     ) -> Optional[FunctionModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
-                function = db.get(Function, id)
+                function = await db.get(Function, id)
 
                 if function:
                     if function.meta:
@@ -332,8 +335,8 @@ class FunctionsTable:
                         function.meta = metadata
 
                     function.updated_at = int(time.time())
-                    db.commit()
-                    db.refresh(function)
+                    await db.commit()
+                    await db.refresh(function)
                     return FunctionModel.model_validate(function)
                 else:
                     return None
@@ -341,9 +344,11 @@ class FunctionsTable:
                 log.exception(f'Error updating function metadata by id {id}: {e}')
                 return None
 
-    def get_user_valves_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> Optional[dict]:
+    async def get_user_valves_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id, db=db)
+            user = await Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "functions" and "valves" settings
@@ -357,11 +362,11 @@ class FunctionsTable:
             log.exception(f'Error getting user values by id {id} and user id {user_id}')
             return None
 
-    def update_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str, valves: dict, db: Optional[Session] = None
+    async def update_user_valves_by_id_and_user_id(
+        self, id: str, user_id: str, valves: dict, db: Optional[AsyncSession] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id, db=db)
+            user = await Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "functions" and "valves" settings
@@ -373,47 +378,51 @@ class FunctionsTable:
             user_settings['functions']['valves'][id] = valves
 
             # Update the user settings in the database
-            Users.update_user_by_id(user_id, {'settings': user_settings}, db=db)
+            await Users.update_user_by_id(user_id, {'settings': user_settings}, db=db)
 
             return user_settings['functions']['valves'][id]
         except Exception as e:
             log.exception(f'Error updating user valves by id {id} and user_id {user_id}: {e}')
             return None
 
-    def update_function_by_id(self, id: str, updated: dict, db: Optional[Session] = None) -> Optional[FunctionModel]:
-        with get_db_context(db) as db:
+    async def update_function_by_id(
+        self, id: str, updated: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[FunctionModel]:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Function).filter_by(id=id).update(
-                    {
+                await db.execute(
+                    update(Function)
+                    .filter_by(id=id)
+                    .values(
                         **updated,
-                        'updated_at': int(time.time()),
-                    }
+                        updated_at=int(time.time()),
+                    )
                 )
-                db.commit()
-                function = db.get(Function, id)
+                await db.commit()
+                function = await db.get(Function, id)
                 return FunctionModel.model_validate(function) if function else None
             except Exception:
                 return None
 
-    def deactivate_all_functions(self, db: Optional[Session] = None) -> Optional[bool]:
-        with get_db_context(db) as db:
+    async def deactivate_all_functions(self, db: Optional[AsyncSession] = None) -> Optional[bool]:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Function).update(
-                    {
-                        'is_active': False,
-                        'updated_at': int(time.time()),
-                    }
+                await db.execute(
+                    update(Function).values(
+                        is_active=False,
+                        updated_at=int(time.time()),
+                    )
                 )
-                db.commit()
+                await db.commit()
                 return True
             except Exception:
                 return None
 
-    def delete_function_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_function_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Function).filter_by(id=id).delete()
-                db.commit()
+                await db.execute(delete(Function).filter_by(id=id))
+                await db.commit()
 
                 return True
             except Exception:

backend/open_webui/models/groups.py

@@ -4,8 +4,9 @@ import time
 from typing import Optional
 import uuid
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update, func, and_, or_, cast, String
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.env import DEFAULT_GROUP_SHARE_PERMISSION
 
 from open_webui.models.files import FileMetadataResponse
@@ -15,15 +16,9 @@ from pydantic import BaseModel, ConfigDict
 from sqlalchemy import (
     BigInteger,
     Column,
-    String,
     Text,
     JSON,
-    and_,
-    func,
     ForeignKey,
-    cast,
-    or_,
-    select,
 )
 
 log = logging.getLogger(__name__)
@@ -143,10 +138,10 @@ class GroupTable:
             group_data['data']['config']['share'] = DEFAULT_GROUP_SHARE_PERMISSION
         return group_data
 
-    def insert_new_group(
-        self, user_id: str, form_data: GroupForm, db: Optional[Session] = None
+    async def insert_new_group(
+        self, user_id: str, form_data: GroupForm, db: Optional[AsyncSession] = None
     ) -> Optional[GroupModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             group_data = self._ensure_default_share_config(form_data.model_dump(exclude_none=True))
             group = GroupModel(
                 **{
@@ -161,8 +156,8 @@ class GroupTable:
             try:
                 result = Group(**group.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return GroupModel.model_validate(result)
                 else:
@@ -171,18 +166,20 @@ class GroupTable:
             except Exception:
                 return None
 
-    def get_all_groups(self, db: Optional[Session] = None) -> list[GroupModel]:
-        with get_db_context(db) as db:
-            groups = db.query(Group).order_by(Group.updated_at.desc()).all()
+    async def get_all_groups(self, db: Optional[AsyncSession] = None) -> list[GroupModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Group).order_by(Group.updated_at.desc()))
+            groups = result.scalars().all()
             return [GroupModel.model_validate(group) for group in groups]
 
-    def get_group_by_name(self, name: str, db: Optional[Session] = None) -> Optional[GroupModel]:
-        with get_db_context(db) as db:
-            group = db.query(Group).filter(Group.name == name).first()
+    async def get_group_by_name(self, name: str, db: Optional[AsyncSession] = None) -> Optional[GroupModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Group).filter(Group.name == name))
+            group = result.scalars().first()
             return GroupModel.model_validate(group) if group else None
 
-    def get_groups(self, filter, db: Optional[Session] = None) -> list[GroupResponse]:
-        with get_db_context(db) as db:
+    async def get_groups(self, filter, db: Optional[AsyncSession] = None) -> list[GroupResponse]:
+        async with get_async_db_context(db) as db:
             member_count = (
                 select(func.count(GroupMember.user_id))
                 .where(GroupMember.group_id == Group.id)
@@ -190,11 +187,11 @@ class GroupTable:
                 .scalar_subquery()
                 .label('member_count')
             )
-            query = db.query(Group, member_count)
+            stmt = select(Group, member_count)
 
             if filter:
                 if 'query' in filter:
-                    query = query.filter(Group.name.ilike(f'%{filter["query"]}%'))
+                    stmt = stmt.filter(Group.name.ilike(f'%{filter["query"]}%'))
 
                 # When share filter is present, member check is handled in the share logic
                 if 'share' in filter:
@@ -218,20 +215,21 @@ class GroupTable:
                                 json_share_lower == 'members',
                                 Group.id.in_(member_groups_select),
                             )
-                            query = query.filter(or_(anyone_can_share, members_only_and_is_member))
+                            stmt = stmt.filter(or_(anyone_can_share, members_only_and_is_member))
                         else:
-                            query = query.filter(anyone_can_share)
+                            stmt = stmt.filter(anyone_can_share)
                     else:
-                        query = query.filter(and_(Group.data.isnot(None), json_share_lower == 'false'))
+                        stmt = stmt.filter(and_(Group.data.isnot(None), json_share_lower == 'false'))
 
                 else:
                     # Only apply member_id filter when share filter is NOT present
                     if 'member_id' in filter:
-                        query = query.filter(
+                        stmt = stmt.filter(
                             Group.id.in_(select(GroupMember.group_id).where(GroupMember.user_id == filter['member_id']))
                         )
 
-            results = query.order_by(Group.updated_at.desc()).all()
+            result = await db.execute(stmt.order_by(Group.updated_at.desc()))
+            rows = result.all()
 
             return [
                 GroupResponse.model_validate(
@@ -240,32 +238,34 @@ class GroupTable:
                         'member_count': count or 0,
                     }
                 )
-                for group, count in results
+                for group, count in rows
             ]
 
-    def search_groups(
+    async def search_groups(
         self,
         filter: Optional[dict] = None,
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> GroupListResponse:
-        with get_db_context(db) as db:
-            query = db.query(Group)
+        async with get_async_db_context(db) as db:
+            stmt = select(Group)
 
             if filter:
                 if 'query' in filter:
-                    query = query.filter(Group.name.ilike(f'%{filter["query"]}%'))
+                    stmt = stmt.filter(Group.name.ilike(f'%{filter["query"]}%'))
                 if 'member_id' in filter:
-                    query = query.filter(
+                    stmt = stmt.filter(
                         Group.id.in_(select(GroupMember.group_id).where(GroupMember.user_id == filter['member_id']))
                     )
 
                 if 'share' in filter:
                     share_value = filter['share']
-                    query = query.filter(Group.data.op('->>')('share') == str(share_value))
+                    stmt = stmt.filter(Group.data.op('->>')('share') == str(share_value))
 
-            total = query.count()
+            # Get total count
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
             member_count = (
                 select(func.count(GroupMember.user_id))
@@ -274,7 +274,14 @@ class GroupTable:
                 .scalar_subquery()
                 .label('member_count')
             )
-            results = query.add_columns(member_count).order_by(Group.updated_at.desc()).offset(skip).limit(limit).all()
+            result = await db.execute(
+                select(Group, member_count)
+                .where(Group.id.in_(select(stmt.subquery().c.id)))
+                .order_by(Group.updated_at.desc())
+                .offset(skip)
+                .limit(limit)
+            )
+            rows = result.all()
 
             return {
                 'items': [
@@ -284,65 +291,69 @@ class GroupTable:
                             'member_count': count or 0,
                         }
                     )
-                    for group, count in results
+                    for group, count in rows
                 ],
                 'total': total,
             }
 
-    def get_groups_by_member_id(self, user_id: str, db: Optional[Session] = None) -> list[GroupModel]:
-        with get_db_context(db) as db:
-            return [
-                GroupModel.model_validate(group)
-                for group in db.query(Group)
+    async def get_groups_by_member_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[GroupModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Group)
                 .join(GroupMember, GroupMember.group_id == Group.id)
                 .filter(GroupMember.user_id == user_id)
                 .order_by(Group.updated_at.desc())
-                .all()
-            ]
+            )
+            return [GroupModel.model_validate(group) for group in result.scalars().all()]
 
-    def get_groups_by_member_ids(
-        self, user_ids: list[str], db: Optional[Session] = None
+    async def get_groups_by_member_ids(
+        self, user_ids: list[str], db: Optional[AsyncSession] = None
     ) -> dict[str, list[GroupModel]]:
         """Fetch groups for multiple users in a single query to avoid N+1."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # Query GroupMember joined with Group, filtering by user_ids
-            results = (
-                db.query(GroupMember.user_id, Group)
+            result = await db.execute(
+                select(GroupMember.user_id, Group)
                 .join(Group, Group.id == GroupMember.group_id)
                 .filter(GroupMember.user_id.in_(user_ids))
                 .order_by(Group.updated_at.desc())
-                .all()
             )
+            rows = result.all()
 
             # Group groups by user_id
             user_groups: dict[str, list[GroupModel]] = {uid: [] for uid in user_ids}
-            for user_id, group in results:
+            for user_id, group in rows:
                 user_groups[user_id].append(GroupModel.model_validate(group))
 
             return user_groups
 
-    def get_group_by_id(self, id: str, db: Optional[Session] = None) -> Optional[GroupModel]:
+    async def get_group_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[GroupModel]:
         try:
-            with get_db_context(db) as db:
-                group = db.query(Group).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Group).filter_by(id=id))
+                group = result.scalars().first()
                 return GroupModel.model_validate(group) if group else None
         except Exception:
             return None
 
-    def get_group_user_ids_by_id(self, id: str, db: Optional[Session] = None) -> list[str]:
-        with get_db_context(db) as db:
-            members = db.query(GroupMember.user_id).filter(GroupMember.group_id == id).all()
+    async def get_group_user_ids_by_id(self, id: str, db: Optional[AsyncSession] = None) -> list[str]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(GroupMember.user_id).filter(GroupMember.group_id == id))
+            members = result.all()
 
             if not members:
                 return []
 
             return [m[0] for m in members]
 
-    def get_group_user_ids_by_ids(self, group_ids: list[str], db: Optional[Session] = None) -> dict[str, list[str]]:
-        with get_db_context(db) as db:
-            members = (
-                db.query(GroupMember.group_id, GroupMember.user_id).filter(GroupMember.group_id.in_(group_ids)).all()
+    async def get_group_user_ids_by_ids(
+        self, group_ids: list[str], db: Optional[AsyncSession] = None
+    ) -> dict[str, list[str]]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(GroupMember.group_id, GroupMember.user_id).filter(GroupMember.group_id.in_(group_ids))
             )
+            members = result.all()
 
             group_user_ids: dict[str, list[str]] = {group_id: [] for group_id in group_ids}
 
@@ -351,10 +362,12 @@ class GroupTable:
 
             return group_user_ids
 
-    def set_group_user_ids_by_id(self, group_id: str, user_ids: list[str], db: Optional[Session] = None) -> None:
-        with get_db_context(db) as db:
+    async def set_group_user_ids_by_id(
+        self, group_id: str, user_ids: list[str], db: Optional[AsyncSession] = None
+    ) -> None:
+        async with get_async_db_context(db) as db:
             # Delete existing members
-            db.query(GroupMember).filter(GroupMember.group_id == group_id).delete()
+            await db.execute(delete(GroupMember).filter(GroupMember.group_id == group_id))
 
             # Insert new members
             now = int(time.time())
@@ -370,101 +383,104 @@ class GroupTable:
             ]
 
             db.add_all(new_members)
-            db.commit()
+            await db.commit()
 
-    def get_group_member_count_by_id(self, id: str, db: Optional[Session] = None) -> int:
-        with get_db_context(db) as db:
-            count = db.query(func.count(GroupMember.user_id)).filter(GroupMember.group_id == id).scalar()
+    async def get_group_member_count_by_id(self, id: str, db: Optional[AsyncSession] = None) -> int:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(func.count(GroupMember.user_id)).filter(GroupMember.group_id == id))
+            count = result.scalar()
             return count if count else 0
 
-    def get_group_member_counts_by_ids(self, ids: list[str], db: Optional[Session] = None) -> dict[str, int]:
+    async def get_group_member_counts_by_ids(self, ids: list[str], db: Optional[AsyncSession] = None) -> dict[str, int]:
         if not ids:
             return {}
-        with get_db_context(db) as db:
-            rows = (
-                db.query(GroupMember.group_id, func.count(GroupMember.user_id))
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(GroupMember.group_id, func.count(GroupMember.user_id))
                 .filter(GroupMember.group_id.in_(ids))
                 .group_by(GroupMember.group_id)
-                .all()
             )
+            rows = result.all()
             return {group_id: count for group_id, count in rows}
 
-    def update_group_by_id(
+    async def update_group_by_id(
         self,
         id: str,
         form_data: GroupUpdateForm,
         overwrite: bool = False,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db_context(db) as db:
-                db.query(Group).filter_by(id=id).update(
-                    {
+            async with get_async_db_context(db) as db:
+                await db.execute(
+                    update(Group)
+                    .filter_by(id=id)
+                    .values(
                         **form_data.model_dump(exclude_none=True),
-                        'updated_at': int(time.time()),
-                    }
+                        updated_at=int(time.time()),
+                    )
                 )
-                db.commit()
-                return self.get_group_by_id(id=id, db=db)
+                await db.commit()
+                return await self.get_group_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def delete_group_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_group_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                db.query(Group).filter_by(id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(Group).filter_by(id=id))
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def delete_all_groups(self, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_all_groups(self, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Group).delete()
-                db.commit()
+                await db.execute(delete(Group))
+                await db.commit()
 
                 return True
             except Exception:
                 return False
 
-    def remove_user_from_all_groups(self, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def remove_user_from_all_groups(self, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
                 # Find all groups the user belongs to
-                groups = (
-                    db.query(Group)
+                result = await db.execute(
+                    select(Group)
                     .join(GroupMember, GroupMember.group_id == Group.id)
                     .filter(GroupMember.user_id == user_id)
-                    .all()
                 )
+                groups = result.scalars().all()
 
                 # Remove the user from each group
                 for group in groups:
-                    db.query(GroupMember).filter(
-                        GroupMember.group_id == group.id, GroupMember.user_id == user_id
-                    ).delete()
+                    await db.execute(
+                        delete(GroupMember).filter(GroupMember.group_id == group.id, GroupMember.user_id == user_id)
+                    )
 
-                    db.query(Group).filter_by(id=group.id).update({'updated_at': int(time.time())})
+                    await db.execute(update(Group).filter_by(id=group.id).values(updated_at=int(time.time())))
 
-                db.commit()
+                await db.commit()
                 return True
 
             except Exception:
-                db.rollback()
+                await db.rollback()
                 return False
 
-    def create_groups_by_group_names(
-        self, user_id: str, group_names: list[str], db: Optional[Session] = None
+    async def create_groups_by_group_names(
+        self, user_id: str, group_names: list[str], db: Optional[AsyncSession] = None
     ) -> list[GroupModel]:
         # check for existing groups
-        existing_groups = self.get_all_groups(db=db)
+        existing_groups = await self.get_all_groups(db=db)
         existing_group_names = {group.name for group in existing_groups}
 
         new_groups = []
 
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             for group_name in group_names:
                 if group_name not in existing_group_names:
                     new_group = GroupModel(
@@ -483,31 +499,33 @@ class GroupTable:
                     try:
                         result = Group(**new_group.model_dump())
                         db.add(result)
-                        db.commit()
-                        db.refresh(result)
+                        await db.commit()
+                        await db.refresh(result)
                         new_groups.append(GroupModel.model_validate(result))
                     except Exception as e:
                         log.exception(e)
                         continue
             return new_groups
 
-    def sync_groups_by_group_names(self, user_id: str, group_names: list[str], db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def sync_groups_by_group_names(
+        self, user_id: str, group_names: list[str], db: Optional[AsyncSession] = None
+    ) -> bool:
+        async with get_async_db_context(db) as db:
             try:
                 now = int(time.time())
 
                 # 1. Groups that SHOULD contain the user
-                target_groups = db.query(Group).filter(Group.name.in_(group_names)).all()
+                result = await db.execute(select(Group).filter(Group.name.in_(group_names)))
+                target_groups = result.scalars().all()
                 target_group_ids = {g.id for g in target_groups}
 
                 # 2. Groups the user is CURRENTLY in
-                existing_group_ids = {
-                    g.id
-                    for g in db.query(Group)
+                result = await db.execute(
+                    select(Group)
                     .join(GroupMember, GroupMember.group_id == Group.id)
                     .filter(GroupMember.user_id == user_id)
-                    .all()
-                }
+                )
+                existing_group_ids = {g.id for g in result.scalars().all()}
 
                 # 3. Determine adds + removals
                 groups_to_add = target_group_ids - existing_group_ids
@@ -515,15 +533,15 @@ class GroupTable:
 
                 # 4. Remove in one bulk delete
                 if groups_to_remove:
-                    db.query(GroupMember).filter(
-                        GroupMember.user_id == user_id,
-                        GroupMember.group_id.in_(groups_to_remove),
-                    ).delete(synchronize_session=False)
-
-                    db.query(Group).filter(Group.id.in_(groups_to_remove)).update(
-                        {'updated_at': now}, synchronize_session=False
+                    await db.execute(
+                        delete(GroupMember).filter(
+                            GroupMember.user_id == user_id,
+                            GroupMember.group_id.in_(groups_to_remove),
+                        )
                     )
 
+                    await db.execute(update(Group).filter(Group.id.in_(groups_to_remove)).values(updated_at=now))
+
                 # 5. Bulk insert missing memberships
                 for group_id in groups_to_add:
                     db.add(
@@ -537,27 +555,26 @@ class GroupTable:
                     )
 
                 if groups_to_add:
-                    db.query(Group).filter(Group.id.in_(groups_to_add)).update(
-                        {'updated_at': now}, synchronize_session=False
-                    )
+                    await db.execute(update(Group).filter(Group.id.in_(groups_to_add)).values(updated_at=now))
 
-                db.commit()
+                await db.commit()
                 return True
 
             except Exception as e:
                 log.exception(e)
-                db.rollback()
+                await db.rollback()
                 return False
 
-    def add_users_to_group(
+    async def add_users_to_group(
         self,
         id: str,
         user_ids: Optional[list[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db_context(db) as db:
-                group = db.query(Group).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Group).filter_by(id=id))
+                group = result.scalars().first()
                 if not group:
                     return None
 
@@ -574,15 +591,14 @@ class GroupTable:
                                 updated_at=now,
                             )
                         )
-                        db.flush()  # Detect unique constraint violation early
+                        await db.flush()  # Detect unique constraint violation early
                     except Exception:
-                        db.rollback()  # Clear failed INSERT
-                        db.begin()  # Start a new transaction
+                        await db.rollback()  # Clear failed INSERT
                         continue  # Duplicate → ignore
 
                 group.updated_at = now
-                db.commit()
-                db.refresh(group)
+                await db.commit()
+                await db.refresh(group)
 
                 return GroupModel.model_validate(group)
 
@@ -590,15 +606,16 @@ class GroupTable:
             log.exception(e)
             return None
 
-    def remove_users_from_group(
+    async def remove_users_from_group(
         self,
         id: str,
         user_ids: Optional[list[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[GroupModel]:
         try:
-            with get_db_context(db) as db:
-                group = db.query(Group).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Group).filter_by(id=id))
+                group = result.scalars().first()
                 if not group:
                     return None
 
@@ -606,15 +623,15 @@ class GroupTable:
                     return GroupModel.model_validate(group)
 
                 # Remove users from group_member in batch
-                db.query(GroupMember).filter(GroupMember.group_id == id, GroupMember.user_id.in_(user_ids)).delete(
-                    synchronize_session=False
+                await db.execute(
+                    delete(GroupMember).filter(GroupMember.group_id == id, GroupMember.user_id.in_(user_ids))
                 )
 
                 # Update group timestamp
                 group.updated_at = int(time.time())
 
-                db.commit()
-                db.refresh(group)
+                await db.commit()
+                await db.refresh(group)
                 return GroupModel.model_validate(group)
 
         except Exception as e:

backend/open_webui/models/knowledge.py

@@ -4,8 +4,9 @@ import time
 from typing import Optional
 import uuid
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update, or_, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 
 from open_webui.models.files import (
     File,
@@ -27,7 +28,6 @@ from sqlalchemy import (
     Text,
     JSON,
     UniqueConstraint,
-    or_,
 )
 
 log = logging.getLogger(__name__)
@@ -134,25 +134,25 @@ class KnowledgeFileListResponse(BaseModel):
 
 
 class KnowledgeTable:
-    def _get_access_grants(self, knowledge_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('knowledge', knowledge_id, db=db)
+    async def _get_access_grants(self, knowledge_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('knowledge', knowledge_id, db=db)
 
-    def _to_knowledge_model(
+    async def _to_knowledge_model(
         self,
         knowledge: Knowledge,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> KnowledgeModel:
         knowledge_data = KnowledgeModel.model_validate(knowledge).model_dump(exclude={'access_grants'})
         knowledge_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(knowledge_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(knowledge_data['id'], db=db)
         )
         return KnowledgeModel.model_validate(knowledge_data)
 
-    def insert_new_knowledge(
-        self, user_id: str, form_data: KnowledgeForm, db: Optional[Session] = None
+    async def insert_new_knowledge(
+        self, user_id: str, form_data: KnowledgeForm, db: Optional[AsyncSession] = None
     ) -> Optional[KnowledgeModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             knowledge = KnowledgeModel(
                 **{
                     **form_data.model_dump(exclude={'access_grants'}),
@@ -167,27 +167,28 @@ class KnowledgeTable:
             try:
                 result = Knowledge(**knowledge.model_dump(exclude={'access_grants'}))
                 db.add(result)
-                db.commit()
-                db.refresh(result)
-                AccessGrants.set_access_grants('knowledge', result.id, form_data.access_grants, db=db)
+                await db.commit()
+                await db.refresh(result)
+                await AccessGrants.set_access_grants('knowledge', result.id, form_data.access_grants, db=db)
                 if result:
-                    return self._to_knowledge_model(result, db=db)
+                    return await self._to_knowledge_model(result, db=db)
                 else:
                     return None
             except Exception:
                 return None
 
-    def get_knowledge_bases(
-        self, skip: int = 0, limit: int = 30, db: Optional[Session] = None
+    async def get_knowledge_bases(
+        self, skip: int = 0, limit: int = 30, db: Optional[AsyncSession] = None
     ) -> list[KnowledgeUserModel]:
-        with get_db_context(db) as db:
-            all_knowledge = db.query(Knowledge).order_by(Knowledge.updated_at.desc()).all()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Knowledge).order_by(Knowledge.updated_at.desc()))
+            all_knowledge = result.scalars().all()
             user_ids = list(set(knowledge.user_id for knowledge in all_knowledge))
             knowledge_ids = [knowledge.id for knowledge in all_knowledge]
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
-            grants_map = AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
 
             knowledge_bases = []
             for knowledge in all_knowledge:
@@ -195,10 +196,12 @@ class KnowledgeTable:
                 knowledge_bases.append(
                     KnowledgeUserModel.model_validate(
                         {
-                            **self._to_knowledge_model(
-                                knowledge,
-                                access_grants=grants_map.get(knowledge.id, []),
-                                db=db,
+                            **(
+                                await self._to_knowledge_model(
+                                    knowledge,
+                                    access_grants=grants_map.get(knowledge.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             'user': user.model_dump() if user else None,
                         }
@@ -206,22 +209,22 @@ class KnowledgeTable:
                 )
             return knowledge_bases
 
-    def search_knowledge_bases(
+    async def search_knowledge_bases(
         self,
         user_id: str,
         filter: dict,
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> KnowledgeListResponse:
         try:
-            with get_db_context(db) as db:
-                query = db.query(Knowledge, User).outerjoin(User, User.id == Knowledge.user_id)
+            async with get_async_db_context(db) as db:
+                stmt = select(Knowledge, User).outerjoin(User, User.id == Knowledge.user_id)
 
                 if filter:
                     query_key = filter.get('query')
                     if query_key:
-                        query = query.filter(
+                        stmt = stmt.filter(
                             or_(
                                 Knowledge.name.ilike(f'%{query_key}%'),
                                 Knowledge.description.ilike(f'%{query_key}%'),
@@ -233,41 +236,45 @@ class KnowledgeTable:
 
                     view_option = filter.get('view_option')
                     if view_option == 'created':
-                        query = query.filter(Knowledge.user_id == user_id)
+                        stmt = stmt.filter(Knowledge.user_id == user_id)
                     elif view_option == 'shared':
-                        query = query.filter(Knowledge.user_id != user_id)
+                        stmt = stmt.filter(Knowledge.user_id != user_id)
 
-                    query = AccessGrants.has_permission_filter(
+                    stmt = AccessGrants.has_permission_filter(
                         db=db,
-                        query=query,
+                        query=stmt,
                         DocumentModel=Knowledge,
                         filter=filter,
                         resource_type='knowledge',
                         permission='read',
                     )
 
-                query = query.order_by(Knowledge.updated_at.desc(), Knowledge.id.asc())
+                stmt = stmt.order_by(Knowledge.updated_at.desc(), Knowledge.id.asc())
 
-                total = query.count()
+                count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+                total = count_result.scalar()
                 if skip:
-                    query = query.offset(skip)
+                    stmt = stmt.offset(skip)
                 if limit:
-                    query = query.limit(limit)
+                    stmt = stmt.limit(limit)
 
-                items = query.all()
+                result = await db.execute(stmt)
+                items = result.all()
 
                 knowledge_ids = [kb.id for kb, _ in items]
-                grants_map = AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
+                grants_map = await AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
 
                 knowledge_bases = []
                 for knowledge_base, user in items:
                     knowledge_bases.append(
                         KnowledgeUserModel.model_validate(
                             {
-                                **self._to_knowledge_model(
-                                    knowledge_base,
-                                    access_grants=grants_map.get(knowledge_base.id, []),
-                                    db=db,
+                                **(
+                                    await self._to_knowledge_model(
+                                        knowledge_base,
+                                        access_grants=grants_map.get(knowledge_base.id, []),
+                                        db=db,
+                                    )
                                 ).model_dump(),
                                 'user': (UserModel.model_validate(user).model_dump() if user else None),
                             }
@@ -279,28 +286,27 @@ class KnowledgeTable:
             print(e)
             return KnowledgeListResponse(items=[], total=0)
 
-    def search_knowledge_files(
-        self, filter: dict, skip: int = 0, limit: int = 30, db: Optional[Session] = None
+    async def search_knowledge_files(
+        self, filter: dict, skip: int = 0, limit: int = 30, db: Optional[AsyncSession] = None
     ) -> KnowledgeFileListResponse:
         """
         Scalable version: search files across all knowledge bases the user has
         READ access to, without loading all KBs or using large IN() lists.
         """
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Base query: join Knowledge → KnowledgeFile → File
-                query = (
-                    db.query(File, User, Knowledge)
+                stmt = (
+                    select(File, User, Knowledge)
                     .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
                     .join(Knowledge, KnowledgeFile.knowledge_id == Knowledge.id)
                     .outerjoin(User, User.id == KnowledgeFile.user_id)
                 )
 
                 # Apply access-control directly to the joined query
-                # This makes the database handle filtering, even with 10k+ KBs
-                query = AccessGrants.has_permission_filter(
+                stmt = AccessGrants.has_permission_filter(
                     db=db,
-                    query=query,
+                    query=stmt,
                     DocumentModel=Knowledge,
                     filter=filter,
                     resource_type='knowledge',
@@ -311,20 +317,22 @@ class KnowledgeTable:
                 if filter:
                     q = filter.get('query')
                     if q:
-                        query = query.filter(File.filename.ilike(f'%{q}%'))
+                        stmt = stmt.filter(File.filename.ilike(f'%{q}%'))
 
                 # Order by file changes
-                query = query.order_by(File.updated_at.desc(), File.id.asc())
+                stmt = stmt.order_by(File.updated_at.desc(), File.id.asc())
 
                 # Count before pagination
-                total = query.count()
+                count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+                total = count_result.scalar()
 
                 if skip:
-                    query = query.offset(skip)
+                    stmt = stmt.offset(skip)
                 if limit:
-                    query = query.limit(limit)
+                    stmt = stmt.limit(limit)
 
-                rows = query.all()
+                result = await db.execute(stmt)
+                rows = result.all()
 
                 items = []
                 for file, user, knowledge in rows:
@@ -332,7 +340,7 @@ class KnowledgeTable:
                         FileUserResponse(
                             **FileModel.model_validate(file).model_dump(),
                             user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
-                            collection=self._to_knowledge_model(knowledge, db=db).model_dump(),
+                            collection=(await self._to_knowledge_model(knowledge, db=db)).model_dump(),
                         )
                     )
 
@@ -342,14 +350,15 @@ class KnowledgeTable:
             print('search_knowledge_files error:', e)
             return KnowledgeFileListResponse(items=[], total=0)
 
-    def check_access_by_user_id(self, id, user_id, permission='write', db: Optional[Session] = None) -> bool:
-        knowledge = self.get_knowledge_by_id(id, db=db)
+    async def check_access_by_user_id(self, id, user_id, permission='write', db: Optional[AsyncSession] = None) -> bool:
+        knowledge = await self.get_knowledge_by_id(id, db=db)
         if not knowledge:
             return False
         if knowledge.user_id == user_id:
             return True
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
-        return AccessGrants.has_access(
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
+        return await AccessGrants.has_access(
             user_id=user_id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -358,45 +367,50 @@ class KnowledgeTable:
             db=db,
         )
 
-    def get_knowledge_bases_by_user_id(
-        self, user_id: str, permission: str = 'write', db: Optional[Session] = None
+    async def get_knowledge_bases_by_user_id(
+        self, user_id: str, permission: str = 'write', db: Optional[AsyncSession] = None
     ) -> list[KnowledgeUserModel]:
-        knowledge_bases = self.get_knowledge_bases(db=db)
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
-        return [
-            knowledge_base
-            for knowledge_base in knowledge_bases
-            if knowledge_base.user_id == user_id
-            or AccessGrants.has_access(
+        knowledge_bases = await self.get_knowledge_bases(db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
+
+        result = []
+        for knowledge_base in knowledge_bases:
+            if knowledge_base.user_id == user_id:
+                result.append(knowledge_base)
+            elif await AccessGrants.has_access(
                 user_id=user_id,
                 resource_type='knowledge',
                 resource_id=knowledge_base.id,
                 permission=permission,
                 user_group_ids=user_group_ids,
                 db=db,
-            )
-        ]
+            ):
+                result.append(knowledge_base)
+        return result
 
-    def get_knowledge_by_id(self, id: str, db: Optional[Session] = None) -> Optional[KnowledgeModel]:
+    async def get_knowledge_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[KnowledgeModel]:
         try:
-            with get_db_context(db) as db:
-                knowledge = db.query(Knowledge).filter_by(id=id).first()
-                return self._to_knowledge_model(knowledge, db=db) if knowledge else None
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Knowledge).filter_by(id=id))
+                knowledge = result.scalars().first()
+                return await self._to_knowledge_model(knowledge, db=db) if knowledge else None
         except Exception:
             return None
 
-    def get_knowledge_by_id_and_user_id(
-        self, id: str, user_id: str, db: Optional[Session] = None
+    async def get_knowledge_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[KnowledgeModel]:
-        knowledge = self.get_knowledge_by_id(id, db=db)
+        knowledge = await self.get_knowledge_by_id(id, db=db)
         if not knowledge:
             return None
 
         if knowledge.user_id == user_id:
             return knowledge
 
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
-        if AccessGrants.has_access(
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
+        if await AccessGrants.has_access(
             user_id=user_id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -407,19 +421,19 @@ class KnowledgeTable:
             return knowledge
         return None
 
-    def get_knowledges_by_file_id(self, file_id: str, db: Optional[Session] = None) -> list[KnowledgeModel]:
+    async def get_knowledges_by_file_id(self, file_id: str, db: Optional[AsyncSession] = None) -> list[KnowledgeModel]:
         try:
-            with get_db_context(db) as db:
-                knowledges = (
-                    db.query(Knowledge)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(
+                    select(Knowledge)
                     .join(KnowledgeFile, Knowledge.id == KnowledgeFile.knowledge_id)
                     .filter(KnowledgeFile.file_id == file_id)
-                    .all()
                 )
+                knowledges = result.scalars().all()
                 knowledge_ids = [k.id for k in knowledges]
-                grants_map = AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
+                grants_map = await AccessGrants.get_grants_by_resources('knowledge', knowledge_ids, db=db)
                 return [
-                    self._to_knowledge_model(
+                    await self._to_knowledge_model(
                         knowledge,
                         access_grants=grants_map.get(knowledge.id, []),
                         db=db,
@@ -429,19 +443,19 @@ class KnowledgeTable:
         except Exception:
             return []
 
-    def search_files_by_id(
+    async def search_files_by_id(
         self,
         knowledge_id: str,
         user_id: str,
         filter: dict,
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> KnowledgeFileListResponse:
         try:
-            with get_db_context(db) as db:
-                query = (
-                    db.query(File, User)
+            async with get_async_db_context(db) as db:
+                stmt = (
+                    select(File, User)
                     .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
                     .outerjoin(User, User.id == KnowledgeFile.user_id)
                     .filter(KnowledgeFile.knowledge_id == knowledge_id)
@@ -453,13 +467,13 @@ class KnowledgeTable:
                 if filter:
                     query_key = filter.get('query')
                     if query_key:
-                        query = query.filter(or_(File.filename.ilike(f'%{query_key}%')))
+                        stmt = stmt.filter(or_(File.filename.ilike(f'%{query_key}%')))
 
                     view_option = filter.get('view_option')
                     if view_option == 'created':
-                        query = query.filter(KnowledgeFile.user_id == user_id)
+                        stmt = stmt.filter(KnowledgeFile.user_id == user_id)
                     elif view_option == 'shared':
-                        query = query.filter(KnowledgeFile.user_id != user_id)
+                        stmt = stmt.filter(KnowledgeFile.user_id != user_id)
 
                     order_by = filter.get('order_by')
                     direction = filter.get('direction')
@@ -473,17 +487,19 @@ class KnowledgeTable:
                         primary_sort = File.updated_at.asc() if is_asc else File.updated_at.desc()
 
                 # Apply sort with secondary key for deterministic pagination
-                query = query.order_by(primary_sort, File.id.asc())
+                stmt = stmt.order_by(primary_sort, File.id.asc())
 
                 # Count BEFORE pagination
-                total = query.count()
+                count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+                total = count_result.scalar()
 
                 if skip:
-                    query = query.offset(skip)
+                    stmt = stmt.offset(skip)
                 if limit:
-                    query = query.limit(limit)
+                    stmt = stmt.limit(limit)
 
-                items = query.all()
+                result = await db.execute(stmt)
+                items = result.all()
 
                 files = []
                 for file, user in items:
@@ -499,35 +515,36 @@ class KnowledgeTable:
             print(e)
             return KnowledgeFileListResponse(items=[], total=0)
 
-    def get_files_by_id(self, knowledge_id: str, db: Optional[Session] = None) -> list[FileModel]:
+    async def get_files_by_id(self, knowledge_id: str, db: Optional[AsyncSession] = None) -> list[FileModel]:
         try:
-            with get_db_context(db) as db:
-                files = (
-                    db.query(File)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(
+                    select(File)
                     .join(KnowledgeFile, File.id == KnowledgeFile.file_id)
                     .filter(KnowledgeFile.knowledge_id == knowledge_id)
-                    .all()
                 )
+                files = result.scalars().all()
                 return [FileModel.model_validate(file) for file in files]
         except Exception:
             return []
 
-    def get_file_metadatas_by_id(self, knowledge_id: str, db: Optional[Session] = None) -> list[FileMetadataResponse]:
+    async def get_file_metadatas_by_id(
+        self, knowledge_id: str, db: Optional[AsyncSession] = None
+    ) -> list[FileMetadataResponse]:
         try:
-            with get_db_context(db) as db:
-                files = self.get_files_by_id(knowledge_id, db=db)
-                return [FileMetadataResponse(**file.model_dump()) for file in files]
+            files = await self.get_files_by_id(knowledge_id, db=db)
+            return [FileMetadataResponse(**file.model_dump()) for file in files]
         except Exception:
             return []
 
-    def add_file_to_knowledge_by_id(
+    async def add_file_to_knowledge_by_id(
         self,
         knowledge_id: str,
         file_id: str,
         user_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[KnowledgeFileModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             knowledge_file = KnowledgeFileModel(
                 **{
                     'id': str(uuid.uuid4()),
@@ -542,8 +559,8 @@ class KnowledgeTable:
             try:
                 result = KnowledgeFile(**knowledge_file.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return KnowledgeFileModel.model_validate(result)
                 else:
@@ -551,103 +568,107 @@ class KnowledgeTable:
             except Exception:
                 return None
 
-    def has_file(self, knowledge_id: str, file_id: str, db: Optional[Session] = None) -> bool:
+    async def has_file(self, knowledge_id: str, file_id: str, db: Optional[AsyncSession] = None) -> bool:
         """Check whether a file belongs to a knowledge base."""
         try:
-            with get_db_context(db) as db:
-                return db.query(KnowledgeFile).filter_by(knowledge_id=knowledge_id, file_id=file_id).first() is not None
+            async with get_async_db_context(db) as db:
+                result = await db.execute(
+                    select(KnowledgeFile).filter_by(knowledge_id=knowledge_id, file_id=file_id).limit(1)
+                )
+                return result.scalars().first() is not None
         except Exception:
             return False
 
-    def remove_file_from_knowledge_by_id(self, knowledge_id: str, file_id: str, db: Optional[Session] = None) -> bool:
+    async def remove_file_from_knowledge_by_id(
+        self, knowledge_id: str, file_id: str, db: Optional[AsyncSession] = None
+    ) -> bool:
         try:
-            with get_db_context(db) as db:
-                db.query(KnowledgeFile).filter_by(knowledge_id=knowledge_id, file_id=file_id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(KnowledgeFile).filter_by(knowledge_id=knowledge_id, file_id=file_id))
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def reset_knowledge_by_id(self, id: str, db: Optional[Session] = None) -> Optional[KnowledgeModel]:
+    async def reset_knowledge_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[KnowledgeModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Delete all knowledge_file entries for this knowledge_id
-                db.query(KnowledgeFile).filter_by(knowledge_id=id).delete()
-                db.commit()
+                await db.execute(delete(KnowledgeFile).filter_by(knowledge_id=id))
+                await db.commit()
 
                 # Update the knowledge entry's updated_at timestamp
-                db.query(Knowledge).filter_by(id=id).update(
-                    {
-                        'updated_at': int(time.time()),
-                    }
-                )
-                db.commit()
+                await db.execute(update(Knowledge).filter_by(id=id).values(updated_at=int(time.time())))
+                await db.commit()
 
-                return self.get_knowledge_by_id(id=id, db=db)
+                return await self.get_knowledge_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def update_knowledge_by_id(
+    async def update_knowledge_by_id(
         self,
         id: str,
         form_data: KnowledgeForm,
         overwrite: bool = False,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[KnowledgeModel]:
         try:
-            with get_db_context(db) as db:
-                knowledge = self.get_knowledge_by_id(id=id, db=db)
-                db.query(Knowledge).filter_by(id=id).update(
-                    {
+            async with get_async_db_context(db) as db:
+                await db.execute(
+                    update(Knowledge)
+                    .filter_by(id=id)
+                    .values(
                         **form_data.model_dump(exclude={'access_grants'}),
-                        'updated_at': int(time.time()),
-                    }
+                        updated_at=int(time.time()),
+                    )
                 )
-                db.commit()
+                await db.commit()
                 if form_data.access_grants is not None:
-                    AccessGrants.set_access_grants('knowledge', id, form_data.access_grants, db=db)
-                return self.get_knowledge_by_id(id=id, db=db)
+                    await AccessGrants.set_access_grants('knowledge', id, form_data.access_grants, db=db)
+                return await self.get_knowledge_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def update_knowledge_data_by_id(
-        self, id: str, data: dict, db: Optional[Session] = None
+    async def update_knowledge_data_by_id(
+        self, id: str, data: dict, db: Optional[AsyncSession] = None
     ) -> Optional[KnowledgeModel]:
         try:
-            with get_db_context(db) as db:
-                knowledge = self.get_knowledge_by_id(id=id, db=db)
-                db.query(Knowledge).filter_by(id=id).update(
-                    {
-                        'data': data,
-                        'updated_at': int(time.time()),
-                    }
+            async with get_async_db_context(db) as db:
+                await db.execute(
+                    update(Knowledge)
+                    .filter_by(id=id)
+                    .values(
+                        data=data,
+                        updated_at=int(time.time()),
+                    )
                 )
-                db.commit()
-                return self.get_knowledge_by_id(id=id, db=db)
+                await db.commit()
+                return await self.get_knowledge_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             return None
 
-    def delete_knowledge_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_knowledge_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                AccessGrants.revoke_all_access('knowledge', id, db=db)
-                db.query(Knowledge).filter_by(id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await AccessGrants.revoke_all_access('knowledge', id, db=db)
+                await db.execute(delete(Knowledge).filter_by(id=id))
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def delete_all_knowledge(self, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_all_knowledge(self, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                knowledge_ids = [row[0] for row in db.query(Knowledge.id).all()]
+                result = await db.execute(select(Knowledge.id))
+                knowledge_ids = [row[0] for row in result.all()]
                 for knowledge_id in knowledge_ids:
-                    AccessGrants.revoke_all_access('knowledge', knowledge_id, db=db)
-                db.query(Knowledge).delete()
-                db.commit()
+                    await AccessGrants.revoke_all_access('knowledge', knowledge_id, db=db)
+                await db.execute(delete(Knowledge))
+                await db.commit()
 
                 return True
             except Exception:

backend/open_webui/models/memories.py

@@ -2,8 +2,9 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db, get_db_context
+from sqlalchemy import select, delete
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
 from pydantic import BaseModel, ConfigDict
 from sqlalchemy import BigInteger, Column, String, Text
 
@@ -40,13 +41,13 @@ class MemoryModel(BaseModel):
 
 
 class MemoriesTable:
-    def insert_new_memory(
+    async def insert_new_memory(
         self,
         user_id: str,
         content: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[MemoryModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             id = str(uuid.uuid4())
 
             memory = MemoryModel(
@@ -60,90 +61,92 @@ class MemoriesTable:
             )
             result = Memory(**memory.model_dump())
             db.add(result)
-            db.commit()
-            db.refresh(result)
+            await db.commit()
+            await db.refresh(result)
             if result:
                 return MemoryModel.model_validate(result)
             else:
                 return None
 
-    def update_memory_by_id_and_user_id(
+    async def update_memory_by_id_and_user_id(
         self,
         id: str,
         user_id: str,
         content: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[MemoryModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
-                memory = db.get(Memory, id)
+                memory = await db.get(Memory, id)
                 if not memory or memory.user_id != user_id:
                     return None
 
                 memory.content = content
                 memory.updated_at = int(time.time())
 
-                db.commit()
-                db.refresh(memory)
+                await db.commit()
+                await db.refresh(memory)
                 return MemoryModel.model_validate(memory)
             except Exception:
                 return None
 
-    def get_memories(self, db: Optional[Session] = None) -> list[MemoryModel]:
-        with get_db_context(db) as db:
+    async def get_memories(self, db: Optional[AsyncSession] = None) -> list[MemoryModel]:
+        async with get_async_db_context(db) as db:
             try:
-                memories = db.query(Memory).all()
+                result = await db.execute(select(Memory))
+                memories = result.scalars().all()
                 return [MemoryModel.model_validate(memory) for memory in memories]
             except Exception:
                 return None
 
-    def get_memories_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[MemoryModel]:
-        with get_db_context(db) as db:
+    async def get_memories_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[MemoryModel]:
+        async with get_async_db_context(db) as db:
             try:
-                memories = db.query(Memory).filter_by(user_id=user_id).all()
+                result = await db.execute(select(Memory).filter_by(user_id=user_id))
+                memories = result.scalars().all()
                 return [MemoryModel.model_validate(memory) for memory in memories]
             except Exception:
                 return None
 
-    def get_memory_by_id(self, id: str, db: Optional[Session] = None) -> Optional[MemoryModel]:
-        with get_db_context(db) as db:
+    async def get_memory_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[MemoryModel]:
+        async with get_async_db_context(db) as db:
             try:
-                memory = db.get(Memory, id)
-                return MemoryModel.model_validate(memory)
+                memory = await db.get(Memory, id)
+                return MemoryModel.model_validate(memory) if memory else None
             except Exception:
                 return None
 
-    def delete_memory_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_memory_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Memory).filter_by(id=id).delete()
-                db.commit()
+                await db.execute(delete(Memory).filter_by(id=id))
+                await db.commit()
 
                 return True
 
             except Exception:
                 return False
 
-    def delete_memories_by_user_id(self, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_memories_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                db.query(Memory).filter_by(user_id=user_id).delete()
-                db.commit()
+                await db.execute(delete(Memory).filter_by(user_id=user_id))
+                await db.commit()
 
                 return True
             except Exception:
                 return False
 
-    def delete_memory_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
+    async def delete_memory_by_id_and_user_id(self, id: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
             try:
-                memory = db.get(Memory, id)
+                memory = await db.get(Memory, id)
                 if not memory or memory.user_id != user_id:
                     return None
 
                 # Delete the memory
-                db.delete(memory)
-                db.commit()
+                await db.delete(memory)
+                await db.commit()
 
                 return True
             except Exception:

backend/open_webui/models/messages.py

@@ -3,8 +3,9 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.tags import TagModel, Tag, Tags
 from open_webui.models.users import Users, User, UserNameResponse
 from open_webui.models.channels import Channels, ChannelMember
@@ -12,7 +13,7 @@ from open_webui.models.channels import Channels, ChannelMember
 
 from pydantic import BaseModel, ConfigDict, field_validator
 from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON
-from sqlalchemy import or_, func, select, and_, text
+from sqlalchemy import or_, func, and_, text
 from sqlalchemy.sql import exists
 
 ####################
@@ -137,15 +138,15 @@ class MessageResponse(MessageReplyToResponse):
 
 
 class MessageTable:
-    def insert_new_message(
+    async def insert_new_message(
         self,
         form_data: MessageForm,
         channel_id: str,
         user_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[MessageModel]:
-        with get_db_context(db) as db:
-            channel_member = Channels.join_channel(channel_id, user_id)
+        async with get_async_db_context(db) as db:
+            channel_member = await Channels.join_channel(channel_id, user_id)
 
             id = str(uuid.uuid4())
             ts = int(time.time_ns())
@@ -170,38 +171,38 @@ class MessageTable:
             result = Message(**message.model_dump())
 
             db.add(result)
-            db.commit()
-            db.refresh(result)
+            await db.commit()
+            await db.refresh(result)
             return MessageModel.model_validate(result) if result else None
 
-    def get_message_by_id(
+    async def get_message_by_id(
         self,
         id: str,
         include_thread_replies: Optional[bool] = True,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[MessageResponse]:
-        with get_db_context(db) as db:
-            message = db.get(Message, id)
+        async with get_async_db_context(db) as db:
+            message = await db.get(Message, id)
             if not message:
                 return None
 
             reply_to_message = (
-                self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
+                await self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
                 if message.reply_to_id
                 else None
             )
 
-            reactions = self.get_reactions_by_message_id(id, db=db)
+            reactions = await self.get_reactions_by_message_id(id, db=db)
 
             thread_replies = []
             if include_thread_replies:
-                thread_replies = self.get_thread_replies_by_message_id(id, db=db)
+                thread_replies = await self.get_thread_replies_by_message_id(id, db=db)
 
             # Check if message was sent by webhook (webhook info in meta takes precedence)
             webhook_info = message.meta.get('webhook') if message.meta else None
             if webhook_info and webhook_info.get('id'):
                 # Look up webhook by ID to get current name
-                webhook = Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
+                webhook = await Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
                 if webhook:
                     user_info = {
                         'id': webhook.id,
@@ -216,7 +217,7 @@ class MessageTable:
                         'role': 'webhook',
                     }
             else:
-                user = Users.get_user_by_id(message.user_id, db=db)
+                user = await Users.get_user_by_id(message.user_id, db=db)
                 user_info = user.model_dump() if user else None
 
             return MessageResponse.model_validate(
@@ -230,34 +231,41 @@ class MessageTable:
                 }
             )
 
-    def get_thread_replies_by_message_id(self, id: str, db: Optional[Session] = None) -> list[MessageReplyToResponse]:
-        with get_db_context(db) as db:
-            all_messages = db.query(Message).filter_by(parent_id=id).order_by(Message.created_at.desc()).all()
+    async def _resolve_user_info(self, message: Message, db: AsyncSession) -> Optional[dict]:
+        """Resolve user info from message, handling webhook messages."""
+        webhook_info = message.meta.get('webhook') if message.meta else None
+        if webhook_info and webhook_info.get('id'):
+            webhook = await Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
+            if webhook:
+                return {
+                    'id': webhook.id,
+                    'name': webhook.name,
+                    'role': 'webhook',
+                }
+            else:
+                return {
+                    'id': webhook_info.get('id'),
+                    'name': 'Deleted Webhook',
+                    'role': 'webhook',
+                }
+        return None
+
+    async def get_thread_replies_by_message_id(
+        self, id: str, db: Optional[AsyncSession] = None
+    ) -> list[MessageReplyToResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Message).filter_by(parent_id=id).order_by(Message.created_at.desc()))
+            all_messages = result.scalars().all()
 
             messages = []
             for message in all_messages:
                 reply_to_message = (
-                    self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
+                    await self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
                     if message.reply_to_id
                     else None
                 )
 
-                webhook_info = message.meta.get('webhook') if message.meta else None
-                user_info = None
-                if webhook_info and webhook_info.get('id'):
-                    webhook = Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
-                    if webhook:
-                        user_info = {
-                            'id': webhook.id,
-                            'name': webhook.name,
-                            'role': 'webhook',
-                        }
-                    else:
-                        user_info = {
-                            'id': webhook_info.get('id'),
-                            'name': 'Deleted Webhook',
-                            'role': 'webhook',
-                        }
+                user_info = await self._resolve_user_info(message, db)
 
                 messages.append(
                     MessageReplyToResponse.model_validate(
@@ -270,51 +278,37 @@ class MessageTable:
                 )
             return messages
 
-    def get_reply_user_ids_by_message_id(self, id: str, db: Optional[Session] = None) -> list[str]:
-        with get_db_context(db) as db:
-            return [message.user_id for message in db.query(Message).filter_by(parent_id=id).all()]
+    async def get_reply_user_ids_by_message_id(self, id: str, db: Optional[AsyncSession] = None) -> list[str]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Message.user_id).filter_by(parent_id=id))
+            return [row[0] for row in result.all()]
 
-    def get_messages_by_channel_id(
+    async def get_messages_by_channel_id(
         self,
         channel_id: str,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[MessageReplyToResponse]:
-        with get_db_context(db) as db:
-            all_messages = (
-                db.query(Message)
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Message)
                 .filter_by(channel_id=channel_id, parent_id=None)
                 .order_by(Message.created_at.desc())
                 .offset(skip)
                 .limit(limit)
-                .all()
             )
+            all_messages = result.scalars().all()
 
             messages = []
             for message in all_messages:
                 reply_to_message = (
-                    self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
+                    await self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
                     if message.reply_to_id
                     else None
                 )
 
-                webhook_info = message.meta.get('webhook') if message.meta else None
-                user_info = None
-                if webhook_info and webhook_info.get('id'):
-                    webhook = Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
-                    if webhook:
-                        user_info = {
-                            'id': webhook.id,
-                            'name': webhook.name,
-                            'role': 'webhook',
-                        }
-                    else:
-                        user_info = {
-                            'id': webhook_info.get('id'),
-                            'name': 'Deleted Webhook',
-                            'role': 'webhook',
-                        }
+                user_info = await self._resolve_user_info(message, db)
 
                 messages.append(
                     MessageReplyToResponse.model_validate(
@@ -327,28 +321,28 @@ class MessageTable:
                 )
             return messages
 
-    def get_messages_by_parent_id(
+    async def get_messages_by_parent_id(
         self,
         channel_id: str,
         parent_id: str,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[MessageReplyToResponse]:
-        with get_db_context(db) as db:
-            message = db.get(Message, parent_id)
+        async with get_async_db_context(db) as db:
+            message = await db.get(Message, parent_id)
 
             if not message:
                 return []
 
-            all_messages = (
-                db.query(Message)
+            result = await db.execute(
+                select(Message)
                 .filter_by(channel_id=channel_id, parent_id=parent_id)
                 .order_by(Message.created_at.desc())
                 .offset(skip)
                 .limit(limit)
-                .all()
             )
+            all_messages = list(result.scalars().all())
 
             # If length of all_messages is less than limit, then add the parent message
             if len(all_messages) < limit:
@@ -357,27 +351,12 @@ class MessageTable:
             messages = []
             for message in all_messages:
                 reply_to_message = (
-                    self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
+                    await self.get_message_by_id(message.reply_to_id, include_thread_replies=False, db=db)
                     if message.reply_to_id
                     else None
                 )
 
-                webhook_info = message.meta.get('webhook') if message.meta else None
-                user_info = None
-                if webhook_info and webhook_info.get('id'):
-                    webhook = Channels.get_webhook_by_id(webhook_info.get('id'), db=db)
-                    if webhook:
-                        user_info = {
-                            'id': webhook.id,
-                            'name': webhook.name,
-                            'role': 'webhook',
-                        }
-                    else:
-                        user_info = {
-                            'id': webhook_info.get('id'),
-                            'name': 'Deleted Webhook',
-                            'role': 'webhook',
-                        }
+                user_info = await self._resolve_user_info(message, db)
 
                 messages.append(
                     MessageReplyToResponse.model_validate(
@@ -390,34 +369,39 @@ class MessageTable:
                 )
             return messages
 
-    def get_last_message_by_channel_id(self, channel_id: str, db: Optional[Session] = None) -> Optional[MessageModel]:
-        with get_db_context(db) as db:
-            message = db.query(Message).filter_by(channel_id=channel_id).order_by(Message.created_at.desc()).first()
+    async def get_last_message_by_channel_id(
+        self, channel_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[MessageModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Message).filter_by(channel_id=channel_id).order_by(Message.created_at.desc()).limit(1)
+            )
+            message = result.scalars().first()
             return MessageModel.model_validate(message) if message else None
 
-    def get_pinned_messages_by_channel_id(
+    async def get_pinned_messages_by_channel_id(
         self,
         channel_id: str,
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[MessageModel]:
-        with get_db_context(db) as db:
-            all_messages = (
-                db.query(Message)
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Message)
                 .filter_by(channel_id=channel_id, is_pinned=True)
                 .order_by(Message.pinned_at.desc())
                 .offset(skip)
                 .limit(limit)
-                .all()
             )
+            all_messages = result.scalars().all()
             return [MessageModel.model_validate(message) for message in all_messages]
 
-    def update_message_by_id(
-        self, id: str, form_data: MessageForm, db: Optional[Session] = None
+    async def update_message_by_id(
+        self, id: str, form_data: MessageForm, db: Optional[AsyncSession] = None
     ) -> Optional[MessageModel]:
-        with get_db_context(db) as db:
-            message = db.get(Message, id)
+        async with get_async_db_context(db) as db:
+            message = await db.get(Message, id)
             message.content = form_data.content
             message.data = {
                 **(message.data if message.data else {}),
@@ -428,49 +412,51 @@ class MessageTable:
                 **(form_data.meta if form_data.meta else {}),
             }
             message.updated_at = int(time.time_ns())
-            db.commit()
-            db.refresh(message)
+            await db.commit()
+            await db.refresh(message)
             return MessageModel.model_validate(message) if message else None
 
-    def update_is_pinned_by_id(
+    async def update_is_pinned_by_id(
         self,
         id: str,
         is_pinned: bool,
         pinned_by: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[MessageModel]:
-        with get_db_context(db) as db:
-            message = db.get(Message, id)
+        async with get_async_db_context(db) as db:
+            message = await db.get(Message, id)
             message.is_pinned = is_pinned
             message.pinned_at = int(time.time_ns()) if is_pinned else None
             message.pinned_by = pinned_by if is_pinned else None
-            db.commit()
-            db.refresh(message)
+            await db.commit()
+            await db.refresh(message)
             return MessageModel.model_validate(message) if message else None
 
-    def get_unread_message_count(
+    async def get_unread_message_count(
         self,
         channel_id: str,
         user_id: str,
         last_read_at: Optional[int] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> int:
-        with get_db_context(db) as db:
-            query = db.query(Message).filter(
+        async with get_async_db_context(db) as db:
+            stmt = select(func.count(Message.id)).filter(
                 Message.channel_id == channel_id,
                 Message.parent_id == None,  # only count top-level messages
                 Message.created_at > (last_read_at if last_read_at else 0),
             )
             if user_id:
-                query = query.filter(Message.user_id != user_id)
-            return query.count()
+                stmt = stmt.filter(Message.user_id != user_id)
+            result = await db.execute(stmt)
+            return result.scalar()
 
-    def add_reaction_to_message(
-        self, id: str, user_id: str, name: str, db: Optional[Session] = None
+    async def add_reaction_to_message(
+        self, id: str, user_id: str, name: str, db: Optional[AsyncSession] = None
     ) -> Optional[MessageReactionModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             # check for existing reaction
-            existing_reaction = db.query(MessageReaction).filter_by(message_id=id, user_id=user_id, name=name).first()
+            result = await db.execute(select(MessageReaction).filter_by(message_id=id, user_id=user_id, name=name))
+            existing_reaction = result.scalars().first()
             if existing_reaction:
                 return MessageReactionModel.model_validate(existing_reaction)
 
@@ -484,19 +470,19 @@ class MessageTable:
             )
             result = MessageReaction(**reaction.model_dump())
             db.add(result)
-            db.commit()
-            db.refresh(result)
+            await db.commit()
+            await db.refresh(result)
             return MessageReactionModel.model_validate(result) if result else None
 
-    def get_reactions_by_message_id(self, id: str, db: Optional[Session] = None) -> list[Reactions]:
-        with get_db_context(db) as db:
+    async def get_reactions_by_message_id(self, id: str, db: Optional[AsyncSession] = None) -> list[Reactions]:
+        async with get_async_db_context(db) as db:
             # JOIN User so all user info is fetched in one query
-            results = (
-                db.query(MessageReaction, User)
+            result = await db.execute(
+                select(MessageReaction, User)
                 .join(User, MessageReaction.user_id == User.id)
                 .filter(MessageReaction.message_id == id)
-                .all()
             )
+            results = result.all()
 
             reactions = {}
 
@@ -518,58 +504,60 @@ class MessageTable:
 
             return [Reactions(**reaction) for reaction in reactions.values()]
 
-    def remove_reaction_by_id_and_user_id_and_name(
-        self, id: str, user_id: str, name: str, db: Optional[Session] = None
+    async def remove_reaction_by_id_and_user_id_and_name(
+        self, id: str, user_id: str, name: str, db: Optional[AsyncSession] = None
     ) -> bool:
-        with get_db_context(db) as db:
-            db.query(MessageReaction).filter_by(message_id=id, user_id=user_id, name=name).delete()
-            db.commit()
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(MessageReaction).filter_by(message_id=id, user_id=user_id, name=name))
+            await db.commit()
             return True
 
-    def delete_reactions_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            db.query(MessageReaction).filter_by(message_id=id).delete()
-            db.commit()
+    async def delete_reactions_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(MessageReaction).filter_by(message_id=id))
+            await db.commit()
             return True
 
-    def delete_replies_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            db.query(Message).filter_by(parent_id=id).delete()
-            db.commit()
+    async def delete_replies_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(Message).filter_by(parent_id=id))
+            await db.commit()
             return True
 
-    def delete_message_by_id(self, id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            db.query(Message).filter_by(id=id).delete()
+    async def delete_message_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(Message).filter_by(id=id))
 
             # Delete all reactions to this message
-            db.query(MessageReaction).filter_by(message_id=id).delete()
+            await db.execute(delete(MessageReaction).filter_by(message_id=id))
 
-            db.commit()
+            await db.commit()
             return True
 
-    def search_messages_by_channel_ids(
+    async def search_messages_by_channel_ids(
         self,
         channel_ids: list[str],
         query: str,
         start_timestamp: Optional[int] = None,
         end_timestamp: Optional[int] = None,
         limit: int = 10,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[MessageModel]:
         """Search messages in specified channels by content."""
-        with get_db_context(db) as db:
-            query_builder = db.query(Message).filter(
+        async with get_async_db_context(db) as db:
+            stmt = select(Message).filter(
                 Message.channel_id.in_(channel_ids),
                 Message.content.ilike(f'%{query}%'),
             )
 
             if start_timestamp:
-                query_builder = query_builder.filter(Message.created_at >= start_timestamp)
+                stmt = stmt.filter(Message.created_at >= start_timestamp)
             if end_timestamp:
-                query_builder = query_builder.filter(Message.created_at <= end_timestamp)
+                stmt = stmt.filter(Message.created_at <= end_timestamp)
 
-            messages = query_builder.order_by(Message.created_at.desc()).limit(limit).all()
+            stmt = stmt.order_by(Message.created_at.desc()).limit(limit)
+            result = await db.execute(stmt)
+            messages = result.scalars().all()
             return [MessageModel.model_validate(msg) for msg in messages]
 
 

backend/open_webui/models/models.py

@@ -1,9 +1,11 @@
+import json
 import logging
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update, or_, func, String, cast
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 
 from open_webui.models.groups import Groups
 from open_webui.models.users import User, UserModel, Users, UserResponse
@@ -12,9 +14,6 @@ from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 from pydantic import BaseModel, ConfigDict, Field, model_validator
 
-from sqlalchemy import String, cast, or_, and_, func
-from sqlalchemy.dialects import postgresql, sqlite
-
 from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy import BigInteger, Column, Text, Boolean
 
@@ -154,26 +153,26 @@ class ModelForm(BaseModel):
 
 
 class ModelsTable:
-    def _get_access_grants(self, model_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('model', model_id, db=db)
+    async def _get_access_grants(self, model_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('model', model_id, db=db)
 
-    def _to_model_model(
+    async def _to_model_model(
         self,
         model: Model,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> ModelModel:
         model_data = ModelModel.model_validate(model).model_dump(exclude={'access_grants'})
         model_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(model_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(model_data['id'], db=db)
         )
         return ModelModel.model_validate(model_data)
 
-    def insert_new_model(
-        self, form_data: ModelForm, user_id: str, db: Optional[Session] = None
+    async def insert_new_model(
+        self, form_data: ModelForm, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[ModelModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 result = Model(
                     **{
                         **form_data.model_dump(exclude={'access_grants'}),
@@ -183,37 +182,40 @@ class ModelsTable:
                     }
                 )
                 db.add(result)
-                db.commit()
-                db.refresh(result)
-                AccessGrants.set_access_grants('model', result.id, form_data.access_grants, db=db)
+                await db.commit()
+                await db.refresh(result)
+                await AccessGrants.set_access_grants('model', result.id, form_data.access_grants, db=db)
 
                 if result:
-                    return self._to_model_model(result, db=db)
+                    return await self._to_model_model(result, db=db)
                 else:
                     return None
         except Exception as e:
             log.exception(f'Failed to insert a new model: {e}')
             return None
 
-    def get_all_models(self, db: Optional[Session] = None) -> list[ModelModel]:
-        with get_db_context(db) as db:
-            all_models = db.query(Model).all()
+    async def get_all_models(self, db: Optional[AsyncSession] = None) -> list[ModelModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Model))
+            all_models = result.scalars().all()
             model_ids = [model.id for model in all_models]
-            grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
             return [
-                self._to_model_model(model, access_grants=grants_map.get(model.id, []), db=db) for model in all_models
+                await self._to_model_model(model, access_grants=grants_map.get(model.id, []), db=db)
+                for model in all_models
             ]
 
-    def get_models(self, db: Optional[Session] = None) -> list[ModelUserResponse]:
-        with get_db_context(db) as db:
-            all_models = db.query(Model).filter(Model.base_model_id != None).all()
+    async def get_models(self, db: Optional[AsyncSession] = None) -> list[ModelUserResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Model).filter(Model.base_model_id != None))
+            all_models = result.scalars().all()
 
             user_ids = list(set(model.user_id for model in all_models))
             model_ids = [model.id for model in all_models]
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
-            grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
 
             models = []
             for model in all_models:
@@ -221,10 +223,12 @@ class ModelsTable:
                 models.append(
                     ModelUserResponse.model_validate(
                         {
-                            **self._to_model_model(
-                                model,
-                                access_grants=grants_map.get(model.id, []),
-                                db=db,
+                            **(
+                                await self._to_model_model(
+                                    model,
+                                    access_grants=grants_map.get(model.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             'user': user.model_dump() if user else None,
                         }
@@ -232,33 +236,38 @@ class ModelsTable:
                 )
             return models
 
-    def get_base_models(self, db: Optional[Session] = None) -> list[ModelModel]:
-        with get_db_context(db) as db:
-            all_models = db.query(Model).filter(Model.base_model_id == None).all()
+    async def get_base_models(self, db: Optional[AsyncSession] = None) -> list[ModelModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Model).filter(Model.base_model_id == None))
+            all_models = result.scalars().all()
             model_ids = [model.id for model in all_models]
-            grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
             return [
-                self._to_model_model(model, access_grants=grants_map.get(model.id, []), db=db) for model in all_models
+                await self._to_model_model(model, access_grants=grants_map.get(model.id, []), db=db)
+                for model in all_models
             ]
 
-    def get_models_by_user_id(
-        self, user_id: str, permission: str = 'write', db: Optional[Session] = None
+    async def get_models_by_user_id(
+        self, user_id: str, permission: str = 'write', db: Optional[AsyncSession] = None
     ) -> list[ModelUserResponse]:
-        models = self.get_models(db=db)
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
-        return [
-            model
-            for model in models
-            if model.user_id == user_id
-            or AccessGrants.has_access(
+        models = await self.get_models(db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
+
+        result = []
+        for model in models:
+            if model.user_id == user_id:
+                result.append(model)
+            elif await AccessGrants.has_access(
                 user_id=user_id,
                 resource_type='model',
                 resource_id=model.id,
                 permission=permission,
                 user_group_ids=user_group_ids,
                 db=db,
-            )
-        ]
+            ):
+                result.append(model)
+        return result
 
     def _has_permission(self, db, query, filter: dict, permission: str = 'read'):
         return AccessGrants.has_permission_filter(
@@ -270,23 +279,22 @@ class ModelsTable:
             permission=permission,
         )
 
-    def search_models(
+    async def search_models(
         self,
         user_id: str,
         filter: dict = {},
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> ModelListResponse:
-        with get_db_context(db) as db:
-            # Join GroupMember so we can order by group_id when requested
-            query = db.query(Model, User).outerjoin(User, User.id == Model.user_id)
-            query = query.filter(Model.base_model_id != None)
+        async with get_async_db_context(db) as db:
+            stmt = select(Model, User).outerjoin(User, User.id == Model.user_id)
+            stmt = stmt.filter(Model.base_model_id != None)
 
             if filter:
                 query_key = filter.get('query')
                 if query_key:
-                    query = query.filter(
+                    stmt = stmt.filter(
                         or_(
                             Model.name.ilike(f'%{query_key}%'),
                             Model.base_model_id.ilike(f'%{query_key}%'),
@@ -298,69 +306,82 @@ class ModelsTable:
 
                 view_option = filter.get('view_option')
                 if view_option == 'created':
-                    query = query.filter(Model.user_id == user_id)
+                    stmt = stmt.filter(Model.user_id == user_id)
                 elif view_option == 'shared':
-                    query = query.filter(Model.user_id != user_id)
+                    stmt = stmt.filter(Model.user_id != user_id)
 
                 # Apply access control filtering
-                query = self._has_permission(
+                stmt = self._has_permission(
                     db,
-                    query,
+                    stmt,
                     filter,
                     permission='read',
                 )
 
                 tag = filter.get('tag')
                 if tag:
-                    # TODO: This is a simple implementation and should be improved for performance
-                    like_pattern = f'%"{tag.lower()}"%'  # `"tag"` inside JSON array
-                    meta_text = func.lower(cast(Model.meta, String))
-
-                    query = query.filter(meta_text.like(like_pattern))
+                    # SQLite stores JSON text via json.dumps(ensure_ascii=True),
+                    # so non-ASCII chars are \uXXXX-escaped. PostgreSQL native JSONB
+                    # stores literal Unicode. Use the right pattern for each.
+                    if db.bind.dialect.name == 'sqlite':
+                        if tag.isascii():
+                            meta_text = func.lower(cast(Model.meta, String))
+                            pattern = f'%{json.dumps(tag.lower())}%'
+                        else:
+                            meta_text = cast(Model.meta, String)
+                            pattern = f'%{json.dumps(tag)}%'
+                    else:
+                        meta_text = func.lower(cast(Model.meta, String))
+                        pattern = f'%{json.dumps(tag.lower(), ensure_ascii=False)}%'
+                    stmt = stmt.filter(meta_text.like(pattern))
 
                 order_by = filter.get('order_by')
                 direction = filter.get('direction')
 
                 if order_by == 'name':
                     if direction == 'asc':
-                        query = query.order_by(Model.name.asc())
+                        stmt = stmt.order_by(Model.name.asc())
                     else:
-                        query = query.order_by(Model.name.desc())
+                        stmt = stmt.order_by(Model.name.desc())
                 elif order_by == 'created_at':
                     if direction == 'asc':
-                        query = query.order_by(Model.created_at.asc())
+                        stmt = stmt.order_by(Model.created_at.asc())
                     else:
-                        query = query.order_by(Model.created_at.desc())
+                        stmt = stmt.order_by(Model.created_at.desc())
                 elif order_by == 'updated_at':
                     if direction == 'asc':
-                        query = query.order_by(Model.updated_at.asc())
+                        stmt = stmt.order_by(Model.updated_at.asc())
                     else:
-                        query = query.order_by(Model.updated_at.desc())
+                        stmt = stmt.order_by(Model.updated_at.desc())
 
             else:
-                query = query.order_by(Model.created_at.desc())
+                stmt = stmt.order_by(Model.created_at.desc())
 
             # Count BEFORE pagination
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
             if skip:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit:
-                query = query.limit(limit)
+                stmt = stmt.limit(limit)
 
-            items = query.all()
+            result = await db.execute(stmt)
+            items = result.all()
 
             model_ids = [model.id for model, _ in items]
-            grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
 
             models = []
             for model, user in items:
                 models.append(
                     ModelUserResponse(
-                        **self._to_model_model(
-                            model,
-                            access_grants=grants_map.get(model.id, []),
-                            db=db,
+                        **(
+                            await self._to_model_model(
+                                model,
+                                access_grants=grants_map.get(model.id, []),
+                                db=db,
+                            )
                         ).model_dump(),
                         user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
                     )
@@ -368,22 +389,23 @@ class ModelsTable:
 
             return ModelListResponse(items=models, total=total)
 
-    def get_model_by_id(self, id: str, db: Optional[Session] = None) -> Optional[ModelModel]:
+    async def get_model_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ModelModel]:
         try:
-            with get_db_context(db) as db:
-                model = db.get(Model, id)
-                return self._to_model_model(model, db=db) if model else None
+            async with get_async_db_context(db) as db:
+                model = await db.get(Model, id)
+                return await self._to_model_model(model, db=db) if model else None
         except Exception:
             return None
 
-    def get_models_by_ids(self, ids: list[str], db: Optional[Session] = None) -> list[ModelModel]:
+    async def get_models_by_ids(self, ids: list[str], db: Optional[AsyncSession] = None) -> list[ModelModel]:
         try:
-            with get_db_context(db) as db:
-                models = db.query(Model).filter(Model.id.in_(ids)).all()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Model).filter(Model.id.in_(ids)))
+                models = result.scalars().all()
                 model_ids = [model.id for model in models]
-                grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+                grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
                 return [
-                    self._to_model_model(
+                    await self._to_model_model(
                         model,
                         access_grants=grants_map.get(model.id, []),
                         db=db,
@@ -393,67 +415,90 @@ class ModelsTable:
         except Exception:
             return []
 
-    def toggle_model_by_id(self, id: str, db: Optional[Session] = None) -> Optional[ModelModel]:
-        with get_db_context(db) as db:
+    async def toggle_model_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ModelModel]:
+        async with get_async_db_context(db) as db:
             try:
-                model = db.query(Model).filter_by(id=id).first()
+                result = await db.execute(select(Model).filter_by(id=id))
+                model = result.scalars().first()
                 if not model:
                     return None
 
                 model.is_active = not model.is_active
                 model.updated_at = int(time.time())
-                db.commit()
-                db.refresh(model)
+                await db.commit()
+                await db.refresh(model)
 
-                return self._to_model_model(model, db=db)
+                return await self._to_model_model(model, db=db)
             except Exception:
                 return None
 
-    def update_model_by_id(self, id: str, model: ModelForm, db: Optional[Session] = None) -> Optional[ModelModel]:
+    async def update_model_by_id(
+        self, id: str, model: ModelForm, db: Optional[AsyncSession] = None
+    ) -> Optional[ModelModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # update only the fields that are present in the model
                 data = model.model_dump(exclude={'id', 'access_grants'})
-                result = db.query(Model).filter_by(id=id).update(data)
+                data['updated_at'] = int(time.time())
+                await db.execute(update(Model).filter_by(id=id).values(**data))
 
-                db.commit()
+                await db.commit()
                 if model.access_grants is not None:
-                    AccessGrants.set_access_grants('model', id, model.access_grants, db=db)
+                    await AccessGrants.set_access_grants('model', id, model.access_grants, db=db)
 
-                return self.get_model_by_id(id, db=db)
+                return await self.get_model_by_id(id, db=db)
         except Exception as e:
             log.exception(f'Failed to update the model by id {id}: {e}')
             return None
 
-    def delete_model_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def update_model_updated_at_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ModelModel]:
         try:
-            with get_db_context(db) as db:
-                AccessGrants.revoke_all_access('model', id, db=db)
-                db.query(Model).filter_by(id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Model).filter_by(id=id))
+                model_obj = result.scalars().first()
+                if not model_obj:
+                    return None
+                model_obj.updated_at = int(time.time())
+                await db.commit()
+                await db.refresh(model_obj)
+                return await self._to_model_model(model_obj, db=db)
+        except Exception as e:
+            log.exception(f'Failed to update the model updated_at by id {id}: {e}')
+            return None
+
+    async def delete_model_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        try:
+            async with get_async_db_context(db) as db:
+                await AccessGrants.revoke_all_access('model', id, db=db)
+                await db.execute(delete(Model).filter_by(id=id))
+                await db.commit()
 
                 return True
         except Exception:
             return False
 
-    def delete_all_models(self, db: Optional[Session] = None) -> bool:
+    async def delete_all_models(self, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                model_ids = [row[0] for row in db.query(Model.id).all()]
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Model.id))
+                model_ids = [row[0] for row in result.all()]
                 for model_id in model_ids:
-                    AccessGrants.revoke_all_access('model', model_id, db=db)
-                db.query(Model).delete()
-                db.commit()
+                    await AccessGrants.revoke_all_access('model', model_id, db=db)
+                await db.execute(delete(Model))
+                await db.commit()
 
                 return True
         except Exception:
             return False
 
-    def sync_models(self, user_id: str, models: list[ModelModel], db: Optional[Session] = None) -> list[ModelModel]:
+    async def sync_models(
+        self, user_id: str, models: list[ModelModel], db: Optional[AsyncSession] = None
+    ) -> list[ModelModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 # Get existing models
-                existing_models = db.query(Model).all()
+                result = await db.execute(select(Model))
+                existing_models = result.scalars().all()
                 existing_ids = {model.id for model in existing_models}
 
                 # Prepare a set of new model IDs
@@ -462,12 +507,14 @@ class ModelsTable:
                 # Update or insert models
                 for model in models:
                     if model.id in existing_ids:
-                        db.query(Model).filter_by(id=model.id).update(
-                            {
+                        await db.execute(
+                            update(Model)
+                            .filter_by(id=model.id)
+                            .values(
                                 **model.model_dump(exclude={'access_grants'}),
-                                'user_id': user_id,
-                                'updated_at': int(time.time()),
-                            }
+                                user_id=user_id,
+                                updated_at=int(time.time()),
+                            )
                         )
                     else:
                         new_model = Model(
@@ -478,21 +525,22 @@ class ModelsTable:
                             }
                         )
                         db.add(new_model)
-                    AccessGrants.set_access_grants('model', model.id, model.access_grants, db=db)
+                    await AccessGrants.set_access_grants('model', model.id, model.access_grants, db=db)
 
                 # Remove models that are no longer present
                 for model in existing_models:
                     if model.id not in new_model_ids:
-                        AccessGrants.revoke_all_access('model', model.id, db=db)
-                        db.delete(model)
+                        await AccessGrants.revoke_all_access('model', model.id, db=db)
+                        await db.delete(model)
 
-                db.commit()
+                await db.commit()
 
-                all_models = db.query(Model).all()
+                result = await db.execute(select(Model))
+                all_models = result.scalars().all()
                 model_ids = [model.id for model in all_models]
-                grants_map = AccessGrants.get_grants_by_resources('model', model_ids, db=db)
+                grants_map = await AccessGrants.get_grants_by_resources('model', model_ids, db=db)
                 return [
-                    self._to_model_model(
+                    await self._to_model_model(
                         model,
                         access_grants=grants_map.get(model.id, []),
                         db=db,

backend/open_webui/models/notes.py

@@ -4,8 +4,9 @@ import uuid
 from typing import Optional
 from functools import lru_cache
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db, get_db_context
+from sqlalchemy import Boolean, select, delete, update, or_, func, cast
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
 from open_webui.models.groups import Groups
 from open_webui.models.users import User, UserModel, Users, UserResponse
 from open_webui.models.access_grants import AccessGrantModel, AccessGrants
@@ -13,7 +14,6 @@ from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy import BigInteger, Column, Text, JSON
-from sqlalchemy import or_, func, cast
 
 ####################
 # Note DB Schema
@@ -29,6 +29,7 @@ class Note(Base):
     title = Column(Text)
     data = Column(JSON, nullable=True)
     meta = Column(JSON, nullable=True)
+    is_pinned = Column(Boolean, default=False, nullable=True)
 
     created_at = Column(BigInteger)
     updated_at = Column(BigInteger)
@@ -43,6 +44,7 @@ class NoteModel(BaseModel):
     title: str
     data: Optional[dict] = None
     meta: Optional[dict] = None
+    is_pinned: Optional[bool] = False
 
     access_grants: list[AccessGrantModel] = Field(default_factory=list)
 
@@ -77,6 +79,7 @@ class NoteItemResponse(BaseModel):
     id: str
     title: str
     data: Optional[dict]
+    is_pinned: Optional[bool] = False
     updated_at: int
     created_at: int
     user: Optional[UserResponse] = None
@@ -88,18 +91,18 @@ class NoteListResponse(BaseModel):
 
 
 class NoteTable:
-    def _get_access_grants(self, note_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('note', note_id, db=db)
+    async def _get_access_grants(self, note_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('note', note_id, db=db)
 
-    def _to_note_model(
+    async def _to_note_model(
         self,
         note: Note,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> NoteModel:
         note_data = NoteModel.model_validate(note).model_dump(exclude={'access_grants'})
         note_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(note_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(note_data['id'], db=db)
         )
         return NoteModel.model_validate(note_data)
 
@@ -113,8 +116,10 @@ class NoteTable:
             permission=permission,
         )
 
-    def insert_new_note(self, user_id: str, form_data: NoteForm, db: Optional[Session] = None) -> Optional[NoteModel]:
-        with get_db_context(db) as db:
+    async def insert_new_note(
+        self, user_id: str, form_data: NoteForm, db: Optional[AsyncSession] = None
+    ) -> Optional[NoteModel]:
+        async with get_async_db_context(db) as db:
             note = NoteModel(
                 **{
                     'id': str(uuid.uuid4()),
@@ -129,53 +134,58 @@ class NoteTable:
             new_note = Note(**note.model_dump(exclude={'access_grants'}))
 
             db.add(new_note)
-            db.commit()
-            AccessGrants.set_access_grants('note', note.id, form_data.access_grants, db=db)
-            return self._to_note_model(new_note, db=db)
+            await db.commit()
+            await AccessGrants.set_access_grants('note', note.id, form_data.access_grants, db=db)
+            return await self._to_note_model(new_note, db=db)
 
-    def get_notes(self, skip: int = 0, limit: int = 50, db: Optional[Session] = None) -> list[NoteModel]:
-        with get_db_context(db) as db:
-            query = db.query(Note).order_by(Note.updated_at.desc())
+    async def get_notes(self, skip: int = 0, limit: int = 50, db: Optional[AsyncSession] = None) -> list[NoteModel]:
+        async with get_async_db_context(db) as db:
+            stmt = select(Note).order_by(Note.updated_at.desc())
             if skip is not None:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit is not None:
-                query = query.limit(limit)
-            notes = query.all()
+                stmt = stmt.limit(limit)
+            result = await db.execute(stmt)
+            notes = result.scalars().all()
             note_ids = [note.id for note in notes]
-            grants_map = AccessGrants.get_grants_by_resources('note', note_ids, db=db)
-            return [self._to_note_model(note, access_grants=grants_map.get(note.id, []), db=db) for note in notes]
+            grants_map = await AccessGrants.get_grants_by_resources('note', note_ids, db=db)
+            return [await self._to_note_model(note, access_grants=grants_map.get(note.id, []), db=db) for note in notes]
 
-    def search_notes(
+    async def search_notes(
         self,
         user_id: str,
         filter: dict = {},
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> NoteListResponse:
-        with get_db_context(db) as db:
-            query = db.query(Note, User).outerjoin(User, User.id == Note.user_id)
+        async with get_async_db_context(db) as db:
+            stmt = select(Note, User).outerjoin(User, User.id == Note.user_id)
             if filter:
                 query_key = filter.get('query')
                 if query_key:
-                    # Normalize search by removing hyphens and spaces (e.g., "todo" matches "to-do" and "to do")
-                    normalized_query = query_key.replace('-', '').replace(' ', '')
-                    query = query.filter(
-                        or_(
-                            func.replace(func.replace(Note.title, '-', ''), ' ', '').ilike(f'%{normalized_query}%'),
-                            func.replace(
-                                func.replace(cast(Note.data['content']['md'], Text), '-', ''),
-                                ' ',
-                                '',
-                            ).ilike(f'%{normalized_query}%'),
+                    # Split query into individual words and normalize each
+                    # (strip hyphens so "todo" matches "to-do").
+                    # All words must match somewhere in title OR content (AND semantics).
+                    search_words = query_key.split()
+                    normalized_words = [w.replace('-', '') for w in search_words if w.replace('-', '')]
+                    for word in normalized_words:
+                        stmt = stmt.filter(
+                            or_(
+                                func.replace(func.replace(Note.title, '-', ''), ' ', '').ilike(f'%{word}%'),
+                                func.replace(
+                                    func.replace(cast(Note.data['content']['md'], Text), '-', ''),
+                                    ' ',
+                                    '',
+                                ).ilike(f'%{word}%'),
+                            )
                         )
-                    )
 
                 view_option = filter.get('view_option')
                 if view_option == 'created':
-                    query = query.filter(Note.user_id == user_id)
+                    stmt = stmt.filter(Note.user_id == user_id)
                 elif view_option == 'shared':
-                    query = query.filter(Note.user_id != user_id)
+                    stmt = stmt.filter(Note.user_id != user_id)
 
                 # Apply access control filtering
                 if 'permission' in filter:
@@ -183,9 +193,9 @@ class NoteTable:
                 else:
                     permission = 'write'
 
-                query = self._has_permission(
+                stmt = self._has_permission(
                     db,
-                    query,
+                    stmt,
                     filter,
                     permission=permission,
                 )
@@ -195,46 +205,50 @@ class NoteTable:
 
                 if order_by == 'name':
                     if direction == 'asc':
-                        query = query.order_by(Note.title.asc())
+                        stmt = stmt.order_by(Note.title.asc())
                     else:
-                        query = query.order_by(Note.title.desc())
+                        stmt = stmt.order_by(Note.title.desc())
                 elif order_by == 'created_at':
                     if direction == 'asc':
-                        query = query.order_by(Note.created_at.asc())
+                        stmt = stmt.order_by(Note.created_at.asc())
                     else:
-                        query = query.order_by(Note.created_at.desc())
+                        stmt = stmt.order_by(Note.created_at.desc())
                 elif order_by == 'updated_at':
                     if direction == 'asc':
-                        query = query.order_by(Note.updated_at.asc())
+                        stmt = stmt.order_by(Note.updated_at.asc())
                     else:
-                        query = query.order_by(Note.updated_at.desc())
+                        stmt = stmt.order_by(Note.updated_at.desc())
                 else:
-                    query = query.order_by(Note.updated_at.desc())
+                    stmt = stmt.order_by(Note.updated_at.desc())
 
             else:
-                query = query.order_by(Note.updated_at.desc())
+                stmt = stmt.order_by(Note.updated_at.desc())
 
             # Count BEFORE pagination
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
             if skip:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit:
-                query = query.limit(limit)
+                stmt = stmt.limit(limit)
 
-            items = query.all()
+            result = await db.execute(stmt)
+            items = result.all()
 
             note_ids = [note.id for note, _ in items]
-            grants_map = AccessGrants.get_grants_by_resources('note', note_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('note', note_ids, db=db)
 
             notes = []
             for note, user in items:
                 notes.append(
                     NoteUserResponse(
-                        **self._to_note_model(
-                            note,
-                            access_grants=grants_map.get(note.id, []),
-                            db=db,
+                        **(
+                            await self._to_note_model(
+                                note,
+                                access_grants=grants_map.get(note.id, []),
+                                db=db,
+                            )
                         ).model_dump(),
                         user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
                     )
@@ -242,40 +256,44 @@ class NoteTable:
 
             return NoteListResponse(items=notes, total=total)
 
-    def get_notes_by_user_id(
+    async def get_notes_by_user_id(
         self,
         user_id: str,
         permission: str = 'read',
         skip: int = 0,
         limit: int = 50,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[NoteModel]:
-        with get_db_context(db) as db:
-            user_group_ids = [group.id for group in Groups.get_groups_by_member_id(user_id, db=db)]
+        async with get_async_db_context(db) as db:
+            user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+            user_group_ids = [group.id for group in user_groups]
 
-            query = db.query(Note).order_by(Note.updated_at.desc())
-            query = self._has_permission(db, query, {'user_id': user_id, 'group_ids': user_group_ids}, permission)
+            stmt = select(Note).order_by(Note.updated_at.desc())
+            stmt = self._has_permission(db, stmt, {'user_id': user_id, 'group_ids': user_group_ids}, permission)
 
             if skip is not None:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit is not None:
-                query = query.limit(limit)
+                stmt = stmt.limit(limit)
 
-            notes = query.all()
+            result = await db.execute(stmt)
+            notes = result.scalars().all()
             note_ids = [note.id for note in notes]
-            grants_map = AccessGrants.get_grants_by_resources('note', note_ids, db=db)
-            return [self._to_note_model(note, access_grants=grants_map.get(note.id, []), db=db) for note in notes]
+            grants_map = await AccessGrants.get_grants_by_resources('note', note_ids, db=db)
+            return [await self._to_note_model(note, access_grants=grants_map.get(note.id, []), db=db) for note in notes]
 
-    def get_note_by_id(self, id: str, db: Optional[Session] = None) -> Optional[NoteModel]:
-        with get_db_context(db) as db:
-            note = db.query(Note).filter(Note.id == id).first()
-            return self._to_note_model(note, db=db) if note else None
+    async def get_note_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[NoteModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Note).filter(Note.id == id))
+            note = result.scalars().first()
+            return await self._to_note_model(note, db=db) if note else None
 
-    def update_note_by_id(
-        self, id: str, form_data: NoteUpdateForm, db: Optional[Session] = None
+    async def update_note_by_id(
+        self, id: str, form_data: NoteUpdateForm, db: Optional[AsyncSession] = None
     ) -> Optional[NoteModel]:
-        with get_db_context(db) as db:
-            note = db.query(Note).filter(Note.id == id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Note).filter(Note.id == id))
+            note = result.scalars().first()
             if not note:
                 return None
 
@@ -289,19 +307,52 @@ class NoteTable:
                 note.meta = {**note.meta, **form_data['meta']}
 
             if 'access_grants' in form_data:
-                AccessGrants.set_access_grants('note', id, form_data['access_grants'], db=db)
+                await AccessGrants.set_access_grants('note', id, form_data['access_grants'], db=db)
 
             note.updated_at = int(time.time_ns())
 
-            db.commit()
-            return self._to_note_model(note, db=db) if note else None
+            await db.commit()
+            return await self._to_note_model(note, db=db) if note else None
 
-    def delete_note_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def toggle_note_pinned_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[NoteModel]:
         try:
-            with get_db_context(db) as db:
-                AccessGrants.revoke_all_access('note', id, db=db)
-                db.query(Note).filter(Note.id == id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Note).filter(Note.id == id))
+                note = result.scalars().first()
+                if not note:
+                    return None
+                note.is_pinned = not note.is_pinned
+                note.updated_at = int(time.time_ns())
+                await db.commit()
+                return await self._to_note_model(note, db=db)
+        except Exception:
+            return None
+
+    async def get_pinned_notes_by_user_id(
+        self,
+        user_id: str,
+        permission: str = 'read',
+        db: Optional[AsyncSession] = None,
+    ) -> list[NoteModel]:
+        async with get_async_db_context(db) as db:
+            user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+            user_group_ids = [group.id for group in user_groups]
+
+            stmt = select(Note).filter(Note.is_pinned == True).order_by(Note.updated_at.desc())
+            stmt = self._has_permission(db, stmt, {'user_id': user_id, 'group_ids': user_group_ids}, permission)
+
+            result = await db.execute(stmt)
+            notes = result.scalars().all()
+            note_ids = [note.id for note in notes]
+            grants_map = await AccessGrants.get_grants_by_resources('note', note_ids, db=db)
+            return [await self._to_note_model(note, access_grants=grants_map.get(note.id, []), db=db) for note in notes]
+
+    async def delete_note_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
+        try:
+            async with get_async_db_context(db) as db:
+                await AccessGrants.revoke_all_access('note', id, db=db)
+                await db.execute(delete(Note).filter(Note.id == id))
+                await db.commit()
                 return True
         except Exception:
             return False

backend/open_webui/models/oauth_sessions.py

@@ -8,8 +8,9 @@ import json
 
 from cryptography.fernet import Fernet
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db, get_db_context
+from sqlalchemy import select, delete, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
 from open_webui.env import OAUTH_SESSION_TOKEN_ENCRYPTION_KEY
 
 from pydantic import BaseModel, ConfigDict
@@ -103,16 +104,16 @@ class OAuthSessionTable:
             log.error(f'Error decrypting tokens: {type(e).__name__}: {e}')
             raise
 
-    def create_session(
+    async def create_session(
         self,
         user_id: str,
         provider: str,
         token: dict,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[OAuthSessionModel]:
         """Create a new OAuth session"""
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 current_time = int(time.time())
                 id = str(uuid.uuid4())
 
@@ -122,98 +123,137 @@ class OAuthSessionTable:
                         'user_id': user_id,
                         'provider': provider,
                         'token': self._encrypt_token(token),
-                        'expires_at': token.get('expires_at'),
+                        'expires_at': token.get('expires_at') or int(time.time() + 3600),
                         'created_at': current_time,
                         'updated_at': current_time,
                     }
                 )
 
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
 
                 if result:
-                    db.expunge(result)  # Detach so dict swap is never flushed
-                    result.token = token  # Return decrypted token
-                    return OAuthSessionModel.model_validate(result)
+                    # Make a copy of the model data before closing session
+                    model = OAuthSessionModel(
+                        id=result.id,
+                        user_id=result.user_id,
+                        provider=result.provider,
+                        token=token,  # Return decrypted token
+                        expires_at=result.expires_at,
+                        created_at=result.created_at,
+                        updated_at=result.updated_at,
+                    )
+                    return model
                 else:
                     return None
         except Exception as e:
             log.error(f'Error creating OAuth session: {e}')
             return None
 
-    def get_session_by_id(self, session_id: str, db: Optional[Session] = None) -> Optional[OAuthSessionModel]:
+    async def get_session_by_id(
+        self, session_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[OAuthSessionModel]:
         """Get OAuth session by ID"""
         try:
-            with get_db_context(db) as db:
-                session = db.query(OAuthSession).filter_by(id=session_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(OAuthSession).filter_by(id=session_id))
+                session = result.scalars().first()
                 if session:
-                    db.expunge(session)
-                    session.token = self._decrypt_token(session.token)
-                    return OAuthSessionModel.model_validate(session)
+                    return OAuthSessionModel(
+                        id=session.id,
+                        user_id=session.user_id,
+                        provider=session.provider,
+                        token=self._decrypt_token(session.token),
+                        expires_at=session.expires_at,
+                        created_at=session.created_at,
+                        updated_at=session.updated_at,
+                    )
 
                 return None
         except Exception as e:
             log.error(f'Error getting OAuth session by ID: {e}')
             return None
 
-    def get_session_by_id_and_user_id(
-        self, session_id: str, user_id: str, db: Optional[Session] = None
+    async def get_session_by_id_and_user_id(
+        self, session_id: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[OAuthSessionModel]:
         """Get OAuth session by ID and user ID"""
         try:
-            with get_db_context(db) as db:
-                session = db.query(OAuthSession).filter_by(id=session_id, user_id=user_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(OAuthSession).filter_by(id=session_id, user_id=user_id))
+                session = result.scalars().first()
                 if session:
-                    db.expunge(session)
-                    session.token = self._decrypt_token(session.token)
-                    return OAuthSessionModel.model_validate(session)
+                    return OAuthSessionModel(
+                        id=session.id,
+                        user_id=session.user_id,
+                        provider=session.provider,
+                        token=self._decrypt_token(session.token),
+                        expires_at=session.expires_at,
+                        created_at=session.created_at,
+                        updated_at=session.updated_at,
+                    )
 
                 return None
         except Exception as e:
             log.error(f'Error getting OAuth session by ID: {e}')
             return None
 
-    def get_session_by_provider_and_user_id(
-        self, provider: str, user_id: str, db: Optional[Session] = None
+    async def get_session_by_provider_and_user_id(
+        self, provider: str, user_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[OAuthSessionModel]:
         """Get OAuth session by provider and user ID"""
         try:
-            with get_db_context(db) as db:
-                session = (
-                    db.query(OAuthSession)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(
+                    select(OAuthSession)
                     .filter_by(provider=provider, user_id=user_id)
                     .order_by(OAuthSession.created_at.desc())
-                    .first()
                 )
+                session = result.scalars().first()
                 if session:
-                    db.expunge(session)
-                    session.token = self._decrypt_token(session.token)
-                    return OAuthSessionModel.model_validate(session)
+                    return OAuthSessionModel(
+                        id=session.id,
+                        user_id=session.user_id,
+                        provider=session.provider,
+                        token=self._decrypt_token(session.token),
+                        expires_at=session.expires_at,
+                        created_at=session.created_at,
+                        updated_at=session.updated_at,
+                    )
 
                 return None
         except Exception as e:
             log.error(f'Error getting OAuth session by provider and user ID: {e}')
             return None
 
-    def get_sessions_by_user_id(self, user_id: str, db: Optional[Session] = None) -> List[OAuthSessionModel]:
+    async def get_sessions_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> List[OAuthSessionModel]:
         """Get all OAuth sessions for a user"""
         try:
-            with get_db_context(db) as db:
-                sessions = db.query(OAuthSession).filter_by(user_id=user_id).all()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(OAuthSession).filter_by(user_id=user_id))
+                sessions = result.scalars().all()
 
                 results = []
                 for session in sessions:
                     try:
-                        db.expunge(session)
-                        session.token = self._decrypt_token(session.token)
-                        results.append(OAuthSessionModel.model_validate(session))
+                        results.append(
+                            OAuthSessionModel(
+                                id=session.id,
+                                user_id=session.user_id,
+                                provider=session.provider,
+                                token=self._decrypt_token(session.token),
+                                expires_at=session.expires_at,
+                                created_at=session.created_at,
+                                updated_at=session.updated_at,
+                            )
+                        )
                     except Exception as e:
                         log.warning(
                             f'Skipping OAuth session {session.id} due to decryption failure, deleting corrupted session: {type(e).__name__}: {e}'
                         )
-                        db.query(OAuthSession).filter_by(id=session.id).delete()
-                        db.commit()
+                        await db.execute(delete(OAuthSession).filter_by(id=session.id))
+                        await db.commit()
 
                 return results
 
@@ -221,62 +261,71 @@ class OAuthSessionTable:
             log.error(f'Error getting OAuth sessions by user ID: {e}')
             return []
 
-    def update_session_by_id(
-        self, session_id: str, token: dict, db: Optional[Session] = None
+    async def update_session_by_id(
+        self, session_id: str, token: dict, db: Optional[AsyncSession] = None
     ) -> Optional[OAuthSessionModel]:
         """Update OAuth session tokens"""
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 current_time = int(time.time())
 
-                db.query(OAuthSession).filter_by(id=session_id).update(
-                    {
-                        'token': self._encrypt_token(token),
-                        'expires_at': token.get('expires_at'),
-                        'updated_at': current_time,
-                    }
+                await db.execute(
+                    update(OAuthSession)
+                    .filter_by(id=session_id)
+                    .values(
+                        token=self._encrypt_token(token),
+                        expires_at=token.get('expires_at') or int(time.time() + 3600),
+                        updated_at=current_time,
+                    )
                 )
-                db.commit()
-                session = db.query(OAuthSession).filter_by(id=session_id).first()
+                await db.commit()
+                result = await db.execute(select(OAuthSession).filter_by(id=session_id))
+                session = result.scalars().first()
 
                 if session:
-                    db.expunge(session)
-                    session.token = self._decrypt_token(session.token)
-                    return OAuthSessionModel.model_validate(session)
+                    return OAuthSessionModel(
+                        id=session.id,
+                        user_id=session.user_id,
+                        provider=session.provider,
+                        token=self._decrypt_token(session.token),
+                        expires_at=session.expires_at,
+                        created_at=session.created_at,
+                        updated_at=session.updated_at,
+                    )
 
                 return None
         except Exception as e:
             log.error(f'Error updating OAuth session tokens: {e}')
             return None
 
-    def delete_session_by_id(self, session_id: str, db: Optional[Session] = None) -> bool:
+    async def delete_session_by_id(self, session_id: str, db: Optional[AsyncSession] = None) -> bool:
         """Delete an OAuth session"""
         try:
-            with get_db_context(db) as db:
-                result = db.query(OAuthSession).filter_by(id=session_id).delete()
-                db.commit()
-                return result > 0
+            async with get_async_db_context(db) as db:
+                result = await db.execute(delete(OAuthSession).filter_by(id=session_id))
+                await db.commit()
+                return result.rowcount > 0
         except Exception as e:
             log.error(f'Error deleting OAuth session: {e}')
             return False
 
-    def delete_sessions_by_user_id(self, user_id: str, db: Optional[Session] = None) -> bool:
+    async def delete_sessions_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> bool:
         """Delete all OAuth sessions for a user"""
         try:
-            with get_db_context(db) as db:
-                result = db.query(OAuthSession).filter_by(user_id=user_id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(OAuthSession).filter_by(user_id=user_id))
+                await db.commit()
                 return True
         except Exception as e:
             log.error(f'Error deleting OAuth sessions by user ID: {e}')
             return False
 
-    def delete_sessions_by_provider(self, provider: str, db: Optional[Session] = None) -> bool:
+    async def delete_sessions_by_provider(self, provider: str, db: Optional[AsyncSession] = None) -> bool:
         """Delete all OAuth sessions for a provider"""
         try:
-            with get_db_context(db) as db:
-                db.query(OAuthSession).filter_by(provider=provider).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(OAuthSession).filter_by(provider=provider))
+                await db.commit()
                 return True
         except Exception as e:
             log.error(f'Error deleting OAuth sessions by provider {provider}: {e}')

backend/open_webui/models/prompt_history.py

@@ -6,8 +6,9 @@ from typing import Optional
 import json
 import difflib
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db_context
+from sqlalchemy import select, delete, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
 from open_webui.models.users import Users, UserResponse
 
 from pydantic import BaseModel, ConfigDict
@@ -49,17 +50,17 @@ class PromptHistoryResponse(PromptHistoryModel):
 
 
 class PromptHistoryTable:
-    def create_history_entry(
+    async def create_history_entry(
         self,
         prompt_id: str,
         snapshot: dict,
         user_id: str,
         parent_id: Optional[str] = None,
         commit_message: Optional[str] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptHistoryModel]:
         """Create a new history entry (commit) for a prompt."""
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             history = PromptHistory(
                 id=str(uuid.uuid4()),
                 prompt_id=prompt_id,
@@ -70,31 +71,31 @@ class PromptHistoryTable:
                 created_at=int(time.time()),
             )
             db.add(history)
-            db.commit()
-            db.refresh(history)
+            await db.commit()
+            await db.refresh(history)
             return PromptHistoryModel.model_validate(history)
 
-    def get_history_by_prompt_id(
+    async def get_history_by_prompt_id(
         self,
         prompt_id: str,
         limit: int = 50,
         offset: int = 0,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[PromptHistoryResponse]:
         """Get all history entries for a prompt, ordered by created_at desc."""
-        with get_db_context(db) as db:
-            entries = (
-                db.query(PromptHistory)
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(PromptHistory)
                 .filter(PromptHistory.prompt_id == prompt_id)
                 .order_by(PromptHistory.created_at.desc())
                 .offset(offset)
                 .limit(limit)
-                .all()
             )
+            entries = result.scalars().all()
 
             # Get user info for each entry
             user_ids = list(set(e.user_id for e in entries))
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
 
             return [
@@ -105,54 +106,61 @@ class PromptHistoryTable:
                 for entry in entries
             ]
 
-    def get_history_entry_by_id(
+    async def get_history_entry_by_id(
         self,
         history_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptHistoryModel]:
         """Get a specific history entry by ID."""
-        with get_db_context(db) as db:
-            entry = db.query(PromptHistory).filter(PromptHistory.id == history_id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(PromptHistory).filter(PromptHistory.id == history_id))
+            entry = result.scalars().first()
             if entry:
                 return PromptHistoryModel.model_validate(entry)
             return None
 
-    def get_latest_history_entry(
+    async def get_latest_history_entry(
         self,
         prompt_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptHistoryModel]:
         """Get the most recent history entry for a prompt."""
-        with get_db_context(db) as db:
-            entry = (
-                db.query(PromptHistory)
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(PromptHistory)
                 .filter(PromptHistory.prompt_id == prompt_id)
                 .order_by(PromptHistory.created_at.desc())
-                .first()
+                .limit(1)
             )
+            entry = result.scalars().first()
             if entry:
                 return PromptHistoryModel.model_validate(entry)
             return None
 
-    def get_history_count(
+    async def get_history_count(
         self,
         prompt_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> int:
         """Get the number of history entries for a prompt."""
-        with get_db_context(db) as db:
-            return db.query(PromptHistory).filter(PromptHistory.prompt_id == prompt_id).count()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(func.count()).select_from(PromptHistory).filter(PromptHistory.prompt_id == prompt_id)
+            )
+            return result.scalar()
 
-    def compute_diff(
+    async def compute_diff(
         self,
         from_id: str,
         to_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[dict]:
         """Compute diff between two history entries."""
-        with get_db_context(db) as db:
-            from_entry = db.query(PromptHistory).filter(PromptHistory.id == from_id).first()
-            to_entry = db.query(PromptHistory).filter(PromptHistory.id == to_id).first()
+        async with get_async_db_context(db) as db:
+            result_from = await db.execute(select(PromptHistory).filter(PromptHistory.id == from_id))
+            from_entry = result_from.scalars().first()
+            result_to = await db.execute(select(PromptHistory).filter(PromptHistory.id == to_id))
+            to_entry = result_to.scalars().first()
 
             if not from_entry or not to_entry:
                 return None
@@ -183,37 +191,39 @@ class PromptHistoryTable:
                 'name_changed': from_snapshot.get('name') != to_snapshot.get('name'),
             }
 
-    def delete_history_by_prompt_id(
+    async def delete_history_by_prompt_id(
         self,
         prompt_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
         """Delete all history entries for a prompt."""
-        with get_db_context(db) as db:
-            db.query(PromptHistory).filter(PromptHistory.prompt_id == prompt_id).delete()
-            db.commit()
+        async with get_async_db_context(db) as db:
+            await db.execute(delete(PromptHistory).filter(PromptHistory.prompt_id == prompt_id))
+            await db.commit()
             return True
 
-    def delete_history_entry(
+    async def delete_history_entry(
         self,
         history_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> bool:
         """Delete a history entry and reparent its children to grandparent."""
-        with get_db_context(db) as db:
-            entry = db.query(PromptHistory).filter_by(id=history_id).first()
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(PromptHistory).filter_by(id=history_id))
+            entry = result.scalars().first()
             if not entry:
                 return False
 
             # Find children that reference this entry as parent
-            children = db.query(PromptHistory).filter_by(parent_id=history_id).all()
+            children_result = await db.execute(select(PromptHistory).filter_by(parent_id=history_id))
+            children = children_result.scalars().all()
 
             # Reparent children to grandparent
             for child in children:
                 child.parent_id = entry.parent_id
 
-            db.delete(entry)
-            db.commit()
+            await db.delete(entry)
+            await db.commit()
             return True
 
 

backend/open_webui/models/prompts.py

@@ -1,17 +1,19 @@
+import json
 import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update, or_, func, text, cast, String
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.groups import Groups
-from open_webui.models.users import Users, UserResponse
+from open_webui.models.users import Users, User, UserModel, UserResponse
 from open_webui.models.prompt_history import PromptHistories
 from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 
 from pydantic import BaseModel, ConfigDict, Field
-from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON, or_, func, cast
+from sqlalchemy import BigInteger, Boolean, Column, Text, JSON
 
 ####################
 # Prompts DB Schema
@@ -92,23 +94,23 @@ class PromptForm(BaseModel):
 
 
 class PromptsTable:
-    def _get_access_grants(self, prompt_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('prompt', prompt_id, db=db)
+    async def _get_access_grants(self, prompt_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('prompt', prompt_id, db=db)
 
-    def _to_prompt_model(
+    async def _to_prompt_model(
         self,
         prompt: Prompt,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> PromptModel:
         prompt_data = PromptModel.model_validate(prompt).model_dump(exclude={'access_grants'})
         prompt_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(prompt_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(prompt_data['id'], db=db)
         )
         return PromptModel.model_validate(prompt_data)
 
-    def insert_new_prompt(
-        self, user_id: str, form_data: PromptForm, db: Optional[Session] = None
+    async def insert_new_prompt(
+        self, user_id: str, form_data: PromptForm, db: Optional[AsyncSession] = None
     ) -> Optional[PromptModel]:
         now = int(time.time())
         prompt_id = str(uuid.uuid4())
@@ -129,15 +131,15 @@ class PromptsTable:
         )
 
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 result = Prompt(**prompt.model_dump(exclude={'access_grants'}))
                 db.add(result)
-                db.commit()
-                db.refresh(result)
-                AccessGrants.set_access_grants('prompt', prompt_id, form_data.access_grants, db=db)
+                await db.commit()
+                await db.refresh(result)
+                await AccessGrants.set_access_grants('prompt', prompt_id, form_data.access_grants, db=db)
 
                 if result:
-                    current_access_grants = self._get_access_grants(prompt_id, db=db)
+                    current_access_grants = await self._get_access_grants(prompt_id, db=db)
                     snapshot = {
                         'name': form_data.name,
                         'content': form_data.content,
@@ -148,7 +150,7 @@ class PromptsTable:
                         'access_grants': [grant.model_dump() for grant in current_access_grants],
                     }
 
-                    history_entry = PromptHistories.create_history_entry(
+                    history_entry = await PromptHistories.create_history_entry(
                         prompt_id=prompt_id,
                         snapshot=snapshot,
                         user_id=user_id,
@@ -160,46 +162,51 @@ class PromptsTable:
                     # Set the initial version as the production version
                     if history_entry:
                         result.version_id = history_entry.id
-                        db.commit()
-                        db.refresh(result)
+                        await db.commit()
+                        await db.refresh(result)
 
-                    return self._to_prompt_model(result, db=db)
+                    return await self._to_prompt_model(result, db=db)
                 else:
                     return None
         except Exception:
             return None
 
-    def get_prompt_by_id(self, prompt_id: str, db: Optional[Session] = None) -> Optional[PromptModel]:
+    async def get_prompt_by_id(self, prompt_id: str, db: Optional[AsyncSession] = None) -> Optional[PromptModel]:
         """Get prompt by UUID."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if prompt:
-                    return self._to_prompt_model(prompt, db=db)
+                    return await self._to_prompt_model(prompt, db=db)
                 return None
         except Exception:
             return None
 
-    def get_prompt_by_command(self, command: str, db: Optional[Session] = None) -> Optional[PromptModel]:
+    async def get_prompt_by_command(self, command: str, db: Optional[AsyncSession] = None) -> Optional[PromptModel]:
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(command=command).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(command=command))
+                prompt = result.scalars().first()
                 if prompt:
-                    return self._to_prompt_model(prompt, db=db)
+                    return await self._to_prompt_model(prompt, db=db)
                 return None
         except Exception:
             return None
 
-    def get_prompts(self, db: Optional[Session] = None) -> list[PromptUserResponse]:
-        with get_db_context(db) as db:
-            all_prompts = db.query(Prompt).filter(Prompt.is_active == True).order_by(Prompt.updated_at.desc()).all()
+    async def get_prompts(self, db: Optional[AsyncSession] = None) -> list[PromptUserResponse]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(Prompt).filter(Prompt.is_active == True).order_by(Prompt.updated_at.desc())
+            )
+            all_prompts = result.scalars().all()
 
             user_ids = list(set(prompt.user_id for prompt in all_prompts))
             prompt_ids = [prompt.id for prompt in all_prompts]
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
-            grants_map = AccessGrants.get_grants_by_resources('prompt', prompt_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('prompt', prompt_ids, db=db)
 
             prompts = []
             for prompt in all_prompts:
@@ -207,10 +214,12 @@ class PromptsTable:
                 prompts.append(
                     PromptUserResponse.model_validate(
                         {
-                            **self._to_prompt_model(
-                                prompt,
-                                access_grants=grants_map.get(prompt.id, []),
-                                db=db,
+                            **(
+                                await self._to_prompt_model(
+                                    prompt,
+                                    access_grants=grants_map.get(prompt.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             'user': user.model_dump() if user else None,
                         }
@@ -219,39 +228,39 @@ class PromptsTable:
 
             return prompts
 
-    def get_prompts_by_user_id(
-        self, user_id: str, permission: str = 'write', db: Optional[Session] = None
+    async def get_prompts_by_user_id(
+        self, user_id: str, permission: str = 'write', db: Optional[AsyncSession] = None
     ) -> list[PromptUserResponse]:
-        prompts = self.get_prompts(db=db)
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
+        prompts = await self.get_prompts(db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
 
-        return [
-            prompt
-            for prompt in prompts
-            if prompt.user_id == user_id
-            or AccessGrants.has_access(
+        result = []
+        for prompt in prompts:
+            if prompt.user_id == user_id:
+                result.append(prompt)
+            elif await AccessGrants.has_access(
                 user_id=user_id,
                 resource_type='prompt',
                 resource_id=prompt.id,
                 permission=permission,
                 user_group_ids=user_group_ids,
                 db=db,
-            )
-        ]
+            ):
+                result.append(prompt)
+        return result
 
-    def search_prompts(
+    async def search_prompts(
         self,
         user_id: str,
         filter: dict = {},
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> PromptListResponse:
-        with get_db_context(db) as db:
-            from open_webui.models.users import User, UserModel
-
+        async with get_async_db_context(db) as db:
             # Join with User table for user filtering and sorting
-            query = db.query(Prompt, User).outerjoin(User, User.id == Prompt.user_id)
+            query = select(Prompt, User).outerjoin(User, User.id == Prompt.user_id)
 
             if filter:
                 query_key = filter.get('query')
@@ -284,10 +293,29 @@ class PromptsTable:
 
                 tag = filter.get('tag')
                 if tag:
-                    # Search for tag in JSON array field
-                    like_pattern = f'%"{tag.lower()}"%'
-                    tags_text = func.lower(cast(Prompt.tags, String))
-                    query = query.filter(tags_text.like(like_pattern))
+                    bind = await db.connection()
+                    dialect_name = bind.dialect.name
+                    tag_lower = tag.lower()
+
+                    if dialect_name == 'sqlite':
+                        tag_clause = text(
+                            'EXISTS (SELECT 1 FROM json_each(prompt.tags) t WHERE LOWER(t.value) = :tag_val)'
+                        )
+                    elif dialect_name == 'postgresql':
+                        tag_clause = text(
+                            'EXISTS (SELECT 1 FROM json_array_elements_text(prompt.tags) t WHERE LOWER(t) = :tag_val)'
+                        )
+                    else:
+                        # Fallback: LIKE on serialised JSON text (ASCII-safe only)
+                        tag_clause = func.lower(cast(Prompt.tags, String)).like(
+                            f'%{json.dumps(tag_lower, ensure_ascii=False)}%'
+                        )
+                        tag_lower = None
+
+                    if tag_lower is not None:
+                        query = query.filter(tag_clause.params(tag_val=tag_lower))
+                    else:
+                        query = query.filter(tag_clause)
 
                 order_by = filter.get('order_by')
                 direction = filter.get('direction')
@@ -313,26 +341,30 @@ class PromptsTable:
                 query = query.order_by(Prompt.updated_at.desc())
 
             # Count BEFORE pagination
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(query.subquery()))
+            total = count_result.scalar()
 
             if skip:
                 query = query.offset(skip)
             if limit:
                 query = query.limit(limit)
 
-            items = query.all()
+            result = await db.execute(query)
+            items = result.all()
 
             prompt_ids = [prompt.id for prompt, _ in items]
-            grants_map = AccessGrants.get_grants_by_resources('prompt', prompt_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('prompt', prompt_ids, db=db)
 
             prompts = []
             for prompt, user in items:
                 prompts.append(
                     PromptUserResponse(
-                        **self._to_prompt_model(
-                            prompt,
-                            access_grants=grants_map.get(prompt.id, []),
-                            db=db,
+                        **(
+                            await self._to_prompt_model(
+                                prompt,
+                                access_grants=grants_map.get(prompt.id, []),
+                                db=db,
+                            )
                         ).model_dump(),
                         user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
                     )
@@ -340,22 +372,23 @@ class PromptsTable:
 
             return PromptListResponse(items=prompts, total=total)
 
-    def update_prompt_by_command(
+    async def update_prompt_by_command(
         self,
         command: str,
         form_data: PromptForm,
         user_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptModel]:
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(command=command).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(command=command))
+                prompt = result.scalars().first()
                 if not prompt:
                     return None
 
-                latest_history = PromptHistories.get_latest_history_entry(prompt.id, db=db)
+                latest_history = await PromptHistories.get_latest_history_entry(prompt.id, db=db)
                 parent_id = latest_history.id if latest_history else None
-                current_access_grants = self._get_access_grants(prompt.id, db=db)
+                current_access_grants = await self._get_access_grants(prompt.id, db=db)
 
                 # Check if content changed to decide on history creation
                 content_changed = (
@@ -371,10 +404,10 @@ class PromptsTable:
                 prompt.meta = form_data.meta or prompt.meta
                 prompt.updated_at = int(time.time())
                 if form_data.access_grants is not None:
-                    AccessGrants.set_access_grants('prompt', prompt.id, form_data.access_grants, db=db)
-                    current_access_grants = self._get_access_grants(prompt.id, db=db)
+                    await AccessGrants.set_access_grants('prompt', prompt.id, form_data.access_grants, db=db)
+                    current_access_grants = await self._get_access_grants(prompt.id, db=db)
 
-                db.commit()
+                await db.commit()
 
                 # Create history entry only if content changed
                 if content_changed:
@@ -387,7 +420,7 @@ class PromptsTable:
                         'access_grants': [grant.model_dump() for grant in current_access_grants],
                     }
 
-                    history_entry = PromptHistories.create_history_entry(
+                    history_entry = await PromptHistories.create_history_entry(
                         prompt_id=prompt.id,
                         snapshot=snapshot,
                         user_id=user_id,
@@ -399,28 +432,29 @@ class PromptsTable:
                     # Set as production if flag is True (default)
                     if form_data.is_production and history_entry:
                         prompt.version_id = history_entry.id
-                        db.commit()
+                        await db.commit()
 
-                return self._to_prompt_model(prompt, db=db)
+                return await self._to_prompt_model(prompt, db=db)
         except Exception:
             return None
 
-    def update_prompt_by_id(
+    async def update_prompt_by_id(
         self,
         prompt_id: str,
         form_data: PromptForm,
         user_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptModel]:
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if not prompt:
                     return None
 
-                latest_history = PromptHistories.get_latest_history_entry(prompt.id, db=db)
+                latest_history = await PromptHistories.get_latest_history_entry(prompt.id, db=db)
                 parent_id = latest_history.id if latest_history else None
-                current_access_grants = self._get_access_grants(prompt.id, db=db)
+                current_access_grants = await self._get_access_grants(prompt.id, db=db)
 
                 # Check if content changed to decide on history creation
                 content_changed = (
@@ -442,12 +476,12 @@ class PromptsTable:
                     prompt.tags = form_data.tags
 
                 if form_data.access_grants is not None:
-                    AccessGrants.set_access_grants('prompt', prompt.id, form_data.access_grants, db=db)
-                    current_access_grants = self._get_access_grants(prompt.id, db=db)
+                    await AccessGrants.set_access_grants('prompt', prompt.id, form_data.access_grants, db=db)
+                    current_access_grants = await self._get_access_grants(prompt.id, db=db)
 
                 prompt.updated_at = int(time.time())
 
-                db.commit()
+                await db.commit()
 
                 # Create history entry only if content changed
                 if content_changed:
@@ -461,7 +495,7 @@ class PromptsTable:
                         'access_grants': [grant.model_dump() for grant in current_access_grants],
                     }
 
-                    history_entry = PromptHistories.create_history_entry(
+                    history_entry = await PromptHistories.create_history_entry(
                         prompt_id=prompt.id,
                         snapshot=snapshot,
                         user_id=user_id,
@@ -473,24 +507,25 @@ class PromptsTable:
                     # Set as production if flag is True (default)
                     if form_data.is_production and history_entry:
                         prompt.version_id = history_entry.id
-                        db.commit()
+                        await db.commit()
 
-                return self._to_prompt_model(prompt, db=db)
+                return await self._to_prompt_model(prompt, db=db)
         except Exception:
             return None
 
-    def update_prompt_metadata(
+    async def update_prompt_metadata(
         self,
         prompt_id: str,
         name: str,
         command: str,
         tags: Optional[list[str]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptModel]:
         """Update only name, command, and tags (no history created)."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if not prompt:
                     return None
 
@@ -501,26 +536,27 @@ class PromptsTable:
                     prompt.tags = tags
 
                 prompt.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
 
-                return self._to_prompt_model(prompt, db=db)
+                return await self._to_prompt_model(prompt, db=db)
         except Exception:
             return None
 
-    def update_prompt_version(
+    async def update_prompt_version(
         self,
         prompt_id: str,
         version_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[PromptModel]:
         """Set the active version of a prompt and restore content from that version's snapshot."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if not prompt:
                     return None
 
-                history_entry = PromptHistories.get_history_entry_by_id(version_id, db=db)
+                history_entry = await PromptHistories.get_history_entry_by_id(version_id, db=db)
 
                 if not history_entry:
                     return None
@@ -537,63 +573,67 @@ class PromptsTable:
 
                 prompt.version_id = version_id
                 prompt.updated_at = int(time.time())
-                db.commit()
+                await db.commit()
 
-                return self._to_prompt_model(prompt, db=db)
+                return await self._to_prompt_model(prompt, db=db)
         except Exception:
             return None
 
-    def toggle_prompt_active(self, prompt_id: str, db: Optional[Session] = None) -> Optional[PromptModel]:
+    async def toggle_prompt_active(self, prompt_id: str, db: Optional[AsyncSession] = None) -> Optional[PromptModel]:
         """Toggle the is_active flag on a prompt."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if prompt:
                     prompt.is_active = not prompt.is_active
                     prompt.updated_at = int(time.time())
-                    db.commit()
-                    db.refresh(prompt)
-                    return self._to_prompt_model(prompt, db=db)
+                    await db.commit()
+                    await db.refresh(prompt)
+                    return await self._to_prompt_model(prompt, db=db)
                 return None
         except Exception:
             return None
 
-    def delete_prompt_by_command(self, command: str, db: Optional[Session] = None) -> bool:
+    async def delete_prompt_by_command(self, command: str, db: Optional[AsyncSession] = None) -> bool:
         """Permanently delete a prompt and its history."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(command=command).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(command=command))
+                prompt = result.scalars().first()
                 if prompt:
-                    PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
-                    AccessGrants.revoke_all_access('prompt', prompt.id, db=db)
+                    await PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
+                    await AccessGrants.revoke_all_access('prompt', prompt.id, db=db)
 
-                    db.delete(prompt)
-                    db.commit()
+                    await db.delete(prompt)
+                    await db.commit()
                     return True
                 return False
         except Exception:
             return False
 
-    def delete_prompt_by_id(self, prompt_id: str, db: Optional[Session] = None) -> bool:
+    async def delete_prompt_by_id(self, prompt_id: str, db: Optional[AsyncSession] = None) -> bool:
         """Permanently delete a prompt and its history."""
         try:
-            with get_db_context(db) as db:
-                prompt = db.query(Prompt).filter_by(id=prompt_id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(id=prompt_id))
+                prompt = result.scalars().first()
                 if prompt:
-                    PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
-                    AccessGrants.revoke_all_access('prompt', prompt.id, db=db)
+                    await PromptHistories.delete_history_by_prompt_id(prompt.id, db=db)
+                    await AccessGrants.revoke_all_access('prompt', prompt.id, db=db)
 
-                    db.delete(prompt)
-                    db.commit()
+                    await db.delete(prompt)
+                    await db.commit()
                     return True
                 return False
         except Exception:
             return False
 
-    def get_tags(self, db: Optional[Session] = None) -> list[str]:
+    async def get_tags(self, db: Optional[AsyncSession] = None) -> list[str]:
         try:
-            with get_db_context(db) as db:
-                prompts = db.query(Prompt).filter_by(is_active=True).all()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Prompt).filter_by(is_active=True))
+                prompts = result.scalars().all()
                 tags = set()
                 for prompt in prompts:
                     if prompt.tags:

backend/open_webui/models/shared_chats.py

@@ -0,0 +1,207 @@
+import logging
+import time
+import uuid
+from typing import Optional
+
+from sqlalchemy import select, delete
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
+
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import BigInteger, Column, ForeignKey, Text, JSON
+
+log = logging.getLogger(__name__)
+
+####################
+# SharedChat DB Schema
+####################
+
+
+class SharedChat(Base):
+    __tablename__ = 'shared_chat'
+
+    id = Column(Text, primary_key=True)  # The share token (UUID) — used in /s/{id} URL
+    chat_id = Column(Text, ForeignKey('chat.id', ondelete='CASCADE'), nullable=False)
+    user_id = Column(Text, nullable=False)  # Who created this share
+
+    title = Column(Text)
+    chat = Column(JSON)  # Snapshot of chat JSON at share time
+
+    created_at = Column(BigInteger)
+    updated_at = Column(BigInteger)
+
+
+class SharedChatModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    chat_id: str
+    user_id: str
+
+    title: str
+    chat: dict
+
+    created_at: int
+    updated_at: int
+
+
+class SharedChatResponse(BaseModel):
+    id: str
+    chat_id: str
+    title: str
+    share_id: Optional[str] = None  # Alias for id, for backward compat
+    updated_at: int
+    created_at: int
+
+
+####################
+# Table Operations
+####################
+
+
+class SharedChatsTable:
+    async def create(self, chat_id: str, user_id: str, db: Optional[AsyncSession] = None) -> Optional[SharedChatModel]:
+        """
+        Create a snapshot of the chat for link sharing.
+        Returns the SharedChatModel with the share token as its id.
+        """
+        async with get_async_db_context(db) as db:
+            from open_webui.models.chats import Chat
+
+            chat = await db.get(Chat, chat_id)
+            if not chat:
+                return None
+
+            share_id = str(uuid.uuid4())
+            now = int(time.time())
+
+            shared_chat = SharedChat(
+                id=share_id,
+                chat_id=chat_id,
+                user_id=user_id,
+                title=chat.title,
+                chat=chat.chat,
+                created_at=now,
+                updated_at=now,
+            )
+            db.add(shared_chat)
+            await db.commit()
+            await db.refresh(shared_chat)
+
+            return SharedChatModel.model_validate(shared_chat)
+
+    async def update(self, share_id: str, db: Optional[AsyncSession] = None) -> Optional[SharedChatModel]:
+        """
+        Re-snapshot: update the shared chat with the current state of the original chat.
+        """
+        async with get_async_db_context(db) as db:
+            from open_webui.models.chats import Chat
+
+            shared_chat = await db.get(SharedChat, share_id)
+            if not shared_chat:
+                return None
+
+            chat = await db.get(Chat, shared_chat.chat_id)
+            if not chat:
+                return None
+
+            shared_chat.title = chat.title
+            shared_chat.chat = chat.chat
+            shared_chat.updated_at = int(time.time())
+
+            await db.commit()
+            await db.refresh(shared_chat)
+            return SharedChatModel.model_validate(shared_chat)
+
+    async def get_by_id(self, share_id: str, db: Optional[AsyncSession] = None) -> Optional[SharedChatModel]:
+        """Get a shared chat by its share token."""
+        async with get_async_db_context(db) as db:
+            shared_chat = await db.get(SharedChat, share_id)
+            if shared_chat:
+                return SharedChatModel.model_validate(shared_chat)
+            return None
+
+    async def get_by_chat_id(self, chat_id: str, db: Optional[AsyncSession] = None) -> Optional[SharedChatModel]:
+        """Get the shared chat for a given original chat. Returns the most recent one."""
+        async with get_async_db_context(db) as db:
+            result = await db.execute(
+                select(SharedChat).filter_by(chat_id=chat_id).order_by(SharedChat.updated_at.desc()).limit(1)
+            )
+            shared_chat = result.scalars().first()
+            if shared_chat:
+                return SharedChatModel.model_validate(shared_chat)
+            return None
+
+    async def get_by_user_id(
+        self,
+        user_id: str,
+        filter: Optional[dict] = None,
+        skip: int = 0,
+        limit: int = 50,
+        db: Optional[AsyncSession] = None,
+    ) -> list[SharedChatResponse]:
+        """List all shared chats created by a user."""
+        async with get_async_db_context(db) as db:
+            stmt = select(SharedChat).filter_by(user_id=user_id)
+
+            if filter:
+                query_key = filter.get('query')
+                if query_key:
+                    stmt = stmt.filter(SharedChat.title.ilike(f'%{query_key}%'))
+
+                order_by = filter.get('order_by')
+                direction = filter.get('direction')
+
+                if order_by and direction:
+                    col = getattr(SharedChat, order_by, None)
+                    if not col:
+                        raise ValueError('Invalid order_by field')
+                    if direction.lower() == 'asc':
+                        stmt = stmt.order_by(col.asc())
+                    elif direction.lower() == 'desc':
+                        stmt = stmt.order_by(col.desc())
+                    else:
+                        raise ValueError('Invalid direction for ordering')
+            else:
+                stmt = stmt.order_by(SharedChat.updated_at.desc())
+
+            if skip:
+                stmt = stmt.offset(skip)
+            if limit:
+                stmt = stmt.limit(limit)
+
+            result = await db.execute(stmt)
+            return [
+                SharedChatResponse(
+                    id=sc.chat_id,
+                    chat_id=sc.chat_id,
+                    title=sc.title,
+                    share_id=sc.id,
+                    updated_at=sc.updated_at,
+                    created_at=sc.created_at,
+                )
+                for sc in result.scalars().all()
+            ]
+
+    async def delete_by_id(self, share_id: str, db: Optional[AsyncSession] = None) -> bool:
+        """Delete a shared chat by its share token."""
+        try:
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(SharedChat).filter_by(id=share_id))
+                await db.commit()
+                return True
+        except Exception:
+            return False
+
+    async def delete_by_chat_id(self, chat_id: str, db: Optional[AsyncSession] = None) -> bool:
+        """Delete all shared chats for a given original chat."""
+        try:
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(SharedChat).filter_by(chat_id=chat_id))
+                await db.commit()
+                return True
+        except Exception:
+            return False
+
+
+SharedChats = SharedChatsTable()

backend/open_webui/models/skills.py

@@ -2,14 +2,15 @@ import logging
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, get_db, get_db_context
-from open_webui.models.users import Users, UserResponse
+from sqlalchemy import select, delete, update, or_
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, get_async_db_context
+from open_webui.models.users import Users, User, UserModel, UserResponse
 from open_webui.models.groups import Groups
 from open_webui.models.access_grants import AccessGrantModel, AccessGrants
 
 from pydantic import BaseModel, ConfigDict, Field
-from sqlalchemy import JSON, BigInteger, Boolean, Column, String, Text, or_
+from sqlalchemy import JSON, BigInteger, Boolean, Column, String, Text, func
 
 log = logging.getLogger(__name__)
 
@@ -105,28 +106,28 @@ class SkillAccessListResponse(BaseModel):
 
 
 class SkillsTable:
-    def _get_access_grants(self, skill_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('skill', skill_id, db=db)
+    async def _get_access_grants(self, skill_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('skill', skill_id, db=db)
 
-    def _to_skill_model(
+    async def _to_skill_model(
         self,
         skill: Skill,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> SkillModel:
         skill_data = SkillModel.model_validate(skill).model_dump(exclude={'access_grants'})
         skill_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(skill_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(skill_data['id'], db=db)
         )
         return SkillModel.model_validate(skill_data)
 
-    def insert_new_skill(
+    async def insert_new_skill(
         self,
         user_id: str,
         form_data: SkillForm,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[SkillModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
                 result = Skill(
                     **{
@@ -137,43 +138,45 @@ class SkillsTable:
                     }
                 )
                 db.add(result)
-                db.commit()
-                db.refresh(result)
-                AccessGrants.set_access_grants('skill', result.id, form_data.access_grants, db=db)
+                await db.commit()
+                await db.refresh(result)
+                await AccessGrants.set_access_grants('skill', result.id, form_data.access_grants, db=db)
                 if result:
-                    return self._to_skill_model(result, db=db)
+                    return await self._to_skill_model(result, db=db)
                 else:
                     return None
             except Exception as e:
                 log.exception(f'Error creating a new skill: {e}')
                 return None
 
-    def get_skill_by_id(self, id: str, db: Optional[Session] = None) -> Optional[SkillModel]:
+    async def get_skill_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[SkillModel]:
         try:
-            with get_db_context(db) as db:
-                skill = db.get(Skill, id)
-                return self._to_skill_model(skill, db=db) if skill else None
+            async with get_async_db_context(db) as db:
+                skill = await db.get(Skill, id)
+                return await self._to_skill_model(skill, db=db) if skill else None
         except Exception:
             return None
 
-    def get_skill_by_name(self, name: str, db: Optional[Session] = None) -> Optional[SkillModel]:
+    async def get_skill_by_name(self, name: str, db: Optional[AsyncSession] = None) -> Optional[SkillModel]:
         try:
-            with get_db_context(db) as db:
-                skill = db.query(Skill).filter_by(name=name).first()
-                return self._to_skill_model(skill, db=db) if skill else None
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Skill).filter_by(name=name))
+                skill = result.scalars().first()
+                return await self._to_skill_model(skill, db=db) if skill else None
         except Exception:
             return None
 
-    def get_skills(self, db: Optional[Session] = None) -> list[SkillUserModel]:
-        with get_db_context(db) as db:
-            all_skills = db.query(Skill).order_by(Skill.updated_at.desc()).all()
+    async def get_skills(self, db: Optional[AsyncSession] = None) -> list[SkillUserModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Skill).order_by(Skill.updated_at.desc()))
+            all_skills = result.scalars().all()
 
             user_ids = list(set(skill.user_id for skill in all_skills))
             skill_ids = [skill.id for skill in all_skills]
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
-            grants_map = AccessGrants.get_grants_by_resources('skill', skill_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('skill', skill_ids, db=db)
 
             skills = []
             for skill in all_skills:
@@ -181,10 +184,12 @@ class SkillsTable:
                 skills.append(
                     SkillUserModel.model_validate(
                         {
-                            **self._to_skill_model(
-                                skill,
-                                access_grants=grants_map.get(skill.id, []),
-                                db=db,
+                            **(
+                                await self._to_skill_model(
+                                    skill,
+                                    access_grants=grants_map.get(skill.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             'user': user.model_dump() if user else None,
                         }
@@ -192,45 +197,45 @@ class SkillsTable:
                 )
             return skills
 
-    def get_skills_by_user_id(
-        self, user_id: str, permission: str = 'write', db: Optional[Session] = None
+    async def get_skills_by_user_id(
+        self, user_id: str, permission: str = 'write', db: Optional[AsyncSession] = None
     ) -> list[SkillUserModel]:
-        skills = self.get_skills(db=db)
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
+        skills = await self.get_skills(db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
 
-        return [
-            skill
-            for skill in skills
-            if skill.user_id == user_id
-            or AccessGrants.has_access(
+        result = []
+        for skill in skills:
+            if skill.user_id == user_id:
+                result.append(skill)
+            elif await AccessGrants.has_access(
                 user_id=user_id,
                 resource_type='skill',
                 resource_id=skill.id,
                 permission=permission,
                 user_group_ids=user_group_ids,
                 db=db,
-            )
-        ]
+            ):
+                result.append(skill)
+        return result
 
-    def search_skills(
+    async def search_skills(
         self,
         user_id: str,
         filter: dict = {},
         skip: int = 0,
         limit: int = 30,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> SkillListResponse:
         try:
-            with get_db_context(db) as db:
-                from open_webui.models.users import User, UserModel
-
+            async with get_async_db_context(db) as db:
                 # Join with User table for user filtering
-                query = db.query(Skill, User).outerjoin(User, User.id == Skill.user_id)
+                stmt = select(Skill, User).outerjoin(User, User.id == Skill.user_id)
 
                 if filter:
                     query_key = filter.get('query')
                     if query_key:
-                        query = query.filter(
+                        stmt = stmt.filter(
                             or_(
                                 Skill.name.ilike(f'%{query_key}%'),
                                 Skill.description.ilike(f'%{query_key}%'),
@@ -242,43 +247,47 @@ class SkillsTable:
 
                     view_option = filter.get('view_option')
                     if view_option == 'created':
-                        query = query.filter(Skill.user_id == user_id)
+                        stmt = stmt.filter(Skill.user_id == user_id)
                     elif view_option == 'shared':
-                        query = query.filter(Skill.user_id != user_id)
+                        stmt = stmt.filter(Skill.user_id != user_id)
 
                     # Apply access grant filtering
-                    query = AccessGrants.has_permission_filter(
+                    stmt = AccessGrants.has_permission_filter(
                         db=db,
-                        query=query,
+                        query=stmt,
                         DocumentModel=Skill,
                         filter=filter,
                         resource_type='skill',
                         permission='read',
                     )
 
-                query = query.order_by(Skill.updated_at.desc())
+                stmt = stmt.order_by(Skill.updated_at.desc())
 
                 # Count BEFORE pagination
-                total = query.count()
+                count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+                total = count_result.scalar()
 
                 if skip:
-                    query = query.offset(skip)
+                    stmt = stmt.offset(skip)
                 if limit:
-                    query = query.limit(limit)
+                    stmt = stmt.limit(limit)
 
-                items = query.all()
+                result = await db.execute(stmt)
+                items = result.all()
 
                 skill_ids = [skill.id for skill, _ in items]
-                grants_map = AccessGrants.get_grants_by_resources('skill', skill_ids, db=db)
+                grants_map = await AccessGrants.get_grants_by_resources('skill', skill_ids, db=db)
 
                 skills = []
                 for skill, user in items:
                     skills.append(
                         SkillUserResponse(
-                            **self._to_skill_model(
-                                skill,
-                                access_grants=grants_map.get(skill.id, []),
-                                db=db,
+                            **(
+                                await self._to_skill_model(
+                                    skill,
+                                    access_grants=grants_map.get(skill.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             user=(UserResponse(**UserModel.model_validate(user).model_dump()) if user else None),
                         )
@@ -289,43 +298,46 @@ class SkillsTable:
             log.exception(f'Error searching skills: {e}')
             return SkillListResponse(items=[], total=0)
 
-    def update_skill_by_id(self, id: str, updated: dict, db: Optional[Session] = None) -> Optional[SkillModel]:
+    async def update_skill_by_id(
+        self, id: str, updated: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[SkillModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 access_grants = updated.pop('access_grants', None)
-                db.query(Skill).filter_by(id=id).update({**updated, 'updated_at': int(time.time())})
-                db.commit()
+                await db.execute(update(Skill).filter_by(id=id).values(**updated, updated_at=int(time.time())))
+                await db.commit()
                 if access_grants is not None:
-                    AccessGrants.set_access_grants('skill', id, access_grants, db=db)
+                    await AccessGrants.set_access_grants('skill', id, access_grants, db=db)
 
-                skill = db.query(Skill).get(id)
-                db.refresh(skill)
-                return self._to_skill_model(skill, db=db)
+                skill = await db.get(Skill, id)
+                await db.refresh(skill)
+                return await self._to_skill_model(skill, db=db)
         except Exception:
             return None
 
-    def toggle_skill_by_id(self, id: str, db: Optional[Session] = None) -> Optional[SkillModel]:
-        with get_db_context(db) as db:
+    async def toggle_skill_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[SkillModel]:
+        async with get_async_db_context(db) as db:
             try:
-                skill = db.query(Skill).filter_by(id=id).first()
+                result = await db.execute(select(Skill).filter_by(id=id))
+                skill = result.scalars().first()
                 if not skill:
                     return None
 
                 skill.is_active = not skill.is_active
                 skill.updated_at = int(time.time())
-                db.commit()
-                db.refresh(skill)
+                await db.commit()
+                await db.refresh(skill)
 
-                return self._to_skill_model(skill, db=db)
+                return await self._to_skill_model(skill, db=db)
             except Exception:
                 return None
 
-    def delete_skill_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_skill_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                AccessGrants.revoke_all_access('skill', id, db=db)
-                db.query(Skill).filter_by(id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await AccessGrants.revoke_all_access('skill', id, db=db)
+                await db.execute(delete(Skill).filter_by(id=id))
+                await db.commit()
 
                 return True
         except Exception:

backend/open_webui/models/tags.py

@@ -3,8 +3,9 @@ import time
 import uuid
 from typing import Optional
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 
 
 from pydantic import BaseModel, ConfigDict
@@ -53,15 +54,15 @@ class TagChatIdForm(BaseModel):
 
 
 class TagTable:
-    def insert_new_tag(self, name: str, user_id: str, db: Optional[Session] = None) -> Optional[TagModel]:
-        with get_db_context(db) as db:
+    async def insert_new_tag(self, name: str, user_id: str, db: Optional[AsyncSession] = None) -> Optional[TagModel]:
+        async with get_async_db_context(db) as db:
             id = name.replace(' ', '_').lower()
             tag = TagModel(**{'id': id, 'user_id': user_id, 'name': name})
             try:
                 result = Tag(**tag.model_dump())
                 db.add(result)
-                db.commit()
-                db.refresh(result)
+                await db.commit()
+                await db.refresh(result)
                 if result:
                     return TagModel.model_validate(result)
                 else:
@@ -70,64 +71,71 @@ class TagTable:
                 log.exception(f'Error inserting a new tag: {e}')
                 return None
 
-    def get_tag_by_name_and_user_id(self, name: str, user_id: str, db: Optional[Session] = None) -> Optional[TagModel]:
+    async def get_tag_by_name_and_user_id(
+        self, name: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[TagModel]:
         try:
             id = name.replace(' ', '_').lower()
-            with get_db_context(db) as db:
-                tag = db.query(Tag).filter_by(id=id, user_id=user_id).first()
-                return TagModel.model_validate(tag)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(Tag).filter_by(id=id, user_id=user_id))
+                tag = result.scalars().first()
+                return TagModel.model_validate(tag) if tag else None
         except Exception:
             return None
 
-    def get_tags_by_user_id(self, user_id: str, db: Optional[Session] = None) -> list[TagModel]:
-        with get_db_context(db) as db:
-            return [TagModel.model_validate(tag) for tag in (db.query(Tag).filter_by(user_id=user_id).all())]
+    async def get_tags_by_user_id(self, user_id: str, db: Optional[AsyncSession] = None) -> list[TagModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Tag).filter_by(user_id=user_id))
+            return [TagModel.model_validate(tag) for tag in result.scalars().all()]
 
-    def get_tags_by_ids_and_user_id(self, ids: list[str], user_id: str, db: Optional[Session] = None) -> list[TagModel]:
-        with get_db_context(db) as db:
-            return [
-                TagModel.model_validate(tag)
-                for tag in (db.query(Tag).filter(Tag.id.in_(ids), Tag.user_id == user_id).all())
-            ]
+    async def get_tags_by_ids_and_user_id(
+        self, ids: list[str], user_id: str, db: Optional[AsyncSession] = None
+    ) -> list[TagModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Tag).filter(Tag.id.in_(ids), Tag.user_id == user_id))
+            return [TagModel.model_validate(tag) for tag in result.scalars().all()]
 
-    def delete_tag_by_name_and_user_id(self, name: str, user_id: str, db: Optional[Session] = None) -> bool:
+    async def delete_tag_by_name_and_user_id(self, name: str, user_id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 id = name.replace(' ', '_').lower()
-                res = db.query(Tag).filter_by(id=id, user_id=user_id).delete()
-                log.debug(f'res: {res}')
-                db.commit()
+                result = await db.execute(delete(Tag).filter_by(id=id, user_id=user_id))
+                log.debug(f'res: {result.rowcount}')
+                await db.commit()
                 return True
         except Exception as e:
             log.error(f'delete_tag: {e}')
             return False
 
-    def delete_tags_by_ids_and_user_id(self, ids: list[str], user_id: str, db: Optional[Session] = None) -> bool:
+    async def delete_tags_by_ids_and_user_id(
+        self, ids: list[str], user_id: str, db: Optional[AsyncSession] = None
+    ) -> bool:
         """Delete all tags whose id is in *ids* for the given user, in one query."""
         if not ids:
             return True
         try:
-            with get_db_context(db) as db:
-                db.query(Tag).filter(Tag.id.in_(ids), Tag.user_id == user_id).delete(synchronize_session=False)
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(Tag).filter(Tag.id.in_(ids), Tag.user_id == user_id))
+                await db.commit()
                 return True
         except Exception as e:
             log.error(f'delete_tags_by_ids: {e}')
             return False
 
-    def ensure_tags_exist(self, names: list[str], user_id: str, db: Optional[Session] = None) -> None:
+    async def ensure_tags_exist(self, names: list[str], user_id: str, db: Optional[AsyncSession] = None) -> None:
         """Create tag rows for any *names* that don't already exist for *user_id*."""
         if not names:
             return
         ids = [n.replace(' ', '_').lower() for n in names]
-        with get_db_context(db) as db:
-            existing = {t.id for t in db.query(Tag.id).filter(Tag.id.in_(ids), Tag.user_id == user_id).all()}
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(Tag.id).filter(Tag.id.in_(ids), Tag.user_id == user_id))
+            existing = {row[0] for row in result.all()}
             new_tags = [
                 Tag(id=tag_id, name=name, user_id=user_id) for tag_id, name in zip(ids, names) if tag_id not in existing
             ]
             if new_tags:
                 db.add_all(new_tags)
-                db.commit()
+                await db.commit()
 
 
 Tags = TagTable()

backend/open_webui/models/tools.py

@@ -2,8 +2,9 @@ import logging
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session, defer
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
+from sqlalchemy import select, delete, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 from open_webui.models.users import Users, UserResponse
 from open_webui.models.groups import Groups
 from open_webui.models.access_grants import AccessGrantModel, AccessGrants
@@ -97,29 +98,29 @@ class ToolValves(BaseModel):
 
 
 class ToolsTable:
-    def _get_access_grants(self, tool_id: str, db: Optional[Session] = None) -> list[AccessGrantModel]:
-        return AccessGrants.get_grants_by_resource('tool', tool_id, db=db)
+    async def _get_access_grants(self, tool_id: str, db: Optional[AsyncSession] = None) -> list[AccessGrantModel]:
+        return await AccessGrants.get_grants_by_resource('tool', tool_id, db=db)
 
-    def _to_tool_model(
+    async def _to_tool_model(
         self,
         tool: Tool,
         access_grants: Optional[list[AccessGrantModel]] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> ToolModel:
         tool_data = ToolModel.model_validate(tool).model_dump(exclude={'access_grants'})
         tool_data['access_grants'] = (
-            access_grants if access_grants is not None else self._get_access_grants(tool_data['id'], db=db)
+            access_grants if access_grants is not None else await self._get_access_grants(tool_data['id'], db=db)
         )
         return ToolModel.model_validate(tool_data)
 
-    def insert_new_tool(
+    async def insert_new_tool(
         self,
         user_id: str,
         form_data: ToolForm,
         specs: list[dict],
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[ToolModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             try:
                 result = Tool(
                     **{
@@ -131,38 +132,39 @@ class ToolsTable:
                     }
                 )
                 db.add(result)
-                db.commit()
-                db.refresh(result)
-                AccessGrants.set_access_grants('tool', result.id, form_data.access_grants, db=db)
+                await db.commit()
+                await db.refresh(result)
+                await AccessGrants.set_access_grants('tool', result.id, form_data.access_grants, db=db)
                 if result:
-                    return self._to_tool_model(result, db=db)
+                    return await self._to_tool_model(result, db=db)
                 else:
                     return None
             except Exception as e:
                 log.exception(f'Error creating a new tool: {e}')
                 return None
 
-    def get_tool_by_id(self, id: str, db: Optional[Session] = None) -> Optional[ToolModel]:
+    async def get_tool_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[ToolModel]:
         try:
-            with get_db_context(db) as db:
-                tool = db.get(Tool, id)
-                return self._to_tool_model(tool, db=db) if tool else None
+            async with get_async_db_context(db) as db:
+                tool = await db.get(Tool, id)
+                return await self._to_tool_model(tool, db=db) if tool else None
         except Exception:
             return None
 
-    def get_tools(self, defer_content: bool = False, db: Optional[Session] = None) -> list[ToolUserModel]:
-        with get_db_context(db) as db:
-            query = db.query(Tool).order_by(Tool.updated_at.desc())
+    async def get_tools(self, defer_content: bool = False, db: Optional[AsyncSession] = None) -> list[ToolUserModel]:
+        async with get_async_db_context(db) as db:
+            stmt = select(Tool).order_by(Tool.updated_at.desc())
             if defer_content:
-                query = query.options(defer(Tool.content), defer(Tool.specs))
-            all_tools = query.all()
+                stmt = stmt
+            result = await db.execute(stmt)
+            all_tools = result.scalars().all()
 
             user_ids = list(set(tool.user_id for tool in all_tools))
             tool_ids = [tool.id for tool in all_tools]
 
-            users = Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
+            users = await Users.get_users_by_user_ids(user_ids, db=db) if user_ids else []
             users_dict = {user.id: user for user in users}
-            grants_map = AccessGrants.get_grants_by_resources('tool', tool_ids, db=db)
+            grants_map = await AccessGrants.get_grants_by_resources('tool', tool_ids, db=db)
 
             tools = []
             for tool in all_tools:
@@ -170,10 +172,12 @@ class ToolsTable:
                 tools.append(
                     ToolUserModel.model_validate(
                         {
-                            **self._to_tool_model(
-                                tool,
-                                access_grants=grants_map.get(tool.id, []),
-                                db=db,
+                            **(
+                                await self._to_tool_model(
+                                    tool,
+                                    access_grants=grants_map.get(tool.id, []),
+                                    db=db,
+                                )
                             ).model_dump(),
                             'user': user.model_dump() if user else None,
                         }
@@ -181,51 +185,57 @@ class ToolsTable:
                 )
             return tools
 
-    def get_tools_by_user_id(
+    async def get_tools_by_user_id(
         self,
         user_id: str,
         permission: str = 'write',
         defer_content: bool = False,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> list[ToolUserModel]:
-        tools = self.get_tools(defer_content=defer_content, db=db)
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id, db=db)}
+        tools = await self.get_tools(defer_content=defer_content, db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
+        user_group_ids = {group.id for group in user_groups}
 
-        return [
-            tool
-            for tool in tools
-            if tool.user_id == user_id
-            or AccessGrants.has_access(
+        result = []
+        for tool in tools:
+            if tool.user_id == user_id:
+                result.append(tool)
+            elif await AccessGrants.has_access(
                 user_id=user_id,
                 resource_type='tool',
                 resource_id=tool.id,
                 permission=permission,
                 user_group_ids=user_group_ids,
                 db=db,
-            )
-        ]
+            ):
+                result.append(tool)
+        return result
 
-    def get_tool_valves_by_id(self, id: str, db: Optional[Session] = None) -> Optional[dict]:
+    async def get_tool_valves_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[dict]:
         try:
-            with get_db_context(db) as db:
-                tool = db.get(Tool, id)
+            async with get_async_db_context(db) as db:
+                tool = await db.get(Tool, id)
                 return tool.valves if tool.valves else {}
         except Exception as e:
             log.exception(f'Error getting tool valves by id {id}')
             return None
 
-    def update_tool_valves_by_id(self, id: str, valves: dict, db: Optional[Session] = None) -> Optional[ToolValves]:
+    async def update_tool_valves_by_id(
+        self, id: str, valves: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[ToolValves]:
         try:
-            with get_db_context(db) as db:
-                db.query(Tool).filter_by(id=id).update({'valves': valves, 'updated_at': int(time.time())})
-                db.commit()
-                return self.get_tool_by_id(id, db=db)
+            async with get_async_db_context(db) as db:
+                await db.execute(update(Tool).filter_by(id=id).values(valves=valves, updated_at=int(time.time())))
+                await db.commit()
+                return await self.get_tool_by_id(id, db=db)
         except Exception:
             return None
 
-    def get_user_valves_by_id_and_user_id(self, id: str, user_id: str, db: Optional[Session] = None) -> Optional[dict]:
+    async def get_user_valves_by_id_and_user_id(
+        self, id: str, user_id: str, db: Optional[AsyncSession] = None
+    ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id, db=db)
+            user = await Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "tools" and "valves" settings
@@ -239,11 +249,11 @@ class ToolsTable:
             log.exception(f'Error getting user values by id {id} and user_id {user_id}: {e}')
             return None
 
-    def update_user_valves_by_id_and_user_id(
-        self, id: str, user_id: str, valves: dict, db: Optional[Session] = None
+    async def update_user_valves_by_id_and_user_id(
+        self, id: str, user_id: str, valves: dict, db: Optional[AsyncSession] = None
     ) -> Optional[dict]:
         try:
-            user = Users.get_user_by_id(user_id, db=db)
+            user = await Users.get_user_by_id(user_id, db=db)
             user_settings = user.settings.model_dump() if user.settings else {}
 
             # Check if user has "tools" and "valves" settings
@@ -255,34 +265,34 @@ class ToolsTable:
             user_settings['tools']['valves'][id] = valves
 
             # Update the user settings in the database
-            Users.update_user_by_id(user_id, {'settings': user_settings}, db=db)
+            await Users.update_user_by_id(user_id, {'settings': user_settings}, db=db)
 
             return user_settings['tools']['valves'][id]
         except Exception as e:
             log.exception(f'Error updating user valves by id {id} and user_id {user_id}: {e}')
             return None
 
-    def update_tool_by_id(self, id: str, updated: dict, db: Optional[Session] = None) -> Optional[ToolModel]:
+    async def update_tool_by_id(self, id: str, updated: dict, db: Optional[AsyncSession] = None) -> Optional[ToolModel]:
         try:
-            with get_db_context(db) as db:
+            async with get_async_db_context(db) as db:
                 access_grants = updated.pop('access_grants', None)
-                db.query(Tool).filter_by(id=id).update({**updated, 'updated_at': int(time.time())})
-                db.commit()
+                await db.execute(update(Tool).filter_by(id=id).values(**updated, updated_at=int(time.time())))
+                await db.commit()
                 if access_grants is not None:
-                    AccessGrants.set_access_grants('tool', id, access_grants, db=db)
+                    await AccessGrants.set_access_grants('tool', id, access_grants, db=db)
 
-                tool = db.query(Tool).get(id)
-                db.refresh(tool)
-                return self._to_tool_model(tool, db=db)
+                tool = await db.get(Tool, id)
+                await db.refresh(tool)
+                return await self._to_tool_model(tool, db=db)
         except Exception:
             return None
 
-    def delete_tool_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_tool_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                AccessGrants.revoke_all_access('tool', id, db=db)
-                db.query(Tool).filter_by(id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await AccessGrants.revoke_all_access('tool', id, db=db)
+                await db.execute(delete(Tool).filter_by(id=id))
+                await db.commit()
 
                 return True
         except Exception:

backend/open_webui/models/users.py

@@ -1,20 +1,15 @@
 import time
 from typing import Optional
 
-from sqlalchemy.orm import Session, defer
-from open_webui.internal.db import Base, JSONField, get_db, get_db_context
-
+from sqlalchemy import select, delete, update, func, or_, case, exists
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import Base, JSONField, get_async_db_context
 
 from open_webui.env import DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL
 
-from open_webui.models.chats import Chats
-from open_webui.models.groups import Groups, GroupMember
-from open_webui.models.channels import ChannelMember
-
 from open_webui.utils.misc import throttle
 from open_webui.utils.validate import validate_profile_image_url
 
-
 from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 from sqlalchemy import (
     BigInteger,
@@ -24,11 +19,8 @@ from sqlalchemy import (
     Boolean,
     Text,
     Date,
-    exists,
-    select,
     cast,
 )
-from sqlalchemy import or_, case, func
 from sqlalchemy.dialects.postgresql import JSONB
 
 import datetime
@@ -247,20 +239,22 @@ class UserRoleUpdateForm(BaseModel):
 
 
 class UserUpdateForm(BaseModel):
-    role: str
-    name: str
-    email: str
-    profile_image_url: str
+    role: Optional[str] = None
+    name: Optional[str] = None
+    email: Optional[str] = None
+    profile_image_url: Optional[str] = None
     password: Optional[str] = None
 
-    @field_validator('profile_image_url')
+    @field_validator('profile_image_url', mode='before')
     @classmethod
-    def check_profile_image_url(cls, v: str) -> str:
+    def check_profile_image_url(cls, v: Optional[str]) -> Optional[str]:
+        if v is None:
+            return v
         return validate_profile_image_url(v)
 
 
 class UsersTable:
-    def insert_new_user(
+    async def insert_new_user(
         self,
         id: str,
         name: str,
@@ -269,9 +263,9 @@ class UsersTable:
         role: str = 'pending',
         username: Optional[str] = None,
         oauth: Optional[dict] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[UserModel]:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
             user = UserModel(
                 **{
                     'id': id,
@@ -288,87 +282,100 @@ class UsersTable:
             )
             result = User(**user.model_dump())
             db.add(result)
-            db.commit()
-            db.refresh(result)
+            await db.commit()
+            await db.refresh(result)
             if result:
                 return user
             else:
                 return None
 
-    def get_user_by_id(self, id: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def get_user_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
-                return UserModel.model_validate(user)
-        except Exception:
-            return None
-
-    def get_user_by_api_key(self, api_key: str, db: Optional[Session] = None) -> Optional[UserModel]:
-        try:
-            with get_db_context(db) as db:
-                user = db.query(User).join(ApiKey, User.id == ApiKey.user_id).filter(ApiKey.key == api_key).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_user_by_email(self, email: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def get_user_by_api_key(self, api_key: str, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter(func.lower(User.email) == email.lower()).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(
+                    select(User).join(ApiKey, User.id == ApiKey.user_id).filter(ApiKey.key == api_key)
+                )
+                user = result.scalars().first()
                 return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_user_by_oauth_sub(self, provider: str, sub: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def get_user_by_email(self, email: str, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:  # type: Session
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter(func.lower(User.email) == email.lower()))
+                user = result.scalars().first()
+                return UserModel.model_validate(user) if user else None
+        except Exception:
+            return None
+
+    async def get_user_by_oauth_sub(
+        self, provider: str, sub: str, db: Optional[AsyncSession] = None
+    ) -> Optional[UserModel]:
+        try:
+            async with get_async_db_context(db) as db:
                 dialect_name = db.bind.dialect.name
 
-                query = db.query(User)
+                stmt = select(User)
                 if dialect_name == 'sqlite':
-                    query = query.filter(User.oauth.contains({provider: {'sub': sub}}))
+                    stmt = stmt.filter(User.oauth.contains({provider: {'sub': sub}}))
                 elif dialect_name == 'postgresql':
-                    query = query.filter(User.oauth[provider].cast(JSONB)['sub'].astext == sub)
+                    stmt = stmt.filter(User.oauth[provider].cast(JSONB)['sub'].astext == sub)
 
-                user = query.first()
+                result = await db.execute(stmt)
+                user = result.scalars().first()
                 return UserModel.model_validate(user) if user else None
         except Exception as e:
             # You may want to log the exception here
             return None
 
-    def get_user_by_scim_external_id(
-        self, provider: str, external_id: str, db: Optional[Session] = None
+    async def get_user_by_scim_external_id(
+        self, provider: str, external_id: str, db: Optional[AsyncSession] = None
     ) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:  # type: Session
+            async with get_async_db_context(db) as db:
                 dialect_name = db.bind.dialect.name
 
-                query = db.query(User)
+                stmt = select(User)
                 if dialect_name == 'sqlite':
-                    query = query.filter(User.scim.contains({provider: {'external_id': external_id}}))
+                    stmt = stmt.filter(User.scim.contains({provider: {'external_id': external_id}}))
                 elif dialect_name == 'postgresql':
-                    query = query.filter(User.scim[provider].cast(JSONB)['external_id'].astext == external_id)
+                    stmt = stmt.filter(User.scim[provider].cast(JSONB)['external_id'].astext == external_id)
 
-                user = query.first()
+                result = await db.execute(stmt)
+                user = result.scalars().first()
                 return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_users(
+    async def get_users(
         self,
         filter: Optional[dict] = None,
         skip: Optional[int] = None,
         limit: Optional[int] = None,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> dict:
-        with get_db_context(db) as db:
+        async with get_async_db_context(db) as db:
+            # Import here to avoid circular imports
+            from open_webui.models.groups import GroupMember
+            from open_webui.models.channels import ChannelMember
+
             # Join GroupMember so we can order by group_id when requested
-            query = db.query(User).options(defer(User.profile_image_url))
+            stmt = select(User)
 
             if filter:
                 query_key = filter.get('query')
                 if query_key:
-                    query = query.filter(
+                    stmt = stmt.filter(
                         or_(
                             User.name.ilike(f'%{query_key}%'),
                             User.email.ilike(f'%{query_key}%'),
@@ -377,7 +384,7 @@ class UsersTable:
 
                 channel_id = filter.get('channel_id')
                 if channel_id:
-                    query = query.filter(
+                    stmt = stmt.filter(
                         exists(
                             select(ChannelMember.id).where(
                                 ChannelMember.user_id == User.id,
@@ -395,10 +402,10 @@ class UsersTable:
                         return {'users': [], 'total': 0}
 
                 if user_ids:
-                    query = query.filter(User.id.in_(user_ids))
+                    stmt = stmt.filter(User.id.in_(user_ids))
 
                 if group_ids:
-                    query = query.filter(
+                    stmt = stmt.filter(
                         exists(
                             select(GroupMember.id).where(
                                 GroupMember.user_id == User.id,
@@ -413,9 +420,9 @@ class UsersTable:
                     exclude_roles = [role[1:] for role in roles if role.startswith('!')]
 
                     if include_roles:
-                        query = query.filter(User.role.in_(include_roles))
+                        stmt = stmt.filter(User.role.in_(include_roles))
                     if exclude_roles:
-                        query = query.filter(~User.role.in_(exclude_roles))
+                        stmt = stmt.filter(~User.role.in_(exclude_roles))
 
                 order_by = filter.get('order_by')
                 direction = filter.get('direction')
@@ -435,99 +442,107 @@ class UsersTable:
                     group_sort = case((membership_exists, 1), else_=0)
 
                     if direction == 'asc':
-                        query = query.order_by(group_sort.asc(), User.name.asc())
+                        stmt = stmt.order_by(group_sort.asc(), User.name.asc())
                     else:
-                        query = query.order_by(group_sort.desc(), User.name.asc())
+                        stmt = stmt.order_by(group_sort.desc(), User.name.asc())
 
                 elif order_by == 'name':
                     if direction == 'asc':
-                        query = query.order_by(User.name.asc())
+                        stmt = stmt.order_by(User.name.asc())
                     else:
-                        query = query.order_by(User.name.desc())
+                        stmt = stmt.order_by(User.name.desc())
 
                 elif order_by == 'email':
                     if direction == 'asc':
-                        query = query.order_by(User.email.asc())
+                        stmt = stmt.order_by(User.email.asc())
                     else:
-                        query = query.order_by(User.email.desc())
+                        stmt = stmt.order_by(User.email.desc())
 
                 elif order_by == 'created_at':
                     if direction == 'asc':
-                        query = query.order_by(User.created_at.asc())
+                        stmt = stmt.order_by(User.created_at.asc())
                     else:
-                        query = query.order_by(User.created_at.desc())
+                        stmt = stmt.order_by(User.created_at.desc())
 
                 elif order_by == 'last_active_at':
                     if direction == 'asc':
-                        query = query.order_by(User.last_active_at.asc())
+                        stmt = stmt.order_by(User.last_active_at.asc())
                     else:
-                        query = query.order_by(User.last_active_at.desc())
+                        stmt = stmt.order_by(User.last_active_at.desc())
 
                 elif order_by == 'updated_at':
                     if direction == 'asc':
-                        query = query.order_by(User.updated_at.asc())
+                        stmt = stmt.order_by(User.updated_at.asc())
                     else:
-                        query = query.order_by(User.updated_at.desc())
+                        stmt = stmt.order_by(User.updated_at.desc())
                 elif order_by == 'role':
                     if direction == 'asc':
-                        query = query.order_by(User.role.asc())
+                        stmt = stmt.order_by(User.role.asc())
                     else:
-                        query = query.order_by(User.role.desc())
+                        stmt = stmt.order_by(User.role.desc())
 
             else:
-                query = query.order_by(User.created_at.desc())
+                stmt = stmt.order_by(User.created_at.desc())
 
             # Count BEFORE pagination
-            total = query.count()
+            count_result = await db.execute(select(func.count()).select_from(stmt.subquery()))
+            total = count_result.scalar()
 
             # correct pagination logic
             if skip is not None:
-                query = query.offset(skip)
+                stmt = stmt.offset(skip)
             if limit is not None:
-                query = query.limit(limit)
+                stmt = stmt.limit(limit)
 
-            users = query.all()
+            result = await db.execute(stmt)
+            users = result.scalars().all()
             return {
                 'users': [UserModel.model_validate(user) for user in users],
                 'total': total,
             }
 
-    def get_users_by_group_id(self, group_id: str, db: Optional[Session] = None) -> list[UserModel]:
-        with get_db_context(db) as db:
-            users = (
-                db.query(User)
-                .options(defer(User.profile_image_url))
-                .join(GroupMember, User.id == GroupMember.user_id)
-                .filter(GroupMember.group_id == group_id)
-                .all()
+    async def get_users_by_group_id(self, group_id: str, db: Optional[AsyncSession] = None) -> list[UserModel]:
+        async with get_async_db_context(db) as db:
+            from open_webui.models.groups import GroupMember
+
+            result = await db.execute(
+                select(User).join(GroupMember, User.id == GroupMember.user_id).filter(GroupMember.group_id == group_id)
             )
+            users = result.scalars().all()
             return [UserModel.model_validate(user) for user in users]
 
-    def get_users_by_user_ids(self, user_ids: list[str], db: Optional[Session] = None) -> list[UserStatusModel]:
-        with get_db_context(db) as db:
-            users = db.query(User).options(defer(User.profile_image_url)).filter(User.id.in_(user_ids)).all()
+    async def get_users_by_user_ids(
+        self, user_ids: list[str], db: Optional[AsyncSession] = None
+    ) -> list[UserStatusModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(User).filter(User.id.in_(user_ids)))
+            users = result.scalars().all()
             return [UserModel.model_validate(user) for user in users]
 
-    def get_num_users(self, db: Optional[Session] = None) -> Optional[int]:
-        with get_db_context(db) as db:
-            return db.query(User).count()
+    async def get_num_users(self, db: Optional[AsyncSession] = None) -> Optional[int]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(func.count()).select_from(User))
+            return result.scalar()
 
-    def has_users(self, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            return db.query(db.query(User).exists()).scalar()
+    async def has_users(self, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(exists(select(User))))
+            return result.scalar()
 
-    def get_first_user(self, db: Optional[Session] = None) -> UserModel:
+    async def get_first_user(self, db: Optional[AsyncSession] = None) -> UserModel:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).order_by(User.created_at).first()
-                return UserModel.model_validate(user)
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).order_by(User.created_at).limit(1))
+                user = result.scalars().first()
+                return UserModel.model_validate(user) if user else None
         except Exception:
             return None
 
-    def get_user_webhook_url_by_id(self, id: str, db: Optional[Session] = None) -> Optional[str]:
+    async def get_user_webhook_url_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[str]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
 
                 if user.settings is None:
                     return None
@@ -536,68 +551,75 @@ class UsersTable:
         except Exception:
             return None
 
-    def get_num_users_active_today(self, db: Optional[Session] = None) -> Optional[int]:
-        with get_db_context(db) as db:
+    async def get_num_users_active_today(self, db: Optional[AsyncSession] = None) -> Optional[int]:
+        async with get_async_db_context(db) as db:
             current_timestamp = int(datetime.datetime.now().timestamp())
             today_midnight_timestamp = current_timestamp - (current_timestamp % 86400)
-            query = db.query(User).filter(User.last_active_at > today_midnight_timestamp)
-            return query.count()
+            result = await db.execute(
+                select(func.count()).select_from(User).filter(User.last_active_at > today_midnight_timestamp)
+            )
+            return result.scalar()
 
-    def update_user_role_by_id(self, id: str, role: str, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def update_user_role_by_id(
+        self, id: str, role: str, db: Optional[AsyncSession] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
                 user.role = role
-                db.commit()
-                db.refresh(user)
+                await db.commit()
+                await db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def update_user_status_by_id(
-        self, id: str, form_data: UserStatus, db: Optional[Session] = None
+    async def update_user_status_by_id(
+        self, id: str, form_data: UserStatus, db: Optional[AsyncSession] = None
     ) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
                 for key, value in form_data.model_dump(exclude_none=True).items():
                     setattr(user, key, value)
-                db.commit()
-                db.refresh(user)
+                await db.commit()
+                await db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def update_user_profile_image_url_by_id(
-        self, id: str, profile_image_url: str, db: Optional[Session] = None
+    async def update_user_profile_image_url_by_id(
+        self, id: str, profile_image_url: str, db: Optional[AsyncSession] = None
     ) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
                 user.profile_image_url = profile_image_url
-                db.commit()
-                db.refresh(user)
+                await db.commit()
+                await db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
     @throttle(DATABASE_USER_ACTIVE_STATUS_UPDATE_INTERVAL)
-    def update_last_active_by_id(self, id: str, db: Optional[Session] = None) -> None:
+    async def update_last_active_by_id(self, id: str, db: Optional[AsyncSession] = None) -> None:
         try:
-            with get_db_context(db) as db:
-                db.query(User).filter_by(id=id).update({'last_active_at': int(time.time())})
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(update(User).filter_by(id=id).values(last_active_at=int(time.time())))
+                await db.commit()
         except Exception:
             pass
 
-    def update_user_oauth_by_id(
-        self, id: str, provider: str, sub: str, db: Optional[Session] = None
+    async def update_user_oauth_by_id(
+        self, id: str, provider: str, sub: str, db: Optional[AsyncSession] = None
     ) -> Optional[UserModel]:
         """
         Update or insert an OAuth provider/sub pair into the user's oauth JSON field.
@@ -608,8 +630,9 @@ class UsersTable:
             }
         """
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
 
@@ -620,20 +643,20 @@ class UsersTable:
                 oauth[provider] = {'sub': sub}
 
                 # Persist updated JSON
-                db.query(User).filter_by(id=id).update({'oauth': oauth})
-                db.commit()
+                await db.execute(update(User).filter_by(id=id).values(oauth=oauth))
+                await db.commit()
 
                 return UserModel.model_validate(user)
 
         except Exception:
             return None
 
-    def update_user_scim_by_id(
+    async def update_user_scim_by_id(
         self,
         id: str,
         provider: str,
         external_id: str,
-        db: Optional[Session] = None,
+        db: Optional[AsyncSession] = None,
     ) -> Optional[UserModel]:
         """
         Update or insert a SCIM provider/external_id pair into the user's scim JSON field.
@@ -644,41 +667,46 @@ class UsersTable:
             }
         """
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
 
                 scim = user.scim or {}
                 scim[provider] = {'external_id': external_id}
 
-                db.query(User).filter_by(id=id).update({'scim': scim})
-                db.commit()
+                await db.execute(update(User).filter_by(id=id).values(scim=scim))
+                await db.commit()
 
                 return UserModel.model_validate(user)
 
         except Exception:
             return None
 
-    def update_user_by_id(self, id: str, updated: dict, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def update_user_by_id(self, id: str, updated: dict, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
                 for key, value in updated.items():
                     setattr(user, key, value)
-                db.commit()
-                db.refresh(user)
+                await db.commit()
+                await db.refresh(user)
                 return UserModel.model_validate(user)
         except Exception as e:
             print(e)
             return None
 
-    def update_user_settings_by_id(self, id: str, updated: dict, db: Optional[Session] = None) -> Optional[UserModel]:
+    async def update_user_settings_by_id(
+        self, id: str, updated: dict, db: Optional[AsyncSession] = None
+    ) -> Optional[UserModel]:
         try:
-            with get_db_context(db) as db:
-                user = db.query(User).filter_by(id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 if not user:
                     return None
 
@@ -689,26 +717,30 @@ class UsersTable:
 
                 user_settings.update(updated)
 
-                db.query(User).filter_by(id=id).update({'settings': user_settings})
-                db.commit()
+                await db.execute(update(User).filter_by(id=id).values(settings=user_settings))
+                await db.commit()
 
-                user = db.query(User).filter_by(id=id).first()
+                result = await db.execute(select(User).filter_by(id=id))
+                user = result.scalars().first()
                 return UserModel.model_validate(user)
         except Exception:
             return None
 
-    def delete_user_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_user_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
+            from open_webui.models.groups import Groups
+            from open_webui.models.chats import Chats
+
             # Remove User from Groups
-            Groups.remove_user_from_all_groups(id)
+            await Groups.remove_user_from_all_groups(id)
 
             # Delete User Chats
-            result = Chats.delete_chats_by_user_id(id, db=db)
+            result = await Chats.delete_chats_by_user_id(id, db=db)
             if result:
-                with get_db_context(db) as db:
+                async with get_async_db_context(db) as db:
                     # Delete User
-                    db.query(User).filter_by(id=id).delete()
-                    db.commit()
+                    await db.execute(delete(User).filter_by(id=id))
+                    await db.commit()
 
                 return True
             else:
@@ -716,19 +748,20 @@ class UsersTable:
         except Exception:
             return False
 
-    def get_user_api_key_by_id(self, id: str, db: Optional[Session] = None) -> Optional[str]:
+    async def get_user_api_key_by_id(self, id: str, db: Optional[AsyncSession] = None) -> Optional[str]:
         try:
-            with get_db_context(db) as db:
-                api_key = db.query(ApiKey).filter_by(user_id=id).first()
+            async with get_async_db_context(db) as db:
+                result = await db.execute(select(ApiKey).filter_by(user_id=id))
+                api_key = result.scalars().first()
                 return api_key.key if api_key else None
         except Exception:
             return None
 
-    def update_user_api_key_by_id(self, id: str, api_key: str, db: Optional[Session] = None) -> bool:
+    async def update_user_api_key_by_id(self, id: str, api_key: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                db.query(ApiKey).filter_by(user_id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(ApiKey).filter_by(user_id=id))
+                await db.commit()
 
                 now = int(time.time())
                 new_api_key = ApiKey(
@@ -739,41 +772,45 @@ class UsersTable:
                     updated_at=now,
                 )
                 db.add(new_api_key)
-                db.commit()
+                await db.commit()
 
                 return True
 
         except Exception:
             return False
 
-    def delete_user_api_key_by_id(self, id: str, db: Optional[Session] = None) -> bool:
+    async def delete_user_api_key_by_id(self, id: str, db: Optional[AsyncSession] = None) -> bool:
         try:
-            with get_db_context(db) as db:
-                db.query(ApiKey).filter_by(user_id=id).delete()
-                db.commit()
+            async with get_async_db_context(db) as db:
+                await db.execute(delete(ApiKey).filter_by(user_id=id))
+                await db.commit()
                 return True
         except Exception:
             return False
 
-    def get_valid_user_ids(self, user_ids: list[str], db: Optional[Session] = None) -> list[str]:
-        with get_db_context(db) as db:
-            users = db.query(User).filter(User.id.in_(user_ids)).all()
+    async def get_valid_user_ids(self, user_ids: list[str], db: Optional[AsyncSession] = None) -> list[str]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(User).filter(User.id.in_(user_ids)))
+            users = result.scalars().all()
             return [user.id for user in users]
 
-    def get_super_admin_user(self, db: Optional[Session] = None) -> Optional[UserModel]:
-        with get_db_context(db) as db:
-            user = db.query(User).filter_by(role='admin').first()
+    async def get_super_admin_user(self, db: Optional[AsyncSession] = None) -> Optional[UserModel]:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(User).filter_by(role='admin').limit(1))
+            user = result.scalars().first()
             if user:
                 return UserModel.model_validate(user)
             else:
                 return None
 
-    def get_active_user_count(self, db: Optional[Session] = None) -> int:
-        with get_db_context(db) as db:
+    async def get_active_user_count(self, db: Optional[AsyncSession] = None) -> int:
+        async with get_async_db_context(db) as db:
             # Consider user active if last_active_at within the last 3 minutes
             three_minutes_ago = int(time.time()) - 180
-            count = db.query(User).filter(User.last_active_at >= three_minutes_ago).count()
-            return count
+            result = await db.execute(
+                select(func.count()).select_from(User).filter(User.last_active_at >= three_minutes_ago)
+            )
+            return result.scalar()
 
     @staticmethod
     def is_active(user: UserModel) -> bool:
@@ -783,9 +820,10 @@ class UsersTable:
             return user.last_active_at >= three_minutes_ago
         return False
 
-    def is_user_active(self, user_id: str, db: Optional[Session] = None) -> bool:
-        with get_db_context(db) as db:
-            user = db.query(User).filter_by(id=user_id).first()
+    async def is_user_active(self, user_id: str, db: Optional[AsyncSession] = None) -> bool:
+        async with get_async_db_context(db) as db:
+            result = await db.execute(select(User).filter_by(id=user_id))
+            user = result.scalars().first()
             if user and user.last_active_at:
                 # Consider user active if last_active_at within the last 3 minutes
                 three_minutes_ago = int(time.time()) - 180

backend/open_webui/retrieval/loaders/main.py

@@ -1,3 +1,4 @@
+import asyncio
 import requests
 import logging
 import ftfy
@@ -238,6 +239,18 @@ class Loader:
 
         return [Document(page_content=ftfy.fix_text(doc.page_content), metadata=doc.metadata) for doc in docs]
 
+    async def aload(self, filename: str, file_content_type: str, file_path: str) -> list[Document]:
+        """
+        Async wrapper around `load`.
+
+        Document loaders dispatched by `_get_loader` (PyMuPDF, Unstructured,
+        python-docx, Tika, etc.) are uniformly synchronous and CPU/IO-bound.
+        Calling `load` directly from an async handler would block the event
+        loop for the entire parse — minutes for large PDFs. This offloads
+        the work to a worker thread so the loop stays responsive.
+        """
+        return await asyncio.to_thread(self.load, filename, file_content_type, file_path)
+
     def _is_text_file(self, file_ext: str, file_content_type: str) -> bool:
         return file_ext in known_source_ext or (
             file_content_type

backend/open_webui/retrieval/loaders/mistral.py

@@ -9,7 +9,7 @@ from typing import List, Dict, Any
 from contextlib import asynccontextmanager
 
 from langchain_core.documents import Document
-from open_webui.env import GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL, AIOHTTP_CLIENT_SESSION_SSL
 
 logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
@@ -285,6 +285,7 @@ class MistralLoader:
                 data=writer,
                 headers=self.headers,
                 timeout=aiohttp.ClientTimeout(total=self.upload_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 return await self._handle_response_async(response)
 
@@ -333,6 +334,7 @@ class MistralLoader:
                 headers=headers,
                 params=params,
                 timeout=aiohttp.ClientTimeout(total=self.url_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 return await self._handle_response_async(response)
 
@@ -404,6 +406,7 @@ class MistralLoader:
                 json=payload,
                 headers=headers,
                 timeout=aiohttp.ClientTimeout(total=self.ocr_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 ocr_response = await self._handle_response_async(response)
 
@@ -436,7 +439,8 @@ class MistralLoader:
                 async with session.delete(
                     url=f'{self.base_url}/files/{file_id}',
                     headers=self.headers,
-                    timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout),  # Shorter timeout for cleanup
+                    timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout),
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
                 ) as response:
                     return await self._handle_response_async(response)
 

backend/open_webui/retrieval/models/colbert.py

@@ -59,14 +59,14 @@ class ColBERT(BaseReranker):
 
         return normalized_scores.detach().cpu().numpy().astype(np.float32)
 
-    def predict(self, sentences):
+    def predict(self, sentences, batch_size=32):
         query = sentences[0][0]
         docs = [i[1] for i in sentences]
 
         # Embedding the documents
-        embedded_docs = self.ckpt.docFromText(docs, bsize=32)[0]
+        embedded_docs = self.ckpt.docFromText(docs, bsize=batch_size)[0]
         # Embedding the queries
-        embedded_queries = self.ckpt.queryFromText([query], bsize=32)
+        embedded_queries = self.ckpt.queryFromText([query], bsize=batch_size)
         embedded_query = embedded_queries[0]
 
         # Calculate retrieval scores for the query against all documents

backend/open_webui/retrieval/utils.py

@@ -20,6 +20,7 @@ from langchain_community.retrievers import BM25Retriever
 from langchain_core.documents import Document
 
 from open_webui.config import VECTOR_DB
+from open_webui.retrieval.vector.async_client import ASYNC_VECTOR_DB_CLIENT
 from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
 
 
@@ -82,11 +83,123 @@ def get_loader(request, url: str):
         )
 
 
+def build_loader_from_config(request):
+    """Build a Loader instance with the admin's configured extraction engine settings."""
+    from open_webui.retrieval.loaders.main import Loader
+
+    config = request.app.state.config
+    return Loader(
+        engine=config.CONTENT_EXTRACTION_ENGINE,
+        DATALAB_MARKER_API_KEY=config.DATALAB_MARKER_API_KEY,
+        DATALAB_MARKER_API_BASE_URL=config.DATALAB_MARKER_API_BASE_URL,
+        DATALAB_MARKER_ADDITIONAL_CONFIG=config.DATALAB_MARKER_ADDITIONAL_CONFIG,
+        DATALAB_MARKER_SKIP_CACHE=config.DATALAB_MARKER_SKIP_CACHE,
+        DATALAB_MARKER_FORCE_OCR=config.DATALAB_MARKER_FORCE_OCR,
+        DATALAB_MARKER_PAGINATE=config.DATALAB_MARKER_PAGINATE,
+        DATALAB_MARKER_STRIP_EXISTING_OCR=config.DATALAB_MARKER_STRIP_EXISTING_OCR,
+        DATALAB_MARKER_DISABLE_IMAGE_EXTRACTION=config.DATALAB_MARKER_DISABLE_IMAGE_EXTRACTION,
+        DATALAB_MARKER_FORMAT_LINES=config.DATALAB_MARKER_FORMAT_LINES,
+        DATALAB_MARKER_USE_LLM=config.DATALAB_MARKER_USE_LLM,
+        DATALAB_MARKER_OUTPUT_FORMAT=config.DATALAB_MARKER_OUTPUT_FORMAT,
+        EXTERNAL_DOCUMENT_LOADER_URL=config.EXTERNAL_DOCUMENT_LOADER_URL,
+        EXTERNAL_DOCUMENT_LOADER_API_KEY=config.EXTERNAL_DOCUMENT_LOADER_API_KEY,
+        TIKA_SERVER_URL=config.TIKA_SERVER_URL,
+        DOCLING_SERVER_URL=config.DOCLING_SERVER_URL,
+        DOCLING_API_KEY=config.DOCLING_API_KEY,
+        DOCLING_PARAMS=config.DOCLING_PARAMS,
+        PDF_EXTRACT_IMAGES=config.PDF_EXTRACT_IMAGES,
+        PDF_LOADER_MODE=config.PDF_LOADER_MODE,
+        DOCUMENT_INTELLIGENCE_ENDPOINT=config.DOCUMENT_INTELLIGENCE_ENDPOINT,
+        DOCUMENT_INTELLIGENCE_KEY=config.DOCUMENT_INTELLIGENCE_KEY,
+        DOCUMENT_INTELLIGENCE_MODEL=config.DOCUMENT_INTELLIGENCE_MODEL,
+        MISTRAL_OCR_API_BASE_URL=config.MISTRAL_OCR_API_BASE_URL,
+        MISTRAL_OCR_API_KEY=config.MISTRAL_OCR_API_KEY,
+        MINERU_API_MODE=config.MINERU_API_MODE,
+        MINERU_API_URL=config.MINERU_API_URL,
+        MINERU_API_KEY=config.MINERU_API_KEY,
+        MINERU_API_TIMEOUT=config.MINERU_API_TIMEOUT,
+        MINERU_PARAMS=config.MINERU_PARAMS,
+    )
+
+
+def _extract_text_from_binary_response(request, response: requests.Response, url: str) -> tuple[str, list]:
+    """Download response body to a temp file and extract text using the Loader pipeline."""
+    import mimetypes
+    import tempfile
+    import urllib.parse
+
+    content_type = response.headers.get('Content-Type', '').split(';')[0].strip()
+
+    # Derive filename from URL path, falling back to Content-Disposition or mime guess
+    url_path = urllib.parse.urlparse(url).path
+    filename = os.path.basename(url_path) if url_path else ''
+
+    if not filename or '.' not in filename:
+        # Try Content-Disposition header
+        cd = response.headers.get('Content-Disposition', '')
+        if 'filename=' in cd:
+            filename = cd.split('filename=')[-1].strip('"\'')
+
+    if not filename or '.' not in filename:
+        ext = mimetypes.guess_extension(content_type) or ''
+        filename = f'download{ext}'
+
+    suffix = '.' + filename.split('.')[-1].lower() if '.' in filename else ''
+
+    with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp:
+        tmp.write(response.content)
+        tmp_path = tmp.name
+
+    try:
+        loader = build_loader_from_config(request)
+        docs = loader.load(filename, content_type, tmp_path)
+        for doc in docs:
+            doc.metadata['source'] = url
+        content = ' '.join([doc.page_content for doc in docs])
+        return content, docs
+    finally:
+        os.remove(tmp_path)
+
+
+def _is_text_content_type(content_type: str) -> bool:
+    """Return True if the content type should be handled by the web loader."""
+    ct = content_type.split(';')[0].strip().lower()
+    if ct.startswith('text/'):
+        return True
+    if any(t in ct for t in ['xml', 'json', 'javascript']):
+        return True
+    return not ct  # empty / missing → assume HTML
+
+
 def get_content_from_url(request, url: str) -> str:
-    loader = get_loader(request, url)
-    docs = loader.load()
-    content = ' '.join([doc.page_content for doc in docs])
-    return content, docs
+    from open_webui.retrieval.web.utils import validate_url
+
+    # Validate URL before making any request (blocks private IPs, non-HTTP, filter list)
+    validate_url(url)
+
+    # Streamed GET to check Content-Type without downloading the body.
+    try:
+        response = requests.get(url, stream=True, timeout=30)
+        response.raise_for_status()
+        content_type = response.headers.get('Content-Type', '')
+    except Exception:
+        content_type = ''
+        response = None
+
+    # Text / HTML / unknown — use the configured web loader
+    if response is None or _is_text_content_type(content_type):
+        if response is not None:
+            response.close()
+        loader = get_loader(request, url)
+        docs = loader.load()
+        content = ' '.join([doc.page_content for doc in docs])
+        return content, docs
+
+    # Binary content (PDF, DOCX, XLSX, PPTX, etc.) — download and extract
+    try:
+        return _extract_text_from_binary_response(request, response, url)
+    finally:
+        response.close()
 
 
 CHUNK_HASH_KEY = '_chunk_hash'
@@ -121,7 +234,7 @@ class VectorSearchRetriever(BaseRetriever):
         run_manager: CallbackManagerForRetrieverRun,
     ) -> list[Document]:
         embedding = await self.embedding_function(query, RAG_EMBEDDING_QUERY_PREFIX)
-        result = VECTOR_DB_CLIENT.search(
+        result = await ASYNC_VECTOR_DB_CLIENT.search(
             collection_name=self.collection_name,
             vectors=[embedding],
             limit=self.top_k,
@@ -488,16 +601,24 @@ async def query_collection_with_hybrid_search(
 ) -> dict:
     results = []
     error = False
-    # Fetch collection data once per collection sequentially
-    # Avoid fetching the same data multiple times later
-    collection_results = {}
-    for collection_name in collection_names:
+    # Fetch every collection's contents once up front so the
+    # per-query/per-document loop below can reuse them. Each fetch
+    # offloads to a worker thread, so run them concurrently with
+    # `asyncio.gather` instead of awaiting them serially — otherwise
+    # latency scales linearly with `len(collection_names)`.
+    log.debug(
+        'query_collection_with_hybrid_search: prefetching %d collections',
+        len(collection_names),
+    )
+
+    async def _fetch_collection(name: str):
         try:
-            log.debug(f'query_collection_with_hybrid_search:VECTOR_DB_CLIENT.get:collection {collection_name}')
-            collection_results[collection_name] = VECTOR_DB_CLIENT.get(collection_name=collection_name)
+            return name, await ASYNC_VECTOR_DB_CLIENT.get(collection_name=name)
         except Exception as e:
-            log.exception(f'Failed to fetch collection {collection_name}: {e}')
-            collection_results[collection_name] = None
+            log.exception(f'Failed to fetch collection {name}: {e}')
+            return name, None
+
+    collection_results = dict(await asyncio.gather(*(_fetch_collection(name) for name in collection_names)))
 
     log.info(f'Starting hybrid search for {len(queries)} queries in {len(collection_names)} collections...')
 
@@ -910,7 +1031,7 @@ async def generate_embeddings(
         return embeddings[0] if isinstance(text, str) else embeddings
 
 
-def get_reranking_function(reranking_engine, reranking_model, reranking_function):
+def get_reranking_function(reranking_engine, reranking_model, reranking_function, reranking_batch_size=32):
     if reranking_function is None:
         return None
     if reranking_engine == 'external':
@@ -919,10 +1040,61 @@ def get_reranking_function(reranking_engine, reranking_model, reranking_function
         )
     else:
         return lambda query, documents, user=None: reranking_function.predict(
-            [(query, doc.page_content) for doc in documents]
+            [(query, doc.page_content) for doc in documents], batch_size=int(reranking_batch_size)
         )
 
 
+async def filter_accessible_collections(
+    collection_names: set[str],
+    user: UserModel,
+    access_type: str = 'read',
+) -> set[str]:
+    """
+    Return only the collection names the user is allowed to access.
+    Admins bypass all checks.  For non-admins the policy is:
+
+      - file-*          → validated via has_access_to_file
+      - user-memory-*   → must match user's own memory collection
+      - web-search-*    → ephemeral per-query collections, always allowed
+      - knowledge-bases → always denied (system meta-collection)
+      - everything else → if the name matches a knowledge base, validated
+                          via Knowledges.check_access_by_user_id; if no
+                          such KB exists, the name is treated as an
+                          ephemeral/legacy collection and allowed
+    """
+    if user.role == 'admin':
+        return collection_names
+
+    validated = set()
+    for name in collection_names:
+        if name == 'knowledge-bases':
+            # System meta-collection — never exposed to non-admins.
+            continue
+        elif name.startswith('file-'):
+            file_id = name[len('file-') :]
+            if await has_access_to_file(file_id=file_id, access_type=access_type, user=user):
+                validated.add(name)
+        elif name.startswith('user-memory-'):
+            if name == f'user-memory-{user.id}':
+                validated.add(name)
+        elif name.startswith('web-search-'):
+            # Ephemeral collections created by process_web_search — safe
+            # to allow because they contain only transient web-search
+            # results scoped to the requesting user's session.
+            validated.add(name)
+        else:
+            # May be a knowledge-base ID or a legacy/ephemeral collection.
+            # If it IS a KB, enforce access control.  If no such KB
+            # exists, treat it as a non-sensitive collection (e.g. legacy
+            # model knowledge, process_text SHA256 collections) and allow.
+            if await Knowledges.check_access_by_user_id(name, user.id, permission=access_type):
+                validated.add(name)
+            elif not await Knowledges.get_knowledge_by_id(name):
+                # Not a KB at all — legacy/ephemeral collection, allow
+                validated.add(name)
+    return validated
+
+
 async def get_sources_from_items(
     request,
     items,
@@ -978,12 +1150,12 @@ async def get_sources_from_items(
 
         elif item.get('type') == 'note':
             # Note Attached
-            note = Notes.get_note_by_id(item.get('id'))
+            note = await Notes.get_note_by_id(item.get('id'))
 
             if note and (
                 user.role == 'admin'
                 or note.user_id == user.id
-                or AccessGrants.has_access(
+                or await AccessGrants.has_access(
                     user_id=user.id,
                     resource_type='note',
                     resource_id=note.id,
@@ -998,7 +1170,7 @@ async def get_sources_from_items(
 
         elif item.get('type') == 'chat':
             # Chat Attached
-            chat = Chats.get_chat_by_id(item.get('id'))
+            chat = await Chats.get_chat_by_id(item.get('id'))
 
             if chat and (user.role == 'admin' or chat.user_id == user.id):
                 messages_map = chat.chat.get('history', {}).get('messages', {})
@@ -1042,11 +1214,11 @@ async def get_sources_from_items(
                         ],
                     }
                 elif item.get('id'):
-                    file_object = Files.get_file_by_id(item.get('id'))
+                    file_object = await Files.get_file_by_id(item.get('id'))
                     if file_object and (
                         user.role == 'admin'
                         or file_object.user_id == user.id
-                        or has_access_to_file(item.get('id'), 'read', user)
+                        or await has_access_to_file(item.get('id'), 'read', user)
                     ):
                         query_result = {
                             'documents': [[file_object.data.get('content', '')]],
@@ -1069,12 +1241,12 @@ async def get_sources_from_items(
 
         elif item.get('type') == 'collection':
             # Manual Full Mode Toggle for Collection
-            knowledge_base = Knowledges.get_knowledge_by_id(item.get('id'))
+            knowledge_base = await Knowledges.get_knowledge_by_id(item.get('id'))
 
             if knowledge_base and (
                 user.role == 'admin'
                 or knowledge_base.user_id == user.id
-                or AccessGrants.has_access(
+                or await AccessGrants.has_access(
                     user_id=user.id,
                     resource_type='knowledge',
                     resource_id=knowledge_base.id,
@@ -1085,14 +1257,14 @@ async def get_sources_from_items(
                     if knowledge_base and (
                         user.role == 'admin'
                         or knowledge_base.user_id == user.id
-                        or AccessGrants.has_access(
+                        or await AccessGrants.has_access(
                             user_id=user.id,
                             resource_type='knowledge',
                             resource_id=knowledge_base.id,
                             permission='read',
                         )
                     ):
-                        files = Knowledges.get_files_by_id(knowledge_base.id)
+                        files = await Knowledges.get_files_by_id(knowledge_base.id)
 
                         documents = []
                         metadatas = []
@@ -1138,9 +1310,18 @@ async def get_sources_from_items(
                 log.debug(f'skipping {item} as it has already been extracted')
                 continue
 
+            # Filter out collections the user cannot read
+            if user:
+                collection_names = await filter_accessible_collections(collection_names, user)
+                if not collection_names:
+                    log.debug(f'access denied for all collections in item {item}')
+                    continue
+
             try:
                 if full_context:
-                    query_result = get_all_items_from_collections(collection_names)
+                    # Sync helper makes blocking VECTOR_DB_CLIENT calls;
+                    # offload so the async caller's event loop stays free.
+                    query_result = await asyncio.to_thread(get_all_items_from_collections, collection_names)
                 else:
                     query_result = await query_collection(
                         request,

backend/open_webui/retrieval/vector/async_client.py

@@ -0,0 +1,129 @@
+"""
+Async facade over the synchronous VECTOR_DB_CLIENT.
+
+The vector DB backends bundled with Open WebUI (Chroma, pgvector, Qdrant,
+Milvus, OpenSearch, Pinecone, Weaviate, …) all expose a uniformly
+synchronous API. Each method performs blocking network or disk I/O — and
+some, like `insert`/`upsert`, can run for several seconds.
+
+When such a sync method is awaited from an async route handler, it blocks
+the event loop for its entire duration, freezing every other in-flight
+HTTP request, websocket message and background task.
+
+This module wraps the sync client in an `AsyncVectorDBClient` that
+transparently dispatches each call to a worker thread via
+`asyncio.to_thread`. Async callers can `await ASYNC_VECTOR_DB_CLIENT.x(...)`
+in place of `VECTOR_DB_CLIENT.x(...)` and the loop stays responsive.
+
+The original `VECTOR_DB_CLIENT` is unchanged, so callers already running
+inside `run_in_threadpool` (e.g. `save_docs_to_vector_db`) are not
+affected.
+
+Thread-safety expectations
+--------------------------
+Every async caller now invokes `VECTOR_DB_CLIENT` from a worker thread
+rather than the event-loop thread, and many can run concurrently. The
+sync client (and its underlying backend driver) is therefore expected
+to be safe for concurrent use across threads, which is the standard
+contract for the bundled drivers (chroma, pgvector via SQLAlchemy
+pool, qdrant-client, opensearch-py, …). This is *not* a new exposure
+introduced by this facade — `save_docs_to_vector_db` already called
+the sync client from `run_in_threadpool`, so concurrent threaded
+access has always been a requirement of the codebase. Adding a global
+serialization lock here would defeat the responsiveness this facade
+exists to provide; any backend that genuinely cannot tolerate
+concurrent access should grow its own internal serialization.
+
+API surface
+-----------
+Method signatures mirror `VectorDBBase` exactly. This is deliberate:
+permissive `*args/**kwargs` forwarding hides typos at the call site
+(an earlier revision of this file shipped that, and a `metadata=`
+typo silently broke an entire endpoint until explicit signatures
+surfaced it). Callers that need a backend-specific parameter not on
+`VectorDBBase` should reach for the `.sync` escape hatch and wrap
+their own `asyncio.to_thread`, e.g. ::
+
+    await asyncio.to_thread(
+        ASYNC_VECTOR_DB_CLIENT.sync.some_backend_specific_op,
+        collection_name, special_kwarg=value,
+    )
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Dict, List, Optional, Union
+
+from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
+from open_webui.retrieval.vector.main import (
+    GetResult,
+    SearchResult,
+    VectorDBBase,
+    VectorItem,
+)
+
+
+class AsyncVectorDBClient:
+    """Awaitable mirror of `VectorDBBase` that off-loads each call to a thread.
+
+    Method signatures mirror `VectorDBBase` exactly so static analysis
+    catches bad kwargs at the call site instead of letting them surface
+    deep inside the worker thread (where the resulting ``TypeError`` is
+    typically swallowed by surrounding ``try/except``).
+    """
+
+    def __init__(self, sync_client: VectorDBBase) -> None:
+        self._sync = sync_client
+
+    @property
+    def sync(self) -> VectorDBBase:
+        """Escape hatch for code that must call the sync client directly
+        (e.g. already inside a worker thread)."""
+        return self._sync
+
+    async def has_collection(self, collection_name: str) -> bool:
+        return await asyncio.to_thread(self._sync.has_collection, collection_name)
+
+    async def delete_collection(self, collection_name: str) -> None:
+        return await asyncio.to_thread(self._sync.delete_collection, collection_name)
+
+    async def insert(self, collection_name: str, items: List[VectorItem]) -> None:
+        return await asyncio.to_thread(self._sync.insert, collection_name, items)
+
+    async def upsert(self, collection_name: str, items: List[VectorItem]) -> None:
+        return await asyncio.to_thread(self._sync.upsert, collection_name, items)
+
+    async def search(
+        self,
+        collection_name: str,
+        vectors: List[List[Union[float, int]]],
+        filter: Optional[Dict] = None,
+        limit: int = 10,
+    ) -> Optional[SearchResult]:
+        return await asyncio.to_thread(self._sync.search, collection_name, vectors, filter, limit)
+
+    async def query(
+        self,
+        collection_name: str,
+        filter: Dict,
+        limit: Optional[int] = None,
+    ) -> Optional[GetResult]:
+        return await asyncio.to_thread(self._sync.query, collection_name, filter, limit)
+
+    async def get(self, collection_name: str) -> Optional[GetResult]:
+        return await asyncio.to_thread(self._sync.get, collection_name)
+
+    async def delete(
+        self,
+        collection_name: str,
+        ids: Optional[List[str]] = None,
+        filter: Optional[Dict] = None,
+    ) -> None:
+        return await asyncio.to_thread(self._sync.delete, collection_name, ids, filter)
+
+    async def reset(self) -> None:
+        return await asyncio.to_thread(self._sync.reset)
+
+
+ASYNC_VECTOR_DB_CLIENT = AsyncVectorDBClient(VECTOR_DB_CLIENT)

backend/open_webui/retrieval/vector/dbs/pgvector.py

@@ -34,6 +34,7 @@ from open_webui.retrieval.vector.main import (
     SearchResult,
     GetResult,
 )
+from open_webui.utils.misc import sanitize_text_for_db
 from open_webui.config import (
     PGVECTOR_DB_URL,
     PGVECTOR_INITIALIZE_MAX_VECTOR_LENGTH,
@@ -289,7 +290,9 @@ class PgvectorClient(VectorDBBase):
                     vector = self.adjust_vector_length(item['vector'])
                     # Use raw SQL for BYTEA/pgcrypto
                     # Ensure metadata is converted to its JSON text representation
-                    json_metadata = json.dumps(item['metadata'])
+                    # Sanitize to strip null bytes / surrogates that PostgreSQL cannot store
+                    json_metadata = sanitize_text_for_db(json.dumps(item['metadata']))
+                    item_text = sanitize_text_for_db(item['text'])
                     self.session.execute(
                         text("""
                             INSERT INTO document_chunk
@@ -305,7 +308,7 @@ class PgvectorClient(VectorDBBase):
                             'id': item['id'],
                             'vector': vector,
                             'collection_name': collection_name,
-                            'text': item['text'],
+                            'text': item_text,
                             'metadata_text': json_metadata,
                             'key': PGVECTOR_PGCRYPTO_KEY,
                         },
@@ -338,7 +341,9 @@ class PgvectorClient(VectorDBBase):
             if PGVECTOR_PGCRYPTO:
                 for item in items:
                     vector = self.adjust_vector_length(item['vector'])
-                    json_metadata = json.dumps(item['metadata'])
+                    # Sanitize to strip null bytes / surrogates that PostgreSQL cannot store
+                    json_metadata = sanitize_text_for_db(json.dumps(item['metadata']))
+                    item_text = sanitize_text_for_db(item['text'])
                     self.session.execute(
                         text("""
                             INSERT INTO document_chunk
@@ -358,7 +363,7 @@ class PgvectorClient(VectorDBBase):
                             'id': item['id'],
                             'vector': vector,
                             'collection_name': collection_name,
-                            'text': item['text'],
+                            'text': item_text,
                             'metadata_text': json_metadata,
                             'key': PGVECTOR_PGCRYPTO_KEY,
                         },

backend/open_webui/retrieval/vector/utils.py

@@ -1,5 +1,7 @@
 from datetime import datetime
 
+from open_webui.utils.misc import sanitize_text_for_db
+
 KEYS_TO_EXCLUDE = ['content', 'pages', 'tables', 'paragraphs', 'sections', 'figures']
 
 
@@ -12,7 +14,8 @@ def filter_metadata(metadata: dict[str, any]) -> dict[str, any]:
 def process_metadata(
     metadata: dict[str, any],
 ) -> dict[str, any]:
-    # Removes large fields and converts non-serializable types (datetime, list, dict) to strings.
+    # Removes large fields, converts non-serializable types (datetime, list, dict) to strings,
+    # and sanitizes strings for database storage (strips null bytes and invalid surrogates).
     result = {}
     for key, value in metadata.items():
         # Skip large fields
@@ -20,7 +23,7 @@ def process_metadata(
             continue
         # Convert non-serializable fields to strings
         if isinstance(value, (datetime, list, dict)):
-            result[key] = str(value)
+            result[key] = sanitize_text_for_db(str(value))
         else:
-            result[key] = value
+            result[key] = sanitize_text_for_db(value)
     return result

backend/open_webui/retrieval/web/firecrawl.py

@@ -1,6 +1,7 @@
 import logging
 from typing import Optional, List
 
+import requests
 from open_webui.retrieval.web.main import SearchResult, get_filtered_results
 
 log = logging.getLogger(__name__)
@@ -14,23 +15,38 @@ def search_firecrawl(
     filter_list: Optional[List[str]] = None,
 ) -> List[SearchResult]:
     try:
-        from firecrawl import FirecrawlApp
+        url = firecrawl_url.rstrip('/')
+        response = requests.post(
+            f'{url}/v1/search',
+            headers={
+                'Content-Type': 'application/json',
+                'Authorization': f'Bearer {firecrawl_api_key}',
+            },
+            json={
+                'query': query,
+                'limit': count,
+                'timeout': count * 3000,
+            },
+            timeout=count * 3 + 10,
+        )
+        response.raise_for_status()
+        data = response.json().get('data', {})
 
-        firecrawl = FirecrawlApp(api_key=firecrawl_api_key, api_url=firecrawl_url)
-        response = firecrawl.search(query=query, limit=count, ignore_invalid_urls=True, timeout=count * 3)
-        results = response.web
-        if filter_list:
-            results = get_filtered_results(results, filter_list)
         results = [
             SearchResult(
-                link=result.url,
-                title=result.title,
-                snippet=result.description,
+                link=r.get('url', ''),
+                title=r.get('title', ''),
+                snippet=r.get('description', ''),
             )
-            for result in results[:count]
+            for r in data.get('web', [])
         ]
-        log.info(f'External search results: {results}')
+
+        if filter_list:
+            results = get_filtered_results(results, filter_list)
+
+        results = results[:count]
+        log.info(f'FireCrawl search results: {results}')
         return results
     except Exception as e:
-        log.error(f'Error in External search: {e}')
+        log.error(f'Error in FireCrawl search: {e}')
         return []

backend/open_webui/retrieval/web/utils.py

@@ -1,4 +1,5 @@
 import asyncio
+import ipaddress
 import logging
 import socket
 import ssl
@@ -44,6 +45,7 @@ from open_webui.config import (
     WEB_FETCH_FILTER_LIST,
 )
 from open_webui.utils.misc import is_string_allowed
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
 
 log = logging.getLogger(__name__)
 
@@ -84,11 +86,9 @@ def validate_url(url: Union[str, Sequence[str]]):
             ipv4_addresses, ipv6_addresses = resolve_hostname(parsed_url.hostname)
             # Check if any of the resolved addresses are private
             # This is technically still vulnerable to DNS rebinding attacks, as we don't control WebBaseLoader
-            for ip in ipv4_addresses:
-                if validators.ipv4(ip, private=True):
-                    raise ValueError(ERROR_MESSAGES.INVALID_URL)
-            for ip in ipv6_addresses:
-                if validators.ipv6(ip, private=True):
+            for ip in ipv4_addresses + ipv6_addresses:
+                addr = ipaddress.ip_address(ip)
+                if not addr.is_global:
                     raise ValueError(ERROR_MESSAGES.INVALID_URL)
         return True
     elif isinstance(url, Sequence):
@@ -193,27 +193,6 @@ class SafeFireCrawlLoader(BaseLoader, RateLimitMixin, URLProcessingMixin):
         proxy: Optional[Dict[str, str]] = None,
         params: Optional[Dict] = None,
     ):
-        """Concurrent document loader for FireCrawl operations.
-
-        Executes multiple FireCrawlLoader instances concurrently using thread pooling
-        to improve bulk processing efficiency.
-        Args:
-            web_paths: List of URLs/paths to process.
-            verify_ssl: If True, verify SSL certificates.
-            trust_env: If True, use proxy settings from environment variables.
-            requests_per_second: Number of requests per second to limit to.
-            continue_on_failure (bool): If True, continue loading other URLs on failure.
-            api_key: API key for FireCrawl service. Defaults to None
-                (uses FIRE_CRAWL_API_KEY environment variable if not provided).
-            api_url: Base URL for FireCrawl API. Defaults to official API endpoint.
-            mode: Operation mode selection:
-                - 'crawl': Website crawling mode
-                - 'scrape': Direct page scraping (default)
-                - 'map': Site map generation
-            proxy: Proxy override settings for the FireCrawl API.
-            params: The parameters to pass to the Firecrawl API.
-                For more details, visit: https://docs.firecrawl.dev/sdks/python#batch-scrape
-        """
         proxy_server = proxy.get('server') if proxy else None
         if trust_env and not proxy_server:
             env_proxies = urllib.request.getproxies()
@@ -230,44 +209,43 @@ class SafeFireCrawlLoader(BaseLoader, RateLimitMixin, URLProcessingMixin):
         self.trust_env = trust_env
         self.continue_on_failure = continue_on_failure
         self.api_key = api_key
-        self.api_url = api_url
+        self.api_url = (api_url or 'https://api.firecrawl.dev').rstrip('/')
         self.timeout = timeout
         self.mode = mode
         self.params = params or {}
 
     def lazy_load(self) -> Iterator[Document]:
-        """Load documents using FireCrawl batch_scrape."""
-        log.debug(
-            'Starting FireCrawl batch scrape for %d URLs, mode: %s, params: %s',
-            len(self.web_paths),
-            self.mode,
-            self.params,
-        )
         try:
-            from firecrawl import FirecrawlApp
+            headers = {
+                'Content-Type': 'application/json',
+                'Authorization': f'Bearer {self.api_key}',
+            }
 
-            firecrawl = FirecrawlApp(api_key=self.api_key, api_url=self.api_url)
-            result = firecrawl.batch_scrape(
-                self.web_paths,
-                formats=['markdown'],
-                skip_tls_verification=not self.verify_ssl,
-                ignore_invalid_urls=True,
-                remove_base64_images=True,
-                max_age=300000,  # 5 minutes https://docs.firecrawl.dev/features/fast-scraping#common-maxage-values
-                wait_timeout=self.timeout if self.timeout else len(self.web_paths) * 3,
-                **self.params,
-            )
+            for url in self.web_paths:
+                payload = {
+                    'url': url,
+                    'formats': ['markdown'],
+                    **self.params,
+                }
+                if self.timeout:
+                    payload['timeout'] = self.timeout * 1000
 
-            if result.status != 'completed':
-                raise RuntimeError(f'FireCrawl batch scrape did not complete successfully. result: {result}')
-
-            for data in result.data:
-                metadata = data.metadata or {}
-                yield Document(
-                    page_content=data.markdown or '',
-                    metadata={'source': metadata.url or metadata.source_url or ''},
+                response = requests.post(
+                    f'{self.api_url}/v1/scrape',
+                    headers=headers,
+                    json=payload,
+                    timeout=self.timeout or 60,
+                    verify=self.verify_ssl,
                 )
+                response.raise_for_status()
+                data = response.json().get('data', {})
+                metadata = data.get('metadata', {})
+                source = metadata.get('url') or metadata.get('sourceURL') or url
 
+                yield Document(
+                    page_content=data.get('markdown', ''),
+                    metadata={'source': source},
+                )
         except Exception as e:
             if self.continue_on_failure:
                 log.exception(f'Error extracting content from URLs: {e}')
@@ -275,38 +253,10 @@ class SafeFireCrawlLoader(BaseLoader, RateLimitMixin, URLProcessingMixin):
                 raise e
 
     async def alazy_load(self):
-        """Async version of lazy_load."""
-        log.debug(
-            'Starting FireCrawl batch scrape for %d URLs, mode: %s, params: %s',
-            len(self.web_paths),
-            self.mode,
-            self.params,
-        )
         try:
-            from firecrawl import FirecrawlApp
-
-            firecrawl = FirecrawlApp(api_key=self.api_key, api_url=self.api_url)
-            result = firecrawl.batch_scrape(
-                self.web_paths,
-                formats=['markdown'],
-                skip_tls_verification=not self.verify_ssl,
-                ignore_invalid_urls=True,
-                remove_base64_images=True,
-                max_age=300000,  # 5 minutes https://docs.firecrawl.dev/features/fast-scraping#common-maxage-values
-                wait_timeout=self.timeout if self.timeout else len(self.web_paths) * 3,
-                **self.params,
-            )
-
-            if result.status != 'completed':
-                raise RuntimeError(f'FireCrawl batch scrape did not complete successfully. result: {result}')
-
-            for data in result.data:
-                metadata = data.metadata or {}
-                yield Document(
-                    page_content=data.markdown or '',
-                    metadata={'source': metadata.url or metadata.source_url or ''},
-                )
-
+            docs = await run_in_threadpool(lambda: list(self.lazy_load()))
+            for doc in docs:
+                yield doc
         except Exception as e:
             if self.continue_on_failure:
                 log.exception(f'Error extracting content from URLs: {e}')
@@ -562,6 +512,8 @@ class SafeWebBaseLoader(WebBaseLoader):
                     )
                     if not self.session.verify:
                         kwargs['ssl'] = False
+                    else:
+                        kwargs['ssl'] = AIOHTTP_CLIENT_SESSION_SSL
 
                     async with session.get(
                         url,

backend/open_webui/routers/analytics.py

@@ -11,8 +11,8 @@ from open_webui.models.groups import Groups
 from open_webui.models.users import Users
 from open_webui.models.feedbacks import Feedbacks
 from open_webui.utils.auth import get_admin_user
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
@@ -59,10 +59,12 @@ async def get_model_analytics(
     end_date: Optional[int] = Query(None, description='End timestamp (epoch)'),
     group_id: Optional[str] = Query(None, description='Filter by user group ID'),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get message counts per model."""
-    counts = ChatMessages.get_message_count_by_model(start_date=start_date, end_date=end_date, group_id=group_id, db=db)
+    counts = await ChatMessages.get_message_count_by_model(
+        start_date=start_date, end_date=end_date, group_id=group_id, db=db
+    )
     models = [
         ModelAnalyticsEntry(model_id=model_id, count=count)
         for model_id, count in sorted(counts.items(), key=lambda x: -x[1])
@@ -77,17 +79,19 @@ async def get_user_analytics(
     group_id: Optional[str] = Query(None, description='Filter by user group ID'),
     limit: int = Query(50, description='Max users to return'),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get message counts and token usage per user with user info."""
-    counts = ChatMessages.get_message_count_by_user(start_date=start_date, end_date=end_date, group_id=group_id, db=db)
-    token_usage = ChatMessages.get_token_usage_by_user(
+    counts = await ChatMessages.get_message_count_by_user(
+        start_date=start_date, end_date=end_date, group_id=group_id, db=db
+    )
+    token_usage = await ChatMessages.get_token_usage_by_user(
         start_date=start_date, end_date=end_date, group_id=group_id, db=db
     )
 
     # Get user info for top users
     top_user_ids = [uid for uid, _ in sorted(counts.items(), key=lambda x: -x[1])[:limit]]
-    user_info = {u.id: u for u in Users.get_users_by_user_ids(top_user_ids, db=db)}
+    user_info = {u.id: u for u in await Users.get_users_by_user_ids(top_user_ids, db=db)}
 
     users = []
     for user_id in top_user_ids:
@@ -118,13 +122,13 @@ async def get_messages(
     skip: int = Query(0),
     limit: int = Query(50, le=100),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Query messages with filters."""
     if chat_id:
-        return ChatMessages.get_messages_by_chat_id(chat_id=chat_id, db=db)
+        return await ChatMessages.get_messages_by_chat_id(chat_id=chat_id, db=db)
     elif model_id:
-        return ChatMessages.get_messages_by_model_id(
+        return await ChatMessages.get_messages_by_model_id(
             model_id=model_id,
             start_date=start_date,
             end_date=end_date,
@@ -133,7 +137,7 @@ async def get_messages(
             db=db,
         )
     elif user_id:
-        return ChatMessages.get_messages_by_user_id(user_id=user_id, skip=skip, limit=limit, db=db)
+        return await ChatMessages.get_messages_by_user_id(user_id=user_id, skip=skip, limit=limit, db=db)
     else:
         # Return empty if no filter specified
         return []
@@ -152,16 +156,16 @@ async def get_summary(
     end_date: Optional[int] = Query(None, description='End timestamp (epoch)'),
     group_id: Optional[str] = Query(None, description='Filter by user group ID'),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get summary statistics for the dashboard."""
-    model_counts = ChatMessages.get_message_count_by_model(
+    model_counts = await ChatMessages.get_message_count_by_model(
         start_date=start_date, end_date=end_date, group_id=group_id, db=db
     )
-    user_counts = ChatMessages.get_message_count_by_user(
+    user_counts = await ChatMessages.get_message_count_by_user(
         start_date=start_date, end_date=end_date, group_id=group_id, db=db
     )
-    chat_counts = ChatMessages.get_message_count_by_chat(
+    chat_counts = await ChatMessages.get_message_count_by_chat(
         start_date=start_date, end_date=end_date, group_id=group_id, db=db
     )
 
@@ -189,13 +193,13 @@ async def get_daily_stats(
     group_id: Optional[str] = Query(None, description='Filter by user group ID'),
     granularity: str = Query('daily', description="Granularity: 'hourly' or 'daily'"),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get message counts grouped by model for time-series chart."""
     if granularity == 'hourly':
-        counts = ChatMessages.get_hourly_message_counts_by_model(start_date=start_date, end_date=end_date, db=db)
+        counts = await ChatMessages.get_hourly_message_counts_by_model(start_date=start_date, end_date=end_date, db=db)
     else:
-        counts = ChatMessages.get_daily_message_counts_by_model(
+        counts = await ChatMessages.get_daily_message_counts_by_model(
             start_date=start_date, end_date=end_date, group_id=group_id, db=db
         )
     return DailyStatsResponse(
@@ -224,10 +228,12 @@ async def get_token_usage(
     end_date: Optional[int] = Query(None),
     group_id: Optional[str] = Query(None, description='Filter by user group ID'),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get token usage aggregated by model."""
-    usage = ChatMessages.get_token_usage_by_model(start_date=start_date, end_date=end_date, group_id=group_id, db=db)
+    usage = await ChatMessages.get_token_usage_by_model(
+        start_date=start_date, end_date=end_date, group_id=group_id, db=db
+    )
 
     models = [
         TokenUsageEntry(model_id=model_id, **data)
@@ -271,12 +277,12 @@ async def get_model_chats(
     skip: int = Query(0),
     limit: int = Query(50, le=100),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get chats that used a specific model, with preview and feedback info."""
 
     # Get chat IDs that used this model
-    chat_ids = ChatMessages.get_chat_ids_by_model_id(
+    chat_ids = await ChatMessages.get_chat_ids_by_model_id(
         model_id=model_id,
         start_date=start_date,
         end_date=end_date,
@@ -291,7 +297,7 @@ async def get_model_chats(
     # Get chat details from messages only
     chats_data = []
     for chat_id in chat_ids:
-        messages = ChatMessages.get_messages_by_chat_id(chat_id, db=db)
+        messages = await ChatMessages.get_messages_by_chat_id(chat_id, db=db)
         if not messages:
             continue
 
@@ -312,7 +318,7 @@ async def get_model_chats(
         # Get user info
         user_name = None
         if user_id:
-            user_info = Users.get_user_by_id(user_id, db=db)
+            user_info = await Users.get_user_by_id(user_id, db=db)
             user_name = user_info.name if user_info else None
 
         # Timestamps from messages
@@ -357,12 +363,12 @@ async def get_model_overview(
     model_id: str,
     days: int = Query(30, description='Number of days of history (0 for all)'),
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get model overview with feedback history and chat tags."""
 
     # Get chat IDs that used this model
-    chat_ids = ChatMessages.get_chat_ids_by_model_id(
+    chat_ids = await ChatMessages.get_chat_ids_by_model_id(
         model_id=model_id,
         start_date=None,
         end_date=None,
@@ -381,7 +387,7 @@ async def get_model_overview(
         start_dt = now - timedelta(days=days)
 
     for chat_id in chat_ids:
-        feedbacks = Feedbacks.get_feedbacks_by_chat_id(chat_id, db=db)
+        feedbacks = await Feedbacks.get_feedbacks_by_chat_id(chat_id, db=db)
         for fb in feedbacks:
             if fb.data and 'rating' in fb.data:
                 rating = fb.data['rating']
@@ -425,7 +431,7 @@ async def get_model_overview(
     # Get chat tags
     tag_counts: dict[str, int] = defaultdict(int)
     for chat_id in chat_ids:
-        chat = Chats.get_chat_by_id(chat_id, db=db)
+        chat = await Chats.get_chat_by_id(chat_id, db=db)
         if chat and chat.meta:
             for tag in chat.meta.get('tags', []):
                 tag_counts[tag] += 1

backend/open_webui/routers/audio.py

@@ -5,7 +5,6 @@ import os
 import uuid
 import html
 import base64
-from functools import lru_cache
 from pydub import AudioSegment
 from pydub.silence import split_on_silence
 from concurrent.futures import ThreadPoolExecutor
@@ -54,6 +53,7 @@ from open_webui.env import (
     AIOHTTP_CLIENT_SESSION_SSL,
     AIOHTTP_CLIENT_TIMEOUT,
     AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST,
+    BYPASS_PYDUB_PREPROCESSING,
     DEVICE_TYPE,
     ENABLE_FORWARD_USER_INFO_HEADERS,
 )
@@ -168,6 +168,8 @@ class TTSConfigForm(BaseModel):
     AZURE_SPEECH_REGION: str
     AZURE_SPEECH_BASE_URL: str
     AZURE_SPEECH_OUTPUT_FORMAT: str
+    MISTRAL_API_KEY: str
+    MISTRAL_API_BASE_URL: str
 
 
 class STTConfigForm(BaseModel):
@@ -208,6 +210,8 @@ async def get_audio_config(request: Request, user=Depends(get_admin_user)):
             'AZURE_SPEECH_REGION': request.app.state.config.TTS_AZURE_SPEECH_REGION,
             'AZURE_SPEECH_BASE_URL': request.app.state.config.TTS_AZURE_SPEECH_BASE_URL,
             'AZURE_SPEECH_OUTPUT_FORMAT': request.app.state.config.TTS_AZURE_SPEECH_OUTPUT_FORMAT,
+            'MISTRAL_API_KEY': request.app.state.config.TTS_MISTRAL_API_KEY,
+            'MISTRAL_API_BASE_URL': request.app.state.config.TTS_MISTRAL_API_BASE_URL,
         },
         'stt': {
             'OPENAI_API_BASE_URL': request.app.state.config.STT_OPENAI_API_BASE_URL,
@@ -242,6 +246,8 @@ async def update_audio_config(request: Request, form_data: AudioConfigUpdateForm
     request.app.state.config.TTS_AZURE_SPEECH_REGION = form_data.tts.AZURE_SPEECH_REGION
     request.app.state.config.TTS_AZURE_SPEECH_BASE_URL = form_data.tts.AZURE_SPEECH_BASE_URL
     request.app.state.config.TTS_AZURE_SPEECH_OUTPUT_FORMAT = form_data.tts.AZURE_SPEECH_OUTPUT_FORMAT
+    request.app.state.config.TTS_MISTRAL_API_KEY = form_data.tts.MISTRAL_API_KEY
+    request.app.state.config.TTS_MISTRAL_API_BASE_URL = form_data.tts.MISTRAL_API_BASE_URL
 
     request.app.state.config.STT_OPENAI_API_BASE_URL = form_data.stt.OPENAI_API_BASE_URL
     request.app.state.config.STT_OPENAI_API_KEY = form_data.stt.OPENAI_API_KEY
@@ -280,6 +286,8 @@ async def update_audio_config(request: Request, form_data: AudioConfigUpdateForm
             'AZURE_SPEECH_REGION': request.app.state.config.TTS_AZURE_SPEECH_REGION,
             'AZURE_SPEECH_BASE_URL': request.app.state.config.TTS_AZURE_SPEECH_BASE_URL,
             'AZURE_SPEECH_OUTPUT_FORMAT': request.app.state.config.TTS_AZURE_SPEECH_OUTPUT_FORMAT,
+            'MISTRAL_API_KEY': request.app.state.config.TTS_MISTRAL_API_KEY,
+            'MISTRAL_API_BASE_URL': request.app.state.config.TTS_MISTRAL_API_BASE_URL,
         },
         'stt': {
             'OPENAI_API_BASE_URL': request.app.state.config.STT_OPENAI_API_BASE_URL,
@@ -322,7 +330,9 @@ async def speech(request: Request, user=Depends(get_verified_user)):
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if user.role != 'admin' and not has_permission(user.id, 'chat.tts', request.app.state.config.USER_PERMISSIONS):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'chat.tts', request.app.state.config.USER_PERMISSIONS
+    ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -410,7 +420,7 @@ async def speech(request: Request, user=Depends(get_verified_user)):
     elif request.app.state.config.TTS_ENGINE == 'elevenlabs':
         voice_id = payload.get('voice', '')
 
-        if voice_id not in get_available_voices(request):
+        if voice_id not in await get_available_voices(request):
             raise HTTPException(
                 status_code=400,
                 detail='Invalid voice id',
@@ -551,6 +561,77 @@ async def speech(request: Request, user=Depends(get_verified_user)):
 
         return FileResponse(file_path)
 
+    elif request.app.state.config.TTS_ENGINE == 'mistral':
+        api_key = request.app.state.config.TTS_MISTRAL_API_KEY
+        api_base_url = request.app.state.config.TTS_MISTRAL_API_BASE_URL or 'https://api.mistral.ai/v1'
+
+        if not api_key:
+            raise HTTPException(
+                status_code=400,
+                detail='Mistral API key is required for Mistral TTS',
+            )
+
+        try:
+            timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT)
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                mistral_payload = {
+                    'input': payload.get('input', ''),
+                    'model': request.app.state.config.TTS_MODEL or 'mistral-tts-latest',
+                    'voice_id': payload.get('voice', ''),
+                    'response_format': 'mp3',
+                }
+
+                r = await session.post(
+                    url=f'{api_base_url}/audio/speech',
+                    json=mistral_payload,
+                    headers={
+                        'Content-Type': 'application/json',
+                        'Authorization': f'Bearer {api_key}',
+                    },
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                )
+
+                r.raise_for_status()
+
+                res = await r.json()
+                audio_data = res.get('audio_data', '')
+                if not audio_data:
+                    raise ValueError('No audio_data in Mistral TTS response')
+
+                audio_bytes = base64.b64decode(audio_data)
+
+                async with aiofiles.open(file_path, 'wb') as f:
+                    await f.write(audio_bytes)
+
+                async with aiofiles.open(file_body_path, 'w') as f:
+                    await f.write(json.dumps(payload))
+
+            return FileResponse(file_path)
+
+        except Exception as e:
+            log.exception(e)
+            detail = None
+
+            status_code = 500
+            detail = 'Open WebUI: Server Connection Error'
+
+            if r is not None:
+                status_code = r.status
+
+                try:
+                    res = await r.json()
+                    if 'error' in res:
+                        detail = f'External: {res["error"]}'
+                    elif 'message' in res:
+                        detail = f'External: {res["message"]}'
+                except Exception:
+                    detail = f'External: {e}'
+
+            raise HTTPException(
+                status_code=status_code,
+                detail=detail,
+            )
+
 
 def transcription_handler(request, file_path, metadata, user=None):
     filename = os.path.basename(file_path)
@@ -582,7 +663,7 @@ def transcription_handler(request, file_path, metadata, user=None):
         data = {'text': transcript.strip()}
 
         # save the transcript to a json file
-        transcript_file = f'{file_dir}/{id}.json'
+        transcript_file = os.path.join(file_dir, f'{id}.json')
         with open(transcript_file, 'w') as f:
             json.dump(data, f)
 
@@ -620,7 +701,7 @@ def transcription_handler(request, file_path, metadata, user=None):
             data = r.json()
 
             # save the transcript to a json file
-            transcript_file = f'{file_dir}/{id}.json'
+            transcript_file = os.path.join(file_dir, f'{id}.json')
             with open(transcript_file, 'w') as f:
                 json.dump(data, f)
 
@@ -689,7 +770,7 @@ def transcription_handler(request, file_path, metadata, user=None):
             data = {'text': transcript.strip()}
 
             # Save transcript
-            transcript_file = f'{file_dir}/{id}.json'
+            transcript_file = os.path.join(file_dir, f'{id}.json')
             with open(transcript_file, 'w') as f:
                 json.dump(data, f)
 
@@ -796,7 +877,7 @@ def transcription_handler(request, file_path, metadata, user=None):
             data = {'text': transcript}
 
             # Save transcript to json file (consistent with other providers)
-            transcript_file = f'{file_dir}/{id}.json'
+            transcript_file = os.path.join(file_dir, f'{id}.json')
             with open(transcript_file, 'w') as f:
                 json.dump(data, f)
 
@@ -893,7 +974,10 @@ def transcription_handler(request, file_path, metadata, user=None):
 
                 # Read and encode audio file as base64
                 with open(audio_file_to_use, 'rb') as audio_file:
-                    audio_base64 = base64.b64encode(audio_file.read()).decode('utf-8')
+                    audio_base64 = {
+                        'data': base64.b64encode(audio_file.read()).decode('utf-8'),
+                        'format': mimetypes.guess_extension(mimetypes.guess_type(audio_file_to_use)[0]).lstrip('.'),
+                    }
 
                 # Prepare chat completions request
                 url = f'{api_base_url}/chat/completions'
@@ -981,7 +1065,7 @@ def transcription_handler(request, file_path, metadata, user=None):
                 data = {'text': transcript}
 
             # Save transcript to json file (consistent with other providers)
-            transcript_file = f'{file_dir}/{id}.json'
+            transcript_file = os.path.join(file_dir, f'{id}.json')
             with open(transcript_file, 'w') as f:
                 json.dump(data, f)
 
@@ -1017,24 +1101,28 @@ def transcription_handler(request, file_path, metadata, user=None):
 def transcribe(request: Request, file_path: str, metadata: Optional[dict] = None, user=None):
     log.info(f'transcribe: {file_path} {metadata}')
 
-    if is_audio_conversion_required(file_path):
-        file_path = convert_audio_to_mp3(file_path)
+    if BYPASS_PYDUB_PREPROCESSING:
+        log.info('Bypassing pydub preprocessing (BYPASS_PYDUB_PREPROCESSING=true)')
+        chunk_paths = [file_path]
+    else:
+        if is_audio_conversion_required(file_path):
+            file_path = convert_audio_to_mp3(file_path)
 
-    try:
-        file_path = compress_audio(file_path)
-    except Exception as e:
-        log.exception(e)
+        try:
+            file_path = compress_audio(file_path)
+        except Exception as e:
+            log.exception(e)
 
-    # Always produce a list of chunk paths (could be one entry if small)
-    try:
-        chunk_paths = split_audio(file_path, MAX_FILE_SIZE)
-        print(f'Chunk paths: {chunk_paths}')
-    except Exception as e:
-        log.exception(e)
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.DEFAULT(e),
-        )
+        # Always produce a list of chunk paths (could be one entry if small)
+        try:
+            chunk_paths = split_audio(file_path, MAX_FILE_SIZE)
+            print(f'Chunk paths: {chunk_paths}')
+        except Exception as e:
+            log.exception(e)
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=ERROR_MESSAGES.DEFAULT(e),
+            )
 
     results = []
     try:
@@ -1130,13 +1218,15 @@ def split_audio(file_path, max_bytes, format='mp3', bitrate='32k'):
 
 
 @router.post('/transcriptions')
-def transcription(
+async def transcription(
     request: Request,
     file: UploadFile = File(...),
     language: Optional[str] = Form(None),
     user=Depends(get_verified_user),
 ):
-    if user.role != 'admin' and not has_permission(user.id, 'chat.stt', request.app.state.config.USER_PERMISSIONS):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'chat.stt', request.app.state.config.USER_PERMISSIONS
+    ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
@@ -1159,9 +1249,9 @@ def transcription(
         filename = f'{id}.{ext}'
         contents = file.file.read()
 
-        file_dir = f'{CACHE_DIR}/audio/transcriptions'
+        file_dir = os.path.join(CACHE_DIR, 'audio', 'transcriptions')
         os.makedirs(file_dir, exist_ok=True)
-        file_path = f'{file_dir}/{filename}'
+        file_path = os.path.join(file_dir, filename)
 
         # Defense-in-depth: ensure resolved path stays within intended directory
         if not os.path.realpath(file_path).startswith(os.path.realpath(file_dir)):
@@ -1204,63 +1294,83 @@ def transcription(
         )
 
 
-def get_available_models(request: Request) -> list[dict]:
+async def get_available_models(request: Request) -> list[dict]:
     available_models = []
     if request.app.state.config.TTS_ENGINE == 'openai':
         # Use custom endpoint if not using the official OpenAI API URL
         if not request.app.state.config.TTS_OPENAI_API_BASE_URL.startswith('https://api.openai.com'):
-            try:
-                response = requests.get(
-                    f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/models',
-                    timeout=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST,
-                )
-                response.raise_for_status()
-                data = response.json()
-                available_models = data.get('models', [])
-            except Exception as e:
-                log.error(f'Error fetching models from custom endpoint: {str(e)}')
-                available_models = [{'id': 'tts-1'}, {'id': 'tts-1-hd'}]
+            timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                try:
+                    async with session.get(
+                        f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/models',
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                    ) as response:
+                        response.raise_for_status()
+                        data = await response.json()
+                        available_models = data.get('models', [])
+                except Exception as e:
+                    log.debug(f'/audio/models not available, trying /models fallback: {str(e)}')
+                    # Fallback to standard OpenAI-compatible /models endpoint
+                    # (used by KokoroTTS and similar custom TTS servers)
+                    try:
+                        async with session.get(
+                            f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/models',
+                            ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                        ) as response:
+                            response.raise_for_status()
+                            data = await response.json()
+                            # OpenAI /models returns {"data": [...]}, /audio/models returns {"models": [...]}
+                            available_models = data.get('data', data.get('models', []))
+                    except Exception as e2:
+                        log.error(f'Error fetching models from custom endpoint: {str(e2)}')
+                        available_models = [{'id': 'tts-1'}, {'id': 'tts-1-hd'}]
         else:
             available_models = [{'id': 'tts-1'}, {'id': 'tts-1-hd'}]
     elif request.app.state.config.TTS_ENGINE == 'elevenlabs':
         try:
-            response = requests.get(
-                f'{ELEVENLABS_API_BASE_URL}/v1/models',
-                headers={
-                    'xi-api-key': request.app.state.config.TTS_API_KEY,
-                    'Content-Type': 'application/json',
-                },
-                timeout=5,
-            )
-            response.raise_for_status()
-            models = response.json()
-
-            available_models = [{'name': model['name'], 'id': model['model_id']} for model in models]
-        except requests.RequestException as e:
-            log.error(f'Error fetching voices: {str(e)}')
+            timeout = aiohttp.ClientTimeout(total=5)
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                async with session.get(
+                    f'{ELEVENLABS_API_BASE_URL}/v1/models',
+                    headers={
+                        'xi-api-key': request.app.state.config.TTS_API_KEY,
+                        'Content-Type': 'application/json',
+                    },
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                ) as response:
+                    response.raise_for_status()
+                    models = await response.json()
+                    available_models = [{'name': model['name'], 'id': model['model_id']} for model in models]
+        except Exception as e:
+            log.error(f'Error fetching models: {str(e)}')
+    elif request.app.state.config.TTS_ENGINE == 'mistral':
+        available_models = [{'id': 'mistral-tts-latest'}]
     return available_models
 
 
 @router.get('/models')
 async def get_models(request: Request, user=Depends(get_verified_user)):
-    return {'models': get_available_models(request)}
+    return {'models': await get_available_models(request)}
 
 
-def get_available_voices(request) -> dict:
+async def get_available_voices(request) -> dict:
     """Returns {voice_id: voice_name} dict"""
     available_voices = {}
     if request.app.state.config.TTS_ENGINE == 'openai':
         # Use custom endpoint if not using the official OpenAI API URL
         if not request.app.state.config.TTS_OPENAI_API_BASE_URL.startswith('https://api.openai.com'):
             try:
-                response = requests.get(
-                    f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/voices',
-                    timeout=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST,
-                )
-                response.raise_for_status()
-                data = response.json()
-                voices_list = data.get('voices', [])
-                available_voices = {voice['id']: voice['name'] for voice in voices_list}
+                timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
+                async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                    async with session.get(
+                        f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/voices',
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                    ) as response:
+                        response.raise_for_status()
+                        data = await response.json()
+                        voices_list = data.get('voices', [])
+                        available_voices = {voice['id']: voice['name'] for voice in voices_list}
             except Exception as e:
                 log.error(f'Error fetching voices from custom endpoint: {str(e)}')
                 available_voices = {
@@ -1282,7 +1392,7 @@ def get_available_voices(request) -> dict:
             }
     elif request.app.state.config.TTS_ENGINE == 'elevenlabs':
         try:
-            available_voices = get_elevenlabs_voices(api_key=request.app.state.config.TTS_API_KEY)
+            available_voices = await get_elevenlabs_voices(api_key=request.app.state.config.TTS_API_KEY)
         except Exception:
             # Avoided @lru_cache with exception
             pass
@@ -1293,20 +1403,46 @@ def get_available_voices(request) -> dict:
             url = (base_url or f'https://{region}.tts.speech.microsoft.com') + '/cognitiveservices/voices/list'
             headers = {'Ocp-Apim-Subscription-Key': request.app.state.config.TTS_API_KEY}
 
-            response = requests.get(url, headers=headers, timeout=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
-            response.raise_for_status()
-            voices = response.json()
+            timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                async with session.get(url, headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as response:
+                    response.raise_for_status()
+                    voices = await response.json()
 
-            for voice in voices:
-                available_voices[voice['ShortName']] = f'{voice["DisplayName"]} ({voice["ShortName"]})'
-        except requests.RequestException as e:
+                    for voice in voices:
+                        available_voices[voice['ShortName']] = f'{voice["DisplayName"]} ({voice["ShortName"]})'
+        except Exception as e:
             log.error(f'Error fetching voices: {str(e)}')
+    elif request.app.state.config.TTS_ENGINE == 'mistral':
+        api_key = request.app.state.config.TTS_MISTRAL_API_KEY
+        api_base_url = request.app.state.config.TTS_MISTRAL_API_BASE_URL or 'https://api.mistral.ai/v1'
+
+        if api_key:
+            try:
+                timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
+                async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+                    async with session.get(
+                        f'{api_base_url}/audio/voices',
+                        headers={
+                            'Authorization': f'Bearer {api_key}',
+                        },
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                    ) as response:
+                        response.raise_for_status()
+                        voices_data = await response.json()
+
+                        for voice in voices_data:
+                            voice_id = voice.get('voice_id', voice.get('id', ''))
+                            voice_name = voice.get('name', voice_id)
+                            if voice_id:
+                                available_voices[voice_id] = voice_name
+            except Exception as e:
+                log.error(f'Error fetching Mistral voices: {str(e)}')
 
     return available_voices
 
 
-@lru_cache
-def get_elevenlabs_voices(api_key: str) -> dict:
+async def get_elevenlabs_voices(api_key: str) -> dict:
     """
     Note, set the following in your .env file to use Elevenlabs:
     AUDIO_TTS_ENGINE=elevenlabs
@@ -1317,22 +1453,23 @@ def get_elevenlabs_voices(api_key: str) -> dict:
 
     try:
         # TODO: Add retries
-        response = requests.get(
-            f'{ELEVENLABS_API_BASE_URL}/v1/voices',
-            headers={
-                'xi-api-key': api_key,
-                'Content-Type': 'application/json',
-            },
-            timeout=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST,
-        )
-        response.raise_for_status()
-        voices_data = response.json()
+        timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
+        async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+            async with session.get(
+                f'{ELEVENLABS_API_BASE_URL}/v1/voices',
+                headers={
+                    'xi-api-key': api_key,
+                    'Content-Type': 'application/json',
+                },
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as response:
+                response.raise_for_status()
+                voices_data = await response.json()
 
-        voices = {}
-        for voice in voices_data.get('voices', []):
-            voices[voice['voice_id']] = voice['name']
-    except requests.RequestException as e:
-        # Avoid @lru_cache with exception
+                voices = {}
+                for voice in voices_data.get('voices', []):
+                    voices[voice['voice_id']] = voice['name']
+    except Exception as e:
         log.error(f'Error fetching voices: {str(e)}')
         raise RuntimeError(f'Error fetching voices: {str(e)}')
 
@@ -1341,4 +1478,4 @@ def get_elevenlabs_voices(api_key: str) -> dict:
 
 @router.get('/voices')
 async def get_voices(request: Request, user=Depends(get_verified_user)):
-    return {'voices': [{'id': k, 'name': v} for k, v in get_available_voices(request).items()]}
+    return {'voices': [{'id': k, 'name': v} for k, v in (await get_available_voices(request)).items()]}

backend/open_webui/routers/auths.py

@@ -54,6 +54,7 @@ from open_webui.config import (
     OAUTH_PROVIDERS,
     OAUTH_MERGE_ACCOUNTS_BY_EMAIL,
 )
+from open_webui.utils.oauth import auth_manager_config
 from pydantic import BaseModel
 
 from open_webui.utils.misc import parse_duration, validate_email_format
@@ -70,8 +71,8 @@ from open_webui.utils.auth import (
     get_password_hash,
     get_http_authorization_cred,
 )
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 from open_webui.utils.webhook import post_webhook
 from open_webui.utils.access_control import get_permissions, has_permission
 from open_webui.utils.groups import apply_default_group_assignment
@@ -96,7 +97,9 @@ log = logging.getLogger(__name__)
 signin_rate_limiter = RateLimiter(redis_client=get_redis_client(), limit=5 * 3, window=60 * 3)
 
 
-def create_session_response(request: Request, user, db, response: Response = None, set_cookie: bool = False) -> dict:
+async def create_session_response(
+    request: Request, user, db, response: Response = None, set_cookie: bool = False
+) -> dict:
     """
     Create JWT token and build session response for a user.
     Shared helper for signin, signup, ldap_auth, add_user, and token_exchange endpoints.
@@ -131,7 +134,7 @@ def create_session_response(request: Request, user, db, response: Response = Non
             **({'max_age': max_age} if max_age is not None else {}),
         )
 
-    user_permissions = get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
+    user_permissions = await get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
 
     return {
         'token': token,
@@ -167,7 +170,7 @@ async def get_session_user(
     request: Request,
     response: Response,
     user=Depends(get_current_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     auth_header = request.headers.get('Authorization')
     auth_token = get_http_authorization_cred(auth_header)
@@ -197,7 +200,7 @@ async def get_session_user(
             **({'max_age': max_age} if max_age is not None else {}),
         )
 
-    user_permissions = get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
+    user_permissions = await get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
 
     return {
         'token': token,
@@ -227,10 +230,10 @@ async def get_session_user(
 async def update_profile(
     form_data: UpdateProfileForm,
     session_user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if session_user:
-        user = Users.update_user_by_id(
+        user = await Users.update_user_by_id(
             session_user.id,
             form_data.model_dump(),
             db=db,
@@ -256,10 +259,10 @@ class UpdateTimezoneForm(BaseModel):
 async def update_timezone(
     form_data: UpdateTimezoneForm,
     session_user=Depends(get_current_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if session_user:
-        Users.update_user_by_id(
+        await Users.update_user_by_id(
             session_user.id,
             {'timezone': form_data.timezone},
             db=db,
@@ -278,12 +281,12 @@ async def update_timezone(
 async def update_password(
     form_data: UpdatePasswordForm,
     session_user=Depends(get_current_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if WEBUI_AUTH_TRUSTED_EMAIL_HEADER:
         raise HTTPException(400, detail=ERROR_MESSAGES.ACTION_PROHIBITED)
     if session_user:
-        user = Auths.authenticate_user(
+        user = await Auths.authenticate_user(
             session_user.email,
             lambda pw: verify_password(form_data.password, pw),
             db=db,
@@ -295,7 +298,7 @@ async def update_password(
             except Exception as e:
                 raise HTTPException(400, detail=str(e))
             hashed = get_password_hash(form_data.new_password)
-            return Auths.update_user_password_by_id(user.id, hashed, db=db)
+            return await Auths.update_user_password_by_id(user.id, hashed, db=db)
         else:
             raise HTTPException(400, detail=ERROR_MESSAGES.INCORRECT_PASSWORD)
     else:
@@ -364,7 +367,7 @@ async def ldap_auth(
     request: Request,
     response: Response,
     form_data: LdapForm,
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     # Security checks FIRST - before loading any config
     if not request.app.state.config.ENABLE_LDAP:
@@ -376,6 +379,14 @@ async def ldap_auth(
             detail=ERROR_MESSAGES.ACTION_PROHIBITED,
         )
 
+    # Reject empty passwords before attempting the LDAP bind.
+    # Per RFC 4513 §5.1.2, a Simple Bind with a non-empty DN but empty
+    # password is "unauthenticated simple authentication" — many LDAP
+    # servers (OpenLDAP default, some AD configs) return success for these,
+    # which would grant access without valid credentials.
+    if not form_data.password or not form_data.password.strip():
+        raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)
+
     # NOW load LDAP config variables
     LDAP_SERVER_LABEL = request.app.state.config.LDAP_SERVER_LABEL
     LDAP_SERVER_HOST = request.app.state.config.LDAP_SERVER_HOST
@@ -550,19 +561,18 @@ async def ldap_auth(
             if not await asyncio.to_thread(connection_user.bind):
                 raise HTTPException(400, 'Authentication failed.')
 
-            user = Users.get_user_by_email(email, db=db)
+            user = await Users.get_user_by_email(email, db=db)
             if not user:
                 try:
-                    role = 'admin' if not Users.has_users(db=db) else request.app.state.config.DEFAULT_USER_ROLE
-
                     if user_id:
                         log.debug(f'Creating LDAP user with AD SID as ID: {user_id}')
-
-                    user = Auths.insert_new_auth(
+                    # Insert with default role first to avoid TOCTOU race on
+                    # first-user registration.  Matches signup_handler pattern.
+                    user = await Auths.insert_new_auth(
                         email=email,
                         password=str(uuid.uuid4()),
                         name=cn,
-                        role=role,
+                        role=request.app.state.config.DEFAULT_USER_ROLE,
                         db=db,
                         id=user_id,
                     )
@@ -571,7 +581,13 @@ async def ldap_auth(
                         log.error(f'Failed to create or recover LDAP user: email={email}, id={user_id}')
                         raise HTTPException(500, detail=ERROR_MESSAGES.CREATE_USER_ERROR)
 
-                    apply_default_group_assignment(
+                    # Atomically check if this is the only user *after* the
+                    # insert.  Only the single user present should become admin.
+                    if await Users.get_num_users(db=db) == 1:
+                        await Users.update_user_role_by_id(user.id, 'admin', db=db)
+                        user = await Users.get_user_by_id(user.id, db=db)
+
+                    await apply_default_group_assignment(
                         request.app.state.config.DEFAULT_GROUP_ID,
                         user.id,
                         db=db,
@@ -583,19 +599,19 @@ async def ldap_auth(
                     log.error(f'LDAP user creation error: {str(err)}')
                     raise HTTPException(500, detail='Internal error occurred during LDAP user creation.')
 
-            user = Auths.authenticate_user_by_email(email, db=db)
+            user = await Auths.authenticate_user_by_email(email, db=db)
 
             if user:
                 if ENABLE_LDAP_GROUP_MANAGEMENT and user_groups:
                     if ENABLE_LDAP_GROUP_CREATION:
-                        Groups.create_groups_by_group_names(user.id, user_groups, db=db)
+                        await Groups.create_groups_by_group_names(user.id, user_groups, db=db)
                     try:
-                        Groups.sync_groups_by_group_names(user.id, user_groups, db=db)
+                        await Groups.sync_groups_by_group_names(user.id, user_groups, db=db)
                         log.info(f'Successfully synced groups for user {user.id}: {user_groups}')
                     except Exception as e:
                         log.error(f'Failed to sync groups for user {user.id}: {e}')
 
-                return create_session_response(request, user, db, response, set_cookie=True)
+                return await create_session_response(request, user, db, response, set_cookie=True)
             else:
                 raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)
         else:
@@ -615,7 +631,7 @@ async def signin(
     request: Request,
     response: Response,
     form_data: SigninForm,
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not ENABLE_PASSWORD_AUTH:
         raise HTTPException(
@@ -637,7 +653,7 @@ async def signin(
             except Exception as e:
                 pass
 
-        if not Users.get_user_by_email(email.lower(), db=db):
+        if not await Users.get_user_by_email(email.lower(), db=db):
             await signup_handler(
                 request,
                 email,
@@ -646,20 +662,20 @@ async def signin(
                 db=db,
             )
 
-        user = Auths.authenticate_user_by_email(email, db=db)
+        user = await Auths.authenticate_user_by_email(email, db=db)
         if user:
             if WEBUI_AUTH_TRUSTED_GROUPS_HEADER:
                 group_names = request.headers.get(WEBUI_AUTH_TRUSTED_GROUPS_HEADER, '').split(',')
                 group_names = [name.strip() for name in group_names if name.strip()]
 
                 if group_names:
-                    Groups.sync_groups_by_group_names(user.id, group_names, db=db)
+                    await Groups.sync_groups_by_group_names(user.id, group_names, db=db)
 
             if WEBUI_AUTH_TRUSTED_ROLE_HEADER:
                 trusted_role = request.headers.get(WEBUI_AUTH_TRUSTED_ROLE_HEADER, '').lower().strip()
                 if trusted_role in {'admin', 'user', 'pending'}:
                     if user.role != trusted_role:
-                        Users.update_user_role_by_id(user.id, trusted_role, db=db)
+                        await Users.update_user_role_by_id(user.id, trusted_role, db=db)
                 elif trusted_role:
                     log.warning(f'Ignoring invalid trusted role header value: {trusted_role}')
 
@@ -667,14 +683,14 @@ async def signin(
         admin_email = 'admin@localhost'
         admin_password = 'admin'
 
-        if Users.get_user_by_email(admin_email.lower(), db=db):
-            user = Auths.authenticate_user(
+        if await Users.get_user_by_email(admin_email.lower(), db=db):
+            user = await Auths.authenticate_user(
                 admin_email.lower(),
                 lambda pw: verify_password(admin_password, pw),
                 db=db,
             )
         else:
-            if Users.has_users(db=db):
+            if await Users.has_users(db=db):
                 raise HTTPException(400, detail=ERROR_MESSAGES.EXISTING_USERS)
 
             await signup_handler(
@@ -685,7 +701,7 @@ async def signin(
                 db=db,
             )
 
-            user = Auths.authenticate_user(
+            user = await Auths.authenticate_user(
                 admin_email.lower(),
                 lambda pw: verify_password(admin_password, pw),
                 db=db,
@@ -706,14 +722,14 @@ async def signin(
             # decode safely — ignore incomplete UTF-8 sequences
             form_data.password = password_bytes.decode('utf-8', errors='ignore')
 
-        user = Auths.authenticate_user(
+        user = await Auths.authenticate_user(
             form_data.email.lower(),
             lambda pw: verify_password(form_data.password, pw),
             db=db,
         )
 
     if user:
-        return create_session_response(request, user, db, response, set_cookie=True)
+        return await create_session_response(request, user, db, response, set_cookie=True)
     else:
         raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)
 
@@ -730,7 +746,7 @@ async def signup_handler(
     name: str,
     profile_image_url: str = '/user.png',
     *,
-    db: Session,
+    db: AsyncSession,
 ) -> UserModel:
     """
     Core user-creation logic shared by the signup endpoint and
@@ -744,7 +760,7 @@ async def signup_handler(
     # first-user registration can all see an empty table and each get admin.
     hashed = get_password_hash(password)
 
-    user = Auths.insert_new_auth(
+    user = await Auths.insert_new_auth(
         email=email.lower(),
         password=hashed,
         name=name,
@@ -757,9 +773,9 @@ async def signup_handler(
 
     # Atomically check if this is the only user *after* the insert.
     # Only the single user present at this point should become admin.
-    if Users.get_num_users(db=db) == 1:
-        Users.update_user_role_by_id(user.id, 'admin', db=db)
-        user = Users.get_user_by_id(user.id, db=db)
+    if await Users.get_num_users(db=db) == 1:
+        await Users.update_user_role_by_id(user.id, 'admin', db=db)
+        user = await Users.get_user_by_id(user.id, db=db)
         request.app.state.config.ENABLE_SIGNUP = False
 
     if request.app.state.config.WEBHOOK_URL:
@@ -774,7 +790,7 @@ async def signup_handler(
             },
         )
 
-    apply_default_group_assignment(
+    await apply_default_group_assignment(
         request.app.state.config.DEFAULT_GROUP_ID,
         user.id,
         db=db,
@@ -788,9 +804,9 @@ async def signup(
     request: Request,
     response: Response,
     form_data: SignupForm,
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    has_users = Users.has_users(db=db)
+    has_users = await Users.has_users(db=db)
 
     if WEBUI_AUTH:
         if not request.app.state.config.ENABLE_SIGNUP or not request.app.state.config.ENABLE_LOGIN_FORM:
@@ -803,7 +819,7 @@ async def signup(
     if not validate_email_format(form_data.email.lower()):
         raise HTTPException(status.HTTP_400_BAD_REQUEST, detail=ERROR_MESSAGES.INVALID_EMAIL_FORMAT)
 
-    if Users.get_user_by_email(form_data.email.lower(), db=db):
+    if await Users.get_user_by_email(form_data.email.lower(), db=db):
         raise HTTPException(400, detail=ERROR_MESSAGES.EMAIL_TAKEN)
 
     try:
@@ -820,7 +836,7 @@ async def signup(
             form_data.profile_image_url,
             db=db,
         )
-        return create_session_response(request, user, db, response, set_cookie=True)
+        return await create_session_response(request, user, db, response, set_cookie=True)
     except HTTPException:
         raise
     except Exception as err:
@@ -829,7 +845,7 @@ async def signup(
 
 
 @router.get('/signout')
-async def signout(request: Request, response: Response, db: Session = Depends(get_session)):
+async def signout(request: Request, response: Response, db: AsyncSession = Depends(get_async_session)):
     # get auth token from headers or cookies
     token = None
     auth_header = request.headers.get('Authorization')
@@ -850,7 +866,7 @@ async def signout(request: Request, response: Response, db: Session = Depends(ge
     if oauth_session_id:
         response.delete_cookie('oauth_session_id')
 
-        session = OAuthSessions.get_session_by_id(oauth_session_id, db=db)
+        session = await OAuthSessions.get_session_by_id(oauth_session_id, db=db)
 
         # If a custom end_session_endpoint is configured (e.g. AWS Cognito), redirect
         # there directly instead of attempting OIDC discovery.
@@ -872,7 +888,7 @@ async def signout(request: Request, response: Response, db: Session = Depends(ge
             oauth_id_token = session.token.get('id_token')
             try:
                 async with ClientSession(trust_env=True) as session:
-                    async with session.get(oauth_server_metadata_url) as r:
+                    async with session.get(oauth_server_metadata_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r:
                         if r.status == 200:
                             openid_data = await r.json()
                             logout_url = openid_data.get('end_session_endpoint')
@@ -925,12 +941,12 @@ async def add_user(
     request: Request,
     form_data: AddUserForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not validate_email_format(form_data.email.lower()):
         raise HTTPException(status.HTTP_400_BAD_REQUEST, detail=ERROR_MESSAGES.INVALID_EMAIL_FORMAT)
 
-    if Users.get_user_by_email(form_data.email.lower(), db=db):
+    if await Users.get_user_by_email(form_data.email.lower(), db=db):
         raise HTTPException(400, detail=ERROR_MESSAGES.EMAIL_TAKEN)
 
     try:
@@ -940,7 +956,7 @@ async def add_user(
             raise HTTPException(400, detail=str(e))
 
         hashed = get_password_hash(form_data.password)
-        user = Auths.insert_new_auth(
+        user = await Auths.insert_new_auth(
             form_data.email.lower(),
             hashed,
             form_data.name,
@@ -950,13 +966,14 @@ async def add_user(
         )
 
         if user:
-            apply_default_group_assignment(
+            await apply_default_group_assignment(
                 request.app.state.config.DEFAULT_GROUP_ID,
                 user.id,
                 db=db,
             )
 
-            token = create_token(data={'id': user.id})
+            expires_delta = parse_duration(request.app.state.config.JWT_EXPIRES_IN)
+            token = create_token(data={'id': user.id}, expires_delta=expires_delta)
             return {
                 'token': token,
                 'token_type': 'Bearer',
@@ -981,7 +998,9 @@ async def add_user(
 
 
 @router.get('/admin/details')
-async def get_admin_details(request: Request, user=Depends(get_current_user), db: Session = Depends(get_session)):
+async def get_admin_details(
+    request: Request, user=Depends(get_current_user), db: AsyncSession = Depends(get_async_session)
+):
     if request.app.state.config.SHOW_ADMIN_DETAILS:
         admin_email = request.app.state.config.ADMIN_EMAIL
         admin_name = None
@@ -989,11 +1008,11 @@ async def get_admin_details(request: Request, user=Depends(get_current_user), db
         log.info(f'Admin details - Email: {admin_email}, Name: {admin_name}')
 
         if admin_email:
-            admin = Users.get_user_by_email(admin_email, db=db)
+            admin = await Users.get_user_by_email(admin_email, db=db)
             if admin:
                 admin_name = admin.name
         else:
-            admin = Users.get_first_user(db=db)
+            admin = await Users.get_first_user(db=db)
             if admin:
                 admin_email = admin.email
                 admin_name = admin.name
@@ -1028,7 +1047,11 @@ async def get_admin_config(request: Request, user=Depends(get_admin_user)):
         'ENABLE_MESSAGE_RATING': request.app.state.config.ENABLE_MESSAGE_RATING,
         'ENABLE_FOLDERS': request.app.state.config.ENABLE_FOLDERS,
         'FOLDER_MAX_FILE_COUNT': request.app.state.config.FOLDER_MAX_FILE_COUNT,
+        'AUTOMATION_MAX_COUNT': request.app.state.config.AUTOMATION_MAX_COUNT,
+        'AUTOMATION_MIN_INTERVAL': request.app.state.config.AUTOMATION_MIN_INTERVAL,
+        'ENABLE_AUTOMATIONS': request.app.state.config.ENABLE_AUTOMATIONS,
         'ENABLE_CHANNELS': request.app.state.config.ENABLE_CHANNELS,
+        'ENABLE_CALENDAR': request.app.state.config.ENABLE_CALENDAR,
         'ENABLE_MEMORIES': request.app.state.config.ENABLE_MEMORIES,
         'ENABLE_NOTES': request.app.state.config.ENABLE_NOTES,
         'ENABLE_USER_WEBHOOKS': request.app.state.config.ENABLE_USER_WEBHOOKS,
@@ -1054,7 +1077,11 @@ class AdminConfig(BaseModel):
     ENABLE_MESSAGE_RATING: bool
     ENABLE_FOLDERS: bool
     FOLDER_MAX_FILE_COUNT: Optional[int | str] = None
+    AUTOMATION_MAX_COUNT: Optional[int | str] = None
+    AUTOMATION_MIN_INTERVAL: Optional[int | str] = None
+    ENABLE_AUTOMATIONS: bool
     ENABLE_CHANNELS: bool
+    ENABLE_CALENDAR: bool
     ENABLE_MEMORIES: bool
     ENABLE_NOTES: bool
     ENABLE_USER_WEBHOOKS: bool
@@ -1079,7 +1106,15 @@ async def update_admin_config(request: Request, form_data: AdminConfig, user=Dep
     request.app.state.config.FOLDER_MAX_FILE_COUNT = (
         int(form_data.FOLDER_MAX_FILE_COUNT) if form_data.FOLDER_MAX_FILE_COUNT else ''
     )
+    request.app.state.config.AUTOMATION_MAX_COUNT = (
+        int(form_data.AUTOMATION_MAX_COUNT) if form_data.AUTOMATION_MAX_COUNT else ''
+    )
+    request.app.state.config.AUTOMATION_MIN_INTERVAL = (
+        int(form_data.AUTOMATION_MIN_INTERVAL) if form_data.AUTOMATION_MIN_INTERVAL else ''
+    )
+    request.app.state.config.ENABLE_AUTOMATIONS = form_data.ENABLE_AUTOMATIONS
     request.app.state.config.ENABLE_CHANNELS = form_data.ENABLE_CHANNELS
+    request.app.state.config.ENABLE_CALENDAR = form_data.ENABLE_CALENDAR
     request.app.state.config.ENABLE_MEMORIES = form_data.ENABLE_MEMORIES
     request.app.state.config.ENABLE_NOTES = form_data.ENABLE_NOTES
 
@@ -1120,7 +1155,11 @@ async def update_admin_config(request: Request, form_data: AdminConfig, user=Dep
         'ENABLE_MESSAGE_RATING': request.app.state.config.ENABLE_MESSAGE_RATING,
         'ENABLE_FOLDERS': request.app.state.config.ENABLE_FOLDERS,
         'FOLDER_MAX_FILE_COUNT': request.app.state.config.FOLDER_MAX_FILE_COUNT,
+        'AUTOMATION_MAX_COUNT': request.app.state.config.AUTOMATION_MAX_COUNT,
+        'AUTOMATION_MIN_INTERVAL': request.app.state.config.AUTOMATION_MIN_INTERVAL,
+        'ENABLE_AUTOMATIONS': request.app.state.config.ENABLE_AUTOMATIONS,
         'ENABLE_CHANNELS': request.app.state.config.ENABLE_CHANNELS,
+        'ENABLE_CALENDAR': request.app.state.config.ENABLE_CALENDAR,
         'ENABLE_MEMORIES': request.app.state.config.ENABLE_MEMORIES,
         'ENABLE_NOTES': request.app.state.config.ENABLE_NOTES,
         'ENABLE_USER_WEBHOOKS': request.app.state.config.ENABLE_USER_WEBHOOKS,
@@ -1179,7 +1218,7 @@ async def update_ldap_server(request: Request, form_data: LdapServerConfig, user
     for key in required_fields:
         value = getattr(form_data, key)
         if not value:
-            raise HTTPException(400, detail=f'Required field {key} is empty')
+            raise HTTPException(400, detail=ERROR_MESSAGES.REQUIRED_FIELD_EMPTY(key))
 
     request.app.state.config.LDAP_SERVER_LABEL = form_data.label
     request.app.state.config.LDAP_SERVER_HOST = form_data.host
@@ -1236,10 +1275,12 @@ async def update_ldap_config(request: Request, form_data: LdapConfigForm, user=D
 
 # create api key
 @router.post('/api_key', response_model=ApiKey)
-async def generate_api_key(request: Request, user=Depends(get_current_user), db: Session = Depends(get_session)):
+async def generate_api_key(
+    request: Request, user=Depends(get_current_user), db: AsyncSession = Depends(get_async_session)
+):
     if not request.app.state.config.ENABLE_API_KEYS or (
         user.role != 'admin'
-        and not has_permission(user.id, 'features.api_keys', request.app.state.config.USER_PERMISSIONS)
+        and not await has_permission(user.id, 'features.api_keys', request.app.state.config.USER_PERMISSIONS)
     ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -1247,7 +1288,7 @@ async def generate_api_key(request: Request, user=Depends(get_current_user), db:
         )
 
     api_key = create_api_key()
-    success = Users.update_user_api_key_by_id(user.id, api_key, db=db)
+    success = await Users.update_user_api_key_by_id(user.id, api_key, db=db)
 
     if success:
         return {
@@ -1259,14 +1300,14 @@ async def generate_api_key(request: Request, user=Depends(get_current_user), db:
 
 # delete api key
 @router.delete('/api_key', response_model=bool)
-async def delete_api_key(user=Depends(get_current_user), db: Session = Depends(get_session)):
-    return Users.delete_user_api_key_by_id(user.id, db=db)
+async def delete_api_key(user=Depends(get_current_user), db: AsyncSession = Depends(get_async_session)):
+    return await Users.delete_user_api_key_by_id(user.id, db=db)
 
 
 # get api key
 @router.get('/api_key', response_model=ApiKey)
-async def get_api_key(user=Depends(get_current_user), db: Session = Depends(get_session)):
-    api_key = Users.get_user_api_key_by_id(user.id, db=db)
+async def get_api_key(user=Depends(get_current_user), db: AsyncSession = Depends(get_async_session)):
+    api_key = await Users.get_user_api_key_by_id(user.id, db=db)
     if api_key:
         return {
             'api_key': api_key,
@@ -1290,7 +1331,7 @@ async def token_exchange(
     response: Response,
     provider: str,
     form_data: TokenExchangeForm,
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """
     Exchange an external OAuth provider token for an OpenWebUI JWT.
@@ -1308,7 +1349,7 @@ async def token_exchange(
     if provider not in OAUTH_PROVIDERS:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"Provider '{provider}' is not configured",
+            detail=ERROR_MESSAGES.OAUTH_NOT_CONFIGURED(provider),
         )
     # Get the OAuth client for this provider
     oauth_manager = request.app.state.oauth_manager
@@ -1316,7 +1357,7 @@ async def token_exchange(
     if not client:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"OAuth client for '{provider}' not found",
+            detail=ERROR_MESSAGES.OAUTH_NOT_CONFIGURED(provider),
         )
 
     # Validate the token by calling the userinfo endpoint
@@ -1358,15 +1399,26 @@ async def token_exchange(
         )
     email = email.lower()
 
+    # Enforce domain allowlist — same check as the normal OAuth callback
+    if (
+        '*' not in auth_manager_config.OAUTH_ALLOWED_DOMAINS
+        and email.split('@')[-1] not in auth_manager_config.OAUTH_ALLOWED_DOMAINS
+    ):
+        log.warning(f'Token exchange denied: email domain not in allowed domains list')
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
     # Try to find the user by OAuth sub
-    user = Users.get_user_by_oauth_sub(provider, sub, db=db)
+    user = await Users.get_user_by_oauth_sub(provider, sub, db=db)
 
     if not user and OAUTH_MERGE_ACCOUNTS_BY_EMAIL.value:
         # Try to find by email if merge is enabled
-        user = Users.get_user_by_email(email, db=db)
+        user = await Users.get_user_by_email(email, db=db)
         if user:
             # Link the OAuth sub to this user
-            Users.update_user_oauth_by_id(user.id, provider, sub, db=db)
+            await Users.update_user_oauth_by_id(user.id, provider, sub, db=db)
 
     if not user:
         raise HTTPException(
@@ -1374,4 +1426,4 @@ async def token_exchange(
             detail='User not found. Please sign in via the web interface first.',
         )
 
-    return create_session_response(request, user, db)
+    return await create_session_response(request, user, db)

backend/open_webui/routers/automations.py

@@ -0,0 +1,304 @@
+import asyncio
+import logging
+
+from typing import Optional
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from open_webui.models.automations import (
+    Automations,
+    AutomationRuns,
+    AutomationForm,
+    AutomationModel,
+    AutomationResponse,
+    AutomationRunModel,
+    AutomationListResponse,
+)
+from open_webui.utils.automations import (
+    validate_rrule,
+    next_run_ns,
+    next_n_runs_ns,
+    execute_automation,
+    rrule_interval_seconds,
+)
+from open_webui.utils.auth import get_verified_user, get_admin_user
+from open_webui.utils.access_control import has_permission
+from open_webui.internal.db import get_async_session
+from open_webui.constants import ERROR_MESSAGES
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+PAGE_ITEM_COUNT = 30
+
+
+############################
+# Helpers
+############################
+
+
+async def check_automations_permission(request, user):
+    if not request.app.state.config.ENABLE_AUTOMATIONS:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'features.automations', request.app.state.config.USER_PERMISSIONS
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+
+
+def check_automation_access(automation, user):
+    if not automation:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=ERROR_MESSAGES.NOT_FOUND,
+        )
+    if user.role != 'admin' and user.id != automation.user_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+
+
+async def check_automation_limits(request, user, rrule_str: str, db, is_create: bool = False):
+    """Enforce global automation limits. Admins bypass all checks."""
+    if user.role == 'admin':
+        return
+
+    # Max count (create only)
+    if is_create:
+        max_count = request.app.state.config.AUTOMATION_MAX_COUNT
+        if max_count:
+            max_count = int(max_count)
+            if max_count > 0 and await Automations.count_by_user(user.id, db=db) >= max_count:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=ERROR_MESSAGES.AUTOMATION_LIMIT_EXCEEDED(max_count),
+                )
+
+    # Min interval (create + update)
+    min_interval = request.app.state.config.AUTOMATION_MIN_INTERVAL
+    if min_interval:
+        min_interval = int(min_interval)
+        if min_interval > 0:
+            interval = rrule_interval_seconds(rrule_str)
+            if interval is not None and interval < min_interval:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=ERROR_MESSAGES.AUTOMATION_TOO_FREQUENT(min_interval),
+                )
+
+
+async def enrich_automation(automation: AutomationModel, db: AsyncSession, tz: str = None) -> AutomationResponse:
+    """Full enrichment for single-item views (includes next_runs computation)."""
+    last_run = await AutomationRuns.get_latest(automation.id, db=db)
+    return AutomationResponse(
+        **automation.model_dump(),
+        last_run=last_run,
+        next_runs=next_n_runs_ns(automation.data['rrule'], tz=tz),
+    )
+
+
+############################
+# GetAutomationItems (paginated)
+############################
+
+
+@router.get('/list')
+async def get_automation_items(
+    request: Request,
+    query: Optional[str] = None,
+    status: Optional[str] = None,
+    page: Optional[int] = 1,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    limit = PAGE_ITEM_COUNT
+    page = max(1, page)
+    skip = (page - 1) * limit
+
+    result = await Automations.search_automations(
+        user_id=user.id,
+        query=query,
+        status=status,
+        skip=skip,
+        limit=limit,
+        db=db,
+    )
+
+    # Batch-fetch latest runs in a single query instead of N+1
+    ids = [item.id for item in result.items]
+    latest_runs = await AutomationRuns.get_latest_batch(ids, db=db) if ids else {}
+
+    return {
+        'items': [
+            AutomationResponse(
+                **item.model_dump(),
+                last_run=latest_runs.get(item.id),
+            )
+            for item in result.items
+        ],
+        'total': result.total,
+    }
+
+
+############################
+# CreateNewAutomation
+############################
+
+
+@router.post('/create', response_model=AutomationResponse)
+async def create_new_automation(
+    request: Request,
+    form_data: AutomationForm,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    try:
+        validate_rrule(form_data.data.rrule, tz=user.timezone)
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e),
+        )
+
+    await check_automation_limits(request, user, form_data.data.rrule, db, is_create=True)
+
+    tz = user.timezone
+    automation = await Automations.insert(user.id, form_data, next_run_ns(form_data.data.rrule, tz=tz), db=db)
+    return await enrich_automation(automation, db, tz=tz)
+
+
+############################
+# GetAutomationById
+############################
+
+
+@router.get('/{id}', response_model=AutomationResponse)
+async def get_automation_by_id(
+    request: Request,
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+    return await enrich_automation(automation, db, tz=user.timezone)
+
+
+############################
+# UpdateAutomationById
+############################
+
+
+@router.post('/{id}/update', response_model=AutomationResponse)
+async def update_automation_by_id(
+    request: Request,
+    id: str,
+    form_data: AutomationForm,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+
+    try:
+        validate_rrule(form_data.data.rrule, tz=user.timezone)
+    except ValueError as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e),
+        )
+
+    await check_automation_limits(request, user, form_data.data.rrule, db, is_create=False)
+
+    tz = user.timezone
+    updated = await Automations.update_by_id(id, form_data, next_run_ns(form_data.data.rrule, tz=tz), db=db)
+    return await enrich_automation(updated, db, tz=tz)
+
+
+############################
+# ToggleAutomationById
+############################
+
+
+@router.post('/{id}/toggle', response_model=AutomationResponse)
+async def toggle_automation_by_id(
+    request: Request,
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+    toggled = await Automations.toggle(id, next_run_ns(automation.data['rrule'], tz=user.timezone), db=db)
+    return await enrich_automation(toggled, db, tz=user.timezone)
+
+
+############################
+# RunAutomationById
+############################
+
+
+@router.post('/{id}/run')
+async def run_automation_by_id(
+    request: Request,
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+    asyncio.create_task(execute_automation(request.app, automation))
+    return await enrich_automation(automation, db, tz=user.timezone)
+
+
+############################
+# DeleteAutomationById
+############################
+
+
+@router.delete('/{id}/delete')
+async def delete_automation_by_id(
+    request: Request,
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+    await AutomationRuns.delete_by_automation(id, db=db)
+    return await Automations.delete(id, db=db)
+
+
+############################
+# GetAutomationRuns
+############################
+
+
+@router.get('/{id}/runs', response_model=list[AutomationRunModel])
+async def get_automation_runs(
+    request: Request,
+    id: str,
+    skip: int = 0,
+    limit: int = 50,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    await check_automations_permission(request, user)
+    automation = await Automations.get_by_id(id, db=db)
+    check_automation_access(automation, user)
+    return await AutomationRuns.get_by_automation(id, skip=skip, limit=limit, db=db)

backend/open_webui/routers/calendar.py

@@ -0,0 +1,389 @@
+import logging
+import time
+from typing import Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+
+from open_webui.models.calendar import (
+    Calendars,
+    CalendarEvents,
+    CalendarEventAttendees,
+    CalendarForm,
+    CalendarUpdateForm,
+    CalendarEventForm,
+    CalendarEventUpdateForm,
+    CalendarModel,
+    CalendarEventModel,
+    CalendarEventUserResponse,
+    CalendarEventListResponse,
+    RSVPForm,
+)
+from open_webui.models.access_grants import AccessGrants
+from open_webui.models.groups import Groups
+from open_webui.models.users import UserModel
+from open_webui.utils.auth import get_verified_user
+from open_webui.utils.access_control import has_permission
+from open_webui.utils.calendar import expand_recurring_event
+from open_webui.constants import ERROR_MESSAGES
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+SCHEDULED_TASKS_CALENDAR_ID = '__scheduled_tasks__'
+
+
+async def check_calendar_permission(request: Request, user):
+    """Check global feature flag AND per-user permission for calendar access."""
+    if not request.app.state.config.ENABLE_CALENDAR:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'features.calendar', request.app.state.config.USER_PERMISSIONS
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+
+
+async def _user_has_automations(request: Request, user) -> bool:
+    """Check if automations feature is available to this user."""
+    if not getattr(request.app.state.config, 'ENABLE_AUTOMATIONS', False):
+        return False
+    if user.role == 'admin':
+        return True
+    return await has_permission(user.id, 'features.automations', request.app.state.config.USER_PERMISSIONS)
+
+
+async def _check_calendar_access(calendar_id: str, user: UserModel, permission: str = 'write') -> CalendarModel:
+    """Verify user has access to a calendar. Returns the calendar or raises 403/404."""
+    cal = await Calendars.get_calendar_by_id(calendar_id)
+    if not cal:
+        raise HTTPException(status_code=404, detail='Calendar not found')
+    if cal.user_id == user.id or user.role == 'admin':
+        return cal
+    user_groups = await Groups.get_groups_by_member_id(user.id)
+    user_group_ids = [g.id for g in user_groups]
+    if await AccessGrants.has_access(
+        user_id=user.id,
+        resource_type='calendar',
+        resource_id=cal.id,
+        permission=permission,
+        user_group_ids=user_group_ids,
+    ):
+        return cal
+    raise HTTPException(status_code=403, detail='Access denied')
+
+
+####################
+# Calendar CRUD (static paths first)
+####################
+
+
+@router.get('/', response_model=list[CalendarModel])
+async def get_calendars(request: Request, user: UserModel = Depends(get_verified_user)):
+    """List user's calendars (owned + shared), plus a virtual Scheduled Tasks calendar
+    when automations are available."""
+    await check_calendar_permission(request, user)
+    calendars = await Calendars.get_calendars_by_user(user.id)
+
+    if await _user_has_automations(request, user):
+        now = int(time.time_ns())
+        calendars.append(
+            CalendarModel(
+                id=SCHEDULED_TASKS_CALENDAR_ID,
+                user_id=user.id,
+                name='Scheduled Tasks',
+                color='#8b5cf6',
+                is_default=False,
+                is_system=True,
+                created_at=now,
+                updated_at=now,
+            )
+        )
+
+    return calendars
+
+
+@router.post('/create', response_model=CalendarModel)
+async def create_calendar(request: Request, form_data: CalendarForm, user: UserModel = Depends(get_verified_user)):
+    """Create a new user calendar."""
+    await check_calendar_permission(request, user)
+    return await Calendars.insert_new_calendar(user.id, form_data)
+
+
+####################
+# Event CRUD (before /{calendar_id} to avoid route conflicts)
+####################
+
+
+@router.get('/events')
+async def get_events(
+    request: Request,
+    start: str,
+    end: str,
+    calendar_ids: Optional[str] = None,
+    user: UserModel = Depends(get_verified_user),
+):
+    """Get events in date range.
+
+    Args:
+        start: ISO 8601 datetime string (e.g. 2026-04-01T00:00:00)
+        end:   ISO 8601 datetime string (e.g. 2026-05-01T00:00:00)
+        calendar_ids: optional comma-separated list to filter
+
+    Includes:
+    - Stored events from the database
+    - Virtual events computed from active automation RRULEs (Scheduled Tasks calendar)
+    """
+    await check_calendar_permission(request, user)
+    from datetime import datetime
+
+    try:
+        start_dt = datetime.fromisoformat(start.replace('Z', '+00:00'))
+        end_dt = datetime.fromisoformat(end.replace('Z', '+00:00'))
+    except ValueError:
+        raise HTTPException(status_code=400, detail='Invalid date format. Use ISO 8601 (e.g. 2026-04-01T00:00:00)')
+
+    NS = 1_000_000
+    start_ns = int(start_dt.timestamp() * 1000) * NS
+    end_ns = int(end_dt.timestamp() * 1000) * NS
+    cal_id_list = calendar_ids.split(',') if calendar_ids else None
+
+    # 1. Stored events
+    events = await CalendarEvents.get_events_by_range(
+        user_id=user.id,
+        start=start_ns,
+        end=end_ns,
+        calendar_ids=cal_id_list,
+    )
+
+    # Expand recurring stored events
+    expanded = []
+    for event in events:
+        event_dict = event.model_dump()
+        if event_dict.get('rrule'):
+            instances = expand_recurring_event(event_dict, start_ns, end_ns, tz=user.timezone)
+            for inst in instances:
+                expanded.append(CalendarEventUserResponse(**{**inst, 'user': event.user}))
+        else:
+            expanded.append(event)
+
+    # 2. Virtual automation events (Scheduled Tasks calendar)
+    if await _user_has_automations(request, user) and (
+        cal_id_list is None or SCHEDULED_TASKS_CALENDAR_ID in cal_id_list
+    ):
+        try:
+            from open_webui.models.automations import Automations, AutomationRuns
+
+            # Future runs: expand RRULEs for active automations only
+            active_automations = await Automations.get_active_by_user(user.id)
+            for auto in active_automations:
+                rrule_str = auto.data.get('rrule', '') if auto.data else ''
+                if not rrule_str:
+                    continue
+
+                virtual = {
+                    'id': f'auto_{auto.id}',
+                    'calendar_id': SCHEDULED_TASKS_CALENDAR_ID,
+                    'user_id': user.id,
+                    'title': auto.name,
+                    'description': auto.data.get('prompt', '') if auto.data else '',
+                    'start_at': auto.next_run_at or 0,
+                    'end_at': None,
+                    'all_day': False,
+                    'rrule': rrule_str,
+                    'color': None,
+                    'location': None,
+                    'data': None,
+                    'meta': {'automation_id': auto.id},
+                    'is_cancelled': False,
+                    'attendees': [],
+                    'created_at': auto.created_at,
+                    'updated_at': auto.updated_at,
+                    'user': None,
+                }
+
+                # Only expand into the future — past runs are handled below
+                now_ns = int(time.time_ns())
+                rrule_start = max(start_ns, now_ns)
+                instances = expand_recurring_event(virtual, rrule_start, end_ns, tz=user.timezone)
+                for inst in instances:
+                    expanded.append(CalendarEventUserResponse(**inst))
+
+            # Past runs: single range query joined with automation
+            runs_with_auto = await AutomationRuns.get_runs_by_user_range(user.id, start_ns, end_ns)
+            for run, auto in runs_with_auto:
+                expanded.append(
+                    CalendarEventUserResponse(
+                        id=f'run_{run.id}',
+                        calendar_id=SCHEDULED_TASKS_CALENDAR_ID,
+                        user_id=user.id,
+                        title=auto.name,
+                        description=run.error if run.status == 'error' else '',
+                        start_at=run.created_at,
+                        end_at=None,
+                        all_day=False,
+                        color=None,
+                        location=None,
+                        data=None,
+                        meta={
+                            'automation_id': auto.id,
+                            'run_id': run.id,
+                            'chat_id': run.chat_id,
+                            'status': run.status,
+                        },
+                        is_cancelled=False,
+                        attendees=[],
+                        created_at=run.created_at,
+                        updated_at=run.created_at,
+                        user=None,
+                    )
+                )
+        except Exception as e:
+            log.warning(f'Failed to compute automation events: {e}', exc_info=True)
+
+    return [e.model_dump() if hasattr(e, 'model_dump') else e for e in expanded]
+
+
+@router.post('/events/create', response_model=CalendarEventModel)
+async def create_event(request: Request, form_data: CalendarEventForm, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+    await _check_calendar_access(form_data.calendar_id, user, 'write')
+    return await CalendarEvents.insert_new_event(user.id, form_data)
+
+
+@router.get('/events/search', response_model=CalendarEventListResponse)
+async def search_events(
+    request: Request,
+    query: Optional[str] = None,
+    skip: int = 0,
+    limit: int = 30,
+    user: UserModel = Depends(get_verified_user),
+):
+    await check_calendar_permission(request, user)
+    return await CalendarEvents.search_events(user_id=user.id, query=query, skip=skip, limit=limit)
+
+
+@router.get('/events/{event_id}', response_model=CalendarEventModel)
+async def get_event(request: Request, event_id: str, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+    event = await CalendarEvents.get_event_by_id(event_id)
+    if not event:
+        raise HTTPException(status_code=404, detail='Event not found')
+
+    await _check_calendar_access(event.calendar_id, user, 'read')
+
+    return event
+
+
+@router.post('/events/{event_id}/update', response_model=CalendarEventModel)
+async def update_event(
+    request: Request, event_id: str, form_data: CalendarEventUpdateForm, user: UserModel = Depends(get_verified_user)
+):
+    await check_calendar_permission(request, user)
+    event = await CalendarEvents.get_event_by_id(event_id)
+    if not event:
+        raise HTTPException(status_code=404, detail='Event not found')
+
+    await _check_calendar_access(event.calendar_id, user, 'write')
+
+    updated = await CalendarEvents.update_event_by_id(event_id, form_data)
+    if not updated:
+        raise HTTPException(status_code=500, detail='Failed to update')
+    return updated
+
+
+@router.delete('/events/{event_id}/delete')
+async def delete_event(request: Request, event_id: str, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+    event = await CalendarEvents.get_event_by_id(event_id)
+    if not event:
+        raise HTTPException(status_code=404, detail='Event not found')
+
+    await _check_calendar_access(event.calendar_id, user, 'write')
+
+    result = await CalendarEvents.delete_event_by_id(event_id)
+    if not result:
+        raise HTTPException(status_code=500, detail='Failed to delete')
+    return {'status': True}
+
+
+@router.post('/events/{event_id}/rsvp', response_model=dict)
+async def rsvp_event(
+    request: Request, event_id: str, form_data: RSVPForm, user: UserModel = Depends(get_verified_user)
+):
+    """Update own RSVP status for an event."""
+    await check_calendar_permission(request, user)
+    if form_data.status not in ('accepted', 'declined', 'tentative', 'pending'):
+        raise HTTPException(status_code=400, detail='Invalid status')
+
+    result = await CalendarEventAttendees.update_rsvp(event_id, user.id, form_data.status)
+    if not result:
+        raise HTTPException(status_code=404, detail='Not an attendee of this event')
+    return {'status': True, 'rsvp': result.status}
+
+
+####################
+# Calendar by ID (dynamic path — MUST come after /events* routes)
+####################
+
+
+@router.get('/{calendar_id}', response_model=CalendarModel)
+async def get_calendar_by_id(request: Request, calendar_id: str, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+    cal = await _check_calendar_access(calendar_id, user, 'read')
+    return cal
+
+
+@router.post('/{calendar_id}/update', response_model=CalendarModel)
+async def update_calendar(
+    request: Request, calendar_id: str, form_data: CalendarUpdateForm, user: UserModel = Depends(get_verified_user)
+):
+    await check_calendar_permission(request, user)
+    cal = await _check_calendar_access(calendar_id, user, 'write')
+
+    # Only owner/admin can change access grants
+    if form_data.access_grants is not None and cal.user_id != user.id and user.role != 'admin':
+        raise HTTPException(status_code=403, detail='Only owner can manage sharing')
+
+    updated = await Calendars.update_calendar_by_id(calendar_id, form_data)
+    if not updated:
+        raise HTTPException(status_code=500, detail='Failed to update')
+    return updated
+
+
+@router.delete('/{calendar_id}/delete')
+async def delete_calendar(request: Request, calendar_id: str, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+
+    # Block deletion of the virtual Scheduled Tasks calendar
+    if calendar_id == SCHEDULED_TASKS_CALENDAR_ID:
+        raise HTTPException(status_code=400, detail='System calendars cannot be deleted')
+
+    cal = await _check_calendar_access(calendar_id, user, 'write')
+
+    # Only owner/admin can delete
+    if cal.user_id != user.id and user.role != 'admin':
+        raise HTTPException(status_code=403, detail='Only owner can delete calendar')
+
+    # Block deletion of default calendar
+    if cal.is_default:
+        raise HTTPException(status_code=400, detail='Default calendar cannot be deleted')
+
+    result = await Calendars.delete_calendar_by_id(calendar_id)
+    if not result:
+        raise HTTPException(status_code=500, detail='Failed to delete')
+    return {'status': True}
+
+
+@router.post('/{calendar_id}/default')
+async def set_default_calendar(request: Request, calendar_id: str, user: UserModel = Depends(get_verified_user)):
+    await check_calendar_permission(request, user)
+    cal = await Calendars.set_default_calendar(user.id, calendar_id)
+    if not cal:
+        raise HTTPException(status_code=404, detail='Calendar not found')
+    return cal

backend/open_webui/routers/configs.py

@@ -6,9 +6,9 @@ import aiohttp
 
 from typing import Optional
 
-from open_webui.env import AIOHTTP_CLIENT_TIMEOUT
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT
 from open_webui.utils.auth import get_admin_user, get_verified_user
-from open_webui.config import get_config, save_config
+from open_webui.config import get_config, save_config, async_save_config
 from open_webui.config import BannerModel
 
 from open_webui.utils.tools import (
@@ -27,6 +27,7 @@ from open_webui.utils.oauth import (
     get_oauth_client_info_with_static_credentials,
     encrypt_data,
     decrypt_data,
+    resolve_oauth_client_info,
     OAuthClientInformationFull,
 )
 from mcp.shared.auth import OAuthMetadata
@@ -49,7 +50,7 @@ class ImportConfigForm(BaseModel):
 
 @router.post('/import', response_model=dict)
 async def import_config(form_data: ImportConfigForm, user=Depends(get_admin_user)):
-    save_config(form_data.config)
+    await async_save_config(form_data.config)
     return get_config()
 
 
@@ -203,9 +204,7 @@ async def set_tool_servers_config(
 
             if auth_type in ('oauth_2.1', 'oauth_2.1_static') and server_id:
                 try:
-                    oauth_client_info = connection.get('info', {}).get('oauth_client_info', '')
-                    oauth_client_info = decrypt_data(oauth_client_info)
-
+                    oauth_client_info = resolve_oauth_client_info(connection)
                     request.app.state.oauth_client_manager.add_client(
                         f'{server_type}:{server_id}',
                         OAuthClientInformationFull(**oauth_client_info),
@@ -294,7 +293,9 @@ async def verify_terminal_server_connection(
         ) as session:
             # Orchestrators expose a policies API; plain terminals don't.
             try:
-                async with session.get(f'{base_url}/api/v1/policies', headers=headers) as resp:
+                async with session.get(
+                    f'{base_url}/api/v1/policies', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL
+                ) as resp:
                     if resp.ok:
                         return {'status': True, 'type': 'orchestrator'}
             except Exception:
@@ -302,7 +303,9 @@ async def verify_terminal_server_connection(
 
             # Fall back to open-terminal config endpoint.
             try:
-                async with session.get(f'{base_url}/api/config', headers=headers) as resp:
+                async with session.get(
+                    f'{base_url}/api/config', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL
+                ) as resp:
                     if resp.ok:
                         return {'status': True, 'type': 'terminal'}
             except Exception:
@@ -343,7 +346,9 @@ async def put_terminal_server_policy(
             timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
         ) as session:
             policy_url = f'{base_url}/api/v1/policies/{form_data.policy_id}'
-            async with session.put(policy_url, headers=headers, json=form_data.policy_data) as resp:
+            async with session.put(
+                policy_url, headers=headers, json=form_data.policy_data, ssl=AIOHTTP_CLIENT_SESSION_SSL
+            ) as resp:
                 if resp.ok:
                     return await resp.json()
                 detail = await resp.text()
@@ -370,7 +375,9 @@ async def verify_tool_servers_config(request: Request, form_data: ToolServerConn
                         trust_env=True,
                         timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
                     ) as session:
-                        async with session.get(discovery_url) as oauth_server_metadata_response:
+                        async with session.get(
+                            discovery_url, ssl=AIOHTTP_CLIENT_SESSION_SSL
+                        ) as oauth_server_metadata_response:
                             if oauth_server_metadata_response.status == 200:
                                 try:
                                     oauth_server_metadata = OAuthMetadata.model_validate(

backend/open_webui/routers/evaluations.py

@@ -20,8 +20,8 @@ from open_webui.models.feedbacks import (
 
 from open_webui.constants import ERROR_MESSAGES
 from open_webui.utils.auth import get_admin_user, get_verified_user
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
@@ -208,10 +208,10 @@ class LeaderboardResponse(BaseModel):
 async def get_leaderboard(
     query: Optional[str] = None,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get model leaderboard with Elo ratings. Query filters by tag similarity."""
-    feedbacks = Feedbacks.get_feedbacks_for_leaderboard(db=db)
+    feedbacks = await Feedbacks.get_feedbacks_for_leaderboard(db=db)
 
     similarities = None
     if query and query.strip():
@@ -244,10 +244,10 @@ async def get_model_history(
     model_id: str,
     days: int = 30,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get daily win/loss history for a specific model."""
-    history = Feedbacks.get_model_evaluation_history(model_id=model_id, days=days, db=db)
+    history = await Feedbacks.get_model_evaluation_history(model_id=model_id, days=days, db=db)
     return ModelHistoryResponse(model_id=model_id, history=history)
 
 
@@ -291,38 +291,49 @@ async def update_config(
     }
 
 
+@router.get('/feedbacks/models', response_model=list[str])
+async def get_feedback_model_ids(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    return await Feedbacks.get_distinct_model_ids(db=db)
+
+
 @router.get('/feedbacks/all', response_model=list[FeedbackResponse])
-async def get_all_feedbacks(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    feedbacks = Feedbacks.get_all_feedbacks(db=db)
+async def get_all_feedbacks(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    feedbacks = await Feedbacks.get_all_feedbacks(db=db)
     return feedbacks
 
 
 @router.get('/feedbacks/all/ids', response_model=list[FeedbackIdResponse])
-async def get_all_feedback_ids(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    return Feedbacks.get_all_feedback_ids(db=db)
+async def get_all_feedback_ids(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    return await Feedbacks.get_all_feedback_ids(db=db)
 
 
 @router.delete('/feedbacks/all')
-async def delete_all_feedbacks(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    success = Feedbacks.delete_all_feedbacks(db=db)
+async def delete_all_feedbacks(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    success = await Feedbacks.delete_all_feedbacks(db=db)
     return success
 
 
 @router.get('/feedbacks/all/export', response_model=list[FeedbackModel])
-async def export_all_feedbacks(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    feedbacks = Feedbacks.get_all_feedbacks(db=db)
+async def export_all_feedbacks(
+    model_id: Optional[str] = None,
+    user=Depends(get_admin_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    feedbacks = await Feedbacks.get_all_feedbacks(db=db)
+    if model_id:
+        feedbacks = [f for f in feedbacks if f.data and f.data.get('model_id') == model_id]
     return feedbacks
 
 
 @router.get('/feedbacks/user', response_model=list[FeedbackUserResponse])
-async def get_feedbacks(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    feedbacks = Feedbacks.get_feedbacks_by_user_id(user.id, db=db)
+async def get_feedbacks(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    feedbacks = await Feedbacks.get_feedbacks_by_user_id(user.id, db=db)
     return feedbacks
 
 
 @router.delete('/feedbacks', response_model=bool)
-async def delete_feedbacks(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    success = Feedbacks.delete_feedbacks_by_user_id(user.id, db=db)
+async def delete_feedbacks(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    success = await Feedbacks.delete_feedbacks_by_user_id(user.id, db=db)
     return success
 
 
@@ -334,8 +345,9 @@ async def get_feedbacks(
     order_by: Optional[str] = None,
     direction: Optional[str] = None,
     page: Optional[int] = 1,
+    model_id: Optional[str] = None,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -347,8 +359,10 @@ async def get_feedbacks(
         filter['order_by'] = order_by
     if direction:
         filter['direction'] = direction
+    if model_id:
+        filter['model_id'] = model_id
 
-    result = Feedbacks.get_feedback_items(filter=filter, skip=skip, limit=limit, db=db)
+    result = await Feedbacks.get_feedback_items(filter=filter, skip=skip, limit=limit, db=db)
     return result
 
 
@@ -357,9 +371,9 @@ async def create_feedback(
     request: Request,
     form_data: FeedbackForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    feedback = Feedbacks.insert_new_feedback(user_id=user.id, form_data=form_data, db=db)
+    feedback = await Feedbacks.insert_new_feedback(user_id=user.id, form_data=form_data, db=db)
     if not feedback:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -370,11 +384,11 @@ async def create_feedback(
 
 
 @router.get('/feedback/{id}', response_model=FeedbackModel)
-async def get_feedback_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def get_feedback_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
     if user.role == 'admin':
-        feedback = Feedbacks.get_feedback_by_id(id=id, db=db)
+        feedback = await Feedbacks.get_feedback_by_id(id=id, db=db)
     else:
-        feedback = Feedbacks.get_feedback_by_id_and_user_id(id=id, user_id=user.id, db=db)
+        feedback = await Feedbacks.get_feedback_by_id_and_user_id(id=id, user_id=user.id, db=db)
 
     if not feedback:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
@@ -387,12 +401,12 @@ async def update_feedback_by_id(
     id: str,
     form_data: FeedbackForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if user.role == 'admin':
-        feedback = Feedbacks.update_feedback_by_id(id=id, form_data=form_data, db=db)
+        feedback = await Feedbacks.update_feedback_by_id(id=id, form_data=form_data, db=db)
     else:
-        feedback = Feedbacks.update_feedback_by_id_and_user_id(id=id, user_id=user.id, form_data=form_data, db=db)
+        feedback = await Feedbacks.update_feedback_by_id_and_user_id(id=id, user_id=user.id, form_data=form_data, db=db)
 
     if not feedback:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
@@ -401,11 +415,13 @@ async def update_feedback_by_id(
 
 
 @router.delete('/feedback/{id}')
-async def delete_feedback_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def delete_feedback_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
     if user.role == 'admin':
-        success = Feedbacks.delete_feedback_by_id(id=id, db=db)
+        success = await Feedbacks.delete_feedback_by_id(id=id, db=db)
     else:
-        success = Feedbacks.delete_feedback_by_id_and_user_id(id=id, user_id=user.id, db=db)
+        success = await Feedbacks.delete_feedback_by_id_and_user_id(id=id, user_id=user.id, db=db)
 
     if not success:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)

backend/open_webui/routers/files.py

@@ -21,11 +21,11 @@ from fastapi import (
 )
 
 from fastapi.responses import FileResponse, StreamingResponse
-from sqlalchemy.orm import Session
-from open_webui.internal.db import get_session, SessionLocal
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import get_async_session, get_async_db_context
 
 from open_webui.constants import ERROR_MESSAGES
-from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
+from open_webui.retrieval.vector.async_client import ASYNC_VECTOR_DB_CLIENT
 
 from open_webui.models.channels import Channels
 from open_webui.models.users import Users
@@ -48,7 +48,7 @@ from open_webui.routers.audio import transcribe
 from open_webui.storage.provider import Storage
 
 
-from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
+from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL, STORAGE_LOCAL_CACHE, STORAGE_PROVIDER, UPLOAD_DIR
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.misc import strict_match_mime_type
 from pydantic import BaseModel
@@ -88,16 +88,30 @@ def _is_text_file(file_path: str, chunk_size: int = 8192) -> bool:
         return False
 
 
-def process_uploaded_file(
+def _cleanup_local_cache(file_path: str) -> None:
+    """Remove the local cached copy of a cloud-stored file after processing."""
+    if STORAGE_LOCAL_CACHE or STORAGE_PROVIDER == 'local':
+        return
+    try:
+        local_filename = os.path.basename(file_path)
+        local_path = os.path.join(UPLOAD_DIR, local_filename)
+        if os.path.isfile(local_path):
+            os.remove(local_path)
+            log.debug(f'Cleaned up local cache: {local_path}')
+    except OSError as e:
+        log.warning(f'Failed to clean up local cache for {file_path}: {e}')
+
+
+async def process_uploaded_file(
     request,
     file,
     file_path,
     file_item,
     file_metadata,
     user,
-    db: Optional[Session] = None,
+    db: Optional[AsyncSession] = None,
 ):
-    def _process_handler(db_session):
+    async def _process_handler(db_session):
         try:
             content_type = file.content_type
 
@@ -110,10 +124,10 @@ def process_uploaded_file(
                 stt_supported_content_types = getattr(request.app.state.config, 'STT_SUPPORTED_CONTENT_TYPES', [])
 
                 if strict_match_mime_type(stt_supported_content_types, content_type):
-                    file_path_processed = Storage.get_file(file_path)
+                    file_path_processed = await asyncio.to_thread(Storage.get_file, file_path)
                     result = transcribe(request, file_path_processed, file_metadata, user)
 
-                    process_file(
+                    await process_file(
                         request,
                         ProcessFileForm(file_id=file_item.id, content=result.get('text', '')),
                         user=user,
@@ -122,7 +136,7 @@ def process_uploaded_file(
                 elif (not content_type.startswith(('image/', 'video/'))) or (
                     request.app.state.config.CONTENT_EXTRACTION_ENGINE == 'external'
                 ):
-                    process_file(
+                    await process_file(
                         request,
                         ProcessFileForm(file_id=file_item.id),
                         user=user,
@@ -132,7 +146,7 @@ def process_uploaded_file(
                     raise Exception(f'File type {content_type} is not supported for processing')
             else:
                 log.info(f'File type {file.content_type} is not provided, but trying to process anyway')
-                process_file(
+                await process_file(
                     request,
                     ProcessFileForm(file_id=file_item.id),
                     user=user,
@@ -141,7 +155,7 @@ def process_uploaded_file(
 
         except Exception as e:
             log.error(f'Error processing file: {file_item.id}')
-            Files.update_file_data_by_id(
+            await Files.update_file_data_by_id(
                 file_item.id,
                 {
                     'status': 'failed',
@@ -150,15 +164,18 @@ def process_uploaded_file(
                 db=db_session,
             )
 
-    if db:
-        _process_handler(db)
-    else:
-        with SessionLocal() as db_session:
-            _process_handler(db_session)
+    try:
+        if db:
+            await _process_handler(db)
+        else:
+            async with get_async_db_context() as db_session:
+                await _process_handler(db_session)
+    finally:
+        _cleanup_local_cache(file_path)
 
 
 @router.post('/', response_model=FileModelResponse)
-def upload_file(
+async def upload_file(
     request: Request,
     background_tasks: BackgroundTasks,
     file: UploadFile = File(...),
@@ -166,9 +183,9 @@ def upload_file(
     process: bool = Query(True),
     process_in_background: bool = Query(True),
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    return upload_file_handler(
+    return await upload_file_handler(
         request,
         file=file,
         metadata=metadata,
@@ -180,7 +197,7 @@ def upload_file(
     )
 
 
-def upload_file_handler(
+async def upload_file_handler(
     request: Request,
     file: UploadFile = File(...),
     metadata: Optional[dict | str] = Form(None),
@@ -188,7 +205,7 @@ def upload_file_handler(
     process_in_background: bool = Query(True),
     user=Depends(get_verified_user),
     background_tasks: Optional[BackgroundTasks] = None,
-    db: Optional[Session] = None,
+    db: Optional[AsyncSession] = None,
 ):
     log.info(f'file.content_type: {file.content_type} {process}')
 
@@ -207,8 +224,8 @@ def upload_file_handler(
         filename = os.path.basename(unsanitized_filename)
 
         file_extension = os.path.splitext(filename)[1]
-        # Remove the leading dot from the file extension
-        file_extension = file_extension[1:] if file_extension else ''
+        # Remove the leading dot from the file extension and lowercase it
+        file_extension = file_extension[1:].lower() if file_extension else ''
 
         if process and request.app.state.config.ALLOWED_FILE_EXTENSIONS:
             request.app.state.config.ALLOWED_FILE_EXTENSIONS = [
@@ -225,7 +242,8 @@ def upload_file_handler(
         id = str(uuid.uuid4())
         name = filename
         filename = f'{id}_{filename}'
-        contents, file_path = Storage.upload_file(
+        contents, file_path = await asyncio.to_thread(
+            Storage.upload_file,
             file.file,
             filename,
             {
@@ -236,7 +254,7 @@ def upload_file_handler(
             },
         )
 
-        file_item = Files.insert_new_file(
+        file_item = await Files.insert_new_file(
             user.id,
             FileForm(
                 **{
@@ -258,9 +276,9 @@ def upload_file_handler(
         )
 
         if 'channel_id' in file_metadata:
-            channel = Channels.get_channel_by_id_and_user_id(file_metadata['channel_id'], user.id, db=db)
+            channel = await Channels.get_channel_by_id_and_user_id(file_metadata['channel_id'], user.id, db=db)
             if channel:
-                Channels.add_file_to_channel_by_id(channel.id, file_item.id, user.id, db=db)
+                await Channels.add_file_to_channel_by_id(channel.id, file_item.id, user.id, db=db)
 
         if process:
             if background_tasks and process_in_background:
@@ -275,7 +293,7 @@ def upload_file_handler(
                 )
                 return {'status': True, **file_item.model_dump()}
             else:
-                process_uploaded_file(
+                await process_uploaded_file(
                     request,
                     file,
                     file_path,
@@ -317,12 +335,12 @@ async def list_files(
     user=Depends(get_verified_user),
     page: int = Query(1, ge=1, description='Page number (1-indexed)'),
     content: bool = Query(True),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     skip = (page - 1) * PAGE_SIZE
     user_id = None if (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL) else user.id
 
-    result = Files.get_file_list(user_id=user_id, skip=skip, limit=PAGE_SIZE, db=db)
+    result = await Files.get_file_list(user_id=user_id, skip=skip, limit=PAGE_SIZE, db=db)
 
     if not content:
         for file in result.items:
@@ -347,7 +365,7 @@ async def search_files(
     skip: int = Query(0, ge=0, description='Number of files to skip'),
     limit: int = Query(100, ge=1, le=1000, description='Maximum number of files to return'),
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """
     Search for files by filename with support for wildcard patterns.
@@ -357,7 +375,7 @@ async def search_files(
     user_id = None if (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL) else user.id
 
     # Use optimized database query with pagination
-    files = Files.search_files(
+    files = await Files.search_files(
         user_id=user_id,
         filename=filename,
         skip=skip,
@@ -385,12 +403,12 @@ async def search_files(
 
 
 @router.delete('/all')
-async def delete_all_files(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    result = Files.delete_all_files(db=db)
+async def delete_all_files(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    result = await Files.delete_all_files(db=db)
     if result:
         try:
-            Storage.delete_all_files()
-            VECTOR_DB_CLIENT.reset()
+            await asyncio.to_thread(Storage.delete_all_files)
+            await ASYNC_VECTOR_DB_CLIENT.reset()
         except Exception as e:
             log.exception(e)
             log.error('Error deleting files')
@@ -412,8 +430,8 @@ async def delete_all_files(user=Depends(get_admin_user), db: Session = Depends(g
 
 
 @router.get('/{id}', response_model=Optional[FileModel])
-async def get_file_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    file = Files.get_file_by_id(id, db=db)
+async def get_file_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -421,7 +439,7 @@ async def get_file_by_id(id: str, user=Depends(get_verified_user), db: Session =
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         return file
     else:
         raise HTTPException(
@@ -435,9 +453,9 @@ async def get_file_process_status(
     id: str,
     stream: bool = Query(False),
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    file = Files.get_file_by_id(id, db=db)
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -445,7 +463,7 @@ async def get_file_process_status(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         if stream:
             MAX_FILE_PROCESSING_DURATION = 3600 * 2
 
@@ -454,7 +472,7 @@ async def get_file_process_status(
                 # Each poll creates its own short-lived session to avoid holding a
                 # connection for hours. A WebSocket push would be more efficient.
                 for _ in range(MAX_FILE_PROCESSING_DURATION):
-                    file_item = Files.get_file_by_id(file_id)  # Creates own session
+                    file_item = await Files.get_file_by_id(file_id)  # Creates own session
                     if file_item:
                         data = file_item.model_dump().get('data', {})
                         status = data.get('status')
@@ -495,8 +513,10 @@ async def get_file_process_status(
 
 
 @router.get('/{id}/data/content')
-async def get_file_data_content_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    file = Files.get_file_by_id(id, db=db)
+async def get_file_data_content_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -504,7 +524,7 @@ async def get_file_data_content_by_id(id: str, user=Depends(get_verified_user),
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         return {'content': file.data.get('content', '')}
     else:
         raise HTTPException(
@@ -523,14 +543,14 @@ class ContentForm(BaseModel):
 
 
 @router.post('/{id}/data/content/update')
-def update_file_data_content_by_id(
+async def update_file_data_content_by_id(
     request: Request,
     id: str,
     form_data: ContentForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    file = Files.get_file_by_id(id, db=db)
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -538,15 +558,15 @@ def update_file_data_content_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'write', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'write', user, db=db):
         try:
-            process_file(
+            await process_file(
                 request,
                 ProcessFileForm(file_id=id, content=form_data.content),
                 user=user,
                 db=db,
             )
-            file = Files.get_file_by_id(id=id, db=db)
+            file = await Files.get_file_by_id(id=id, db=db)
         except Exception as e:
             log.exception(e)
             log.error(f'Error processing file: {file.id}')
@@ -554,13 +574,13 @@ def update_file_data_content_by_id(
         # Propagate content change to all knowledge collections referencing
         # this file.  Without this the old embeddings remain in the knowledge
         # collection and RAG returns both stale and current data (#20558).
-        knowledges = Knowledges.get_knowledges_by_file_id(id, db=db)
+        knowledges = await Knowledges.get_knowledges_by_file_id(id, db=db)
         for knowledge in knowledges:
             try:
                 # Remove old embeddings for this file from the KB collection
-                VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': id})
+                await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': id})
                 # Re-add from the now-updated file-{file_id} collection
-                process_file(
+                await process_file(
                     request,
                     ProcessFileForm(file_id=id, collection_name=knowledge.id),
                     user=user,
@@ -587,9 +607,9 @@ async def get_file_content_by_id(
     id: str,
     user=Depends(get_verified_user),
     attachment: bool = Query(False),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    file = Files.get_file_by_id(id, db=db)
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -597,9 +617,9 @@ async def get_file_content_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         try:
-            file_path = Storage.get_file(file.path)
+            file_path = await asyncio.to_thread(Storage.get_file, file.path)
             file_path = Path(file_path)
 
             # Check if the file already exists in the cache
@@ -646,8 +666,10 @@ async def get_file_content_by_id(
 
 
 @router.get('/{id}/content/html')
-async def get_html_file_content_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    file = Files.get_file_by_id(id, db=db)
+async def get_html_file_content_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -655,16 +677,16 @@ async def get_html_file_content_by_id(id: str, user=Depends(get_verified_user),
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    file_user = Users.get_user_by_id(file.user_id, db=db)
-    if not file_user.role == 'admin':
+    file_user = await Users.get_user_by_id(file.user_id, db=db)
+    if not file_user or file_user.role != 'admin':
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         try:
-            file_path = Storage.get_file(file.path)
+            file_path = await asyncio.to_thread(Storage.get_file, file.path)
             file_path = Path(file_path)
 
             # Check if the file already exists in the cache
@@ -693,8 +715,10 @@ async def get_html_file_content_by_id(id: str, user=Depends(get_verified_user),
 
 
 @router.get('/{id}/content/{file_name}')
-async def get_file_content_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    file = Files.get_file_by_id(id, db=db)
+async def get_file_content_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -702,7 +726,7 @@ async def get_file_content_by_id(id: str, user=Depends(get_verified_user), db: S
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'read', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'read', user, db=db):
         file_path = file.path
 
         # Handle Unicode filenames
@@ -711,7 +735,7 @@ async def get_file_content_by_id(id: str, user=Depends(get_verified_user), db: S
         headers = {'Content-Disposition': f"attachment; filename*=UTF-8''{encoded_filename}"}
 
         if file_path:
-            file_path = Storage.get_file(file_path)
+            file_path = await asyncio.to_thread(Storage.get_file, file_path)
             file_path = Path(file_path)
 
             # Check if the file already exists in the cache
@@ -749,8 +773,8 @@ async def get_file_content_by_id(id: str, user=Depends(get_verified_user), db: S
 
 
 @router.delete('/{id}')
-async def delete_file_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    file = Files.get_file_by_id(id, db=db)
+async def delete_file_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    file = await Files.get_file_by_id(id, db=db)
 
     if not file:
         raise HTTPException(
@@ -758,25 +782,25 @@ async def delete_file_by_id(id: str, user=Depends(get_verified_user), db: Sessio
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if file.user_id == user.id or user.role == 'admin' or has_access_to_file(id, 'write', user, db=db):
+    if file.user_id == user.id or user.role == 'admin' or await has_access_to_file(id, 'write', user, db=db):
         # Clean up KB associations and embeddings before deleting
-        knowledges = Knowledges.get_knowledges_by_file_id(id, db=db)
+        knowledges = await Knowledges.get_knowledges_by_file_id(id, db=db)
         for knowledge in knowledges:
             # Remove KB-file relationship
-            Knowledges.remove_file_from_knowledge_by_id(knowledge.id, id, db=db)
+            await Knowledges.remove_file_from_knowledge_by_id(knowledge.id, id, db=db)
             # Clean KB embeddings (same logic as /knowledge/{id}/file/remove)
             try:
-                VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': id})
+                await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': id})
                 if file.hash:
-                    VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'hash': file.hash})
+                    await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'hash': file.hash})
             except Exception as e:
                 log.debug(f'KB embedding cleanup for {knowledge.id}: {e}')
 
-        result = Files.delete_file_by_id(id, db=db)
+        result = await Files.delete_file_by_id(id, db=db)
         if result:
             try:
-                Storage.delete_file(file.path)
-                VECTOR_DB_CLIENT.delete(collection_name=f'file-{id}')
+                await asyncio.to_thread(Storage.delete_file, file.path)
+                await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=f'file-{id}')
             except Exception as e:
                 log.exception(e)
                 log.error('Error deleting files')

backend/open_webui/routers/folders.py

@@ -22,8 +22,8 @@ from open_webui.models.knowledge import Knowledges
 
 from open_webui.config import UPLOAD_DIR
 from open_webui.constants import ERROR_MESSAGES
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status, Request
@@ -48,7 +48,7 @@ router = APIRouter()
 async def get_folders(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if request.app.state.config.ENABLE_FOLDERS is False:
         raise HTTPException(
@@ -56,7 +56,7 @@ async def get_folders(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id,
         'features.folders',
         request.app.state.config.USER_PERMISSIONS,
@@ -67,29 +67,31 @@ async def get_folders(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    folders = Folders.get_folders_by_user_id(user.id, db=db)
+    folders = await Folders.get_folders_by_user_id(user.id, db=db)
 
     # Verify folder data integrity
     folder_list = []
     for folder in folders:
-        if folder.parent_id and not Folders.get_folder_by_id_and_user_id(folder.parent_id, user.id, db=db):
-            folder = Folders.update_folder_parent_id_by_id_and_user_id(folder.id, user.id, None, db=db)
+        if folder.parent_id and not await Folders.get_folder_by_id_and_user_id(folder.parent_id, user.id, db=db):
+            folder = await Folders.update_folder_parent_id_by_id_and_user_id(folder.id, user.id, None, db=db)
 
         if folder.data:
             if 'files' in folder.data:
                 valid_files = []
                 for file in folder.data['files']:
                     if file.get('type') == 'file':
-                        if Files.check_access_by_user_id(file.get('id'), user.id, 'read', db=db):
+                        if await Files.check_access_by_user_id(file.get('id'), user.id, 'read', db=db):
                             valid_files.append(file)
                     elif file.get('type') == 'collection':
-                        if Knowledges.check_access_by_user_id(file.get('id'), user.id, 'read', db=db):
+                        if await Knowledges.check_access_by_user_id(file.get('id'), user.id, 'read', db=db):
                             valid_files.append(file)
                     else:
                         valid_files.append(file)
 
                 folder.data['files'] = valid_files
-                Folders.update_folder_by_id_and_user_id(folder.id, user.id, FolderUpdateForm(data=folder.data), db=db)
+                await Folders.update_folder_by_id_and_user_id(
+                    folder.id, user.id, FolderUpdateForm(data=folder.data), db=db
+                )
 
         folder_list.append(FolderNameIdResponse(**folder.model_dump()))
 
@@ -102,12 +104,14 @@ async def get_folders(
 
 
 @router.post('/')
-def create_folder(
+async def create_folder(
     form_data: FolderForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    folder = Folders.get_folder_by_parent_id_and_user_id_and_name(form_data.parent_id, user.id, form_data.name, db=db)
+    folder = await Folders.get_folder_by_parent_id_and_user_id_and_name(
+        form_data.parent_id, user.id, form_data.name, db=db
+    )
 
     if folder:
         raise HTTPException(
@@ -116,7 +120,7 @@ def create_folder(
         )
 
     try:
-        folder = Folders.insert_new_folder(user.id, form_data, form_data.parent_id, db=db)
+        folder = await Folders.insert_new_folder(user.id, form_data, form_data.parent_id, db=db)
         return folder
     except Exception as e:
         log.exception(e)
@@ -133,8 +137,8 @@ def create_folder(
 
 
 @router.get('/{id}', response_model=Optional[FolderModel])
-async def get_folder_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    folder = Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
+async def get_folder_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    folder = await Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
     if folder:
         return folder
     else:
@@ -154,13 +158,13 @@ async def update_folder_name_by_id(
     id: str,
     form_data: FolderUpdateForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    folder = Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
+    folder = await Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
     if folder:
         if form_data.name is not None:
             # Check if folder with same name exists
-            existing_folder = Folders.get_folder_by_parent_id_and_user_id_and_name(
+            existing_folder = await Folders.get_folder_by_parent_id_and_user_id_and_name(
                 folder.parent_id, user.id, form_data.name, db=db
             )
             if existing_folder and existing_folder.id != id:
@@ -170,7 +174,7 @@ async def update_folder_name_by_id(
                 )
 
         try:
-            folder = Folders.update_folder_by_id_and_user_id(id, user.id, form_data, db=db)
+            folder = await Folders.update_folder_by_id_and_user_id(id, user.id, form_data, db=db)
             return folder
         except Exception as e:
             log.exception(e)
@@ -200,11 +204,11 @@ async def update_folder_parent_id_by_id(
     id: str,
     form_data: FolderParentIdForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    folder = Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
+    folder = await Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
     if folder:
-        existing_folder = Folders.get_folder_by_parent_id_and_user_id_and_name(
+        existing_folder = await Folders.get_folder_by_parent_id_and_user_id_and_name(
             form_data.parent_id, user.id, folder.name, db=db
         )
 
@@ -215,7 +219,7 @@ async def update_folder_parent_id_by_id(
             )
 
         try:
-            folder = Folders.update_folder_parent_id_by_id_and_user_id(id, user.id, form_data.parent_id, db=db)
+            folder = await Folders.update_folder_parent_id_by_id_and_user_id(id, user.id, form_data.parent_id, db=db)
             return folder
         except Exception as e:
             log.exception(e)
@@ -245,12 +249,14 @@ async def update_folder_is_expanded_by_id(
     id: str,
     form_data: FolderIsExpandedForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    folder = Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
+    folder = await Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
     if folder:
         try:
-            folder = Folders.update_folder_is_expanded_by_id_and_user_id(id, user.id, form_data.is_expanded, db=db)
+            folder = await Folders.update_folder_is_expanded_by_id_and_user_id(
+                id, user.id, form_data.is_expanded, db=db
+            )
             return folder
         except Exception as e:
             log.exception(e)
@@ -277,10 +283,10 @@ async def delete_folder_by_id(
     id: str,
     delete_contents: Optional[bool] = True,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if Chats.count_chats_by_folder_id_and_user_id(id, user.id, db=db):
-        chat_delete_permission = has_permission(
+    if await Chats.count_chats_by_folder_id_and_user_id(id, user.id, db=db):
+        chat_delete_permission = await has_permission(
             user.id, 'chat.delete', request.app.state.config.USER_PERMISSIONS, db=db
         )
         if user.role != 'admin' and not chat_delete_permission:
@@ -290,18 +296,18 @@ async def delete_folder_by_id(
             )
 
     folders = []
-    folders.append(Folders.get_folder_by_id_and_user_id(id, user.id, db=db))
+    folders.append(await Folders.get_folder_by_id_and_user_id(id, user.id, db=db))
     while folders:
         folder = folders.pop()
         if folder:
             try:
-                folder_ids = Folders.delete_folder_by_id_and_user_id(folder.id, user.id, db=db)
+                folder_ids = await Folders.delete_folder_by_id_and_user_id(folder.id, user.id, db=db)
 
                 for folder_id in folder_ids:
                     if delete_contents:
-                        Chats.delete_chats_by_user_id_and_folder_id(user.id, folder_id, db=db)
+                        await Chats.delete_chats_by_user_id_and_folder_id(user.id, folder_id, db=db)
                     else:
-                        Chats.move_chats_by_user_id_and_folder_id(user.id, folder_id, None, db=db)
+                        await Chats.move_chats_by_user_id_and_folder_id(user.id, folder_id, None, db=db)
 
                 return True
             except Exception as e:
@@ -313,7 +319,7 @@ async def delete_folder_by_id(
                 )
             finally:
                 # Get all subfolders
-                subfolders = Folders.get_folders_by_parent_id_and_user_id(folder.id, user.id, db=db)
+                subfolders = await Folders.get_folders_by_parent_id_and_user_id(folder.id, user.id, db=db)
                 folders.extend(subfolders)
 
     else:

backend/open_webui/routers/functions.py

@@ -6,7 +6,7 @@ import aiohttp
 from pathlib import Path
 from typing import Optional
 
-from open_webui.env import AIOHTTP_CLIENT_TIMEOUT
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT
 from open_webui.models.functions import (
     FunctionForm,
     FunctionModel,
@@ -26,8 +26,8 @@ from open_webui.constants import ERROR_MESSAGES
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from pydantic import BaseModel, HttpUrl
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
@@ -42,13 +42,13 @@ router = APIRouter()
 
 
 @router.get('/', response_model=list[FunctionResponse])
-async def get_functions(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    return Functions.get_functions(db=db)
+async def get_functions(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    return await Functions.get_functions(db=db)
 
 
 @router.get('/list', response_model=list[FunctionUserResponse])
-async def get_function_list(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    return Functions.get_function_list(db=db)
+async def get_function_list(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    return await Functions.get_function_list(db=db)
 
 
 ############################
@@ -60,9 +60,9 @@ async def get_function_list(user=Depends(get_admin_user), db: Session = Depends(
 async def get_functions(
     include_valves: bool = False,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    return Functions.get_functions(include_valves=include_valves, db=db)
+    return await Functions.get_functions(include_valves=include_valves, db=db)
 
 
 ############################
@@ -117,7 +117,9 @@ async def load_function_from_url(request: Request, form_data: LoadUrlForm, user=
         async with aiohttp.ClientSession(
             trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT)
         ) as session:
-            async with session.get(url, headers={'Content-Type': 'application/json'}) as resp:
+            async with session.get(
+                url, headers={'Content-Type': 'application/json'}, ssl=AIOHTTP_CLIENT_SESSION_SSL
+            ) as resp:
                 if resp.status != 200:
                     raise HTTPException(status_code=resp.status, detail='Failed to fetch the function')
                 data = await resp.text()
@@ -128,7 +130,7 @@ async def load_function_from_url(request: Request, form_data: LoadUrlForm, user=
             'content': data,
         }
     except Exception as e:
-        raise HTTPException(status_code=500, detail=f'Error importing function: {e}')
+        raise HTTPException(status_code=500, detail=ERROR_MESSAGES.DEFAULT(e))
 
 
 ############################
@@ -145,12 +147,12 @@ async def sync_functions(
     request: Request,
     form_data: SyncFunctionsForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
         for function in form_data.functions:
             function.content = replace_imports(function.content)
-            function_module, function_type, frontmatter = load_function_module_by_id(
+            function_module, function_type, frontmatter = await load_function_module_by_id(
                 function.id,
                 content=function.content,
             )
@@ -163,7 +165,7 @@ async def sync_functions(
                     log.exception(f'Error validating valves for function {function.id}: {e}')
                     raise e
 
-        return Functions.sync_functions(user.id, form_data.functions, db=db)
+        return await Functions.sync_functions(user.id, form_data.functions, db=db)
     except Exception as e:
         log.exception(f'Failed to load a function: {e}')
         raise HTTPException(
@@ -182,7 +184,7 @@ async def create_new_function(
     request: Request,
     form_data: FunctionForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not form_data.id.isidentifier():
         raise HTTPException(
@@ -192,11 +194,11 @@ async def create_new_function(
 
     form_data.id = form_data.id.lower()
 
-    function = Functions.get_function_by_id(form_data.id, db=db)
+    function = await Functions.get_function_by_id(form_data.id, db=db)
     if function is None:
         try:
             form_data.content = replace_imports(form_data.content)
-            function_module, function_type, frontmatter = load_function_module_by_id(
+            function_module, function_type, frontmatter = await load_function_module_by_id(
                 form_data.id,
                 content=form_data.content,
             )
@@ -205,13 +207,13 @@ async def create_new_function(
             FUNCTIONS = request.app.state.FUNCTIONS
             FUNCTIONS[form_data.id] = function_module
 
-            function = Functions.insert_new_function(user.id, function_type, form_data, db=db)
+            function = await Functions.insert_new_function(user.id, function_type, form_data, db=db)
 
             function_cache_dir = CACHE_DIR / 'functions' / form_data.id
             function_cache_dir.mkdir(parents=True, exist_ok=True)
 
             if function_type == 'filter' and getattr(function_module, 'toggle', None):
-                Functions.update_function_metadata_by_id(form_data.id, {'toggle': True}, db=db)
+                await Functions.update_function_metadata_by_id(form_data.id, {'toggle': True}, db=db)
 
             if function:
                 return function
@@ -239,8 +241,8 @@ async def create_new_function(
 
 
 @router.get('/id/{id}', response_model=Optional[FunctionModel])
-async def get_function_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    function = Functions.get_function_by_id(id, db=db)
+async def get_function_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    function = await Functions.get_function_by_id(id, db=db)
 
     if function:
         return function
@@ -257,10 +259,10 @@ async def get_function_by_id(id: str, user=Depends(get_admin_user), db: Session
 
 
 @router.post('/id/{id}/toggle', response_model=Optional[FunctionModel])
-async def toggle_function_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    function = Functions.get_function_by_id(id, db=db)
+async def toggle_function_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
-        function = Functions.update_function_by_id(id, {'is_active': not function.is_active}, db=db)
+        function = await Functions.update_function_by_id(id, {'is_active': not function.is_active}, db=db)
 
         if function:
             return function
@@ -282,10 +284,10 @@ async def toggle_function_by_id(id: str, user=Depends(get_admin_user), db: Sessi
 
 
 @router.post('/id/{id}/toggle/global', response_model=Optional[FunctionModel])
-async def toggle_global_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    function = Functions.get_function_by_id(id, db=db)
+async def toggle_global_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
-        function = Functions.update_function_by_id(id, {'is_global': not function.is_global}, db=db)
+        function = await Functions.update_function_by_id(id, {'is_global': not function.is_global}, db=db)
 
         if function:
             return function
@@ -312,11 +314,11 @@ async def update_function_by_id(
     id: str,
     form_data: FunctionForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
         form_data.content = replace_imports(form_data.content)
-        function_module, function_type, frontmatter = load_function_module_by_id(id, content=form_data.content)
+        function_module, function_type, frontmatter = await load_function_module_by_id(id, content=form_data.content)
         form_data.meta.manifest = frontmatter
 
         FUNCTIONS = request.app.state.FUNCTIONS
@@ -325,10 +327,10 @@ async def update_function_by_id(
         updated = {**form_data.model_dump(exclude={'id'}), 'type': function_type}
         log.debug(updated)
 
-        function = Functions.update_function_by_id(id, updated, db=db)
+        function = await Functions.update_function_by_id(id, updated, db=db)
 
         if function_type == 'filter' and getattr(function_module, 'toggle', None):
-            Functions.update_function_metadata_by_id(id, {'toggle': True}, db=db)
+            await Functions.update_function_metadata_by_id(id, {'toggle': True}, db=db)
 
         if function:
             return function
@@ -355,9 +357,9 @@ async def delete_function_by_id(
     request: Request,
     id: str,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    result = Functions.delete_function_by_id(id, db=db)
+    result = await Functions.delete_function_by_id(id, db=db)
 
     if result:
         FUNCTIONS = request.app.state.FUNCTIONS
@@ -373,11 +375,13 @@ async def delete_function_by_id(
 
 
 @router.get('/id/{id}/valves', response_model=Optional[dict])
-async def get_function_valves_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    function = Functions.get_function_by_id(id, db=db)
+async def get_function_valves_by_id(
+    id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)
+):
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
         try:
-            valves = Functions.get_function_valves_by_id(id, db=db)
+            valves = await Functions.get_function_valves_by_id(id, db=db)
             return valves
         except Exception as e:
             raise HTTPException(
@@ -401,11 +405,11 @@ async def get_function_valves_spec_by_id(
     request: Request,
     id: str,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    function = Functions.get_function_by_id(id, db=db)
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
-        function_module, function_type, frontmatter = get_function_module_from_cache(request, id)
+        function_module, function_type, frontmatter = await get_function_module_from_cache(request, id)
 
         if hasattr(function_module, 'Valves'):
             Valves = function_module.Valves
@@ -432,11 +436,11 @@ async def update_function_valves_by_id(
     id: str,
     form_data: dict,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    function = Functions.get_function_by_id(id, db=db)
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
-        function_module, function_type, frontmatter = get_function_module_from_cache(request, id)
+        function_module, function_type, frontmatter = await get_function_module_from_cache(request, id)
 
         if hasattr(function_module, 'Valves'):
             Valves = function_module.Valves
@@ -446,7 +450,7 @@ async def update_function_valves_by_id(
                 valves = Valves(**form_data)
 
                 valves_dict = valves.model_dump(exclude_unset=True)
-                Functions.update_function_valves_by_id(id, valves_dict, db=db)
+                await Functions.update_function_valves_by_id(id, valves_dict, db=db)
                 return valves_dict
             except Exception as e:
                 log.exception(f'Error updating function values by id {id}: {e}')
@@ -473,11 +477,13 @@ async def update_function_valves_by_id(
 
 
 @router.get('/id/{id}/valves/user', response_model=Optional[dict])
-async def get_function_user_valves_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    function = Functions.get_function_by_id(id, db=db)
+async def get_function_user_valves_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
         try:
-            user_valves = Functions.get_user_valves_by_id_and_user_id(id, user.id, db=db)
+            user_valves = await Functions.get_user_valves_by_id_and_user_id(id, user.id, db=db)
             return user_valves
         except Exception as e:
             raise HTTPException(
@@ -496,11 +502,11 @@ async def get_function_user_valves_spec_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    function = Functions.get_function_by_id(id, db=db)
+    function = await Functions.get_function_by_id(id, db=db)
     if function:
-        function_module, function_type, frontmatter = get_function_module_from_cache(request, id)
+        function_module, function_type, frontmatter = await get_function_module_from_cache(request, id)
 
         if hasattr(function_module, 'UserValves'):
             UserValves = function_module.UserValves
@@ -522,12 +528,12 @@ async def update_function_user_valves_by_id(
     id: str,
     form_data: dict,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    function = Functions.get_function_by_id(id, db=db)
+    function = await Functions.get_function_by_id(id, db=db)
 
     if function:
-        function_module, function_type, frontmatter = get_function_module_from_cache(request, id)
+        function_module, function_type, frontmatter = await get_function_module_from_cache(request, id)
 
         if hasattr(function_module, 'UserValves'):
             UserValves = function_module.UserValves
@@ -536,7 +542,7 @@ async def update_function_user_valves_by_id(
                 form_data = {k: v for k, v in form_data.items() if v is not None}
                 user_valves = UserValves(**form_data)
                 user_valves_dict = user_valves.model_dump(exclude_unset=True)
-                Functions.update_user_valves_by_id_and_user_id(id, user.id, user_valves_dict, db=db)
+                await Functions.update_user_valves_by_id_and_user_id(id, user.id, user_valves_dict, db=db)
                 return user_valves_dict
             except Exception as e:
                 log.exception(f'Error updating function user valves by id {id}: {e}')

backend/open_webui/routers/groups.py

@@ -17,8 +17,8 @@ from open_webui.config import CACHE_DIR
 from open_webui.constants import ERROR_MESSAGES
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from open_webui.utils.auth import get_admin_user, get_verified_user
 
@@ -35,7 +35,7 @@ router = APIRouter()
 async def get_groups(
     share: Optional[bool] = None,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     filter = {}
 
@@ -45,7 +45,7 @@ async def get_groups(
         if share is not None:
             filter['share'] = share
 
-    groups = Groups.get_groups(filter=filter, db=db)
+    groups = await Groups.get_groups(filter=filter, db=db)
 
     return groups
 
@@ -59,14 +59,14 @@ async def get_groups(
 async def create_new_group(
     form_data: GroupForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
-        group = Groups.insert_new_group(user.id, form_data, db=db)
+        group = await Groups.insert_new_group(user.id, form_data, db=db)
         if group:
             return GroupResponse(
                 **group.model_dump(),
-                member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+                member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
             )
         else:
             raise HTTPException(
@@ -87,12 +87,12 @@ async def create_new_group(
 
 
 @router.get('/id/{id}', response_model=Optional[GroupResponse])
-async def get_group_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    group = Groups.get_group_by_id(id, db=db)
+async def get_group_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    group = await Groups.get_group_by_id(id, db=db)
     if group:
         return GroupResponse(
             **group.model_dump(),
-            member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+            member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
         )
     else:
         raise HTTPException(
@@ -102,12 +102,12 @@ async def get_group_by_id(id: str, user=Depends(get_admin_user), db: Session = D
 
 
 @router.get('/id/{id}/info', response_model=Optional[GroupInfoResponse])
-async def get_group_info_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    group = Groups.get_group_by_id(id, db=db)
+async def get_group_info_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    group = await Groups.get_group_by_id(id, db=db)
     if group:
         return GroupInfoResponse(
             **group.model_dump(),
-            member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+            member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
         )
     else:
         raise HTTPException(
@@ -127,13 +127,13 @@ class GroupExportResponse(GroupResponse):
 
 
 @router.get('/id/{id}/export', response_model=Optional[GroupExportResponse])
-async def export_group_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    group = Groups.get_group_by_id(id, db=db)
+async def export_group_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    group = await Groups.get_group_by_id(id, db=db)
     if group:
         return GroupExportResponse(
             **group.model_dump(),
-            member_count=Groups.get_group_member_count_by_id(group.id, db=db),
-            user_ids=Groups.get_group_user_ids_by_id(group.id, db=db),
+            member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
+            user_ids=await Groups.get_group_user_ids_by_id(group.id, db=db),
         )
     else:
         raise HTTPException(
@@ -148,9 +148,9 @@ async def export_group_by_id(id: str, user=Depends(get_admin_user), db: Session
 
 
 @router.post('/id/{id}/users', response_model=list[UserInfoResponse])
-async def get_users_in_group(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
+async def get_users_in_group(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
     try:
-        users = Users.get_users_by_group_id(id, db=db)
+        users = await Users.get_users_by_group_id(id, db=db)
         return users
     except Exception as e:
         log.exception(f'Error adding users to group {id}: {e}')
@@ -170,14 +170,14 @@ async def update_group_by_id(
     id: str,
     form_data: GroupUpdateForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
-        group = Groups.update_group_by_id(id, form_data, db=db)
+        group = await Groups.update_group_by_id(id, form_data, db=db)
         if group:
             return GroupResponse(
                 **group.model_dump(),
-                member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+                member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
             )
         else:
             raise HTTPException(
@@ -202,17 +202,17 @@ async def add_user_to_group(
     id: str,
     form_data: UserIdsForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
         if form_data.user_ids:
-            form_data.user_ids = Users.get_valid_user_ids(form_data.user_ids, db=db)
+            form_data.user_ids = await Users.get_valid_user_ids(form_data.user_ids, db=db)
 
-        group = Groups.add_users_to_group(id, form_data.user_ids, db=db)
+        group = await Groups.add_users_to_group(id, form_data.user_ids, db=db)
         if group:
             return GroupResponse(
                 **group.model_dump(),
-                member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+                member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
             )
         else:
             raise HTTPException(
@@ -232,14 +232,14 @@ async def remove_users_from_group(
     id: str,
     form_data: UserIdsForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
-        group = Groups.remove_users_from_group(id, form_data.user_ids, db=db)
+        group = await Groups.remove_users_from_group(id, form_data.user_ids, db=db)
         if group:
             return GroupResponse(
                 **group.model_dump(),
-                member_count=Groups.get_group_member_count_by_id(group.id, db=db),
+                member_count=await Groups.get_group_member_count_by_id(group.id, db=db),
             )
         else:
             raise HTTPException(
@@ -260,9 +260,9 @@ async def remove_users_from_group(
 
 
 @router.delete('/id/{id}/delete', response_model=bool)
-async def delete_group_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
+async def delete_group_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
     try:
-        result = Groups.delete_group_by_id(id, db=db)
+        result = await Groups.delete_group_by_id(id, db=db)
         if result:
             return result
         else:

backend/open_webui/routers/images.py

@@ -10,7 +10,8 @@ from pathlib import Path
 from typing import Optional
 
 from urllib.parse import quote
-import requests
+import aiohttp
+
 from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile
 from fastapi.responses import FileResponse
 
@@ -21,15 +22,16 @@ from open_webui.config import (
 )
 from open_webui.constants import ERROR_MESSAGES
 from open_webui.retrieval.web.utils import validate_url
-from open_webui.env import ENABLE_FORWARD_USER_INFO_HEADERS
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, ENABLE_FORWARD_USER_INFO_HEADERS
+from open_webui.utils.session_pool import get_session
 
 from open_webui.models.chats import Chats
 from open_webui.routers.files import upload_file_handler, get_file_content_by_id
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.access_control import has_permission
 from open_webui.utils.headers import include_user_info_headers
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 from open_webui.utils.images.comfyui import (
     ComfyUICreateImageForm,
     ComfyUIEditImageForm,
@@ -50,32 +52,36 @@ IMAGE_CACHE_DIR.mkdir(parents=True, exist_ok=True)
 router = APIRouter()
 
 
-def set_image_model(request: Request, model: str):
+async def set_image_model(request: Request, model: str):
     log.info(f'Setting image model to {model}')
     request.app.state.config.IMAGE_GENERATION_MODEL = model
     if request.app.state.config.IMAGE_GENERATION_ENGINE in ['', 'automatic1111']:
         api_auth = get_automatic1111_api_auth(request)
 
         try:
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/options',
                 headers={'authorization': api_auth},
-            )
-            options = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                options = await r.json()
             if model != options['sd_model_checkpoint']:
                 options['sd_model_checkpoint'] = model
-                r = requests.post(
+                async with session.post(
                     url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/options',
                     json=options,
                     headers={'authorization': api_auth},
-                )
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
+                ) as r:
+                    r.raise_for_status()
         except Exception as e:
             log.debug(f'{e}')
 
     return request.app.state.config.IMAGE_GENERATION_MODEL
 
 
-def get_image_model(request):
+async def get_image_model(request):
     if request.app.state.config.IMAGE_GENERATION_ENGINE == 'openai':
         return (
             request.app.state.config.IMAGE_GENERATION_MODEL
@@ -97,14 +103,15 @@ def get_image_model(request):
         or request.app.state.config.IMAGE_GENERATION_ENGINE == ''
     ):
         try:
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/options',
                 headers={'authorization': get_automatic1111_api_auth(request)},
-            )
-            options = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                options = await r.json()
             return options['sd_model_checkpoint']
         except Exception as e:
-            request.app.state.config.ENABLE_IMAGE_GENERATION = False
             raise HTTPException(status_code=400, detail=ERROR_MESSAGES.DEFAULT(e))
 
 
@@ -198,7 +205,7 @@ async def update_config(request: Request, form_data: ImagesConfig, user=Depends(
     request.app.state.config.ENABLE_IMAGE_PROMPT_GENERATION = form_data.ENABLE_IMAGE_PROMPT_GENERATION
 
     request.app.state.config.IMAGE_GENERATION_ENGINE = form_data.IMAGE_GENERATION_ENGINE
-    set_image_model(request, form_data.IMAGE_GENERATION_MODEL)
+    await set_image_model(request, form_data.IMAGE_GENERATION_MODEL)
     if form_data.IMAGE_SIZE == 'auto' and not re.match(
         IMAGE_AUTO_SIZE_MODELS_REGEX_PATTERN, form_data.IMAGE_GENERATION_MODEL
     ):
@@ -313,35 +320,37 @@ def get_automatic1111_api_auth(request: Request):
 async def verify_url(request: Request, user=Depends(get_admin_user)):
     if request.app.state.config.IMAGE_GENERATION_ENGINE == 'automatic1111':
         try:
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/options',
                 headers={'authorization': get_automatic1111_api_auth(request)},
-            )
-            r.raise_for_status()
-            return True
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                return True
         except Exception:
-            request.app.state.config.ENABLE_IMAGE_GENERATION = False
             raise HTTPException(status_code=400, detail=ERROR_MESSAGES.INVALID_URL)
     elif request.app.state.config.IMAGE_GENERATION_ENGINE == 'comfyui':
         headers = None
         if request.app.state.config.COMFYUI_API_KEY:
             headers = {'Authorization': f'Bearer {request.app.state.config.COMFYUI_API_KEY}'}
         try:
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.COMFYUI_BASE_URL}/object_info',
                 headers=headers,
-            )
-            r.raise_for_status()
-            return True
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                return True
         except Exception:
-            request.app.state.config.ENABLE_IMAGE_GENERATION = False
             raise HTTPException(status_code=400, detail=ERROR_MESSAGES.INVALID_URL)
     else:
         return True
 
 
 @router.get('/models')
-def get_models(request: Request, user=Depends(get_verified_user)):
+async def get_models(request: Request, user=Depends(get_verified_user)):
     try:
         if request.app.state.config.IMAGE_GENERATION_ENGINE == 'openai':
             return [
@@ -357,11 +366,13 @@ def get_models(request: Request, user=Depends(get_verified_user)):
         elif request.app.state.config.IMAGE_GENERATION_ENGINE == 'comfyui':
             # TODO - get models from comfyui
             headers = {'Authorization': f'Bearer {request.app.state.config.COMFYUI_API_KEY}'}
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.COMFYUI_BASE_URL}/object_info',
                 headers=headers,
-            )
-            info = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                info = await r.json()
 
             workflow = json.loads(request.app.state.config.COMFYUI_WORKFLOW)
             model_node_id = None
@@ -399,11 +410,13 @@ def get_models(request: Request, user=Depends(get_verified_user)):
             request.app.state.config.IMAGE_GENERATION_ENGINE == 'automatic1111'
             or request.app.state.config.IMAGE_GENERATION_ENGINE == ''
         ):
-            r = requests.get(
+            session = await get_session()
+            async with session.get(
                 url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/sd-models',
                 headers={'authorization': get_automatic1111_api_auth(request)},
-            )
-            models = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                models = await r.json()
             return list(
                 map(
                     lambda model: {'id': model['title'], 'name': model['model_name']},
@@ -411,7 +424,6 @@ def get_models(request: Request, user=Depends(get_verified_user)):
                 )
             )
     except Exception as e:
-        request.app.state.config.ENABLE_IMAGE_GENERATION = False
         raise HTTPException(status_code=400, detail=ERROR_MESSAGES.DEFAULT(e))
 
 
@@ -427,21 +439,22 @@ class CreateImageForm(BaseModel):
 GenerateImageForm = CreateImageForm  # Alias for backward compatibility
 
 
-def get_image_data(data: str, headers=None):
+async def get_image_data(data: str, headers=None):
     try:
         if data.startswith('http://') or data.startswith('https://'):
-            if headers:
-                r = requests.get(data, headers=headers)
-            else:
-                r = requests.get(data)
-
-            r.raise_for_status()
-            if r.headers['content-type'].split('/')[0] == 'image':
-                mime_type = r.headers['content-type']
-                return r.content, mime_type
-            else:
-                log.error('Url does not point to an image.')
-                return None
+            session = await get_session()
+            async with session.get(
+                data,
+                headers=headers,
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                content_type = r.headers.get('content-type', '')
+                if content_type.split('/')[0] == 'image':
+                    return await r.read(), content_type
+                else:
+                    log.error('Url does not point to an image.')
+                    return None, None
         else:
             if ',' in data:
                 header, encoded = data.split(',', 1)
@@ -456,7 +469,7 @@ def get_image_data(data: str, headers=None):
         return None, None
 
 
-def upload_image(request, image_data, content_type, metadata, user, db=None):
+async def upload_image(request, image_data, content_type, metadata, user, db=None):
     image_format = mimetypes.guess_extension(content_type)
     file = UploadFile(
         file=io.BytesIO(image_data),
@@ -465,7 +478,7 @@ def upload_image(request, image_data, content_type, metadata, user, db=None):
             'content-type': content_type,
         },
     )
-    file_item = upload_file_handler(
+    file_item = await upload_file_handler(
         request,
         file=file,
         metadata=metadata,
@@ -479,7 +492,7 @@ def upload_image(request, image_data, content_type, metadata, user, db=None):
         message_id = metadata.get('message_id')
 
         if chat_id and message_id:
-            Chats.insert_chat_files(
+            await Chats.insert_chat_files(
                 chat_id=chat_id,
                 message_id=message_id,
                 file_ids=[file_item.id],
@@ -499,7 +512,7 @@ async def generate_images(request: Request, form_data: CreateImageForm, user=Dep
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.image_generation', request.app.state.config.USER_PERMISSIONS
     ):
         raise HTTPException(
@@ -531,9 +544,8 @@ async def image_generations(
 
     metadata = metadata or {}
 
-    model = get_image_model(request)
+    model = await get_image_model(request)
 
-    r = None
     try:
         if request.app.state.config.IMAGE_GENERATION_ENGINE == 'openai':
             headers = {
@@ -552,7 +564,11 @@ async def image_generations(
                 'model': model,
                 'prompt': form_data.prompt,
                 'n': form_data.n,
-                'size': (form_data.size if form_data.size else request.app.state.config.IMAGE_SIZE),
+                **(
+                    {'size': form_data.size or request.app.state.config.IMAGE_SIZE}
+                    if (form_data.size or request.app.state.config.IMAGE_SIZE)
+                    else {}
+                ),
                 **(
                     {}
                     if re.match(
@@ -568,29 +584,28 @@ async def image_generations(
                 ),
             }
 
-            # Use asyncio.to_thread for the requests.post call
-            r = await asyncio.to_thread(
-                requests.post,
+            session = await get_session()
+            async with session.post(
                 url=url,
                 json=data,
                 headers=headers,
-            )
-
-            r.raise_for_status()
-            res = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                res = await r.json()
 
             images = []
 
             for image in res['data']:
                 if image_url := image.get('url', None):
-                    image_data, content_type = get_image_data(
+                    image_data, content_type = await get_image_data(
                         image_url,
                         {k: v for k, v in headers.items() if k != 'Content-Type'},
                     )
                 else:
-                    image_data, content_type = get_image_data(image['b64_json'])
+                    image_data, content_type = await get_image_data(image['b64_json'])
 
-                _, url = upload_image(request, image_data, content_type, {**data, **metadata}, user)
+                _, url = await upload_image(request, image_data, content_type, {**data, **metadata}, user)
                 images.append({'url': url})
             return images
 
@@ -619,30 +634,29 @@ async def image_generations(
                 model = f'{model}:generateContent'
                 data = {'contents': [{'parts': [{'text': form_data.prompt}]}]}
 
-            # Use asyncio.to_thread for the requests.post call
-            r = await asyncio.to_thread(
-                requests.post,
+            session = await get_session()
+            async with session.post(
                 url=f'{request.app.state.config.IMAGES_GEMINI_API_BASE_URL}/models/{model}',
                 json=data,
                 headers=headers,
-            )
-
-            r.raise_for_status()
-            res = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                res = await r.json()
 
             images = []
 
             if model.endswith(':predict'):
                 for image in res['predictions']:
-                    image_data, content_type = get_image_data(image['bytesBase64Encoded'])
-                    _, url = upload_image(request, image_data, content_type, {**data, **metadata}, user)
+                    image_data, content_type = await get_image_data(image['bytesBase64Encoded'])
+                    _, url = await upload_image(request, image_data, content_type, {**data, **metadata}, user)
                     images.append({'url': url})
             elif model.endswith(':generateContent'):
                 for image in res['candidates']:
                     for part in image['content']['parts']:
                         if part.get('inlineData', {}).get('data'):
-                            image_data, content_type = get_image_data(part['inlineData']['data'])
-                            _, url = upload_image(
+                            image_data, content_type = await get_image_data(part['inlineData']['data'])
+                            _, url = await upload_image(
                                 request,
                                 image_data,
                                 content_type,
@@ -681,7 +695,7 @@ async def image_generations(
             res = await comfyui_create_image(
                 model,
                 form_data,
-                user.id,
+                str(uuid.uuid4()),
                 request.app.state.config.COMFYUI_BASE_URL,
                 request.app.state.config.COMFYUI_API_KEY,
             )
@@ -694,8 +708,8 @@ async def image_generations(
                 if request.app.state.config.COMFYUI_API_KEY:
                     headers = {'Authorization': f'Bearer {request.app.state.config.COMFYUI_API_KEY}'}
 
-                image_data, content_type = get_image_data(image['url'], headers)
-                _, url = upload_image(
+                image_data, content_type = await get_image_data(image['url'], headers)
+                _, url = await upload_image(
                     request,
                     image_data,
                     content_type,
@@ -709,7 +723,7 @@ async def image_generations(
             or request.app.state.config.IMAGE_GENERATION_ENGINE == ''
         ):
             if form_data.model:
-                set_image_model(request, form_data.model)
+                await set_image_model(request, form_data.model)
 
             data = {
                 'prompt': form_data.prompt,
@@ -727,22 +741,21 @@ async def image_generations(
             if request.app.state.config.AUTOMATIC1111_PARAMS:
                 data = {**data, **request.app.state.config.AUTOMATIC1111_PARAMS}
 
-            # Use asyncio.to_thread for the requests.post call
-            r = await asyncio.to_thread(
-                requests.post,
+            session = await get_session()
+            async with session.post(
                 url=f'{request.app.state.config.AUTOMATIC1111_BASE_URL}/sdapi/v1/txt2img',
                 json=data,
                 headers={'authorization': get_automatic1111_api_auth(request)},
-            )
-
-            res = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                res = await r.json()
             log.debug(f'res: {res}')
 
             images = []
 
             for image in res['images']:
-                image_data, content_type = get_image_data(image)
-                _, url = upload_image(
+                image_data, content_type = await get_image_data(image)
+                _, url = await upload_image(
                     request,
                     image_data,
                     content_type,
@@ -753,10 +766,8 @@ async def image_generations(
             return images
     except Exception as e:
         error = e
-        if r != None:
-            data = r.json()
-            if 'error' in data:
-                error = data['error']['message']
+        if isinstance(e, aiohttp.ClientResponseError):
+            error = e.message
         raise HTTPException(status_code=400, detail=ERROR_MESSAGES.DEFAULT(error))
 
 
@@ -798,11 +809,12 @@ async def image_edits(
             if data.startswith('http://') or data.startswith('https://'):
                 # Validate URL to prevent SSRF attacks against local/private networks
                 validate_url(data)
-                r = await asyncio.to_thread(requests.get, data)
-                r.raise_for_status()
+                session = await get_session()
+                async with session.get(data, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r:
+                    r.raise_for_status()
 
-                image_data = base64.b64encode(r.content).decode('utf-8')
-                return f'data:{r.headers["content-type"]};base64,{image_data}'
+                    image_data = base64.b64encode(await r.read()).decode('utf-8')
+                    return f'data:{r.headers["content-type"]};base64,{image_data}'
 
             else:
                 file_id = None
@@ -846,7 +858,6 @@ async def image_edits(
             ),
         )
 
-    r = None
     try:
         if request.app.state.config.IMAGE_EDIT_ENGINE == 'openai':
             headers = {
@@ -883,29 +894,42 @@ async def image_edits(
             if request.app.state.config.IMAGES_EDIT_OPENAI_API_VERSION:
                 url_search_params += f'?api-version={request.app.state.config.IMAGES_EDIT_OPENAI_API_VERSION}'
 
-            # Use asyncio.to_thread for the requests.post call
-            r = await asyncio.to_thread(
-                requests.post,
+            # Build multipart form data for aiohttp
+            form = aiohttp.FormData()
+            for key, value in data.items():
+                if isinstance(value, dict):
+                    form.add_field(key, json.dumps(value))
+                else:
+                    form.add_field(key, str(value))
+            for param_name, (filename, file_obj, content_type_val) in files:
+                form.add_field(
+                    param_name,
+                    file_obj,
+                    filename=filename,
+                    content_type=content_type_val,
+                )
+
+            session = await get_session()
+            async with session.post(
                 url=f'{request.app.state.config.IMAGES_EDIT_OPENAI_API_BASE_URL}/images/edits{url_search_params}',
                 headers=headers,
-                files=files,
-                data=data,
-            )
-
-            r.raise_for_status()
-            res = r.json()
+                data=form,
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                res = await r.json()
 
             images = []
             for image in res['data']:
                 if image_url := image.get('url', None):
-                    image_data, content_type = get_image_data(
+                    image_data, content_type = await get_image_data(
                         image_url,
                         {k: v for k, v in headers.items() if k != 'Content-Type'},
                     )
                 else:
-                    image_data, content_type = get_image_data(image['b64_json'])
+                    image_data, content_type = await get_image_data(image['b64_json'])
 
-                _, url = upload_image(request, image_data, content_type, {**data, **metadata}, user)
+                _, url = await upload_image(request, image_data, content_type, {**data, **metadata}, user)
                 images.append({'url': url})
             return images
 
@@ -940,23 +964,22 @@ async def image_edits(
                     ]
                 )
 
-            # Use asyncio.to_thread for the requests.post call
-            r = await asyncio.to_thread(
-                requests.post,
+            session = await get_session()
+            async with session.post(
                 url=f'{request.app.state.config.IMAGES_EDIT_GEMINI_API_BASE_URL}/models/{model}',
                 json=data,
                 headers=headers,
-            )
-
-            r.raise_for_status()
-            res = r.json()
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as r:
+                r.raise_for_status()
+                res = await r.json()
 
             images = []
             for image in res['candidates']:
                 for part in image['content']['parts']:
                     if part.get('inlineData', {}).get('data'):
-                        image_data, content_type = get_image_data(part['inlineData']['data'])
-                        _, url = upload_image(
+                        image_data, content_type = await get_image_data(part['inlineData']['data'])
+                        _, url = await upload_image(
                             request,
                             image_data,
                             content_type,
@@ -1011,7 +1034,7 @@ async def image_edits(
             res = await comfyui_edit_image(
                 model,
                 form_data,
-                user.id,
+                str(uuid.uuid4()),
                 request.app.state.config.IMAGES_EDIT_COMFYUI_BASE_URL,
                 request.app.state.config.IMAGES_EDIT_COMFYUI_API_KEY,
             )
@@ -1035,8 +1058,8 @@ async def image_edits(
                 if request.app.state.config.IMAGES_EDIT_COMFYUI_API_KEY:
                     headers = {'Authorization': f'Bearer {request.app.state.config.IMAGES_EDIT_COMFYUI_API_KEY}'}
 
-                image_data, content_type = get_image_data(image_url, headers)
-                _, url = upload_image(
+                image_data, content_type = await get_image_data(image_url, headers)
+                _, url = await upload_image(
                     request,
                     image_data,
                     content_type,
@@ -1048,13 +1071,7 @@ async def image_edits(
             return images
     except Exception as e:
         error = e
-        if r != None:
-            data = r.text
-            try:
-                data = json.loads(data)
-                if 'error' in data:
-                    error = data['error']['message']
-            except Exception:
-                error = data
+        if isinstance(e, aiohttp.ClientResponseError):
+            error = e.message
 
         raise HTTPException(status_code=400, detail=ERROR_MESSAGES.DEFAULT(error))

backend/open_webui/routers/knowledge.py

@@ -2,14 +2,14 @@ from typing import List, Optional
 from pydantic import BaseModel
 from fastapi import APIRouter, Depends, HTTPException, status, Request, Query
 from fastapi.responses import StreamingResponse
-from fastapi.concurrency import run_in_threadpool
+
 import logging
 import io
 import zipfile
 from urllib.parse import quote
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import get_session
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import get_async_session
 from open_webui.models.groups import Groups
 from open_webui.models.knowledge import (
     KnowledgeFileListResponse,
@@ -19,7 +19,7 @@ from open_webui.models.knowledge import (
     KnowledgeUserResponse,
 )
 from open_webui.models.files import Files, FileModel, FileMetadataResponse
-from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
+from open_webui.retrieval.vector.async_client import ASYNC_VECTOR_DB_CLIENT
 from open_webui.routers.retrieval import (
     process_file,
     ProcessFileForm,
@@ -66,7 +66,7 @@ async def embed_knowledge_base_metadata(
     try:
         content = f'{name}\n\n{description}' if description else name
         embedding = await request.app.state.EMBEDDING_FUNCTION(content)
-        VECTOR_DB_CLIENT.upsert(
+        await ASYNC_VECTOR_DB_CLIENT.upsert(
             collection_name=KNOWLEDGE_BASES_COLLECTION,
             items=[
                 {
@@ -85,10 +85,10 @@ async def embed_knowledge_base_metadata(
         return False
 
 
-def remove_knowledge_base_metadata_embedding(knowledge_base_id: str) -> bool:
+async def remove_knowledge_base_metadata_embedding(knowledge_base_id: str) -> bool:
     """Remove knowledge base embedding."""
     try:
-        VECTOR_DB_CLIENT.delete(
+        await ASYNC_VECTOR_DB_CLIENT.delete(
             collection_name=KNOWLEDGE_BASES_COLLECTION,
             ids=[knowledge_base_id],
         )
@@ -111,14 +111,14 @@ class KnowledgeAccessListResponse(BaseModel):
 async def get_knowledge_bases(
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     page = max(page, 1)
     limit = PAGE_ITEM_COUNT
     skip = (page - 1) * limit
 
     filter = {}
-    groups = Groups.get_groups_by_member_id(user.id, db=db)
+    groups = await Groups.get_groups_by_member_id(user.id, db=db)
     user_group_ids = {group.id for group in groups}
 
     if not user.role == 'admin' or not BYPASS_ADMIN_ACCESS_CONTROL:
@@ -127,11 +127,11 @@ async def get_knowledge_bases(
 
         filter['user_id'] = user.id
 
-    result = Knowledges.search_knowledge_bases(user.id, filter=filter, skip=skip, limit=limit, db=db)
+    result = await Knowledges.search_knowledge_bases(user.id, filter=filter, skip=skip, limit=limit, db=db)
 
     # Batch-fetch writable knowledge IDs in a single query instead of N has_access calls
     knowledge_base_ids = [knowledge_base.id for knowledge_base in result.items]
-    writable_knowledge_base_ids = AccessGrants.get_accessible_resource_ids(
+    writable_knowledge_base_ids = await AccessGrants.get_accessible_resource_ids(
         user_id=user.id,
         resource_type='knowledge',
         resource_ids=knowledge_base_ids,
@@ -162,7 +162,7 @@ async def search_knowledge_bases(
     view_option: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     page = max(page, 1)
     limit = PAGE_ITEM_COUNT
@@ -174,7 +174,7 @@ async def search_knowledge_bases(
     if view_option:
         filter['view_option'] = view_option
 
-    groups = Groups.get_groups_by_member_id(user.id, db=db)
+    groups = await Groups.get_groups_by_member_id(user.id, db=db)
     user_group_ids = {group.id for group in groups}
 
     if not user.role == 'admin' or not BYPASS_ADMIN_ACCESS_CONTROL:
@@ -183,11 +183,11 @@ async def search_knowledge_bases(
 
         filter['user_id'] = user.id
 
-    result = Knowledges.search_knowledge_bases(user.id, filter=filter, skip=skip, limit=limit, db=db)
+    result = await Knowledges.search_knowledge_bases(user.id, filter=filter, skip=skip, limit=limit, db=db)
 
     # Batch-fetch writable knowledge IDs in a single query instead of N has_access calls
     knowledge_base_ids = [knowledge_base.id for knowledge_base in result.items]
-    writable_knowledge_base_ids = AccessGrants.get_accessible_resource_ids(
+    writable_knowledge_base_ids = await AccessGrants.get_accessible_resource_ids(
         user_id=user.id,
         resource_type='knowledge',
         resource_ids=knowledge_base_ids,
@@ -217,7 +217,7 @@ async def search_knowledge_files(
     query: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     page = max(page, 1)
     limit = PAGE_ITEM_COUNT
@@ -227,13 +227,13 @@ async def search_knowledge_files(
     if query:
         filter['query'] = query
 
-    groups = Groups.get_groups_by_member_id(user.id, db=db)
+    groups = await Groups.get_groups_by_member_id(user.id, db=db)
     if groups:
         filter['group_ids'] = [group.id for group in groups]
 
     filter['user_id'] = user.id
 
-    return Knowledges.search_knowledge_files(filter=filter, skip=skip, limit=limit, db=db)
+    return await Knowledges.search_knowledge_files(filter=filter, skip=skip, limit=limit, db=db)
 
 
 ############################
@@ -247,11 +247,11 @@ async def create_new_knowledge(
     form_data: KnowledgeForm,
     user=Depends(get_verified_user),
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations (has_permission, filter_allowed_access_grants, insert_new_knowledge) manage their own sessions.
     # This prevents holding a connection during embed_knowledge_base_metadata()
     # which makes external embedding API calls (1-5+ seconds).
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'workspace.knowledge', request.app.state.config.USER_PERMISSIONS
     ):
         raise HTTPException(
@@ -259,7 +259,7 @@ async def create_new_knowledge(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -267,7 +267,7 @@ async def create_new_knowledge(
         'sharing.public_knowledge',
     )
 
-    knowledge = Knowledges.insert_new_knowledge(user.id, form_data)
+    knowledge = await Knowledges.insert_new_knowledge(user.id, form_data)
 
     if knowledge:
         # Embed knowledge base for semantic search
@@ -294,7 +294,7 @@ async def create_new_knowledge(
 async def reindex_knowledge_files(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if user.role != 'admin':
         raise HTTPException(
@@ -302,16 +302,16 @@ async def reindex_knowledge_files(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    knowledge_bases = Knowledges.get_knowledge_bases(db=db)
+    knowledge_bases = await Knowledges.get_knowledge_bases(db=db)
 
     log.info(f'Starting reindexing for {len(knowledge_bases)} knowledge bases')
 
     for knowledge_base in knowledge_bases:
         try:
-            files = Knowledges.get_files_by_id(knowledge_base.id, db=db)
+            files = await Knowledges.get_files_by_id(knowledge_base.id, db=db)
             try:
-                if VECTOR_DB_CLIENT.has_collection(collection_name=knowledge_base.id):
-                    VECTOR_DB_CLIENT.delete_collection(collection_name=knowledge_base.id)
+                if await ASYNC_VECTOR_DB_CLIENT.has_collection(collection_name=knowledge_base.id):
+                    await ASYNC_VECTOR_DB_CLIENT.delete_collection(collection_name=knowledge_base.id)
             except Exception as e:
                 log.error(f'Error deleting collection {knowledge_base.id}: {str(e)}')
                 continue  # Skip, don't raise
@@ -319,8 +319,7 @@ async def reindex_knowledge_files(
             failed_files = []
             for file in files:
                 try:
-                    await run_in_threadpool(
-                        process_file,
+                    await process_file(
                         request,
                         ProcessFileForm(file_id=file.id, collection_name=knowledge_base.id),
                         user=user,
@@ -357,12 +356,12 @@ async def reindex_knowledge_base_metadata_embeddings(
 ):
     """Batch embed all existing knowledge bases. Admin only.
 
-    NOTE: We intentionally do NOT use Depends(get_session) here.
+    NOTE: We intentionally do NOT use Depends(get_async_session) here.
     This endpoint loops through ALL knowledge bases and calls embed_knowledge_base_metadata()
     for each one, making N external embedding API calls. Holding a session during
     this entire operation would exhaust the connection pool.
     """
-    knowledge_bases = Knowledges.get_knowledge_bases()
+    knowledge_bases = await Knowledges.get_knowledge_bases()
     log.info(f'Reindexing embeddings for {len(knowledge_bases)} knowledge bases')
 
     success_count = 0
@@ -385,14 +384,14 @@ class KnowledgeFilesResponse(KnowledgeResponse):
 
 
 @router.get('/{id}', response_model=Optional[KnowledgeFilesResponse])
-async def get_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+async def get_knowledge_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
 
     if knowledge:
         if (
             user.role == 'admin'
             or knowledge.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='knowledge',
                 resource_id=knowledge.id,
@@ -405,7 +404,7 @@ async def get_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Sess
                 write_access=(
                     user.id == knowledge.user_id
                     or (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='knowledge',
                         resource_id=knowledge.id,
@@ -438,11 +437,11 @@ async def update_knowledge_by_id(
     form_data: KnowledgeForm,
     user=Depends(get_verified_user),
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations manage their own short-lived sessions internally.
     # This prevents holding a connection during embed_knowledge_base_metadata()
     # which makes external embedding API calls (1-5+ seconds).
-    knowledge = Knowledges.get_knowledge_by_id(id=id)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -451,7 +450,7 @@ async def update_knowledge_by_id(
     # Is the user the original creator, in a group with write access, or an admin
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -464,7 +463,7 @@ async def update_knowledge_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -472,7 +471,7 @@ async def update_knowledge_by_id(
         'sharing.public_knowledge',
     )
 
-    knowledge = Knowledges.update_knowledge_by_id(id=id, form_data=form_data)
+    knowledge = await Knowledges.update_knowledge_by_id(id=id, form_data=form_data)
     if knowledge:
         # Re-embed knowledge base for semantic search
         await embed_knowledge_base_metadata(
@@ -483,7 +482,7 @@ async def update_knowledge_by_id(
         )
         return KnowledgeFilesResponse(
             **knowledge.model_dump(),
-            files=Knowledges.get_file_metadatas_by_id(knowledge.id),
+            files=await Knowledges.get_file_metadatas_by_id(knowledge.id),
         )
     else:
         raise HTTPException(
@@ -507,9 +506,9 @@ async def update_knowledge_access_by_id(
     id: str,
     form_data: KnowledgeAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -518,7 +517,7 @@ async def update_knowledge_access_by_id(
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -532,7 +531,7 @@ async def update_knowledge_access_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -540,11 +539,11 @@ async def update_knowledge_access_by_id(
         'sharing.public_knowledge',
     )
 
-    AccessGrants.set_access_grants('knowledge', id, form_data.access_grants, db=db)
+    knowledge.access_grants = await AccessGrants.set_access_grants('knowledge', id, form_data.access_grants, db=db)
 
     return KnowledgeFilesResponse(
-        **Knowledges.get_knowledge_by_id(id=id, db=db).model_dump(),
-        files=Knowledges.get_file_metadatas_by_id(id, db=db),
+        **knowledge.model_dump(),
+        files=await Knowledges.get_file_metadatas_by_id(id, db=db),
     )
 
 
@@ -562,9 +561,9 @@ async def get_knowledge_files_by_id(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -574,7 +573,7 @@ async def get_knowledge_files_by_id(
     if not (
         user.role == 'admin'
         or knowledge.user_id == user.id
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -602,7 +601,7 @@ async def get_knowledge_files_by_id(
     if direction:
         filter['direction'] = direction
 
-    return Knowledges.search_files_by_id(id, user.id, filter=filter, skip=skip, limit=limit, db=db)
+    return await Knowledges.search_files_by_id(id, user.id, filter=filter, skip=skip, limit=limit, db=db)
 
 
 ############################
@@ -615,14 +614,14 @@ class KnowledgeFileIdForm(BaseModel):
 
 
 @router.post('/{id}/file/add', response_model=Optional[KnowledgeFilesResponse])
-def add_file_to_knowledge_by_id(
+async def add_file_to_knowledge_by_id(
     request: Request,
     id: str,
     form_data: KnowledgeFileIdForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -631,7 +630,7 @@ def add_file_to_knowledge_by_id(
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -645,7 +644,7 @@ def add_file_to_knowledge_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    file = Files.get_file_by_id(form_data.file_id, db=db)
+    file = await Files.get_file_by_id(form_data.file_id, db=db)
     if not file:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -659,7 +658,7 @@ def add_file_to_knowledge_by_id(
 
     # Add content to the vector database
     try:
-        process_file(
+        await process_file(
             request,
             ProcessFileForm(file_id=form_data.file_id, collection_name=id),
             user=user,
@@ -667,7 +666,7 @@ def add_file_to_knowledge_by_id(
         )
 
         # Add file to knowledge base
-        Knowledges.add_file_to_knowledge_by_id(knowledge_id=id, file_id=form_data.file_id, user_id=user.id, db=db)
+        await Knowledges.add_file_to_knowledge_by_id(knowledge_id=id, file_id=form_data.file_id, user_id=user.id, db=db)
     except Exception as e:
         log.debug(e)
         raise HTTPException(
@@ -678,7 +677,7 @@ def add_file_to_knowledge_by_id(
     if knowledge:
         return KnowledgeFilesResponse(
             **knowledge.model_dump(),
-            files=Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
+            files=await Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
         )
     else:
         raise HTTPException(
@@ -688,14 +687,14 @@ def add_file_to_knowledge_by_id(
 
 
 @router.post('/{id}/file/update', response_model=Optional[KnowledgeFilesResponse])
-def update_file_from_knowledge_by_id(
+async def update_file_from_knowledge_by_id(
     request: Request,
     id: str,
     form_data: KnowledgeFileIdForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -704,7 +703,7 @@ def update_file_from_knowledge_by_id(
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -718,7 +717,7 @@ def update_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    file = Files.get_file_by_id(form_data.file_id, db=db)
+    file = await Files.get_file_by_id(form_data.file_id, db=db)
     if not file:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -726,18 +725,18 @@ def update_file_from_knowledge_by_id(
         )
 
     # Validate the file actually belongs to this knowledge base
-    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+    if not await Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
     # Remove content from the vector database
-    VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': form_data.file_id})
+    await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=knowledge.id, filter={'file_id': form_data.file_id})
 
     # Add content to the vector database
     try:
-        process_file(
+        await process_file(
             request,
             ProcessFileForm(file_id=form_data.file_id, collection_name=id),
             user=user,
@@ -752,7 +751,7 @@ def update_file_from_knowledge_by_id(
     if knowledge:
         return KnowledgeFilesResponse(
             **knowledge.model_dump(),
-            files=Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
+            files=await Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
         )
     else:
         raise HTTPException(
@@ -767,14 +766,14 @@ def update_file_from_knowledge_by_id(
 
 
 @router.post('/{id}/file/remove', response_model=Optional[KnowledgeFilesResponse])
-def remove_file_from_knowledge_by_id(
+async def remove_file_from_knowledge_by_id(
     id: str,
     form_data: KnowledgeFileIdForm,
     delete_file: bool = Query(True),
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -783,7 +782,7 @@ def remove_file_from_knowledge_by_id(
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -797,7 +796,7 @@ def remove_file_from_knowledge_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    file = Files.get_file_by_id(form_data.file_id, db=db)
+    file = await Files.get_file_by_id(form_data.file_id, db=db)
     if not file:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -805,21 +804,21 @@ def remove_file_from_knowledge_by_id(
         )
 
     # Validate the file actually belongs to this knowledge base
-    if not Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
+    if not await Knowledges.has_file(knowledge_id=id, file_id=form_data.file_id, db=db):
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    Knowledges.remove_file_from_knowledge_by_id(knowledge_id=id, file_id=form_data.file_id, db=db)
+    await Knowledges.remove_file_from_knowledge_by_id(knowledge_id=id, file_id=form_data.file_id, db=db)
 
     # Remove content from the vector database
     try:
-        VECTOR_DB_CLIENT.delete(
+        await ASYNC_VECTOR_DB_CLIENT.delete(
             collection_name=knowledge.id, filter={'file_id': form_data.file_id}
         )  # Remove by file_id first
 
-        VECTOR_DB_CLIENT.delete(
+        await ASYNC_VECTOR_DB_CLIENT.delete(
             collection_name=knowledge.id, filter={'hash': file.hash}
         )  # Remove by hash as well in case of duplicates
     except Exception as e:
@@ -827,24 +826,28 @@ def remove_file_from_knowledge_by_id(
         log.debug(e)
         pass
 
-    if delete_file:
+    # Only the file owner or an admin may permanently delete the underlying
+    # file.  Collaborators with KB write access can unlink a file from the
+    # knowledge base but must not be able to destroy files they do not own,
+    # as the same file may be referenced by other KBs and chats.
+    if delete_file and (file.user_id == user.id or user.role == 'admin'):
         try:
             # Remove the file's collection from vector database
             file_collection = f'file-{form_data.file_id}'
-            if VECTOR_DB_CLIENT.has_collection(collection_name=file_collection):
-                VECTOR_DB_CLIENT.delete_collection(collection_name=file_collection)
+            if await ASYNC_VECTOR_DB_CLIENT.has_collection(collection_name=file_collection):
+                await ASYNC_VECTOR_DB_CLIENT.delete_collection(collection_name=file_collection)
         except Exception as e:
             log.debug('This was most likely caused by bypassing embedding processing')
             log.debug(e)
             pass
 
         # Delete file from database
-        Files.delete_file_by_id(form_data.file_id, db=db)
+        await Files.delete_file_by_id(form_data.file_id, db=db)
 
     if knowledge:
         return KnowledgeFilesResponse(
             **knowledge.model_dump(),
-            files=Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
+            files=await Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
         )
     else:
         raise HTTPException(
@@ -859,8 +862,10 @@ def remove_file_from_knowledge_by_id(
 
 
 @router.delete('/{id}/delete', response_model=bool)
-async def delete_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+async def delete_knowledge_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -869,7 +874,7 @@ async def delete_knowledge_by_id(id: str, user=Depends(get_verified_user), db: S
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -886,7 +891,7 @@ async def delete_knowledge_by_id(id: str, user=Depends(get_verified_user), db: S
     log.info(f'Deleting knowledge base: {id} (name: {knowledge.name})')
 
     # Get all models
-    models = Models.get_all_models(db=db)
+    models = await Models.get_all_models(db=db)
     log.info(f'Found {len(models)} models to check for knowledge base {id}')
 
     # Update models that reference this knowledge base
@@ -900,29 +905,20 @@ async def delete_knowledge_by_id(id: str, user=Depends(get_verified_user), db: S
             if len(updated_knowledge) != len(knowledge_list):
                 log.info(f'Updating model {model.id} to remove knowledge base {id}')
                 model.meta.knowledge = updated_knowledge
-                # Create a ModelForm for the update
-                model_form = ModelForm(
-                    id=model.id,
-                    name=model.name,
-                    base_model_id=model.base_model_id,
-                    meta=model.meta,
-                    params=model.params,
-                    access_grants=model.access_grants,
-                    is_active=model.is_active,
-                )
-                Models.update_model_by_id(model.id, model_form, db=db)
+                model_form = ModelForm(**model.model_dump())
+                await Models.update_model_by_id(model.id, model_form, db=db)
 
     # Clean up vector DB
     try:
-        VECTOR_DB_CLIENT.delete_collection(collection_name=id)
+        await ASYNC_VECTOR_DB_CLIENT.delete_collection(collection_name=id)
     except Exception as e:
         log.debug(e)
         pass
 
     # Remove knowledge base embedding
-    remove_knowledge_base_metadata_embedding(id)
+    await remove_knowledge_base_metadata_embedding(id)
 
-    result = Knowledges.delete_knowledge_by_id(id=id, db=db)
+    result = await Knowledges.delete_knowledge_by_id(id=id, db=db)
     return result
 
 
@@ -932,8 +928,10 @@ async def delete_knowledge_by_id(id: str, user=Depends(get_verified_user), db: S
 
 
 @router.post('/{id}/reset', response_model=Optional[KnowledgeResponse])
-async def reset_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+async def reset_knowledge_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -942,7 +940,7 @@ async def reset_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Se
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -957,12 +955,12 @@ async def reset_knowledge_by_id(id: str, user=Depends(get_verified_user), db: Se
         )
 
     try:
-        VECTOR_DB_CLIENT.delete_collection(collection_name=id)
+        await ASYNC_VECTOR_DB_CLIENT.delete_collection(collection_name=id)
     except Exception as e:
         log.debug(e)
         pass
 
-    knowledge = Knowledges.reset_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.reset_knowledge_by_id(id=id, db=db)
     return knowledge
 
 
@@ -977,12 +975,12 @@ async def add_files_to_knowledge_batch(
     id: str,
     form_data: list[KnowledgeFileIdForm],
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """
     Add multiple files to a knowledge base
     """
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -991,7 +989,7 @@ async def add_files_to_knowledge_batch(
 
     if (
         knowledge.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge.id,
@@ -1008,7 +1006,7 @@ async def add_files_to_knowledge_batch(
     # Batch-fetch all files to avoid N+1 queries
     log.info(f'files/batch/add - {len(form_data)} files')
     file_ids = [form.file_id for form in form_data]
-    files = Files.get_files_by_ids(file_ids, db=db)
+    files = await Files.get_files_by_ids(file_ids, db=db)
 
     # Verify all requested files were found
     found_ids = {file.id for file in files}
@@ -1034,14 +1032,14 @@ async def add_files_to_knowledge_batch(
     # Only add files that were successfully processed
     successful_file_ids = [r.file_id for r in result.results if r.status == 'completed']
     for file_id in successful_file_ids:
-        Knowledges.add_file_to_knowledge_by_id(knowledge_id=id, file_id=file_id, user_id=user.id, db=db)
+        await Knowledges.add_file_to_knowledge_by_id(knowledge_id=id, file_id=file_id, user_id=user.id, db=db)
 
     # If there were any errors, include them in the response
     if result.errors:
         error_details = [f'{err.file_id}: {err.error}' for err in result.errors]
         return KnowledgeFilesResponse(
             **knowledge.model_dump(),
-            files=Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
+            files=await Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
             warnings={
                 'message': 'Some files failed to process',
                 'errors': error_details,
@@ -1050,7 +1048,7 @@ async def add_files_to_knowledge_batch(
 
     return KnowledgeFilesResponse(
         **knowledge.model_dump(),
-        files=Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
+        files=await Knowledges.get_file_metadatas_by_id(knowledge.id, db=db),
     )
 
 
@@ -1060,20 +1058,20 @@ async def add_files_to_knowledge_batch(
 
 
 @router.get('/{id}/export')
-async def export_knowledge_by_id(id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
+async def export_knowledge_by_id(id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
     """
     Export a knowledge base as a zip file containing .txt files.
     Admin only.
     """
 
-    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)
+    knowledge = await Knowledges.get_knowledge_by_id(id=id, db=db)
     if not knowledge:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    files = Knowledges.get_files_by_id(id, db=db)
+    files = await Knowledges.get_files_by_id(id, db=db)
 
     # Create zip file in memory
     zip_buffer = io.BytesIO()

backend/open_webui/routers/memories.py

@@ -5,10 +5,10 @@ import asyncio
 from typing import Optional
 
 from open_webui.models.memories import Memories, MemoryModel
-from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
+from open_webui.retrieval.vector.async_client import ASYNC_VECTOR_DB_CLIENT
 from open_webui.utils.auth import get_verified_user
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from open_webui.utils.access_control import has_permission
 from open_webui.constants import ERROR_MESSAGES
@@ -29,7 +29,7 @@ router = APIRouter()
 async def get_memories(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not request.app.state.config.ENABLE_MEMORIES:
         raise HTTPException(
@@ -37,13 +37,13 @@ async def get_memories(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    return Memories.get_memories_by_user_id(user.id, db=db)
+    return await Memories.get_memories_by_user_id(user.id, db=db)
 
 
 ############################
@@ -65,7 +65,7 @@ async def add_memory(
     form_data: AddMemoryForm,
     user=Depends(get_verified_user),
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations (insert_new_memory) manage their own short-lived sessions.
     # This prevents holding a connection during EMBEDDING_FUNCTION()
     # which makes external embedding API calls (1-5+ seconds).
@@ -75,17 +75,17 @@ async def add_memory(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    memory = Memories.insert_new_memory(user.id, form_data.content)
+    memory = await Memories.insert_new_memory(user.id, form_data.content)
 
     vector = await request.app.state.EMBEDDING_FUNCTION(memory.content, user=user)
 
-    VECTOR_DB_CLIENT.upsert(
+    await ASYNC_VECTOR_DB_CLIENT.upsert(
         collection_name=f'user-memory-{user.id}',
         items=[
             {
@@ -116,7 +116,7 @@ async def query_memory(
     form_data: QueryMemoryForm,
     user=Depends(get_verified_user),
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations (get_memories_by_user_id) manage their own short-lived sessions.
     # This prevents holding a connection during EMBEDDING_FUNCTION()
     # which makes external embedding API calls (1-5+ seconds).
@@ -126,24 +126,56 @@ async def query_memory(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    memories = Memories.get_memories_by_user_id(user.id)
+    memories = await Memories.get_memories_by_user_id(user.id)
     if not memories:
         raise HTTPException(status_code=404, detail='No memories found for user')
 
     vector = await request.app.state.EMBEDDING_FUNCTION(form_data.content, user=user)
 
-    results = VECTOR_DB_CLIENT.search(
+    results = await ASYNC_VECTOR_DB_CLIENT.search(
         collection_name=f'user-memory-{user.id}',
         vectors=[vector],
         limit=form_data.k,
     )
 
+    # Filter results by relevance threshold to avoid returning unrelated
+    # memories.  Vector similarity search always returns the top-K nearest
+    # neighbours even when they are completely irrelevant; applying the
+    # same RELEVANCE_THRESHOLD used by RAG ensures only genuinely matching
+    # memories are surfaced (distances are normalised to 0→1, higher is
+    # better).
+    relevance_threshold = getattr(request.app.state.config, 'RELEVANCE_THRESHOLD', 0.0)
+    if results and relevance_threshold > 0.0 and results.distances and results.distances[0]:
+        from open_webui.retrieval.vector.main import SearchResult
+
+        filtered_ids = []
+        filtered_docs = []
+        filtered_metas = []
+        filtered_dists = []
+
+        for idx, score in enumerate(results.distances[0]):
+            if score >= relevance_threshold:
+                if results.ids and results.ids[0]:
+                    filtered_ids.append(results.ids[0][idx])
+                if results.documents and results.documents[0]:
+                    filtered_docs.append(results.documents[0][idx])
+                if results.metadatas and results.metadatas[0]:
+                    filtered_metas.append(results.metadatas[0][idx])
+                filtered_dists.append(score)
+
+        results = SearchResult(
+            ids=[filtered_ids] if filtered_ids else [[]],
+            documents=[filtered_docs] if filtered_docs else [[]],
+            metadatas=[filtered_metas] if filtered_metas else [[]],
+            distances=[filtered_dists] if filtered_dists else [[]],
+        )
+
     return results
 
 
@@ -157,7 +189,7 @@ async def reset_memory_from_vector_db(
 ):
     """Reset user's memory vector embeddings.
 
-    CRITICAL: We intentionally do NOT use Depends(get_session) here.
+    CRITICAL: We intentionally do NOT use Depends(get_async_session) here.
     This endpoint generates embeddings for ALL user memories in parallel using
     asyncio.gather(). A user with 100 memories would trigger 100 embedding API
     calls simultaneously. With a session held, this could block a connection
@@ -169,22 +201,22 @@ async def reset_memory_from_vector_db(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    VECTOR_DB_CLIENT.delete_collection(f'user-memory-{user.id}')
+    await ASYNC_VECTOR_DB_CLIENT.delete_collection(f'user-memory-{user.id}')
 
-    memories = Memories.get_memories_by_user_id(user.id)
+    memories = await Memories.get_memories_by_user_id(user.id)
 
     # Generate vectors in parallel
     vectors = await asyncio.gather(
         *[request.app.state.EMBEDDING_FUNCTION(memory.content, user=user) for memory in memories]
     )
 
-    VECTOR_DB_CLIENT.upsert(
+    await ASYNC_VECTOR_DB_CLIENT.upsert(
         collection_name=f'user-memory-{user.id}',
         items=[
             {
@@ -212,7 +244,7 @@ async def reset_memory_from_vector_db(
 async def delete_memory_by_user_id(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not request.app.state.config.ENABLE_MEMORIES:
         raise HTTPException(
@@ -220,17 +252,17 @@ async def delete_memory_by_user_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    result = Memories.delete_memories_by_user_id(user.id, db=db)
+    result = await Memories.delete_memories_by_user_id(user.id, db=db)
 
     if result:
         try:
-            VECTOR_DB_CLIENT.delete_collection(f'user-memory-{user.id}')
+            await ASYNC_VECTOR_DB_CLIENT.delete_collection(f'user-memory-{user.id}')
         except Exception as e:
             log.error(e)
         return True
@@ -250,7 +282,7 @@ async def update_memory_by_id(
     form_data: MemoryUpdateModel,
     user=Depends(get_verified_user),
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations (update_memory_by_id_and_user_id) manage their own
     # short-lived sessions. This prevents holding a connection during
     # EMBEDDING_FUNCTION() which makes external API calls (1-5+ seconds).
@@ -260,20 +292,20 @@ async def update_memory_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    memory = Memories.update_memory_by_id_and_user_id(memory_id, user.id, form_data.content)
+    memory = await Memories.update_memory_by_id_and_user_id(memory_id, user.id, form_data.content)
     if memory is None:
-        raise HTTPException(status_code=404, detail='Memory not found')
+        raise HTTPException(status_code=404, detail=ERROR_MESSAGES.NOT_FOUND)
 
     if form_data.content is not None:
         vector = await request.app.state.EMBEDDING_FUNCTION(memory.content, user=user)
 
-        VECTOR_DB_CLIENT.upsert(
+        await ASYNC_VECTOR_DB_CLIENT.upsert(
             collection_name=f'user-memory-{user.id}',
             items=[
                 {
@@ -301,7 +333,7 @@ async def delete_memory_by_id(
     memory_id: str,
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not request.app.state.config.ENABLE_MEMORIES:
         raise HTTPException(
@@ -309,16 +341,16 @@ async def delete_memory_by_id(
             detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
-    if not has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
+    if not await has_permission(user.id, 'features.memories', request.app.state.config.USER_PERMISSIONS):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    result = Memories.delete_memory_by_id_and_user_id(memory_id, user.id, db=db)
+    result = await Memories.delete_memory_by_id_and_user_id(memory_id, user.id, db=db)
 
     if result:
-        VECTOR_DB_CLIENT.delete(collection_name=f'user-memory-{user.id}', ids=[memory_id])
+        await ASYNC_VECTOR_DB_CLIENT.delete(collection_name=f'user-memory-{user.id}', ids=[memory_id])
         return True
 
     return False

backend/open_webui/routers/models.py

@@ -35,8 +35,8 @@ from fastapi.responses import FileResponse, StreamingResponse
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.access_control import has_permission, filter_allowed_access_grants
 from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL, STATIC_DIR
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
@@ -66,7 +66,7 @@ async def get_models(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -86,7 +86,7 @@ async def get_models(
         filter['direction'] = direction
 
     # Pre-fetch user group IDs once - used for both filter and write_access check
-    groups = Groups.get_groups_by_member_id(user.id, db=db)
+    groups = await Groups.get_groups_by_member_id(user.id, db=db)
     user_group_ids = {group.id for group in groups}
 
     if not user.role == 'admin' or not BYPASS_ADMIN_ACCESS_CONTROL:
@@ -95,11 +95,11 @@ async def get_models(
 
         filter['user_id'] = user.id
 
-    result = Models.search_models(user.id, filter=filter, skip=skip, limit=limit, db=db)
+    result = await Models.search_models(user.id, filter=filter, skip=skip, limit=limit, db=db)
 
     # Batch-fetch writable model IDs in a single query instead of N has_access calls
     model_ids = [model.id for model in result.items]
-    writable_model_ids = AccessGrants.get_accessible_resource_ids(
+    writable_model_ids = await AccessGrants.get_accessible_resource_ids(
         user_id=user.id,
         resource_type='model',
         resource_ids=model_ids,
@@ -130,8 +130,8 @@ async def get_models(
 
 
 @router.get('/base', response_model=list[ModelResponse])
-async def get_base_models(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    return Models.get_base_models(db=db)
+async def get_base_models(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    return await Models.get_base_models(db=db)
 
 
 ###########################
@@ -140,11 +140,11 @@ async def get_base_models(user=Depends(get_admin_user), db: Session = Depends(ge
 
 
 @router.get('/tags', response_model=list[str])
-async def get_model_tags(user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def get_model_tags(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        models = Models.get_models(db=db)
+        models = await Models.get_models(db=db)
     else:
-        models = Models.get_models_by_user_id(user.id, db=db)
+        models = await Models.get_models_by_user_id(user.id, db=db)
 
     tags_set = set()
     for model in models:
@@ -172,9 +172,9 @@ async def create_new_model(
     request: Request,
     form_data: ModelForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'workspace.models', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -182,7 +182,7 @@ async def create_new_model(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    model = Models.get_model_by_id(form_data.id, db=db)
+    model = await Models.get_model_by_id(form_data.id, db=db)
     if model:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -196,7 +196,15 @@ async def create_new_model(
         )
 
     else:
-        model = Models.insert_new_model(form_data, user.id, db=db)
+        form_data.access_grants = await filter_allowed_access_grants(
+            request.app.state.config.USER_PERMISSIONS,
+            user.id,
+            user.role,
+            form_data.access_grants,
+            'sharing.public_models',
+        )
+
+        model = await Models.insert_new_model(form_data, user.id, db=db)
         if model:
             return model
         else:
@@ -215,9 +223,9 @@ async def create_new_model(
 async def export_models(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id,
         'workspace.models_export',
         request.app.state.config.USER_PERMISSIONS,
@@ -229,9 +237,9 @@ async def export_models(
         )
 
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        return Models.get_models(db=db)
+        return await Models.get_models(db=db)
     else:
-        return Models.get_models_by_user_id(user.id, db=db)
+        return await Models.get_models_by_user_id(user.id, db=db)
 
 
 ############################
@@ -248,9 +256,9 @@ async def import_models(
     request: Request,
     user=Depends(get_verified_user),
     form_data: ModelsImportForm = (...),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id,
         'workspace.models_import',
         request.app.state.config.USER_PERMISSIONS,
@@ -270,28 +278,75 @@ async def import_models(
                 if model_data.get('id') and is_valid_model_id(model_data.get('id'))
             ]
             existing_models = {
-                model.id: model for model in (Models.get_models_by_ids(model_ids, db=db) if model_ids else [])
+                model.id: model for model in (await Models.get_models_by_ids(model_ids, db=db) if model_ids else [])
             }
 
+            # Batch-resolve write permissions in one query instead of
+            # per-model has_access calls (N+1 avoidance).
+            existing_model_ids = list(existing_models.keys())
+            if user.role != 'admin' and existing_model_ids:
+                groups = await Groups.get_groups_by_member_id(user.id, db=db)
+                user_group_ids = {group.id for group in groups}
+                writable_model_ids = await AccessGrants.get_accessible_resource_ids(
+                    user_id=user.id,
+                    resource_type='model',
+                    resource_ids=existing_model_ids,
+                    permission='write',
+                    user_group_ids=user_group_ids,
+                    db=db,
+                )
+            else:
+                writable_model_ids = set(existing_model_ids)
+
             for model_data in data:
-                # Here, you can add logic to validate model_data if needed
                 model_id = model_data.get('id')
 
                 if model_id and is_valid_model_id(model_id):
                     existing_model = existing_models.get(model_id)
                     if existing_model:
+                        # Enforce ownership/write-access before allowing overwrite
+                        if (
+                            user.role != 'admin'
+                            and existing_model.user_id != user.id
+                            and model_id not in writable_model_ids
+                        ):
+                            log.warning(
+                                'import_models: user %s skipped model %s (no write access)',
+                                user.id,
+                                model_id,
+                            )
+                            continue
+
                         # Update existing model
                         model_data['meta'] = model_data.get('meta', {})
                         model_data['params'] = model_data.get('params', {})
 
                         updated_model = ModelForm(**{**existing_model.model_dump(), **model_data})
-                        Models.update_model_by_id(model_id, updated_model, db=db)
+                        # Only filter access_grants when explicitly provided
+                        # in the payload to avoid altering existing ACLs on
+                        # metadata-only imports.
+                        if 'access_grants' in model_data:
+                            updated_model.access_grants = await filter_allowed_access_grants(
+                                request.app.state.config.USER_PERMISSIONS,
+                                user.id,
+                                user.role,
+                                updated_model.access_grants,
+                                'sharing.public_models',
+                            )
+                        await Models.update_model_by_id(model_id, updated_model, db=db)
                     else:
                         # Insert new model
                         model_data['meta'] = model_data.get('meta', {})
                         model_data['params'] = model_data.get('params', {})
                         new_model = ModelForm(**model_data)
-                        Models.insert_new_model(user_id=user.id, form_data=new_model, db=db)
+                        new_model.access_grants = await filter_allowed_access_grants(
+                            request.app.state.config.USER_PERMISSIONS,
+                            user.id,
+                            user.role,
+                            new_model.access_grants,
+                            'sharing.public_models',
+                        )
+                        await Models.insert_new_model(user_id=user.id, form_data=new_model, db=db)
             return True
         else:
             raise HTTPException(status_code=400, detail='Invalid JSON format')
@@ -314,9 +369,9 @@ async def sync_models(
     request: Request,
     form_data: SyncModelsForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    return Models.sync_models(user.id, form_data.models, db=db)
+    return await Models.sync_models(user.id, form_data.models, db=db)
 
 
 ###########################
@@ -330,13 +385,13 @@ class ModelIdForm(BaseModel):
 
 # Note: We're not using the typical url path param here, but instead using a query parameter to allow '/' in the id
 @router.get('/model', response_model=Optional[ModelAccessResponse])
-async def get_model_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    model = Models.get_model_by_id(id, db=db)
+async def get_model_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    model = await Models.get_model_by_id(id, db=db)
     if model:
         if (
             (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
             or model.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='model',
                 resource_id=model.id,
@@ -349,7 +404,7 @@ async def get_model_by_id(id: str, user=Depends(get_verified_user), db: Session
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == model.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='model',
                         resource_id=model.id,
@@ -376,8 +431,12 @@ async def get_model_by_id(id: str, user=Depends(get_verified_user), db: Session
 
 
 @router.get('/model/profile/image')
-def get_model_profile_image(id: str, user=Depends(get_verified_user)):
-    model = Models.get_model_by_id(id)
+async def get_model_profile_image(
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    model = await Models.get_model_by_id(id, db=db)
 
     if model:
         etag = f'"{model.updated_at}"' if model.updated_at else None
@@ -418,13 +477,13 @@ def get_model_profile_image(id: str, user=Depends(get_verified_user)):
 
 
 @router.post('/model/toggle', response_model=Optional[ModelResponse])
-async def toggle_model_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    model = Models.get_model_by_id(id, db=db)
+async def toggle_model_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    model = await Models.get_model_by_id(id, db=db)
     if model:
         if (
             user.role == 'admin'
             or model.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='model',
                 resource_id=model.id,
@@ -432,7 +491,7 @@ async def toggle_model_by_id(id: str, user=Depends(get_verified_user), db: Sessi
                 db=db,
             )
         ):
-            model = Models.toggle_model_by_id(id, db=db)
+            model = await Models.toggle_model_by_id(id, db=db)
 
             if model:
                 return model
@@ -460,11 +519,12 @@ async def toggle_model_by_id(id: str, user=Depends(get_verified_user), db: Sessi
 
 @router.post('/model/update', response_model=Optional[ModelModel])
 async def update_model_by_id(
+    request: Request,
     form_data: ModelForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    model = Models.get_model_by_id(form_data.id, db=db)
+    model = await Models.get_model_by_id(form_data.id, db=db)
     if not model:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -473,7 +533,7 @@ async def update_model_by_id(
 
     if (
         model.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='model',
             resource_id=model.id,
@@ -487,7 +547,15 @@ async def update_model_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    model = Models.update_model_by_id(form_data.id, ModelForm(**form_data.model_dump()), db=db)
+    form_data.access_grants = await filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_models',
+    )
+
+    model = await Models.update_model_by_id(form_data.id, ModelForm(**form_data.model_dump()), db=db)
     return model
 
 
@@ -507,9 +575,9 @@ async def update_model_access_by_id(
     request: Request,
     form_data: ModelAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    model = Models.get_model_by_id(form_data.id, db=db)
+    model = await Models.get_model_by_id(form_data.id, db=db)
 
     # Non-preset models (e.g. direct Ollama/OpenAI models) may not have a DB
     # entry yet. Create a minimal one so access grants can be stored.
@@ -519,7 +587,7 @@ async def update_model_access_by_id(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
             )
-        model = Models.insert_new_model(
+        model = await Models.insert_new_model(
             ModelForm(
                 id=form_data.id,
                 name=form_data.name or form_data.id,
@@ -537,7 +605,7 @@ async def update_model_access_by_id(
 
     if (
         model.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='model',
             resource_id=model.id,
@@ -551,7 +619,7 @@ async def update_model_access_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -559,9 +627,11 @@ async def update_model_access_by_id(
         'sharing.public_models',
     )
 
-    AccessGrants.set_access_grants('model', form_data.id, form_data.access_grants, db=db)
+    await AccessGrants.set_access_grants('model', form_data.id, form_data.access_grants, db=db)
 
-    return Models.get_model_by_id(form_data.id, db=db)
+    await Models.update_model_updated_at_by_id(form_data.id, db=db)
+
+    return await Models.get_model_by_id(form_data.id, db=db)
 
 
 ############################
@@ -573,9 +643,9 @@ async def update_model_access_by_id(
 async def delete_model_by_id(
     form_data: ModelIdForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    model = Models.get_model_by_id(form_data.id, db=db)
+    model = await Models.get_model_by_id(form_data.id, db=db)
     if not model:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -585,7 +655,7 @@ async def delete_model_by_id(
     if (
         user.role != 'admin'
         and model.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='model',
             resource_id=model.id,
@@ -598,11 +668,11 @@ async def delete_model_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    result = Models.delete_model_by_id(form_data.id, db=db)
+    result = await Models.delete_model_by_id(form_data.id, db=db)
     return result
 
 
 @router.delete('/delete/all', response_model=bool)
-async def delete_all_models(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    result = Models.delete_all_models(db=db)
+async def delete_all_models(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    result = await Models.delete_all_models(db=db)
     return result

backend/open_webui/routers/notes.py

@@ -34,8 +34,8 @@ from open_webui.utils.access_control import (
     filter_allowed_access_grants,
 )
 from open_webui.models.access_grants import AccessGrants
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
@@ -58,6 +58,7 @@ class NoteItemResponse(BaseModel):
     id: str
     title: str
     data: Optional[dict]
+    is_pinned: Optional[bool] = False
     updated_at: int
     created_at: int
     user: Optional[UserResponse] = None
@@ -68,9 +69,9 @@ async def get_notes(
     request: Request,
     page: Optional[int] = None,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -84,12 +85,51 @@ async def get_notes(
         limit = 60
         skip = (page - 1) * limit
 
-    notes = Notes.get_notes_by_user_id(user.id, 'read', skip=skip, limit=limit, db=db)
+    notes = await Notes.get_notes_by_user_id(user.id, 'read', skip=skip, limit=limit, db=db)
     if not notes:
         return []
 
     user_ids = list(set(note.user_id for note in notes))
-    users = {user.id: user for user in Users.get_users_by_user_ids(user_ids, db=db)}
+    users = {user.id: user for user in await Users.get_users_by_user_ids(user_ids, db=db)}
+
+    return [
+        NoteUserResponse(
+            **{
+                **note.model_dump(),
+                'data': _truncate_note_data(note.data),
+                'user': UserResponse(**users[note.user_id].model_dump()),
+            }
+        )
+        for note in notes
+        if note.user_id in users
+    ]
+
+
+############################
+# GetPinnedNotes
+############################
+
+
+@router.get('/pinned', response_model=list[NoteItemResponse])
+async def get_pinned_notes(
+    request: Request,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+
+    notes = await Notes.get_pinned_notes_by_user_id(user.id, 'read', db=db)
+    if not notes:
+        return []
+
+    user_ids = list(set(note.user_id for note in notes))
+    users = {user.id: user for user in await Users.get_users_by_user_ids(user_ids, db=db)}
 
     return [
         NoteUserResponse(
@@ -114,9 +154,9 @@ async def search_notes(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -143,13 +183,13 @@ async def search_notes(
         filter['direction'] = direction
 
     if not user.role == 'admin' or not BYPASS_ADMIN_ACCESS_CONTROL:
-        groups = Groups.get_groups_by_member_id(user.id, db=db)
+        groups = await Groups.get_groups_by_member_id(user.id, db=db)
         if groups:
             filter['group_ids'] = [group.id for group in groups]
 
         filter['user_id'] = user.id
 
-    result = Notes.search_notes(user.id, filter, skip=skip, limit=limit, db=db)
+    result = await Notes.search_notes(user.id, filter, skip=skip, limit=limit, db=db)
     for note in result.items:
         note.data = _truncate_note_data(note.data)
     return result
@@ -165,9 +205,9 @@ async def create_new_note(
     request: Request,
     form_data: NoteForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -175,8 +215,17 @@ async def create_new_note(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
+    form_data.access_grants = await filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_notes',
+        db=db,
+    )
+
     try:
-        note = Notes.insert_new_note(user.id, form_data, db=db)
+        note = await Notes.insert_new_note(user.id, form_data, db=db)
         return note
     except Exception as e:
         log.exception(e)
@@ -197,9 +246,9 @@ async def get_note_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -207,14 +256,14 @@ async def get_note_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    note = Notes.get_note_by_id(id, db=db)
+    note = await Notes.get_note_by_id(id, db=db)
     if not note:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
 
     if user.role != 'admin' and (
         user.id != note.user_id
         and (
-            not AccessGrants.has_access(
+            not await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='note',
                 resource_id=note.id,
@@ -228,7 +277,7 @@ async def get_note_by_id(
     write_access = (
         user.role == 'admin'
         or (user.id == note.user_id)
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='note',
             resource_id=note.id,
@@ -252,9 +301,9 @@ async def update_note_by_id(
     id: str,
     form_data: NoteForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -262,13 +311,13 @@ async def update_note_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    note = Notes.get_note_by_id(id, db=db)
+    note = await Notes.get_note_by_id(id, db=db)
     if not note:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
 
     if user.role != 'admin' and (
         user.id != note.user_id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='note',
             resource_id=note.id,
@@ -278,7 +327,7 @@ async def update_note_by_id(
     ):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -288,7 +337,7 @@ async def update_note_by_id(
     )
 
     try:
-        note = Notes.update_note_by_id(id, form_data, db=db)
+        note = await Notes.update_note_by_id(id, form_data, db=db)
         await sio.emit(
             'note-events',
             note.model_dump(),
@@ -316,9 +365,9 @@ async def update_note_access_by_id(
     id: str,
     form_data: NoteAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -326,13 +375,13 @@ async def update_note_access_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    note = Notes.get_note_by_id(id, db=db)
+    note = await Notes.get_note_by_id(id, db=db)
     if not note:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
 
     if user.role != 'admin' and (
         user.id != note.user_id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='note',
             resource_id=note.id,
@@ -342,7 +391,7 @@ async def update_note_access_by_id(
     ):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -350,9 +399,49 @@ async def update_note_access_by_id(
         'sharing.public_notes',
     )
 
-    AccessGrants.set_access_grants('note', id, form_data.access_grants, db=db)
+    await AccessGrants.set_access_grants('note', id, form_data.access_grants, db=db)
 
-    return Notes.get_note_by_id(id, db=db)
+    return await Notes.get_note_by_id(id, db=db)
+
+
+############################
+# PinNoteById
+############################
+
+
+@router.post('/{id}/pin', response_model=Optional[NoteModel])
+async def pin_note_by_id(
+    request: Request,
+    id: str,
+    user=Depends(get_verified_user),
+    db: AsyncSession = Depends(get_async_session),
+):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERROR_MESSAGES.UNAUTHORIZED,
+        )
+
+    note = await Notes.get_note_by_id(id, db=db)
+    if not note:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
+
+    if user.role != 'admin' and (
+        user.id != note.user_id
+        and not await AccessGrants.has_access(
+            user_id=user.id,
+            resource_type='note',
+            resource_id=note.id,
+            permission='read',
+            db=db,
+        )
+    ):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
+
+    note = await Notes.toggle_note_pinned_by_id(id, db=db)
+    return note
 
 
 ############################
@@ -365,9 +454,9 @@ async def delete_note_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.notes', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -375,13 +464,13 @@ async def delete_note_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    note = Notes.get_note_by_id(id, db=db)
+    note = await Notes.get_note_by_id(id, db=db)
     if not note:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=ERROR_MESSAGES.NOT_FOUND)
 
     if user.role != 'admin' and (
         user.id != note.user_id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='note',
             resource_id=note.id,
@@ -392,7 +481,7 @@ async def delete_note_by_id(
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
 
     try:
-        note = Notes.delete_note_by_id(id, db=db)
+        note = await Notes.delete_note_by_id(id, db=db)
         return True
     except Exception as e:
         log.exception(e)

backend/open_webui/routers/openai.py

@@ -4,15 +4,15 @@ import json
 import logging
 import re
 from typing import Optional
-from urllib.parse import urlparse
+from urllib.parse import quote, urlparse
 
 import aiohttp
 from aiocache import cached
-import requests
+
 
 from azure.identity import DefaultAzureCredential, get_bearer_token_provider
 
-from fastapi import Depends, HTTPException, Request, APIRouter
+from fastapi import Depends, HTTPException, Request, APIRouter, status
 from fastapi.responses import (
     FileResponse,
     StreamingResponse,
@@ -21,13 +21,14 @@ from fastapi.responses import (
 )
 from pydantic import BaseModel, ConfigDict
 
-from sqlalchemy.orm import Session
+from sqlalchemy.ext.asyncio import AsyncSession
 
-from open_webui.internal.db import get_session
+from open_webui.internal.db import get_async_session
 
 from open_webui.models.models import Models
 from open_webui.models.access_grants import AccessGrants
 from open_webui.models.groups import Groups
+from open_webui.utils.access_control import has_connection_access, check_model_access
 from open_webui.config import (
     CACHE_DIR,
 )
@@ -39,6 +40,7 @@ from open_webui.env import (
     ENABLE_FORWARD_USER_INFO_HEADERS,
     FORWARD_SESSION_INFO_HEADER_CHAT_ID,
     BYPASS_MODEL_ACCESS_CONTROL,
+    ENABLE_OPENAI_API_PASSTHROUGH,
 )
 from open_webui.models.users import UserModel
 
@@ -50,9 +52,12 @@ from open_webui.utils.payload import (
     apply_system_prompt_to_body,
 )
 from open_webui.utils.misc import (
-    cleanup_response,
     convert_logit_bias_input_to_json,
     stream_chunks_handler,
+)
+from open_webui.utils.session_pool import (
+    cleanup_response,
+    get_session,
     stream_wrapper,
 )
 
@@ -307,19 +312,20 @@ async def speech(request: Request, user=Depends(get_verified_user)):
 
         r = None
         try:
-            r = requests.post(
+            session = await get_session()
+            r = await session.post(
                 url=f'{url}/audio/speech',
                 data=body,
                 headers=headers,
                 cookies=cookies,
-                stream=True,
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             )
 
             r.raise_for_status()
 
             # Save the streaming content to a file
             with open(file_path, 'wb') as f:
-                for chunk in r.iter_content(chunk_size=8192):
+                async for chunk in r.content.iter_chunked(8192):
                     f.write(chunk)
 
             with open(file_body_path, 'w') as f:
@@ -334,14 +340,14 @@ async def speech(request: Request, user=Depends(get_verified_user)):
             detail = None
             if r is not None:
                 try:
-                    res = r.json()
+                    res = await r.json()
                     if 'error' in res:
                         detail = f'External: {res["error"]}'
                 except Exception:
                     detail = f'External: {e}'
 
             raise HTTPException(
-                status_code=r.status_code if r else 500,
+                status_code=r.status if r else 500,
                 detail=detail if detail else 'Open WebUI: Server Connection Error',
             )
 
@@ -449,11 +455,11 @@ async def get_all_models_responses(request: Request, user: UserModel) -> list:
 async def get_filtered_models(models, user, db=None):
     # Filter models based on user access control
     model_ids = [model['id'] for model in models.get('data', [])]
-    model_infos = {model_info.id: model_info for model_info in Models.get_models_by_ids(model_ids, db=db)}
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id, db=db)}
+    model_infos = {model_info.id: model_info for model_info in await Models.get_models_by_ids(model_ids, db=db)}
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id, db=db)}
 
     # Batch-fetch accessible resource IDs in a single query instead of N has_access calls
-    accessible_model_ids = AccessGrants.get_accessible_resource_ids(
+    accessible_model_ids = await AccessGrants.get_accessible_resource_ids(
         user_id=user.id,
         resource_type='model',
         resource_ids=list(model_infos.keys()),
@@ -686,7 +692,7 @@ async def verify_connection(
             elif is_anthropic_url(url):
                 result = await get_anthropic_models(url, key)
                 if result is None:
-                    raise HTTPException(status_code=500, detail='Failed to connect to Anthropic API')
+                    raise HTTPException(status_code=500, detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR)
                 if 'error' in result:
                     raise HTTPException(status_code=500, detail=result['error'])
                 return result
@@ -713,10 +719,10 @@ async def verify_connection(
         except aiohttp.ClientError as e:
             # ClientError covers all aiohttp requests issues
             log.exception(f'Client error: {str(e)}')
-            raise HTTPException(status_code=500, detail='Open WebUI: Server Connection Error')
+            raise HTTPException(status_code=500, detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR)
         except Exception as e:
             log.exception(f'Unexpected error: {e}')
-            raise HTTPException(status_code=500, detail='Open WebUI: Server Connection Error')
+            raise HTTPException(status_code=500, detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR)
 
 
 def get_azure_allowed_params(api_version: str) -> set[str]:
@@ -771,6 +777,21 @@ def is_openai_new_model(model: str) -> bool:
     return False
 
 
+def _sanitize_model_for_url(model: str) -> str:
+    """Sanitize a model name before interpolating it into a URL path.
+
+    Rejects path traversal attempts (../, /, \\) and percent-encodes
+    the name so it is safe to use as a single URL path segment
+    (e.g. Azure deployment name).
+    """
+    if not model or '..' in model or '/' in model or '\\' in model:
+        raise HTTPException(
+            status_code=400,
+            detail='Invalid model name: must not be empty or contain path separators or traversal sequences',
+        )
+    return quote(model, safe='')
+
+
 def convert_to_azure_payload(url, payload: dict, api_version: str):
     model = payload.get('model', '')
 
@@ -794,6 +815,9 @@ def convert_to_azure_payload(url, payload: dict, api_version: str):
     # Filter out unsupported parameters
     payload = {k: v for k, v in payload.items() if k in allowed_params}
 
+    # Sanitize model name to prevent path traversal in the deployment URL
+    model = _sanitize_model_for_url(model)
+
     url = f'{url}/openai/deployments/{model}'
     return url, payload
 
@@ -1006,7 +1030,7 @@ async def generate_chat_completion(
     user=Depends(get_verified_user),
     bypass_system_prompt: bool = False,
 ):
-    # NOTE: We intentionally do NOT use Depends(get_session) here.
+    # NOTE: We intentionally do NOT use Depends(get_async_session) here.
     # Database operations (get_model_by_id, AccessGrants.has_access) manage their own short-lived sessions.
     # This prevents holding a connection during the entire LLM call (30-60+ seconds),
     # which would exhaust the connection pool under concurrent load.
@@ -1024,7 +1048,7 @@ async def generate_chat_completion(
     metadata = payload.pop('metadata', None)
 
     model_id = form_data.get('model')
-    model_info = Models.get_model_by_id(model_id)
+    model_info = await Models.get_model_by_id(model_id)
 
     # Check model info and override the payload
     if model_info:
@@ -1044,29 +1068,9 @@ async def generate_chat_completion(
             if not bypass_system_prompt:
                 payload = apply_system_prompt_to_body(system, payload, metadata, user)
 
-        # Check if user has access to the model
-        if not bypass_filter and user.role == 'user':
-            user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
-            if not (
-                user.id == model_info.user_id
-                or AccessGrants.has_access(
-                    user_id=user.id,
-                    resource_type='model',
-                    resource_id=model_info.id,
-                    permission='read',
-                    user_group_ids=user_group_ids,
-                )
-            ):
-                raise HTTPException(
-                    status_code=403,
-                    detail='Model not found',
-                )
-    elif not bypass_filter:
-        if user.role != 'admin':
-            raise HTTPException(
-                status_code=403,
-                detail='Model not found',
-            )
+        await check_model_access(user, model_info, bypass_filter)
+    else:
+        await check_model_access(user, None, bypass_filter)
 
     # Check if model is already in app state cache to avoid expensive get_all_models() call
     models = request.app.state.OPENAI_MODELS
@@ -1080,7 +1084,7 @@ async def generate_chat_completion(
     else:
         raise HTTPException(
             status_code=404,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Get the API config for the model
@@ -1131,21 +1135,31 @@ async def generate_chat_completion(
     is_responses = api_config.get('api_type') == 'responses'
 
     if api_config.get('azure', False):
-        api_version = api_config.get('api_version', '2023-03-15-preview')
-        request_url, payload = convert_to_azure_payload(url, payload, api_version)
-
         # Only set api-key header if not using Azure Entra ID authentication
         auth_type = api_config.get('auth_type', 'bearer')
         if auth_type not in ('azure_ad', 'microsoft_entra_id'):
             headers['api-key'] = key
 
-        headers['api-version'] = api_version
+        # Azure v1 format: base URL already ends with /openai/v1,
+        # model stays in the payload, no deployment URL rewriting.
+        is_azure_v1 = bool(re.search(r'/openai/v1(?:/|$)', url))
 
-        if is_responses:
-            payload = convert_to_responses_payload(payload)
-            request_url = f'{request_url}/responses?api-version={api_version}'
+        if is_azure_v1:
+            if is_responses:
+                payload = convert_to_responses_payload(payload)
+                request_url = f'{url.rstrip("/")}/responses'
+            else:
+                request_url = f'{url.rstrip("/")}/chat/completions'
         else:
-            request_url = f'{request_url}/chat/completions?api-version={api_version}'
+            api_version = api_config.get('api_version', '2023-03-15-preview')
+            request_url, payload = convert_to_azure_payload(url, payload, api_version)
+            headers['api-version'] = api_version
+
+            if is_responses:
+                payload = convert_to_responses_payload(payload)
+                request_url = f'{request_url}/responses?api-version={api_version}'
+            else:
+                request_url = f'{request_url}/chat/completions?api-version={api_version}'
     else:
         if is_responses:
             payload = convert_to_responses_payload(payload)
@@ -1164,12 +1178,11 @@ async def generate_chat_completion(
     payload = json.dumps(payload)
 
     r = None
-    session = None
     streaming = False
     response = None
 
     try:
-        session = aiohttp.ClientSession(trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT))
+        session = await get_session()
 
         r = await session.request(
             method='POST',
@@ -1178,13 +1191,33 @@ async def generate_chat_completion(
             headers=headers,
             cookies=cookies,
             ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
         )
 
         # Check if response is SSE
         if 'text/event-stream' in r.headers.get('Content-Type', ''):
+            # If the provider returned an error status with SSE content-type,
+            # read the body and return a proper error response instead of
+            # streaming the error back (which hides the error from logs).
+            if r.status >= 400:
+                error_body = await r.text()
+                log.error(
+                    'Provider returned HTTP %d with SSE content-type: %s',
+                    r.status,
+                    error_body[:1000],
+                )
+                try:
+                    error_json = json.loads(error_body)
+                    return JSONResponse(status_code=r.status, content=error_json)
+                except json.JSONDecodeError:
+                    return JSONResponse(
+                        status_code=r.status,
+                        content={'error': {'message': error_body, 'code': r.status}},
+                    )
+
             streaming = True
             return StreamingResponse(
-                stream_wrapper(r, session, stream_chunks_handler),
+                stream_wrapper(r, content_handler=stream_chunks_handler),
                 status_code=r.status,
                 headers=dict(r.headers),
             )
@@ -1211,11 +1244,11 @@ async def generate_chat_completion(
 
         raise HTTPException(
             status_code=r.status if r else 500,
-            detail='Open WebUI: Server Connection Error',
+            detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR,
         )
     finally:
         if not streaming:
-            await cleanup_response(r, session)
+            await cleanup_response(r)
 
 
 async def embeddings(request: Request, form_data: dict, user):
@@ -1251,27 +1284,25 @@ async def embeddings(request: Request, form_data: dict, user):
     )
 
     r = None
-    session = None
     streaming = False
 
     headers, cookies = await get_headers_and_cookies(request, url, key, api_config, user=user)
     try:
-        session = aiohttp.ClientSession(
-            trust_env=True,
-            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
-        )
+        session = await get_session()
         r = await session.request(
             method='POST',
             url=f'{url}/embeddings',
             data=body,
             headers=headers,
             cookies=cookies,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
+            ssl=AIOHTTP_CLIENT_SESSION_SSL,
         )
 
         if 'text/event-stream' in r.headers.get('Content-Type', ''):
             streaming = True
             return StreamingResponse(
-                stream_wrapper(r, session),
+                stream_wrapper(r),
                 status_code=r.status,
                 headers=dict(r.headers),
             )
@@ -1292,11 +1323,11 @@ async def embeddings(request: Request, form_data: dict, user):
         log.exception(e)
         raise HTTPException(
             status_code=r.status if r else 500,
-            detail='Open WebUI: Server Connection Error',
+            detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR,
         )
     finally:
         if not streaming:
-            await cleanup_response(r, session)
+            await cleanup_response(r)
 
 
 class ResponsesForm(BaseModel):
@@ -1330,10 +1361,15 @@ async def responses(
     Routes to the correct upstream backend based on the model field.
     """
     payload = form_data.model_dump(exclude_none=True)
-    body = json.dumps(payload)
 
     idx = 0
     model_id = form_data.model
+
+    # Enforce per-model access control
+    await check_model_access(user, await Models.get_model_by_id(model_id), BYPASS_MODEL_ACCESS_CONTROL)
+
+    body = json.dumps(payload)
+
     if model_id:
         models = request.app.state.OPENAI_MODELS
         if not models or model_id not in models:
@@ -1350,30 +1386,29 @@ async def responses(
     )
 
     r = None
-    session = None
     streaming = False
 
     try:
         headers, cookies = await get_headers_and_cookies(request, url, key, api_config, user=user)
 
         if api_config.get('azure', False):
-            api_version = api_config.get('api_version', '2023-03-15-preview')
-
             auth_type = api_config.get('auth_type', 'bearer')
             if auth_type not in ('azure_ad', 'microsoft_entra_id'):
                 headers['api-key'] = key
 
-            headers['api-version'] = api_version
+            is_azure_v1 = bool(re.search(r'/openai/v1(?:/|$)', url))
 
-            model = payload.get('model', '')
-            request_url = f'{url}/openai/deployments/{model}/responses?api-version={api_version}'
+            if is_azure_v1:
+                request_url = f'{url.rstrip("/")}/responses'
+            else:
+                api_version = api_config.get('api_version', '2023-03-15-preview')
+                headers['api-version'] = api_version
+                model = _sanitize_model_for_url(payload.get('model', ''))
+                request_url = f'{url}/openai/deployments/{model}/responses?api-version={api_version}'
         else:
             request_url = f'{url}/responses'
 
-        session = aiohttp.ClientSession(
-            trust_env=True,
-            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
-        )
+        session = await get_session()
         r = await session.request(
             method='POST',
             url=request_url,
@@ -1381,13 +1416,14 @@ async def responses(
             headers=headers,
             cookies=cookies,
             ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
         )
 
         # Check if response is SSE
         if 'text/event-stream' in r.headers.get('Content-Type', ''):
             streaming = True
             return StreamingResponse(
-                stream_wrapper(r, session),
+                stream_wrapper(r),
                 status_code=r.status,
                 headers=dict(r.headers),
             )
@@ -1405,23 +1441,32 @@ async def responses(
 
             return response_data
 
+    except HTTPException:
+        raise
     except Exception as e:
         log.exception(e)
         raise HTTPException(
             status_code=r.status if r else 500,
-            detail='Open WebUI: Server Connection Error',
+            detail=ERROR_MESSAGES.SERVER_CONNECTION_ERROR,
         )
     finally:
         if not streaming:
-            await cleanup_response(r, session)
+            await cleanup_response(r)
 
 
 @router.api_route('/{path:path}', methods=['GET', 'POST', 'PUT', 'DELETE'])
 async def proxy(path: str, request: Request, user=Depends(get_verified_user)):
     """
-    Deprecated: proxy all requests to OpenAI API
+    Deprecated: proxy all requests to OpenAI API.
+    Disabled by default. Set ENABLE_OPENAI_API_PASSTHROUGH=True to enable.
     """
 
+    if not ENABLE_OPENAI_API_PASSTHROUGH:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Direct API passthrough is disabled. Set ENABLE_OPENAI_API_PASSTHROUGH=True to enable.',
+        )
+
     body = await request.body()
 
     # Parse JSON body to resolve model-based routing
@@ -1452,34 +1497,35 @@ async def proxy(path: str, request: Request, user=Depends(get_verified_user)):
     )
 
     r = None
-    session = None
     streaming = False
 
     try:
         headers, cookies = await get_headers_and_cookies(request, url, key, api_config, user=user)
 
         if api_config.get('azure', False):
-            api_version = api_config.get('api_version', '2023-03-15-preview')
-
             # Only set api-key header if not using Azure Entra ID authentication
             auth_type = api_config.get('auth_type', 'bearer')
             if auth_type not in ('azure_ad', 'microsoft_entra_id'):
                 headers['api-key'] = key
 
-            headers['api-version'] = api_version
+            is_azure_v1 = bool(re.search(r'/openai/v1(?:/|$)', url))
 
-            payload = json.loads(body)
-            url, payload = convert_to_azure_payload(url, payload, api_version)
-            body = json.dumps(payload).encode()
+            if is_azure_v1:
+                qs = request.url.query
+                request_url = f'{url.rstrip("/")}/{path}' + (f'?{qs}' if qs else '')
+            else:
+                api_version = api_config.get('api_version', '2023-03-15-preview')
+                headers['api-version'] = api_version
 
-            request_url = f'{url}/{path}?api-version={api_version}'
+                payload = json.loads(body)
+                url, payload = convert_to_azure_payload(url, payload, api_version)
+                body = json.dumps(payload).encode()
+
+                request_url = f'{url}/{path}?api-version={api_version}'
         else:
             request_url = f'{url}/{path}'
 
-        session = aiohttp.ClientSession(
-            trust_env=True,
-            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
-        )
+        session = await get_session()
         r = await session.request(
             method=request.method,
             url=request_url,
@@ -1487,13 +1533,14 @@ async def proxy(path: str, request: Request, user=Depends(get_verified_user)):
             headers=headers,
             cookies=cookies,
             ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
         )
 
         # Check if response is SSE
         if 'text/event-stream' in r.headers.get('Content-Type', ''):
             streaming = True
             return StreamingResponse(
-                stream_wrapper(r, session),
+                stream_wrapper(r),
                 status_code=r.status,
                 headers=dict(r.headers),
             )
@@ -1511,6 +1558,8 @@ async def proxy(path: str, request: Request, user=Depends(get_verified_user)):
 
             return response_data
 
+    except HTTPException:
+        raise
     except Exception as e:
         log.exception(e)
         raise HTTPException(
@@ -1519,4 +1568,4 @@ async def proxy(path: str, request: Request, user=Depends(get_verified_user)):
         )
     finally:
         if not streaming:
-            await cleanup_response(r, session)
+            await cleanup_response(r)

backend/open_webui/routers/pipelines.py

@@ -94,9 +94,24 @@ async def process_pipeline_inlet_filter(request, payload, user, models):
                     response.raise_for_status()
                     payload = await response.json()
             except aiohttp.ClientResponseError as e:
-                res = await response.json() if response.content_type == 'application/json' else {}
-                if 'detail' in res:
-                    raise Exception(response.status, res['detail'])
+                try:
+                    res = await response.json() if 'application/json' in response.content_type else {}
+                    if 'detail' in res:
+                        raise HTTPException(
+                            status_code=response.status,
+                            detail=res['detail'],
+                        )
+                except HTTPException:
+                    raise
+                except Exception:
+                    pass
+
+                raise HTTPException(
+                    status_code=response.status,
+                    detail=e.message,
+                )
+            except HTTPException:
+                raise
             except Exception as e:
                 log.exception(f'Connection error: {e}')
 
@@ -146,9 +161,21 @@ async def process_pipeline_outlet_filter(request, payload, user, models):
                 try:
                     res = await response.json() if 'application/json' in response.content_type else {}
                     if 'detail' in res:
-                        raise Exception(response.status, res)
+                        raise HTTPException(
+                            status_code=response.status,
+                            detail=res['detail'],
+                        )
+                except HTTPException:
+                    raise
                 except Exception:
                     pass
+
+                raise HTTPException(
+                    status_code=response.status,
+                    detail=e.message,
+                )
+            except HTTPException:
+                raise
             except Exception as e:
                 log.exception(f'Connection error: {e}')
 

backend/open_webui/routers/prompts.py

@@ -20,8 +20,8 @@ from open_webui.constants import ERROR_MESSAGES
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.utils.access_control import has_permission, filter_allowed_access_grants
 from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
-from open_webui.internal.db import get_session
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 from pydantic import BaseModel
 
 
@@ -48,21 +48,21 @@ PAGE_ITEM_COUNT = 30
 
 
 @router.get('/', response_model=list[PromptModel])
-async def get_prompts(user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def get_prompts(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        prompts = Prompts.get_prompts(db=db)
+        prompts = await Prompts.get_prompts(db=db)
     else:
-        prompts = Prompts.get_prompts_by_user_id(user.id, 'read', db=db)
+        prompts = await Prompts.get_prompts_by_user_id(user.id, 'read', db=db)
 
     return prompts
 
 
 @router.get('/tags', response_model=list[str])
-async def get_prompt_tags(user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def get_prompt_tags(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        return Prompts.get_tags(db=db)
+        return await Prompts.get_tags(db=db)
     else:
-        prompts = Prompts.get_prompts_by_user_id(user.id, 'read', db=db)
+        prompts = await Prompts.get_prompts_by_user_id(user.id, 'read', db=db)
         tags = set()
         for prompt in prompts:
             if prompt.tags:
@@ -79,7 +79,7 @@ async def get_prompt_list(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -99,7 +99,7 @@ async def get_prompt_list(
         filter['direction'] = direction
 
     # Pre-fetch user group IDs once - used for both filter and write_access check
-    groups = Groups.get_groups_by_member_id(user.id, db=db)
+    groups = await Groups.get_groups_by_member_id(user.id, db=db)
     user_group_ids = {group.id for group in groups}
 
     if not (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL):
@@ -108,11 +108,11 @@ async def get_prompt_list(
 
         filter['user_id'] = user.id
 
-    result = Prompts.search_prompts(user.id, filter=filter, skip=skip, limit=limit, db=db)
+    result = await Prompts.search_prompts(user.id, filter=filter, skip=skip, limit=limit, db=db)
 
     # Batch-fetch writable prompt IDs in a single query instead of N has_access calls
     prompt_ids = [prompt.id for prompt in result.items]
-    writable_prompt_ids = AccessGrants.get_accessible_resource_ids(
+    writable_prompt_ids = await AccessGrants.get_accessible_resource_ids(
         user_id=user.id,
         resource_type='prompt',
         resource_ids=prompt_ids,
@@ -147,16 +147,16 @@ async def create_new_prompt(
     request: Request,
     form_data: PromptForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if user.role != 'admin' and not (
-        has_permission(
+        await has_permission(
             user.id,
             'workspace.prompts',
             request.app.state.config.USER_PERMISSIONS,
             db=db,
         )
-        or has_permission(
+        or await has_permission(
             user.id,
             'workspace.prompts_import',
             request.app.state.config.USER_PERMISSIONS,
@@ -168,9 +168,17 @@ async def create_new_prompt(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    prompt = Prompts.get_prompt_by_command(form_data.command, db=db)
+    form_data.access_grants = await filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_prompts',
+    )
+
+    prompt = await Prompts.get_prompt_by_command(form_data.command, db=db)
     if prompt is None:
-        prompt = Prompts.insert_new_prompt(user.id, form_data, db=db)
+        prompt = await Prompts.insert_new_prompt(user.id, form_data, db=db)
 
         if prompt:
             return prompt
@@ -190,14 +198,16 @@ async def create_new_prompt(
 
 
 @router.get('/command/{command}', response_model=Optional[PromptAccessResponse])
-async def get_prompt_by_command(command: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    prompt = Prompts.get_prompt_by_command(command, db=db)
+async def get_prompt_by_command(
+    command: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    prompt = await Prompts.get_prompt_by_command(command, db=db)
 
     if prompt:
         if (
             user.role == 'admin'
             or prompt.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='prompt',
                 resource_id=prompt.id,
@@ -210,7 +220,7 @@ async def get_prompt_by_command(command: str, user=Depends(get_verified_user), d
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == prompt.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='prompt',
                         resource_id=prompt.id,
@@ -232,14 +242,16 @@ async def get_prompt_by_command(command: str, user=Depends(get_verified_user), d
 
 
 @router.get('/id/{prompt_id}', response_model=Optional[PromptAccessResponse])
-async def get_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+async def get_prompt_by_id(
+    prompt_id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if prompt:
         if (
             user.role == 'admin'
             or prompt.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='prompt',
                 resource_id=prompt.id,
@@ -252,7 +264,7 @@ async def get_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), db:
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == prompt.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='prompt',
                         resource_id=prompt.id,
@@ -275,12 +287,13 @@ async def get_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), db:
 
 @router.post('/id/{prompt_id}/update', response_model=Optional[PromptModel])
 async def update_prompt_by_id(
+    request: Request,
     prompt_id: str,
     form_data: PromptForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -291,7 +304,7 @@ async def update_prompt_by_id(
     # Is the user the original creator, in a group with write access, or an admin
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -307,15 +320,23 @@ async def update_prompt_by_id(
 
     # Check for command collision if command is being changed
     if form_data.command != prompt.command:
-        existing_prompt = Prompts.get_prompt_by_command(form_data.command, db=db)
+        existing_prompt = await Prompts.get_prompt_by_command(form_data.command, db=db)
         if existing_prompt and existing_prompt.id != prompt.id:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"Command '/{form_data.command}' is already in use by another prompt",
+                detail=ERROR_MESSAGES.COMMAND_TAKEN,
             )
 
+    form_data.access_grants = await filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_prompts',
+    )
+
     # Use the ID from the found prompt
-    updated_prompt = Prompts.update_prompt_by_id(prompt.id, form_data, user.id, db=db)
+    updated_prompt = await Prompts.update_prompt_by_id(prompt.id, form_data, user.id, db=db)
     if updated_prompt:
         return updated_prompt
     else:
@@ -335,10 +356,10 @@ async def update_prompt_metadata(
     prompt_id: str,
     form_data: PromptMetadataForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Update prompt name and command only (no history created)."""
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -348,7 +369,7 @@ async def update_prompt_metadata(
 
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -364,14 +385,16 @@ async def update_prompt_metadata(
 
     # Check for command collision if command is being changed
     if form_data.command != prompt.command:
-        existing_prompt = Prompts.get_prompt_by_command(form_data.command, db=db)
+        existing_prompt = await Prompts.get_prompt_by_command(form_data.command, db=db)
         if existing_prompt and existing_prompt.id != prompt.id:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"Command '/{form_data.command}' is already in use",
+                detail=ERROR_MESSAGES.COMMAND_TAKEN,
             )
 
-    updated_prompt = Prompts.update_prompt_metadata(prompt.id, form_data.name, form_data.command, form_data.tags, db=db)
+    updated_prompt = await Prompts.update_prompt_metadata(
+        prompt.id, form_data.name, form_data.command, form_data.tags, db=db
+    )
     if updated_prompt:
         return updated_prompt
     else:
@@ -386,9 +409,9 @@ async def set_prompt_version(
     prompt_id: str,
     form_data: PromptVersionUpdateForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
     if not prompt:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -397,7 +420,7 @@ async def set_prompt_version(
 
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -411,7 +434,7 @@ async def set_prompt_version(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    updated_prompt = Prompts.update_prompt_version(prompt.id, form_data.version_id, db=db)
+    updated_prompt = await Prompts.update_prompt_version(prompt.id, form_data.version_id, db=db)
     if updated_prompt:
         return updated_prompt
     else:
@@ -436,9 +459,9 @@ async def update_prompt_access_by_id(
     prompt_id: str,
     form_data: PromptAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
     if not prompt:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -447,7 +470,7 @@ async def update_prompt_access_by_id(
 
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -461,7 +484,7 @@ async def update_prompt_access_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -469,9 +492,9 @@ async def update_prompt_access_by_id(
         'sharing.public_prompts',
     )
 
-    AccessGrants.set_access_grants('prompt', prompt_id, form_data.access_grants, db=db)
+    await AccessGrants.set_access_grants('prompt', prompt_id, form_data.access_grants, db=db)
 
-    return Prompts.get_prompt_by_id(prompt_id, db=db)
+    return await Prompts.get_prompt_by_id(prompt_id, db=db)
 
 
 ############################
@@ -480,8 +503,10 @@ async def update_prompt_access_by_id(
 
 
 @router.post('/id/{prompt_id}/toggle', response_model=Optional[PromptModel])
-async def toggle_prompt_active(prompt_id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+async def toggle_prompt_active(
+    prompt_id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -491,7 +516,7 @@ async def toggle_prompt_active(prompt_id: str, user=Depends(get_verified_user),
 
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -505,7 +530,7 @@ async def toggle_prompt_active(prompt_id: str, user=Depends(get_verified_user),
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    result = Prompts.toggle_prompt_active(prompt.id, db=db)
+    result = await Prompts.toggle_prompt_active(prompt.id, db=db)
     if result:
         return result
     raise HTTPException(
@@ -520,8 +545,10 @@ async def toggle_prompt_active(prompt_id: str, user=Depends(get_verified_user),
 
 
 @router.delete('/id/{prompt_id}/delete', response_model=bool)
-async def delete_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+async def delete_prompt_by_id(
+    prompt_id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -531,7 +558,7 @@ async def delete_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), d
 
     if (
         prompt.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -545,7 +572,7 @@ async def delete_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), d
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    result = Prompts.delete_prompt_by_id(prompt.id, db=db)
+    result = await Prompts.delete_prompt_by_id(prompt.id, db=db)
     return result
 
 
@@ -559,12 +586,12 @@ async def get_prompt_history(
     prompt_id: str,
     page: int = 0,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get version history for a prompt."""
     PAGE_SIZE = 20
 
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -576,7 +603,7 @@ async def get_prompt_history(
     if not (
         user.role == 'admin'
         or prompt.user_id == user.id
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -589,7 +616,7 @@ async def get_prompt_history(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    history = PromptHistories.get_history_by_prompt_id(prompt.id, limit=PAGE_SIZE, offset=page * PAGE_SIZE, db=db)
+    history = await PromptHistories.get_history_by_prompt_id(prompt.id, limit=PAGE_SIZE, offset=page * PAGE_SIZE, db=db)
     return history
 
 
@@ -598,10 +625,10 @@ async def get_prompt_history_entry(
     prompt_id: str,
     history_id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get a specific version from history."""
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -613,7 +640,7 @@ async def get_prompt_history_entry(
     if not (
         user.role == 'admin'
         or prompt.user_id == user.id
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -626,7 +653,7 @@ async def get_prompt_history_entry(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    history_entry = PromptHistories.get_history_entry_by_id(history_id, db=db)
+    history_entry = await PromptHistories.get_history_entry_by_id(history_id, db=db)
     if not history_entry or history_entry.prompt_id != prompt.id:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -641,10 +668,10 @@ async def delete_prompt_history_entry(
     prompt_id: str,
     history_id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Delete a history entry. Cannot delete the active production version."""
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -656,7 +683,7 @@ async def delete_prompt_history_entry(
     if not (
         user.role == 'admin'
         or prompt.user_id == user.id
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -676,7 +703,7 @@ async def delete_prompt_history_entry(
             detail='Cannot delete the active production version',
         )
 
-    success = PromptHistories.delete_history_entry(history_id, db=db)
+    success = await PromptHistories.delete_history_entry(history_id, db=db)
     if not success:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -692,10 +719,10 @@ async def get_prompt_diff(
     from_id: str,
     to_id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get diff between two versions."""
-    prompt = Prompts.get_prompt_by_id(prompt_id, db=db)
+    prompt = await Prompts.get_prompt_by_id(prompt_id, db=db)
 
     if not prompt:
         raise HTTPException(
@@ -707,7 +734,7 @@ async def get_prompt_diff(
     if not (
         user.role == 'admin'
         or prompt.user_id == user.id
-        or AccessGrants.has_access(
+        or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='prompt',
             resource_id=prompt.id,
@@ -720,11 +747,11 @@ async def get_prompt_diff(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    diff = PromptHistories.compute_diff(from_id, to_id, db=db)
+    diff = await PromptHistories.compute_diff(from_id, to_id, db=db)
     if not diff:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='One or both history entries not found',
+            detail=ERROR_MESSAGES.NOT_FOUND,
         )
 
     return diff

backend/open_webui/routers/retrieval.py

@@ -40,14 +40,15 @@ from open_webui.models.files import FileModel, FileUpdateForm, Files
 from open_webui.utils.access_control.files import has_access_to_file
 from open_webui.models.knowledge import Knowledges
 from open_webui.storage.provider import Storage
-from open_webui.internal.db import get_session, get_db
-from sqlalchemy.orm import Session
+from open_webui.internal.db import get_async_db, get_async_session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 
 from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
+from open_webui.retrieval.vector.async_client import ASYNC_VECTOR_DB_CLIENT
 
 # Document loaders
-from open_webui.retrieval.loaders.main import Loader
+
 from open_webui.retrieval.loaders.youtube import YoutubeLoader
 
 # Web search engines
@@ -81,6 +82,8 @@ from open_webui.retrieval.web.yandex import search_yandex
 from open_webui.retrieval.web.ydc import search_youcom
 
 from open_webui.retrieval.utils import (
+    build_loader_from_config,
+    filter_accessible_collections,
     get_content_from_url,
     get_embedding_function,
     get_reranking_function,
@@ -151,7 +154,7 @@ def get_ef(
                 model_kwargs=SENTENCE_TRANSFORMERS_MODEL_KWARGS,
             )
         except Exception as e:
-            log.debug(f'Error loading SentenceTransformer: {e}')
+            log.error(f'Error loading SentenceTransformer: {e}')
 
     return ef
 
@@ -486,6 +489,7 @@ async def get_rag_config(request: Request, user=Depends(get_admin_user)):
         # Reranking settings
         'RAG_RERANKING_MODEL': request.app.state.config.RAG_RERANKING_MODEL,
         'RAG_RERANKING_ENGINE': request.app.state.config.RAG_RERANKING_ENGINE,
+        'RAG_RERANKING_BATCH_SIZE': request.app.state.config.RAG_RERANKING_BATCH_SIZE,
         'RAG_EXTERNAL_RERANKER_URL': request.app.state.config.RAG_EXTERNAL_RERANKER_URL,
         'RAG_EXTERNAL_RERANKER_API_KEY': request.app.state.config.RAG_EXTERNAL_RERANKER_API_KEY,
         'RAG_EXTERNAL_RERANKER_TIMEOUT': request.app.state.config.RAG_EXTERNAL_RERANKER_TIMEOUT,
@@ -579,9 +583,9 @@ class WebConfig(BaseModel):
     WEB_SEARCH_TRUST_ENV: Optional[bool] = None
     WEB_SEARCH_RESULT_COUNT: Optional[int] = None
     WEB_SEARCH_CONCURRENT_REQUESTS: Optional[int] = None
+    WEB_SEARCH_DOMAIN_FILTER_LIST: Optional[List[str]] = []
     WEB_FETCH_MAX_CONTENT_LENGTH: Optional[int] = None
     WEB_LOADER_CONCURRENT_REQUESTS: Optional[int] = None
-    WEB_SEARCH_DOMAIN_FILTER_LIST: Optional[List[str]] = []
     BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL: Optional[bool] = None
     BYPASS_WEB_SEARCH_WEB_LOADER: Optional[bool] = None
     OLLAMA_CLOUD_WEB_SEARCH_API_KEY: Optional[str] = None
@@ -693,6 +697,7 @@ class ConfigForm(BaseModel):
     # Reranking settings
     RAG_RERANKING_MODEL: Optional[str] = None
     RAG_RERANKING_ENGINE: Optional[str] = None
+    RAG_RERANKING_BATCH_SIZE: Optional[int] = None
     RAG_EXTERNAL_RERANKER_URL: Optional[str] = None
     RAG_EXTERNAL_RERANKER_API_KEY: Optional[str] = None
     RAG_EXTERNAL_RERANKER_TIMEOUT: Optional[str] = None
@@ -939,6 +944,12 @@ async def update_rag_config(request: Request, form_data: ConfigForm, user=Depend
         else request.app.state.config.RAG_EXTERNAL_RERANKER_TIMEOUT
     )
 
+    request.app.state.config.RAG_RERANKING_BATCH_SIZE = (
+        form_data.RAG_RERANKING_BATCH_SIZE
+        if form_data.RAG_RERANKING_BATCH_SIZE is not None
+        else request.app.state.config.RAG_RERANKING_BATCH_SIZE
+    )
+
     log.info(
         f'Updating reranking model: {request.app.state.config.RAG_RERANKING_MODEL} to {form_data.RAG_RERANKING_MODEL}'
     )
@@ -966,6 +977,7 @@ async def update_rag_config(request: Request, form_data: ConfigForm, user=Depend
                     request.app.state.config.RAG_RERANKING_ENGINE,
                     request.app.state.config.RAG_RERANKING_MODEL,
                     request.app.state.rf,
+                    reranking_batch_size=request.app.state.config.RAG_RERANKING_BATCH_SIZE,
                 )
         except Exception as e:
             log.error(f'Error loading reranking model: {e}')
@@ -1174,7 +1186,7 @@ async def update_rag_config(request: Request, form_data: ConfigForm, user=Depend
             'WEB_SEARCH_TRUST_ENV': request.app.state.config.WEB_SEARCH_TRUST_ENV,
             'WEB_SEARCH_RESULT_COUNT': request.app.state.config.WEB_SEARCH_RESULT_COUNT,
             'WEB_SEARCH_CONCURRENT_REQUESTS': request.app.state.config.WEB_SEARCH_CONCURRENT_REQUESTS,
-            'FETCH_URL_MAX_CONTENT_LENGTH': request.app.state.config.FETCH_URL_MAX_CONTENT_LENGTH,
+            'WEB_FETCH_MAX_CONTENT_LENGTH': request.app.state.config.WEB_FETCH_MAX_CONTENT_LENGTH,
             'WEB_LOADER_CONCURRENT_REQUESTS': request.app.state.config.WEB_LOADER_CONCURRENT_REQUESTS,
             'WEB_SEARCH_DOMAIN_FILTER_LIST': request.app.state.config.WEB_SEARCH_DOMAIN_FILTER_LIST,
             'BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL': request.app.state.config.BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL,
@@ -1526,11 +1538,11 @@ class ProcessFileForm(BaseModel):
 
 
 @router.post('/process/file')
-def process_file(
+async def process_file(
     request: Request,
     form_data: ProcessFileForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """
     Process a file and save its content to the vector database.
@@ -1539,9 +1551,9 @@ def process_file(
     The session is committed before external API calls, and updates use a fresh session.
     """
     if user.role == 'admin':
-        file = Files.get_file_by_id(form_data.file_id, db=db)
+        file = await Files.get_file_by_id(form_data.file_id, db=db)
     else:
-        file = Files.get_file_by_id_and_user_id(form_data.file_id, user.id, db=db)
+        file = await Files.get_file_by_id_and_user_id(form_data.file_id, user.id, db=db)
 
     if file:
         try:
@@ -1556,7 +1568,7 @@ def process_file(
 
                 try:
                     # /files/{file_id}/data/content/update
-                    VECTOR_DB_CLIENT.delete_collection(collection_name=f'file-{file.id}')
+                    await ASYNC_VECTOR_DB_CLIENT.delete_collection(collection_name=f'file-{file.id}')
                 except Exception:
                     # Audio file upload pipeline
                     pass
@@ -1579,7 +1591,9 @@ def process_file(
                 # Check if the file has already been processed and save the content
                 # Usage: /knowledge/{id}/file/add, /knowledge/{id}/file/update
 
-                result = VECTOR_DB_CLIENT.query(collection_name=f'file-{file.id}', filter={'file_id': file.id})
+                result = await ASYNC_VECTOR_DB_CLIENT.query(
+                    collection_name=f'file-{file.id}', filter={'file_id': file.id}
+                )
 
                 if result is not None and len(result.ids[0]) > 0:
                     docs = [
@@ -1609,41 +1623,10 @@ def process_file(
                 # Usage: /files/
                 file_path = file.path
                 if file_path:
-                    file_path = Storage.get_file(file_path)
-                    loader = Loader(
-                        engine=request.app.state.config.CONTENT_EXTRACTION_ENGINE,
-                        user=user,
-                        DATALAB_MARKER_API_KEY=request.app.state.config.DATALAB_MARKER_API_KEY,
-                        DATALAB_MARKER_API_BASE_URL=request.app.state.config.DATALAB_MARKER_API_BASE_URL,
-                        DATALAB_MARKER_ADDITIONAL_CONFIG=request.app.state.config.DATALAB_MARKER_ADDITIONAL_CONFIG,
-                        DATALAB_MARKER_SKIP_CACHE=request.app.state.config.DATALAB_MARKER_SKIP_CACHE,
-                        DATALAB_MARKER_FORCE_OCR=request.app.state.config.DATALAB_MARKER_FORCE_OCR,
-                        DATALAB_MARKER_PAGINATE=request.app.state.config.DATALAB_MARKER_PAGINATE,
-                        DATALAB_MARKER_STRIP_EXISTING_OCR=request.app.state.config.DATALAB_MARKER_STRIP_EXISTING_OCR,
-                        DATALAB_MARKER_DISABLE_IMAGE_EXTRACTION=request.app.state.config.DATALAB_MARKER_DISABLE_IMAGE_EXTRACTION,
-                        DATALAB_MARKER_FORMAT_LINES=request.app.state.config.DATALAB_MARKER_FORMAT_LINES,
-                        DATALAB_MARKER_USE_LLM=request.app.state.config.DATALAB_MARKER_USE_LLM,
-                        DATALAB_MARKER_OUTPUT_FORMAT=request.app.state.config.DATALAB_MARKER_OUTPUT_FORMAT,
-                        EXTERNAL_DOCUMENT_LOADER_URL=request.app.state.config.EXTERNAL_DOCUMENT_LOADER_URL,
-                        EXTERNAL_DOCUMENT_LOADER_API_KEY=request.app.state.config.EXTERNAL_DOCUMENT_LOADER_API_KEY,
-                        TIKA_SERVER_URL=request.app.state.config.TIKA_SERVER_URL,
-                        DOCLING_SERVER_URL=request.app.state.config.DOCLING_SERVER_URL,
-                        DOCLING_API_KEY=request.app.state.config.DOCLING_API_KEY,
-                        DOCLING_PARAMS=request.app.state.config.DOCLING_PARAMS,
-                        PDF_EXTRACT_IMAGES=request.app.state.config.PDF_EXTRACT_IMAGES,
-                        PDF_LOADER_MODE=request.app.state.config.PDF_LOADER_MODE,
-                        DOCUMENT_INTELLIGENCE_ENDPOINT=request.app.state.config.DOCUMENT_INTELLIGENCE_ENDPOINT,
-                        DOCUMENT_INTELLIGENCE_KEY=request.app.state.config.DOCUMENT_INTELLIGENCE_KEY,
-                        DOCUMENT_INTELLIGENCE_MODEL=request.app.state.config.DOCUMENT_INTELLIGENCE_MODEL,
-                        MISTRAL_OCR_API_BASE_URL=request.app.state.config.MISTRAL_OCR_API_BASE_URL,
-                        MISTRAL_OCR_API_KEY=request.app.state.config.MISTRAL_OCR_API_KEY,
-                        MINERU_API_MODE=request.app.state.config.MINERU_API_MODE,
-                        MINERU_API_URL=request.app.state.config.MINERU_API_URL,
-                        MINERU_API_KEY=request.app.state.config.MINERU_API_KEY,
-                        MINERU_API_TIMEOUT=request.app.state.config.MINERU_API_TIMEOUT,
-                        MINERU_PARAMS=request.app.state.config.MINERU_PARAMS,
-                    )
-                    docs = loader.load(file.filename, file.meta.get('content_type'), file_path)
+                    file_path = await asyncio.to_thread(Storage.get_file, file_path)
+                    loader = build_loader_from_config(request)
+                    loader.user = user
+                    docs = await loader.aload(file.filename, file.meta.get('content_type'), file_path)
 
                     docs = [
                         Document(
@@ -1674,7 +1657,7 @@ def process_file(
                 text_content = ' '.join([doc.page_content for doc in docs])
 
             log.debug(f'text_content: {text_content}')
-            Files.update_file_data_by_id(
+            await Files.update_file_data_by_id(
                 file.id,
                 {'content': text_content},
                 db=db,
@@ -1682,8 +1665,8 @@ def process_file(
             hash = calculate_sha256_string(text_content)
 
             if request.app.state.config.BYPASS_EMBEDDING_AND_RETRIEVAL:
-                Files.update_file_data_by_id(file.id, {'status': 'completed'}, db=db)
-                Files.update_file_hash_by_id(file.id, hash, db=db)
+                await Files.update_file_data_by_id(file.id, {'status': 'completed'}, db=db)
+                await Files.update_file_hash_by_id(file.id, hash, db=db)
                 return {
                     'status': True,
                     'collection_name': None,
@@ -1694,11 +1677,16 @@ def process_file(
                 try:
                     # Commit any pending changes before the slow embedding step.
                     # Note: file is already a Pydantic model (not ORM), so no expunge needed.
-                    db.commit()
+                    await db.commit()
 
                     # External embedding API takes time (5-60s+).
-                    # Subsequent updates use fresh sessions via get_db().
-                    result = save_docs_to_vector_db(
+                    # Subsequent updates use fresh async sessions.
+                    # NOTE: save_docs_to_vector_db is a sync function that
+                    # calls asyncio.run_coroutine_threadsafe(..., main_loop).result()
+                    # which blocks the calling thread.  We MUST run it in a
+                    # worker thread to avoid deadlocking the event loop.
+                    result = await run_in_threadpool(
+                        save_docs_to_vector_db,
                         request,
                         docs=docs,
                         collection_name=collection_name,
@@ -1714,8 +1702,8 @@ def process_file(
 
                     if result:
                         # Fresh session for the final update.
-                        with get_db() as session:
-                            Files.update_file_metadata_by_id(
+                        async with get_async_db() as session:
+                            await Files.update_file_metadata_by_id(
                                 file.id,
                                 {
                                     'collection_name': collection_name,
@@ -1723,12 +1711,12 @@ def process_file(
                                 db=session,
                             )
 
-                            Files.update_file_data_by_id(
+                            await Files.update_file_data_by_id(
                                 file.id,
                                 {'status': 'completed'},
                                 db=session,
                             )
-                            Files.update_file_hash_by_id(file.id, hash, db=session)
+                            await Files.update_file_hash_by_id(file.id, hash, db=session)
 
                             return {
                                 'status': True,
@@ -1744,14 +1732,14 @@ def process_file(
         except Exception as e:
             log.exception(e)
             # Fresh session for error status update.
-            with get_db() as session:
-                Files.update_file_data_by_id(
+            async with get_async_db() as session:
+                await Files.update_file_data_by_id(
                     file.id,
                     {'status': 'failed'},
                     db=session,
                 )
                 # Clear the hash so the file can be re-uploaded after fixing the issue
-                Files.update_file_hash_by_id(file.id, None, db=session)
+                await Files.update_file_hash_by_id(file.id, None, db=session)
 
             if 'No pandoc was found' in str(e):
                 raise HTTPException(
@@ -1783,6 +1771,8 @@ async def process_text(
     collection_name = form_data.collection_name
     if collection_name is None:
         collection_name = calculate_sha256_string(form_data.content)
+    else:
+        await _validate_collection_access([collection_name], user, access_type='write')
 
     docs = [
         Document(
@@ -1824,6 +1814,8 @@ async def process_web(
             collection_name = form_data.collection_name
             if not collection_name:
                 collection_name = calculate_sha256_string(form_data.url)[:63]
+            else:
+                await _validate_collection_access([collection_name], user, access_type='write')
 
             if not request.app.state.config.BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL:
                 await run_in_threadpool(
@@ -2175,7 +2167,7 @@ async def process_web_search(request: Request, form_data: SearchForm, user=Depen
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'features.web_search', request.app.state.config.USER_PERMISSIONS
     ):
         raise HTTPException(
@@ -2327,32 +2319,20 @@ async def process_web_search(request: Request, form_data: SearchForm, user=Depen
         )
 
 
-def _validate_collection_access(collection_names: list[str], user) -> None:
+async def _validate_collection_access(collection_names: list[str], user, access_type: str = 'read') -> None:
     """
-    Prevent users from querying collections they don't own.
-    Enforces ownership on user-memory-* and file-* collections.
-    Admins bypass this check.
+    Raise 403 if the user lacks access to any of the requested collections.
+    Delegates to the shared filter_accessible_collections utility so the
+    access rules stay in one place.
     """
-    if user.role == 'admin':
-        return
-
-    for name in collection_names:
-        if name.startswith('user-memory-') and name != f'user-memory-{user.id}':
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
-            )
-        elif name.startswith('file-'):
-            file_id = name[len('file-') :]
-            if not has_access_to_file(
-                file_id=file_id,
-                access_type='read',
-                user=user,
-            ):
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
-                )
+    requested = set(collection_names)
+    allowed = await filter_accessible_collections(requested, user, access_type=access_type)
+    denied = requested - allowed
+    if denied:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
 
 
 class QueryDocForm(BaseModel):
@@ -2370,12 +2350,12 @@ async def query_doc_handler(
     form_data: QueryDocForm,
     user=Depends(get_verified_user),
 ):
-    _validate_collection_access([form_data.collection_name], user)
+    await _validate_collection_access([form_data.collection_name], user)
 
     try:
         if request.app.state.config.ENABLE_RAG_HYBRID_SEARCH and (form_data.hybrid is None or form_data.hybrid):
             collection_results = {}
-            collection_results[form_data.collection_name] = VECTOR_DB_CLIENT.get(
+            collection_results[form_data.collection_name] = await ASYNC_VECTOR_DB_CLIENT.get(
                 collection_name=form_data.collection_name
             )
             return await query_doc_with_hybrid_search(
@@ -2404,7 +2384,10 @@ async def query_doc_handler(
             query_embedding = await request.app.state.EMBEDDING_FUNCTION(
                 form_data.query, prefix=RAG_EMBEDDING_QUERY_PREFIX, user=user
             )
-            return query_doc(
+            # query_doc wraps a blocking VECTOR_DB_CLIENT.search call;
+            # offload so the request's event loop stays responsive.
+            return await asyncio.to_thread(
+                query_doc,
                 collection_name=form_data.collection_name,
                 query_embedding=query_embedding,
                 k=form_data.k if form_data.k else request.app.state.config.TOP_K,
@@ -2435,7 +2418,7 @@ async def query_collection_handler(
     form_data: QueryCollectionsForm,
     user=Depends(get_verified_user),
 ):
-    _validate_collection_access(form_data.collection_names, user)
+    await _validate_collection_access(form_data.collection_names, user)
 
     try:
         if request.app.state.config.ENABLE_RAG_HYBRID_SEARCH and (form_data.hybrid is None or form_data.hybrid):
@@ -2496,14 +2479,14 @@ class DeleteForm(BaseModel):
 
 
 @router.post('/delete')
-def delete_entries_from_collection(
+async def delete_entries_from_collection(
     form_data: DeleteForm,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     try:
-        if VECTOR_DB_CLIENT.has_collection(collection_name=form_data.collection_name):
-            file = Files.get_file_by_id(form_data.file_id, db=db)
+        if await ASYNC_VECTOR_DB_CLIENT.has_collection(collection_name=form_data.collection_name):
+            file = await Files.get_file_by_id(form_data.file_id, db=db)
             if not file:
                 raise HTTPException(
                     status_code=status.HTTP_404_NOT_FOUND,
@@ -2511,26 +2494,50 @@ def delete_entries_from_collection(
                 )
             hash = file.hash
 
-            VECTOR_DB_CLIENT.delete(
+            # Refuse to issue a `filter={'hash': None}` query — the
+            # match semantics of a null filter value are
+            # backend-dependent (some backends ignore the key, some
+            # match every row whose metadata lacks `hash`) and risk
+            # deleting unrelated entries. Files without a hash are
+            # typically unprocessed / failed / legacy records that
+            # can't be targeted by hash anyway.
+            if hash is None:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=ERROR_MESSAGES.DEFAULT('File has no hash; cannot delete vector entries by hash.'),
+                )
+
+            # Pre-existing bug: this used `metadata=` which is not a
+            # parameter on `VectorDBBase.delete` nor on any backend
+            # implementation, so the call always raised TypeError that
+            # was silently swallowed by the surrounding `except
+            # Exception` and the endpoint reported `{'status': False}`
+            # for every request. Use `filter` to actually do what the
+            # endpoint name promises.
+            await ASYNC_VECTOR_DB_CLIENT.delete(
                 collection_name=form_data.collection_name,
-                metadata={'hash': hash},
+                filter={'hash': hash},
             )
             return {'status': True}
         else:
             return {'status': False}
+    except HTTPException:
+        # Caller-meaningful errors (404/400 above) must not be
+        # swallowed and re-shaped as `{'status': False}`.
+        raise
     except Exception as e:
         log.exception(e)
         return {'status': False}
 
 
 @router.post('/reset/db')
-def reset_vector_db(user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    VECTOR_DB_CLIENT.reset()
-    Knowledges.delete_all_knowledge(db=db)
+async def reset_vector_db(user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
+    await ASYNC_VECTOR_DB_CLIENT.reset()
+    await Knowledges.delete_all_knowledge(db=db)
 
 
 @router.post('/reset/uploads')
-def reset_upload_dir(user=Depends(get_admin_user)) -> bool:
+async def reset_upload_dir(user=Depends(get_admin_user)) -> bool:
     folder = f'{UPLOAD_DIR}'
     try:
         # Check if the directory exists
@@ -2580,11 +2587,12 @@ async def process_files_batch(
     request: Request,
     form_data: BatchProcessFilesForm,
     user=Depends(get_verified_user),
+    db=None,
 ) -> BatchProcessFilesResponse:
     """
     Process a batch of files and save them to the vector database.
 
-    NOTE: We intentionally do NOT use Depends(get_session) here.
+    NOTE: We intentionally do NOT use Depends(get_async_session) here.
     The save_docs_to_vector_db() call makes external embedding API calls which
     can take 5-60+ seconds for batch operations. Database operations after
     embedding (Files.update_file_by_id) manage their own short-lived sessions.
@@ -2602,7 +2610,7 @@ async def process_files_batch(
     for file in form_data.files:
         try:
             # Ownership check: verify the requesting user owns the file or is an admin
-            db_file = Files.get_file_by_id(file.id)
+            db_file = await Files.get_file_by_id(file.id, db=db)
             if not db_file:
                 file_errors.append(
                     BatchProcessFilesResult(
@@ -2664,7 +2672,7 @@ async def process_files_batch(
 
             # Update all files with collection name
             for file_update, file_result in zip(file_updates, file_results):
-                Files.update_file_by_id(id=file_result.file_id, form_data=file_update)
+                await Files.update_file_by_id(id=file_result.file_id, form_data=file_update, db=db)
                 file_result.status = 'completed'
 
         except Exception as e:

backend/open_webui/routers/scim.py

@@ -5,6 +5,7 @@ Provides System for Cross-domain Identity Management endpoints for users and gro
 NOTE: This is an experimental implementation and may not fully comply with SCIM 2.0 standards, and is subject to change.
 """
 
+import hmac
 import logging
 import uuid
 import time
@@ -29,8 +30,8 @@ from open_webui.config import OAUTH_PROVIDERS
 from open_webui.env import SCIM_AUTH_PROVIDER
 
 
-from sqlalchemy.orm import Session
-from open_webui.internal.db import get_session
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import get_async_session
 
 log = logging.getLogger(__name__)
 
@@ -278,7 +279,7 @@ def get_scim_auth(request: Request, authorization: Optional[str] = Header(None))
         if hasattr(scim_token, 'value'):
             scim_token = scim_token.value
         log.debug(f'SCIM token configured: {bool(scim_token)}')
-        if not scim_token or token != scim_token:
+        if not scim_token or not hmac.compare_digest(token, scim_token):
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail='Invalid SCIM token',
@@ -325,18 +326,18 @@ def get_scim_provider() -> str:
     return SCIM_AUTH_PROVIDER
 
 
-def find_user_by_external_id(external_id: str, db=None) -> Optional[UserModel]:
+async def find_user_by_external_id(external_id: str, db=None) -> Optional[UserModel]:
     """Find a user by SCIM externalId, falling back to OAuth sub match."""
     provider = get_scim_provider()
-    user = Users.get_user_by_scim_external_id(provider, external_id, db=db)
+    user = await Users.get_user_by_scim_external_id(provider, external_id, db=db)
     if user:
         return user
 
     # Fallback: check if externalId matches an existing OAuth sub (account linking)
-    return Users.get_user_by_oauth_sub(provider, external_id, db=db)
+    return await Users.get_user_by_oauth_sub(provider, external_id, db=db)
 
 
-def user_to_scim(user: UserModel, request: Request, db=None) -> SCIMUser:
+async def user_to_scim(user: UserModel, request: Request, db=None) -> SCIMUser:
     """Convert internal User model to SCIM User"""
     # Parse display name into name components
     name_parts = user.name.split(' ', 1) if user.name else ['', '']
@@ -344,7 +345,7 @@ def user_to_scim(user: UserModel, request: Request, db=None) -> SCIMUser:
     family_name = name_parts[1] if len(name_parts) > 1 else ''
 
     # Get user's groups
-    user_groups = Groups.get_groups_by_member_id(user.id, db=db)
+    user_groups = await Groups.get_groups_by_member_id(user.id, db=db)
     groups = [
         {
             'value': group.id,
@@ -378,12 +379,12 @@ def user_to_scim(user: UserModel, request: Request, db=None) -> SCIMUser:
     )
 
 
-def group_to_scim(group: GroupModel, request: Request, db=None) -> SCIMGroup:
+async def group_to_scim(group: GroupModel, request: Request, db=None) -> SCIMGroup:
     """Convert internal Group model to SCIM Group"""
-    member_ids = Groups.get_group_user_ids_by_id(group.id, db) or []
+    member_ids = await Groups.get_group_user_ids_by_id(group.id, db) or []
 
     # Batch-fetch all users to avoid N+1 queries
-    users = Users.get_users_by_user_ids(member_ids, db=db) if member_ids else []
+    users = await Users.get_users_by_user_ids(member_ids, db=db) if member_ids else []
     members = [
         SCIMGroupMember(
             value=user.id,
@@ -511,7 +512,7 @@ async def get_users(
     count: int = Query(20),
     filter: Optional[str] = None,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """List SCIM Users"""
     # Clamp per SCIM 2.0 spec (RFC 7644 §3.4.2.4):
@@ -526,25 +527,25 @@ async def get_users(
         # Simple filter parsing - supports userName eq, externalId eq
         if 'userName eq' in filter:
             email = filter.split('"')[1]
-            user = Users.get_user_by_email(email, db=db)
+            user = await Users.get_user_by_email(email, db=db)
             users_list = [user] if user else []
             total = 1 if user else 0
         elif 'externalId eq' in filter:
             external_id = filter.split('"')[1]
-            user = find_user_by_external_id(external_id, db=db)
+            user = await find_user_by_external_id(external_id, db=db)
             users_list = [user] if user else []
             total = 1 if user else 0
         else:
-            response = Users.get_users(skip=skip, limit=limit, db=db)
+            response = await Users.get_users(skip=skip, limit=limit, db=db)
             users_list = response['users']
             total = response['total']
     else:
-        response = Users.get_users(skip=skip, limit=limit, db=db)
+        response = await Users.get_users(skip=skip, limit=limit, db=db)
         users_list = response['users']
         total = response['total']
 
     # Convert to SCIM format
-    scim_users = [user_to_scim(user, request, db=db) for user in users_list]
+    scim_users = [await user_to_scim(user, request, db=db) for user in users_list]
 
     return SCIMListResponse(
         totalResults=total,
@@ -559,14 +560,14 @@ async def get_user(
     user_id: str,
     request: Request,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get SCIM User by ID"""
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
     if not user:
         return scim_error(status_code=status.HTTP_404_NOT_FOUND, detail=f'User {user_id} not found')
 
-    return user_to_scim(user, request, db=db)
+    return await user_to_scim(user, request, db=db)
 
 
 @router.post('/Users', response_model=SCIMUser, status_code=status.HTTP_201_CREATED)
@@ -574,12 +575,12 @@ async def create_user(
     request: Request,
     user_data: SCIMUserCreateRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Create SCIM User"""
     # Check for duplicate by externalId
     if user_data.externalId:
-        existing_user = find_user_by_external_id(user_data.externalId, db=db)
+        existing_user = await find_user_by_external_id(user_data.externalId, db=db)
         if existing_user:
             raise HTTPException(
                 status_code=status.HTTP_409_CONFLICT,
@@ -595,7 +596,7 @@ async def create_user(
     email = email.lower()
 
     # Check for duplicate by email
-    existing_user = Users.get_user_by_email(email, db=db)
+    existing_user = await Users.get_user_by_email(email, db=db)
     if existing_user:
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT,
@@ -618,7 +619,7 @@ async def create_user(
     if user_data.photos and len(user_data.photos) > 0:
         profile_image = user_data.photos[0].value
 
-    new_user = Users.insert_new_user(
+    new_user = await Users.insert_new_user(
         id=user_id,
         name=name,
         email=email,
@@ -636,10 +637,10 @@ async def create_user(
     # Store externalId in the scim field
     if user_data.externalId:
         provider = get_scim_provider()
-        Users.update_user_scim_by_id(user_id, provider, user_data.externalId, db=db)
-        new_user = Users.get_user_by_id(user_id, db=db)
+        await Users.update_user_scim_by_id(user_id, provider, user_data.externalId, db=db)
+        new_user = await Users.get_user_by_id(user_id, db=db)
 
-    return user_to_scim(new_user, request, db=db)
+    return await user_to_scim(new_user, request, db=db)
 
 
 @router.put('/Users/{user_id}', response_model=SCIMUser)
@@ -648,10 +649,10 @@ async def update_user(
     request: Request,
     user_data: SCIMUserUpdateRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Update SCIM User (full update)"""
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
     if not user:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -681,7 +682,7 @@ async def update_user(
     if user_data.photos and len(user_data.photos) > 0:
         update_data['profile_image_url'] = user_data.photos[0].value
 
-    updated_user = Users.update_user_by_id(user_id, update_data, db=db)
+    updated_user = await Users.update_user_by_id(user_id, update_data, db=db)
     if not updated_user:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -691,10 +692,10 @@ async def update_user(
     # Update externalId in the scim field
     if user_data.externalId:
         provider = get_scim_provider()
-        Users.update_user_scim_by_id(user_id, provider, user_data.externalId, db=db)
-        updated_user = Users.get_user_by_id(user_id, db=db)
+        await Users.update_user_scim_by_id(user_id, provider, user_data.externalId, db=db)
+        updated_user = await Users.get_user_by_id(user_id, db=db)
 
-    return user_to_scim(updated_user, request, db=db)
+    return await user_to_scim(updated_user, request, db=db)
 
 
 @router.patch('/Users/{user_id}', response_model=SCIMUser)
@@ -703,10 +704,10 @@ async def patch_user(
     request: Request,
     patch_data: SCIMPatchRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Update SCIM User (partial update)"""
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
     if not user:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -733,11 +734,11 @@ async def patch_user(
                 update_data['name'] = value
             elif path == 'externalId':
                 provider = get_scim_provider()
-                Users.update_user_scim_by_id(user_id, provider, value, db=db)
+                await Users.update_user_scim_by_id(user_id, provider, value, db=db)
 
     # Update user
     if update_data:
-        updated_user = Users.update_user_by_id(user_id, update_data, db=db)
+        updated_user = await Users.update_user_by_id(user_id, update_data, db=db)
         if not updated_user:
             raise HTTPException(
                 status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -746,7 +747,7 @@ async def patch_user(
     else:
         updated_user = user
 
-    return user_to_scim(updated_user, request, db=db)
+    return await user_to_scim(updated_user, request, db=db)
 
 
 @router.delete('/Users/{user_id}', status_code=status.HTTP_204_NO_CONTENT)
@@ -754,17 +755,17 @@ async def delete_user(
     user_id: str,
     request: Request,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Delete SCIM User"""
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
     if not user:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f'User {user_id} not found',
         )
 
-    success = Users.delete_user_by_id(user_id, db=db)
+    success = await Users.delete_user_by_id(user_id, db=db)
     if not success:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -782,7 +783,7 @@ async def get_groups(
     count: int = Query(20),
     filter: Optional[str] = None,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """List SCIM Groups"""
     # Clamp per SCIM 2.0 spec (RFC 7644 §3.4.2.4):
@@ -794,13 +795,13 @@ async def get_groups(
     if filter:
         if 'displayName eq' in filter:
             display_name = filter.split('"')[1]
-            group = Groups.get_group_by_name(display_name, db=db)
+            group = await Groups.get_group_by_name(display_name, db=db)
             groups_list = [group] if group else []
         else:
             # Unrecognized filter — fall back to all groups
-            groups_list = Groups.get_all_groups(db=db)
+            groups_list = await Groups.get_all_groups(db=db)
     else:
-        groups_list = Groups.get_all_groups(db=db)
+        groups_list = await Groups.get_all_groups(db=db)
 
     # Apply pagination
     total = len(groups_list)
@@ -809,7 +810,7 @@ async def get_groups(
     paginated_groups = groups_list[start:end]
 
     # Convert to SCIM format
-    scim_groups = [group_to_scim(group, request, db=db) for group in paginated_groups]
+    scim_groups = [await group_to_scim(group, request, db=db) for group in paginated_groups]
 
     return SCIMListResponse(
         totalResults=total,
@@ -824,17 +825,17 @@ async def get_group(
     group_id: str,
     request: Request,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Get SCIM Group by ID"""
-    group = Groups.get_group_by_id(group_id, db=db)
+    group = await Groups.get_group_by_id(group_id, db=db)
     if not group:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f'Group {group_id} not found',
         )
 
-    return group_to_scim(group, request, db=db)
+    return await group_to_scim(group, request, db=db)
 
 
 @router.post('/Groups', response_model=SCIMGroup, status_code=status.HTTP_201_CREATED)
@@ -842,7 +843,7 @@ async def create_group(
     request: Request,
     group_data: SCIMGroupCreateRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Create SCIM Group"""
     # Extract member IDs
@@ -860,14 +861,14 @@ async def create_group(
     )
 
     # Need to get the creating user's ID - we'll use the first admin
-    admin_user = Users.get_super_admin_user(db=db)
+    admin_user = await Users.get_super_admin_user(db=db)
     if not admin_user:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail='No admin user found',
         )
 
-    new_group = Groups.insert_new_group(admin_user.id, form, db=db)
+    new_group = await Groups.insert_new_group(admin_user.id, form, db=db)
     if not new_group:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -883,12 +884,12 @@ async def create_group(
             description=new_group.description,
         )
 
-        Groups.update_group_by_id(new_group.id, update_form, db=db)
-        Groups.set_group_user_ids_by_id(new_group.id, member_ids, db=db)
+        await Groups.update_group_by_id(new_group.id, update_form, db=db)
+        await Groups.set_group_user_ids_by_id(new_group.id, member_ids, db=db)
 
-        new_group = Groups.get_group_by_id(new_group.id, db=db)
+        new_group = await Groups.get_group_by_id(new_group.id, db=db)
 
-    return group_to_scim(new_group, request, db=db)
+    return await group_to_scim(new_group, request, db=db)
 
 
 @router.put('/Groups/{group_id}', response_model=SCIMGroup)
@@ -897,10 +898,10 @@ async def update_group(
     request: Request,
     group_data: SCIMGroupUpdateRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Update SCIM Group (full update)"""
-    group = Groups.get_group_by_id(group_id, db=db)
+    group = await Groups.get_group_by_id(group_id, db=db)
     if not group:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -918,17 +919,17 @@ async def update_group(
     # Handle members if provided
     if group_data.members is not None:
         member_ids = [member.value for member in group_data.members]
-        Groups.set_group_user_ids_by_id(group_id, member_ids, db=db)
+        await Groups.set_group_user_ids_by_id(group_id, member_ids, db=db)
 
     # Update group
-    updated_group = Groups.update_group_by_id(group_id, update_form, db=db)
+    updated_group = await Groups.update_group_by_id(group_id, update_form, db=db)
     if not updated_group:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail='Failed to update group',
         )
 
-    return group_to_scim(updated_group, request, db=db)
+    return await group_to_scim(updated_group, request, db=db)
 
 
 @router.patch('/Groups/{group_id}', response_model=SCIMGroup)
@@ -937,10 +938,10 @@ async def patch_group(
     request: Request,
     patch_data: SCIMPatchRequest,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Update SCIM Group (partial update)"""
-    group = Groups.get_group_by_id(group_id, db=db)
+    group = await Groups.get_group_by_id(group_id, db=db)
     if not group:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -964,7 +965,7 @@ async def patch_group(
                 update_form.name = value
             elif path == 'members':
                 # Replace all members
-                Groups.set_group_user_ids_by_id(group_id, [member['value'] for member in value], db=db)
+                await Groups.set_group_user_ids_by_id(group_id, [member['value'] for member in value], db=db)
 
         elif op == 'add':
             if path == 'members':
@@ -972,22 +973,22 @@ async def patch_group(
                 if isinstance(value, list):
                     for member in value:
                         if isinstance(member, dict) and 'value' in member:
-                            Groups.add_users_to_group(group_id, [member['value']], db=db)
+                            await Groups.add_users_to_group(group_id, [member['value']], db=db)
         elif op == 'remove':
             if path and path.startswith('members[value eq'):
                 # Remove specific member
                 member_id = path.split('"')[1]
-                Groups.remove_users_from_group(group_id, [member_id], db=db)
+                await Groups.remove_users_from_group(group_id, [member_id], db=db)
 
     # Update group
-    updated_group = Groups.update_group_by_id(group_id, update_form, db=db)
+    updated_group = await Groups.update_group_by_id(group_id, update_form, db=db)
     if not updated_group:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail='Failed to update group',
         )
 
-    return group_to_scim(updated_group, request, db=db)
+    return await group_to_scim(updated_group, request, db=db)
 
 
 @router.delete('/Groups/{group_id}', status_code=status.HTTP_204_NO_CONTENT)
@@ -995,17 +996,17 @@ async def delete_group(
     group_id: str,
     request: Request,
     _: bool = Depends(get_scim_auth),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     """Delete SCIM Group"""
-    group = Groups.get_group_by_id(group_id, db=db)
+    group = await Groups.get_group_by_id(group_id, db=db)
     if not group:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f'Group {group_id} not found',
         )
 
-    success = Groups.delete_group_by_id(group_id, db=db)
+    success = await Groups.delete_group_by_id(group_id, db=db)
     if not success:
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,

backend/open_webui/routers/skills.py

@@ -5,9 +5,9 @@ from open_webui.models.groups import Groups
 from pydantic import BaseModel
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
-from sqlalchemy.orm import Session
+from sqlalchemy.ext.asyncio import AsyncSession
 
-from open_webui.internal.db import get_session
+from open_webui.internal.db import get_async_session
 from open_webui.models.skills import (
     SkillForm,
     SkillModel,
@@ -40,18 +40,18 @@ router = APIRouter()
 async def get_skills(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        skills = Skills.get_skills(db=db)
+        skills = await Skills.get_skills(db=db)
     else:
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id, db=db)}
-        all_skills = Skills.get_skills(db=db)
+        user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id, db=db)}
+        all_skills = await Skills.get_skills(db=db)
         skills = [
             skill
             for skill in all_skills
             if skill.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='skill',
                 resource_id=skill.id,
@@ -75,7 +75,7 @@ async def get_skill_list(
     view_option: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -89,13 +89,13 @@ async def get_skill_list(
         filter['view_option'] = view_option
 
     if not (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL):
-        groups = Groups.get_groups_by_member_id(user.id, db=db)
+        groups = await Groups.get_groups_by_member_id(user.id, db=db)
         if groups:
             filter['group_ids'] = [group.id for group in groups]
 
         filter['user_id'] = user.id
 
-    result = Skills.search_skills(user.id, filter=filter, skip=skip, limit=limit, db=db)
+    result = await Skills.search_skills(user.id, filter=filter, skip=skip, limit=limit, db=db)
 
     return SkillAccessListResponse(
         items=[
@@ -104,7 +104,7 @@ async def get_skill_list(
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == skill.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='skill',
                         resource_id=skill.id,
@@ -128,9 +128,9 @@ async def get_skill_list(
 async def export_skills(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id,
         'workspace.skills',
         request.app.state.config.USER_PERMISSIONS,
@@ -142,9 +142,9 @@ async def export_skills(
         )
 
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        return Skills.get_skills(db=db)
+        return await Skills.get_skills(db=db)
     else:
-        return Skills.get_skills_by_user_id(user.id, 'read', db=db)
+        return await Skills.get_skills_by_user_id(user.id, 'read', db=db)
 
 
 ############################
@@ -157,9 +157,9 @@ async def create_new_skill(
     request: Request,
     form_data: SkillForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id, 'workspace.skills', request.app.state.config.USER_PERMISSIONS, db=db
     ):
         raise HTTPException(
@@ -169,7 +169,7 @@ async def create_new_skill(
 
     form_data.id = form_data.id.lower().replace(' ', '-')
 
-    existing = Skills.get_skill_by_id(form_data.id, db=db)
+    existing = await Skills.get_skill_by_id(form_data.id, db=db)
     if existing is not None:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -177,7 +177,7 @@ async def create_new_skill(
         )
 
     try:
-        skill = Skills.insert_new_skill(user.id, form_data, db=db)
+        skill = await Skills.insert_new_skill(user.id, form_data, db=db)
         if skill:
             return skill
         else:
@@ -199,14 +199,14 @@ async def create_new_skill(
 
 
 @router.get('/id/{id}', response_model=Optional[SkillAccessResponse])
-async def get_skill_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    skill = Skills.get_skill_by_id(id, db=db)
+async def get_skill_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    skill = await Skills.get_skill_by_id(id, db=db)
 
     if skill:
         if (
             user.role == 'admin'
             or skill.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='skill',
                 resource_id=skill.id,
@@ -219,7 +219,7 @@ async def get_skill_by_id(id: str, user=Depends(get_verified_user), db: Session
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == skill.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='skill',
                         resource_id=skill.id,
@@ -251,9 +251,9 @@ async def update_skill_by_id(
     id: str,
     form_data: SkillForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    skill = Skills.get_skill_by_id(id, db=db)
+    skill = await Skills.get_skill_by_id(id, db=db)
     if not skill:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -262,7 +262,7 @@ async def update_skill_by_id(
 
     if (
         skill.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='skill',
             resource_id=skill.id,
@@ -281,7 +281,7 @@ async def update_skill_by_id(
             **form_data.model_dump(exclude={'id'}),
         }
 
-        skill = Skills.update_skill_by_id(id, updated, db=db)
+        skill = await Skills.update_skill_by_id(id, updated, db=db)
 
         if skill:
             return skill
@@ -312,9 +312,9 @@ async def update_skill_access_by_id(
     id: str,
     form_data: SkillAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    skill = Skills.get_skill_by_id(id, db=db)
+    skill = await Skills.get_skill_by_id(id, db=db)
     if not skill:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -323,7 +323,7 @@ async def update_skill_access_by_id(
 
     if (
         skill.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='skill',
             resource_id=skill.id,
@@ -337,7 +337,7 @@ async def update_skill_access_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -345,9 +345,9 @@ async def update_skill_access_by_id(
         'sharing.public_skills',
     )
 
-    AccessGrants.set_access_grants('skill', id, form_data.access_grants, db=db)
+    await AccessGrants.set_access_grants('skill', id, form_data.access_grants, db=db)
 
-    return Skills.get_skill_by_id(id, db=db)
+    return await Skills.get_skill_by_id(id, db=db)
 
 
 ############################
@@ -356,13 +356,13 @@ async def update_skill_access_by_id(
 
 
 @router.post('/id/{id}/toggle', response_model=Optional[SkillModel])
-async def toggle_skill_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    skill = Skills.get_skill_by_id(id, db=db)
+async def toggle_skill_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    skill = await Skills.get_skill_by_id(id, db=db)
     if skill:
         if (
             user.role == 'admin'
             or skill.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='skill',
                 resource_id=skill.id,
@@ -370,7 +370,7 @@ async def toggle_skill_by_id(id: str, user=Depends(get_verified_user), db: Sessi
                 db=db,
             )
         ):
-            skill = Skills.toggle_skill_by_id(id, db=db)
+            skill = await Skills.toggle_skill_by_id(id, db=db)
 
             if skill:
                 return skill
@@ -401,9 +401,9 @@ async def delete_skill_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    skill = Skills.get_skill_by_id(id, db=db)
+    skill = await Skills.get_skill_by_id(id, db=db)
     if not skill:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -412,7 +412,7 @@ async def delete_skill_by_id(
 
     if (
         skill.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='skill',
             resource_id=skill.id,
@@ -426,5 +426,5 @@ async def delete_skill_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    result = Skills.delete_skill_by_id(id, db=db)
+    result = await Skills.delete_skill_by_id(id, db=db)
     return result

backend/open_webui/routers/tasks.py

@@ -18,7 +18,7 @@ from open_webui.utils.task import (
     moa_response_generation_template,
 )
 from open_webui.utils.auth import get_admin_user, get_verified_user
-from open_webui.constants import TASKS
+from open_webui.constants import ERROR_MESSAGES, TASKS
 
 from open_webui.routers.pipelines import process_pipeline_inlet_filter
 
@@ -168,7 +168,7 @@ async def generate_title(request: Request, form_data: dict, user=Depends(get_ver
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -245,7 +245,7 @@ async def generate_follow_ups(request: Request, form_data: dict, user=Depends(ge
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -313,7 +313,7 @@ async def generate_chat_tags(request: Request, form_data: dict, user=Depends(get
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -375,7 +375,7 @@ async def generate_image_prompt(request: Request, form_data: dict, user=Depends(
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -431,13 +431,13 @@ async def generate_queries(request: Request, form_data: dict, user=Depends(get_v
         if not request.app.state.config.ENABLE_SEARCH_QUERY_GENERATION:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f'Search query generation is disabled',
+                detail=ERROR_MESSAGES.FEATURE_DISABLED('Search query generation'),
             )
     elif type == 'retrieval':
         if not request.app.state.config.ENABLE_RETRIEVAL_QUERY_GENERATION:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f'Query generation is disabled',
+                detail=ERROR_MESSAGES.FEATURE_DISABLED('Query generation'),
             )
 
     if getattr(request.state, 'cached_queries', None):
@@ -455,7 +455,7 @@ async def generate_queries(request: Request, form_data: dict, user=Depends(get_v
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -508,7 +508,7 @@ async def generate_autocompletion(request: Request, form_data: dict, user=Depend
     if not request.app.state.config.ENABLE_AUTOCOMPLETE_GENERATION:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'Autocompletion generation is disabled',
+            detail=ERROR_MESSAGES.FEATURE_DISABLED('Autocompletion generation'),
         )
 
     type = form_data.get('type')
@@ -519,7 +519,7 @@ async def generate_autocompletion(request: Request, form_data: dict, user=Depend
         if len(prompt) > request.app.state.config.AUTOCOMPLETE_GENERATION_INPUT_MAX_LENGTH:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f'Input prompt exceeds maximum length of {request.app.state.config.AUTOCOMPLETE_GENERATION_INPUT_MAX_LENGTH}',
+                detail=ERROR_MESSAGES.INPUT_TOO_LONG(request.app.state.config.AUTOCOMPLETE_GENERATION_INPUT_MAX_LENGTH),
             )
 
     if getattr(request.state, 'direct', False) and hasattr(request.state, 'model'):
@@ -533,7 +533,7 @@ async def generate_autocompletion(request: Request, form_data: dict, user=Depend
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -595,7 +595,7 @@ async def generate_emoji(request: Request, form_data: dict, user=Depends(get_ver
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     # Check if the user has a custom task model
@@ -661,7 +661,7 @@ async def generate_moa_response(request: Request, form_data: dict, user=Depends(
     if model_id not in models:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail='Model not found',
+            detail=ERROR_MESSAGES.MODEL_NOT_FOUND(),
         )
 
     template = DEFAULT_MOA_GENERATION_PROMPT_TEMPLATE

backend/open_webui/routers/terminals.py

@@ -16,6 +16,7 @@ from starlette.background import BackgroundTask
 
 from open_webui.utils.auth import get_verified_user
 from open_webui.utils.access_control import has_connection_access
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
 from open_webui.models.groups import Groups
 from open_webui.models.users import Users
 
@@ -52,7 +53,7 @@ def _sanitize_proxy_path(path: str) -> str | None:
 async def list_terminal_servers(request: Request, user=Depends(get_verified_user)):
     """Return terminal servers the authenticated user has access to."""
     connections = request.app.state.config.TERMINAL_SERVER_CONNECTIONS or []
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
 
     return [
         {
@@ -61,7 +62,7 @@ async def list_terminal_servers(request: Request, user=Depends(get_verified_user
             'name': connection.get('name', ''),
         }
         for connection in connections
-        if connection.get('enabled', True) and has_connection_access(user, connection, user_group_ids)
+        if connection.get('enabled', True) and await has_connection_access(user, connection, user_group_ids)
     ]
 
 
@@ -82,8 +83,8 @@ async def proxy_terminal(
     if connection is None:
         return JSONResponse({'error': f"Terminal server '{server_id}' not found"}, status_code=404)
 
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
-    if not has_connection_access(user, connection, user_group_ids):
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
+    if not await has_connection_access(user, connection, user_group_ids):
         return JSONResponse({'error': 'Access denied'}, status_code=403)
 
     base_url = (connection.get('url') or '').rstrip('/')
@@ -141,6 +142,7 @@ async def proxy_terminal(
             headers=headers,
             cookies=cookies,
             data=body or None,
+            ssl=AIOHTTP_CLIENT_SESSION_SSL,
         )
 
         upstream_content_type = upstream_response.headers.get('content-type', '')
@@ -208,7 +210,7 @@ async def _resolve_authenticated_connection(ws: WebSocket, server_id: str):
         if data is None or 'id' not in data:
             await ws.close(code=4001, reason='Invalid token')
             return None
-        user = Users.get_user_by_id(data['id'])
+        user = await Users.get_user_by_id(data['id'])
         if user is None:
             await ws.close(code=4001, reason='User not found')
             return None
@@ -227,8 +229,8 @@ async def _resolve_authenticated_connection(ws: WebSocket, server_id: str):
         await ws.close(code=4004, reason='Terminal server not found')
         return None
 
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
-    if not has_connection_access(user, connection, user_group_ids):
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
+    if not await has_connection_access(user, connection, user_group_ids):
         await ws.close(code=4003, reason='Access denied')
         return None
 
@@ -279,7 +281,7 @@ async def ws_terminal(
 
     session = aiohttp.ClientSession()
     try:
-        async with session.ws_connect(upstream_url) as upstream:
+        async with session.ws_connect(upstream_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as upstream:
             import asyncio
             import json as _json
 

backend/open_webui/routers/tools.py

@@ -4,12 +4,12 @@ from typing import Optional
 import time
 import re
 import aiohttp
-from open_webui.env import AIOHTTP_CLIENT_TIMEOUT
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT
 from open_webui.models.groups import Groups
 from pydantic import BaseModel, HttpUrl
 from fastapi import APIRouter, Depends, HTTPException, Request, status
-from sqlalchemy.orm import Session
-from open_webui.internal.db import get_session
+from sqlalchemy.ext.asyncio import AsyncSession
+from open_webui.internal.db import get_async_session
 
 
 from open_webui.models.oauth_sessions import OAuthSessions
@@ -46,11 +46,11 @@ log = logging.getLogger(__name__)
 router = APIRouter()
 
 
-def get_tool_module(request, tool_id, load_from_db=True):
+async def get_tool_module(request, tool_id, load_from_db=True):
     """
     Get the tool module by its ID.
     """
-    tool_module, _ = get_tool_module_from_cache(request, tool_id, load_from_db)
+    tool_module, _ = await get_tool_module_from_cache(request, tool_id, load_from_db)
     return tool_module
 
 
@@ -65,12 +65,12 @@ def get_tool_module(request, tool_id, load_from_db=True):
 async def get_tools(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     tools = []
 
     # Local Tools
-    for tool in Tools.get_tools(defer_content=True, db=db):
+    for tool in await Tools.get_tools(defer_content=True, db=db):
         tool_module = request.app.state.TOOLS.get(tool.id) if hasattr(request.app.state, 'TOOLS') else None
         tools.append(
             ToolUserResponse(
@@ -120,7 +120,7 @@ async def get_tools(
             auth_type = server.get('auth_type', 'none')
 
             session_token = None
-            if auth_type == 'oauth_2.1':
+            if auth_type in ('oauth_2.1', 'oauth_2.1_static'):
                 splits = server_id.split(':')
                 server_id = splits[-1] if len(splits) > 1 else server_id
 
@@ -148,7 +148,7 @@ async def get_tools(
                             {
                                 'authenticated': session_token is not None,
                             }
-                            if auth_type == 'oauth_2.1'
+                            if auth_type in ('oauth_2.1', 'oauth_2.1_static')
                             else {}
                         ),
                     }
@@ -159,31 +159,30 @@ async def get_tools(
         # Admin can see all tools
         return tools
     else:
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id, db=db)}
-        tools = [
-            tool
-            for tool in tools
-            if tool.user_id == user.id
-            or (
-                has_access(
+        user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id, db=db)}
+        filtered_tools = []
+        for tool in tools:
+            if tool.user_id == user.id:
+                filtered_tools.append(tool)
+            elif str(tool.id).startswith('server:'):
+                if await has_access(
                     user.id,
                     'read',
                     server_access_grants.get(str(tool.id), []),
                     user_group_ids,
                     db=db,
-                )
-                if str(tool.id).startswith('server:')
-                else AccessGrants.has_access(
-                    user_id=user.id,
-                    resource_type='tool',
-                    resource_id=tool.id,
-                    permission='read',
-                    user_group_ids=user_group_ids,
-                    db=db,
-                )
-            )
-        ]
-        return tools
+                ):
+                    filtered_tools.append(tool)
+            elif await AccessGrants.has_access(
+                user_id=user.id,
+                resource_type='tool',
+                resource_id=tool.id,
+                permission='read',
+                user_group_ids=user_group_ids,
+                db=db,
+            ):
+                filtered_tools.append(tool)
+        return filtered_tools
 
 
 ############################
@@ -192,13 +191,13 @@ async def get_tools(
 
 
 @router.get('/list', response_model=list[ToolAccessResponse])
-async def get_tool_list(user=Depends(get_verified_user), db: Session = Depends(get_session)):
+async def get_tool_list(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        tools = Tools.get_tools(defer_content=True, db=db)
+        tools = await Tools.get_tools(defer_content=True, db=db)
     else:
-        tools = Tools.get_tools_by_user_id(user.id, 'read', defer_content=True, db=db)
+        tools = await Tools.get_tools_by_user_id(user.id, 'read', defer_content=True, db=db)
 
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id, db=db)}
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id, db=db)}
 
     result = []
     for tool in tools:
@@ -275,7 +274,9 @@ async def load_tool_from_url(request: Request, form_data: LoadUrlForm, user=Depe
         async with aiohttp.ClientSession(
             trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT)
         ) as session:
-            async with session.get(url, headers={'Content-Type': 'application/json'}) as resp:
+            async with session.get(
+                url, headers={'Content-Type': 'application/json'}, ssl=AIOHTTP_CLIENT_SESSION_SSL
+            ) as resp:
                 if resp.status != 200:
                     raise HTTPException(status_code=resp.status, detail='Failed to fetch the tool')
                 data = await resp.text()
@@ -286,7 +287,7 @@ async def load_tool_from_url(request: Request, form_data: LoadUrlForm, user=Depe
             'content': data,
         }
     except Exception as e:
-        raise HTTPException(status_code=500, detail=f'Error importing tool: {e}')
+        raise HTTPException(status_code=500, detail=ERROR_MESSAGES.DEFAULT(e))
 
 
 ############################
@@ -298,9 +299,9 @@ async def load_tool_from_url(request: Request, form_data: LoadUrlForm, user=Depe
 async def export_tools(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role != 'admin' and not has_permission(
+    if user.role != 'admin' and not await has_permission(
         user.id,
         'workspace.tools_export',
         request.app.state.config.USER_PERMISSIONS,
@@ -312,9 +313,9 @@ async def export_tools(
         )
 
     if user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL:
-        return Tools.get_tools(db=db)
+        return await Tools.get_tools(db=db)
     else:
-        return Tools.get_tools_by_user_id(user.id, 'read', db=db)
+        return await Tools.get_tools_by_user_id(user.id, 'read', db=db)
 
 
 ############################
@@ -327,11 +328,11 @@ async def create_new_tools(
     request: Request,
     form_data: ToolForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if user.role != 'admin' and not (
-        has_permission(user.id, 'workspace.tools', request.app.state.config.USER_PERMISSIONS, db=db)
-        or has_permission(
+        await has_permission(user.id, 'workspace.tools', request.app.state.config.USER_PERMISSIONS, db=db)
+        or await has_permission(
             user.id,
             'workspace.tools_import',
             request.app.state.config.USER_PERMISSIONS,
@@ -351,18 +352,26 @@ async def create_new_tools(
 
     form_data.id = form_data.id.lower()
 
-    tools = Tools.get_tool_by_id(form_data.id, db=db)
+    tools = await Tools.get_tool_by_id(form_data.id, db=db)
     if tools is None:
         try:
+            form_data.access_grants = await filter_allowed_access_grants(
+                request.app.state.config.USER_PERMISSIONS,
+                user.id,
+                user.role,
+                form_data.access_grants,
+                'sharing.public_tools',
+            )
+
             form_data.content = replace_imports(form_data.content)
-            tool_module, frontmatter = load_tool_module_by_id(form_data.id, content=form_data.content)
+            tool_module, frontmatter = await load_tool_module_by_id(form_data.id, content=form_data.content)
             form_data.meta.manifest = frontmatter
 
             TOOLS = request.app.state.TOOLS
             TOOLS[form_data.id] = tool_module
 
             specs = get_tool_specs(TOOLS[form_data.id])
-            tools = Tools.insert_new_tool(user.id, form_data, specs, db=db)
+            tools = await Tools.insert_new_tool(user.id, form_data, specs, db=db)
 
             tool_cache_dir = CACHE_DIR / 'tools' / form_data.id
             tool_cache_dir.mkdir(parents=True, exist_ok=True)
@@ -393,14 +402,14 @@ async def create_new_tools(
 
 
 @router.get('/id/{id}', response_model=Optional[ToolAccessResponse])
-async def get_tools_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    tools = Tools.get_tool_by_id(id, db=db)
+async def get_tools_by_id(id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    tools = await Tools.get_tool_by_id(id, db=db)
 
     if tools:
         if (
             user.role == 'admin'
             or tools.user_id == user.id
-            or AccessGrants.has_access(
+            or await AccessGrants.has_access(
                 user_id=user.id,
                 resource_type='tool',
                 resource_id=tools.id,
@@ -413,7 +422,7 @@ async def get_tools_by_id(id: str, user=Depends(get_verified_user), db: Session
                 write_access=(
                     (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
                     or user.id == tools.user_id
-                    or AccessGrants.has_access(
+                    or await AccessGrants.has_access(
                         user_id=user.id,
                         resource_type='tool',
                         resource_id=tools.id,
@@ -445,9 +454,9 @@ async def update_tools_by_id(
     id: str,
     form_data: ToolForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -457,7 +466,7 @@ async def update_tools_by_id(
     # Is the user the original creator, in a group with write access, or an admin
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -473,7 +482,7 @@ async def update_tools_by_id(
 
     try:
         form_data.content = replace_imports(form_data.content)
-        tool_module, frontmatter = load_tool_module_by_id(id, content=form_data.content)
+        tool_module, frontmatter = await load_tool_module_by_id(id, content=form_data.content)
         form_data.meta.manifest = frontmatter
 
         TOOLS = request.app.state.TOOLS
@@ -481,13 +490,21 @@ async def update_tools_by_id(
 
         specs = get_tool_specs(TOOLS[id])
 
+        form_data.access_grants = await filter_allowed_access_grants(
+            request.app.state.config.USER_PERMISSIONS,
+            user.id,
+            user.role,
+            form_data.access_grants,
+            'sharing.public_tools',
+        )
+
         updated = {
             **form_data.model_dump(exclude={'id'}),
             'specs': specs,
         }
 
         log.debug(updated)
-        tools = Tools.update_tool_by_id(id, updated, db=db)
+        tools = await Tools.update_tool_by_id(id, updated, db=db)
 
         if tools:
             return tools
@@ -519,9 +536,9 @@ async def update_tool_access_by_id(
     id: str,
     form_data: ToolAccessGrantsForm,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -530,7 +547,7 @@ async def update_tool_access_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -544,7 +561,7 @@ async def update_tool_access_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    form_data.access_grants = filter_allowed_access_grants(
+    form_data.access_grants = await filter_allowed_access_grants(
         request.app.state.config.USER_PERMISSIONS,
         user.id,
         user.role,
@@ -552,9 +569,9 @@ async def update_tool_access_by_id(
         'sharing.public_tools',
     )
 
-    AccessGrants.set_access_grants('tool', id, form_data.access_grants, db=db)
+    await AccessGrants.set_access_grants('tool', id, form_data.access_grants, db=db)
 
-    return Tools.get_tool_by_id(id, db=db)
+    return await Tools.get_tool_by_id(id, db=db)
 
 
 ############################
@@ -567,9 +584,9 @@ async def delete_tools_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -578,7 +595,7 @@ async def delete_tools_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -592,7 +609,7 @@ async def delete_tools_by_id(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
-    result = Tools.delete_tool_by_id(id, db=db)
+    result = await Tools.delete_tool_by_id(id, db=db)
     if result:
         TOOLS = request.app.state.TOOLS
         if id in TOOLS:
@@ -607,8 +624,10 @@ async def delete_tools_by_id(
 
 
 @router.get('/id/{id}/valves', response_model=Optional[dict])
-async def get_tools_valves_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    tools = Tools.get_tool_by_id(id, db=db)
+async def get_tools_valves_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -617,7 +636,7 @@ async def get_tools_valves_by_id(id: str, user=Depends(get_verified_user), db: S
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -632,7 +651,7 @@ async def get_tools_valves_by_id(id: str, user=Depends(get_verified_user), db: S
         )
 
     try:
-        valves = Tools.get_tool_valves_by_id(id, db=db)
+        valves = await Tools.get_tool_valves_by_id(id, db=db)
         return valves
     except Exception as e:
         raise HTTPException(
@@ -651,9 +670,9 @@ async def get_tools_valves_spec_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -662,7 +681,7 @@ async def get_tools_valves_spec_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -679,7 +698,7 @@ async def get_tools_valves_spec_by_id(
     if id in request.app.state.TOOLS:
         tools_module = request.app.state.TOOLS[id]
     else:
-        tools_module, _ = load_tool_module_by_id(id)
+        tools_module, _ = await load_tool_module_by_id(id)
         request.app.state.TOOLS[id] = tools_module
 
     if hasattr(tools_module, 'Valves'):
@@ -702,9 +721,9 @@ async def update_tools_valves_by_id(
     id: str,
     form_data: dict,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -713,7 +732,7 @@ async def update_tools_valves_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -730,7 +749,7 @@ async def update_tools_valves_by_id(
     if id in request.app.state.TOOLS:
         tools_module = request.app.state.TOOLS[id]
     else:
-        tools_module, _ = load_tool_module_by_id(id)
+        tools_module, _ = await load_tool_module_by_id(id)
         request.app.state.TOOLS[id] = tools_module
 
     if not hasattr(tools_module, 'Valves'):
@@ -744,7 +763,7 @@ async def update_tools_valves_by_id(
         form_data = {k: v for k, v in form_data.items() if v is not None}
         valves = Valves(**form_data)
         valves_dict = valves.model_dump(exclude_unset=True)
-        Tools.update_tool_valves_by_id(id, valves_dict, db=db)
+        await Tools.update_tool_valves_by_id(id, valves_dict, db=db)
         return valves_dict
     except Exception as e:
         log.exception(f'Failed to update tool valves by id {id}: {e}')
@@ -760,8 +779,10 @@ async def update_tools_valves_by_id(
 
 
 @router.get('/id/{id}/valves/user', response_model=Optional[dict])
-async def get_tools_user_valves_by_id(id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    tools = Tools.get_tool_by_id(id, db=db)
+async def get_tools_user_valves_by_id(
+    id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -770,7 +791,7 @@ async def get_tools_user_valves_by_id(id: str, user=Depends(get_verified_user),
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -785,7 +806,7 @@ async def get_tools_user_valves_by_id(id: str, user=Depends(get_verified_user),
         )
 
     try:
-        user_valves = Tools.get_user_valves_by_id_and_user_id(id, user.id, db=db)
+        user_valves = await Tools.get_user_valves_by_id_and_user_id(id, user.id, db=db)
         return user_valves
     except Exception as e:
         raise HTTPException(
@@ -799,9 +820,9 @@ async def get_tools_user_valves_spec_by_id(
     request: Request,
     id: str,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -810,7 +831,7 @@ async def get_tools_user_valves_spec_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -827,7 +848,7 @@ async def get_tools_user_valves_spec_by_id(
     if id in request.app.state.TOOLS:
         tools_module = request.app.state.TOOLS[id]
     else:
-        tools_module, _ = load_tool_module_by_id(id)
+        tools_module, _ = await load_tool_module_by_id(id)
         request.app.state.TOOLS[id] = tools_module
 
     if hasattr(tools_module, 'UserValves'):
@@ -845,9 +866,9 @@ async def update_tools_user_valves_by_id(
     id: str,
     form_data: dict,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    tools = Tools.get_tool_by_id(id, db=db)
+    tools = await Tools.get_tool_by_id(id, db=db)
     if not tools:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
@@ -856,7 +877,7 @@ async def update_tools_user_valves_by_id(
 
     if (
         tools.user_id != user.id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='tool',
             resource_id=tools.id,
@@ -873,7 +894,7 @@ async def update_tools_user_valves_by_id(
     if id in request.app.state.TOOLS:
         tools_module = request.app.state.TOOLS[id]
     else:
-        tools_module, _ = load_tool_module_by_id(id)
+        tools_module, _ = await load_tool_module_by_id(id)
         request.app.state.TOOLS[id] = tools_module
 
     if hasattr(tools_module, 'UserValves'):
@@ -883,7 +904,7 @@ async def update_tools_user_valves_by_id(
             form_data = {k: v for k, v in form_data.items() if v is not None}
             user_valves = UserValves(**form_data)
             user_valves_dict = user_valves.model_dump(exclude_unset=True)
-            Tools.update_user_valves_by_id_and_user_id(id, user.id, user_valves_dict, db=db)
+            await Tools.update_user_valves_by_id_and_user_id(id, user.id, user_valves_dict, db=db)
             return user_valves_dict
         except Exception as e:
             log.exception(f'Failed to update user valves by id {id}: {e}')

backend/open_webui/routers/users.py

@@ -1,6 +1,6 @@
 import logging
 from typing import Optional
-from sqlalchemy.orm import Session
+from sqlalchemy.ext.asyncio import AsyncSession
 import base64
 import io
 
@@ -14,7 +14,7 @@ from open_webui.models.auths import Auths
 from open_webui.models.oauth_sessions import OAuthSessions
 
 from open_webui.models.groups import Groups
-from open_webui.models.chats import Chats
+
 from open_webui.models.users import (
     UserModel,
     UserGroupIdsModel,
@@ -30,7 +30,7 @@ from open_webui.models.users import (
 
 from open_webui.constants import ERROR_MESSAGES
 from open_webui.env import STATIC_DIR
-from open_webui.internal.db import get_session
+from open_webui.internal.db import get_async_session
 
 
 from open_webui.utils.auth import (
@@ -40,6 +40,7 @@ from open_webui.utils.auth import (
     validate_password,
 )
 from open_webui.utils.access_control import get_permissions, has_permission
+from open_webui.socket.main import disconnect_user_sessions
 
 log = logging.getLogger(__name__)
 
@@ -63,7 +64,7 @@ async def get_users(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -80,14 +81,14 @@ async def get_users(
 
     filter['direction'] = direction
 
-    result = Users.get_users(filter=filter, skip=skip, limit=limit, db=db)
+    result = await Users.get_users(filter=filter, skip=skip, limit=limit, db=db)
 
     users = result['users']
     total = result['total']
 
     # Fetch groups for all users in a single query to avoid N+1
     user_ids = [user.id for user in users]
-    user_groups = Groups.get_groups_by_member_ids(user_ids, db=db)
+    user_groups = await Groups.get_groups_by_member_ids(user_ids, db=db)
 
     return {
         'users': [
@@ -106,9 +107,9 @@ async def get_users(
 @router.get('/all', response_model=UserInfoListResponse)
 async def get_all_users(
     user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    return Users.get_users(db=db)
+    return await Users.get_users(db=db)
 
 
 @router.get('/search', response_model=UserInfoListResponse)
@@ -118,7 +119,7 @@ async def search_users(
     direction: Optional[str] = None,
     page: Optional[int] = 1,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     limit = PAGE_ITEM_COUNT
 
@@ -133,7 +134,7 @@ async def search_users(
     if direction:
         filter['direction'] = direction
 
-    return Users.get_users(filter=filter, skip=skip, limit=limit, db=db)
+    return await Users.get_users(filter=filter, skip=skip, limit=limit, db=db)
 
 
 ############################
@@ -142,8 +143,8 @@ async def search_users(
 
 
 @router.get('/groups')
-async def get_user_groups(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    return Groups.get_groups_by_member_id(user.id, db=db)
+async def get_user_groups(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    return await Groups.get_groups_by_member_id(user.id, db=db)
 
 
 ############################
@@ -155,9 +156,9 @@ async def get_user_groups(user=Depends(get_verified_user), db: Session = Depends
 async def get_user_permissisions(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
-    user_permissions = get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
+    user_permissions = await get_permissions(user.id, request.app.state.config.USER_PERMISSIONS, db=db)
 
     return user_permissions
 
@@ -232,6 +233,7 @@ class FeaturesPermissions(BaseModel):
     image_generation: bool = True
     code_interpreter: bool = True
     memories: bool = True
+    automations: bool = False
 
 
 class SettingsPermissions(BaseModel):
@@ -271,15 +273,11 @@ async def update_default_user_permissions(request: Request, form_data: UserPermi
 
 
 @router.get('/user/settings', response_model=Optional[UserSettings])
-async def get_user_settings_by_session_user(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    user = Users.get_user_by_id(user.id, db=db)
-    if user:
-        return user.settings
-    else:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.USER_NOT_FOUND,
-        )
+async def get_user_settings_by_session_user(
+    user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    # user already fetched by get_verified_user — no need to refetch
+    return user.settings
 
 
 ############################
@@ -292,7 +290,7 @@ async def update_user_settings_by_session_user(
     request: Request,
     form_data: UserSettings,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     updated_user_settings = form_data.model_dump()
     ui_settings = updated_user_settings.get('ui')
@@ -300,7 +298,7 @@ async def update_user_settings_by_session_user(
         user.role != 'admin'
         and ui_settings is not None
         and 'toolServers' in ui_settings.keys()
-        and not has_permission(
+        and not await has_permission(
             user.id,
             'features.direct_tool_servers',
             request.app.state.config.USER_PERMISSIONS,
@@ -309,7 +307,7 @@ async def update_user_settings_by_session_user(
         # If the user is not an admin and does not have permission to use tool servers, remove the key
         updated_user_settings['ui'].pop('toolServers', None)
 
-    user = Users.update_user_settings_by_id(user.id, updated_user_settings, db=db)
+    user = await Users.update_user_settings_by_id(user.id, updated_user_settings, db=db)
     if user:
         return user.settings
     else:
@@ -328,21 +326,15 @@ async def update_user_settings_by_session_user(
 async def get_user_status_by_session_user(
     request: Request,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not request.app.state.config.ENABLE_USER_STATUS:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACTION_PROHIBITED,
         )
-    user = Users.get_user_by_id(user.id, db=db)
-    if user:
-        return user
-    else:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.USER_NOT_FOUND,
-        )
+    # user already fetched by get_verified_user — no need to refetch
+    return user
 
 
 ############################
@@ -355,22 +347,21 @@ async def update_user_status_by_session_user(
     request: Request,
     form_data: UserStatus,
     user=Depends(get_verified_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     if not request.app.state.config.ENABLE_USER_STATUS:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=ERROR_MESSAGES.ACTION_PROHIBITED,
         )
-    user = Users.get_user_by_id(user.id, db=db)
-    if user:
-        user = Users.update_user_status_by_id(user.id, form_data, db=db)
-        return user
-    else:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.USER_NOT_FOUND,
-        )
+    # user already fetched by get_verified_user — no need to refetch
+    updated = await Users.update_user_status_by_id(user.id, form_data, db=db)
+    if updated:
+        return updated
+    raise HTTPException(
+        status_code=status.HTTP_400_BAD_REQUEST,
+        detail=ERROR_MESSAGES.USER_NOT_FOUND,
+    )
 
 
 ############################
@@ -379,15 +370,9 @@ async def update_user_status_by_session_user(
 
 
 @router.get('/user/info', response_model=Optional[dict])
-async def get_user_info_by_session_user(user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    user = Users.get_user_by_id(user.id, db=db)
-    if user:
-        return user.info
-    else:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.USER_NOT_FOUND,
-        )
+async def get_user_info_by_session_user(user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)):
+    # user already fetched by get_verified_user — no need to refetch
+    return user.info
 
 
 ############################
@@ -397,21 +382,15 @@ async def get_user_info_by_session_user(user=Depends(get_verified_user), db: Ses
 
 @router.post('/user/info/update', response_model=Optional[dict])
 async def update_user_info_by_session_user(
-    form_data: dict, user=Depends(get_verified_user), db: Session = Depends(get_session)
+    form_data: dict, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
 ):
-    user = Users.get_user_by_id(user.id, db=db)
-    if user:
-        if user.info is None:
-            user.info = {}
-
-        user = Users.update_user_by_id(user.id, {'info': {**user.info, **form_data}}, db=db)
-        if user:
-            return user.info
-        else:
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail=ERROR_MESSAGES.USER_NOT_FOUND,
-            )
+    # Merges against the auth-time snapshot of user.info. The previous pre-merge
+    # refetch only narrowed (did not eliminate) the lost-update window on concurrent
+    # same-user writes; real safety needs row locking or a version column.
+    existing_info = user.info or {}
+    updated = await Users.update_user_by_id(user.id, {'info': {**existing_info, **form_data}}, db=db)
+    if updated:
+        return updated.info
     else:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -434,28 +413,16 @@ class UserActiveResponse(UserStatus):
 
 
 @router.get('/{user_id}', response_model=UserActiveResponse)
-async def get_user_by_id(user_id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    # Check if user_id is a shared chat
-    # If it is, get the user_id from the chat
-    if user_id.startswith('shared-'):
-        chat_id = user_id.replace('shared-', '')
-        chat = Chats.get_chat_by_id(chat_id)
-        if chat:
-            user_id = chat.user_id
-        else:
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail=ERROR_MESSAGES.USER_NOT_FOUND,
-            )
+async def get_user_by_id(user_id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
 
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
     if user:
-        groups = Groups.get_groups_by_member_id(user_id, db=db)
+        groups = await Groups.get_groups_by_member_id(user_id, db=db)
         return UserActiveResponse(
             **{
                 **user.model_dump(),
                 'groups': [{'id': group.id, 'name': group.name} for group in groups],
-                'is_active': Users.is_user_active(user_id, db=db),
+                'is_active': await Users.is_user_active(user_id, db=db),
             }
         )
     else:
@@ -466,15 +433,17 @@ async def get_user_by_id(user_id: str, user=Depends(get_admin_user), db: Session
 
 
 @router.get('/{user_id}/info', response_model=UserInfoResponse)
-async def get_user_info_by_id(user_id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)):
-    user = Users.get_user_by_id(user_id, db=db)
+async def get_user_info_by_id(
+    user_id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+):
+    user = await Users.get_user_by_id(user_id, db=db)
     if user:
-        groups = Groups.get_groups_by_member_id(user_id, db=db)
+        groups = await Groups.get_groups_by_member_id(user_id, db=db)
         return UserInfoResponse(
             **{
                 **user.model_dump(),
                 'groups': [{'id': group.id, 'name': group.name} for group in groups],
-                'is_active': Users.is_user_active(user_id, db=db),
+                'is_active': await Users.is_user_active(user_id, db=db),
             }
         )
     else:
@@ -485,8 +454,10 @@ async def get_user_info_by_id(user_id: str, user=Depends(get_verified_user), db:
 
 
 @router.get('/{user_id}/oauth/sessions')
-async def get_user_oauth_sessions_by_id(user_id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    sessions = OAuthSessions.get_sessions_by_user_id(user_id, db=db)
+async def get_user_oauth_sessions_by_id(
+    user_id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)
+):
+    sessions = await OAuthSessions.get_sessions_by_user_id(user_id, db=db)
     if sessions and len(sessions) > 0:
         return sessions
     else:
@@ -502,8 +473,8 @@ async def get_user_oauth_sessions_by_id(user_id: str, user=Depends(get_admin_use
 
 
 @router.get('/{user_id}/profile/image')
-def get_user_profile_image_by_id(user_id: str, user=Depends(get_verified_user)):
-    user = Users.get_user_by_id(user_id)
+async def get_user_profile_image_by_id(user_id: str, user=Depends(get_verified_user)):
+    user = await Users.get_user_by_id(user_id)
     if user:
         if user.profile_image_url:
             # check if it's url or base64
@@ -541,10 +512,10 @@ def get_user_profile_image_by_id(user_id: str, user=Depends(get_verified_user)):
 
 @router.get('/{user_id}/active', response_model=dict)
 async def get_user_active_status_by_id(
-    user_id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)
+    user_id: str, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
 ):
     return {
-        'active': Users.is_user_active(user_id, db=db),
+        'active': await Users.is_user_active(user_id, db=db),
     }
 
 
@@ -558,11 +529,11 @@ async def update_user_by_id(
     user_id: str,
     form_data: UserUpdateForm,
     session_user=Depends(get_admin_user),
-    db: Session = Depends(get_session),
+    db: AsyncSession = Depends(get_async_session),
 ):
     # Prevent modification of the primary admin user by other admins
     try:
-        first_user = Users.get_first_user(db=db)
+        first_user = await Users.get_first_user(db=db)
         if first_user:
             if user_id == first_user.id:
                 if session_user.id != user_id:
@@ -572,7 +543,7 @@ async def update_user_by_id(
                         detail=ERROR_MESSAGES.ACTION_PROHIBITED,
                     )
 
-                if form_data.role != 'admin':
+                if form_data.role is not None and form_data.role != 'admin':
                     # If the primary admin is trying to change their own role, prevent it
                     raise HTTPException(
                         status_code=status.HTTP_403_FORBIDDEN,
@@ -586,11 +557,11 @@ async def update_user_by_id(
             detail='Could not verify primary admin status.',
         )
 
-    user = Users.get_user_by_id(user_id, db=db)
+    user = await Users.get_user_by_id(user_id, db=db)
 
     if user:
-        if form_data.email.lower() != user.email:
-            email_user = Users.get_user_by_email(form_data.email.lower(), db=db)
+        if form_data.email is not None and form_data.email.lower() != user.email:
+            email_user = await Users.get_user_by_email(form_data.email.lower(), db=db)
             if email_user:
                 raise HTTPException(
                     status_code=status.HTTP_400_BAD_REQUEST,
@@ -604,21 +575,34 @@ async def update_user_by_id(
                 raise HTTPException(400, detail=str(e))
 
             hashed = get_password_hash(form_data.password)
-            Auths.update_user_password_by_id(user_id, hashed, db=db)
+            await Auths.update_user_password_by_id(user_id, hashed, db=db)
 
-        Auths.update_email_by_id(user_id, form_data.email.lower(), db=db)
-        updated_user = Users.update_user_by_id(
-            user_id,
-            {
-                'role': form_data.role,
-                'name': form_data.name,
-                'email': form_data.email.lower(),
-                'profile_image_url': form_data.profile_image_url,
-            },
-            db=db,
-        )
+        # Build update dict from only the provided fields
+        update_data = {}
+        if form_data.role is not None:
+            update_data['role'] = form_data.role
+        if form_data.name is not None:
+            update_data['name'] = form_data.name
+        if form_data.email is not None:
+            update_data['email'] = form_data.email.lower()
+            await Auths.update_email_by_id(user_id, form_data.email.lower(), db=db)
+        if form_data.profile_image_url is not None:
+            update_data['profile_image_url'] = form_data.profile_image_url
+
+        if update_data:
+            updated_user = await Users.update_user_by_id(
+                user_id,
+                update_data,
+                db=db,
+            )
+        else:
+            updated_user = user
 
         if updated_user:
+            # If the role changed, disconnect all socket sessions so stale
+            # privileges cached in SESSION_POOL are invalidated.
+            if updated_user.role != user.role:
+                await disconnect_user_sessions(user_id)
             return updated_user
 
         raise HTTPException(
@@ -638,10 +622,10 @@ async def update_user_by_id(
 
 
 @router.delete('/{user_id}', response_model=bool)
-async def delete_user_by_id(user_id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
+async def delete_user_by_id(user_id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)):
     # Prevent deletion of the primary admin user
     try:
-        first_user = Users.get_first_user(db=db)
+        first_user = await Users.get_first_user(db=db)
         if first_user and user_id == first_user.id:
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
@@ -655,9 +639,10 @@ async def delete_user_by_id(user_id: str, user=Depends(get_admin_user), db: Sess
         )
 
     if user.id != user_id:
-        result = Auths.delete_auth_by_id(user_id, db=db)
+        result = await Auths.delete_auth_by_id(user_id, db=db)
 
         if result:
+            await disconnect_user_sessions(user_id)
             return True
 
         raise HTTPException(
@@ -678,5 +663,7 @@ async def delete_user_by_id(user_id: str, user=Depends(get_admin_user), db: Sess
 
 
 @router.get('/{user_id}/groups')
-async def get_user_groups_by_id(user_id: str, user=Depends(get_admin_user), db: Session = Depends(get_session)):
-    return Groups.get_groups_by_member_id(user_id, db=db)
+async def get_user_groups_by_id(
+    user_id: str, user=Depends(get_admin_user), db: AsyncSession = Depends(get_async_session)
+):
+    return await Groups.get_groups_by_member_id(user_id, db=db)

backend/open_webui/routers/utils.py

@@ -45,7 +45,7 @@ async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_v
     if not request.app.state.config.ENABLE_CODE_EXECUTION:
         raise HTTPException(
             status_code=403,
-            detail='Code execution is disabled',
+            detail=ERROR_MESSAGES.FEATURE_DISABLED('Code execution'),
         )
 
     if request.app.state.config.CODE_EXECUTION_ENGINE == 'jupyter':
@@ -69,7 +69,7 @@ async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_v
     else:
         raise HTTPException(
             status_code=400,
-            detail='Code execution engine not supported',
+            detail=ERROR_MESSAGES.DEFAULT('Code execution engine not supported'),
         )
 
 

backend/open_webui/socket/main.py

@@ -312,6 +312,24 @@ async def enter_room_for_users(room: str, user_ids: list[str]):
         log.debug(f'Failed to make users {user_ids} join room {room}: {e}')
 
 
+async def disconnect_user_sessions(user_id: str):
+    """Disconnect all Socket.IO sessions belonging to a user.
+
+    Call this when a user's role is changed or the user is deleted so that
+    stale role/permission data cached in SESSION_POOL is invalidated.
+    The client will automatically reconnect and re-authenticate with
+    fresh data from the database.
+    """
+    try:
+        session_ids = get_session_ids_from_room(f'user:{user_id}')
+        for sid in session_ids:
+            await sio.disconnect(sid)
+        if session_ids:
+            log.info(f'Disconnected {len(session_ids)} session(s) for user {user_id}')
+    except Exception as e:
+        log.warning(f'Failed to disconnect sessions for user {user_id}: {e}')
+
+
 @sio.on('usage')
 async def usage(sid, data):
     if sid in SESSION_POOL:
@@ -333,7 +351,7 @@ async def connect(sid, environ, auth):
         data = decode_token(auth['token'])
 
         if data is not None and 'id' in data:
-            user = Users.get_user_by_id(data['id'])
+            user = await Users.get_user_by_id(data['id'])
 
         if user:
             SESSION_POOL[sid] = {
@@ -361,7 +379,7 @@ async def user_join(sid, data):
     if data is None or 'id' not in data:
         return
 
-    user = Users.get_user_by_id(data['id'])
+    user = await Users.get_user_by_id(data['id'])
     if not user:
         return
 
@@ -381,8 +399,8 @@ async def user_join(sid, data):
     await sio.enter_room(sid, f'user:{user.id}')
 
     # Join all the channels only if user has channels permission
-    if user.role == 'admin' or has_permission(user.id, 'features.channels'):
-        channels = Channels.get_channels_by_user_id(user.id)
+    if user.role == 'admin' or await has_permission(user.id, 'features.channels'):
+        channels = await Channels.get_channels_by_user_id(user.id)
         log.debug(f'{channels=}')
         for channel in channels:
             await sio.enter_room(sid, f'channel:{channel.id}')
@@ -395,7 +413,7 @@ async def heartbeat(sid, data):
     user = SESSION_POOL.get(sid)
     if user:
         SESSION_POOL[sid] = {**user, 'last_seen_at': int(time.time())}
-        await asyncio.to_thread(Users.update_last_active_by_id, user['id'])
+        await Users.update_last_active_by_id(user['id'])
 
 
 @sio.on('join-channels')
@@ -408,13 +426,13 @@ async def join_channel(sid, data):
     if data is None or 'id' not in data:
         return
 
-    user = Users.get_user_by_id(data['id'])
+    user = await Users.get_user_by_id(data['id'])
     if not user:
         return
 
     # Join all the channels only if user has channels permission
-    if user.role == 'admin' or has_permission(user.id, 'features.channels'):
-        channels = Channels.get_channels_by_user_id(user.id)
+    if user.role == 'admin' or await has_permission(user.id, 'features.channels'):
+        channels = await Channels.get_channels_by_user_id(user.id)
         log.debug(f'{channels=}')
         for channel in channels:
             await sio.enter_room(sid, f'channel:{channel.id}')
@@ -430,11 +448,11 @@ async def join_note(sid, data):
     if token_data is None or 'id' not in token_data:
         return
 
-    user = Users.get_user_by_id(token_data['id'])
+    user = await Users.get_user_by_id(token_data['id'])
     if not user:
         return
 
-    note = Notes.get_note_by_id(data['note_id'])
+    note = await Notes.get_note_by_id(data['note_id'])
     if not note:
         log.error(f'Note {data["note_id"]} not found for user {user.id}')
         return
@@ -442,7 +460,7 @@ async def join_note(sid, data):
     if (
         user.role != 'admin'
         and user.id != note.user_id
-        and not AccessGrants.has_access(
+        and not await AccessGrants.has_access(
             user_id=user.id,
             resource_type='note',
             resource_id=note.id,
@@ -488,7 +506,20 @@ async def channel_events(sid, data):
             room=room,
         )
     elif event_type == 'last_read_at':
-        Channels.update_member_last_read_at(data['channel_id'], user['id'])
+        await Channels.update_member_last_read_at(data['channel_id'], user['id'])
+
+
+@sio.on('events:chat')
+async def chat_events(sid, data):
+    user = SESSION_POOL.get(sid)
+    if not user:
+        return
+
+    event_data = data.get('data', {})
+    event_type = event_data.get('type')
+
+    if event_type == 'last_read_at':
+        await Chats.update_chat_last_read_at_by_id(data['chat_id'], user['id'])
 
 
 def normalize_document_id(document_id: str) -> str:
@@ -516,7 +547,7 @@ async def ydoc_document_join(sid, data):
 
         if document_id.startswith('note:'):
             note_id = document_id.split(':')[1]
-            note = Notes.get_note_by_id(note_id)
+            note = await Notes.get_note_by_id(note_id)
             if not note:
                 log.error(f'Note {note_id} not found')
                 return
@@ -524,7 +555,7 @@ async def ydoc_document_join(sid, data):
             if (
                 user.get('role') != 'admin'
                 and user.get('id') != note.user_id
-                and not AccessGrants.has_access(
+                and not await AccessGrants.has_access(
                     user_id=user.get('id'),
                     resource_type='note',
                     resource_id=note.id,
@@ -589,7 +620,7 @@ async def document_save_handler(document_id, data, user):
 
     if document_id.startswith('note:'):
         note_id = document_id.split(':')[1]
-        note = Notes.get_note_by_id(note_id)
+        note = await Notes.get_note_by_id(note_id)
         if not note:
             log.error(f'Note {note_id} not found')
             return
@@ -597,17 +628,17 @@ async def document_save_handler(document_id, data, user):
         if (
             user.get('role') != 'admin'
             and user.get('id') != note.user_id
-            and not AccessGrants.has_access(
+            and not await AccessGrants.has_access(
                 user_id=user.get('id'),
                 resource_type='note',
                 resource_id=note.id,
-                permission='read',
+                permission='write',
             )
         ):
-            log.error(f'User {user.get("id")} does not have access to note {note_id}')
+            log.error(f'User {user.get("id")} does not have write access to note {note_id}')
             return
 
-        Notes.update_note_by_id(note_id, NoteUpdateForm(data=data))
+        await Notes.update_note_by_id(note_id, NoteUpdateForm(data=data))
 
 
 @sio.on('ydoc:document:state')
@@ -666,6 +697,31 @@ async def yjs_document_update(sid, data):
             log.warning(f'Session {sid} not in room {room}. Rejecting update.')
             return
 
+        # Verify write permission — room membership only proves read access
+        user = SESSION_POOL.get(sid)
+        if not user:
+            return
+
+        if document_id.startswith('note:'):
+            note_id = document_id.split(':')[1]
+            note = await Notes.get_note_by_id(note_id)
+            if not note:
+                log.error(f'Note {note_id} not found')
+                return
+
+            if (
+                user.get('role') != 'admin'
+                and user.get('id') != note.user_id
+                and not await AccessGrants.has_access(
+                    user_id=user.get('id'),
+                    resource_type='note',
+                    resource_id=note.id,
+                    permission='write',
+                )
+            ):
+                log.warning(f'User {user.get("id")} does not have write access to note {note_id}. Rejecting update.')
+                return
+
         try:
             await stop_item_tasks(REDIS, document_id)
         except Exception:
@@ -693,10 +749,6 @@ async def yjs_document_update(sid, data):
             skip_sid=sid,
         )
 
-        user = SESSION_POOL.get(sid)
-        if not user:
-            return
-
         async def debounced_save():
             await asyncio.sleep(0.5)
             await document_save_handler(document_id, data.get('data', {}), user)
@@ -712,7 +764,7 @@ async def yjs_document_update(sid, data):
 async def yjs_document_leave(sid, data):
     """Handle user leaving a document"""
     try:
-        document_id = data['document_id']
+        document_id = normalize_document_id(data['document_id'])
         user_id = data.get('user_id', sid)
 
         log.info(f'User {user_id} leaving document {document_id}')
@@ -780,7 +832,7 @@ async def disconnect(sid):
         # print(f"Unknown session ID {sid} disconnected")
 
 
-def get_event_emitter(request_info, update_db=True):
+async def get_event_emitter(request_info, update_db=True):
     async def __event_emitter__(event_data):
         user_id = request_info['user_id']
         chat_id = request_info['chat_id']
@@ -800,16 +852,14 @@ def get_event_emitter(request_info, update_db=True):
             event_type = event_data.get('type')
 
             if event_type == 'status':
-                await asyncio.to_thread(
-                    Chats.add_message_status_to_chat_by_id_and_message_id,
+                await Chats.add_message_status_to_chat_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                     event_data.get('data', {}),
                 )
 
             elif event_type == 'message':
-                message = await asyncio.to_thread(
-                    Chats.get_message_by_id_and_message_id,
+                message = await Chats.get_message_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                 )
@@ -818,8 +868,7 @@ def get_event_emitter(request_info, update_db=True):
                     content = message.get('content', '')
                     content += event_data.get('data', {}).get('content', '')
 
-                    await asyncio.to_thread(
-                        Chats.upsert_message_to_chat_by_id_and_message_id,
+                    await Chats.upsert_message_to_chat_by_id_and_message_id(
                         request_info['chat_id'],
                         request_info['message_id'],
                         {
@@ -830,8 +879,7 @@ def get_event_emitter(request_info, update_db=True):
             elif event_type == 'replace':
                 content = event_data.get('data', {}).get('content', '')
 
-                await asyncio.to_thread(
-                    Chats.upsert_message_to_chat_by_id_and_message_id,
+                await Chats.upsert_message_to_chat_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                     {
@@ -840,8 +888,7 @@ def get_event_emitter(request_info, update_db=True):
                 )
 
             elif event_type == 'embeds':
-                message = await asyncio.to_thread(
-                    Chats.get_message_by_id_and_message_id,
+                message = await Chats.get_message_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                 )
@@ -849,8 +896,7 @@ def get_event_emitter(request_info, update_db=True):
                 embeds = event_data.get('data', {}).get('embeds', [])
                 embeds.extend(message.get('embeds', []))
 
-                await asyncio.to_thread(
-                    Chats.upsert_message_to_chat_by_id_and_message_id,
+                await Chats.upsert_message_to_chat_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                     {
@@ -859,8 +905,7 @@ def get_event_emitter(request_info, update_db=True):
                 )
 
             elif event_type == 'files':
-                message = await asyncio.to_thread(
-                    Chats.get_message_by_id_and_message_id,
+                message = await Chats.get_message_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                 )
@@ -868,8 +913,7 @@ def get_event_emitter(request_info, update_db=True):
                 files = event_data.get('data', {}).get('files', [])
                 files.extend(message.get('files', []))
 
-                await asyncio.to_thread(
-                    Chats.upsert_message_to_chat_by_id_and_message_id,
+                await Chats.upsert_message_to_chat_by_id_and_message_id(
                     request_info['chat_id'],
                     request_info['message_id'],
                     {
@@ -880,8 +924,7 @@ def get_event_emitter(request_info, update_db=True):
             elif event_type in ('source', 'citation'):
                 data = event_data.get('data', {})
                 if data.get('type') is None:
-                    message = await asyncio.to_thread(
-                        Chats.get_message_by_id_and_message_id,
+                    message = await Chats.get_message_by_id_and_message_id(
                         request_info['chat_id'],
                         request_info['message_id'],
                     )
@@ -889,8 +932,7 @@ def get_event_emitter(request_info, update_db=True):
                     sources = message.get('sources', [])
                     sources.append(data)
 
-                    await asyncio.to_thread(
-                        Chats.upsert_message_to_chat_by_id_and_message_id,
+                    await Chats.upsert_message_to_chat_by_id_and_message_id(
                         request_info['chat_id'],
                         request_info['message_id'],
                         {
@@ -904,7 +946,7 @@ def get_event_emitter(request_info, update_db=True):
         return None
 
 
-def get_event_call(request_info):
+async def get_event_call(request_info):
     async def __event_caller__(event_data):
         response = await sio.call(
             'events',

backend/open_webui/storage/provider.py

@@ -61,7 +61,7 @@ class LocalStorageProvider(StorageProvider):
         contents = file.read()
         if not contents:
             raise ValueError(ERROR_MESSAGES.EMPTY_CONTENT)
-        file_path = f'{UPLOAD_DIR}/{filename}'
+        file_path = os.path.join(UPLOAD_DIR, filename)
         with open(file_path, 'wb') as f:
             f.write(contents)
         return contents, file_path
@@ -74,8 +74,8 @@ class LocalStorageProvider(StorageProvider):
     @staticmethod
     def delete_file(file_path: str) -> None:
         """Handles deletion of the file from local storage."""
-        filename = file_path.split('/')[-1]
-        file_path = f'{UPLOAD_DIR}/{filename}'
+        filename = os.path.basename(file_path)
+        file_path = os.path.join(UPLOAD_DIR, filename)
         if os.path.isfile(file_path):
             os.remove(file_path)
         else:
@@ -140,7 +140,7 @@ class S3StorageProvider(StorageProvider):
 
     def upload_file(self, file: BinaryIO, filename: str, tags: Dict[str, str]) -> Tuple[bytes, str]:
         """Handles uploading of the file to S3 storage."""
-        _, file_path = LocalStorageProvider.upload_file(file, filename, tags)
+        contents, file_path = LocalStorageProvider.upload_file(file, filename, tags)
         s3_key = os.path.join(self.key_prefix, filename)
         try:
             self.s3_client.upload_file(file_path, self.bucket_name, s3_key)
@@ -153,7 +153,7 @@ class S3StorageProvider(StorageProvider):
                     Tagging=tagging,
                 )
             return (
-                open(file_path, 'rb').read(),
+                contents,
                 f's3://{self.bucket_name}/{s3_key}',
             )
         except ClientError as e:
@@ -202,7 +202,7 @@ class S3StorageProvider(StorageProvider):
         return '/'.join(full_file_path.split('//')[1].split('/')[1:])
 
     def _get_local_file_path(self, s3_key: str) -> str:
-        return f'{UPLOAD_DIR}/{s3_key.split("/")[-1]}'
+        return os.path.join(UPLOAD_DIR, s3_key.split('/')[-1])
 
 
 class GCSStorageProvider(StorageProvider):
@@ -234,7 +234,7 @@ class GCSStorageProvider(StorageProvider):
         """Handles downloading of the file from GCS storage."""
         try:
             filename = file_path.removeprefix('gs://').split('/')[1]
-            local_file_path = f'{UPLOAD_DIR}/{filename}'
+            local_file_path = os.path.join(UPLOAD_DIR, filename)
             blob = self.bucket.get_blob(filename)
             blob.download_to_filename(local_file_path)
 
@@ -298,7 +298,7 @@ class AzureStorageProvider(StorageProvider):
         """Handles downloading of the file from Azure Blob Storage."""
         try:
             filename = file_path.split('/')[-1]
-            local_file_path = f'{UPLOAD_DIR}/{filename}'
+            local_file_path = os.path.join(UPLOAD_DIR, filename)
             blob_client = self.container_client.get_blob_client(filename)
             with open(local_file_path, 'wb') as download_file:
                 download_file.write(blob_client.download_blob().readall())

backend/open_webui/utils/access_control/__init__.py

@@ -11,7 +11,7 @@ from open_webui.models.access_grants import (
 )
 from open_webui.config import DEFAULT_USER_PERMISSIONS
 
-from sqlalchemy.orm import Session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 
 def fill_missing_permissions(permissions: dict[str, Any], default_permissions: dict[str, Any]) -> dict[str, Any]:
@@ -28,10 +28,10 @@ def fill_missing_permissions(permissions: dict[str, Any], default_permissions: d
     return permissions
 
 
-def get_permissions(
+async def get_permissions(
     user_id: str,
     default_permissions: dict[str, Any],
-    db: Session | None = None,
+    db: AsyncSession | None = None,
 ) -> dict[str, Any]:
     """
     Get all permissions for a user by combining the permissions of all groups the user is a member of.
@@ -53,7 +53,7 @@ def get_permissions(
                     permissions[key] = permissions[key] or value  # Use the most permissive value (True > False)
         return permissions
 
-    user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+    user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
 
     # Deep copy default permissions to avoid modifying the original dict
     permissions = json.loads(json.dumps(default_permissions))
@@ -68,11 +68,11 @@ def get_permissions(
     return permissions
 
 
-def has_permission(
+async def has_permission(
     user_id: str,
     permission_key: str,
     default_permissions: dict[str, Any] = {},
-    db: Session | None = None,
+    db: AsyncSession | None = None,
 ) -> bool:
     """
     Check if a user has a specific permission by checking the group permissions
@@ -93,7 +93,7 @@ def has_permission(
     permission_hierarchy = permission_key.split('.')
 
     # Retrieve user group permissions
-    user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+    user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
 
     for group in user_groups:
         if get_permission(group.permissions or {}, permission_hierarchy):
@@ -104,12 +104,12 @@ def has_permission(
     return get_permission(default_permissions, permission_hierarchy)
 
 
-def has_access(
+async def has_access(
     user_id: str,
     permission: str = 'read',
     access_grants: list | None = None,
     user_group_ids: set[str] | None = None,
-    db: Session | None = None,
+    db: AsyncSession | None = None,
 ) -> bool:
     """
     Check if a user has the specified permission using an in-memory access_grants list.
@@ -126,7 +126,7 @@ def has_access(
         return False
 
     if user_group_ids is None:
-        user_groups = Groups.get_groups_by_member_id(user_id, db=db)
+        user_groups = await Groups.get_groups_by_member_id(user_id, db=db)
         user_group_ids = {group.id for group in user_groups}
 
     for grant in access_grants:
@@ -144,7 +144,7 @@ def has_access(
     return False
 
 
-def has_connection_access(
+async def has_connection_access(
     user: UserModel,
     connection: dict,
     user_group_ids: set[str] | None = None,
@@ -163,10 +163,10 @@ def has_connection_access(
         return True
 
     if user_group_ids is None:
-        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
+        user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
 
     access_grants = (connection.get('config') or {}).get('access_grants', [])
-    return has_access(user.id, 'read', access_grants, user_group_ids)
+    return await has_access(user.id, 'read', access_grants, user_group_ids)
 
 
 def migrate_access_control(data: dict, ac_key: str = 'access_control', grants_key: str = 'access_grants') -> None:
@@ -210,13 +210,13 @@ def migrate_access_control(data: dict, ac_key: str = 'access_control', grants_ke
     data.pop(ac_key, None)
 
 
-def filter_allowed_access_grants(
+async def filter_allowed_access_grants(
     default_permissions: dict[str, Any],
     user_id: str,
     user_role: str,
     access_grants: list,
     public_permission_key: str,
-    db: Session | None = None,
+    db: AsyncSession | None = None,
 ) -> list:
     """
     Checks if the user has the required permissions to grant access to a resource.
@@ -228,7 +228,7 @@ def filter_allowed_access_grants(
     # Check if user can share publicly
     if (
         has_public_read_access_grant(access_grants) or has_public_write_access_grant(access_grants)
-    ) and not has_permission(
+    ) and not await has_permission(
         user_id,
         public_permission_key,
         default_permissions,
@@ -246,7 +246,7 @@ def filter_allowed_access_grants(
         ]
 
     # Strip individual user sharing if user lacks permission
-    if has_user_access_grant(access_grants) and not has_permission(
+    if has_user_access_grant(access_grants) and not await has_permission(
         user_id,
         'access_grants.allow_users',
         default_permissions,
@@ -255,3 +255,92 @@ def filter_allowed_access_grants(
         access_grants = strip_user_access_grants(access_grants)
 
     return access_grants
+
+
+async def has_base_model_access(
+    user_id: str,
+    model_info,
+    *,
+    user_group_ids: set[str] | None = None,
+    db=None,
+) -> bool:
+    """
+    Walk the ``base_model_id`` chain and verify the caller has read access
+    at every hop.
+
+    Returns ``True`` when access is granted (or the chain ends at a raw
+    provider model that has no per-model ACL).  Returns ``False`` the
+    moment a registered base model denies access.
+    """
+    from open_webui.models.models import Models
+    from open_webui.models.access_grants import AccessGrants
+
+    base_model_id = getattr(model_info, 'base_model_id', None)
+    seen = {model_info.id}
+    while base_model_id and base_model_id not in seen:
+        seen.add(base_model_id)
+        base_model_info = await Models.get_model_by_id(base_model_id, db=db)
+        if base_model_info is None:
+            break  # Raw provider model — no per-model ACL
+        if not (
+            user_id == base_model_info.user_id
+            or await AccessGrants.has_access(
+                user_id=user_id,
+                resource_type='model',
+                resource_id=base_model_info.id,
+                permission='read',
+                user_group_ids=user_group_ids,
+                db=db,
+            )
+        ):
+            return False
+        base_model_id = getattr(base_model_info, 'base_model_id', None)
+    return True
+
+
+async def check_model_access(
+    user: UserModel,
+    model_info,
+    bypass_filter: bool = False,
+) -> None:
+    """
+    Enforce per-model read access for the given user.
+
+    Raises HTTPException(403) if the user is not authorized.
+    Does nothing if bypass_filter is True.
+
+    Args:
+        user: The authenticated user.
+        model_info: The model record from await Models.get_model_by_id(),
+                    or None if the model is not registered.
+        bypass_filter: If True, skip all access checks (used by
+                       internal callers and BYPASS_MODEL_ACCESS_CONTROL).
+    """
+    from fastapi import HTTPException
+
+    if bypass_filter:
+        return
+
+    if model_info:
+        if user.role == 'user':
+            from open_webui.models.access_grants import AccessGrants
+
+            user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id)}
+            if not (
+                user.id == model_info.user_id
+                or await AccessGrants.has_access(
+                    user_id=user.id,
+                    resource_type='model',
+                    resource_id=model_info.id,
+                    permission='read',
+                    user_group_ids=user_group_ids,
+                )
+            ):
+                raise HTTPException(status_code=403, detail='Model not found')
+
+            # Enforce access on chained base models
+            if not await has_base_model_access(user.id, model_info, user_group_ids=user_group_ids):
+                raise HTTPException(status_code=403, detail='Model not found')
+    else:
+        if user.role != 'admin':
+            raise HTTPException(status_code=403, detail='Model not found')

backend/open_webui/utils/access_control/files.py

@@ -9,16 +9,16 @@ from open_webui.models.groups import Groups
 from open_webui.models.models import Models
 from open_webui.models.access_grants import AccessGrants
 
-from sqlalchemy.orm import Session
+from sqlalchemy.ext.asyncio import AsyncSession
 
 log = logging.getLogger(__name__)
 
 
-def has_access_to_file(
+async def has_access_to_file(
     file_id: str | None,
     access_type: str,
     user: UserModel,
-    db: Session | None = None,
+    db: AsyncSession | None = None,
 ) -> bool:
     """
     Check if a user has the specified access to a file through any of:
@@ -30,7 +30,7 @@ def has_access_to_file(
     NOTE: This does NOT check direct file ownership — callers should check
     file.user_id == user.id separately before calling this.
     """
-    file = Files.get_file_by_id(file_id, db=db)
+    file = await Files.get_file_by_id(file_id, db=db)
     log.debug(f'Checking if user has {access_type} access to file')
     if not file:
         return False
@@ -40,10 +40,10 @@ def has_access_to_file(
         return True
 
     # Check if the file is associated with any knowledge bases the user has access to
-    knowledge_bases = Knowledges.get_knowledges_by_file_id(file_id, db=db)
-    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id, db=db)}
+    knowledge_bases = await Knowledges.get_knowledges_by_file_id(file_id, db=db)
+    user_group_ids = {group.id for group in await Groups.get_groups_by_member_id(user.id, db=db)}
     for knowledge_base in knowledge_bases:
-        if knowledge_base.user_id == user.id or AccessGrants.has_access(
+        if knowledge_base.user_id == user.id or await AccessGrants.has_access(
             user_id=user.id,
             resource_type='knowledge',
             resource_id=knowledge_base.id,
@@ -55,24 +55,32 @@ def has_access_to_file(
 
     knowledge_base_id = file.meta.get('collection_name') if file.meta else None
     if knowledge_base_id:
-        knowledge_bases = Knowledges.get_knowledge_bases_by_user_id(user.id, access_type, db=db)
+        knowledge_bases = await Knowledges.get_knowledge_bases_by_user_id(user.id, access_type, db=db)
         for knowledge_base in knowledge_bases:
             if knowledge_base.id == knowledge_base_id:
                 return True
 
     # Check if the file is associated with any channels the user has access to
-    channels = Channels.get_channels_by_file_id_and_user_id(file_id, user.id, db=db)
+    channels = await Channels.get_channels_by_file_id_and_user_id(file_id, user.id, db=db)
     if access_type == 'read' and channels:
         return True
 
     # Check if the file is associated with any chats the user has access to
-    # TODO: Granular access control for chats
-    chats = Chats.get_shared_chats_by_file_id(file_id, db=db)
-    if chats:
-        return True
+    shared_chat_ids = await Chats.get_shared_chat_ids_by_file_id(file_id, db=db)
+    if shared_chat_ids:
+        accessible_ids = await AccessGrants.get_accessible_resource_ids(
+            user_id=user.id,
+            resource_type='shared_chat',
+            resource_ids=shared_chat_ids,
+            permission='read',
+            user_group_ids=user_group_ids,
+            db=db,
+        )
+        if accessible_ids:
+            return True
 
     # Check if the file is directly attached to a shared workspace model
-    for model in Models.get_models_by_user_id(user.id, permission=access_type, db=db):
+    for model in await Models.get_models_by_user_id(user.id, permission=access_type, db=db):
         knowledge_items = getattr(model.meta, 'knowledge', None) or []
         for item in knowledge_items:
             if isinstance(item, dict) and item.get('type') == 'file' and item.get('id') == file.id:

backend/open_webui/utils/actions.py

@@ -26,7 +26,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
     else:
         sub_action_id = None
 
-    action = Functions.get_function_by_id(action_id)
+    action = await Functions.get_function_by_id(action_id)
     if not action:
         raise Exception(f'Action not found: {action_id}')
 
@@ -47,7 +47,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
         raise Exception('Model not found')
     model = models[model_id]
 
-    __event_emitter__ = get_event_emitter(
+    __event_emitter__ = await get_event_emitter(
         {
             'chat_id': data['chat_id'],
             'message_id': data['id'],
@@ -55,7 +55,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
             'user_id': user.id,
         }
     )
-    __event_call__ = get_event_call(
+    __event_call__ = await get_event_call(
         {
             'chat_id': data['chat_id'],
             'message_id': data['id'],
@@ -64,10 +64,10 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
         }
     )
 
-    function_module, _, _ = get_function_module_from_cache(request, action_id)
+    function_module, _, _ = await get_function_module_from_cache(request, action_id)
 
     if hasattr(function_module, 'valves') and hasattr(function_module, 'Valves'):
-        valves = Functions.get_function_valves_by_id(action_id)
+        valves = await Functions.get_function_valves_by_id(action_id)
         function_module.valves = function_module.Valves(**(valves if valves else {}))
 
     if hasattr(function_module, 'action'):
@@ -98,7 +98,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
                 try:
                     if hasattr(function_module, 'UserValves'):
                         __user__['valves'] = function_module.UserValves(
-                            **Functions.get_user_valves_by_id_and_user_id(action_id, user.id)
+                            **await Functions.get_user_valves_by_id_and_user_id(action_id, user.id)
                         )
                 except Exception as e:
                     log.exception(f'Failed to get user values: {e}')
@@ -111,7 +111,7 @@ async def chat_action(request: Request, action_id: str, form_data: dict, user: A
                 data = action(**params)
 
             # Process action result for Rich UI embeds (HTMLResponse, tuple with headers)
-            processed_result, _, action_embeds = process_tool_result(
+            processed_result, _, action_embeds = await process_tool_result(
                 request,
                 action_id,
                 data,

backend/open_webui/utils/anthropic.py

@@ -181,17 +181,99 @@ def convert_anthropic_to_openai_payload(anthropic_payload: dict) -> dict:
                     )
                 elif block_type == 'tool_result':
                     # Tool results become separate tool messages in OpenAI format
-                    tool_content = block.get('content', '')
-                    if isinstance(tool_content, list):
-                        tool_text_parts = []
-                        for tc in tool_content:
-                            if isinstance(tc, dict) and tc.get('type') == 'text':
-                                tool_text_parts.append(tc.get('text', ''))
-                        tool_content = '\n'.join(tool_text_parts)
+                    tool_result_content = block.get('content', '')
+                    tool_content: str | list = ''
+
+                    if isinstance(tool_result_content, str):
+                        tool_content = tool_result_content
+                    elif isinstance(tool_result_content, list):
+                        # Build a multimodal content array to preserve
+                        # images and other non-text content types.
+                        converted_parts = []
+                        for content_block in tool_result_content:
+                            if not isinstance(content_block, dict):
+                                continue
+                            content_type = content_block.get('type', 'text')
+
+                            if content_type == 'text':
+                                converted_parts.append(
+                                    {
+                                        'type': 'text',
+                                        'text': content_block.get('text', ''),
+                                    }
+                                )
+                            elif content_type == 'image':
+                                source = content_block.get('source', {})
+                                if source.get('type') == 'base64':
+                                    media_type = source.get('media_type', 'image/png')
+                                    data = source.get('data', '')
+                                    converted_parts.append(
+                                        {
+                                            'type': 'image_url',
+                                            'image_url': {
+                                                'url': f'data:{media_type};base64,{data}',
+                                            },
+                                        }
+                                    )
+                                elif source.get('type') == 'url':
+                                    converted_parts.append(
+                                        {
+                                            'type': 'image_url',
+                                            'image_url': {
+                                                'url': source.get('url', ''),
+                                            },
+                                        }
+                                    )
+                            elif content_type == 'document':
+                                # Documents have no direct OpenAI equivalent;
+                                # convert to a text representation.
+                                document_source = content_block.get('source', {})
+                                document_title = content_block.get('title', 'Document')
+                                document_context = content_block.get('context', '')
+                                document_text = f'[Document: {document_title}]'
+                                if document_context:
+                                    document_text += f'\n{document_context}'
+                                if document_source.get('type') == 'text' and document_source.get('data'):
+                                    document_text += f'\n{document_source["data"]}'
+                                converted_parts.append({'type': 'text', 'text': document_text})
+                            elif content_type == 'search_result':
+                                # Convert search results to a text
+                                # representation with source attribution.
+                                search_title = content_block.get('title', '')
+                                search_url = content_block.get('source', '')
+                                search_content_blocks = content_block.get('content', [])
+                                search_texts = []
+                                for search_block in search_content_blocks:
+                                    if isinstance(search_block, dict) and search_block.get('type') == 'text':
+                                        search_texts.append(search_block.get('text', ''))
+                                search_body = '\n'.join(search_texts)
+                                search_text = f'[Search Result: {search_title}]'
+                                if search_url:
+                                    search_text += f'\nSource: {search_url}'
+                                if search_body:
+                                    search_text += f'\n{search_body}'
+                                converted_parts.append({'type': 'text', 'text': search_text})
+
+                        # Flatten to string when only text parts are present
+                        if all(part.get('type') == 'text' for part in converted_parts):
+                            tool_content = '\n'.join(part.get('text', '') for part in converted_parts)
+                        elif converted_parts:
+                            tool_content = converted_parts
+                        else:
+                            tool_content = ''
 
                     # Propagate error status if present
                     if block.get('is_error'):
-                        tool_content = f'Error: {tool_content}'
+                        if isinstance(tool_content, str):
+                            tool_content = f'Error: {tool_content}'
+                        elif isinstance(tool_content, list):
+                            tool_content.insert(
+                                0,
+                                {
+                                    'type': 'text',
+                                    'text': 'Error: ',
+                                },
+                            )
 
                     messages.append(
                         {

backend/open_webui/utils/asgi_middleware.py

@@ -0,0 +1,268 @@
+"""
+Pure-ASGI replacements for the project's previous
+`@app.middleware('http')` / `BaseHTTPMiddleware` middlewares.
+
+Why this matters
+----------------
+Starlette's `BaseHTTPMiddleware` (which `@app.middleware('http')` is
+sugar for) runs the downstream app inside an `anyio` task group. When
+the wrapper exits — for any reason: response complete, client
+disconnect, an outer middleware bailing out — the task group cancels
+the inner task. That `CancelledError` then propagates into whatever
+the inner task was doing, including in-flight DB queries, embedding
+calls and disk I/O.
+
+In Open WebUI this surfaces as:
+
+* SQLAlchemy logging multi-page `NotImplementedError:
+  terminate_force_close()` tracebacks at ERROR every time a request is
+  cancelled mid-DB-call (the aiosqlite connector cleanup path).
+* Spurious cancellations cascading through the four stacked
+  `@app.middleware('http')` wrappers.
+
+Pure ASGI middleware does not introduce a cancel scope around the
+downstream app, so client disconnects propagate the way ASGI was
+designed to (via `receive()` returning `http.disconnect`) instead of
+being injected as `CancelledError` into arbitrary `await` points.
+
+Reference: https://www.starlette.io/middleware/#limitations
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+import time
+from urllib.parse import parse_qs, urlencode
+
+from fastapi.responses import JSONResponse, RedirectResponse
+from fastapi.security import HTTPAuthorizationCredentials
+from starlette.datastructures import MutableHeaders
+from starlette.requests import Request
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from open_webui.internal.db import ScopedSession
+from open_webui.utils.auth import get_http_authorization_cred
+
+log = logging.getLogger(__name__)
+
+
+class CommitSessionMiddleware:
+    """Commit and release the thread-local sync `ScopedSession` after each
+    HTTP request.
+
+    Most requests now use the async session; the sync ScopedSession is
+    only touched by startup, healthchecks, and a handful of legacy
+    helpers (notably the pgvector / opengauss vector-DB clients). The
+    middleware exists so that PostgreSQL connections do not accumulate
+    as "idle in transaction" and so that any pending sync work made
+    inside the request is durably persisted.
+
+    Failure semantics
+    -----------------
+    * Downstream raised → roll back any pending sync work, release the
+      connection, and re-raise so the outer exception middleware can
+      turn it into an error response. We never commit work on a
+      request that did not complete successfully.
+    * Downstream returned → commit pending sync work; on commit
+      failure, log loudly, roll back, and re-raise. Note that in pure
+      ASGI the response messages have already been emitted by the
+      time `await self.app(...)` returns, so a commit failure cannot
+      retroactively change what the client sees on the wire — but
+      re-raising still surfaces the error in logs and to ASGI servers
+      that expose it. We deliberately do not buffer the response to
+      gate it on commit success, because that would defeat streaming
+      responses (chat completions, SSE) which are core to the app.
+
+    For request paths where commit-before-send is required, manage the
+    sync session explicitly inside the handler instead of relying on
+    this middleware.
+    """
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope['type'] != 'http':
+            await self.app(scope, receive, send)
+            return
+
+        try:
+            await self.app(scope, receive, send)
+        except BaseException:
+            # Downstream did not complete successfully. Roll back any
+            # pending sync writes, release the connection, and let the
+            # exception propagate.
+            try:
+                ScopedSession.rollback()
+            except Exception:
+                log.exception('CommitSessionMiddleware: rollback failed after downstream error')
+            finally:
+                ScopedSession.remove()
+            raise
+
+        # Downstream completed. Commit pending sync work.
+        try:
+            ScopedSession.commit()
+        except Exception:
+            log.exception('CommitSessionMiddleware: post-request commit failed; response was already sent to client')
+            try:
+                ScopedSession.rollback()
+            except Exception:
+                log.exception('CommitSessionMiddleware: rollback failed after commit failure')
+            raise
+        finally:
+            # CRITICAL: remove() returns the connection to the pool.
+            # Without this, connections remain "checked out" and
+            # accumulate as "idle in transaction" in PostgreSQL.
+            ScopedSession.remove()
+
+
+class AuthTokenMiddleware:
+    """Extract the bearer/cookie/x-api-key credential and stash it on
+    `request.state.token`.
+
+    Routes that depend on `get_verified_user` etc. read this state.
+    Also exposes `request.state.enable_api_keys` (snapshotted at request
+    entry from runtime config) and stamps an `X-Process-Time` response
+    header.
+    """
+
+    def __init__(self, app: ASGIApp, *, fastapi_app) -> None:
+        self.app = app
+        self._fastapi_app = fastapi_app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope['type'] != 'http':
+            await self.app(scope, receive, send)
+            return
+
+        start_time = time.monotonic()
+        request = Request(scope)
+
+        token = get_http_authorization_cred(request.headers.get('Authorization'))
+        if token is None:
+            cookie_token = request.cookies.get('token')
+            if cookie_token:
+                token = HTTPAuthorizationCredentials(scheme='Bearer', credentials=cookie_token)
+        if token is None:
+            api_key = request.headers.get('x-api-key')
+            if api_key:
+                token = HTTPAuthorizationCredentials(scheme='Bearer', credentials=api_key)
+
+        request.state.token = token
+        request.state.enable_api_keys = self._fastapi_app.state.config.ENABLE_API_KEYS
+
+        async def send_with_timing(message: Message) -> None:
+            if message['type'] == 'http.response.start':
+                process_time = int(time.monotonic() - start_time)
+                headers = MutableHeaders(scope=message)
+                headers['X-Process-Time'] = str(process_time)
+            await send(message)
+
+        await self.app(scope, receive, send_with_timing)
+
+
+class WebsocketUpgradeGuardMiddleware:
+    """Reject HTTP requests to `/ws/socket.io` that claim
+    `transport=websocket` but lack the proper `Upgrade`/`Connection`
+    headers.
+
+    Works around https://github.com/miguelgrinberg/python-engineio/issues/367
+    where engineio mishandles such requests.
+    """
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope['type'] != 'http':
+            await self.app(scope, receive, send)
+            return
+
+        path = scope.get('path', '')
+        if '/ws/socket.io' in path:
+            query_string = scope.get('query_string', b'').decode('latin-1', errors='replace')
+            query_params = parse_qs(query_string)
+            if query_params.get('transport', [''])[0] == 'websocket':
+                headers = _scope_headers(scope)
+                upgrade = headers.get('upgrade', '').lower()
+                connection_tokens = [token.strip() for token in headers.get('connection', '').lower().split(',')]
+                if upgrade != 'websocket' or 'upgrade' not in connection_tokens:
+                    response = JSONResponse(
+                        status_code=400,
+                        content={'detail': 'Invalid WebSocket upgrade request'},
+                    )
+                    await response(scope, receive, send)
+                    return
+
+        await self.app(scope, receive, send)
+
+
+class RedirectMiddleware:
+    """Rewrites a couple of legacy entry-points to the SPA's own routes:
+
+    * ``GET /watch?v=ID`` (YouTube) → ``/?youtube=ID``
+    * ``GET /?shared=…`` (PWA share-target) → ``/?youtube=…`` /
+      ``/?load-url=…`` / ``/?q=…``
+    """
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope['type'] != 'http' or scope.get('method', '').upper() != 'GET':
+            await self.app(scope, receive, send)
+            return
+
+        path = scope.get('path', '')
+        query_string = scope.get('query_string', b'').decode('latin-1', errors='replace')
+        query_params = parse_qs(query_string)
+
+        redirect_params: dict[str, str] = {}
+        if path.endswith('/watch') and 'v' in query_params and query_params['v']:
+            redirect_params['youtube'] = query_params['v'][0]
+
+        if 'shared' in query_params and query_params['shared']:
+            text = query_params['shared'][0]
+            if text:
+                url_match = re.match(r'https://\S+', text)
+                if url_match:
+                    # Local import: youtube loader pulls heavy deps and is
+                    # only needed when a share-target actually contains a
+                    # YouTube URL.
+                    from open_webui.retrieval.loaders.youtube import _parse_video_id
+
+                    youtube_video_id = _parse_video_id(url_match[0])
+                    if youtube_video_id:
+                        redirect_params['youtube'] = youtube_video_id
+                    else:
+                        redirect_params['load-url'] = url_match[0]
+                else:
+                    redirect_params['q'] = text
+
+        if redirect_params:
+            redirect_url = f'/?{urlencode(redirect_params)}'
+            response = RedirectResponse(url=redirect_url)
+            await response(scope, receive, send)
+            return
+
+        await self.app(scope, receive, send)
+
+
+def _scope_headers(scope: Scope) -> dict[str, str]:
+    """Return ASGI scope headers as a lower-cased str→str dict.
+
+    ASGI delivers headers as a list of (bytes, bytes) pairs. For
+    convenience, fold duplicate keys with comma-joining (matching
+    HTTP/1.1 semantics).
+    """
+    decoded: dict[str, str] = {}
+    for raw_key, raw_value in scope.get('headers', []):
+        key = raw_key.decode('latin-1').lower()
+        value = raw_value.decode('latin-1')
+        if key in decoded:
+            decoded[key] = f'{decoded[key]}, {value}'
+        else:
+            decoded[key] = value
+    return decoded

backend/open_webui/utils/audit.py

@@ -24,7 +24,7 @@ from asgiref.typing import (
 from loguru import logger
 from starlette.requests import Request
 
-from open_webui.env import AUDIT_LOG_LEVEL, AUDIT_INCLUDED_PATHS, MAX_BODY_LOG_SIZE
+from open_webui.env import AUDIT_LOG_LEVEL, ENABLE_AUDIT_GET_REQUESTS, AUDIT_INCLUDED_PATHS, MAX_BODY_LOG_SIZE
 from open_webui.utils.auth import get_current_user, get_http_authorization_cred
 from open_webui.models.users import UserModel
 
@@ -117,7 +117,7 @@ class AuditLoggingMiddleware:
     ASGI middleware that intercepts HTTP requests and responses to perform audit logging. It captures request/response bodies (depending on audit level), headers, HTTP methods, and user information, then logs a structured audit entry at the end of the request cycle.
     """
 
-    AUDITED_METHODS = {'PUT', 'PATCH', 'DELETE', 'POST'}
+    DEFAULT_AUDITED_METHODS = {'PUT', 'PATCH', 'DELETE', 'POST'}
 
     def __init__(
         self,
@@ -127,12 +127,16 @@ class AuditLoggingMiddleware:
         included_paths: Optional[list[str]] = None,
         max_body_size: int = MAX_BODY_LOG_SIZE,
         audit_level: AuditLevel = AuditLevel.NONE,
+        audit_get_requests: bool = False,
     ) -> None:
         self.app = app
         self.audit_logger = AuditLogger(logger)
         self.excluded_paths = excluded_paths or []
         self.included_paths = included_paths or []
         self.max_body_size = max_body_size
+        self.audited_methods = set(self.DEFAULT_AUDITED_METHODS)
+        if audit_get_requests:
+            self.audited_methods.add('GET')
         self.audit_level = audit_level
 
         if self.included_paths and self.excluded_paths:
@@ -202,7 +206,10 @@ class AuditLoggingMiddleware:
         return None
 
     def _should_skip_auditing(self, request: Request) -> bool:
-        if request.method not in {'POST', 'PUT', 'PATCH', 'DELETE'} or AUDIT_LOG_LEVEL == 'NONE':
+        if AUDIT_LOG_LEVEL == 'NONE':
+            return True
+
+        if request.method not in self.audited_methods:
             return True
 
         ALWAYS_LOG_ENDPOINTS = {

backend/open_webui/utils/auth.py

@@ -19,8 +19,6 @@ import pytz
 from pytz import UTC
 from typing import Optional, Union, List, Dict
 
-from opentelemetry import trace
-
 
 from open_webui.utils.access_control import has_permission
 from open_webui.models.users import Users
@@ -30,6 +28,7 @@ from open_webui.models.auths import Auths
 from open_webui.constants import ERROR_MESSAGES
 
 from open_webui.env import (
+    ENABLE_OTEL,
     ENABLE_PASSWORD_VALIDATION,
     OFFLINE_MODE,
     LICENSE_BLOB,
@@ -206,7 +205,7 @@ def create_token(data: dict, expires_delta: Union[timedelta, None] = None) -> st
         payload.update({'exp': expire})
 
     jti = str(uuid.uuid4())
-    payload.update({'jti': jti})
+    payload.update({'jti': jti, 'iat': datetime.now(UTC)})
 
     encoded_jwt = jwt.encode(payload, SESSION_SECRET, algorithm=ALGORITHM)
     return encoded_jwt
@@ -221,15 +220,34 @@ def decode_token(token: str) -> Optional[dict]:
 
 
 async def is_valid_token(request, decoded) -> bool:
-    # Require Redis to check revoked tokens
+    """
+    Check whether a JWT has been revoked. Two mechanisms:
+    1. Per-token (jti) — used by user-initiated sign-out (known jti).
+    2. Per-user (revoked_at) — used by OIDC back-channel logout when
+       individual jti values are unknown; rejects tokens with iat <= revoked_at.
+    """
     if request.app.state.redis:
+        # Per-token revocation
         jti = decoded.get('jti')
-
         if jti:
             revoked = await request.app.state.redis.get(f'{REDIS_KEY_PREFIX}:auth:token:{jti}:revoked')
             if revoked:
                 return False
 
+        # Per-user revocation (OIDC back-channel logout)
+        user_id = decoded.get('id')
+        if user_id:
+            revoked_at = await request.app.state.redis.get(f'{REDIS_KEY_PREFIX}:auth:user:{user_id}:revoked_at')
+            if revoked_at:
+                try:
+                    revoked_at_ts = int(revoked_at)
+                    token_iat = decoded.get('iat')
+                    # No iat means legacy token — reject since we can't verify issue time
+                    if token_iat is None or token_iat <= revoked_at_ts:
+                        return False
+                except (ValueError, TypeError):
+                    pass
+
     return True
 
 
@@ -303,15 +321,18 @@ async def get_current_user(
 
     # auth by api key
     if token.startswith('sk-'):
-        user = get_current_user_by_api_key(request, token)
+        user = await get_current_user_by_api_key(request, token)
 
         # Add user info to current span
-        current_span = trace.get_current_span()
-        if current_span:
-            current_span.set_attribute('client.user.id', user.id)
-            current_span.set_attribute('client.user.email', user.email)
-            current_span.set_attribute('client.user.role', user.role)
-            current_span.set_attribute('client.auth.type', 'api_key')
+        if ENABLE_OTEL:
+            from opentelemetry import trace
+
+            current_span = trace.get_current_span()
+            if current_span:
+                current_span.set_attribute('client.user.id', user.id)
+                current_span.set_attribute('client.user.email', user.email)
+                current_span.set_attribute('client.user.role', user.role)
+                current_span.set_attribute('client.auth.type', 'api_key')
 
         return user
 
@@ -332,7 +353,7 @@ async def get_current_user(
                     detail='Invalid token',
                 )
 
-            user = Users.get_user_by_id(data['id'])
+            user = await Users.get_user_by_id(data['id'])
             if user is None:
                 raise HTTPException(
                     status_code=status.HTTP_401_UNAUTHORIZED,
@@ -348,17 +369,21 @@ async def get_current_user(
                         )
 
                 # Add user info to current span
-                current_span = trace.get_current_span()
-                if current_span:
-                    current_span.set_attribute('client.user.id', user.id)
-                    current_span.set_attribute('client.user.email', user.email)
-                    current_span.set_attribute('client.user.role', user.role)
-                    current_span.set_attribute('client.auth.type', 'jwt')
+                if ENABLE_OTEL:
+                    from opentelemetry import trace
 
-                # Refresh the user's last active timestamp asynchronously
-                # to prevent blocking the request
-                if background_tasks:
-                    background_tasks.add_task(Users.update_last_active_by_id, user.id)
+                    current_span = trace.get_current_span()
+                    if current_span:
+                        current_span.set_attribute('client.user.id', user.id)
+                        current_span.set_attribute('client.user.email', user.email)
+                        current_span.set_attribute('client.user.role', user.role)
+                        current_span.set_attribute('client.auth.type', 'jwt')
+
+                # Refresh the user's last active timestamp
+                # Fire-and-forget via asyncio.create_task to avoid blocking
+                import asyncio
+
+                asyncio.create_task(Users.update_last_active_by_id(user.id))
             return user
         else:
             raise HTTPException(
@@ -380,9 +405,9 @@ async def get_current_user(
         raise e
 
 
-def get_current_user_by_api_key(request, api_key: str):
+async def get_current_user_by_api_key(request, api_key: str):
     # Each function call manages its own short-lived session internally
-    user = Users.get_user_by_api_key(api_key)
+    user = await Users.get_user_by_api_key(api_key)
 
     if user is None:
         raise HTTPException(
@@ -392,7 +417,7 @@ def get_current_user_by_api_key(request, api_key: str):
 
     if not request.state.enable_api_keys or (
         user.role != 'admin'
-        and not has_permission(
+        and not await has_permission(
             user.id,
             'features.api_keys',
             request.app.state.config.USER_PERMISSIONS,
@@ -400,15 +425,33 @@ def get_current_user_by_api_key(request, api_key: str):
     ):
         raise HTTPException(status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.API_KEY_NOT_ALLOWED)
 
-    # Add user info to current span
-    current_span = trace.get_current_span()
-    if current_span:
-        current_span.set_attribute('client.user.id', user.id)
-        current_span.set_attribute('client.user.email', user.email)
-        current_span.set_attribute('client.user.role', user.role)
-        current_span.set_attribute('client.auth.type', 'api_key')
+    # Enforce endpoint restrictions — checked here (not in middleware)
+    # so it applies regardless of how the API key was transported
+    # (Authorization header, cookie, x-api-key header, etc.).
+    if request.app.state.config.ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS:
+        allowed_paths = [
+            path.strip() for path in str(request.app.state.config.API_KEYS_ALLOWED_ENDPOINTS).split(',') if path.strip()
+        ]
+        request_path = request.url.path
+        is_allowed = any(request_path == allowed or request_path.startswith(allowed + '/') for allowed in allowed_paths)
+        if not is_allowed:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+            )
 
-    Users.update_last_active_by_id(user.id)
+    # Add user info to current span
+    if ENABLE_OTEL:
+        from opentelemetry import trace
+
+        current_span = trace.get_current_span()
+        if current_span:
+            current_span.set_attribute('client.user.id', user.id)
+            current_span.set_attribute('client.user.email', user.email)
+            current_span.set_attribute('client.user.role', user.role)
+            current_span.set_attribute('client.auth.type', 'api_key')
+
+    await Users.update_last_active_by_id(user.id)
     return user
 
 
@@ -430,7 +473,7 @@ def get_admin_user(user=Depends(get_current_user)):
     return user
 
 
-def create_admin_user(email: str, password: str, name: str = 'Admin'):
+async def create_admin_user(email: str, password: str, name: str = 'Admin'):
     """
     Create an admin user from environment variables.
     Used for headless/automated deployments.
@@ -440,14 +483,14 @@ def create_admin_user(email: str, password: str, name: str = 'Admin'):
     if not email or not password:
         return None
 
-    if Users.has_users():
+    if await Users.has_users():
         log.debug('Users already exist, skipping admin creation')
         return None
 
     log.info(f'Creating admin account from environment variables: {email}')
     try:
         hashed = get_password_hash(password)
-        user = Auths.insert_new_auth(
+        user = await Auths.insert_new_auth(
             email=email.lower(),
             password=hashed,
             name=name,

backend/open_webui/utils/automations.py

@@ -0,0 +1,593 @@
+"""
+Automation utilities and unified scheduler.
+
+RRULE helpers, scheduler worker loop, and execution logic.
+Follows the utils/<feature>.py pattern (cf. utils/channels.py, utils/task.py).
+
+The scheduler_worker_loop handles all time-based background work:
+  - Automation execution (claim_due → execute)
+  - Calendar event alerts (upcoming events → socket + webhook notifications)
+
+Environment:
+    SCHEDULER_POLL_INTERVAL             – seconds between polls (default: 10)
+    CALENDAR_ALERT_LOOKAHEAD_MINUTES   – default alert window (default: 5)
+"""
+
+import asyncio
+import logging
+import os
+import random
+import time
+from datetime import datetime
+from typing import Optional
+from uuid import uuid4
+from zoneinfo import ZoneInfo
+
+from dateutil.rrule import rrulestr
+from fastapi import Request
+from starlette.datastructures import Headers
+
+from open_webui.constants import ERROR_MESSAGES
+from open_webui.models.automations import Automations, AutomationRuns, AutomationModel
+from open_webui.models.chats import ChatForm, Chats
+from open_webui.models.users import Users
+from open_webui.utils.task import prompt_template
+from open_webui.internal.db import get_async_db
+
+log = logging.getLogger(__name__)
+
+SCHEDULER_POLL_INTERVAL = int(os.getenv('SCHEDULER_POLL_INTERVAL', os.getenv('AUTOMATION_POLL_INTERVAL', '10')))
+CALENDAR_ALERT_LOOKAHEAD_MINUTES = int(os.getenv('CALENDAR_ALERT_LOOKAHEAD_MINUTES', '10'))
+
+
+####################
+# RRULE Helpers
+####################
+
+
+def _resolve_tz(tz: str = None) -> Optional[ZoneInfo]:
+    """Safely resolve a timezone string to ZoneInfo.
+
+    Returns None (→ server-local fallback) when *tz* is empty, None,
+    or an unrecognised IANA key.  Logs a warning on bad keys so
+    misconfiguration is visible in the server logs.
+    """
+    if not tz:
+        return None
+    try:
+        return ZoneInfo(tz)
+    except (KeyError, Exception):
+        log.warning('Unknown timezone %r — falling back to server time', tz)
+        return None
+
+
+def _parse_rule(s: str):
+    """Parse RRULE with clock-aligned DTSTART for sub-daily frequencies.
+
+    MINUTELY/HOURLY rules use a fixed epoch DTSTART (2000-01-01 00:00)
+    so intervals snap to clock boundaries (e.g. every 5min = :00, :05, :10).
+    """
+    raw = s.replace('RRULE:', '')
+    parts = dict(p.split('=', 1) for p in raw.split(';') if '=' in p)
+    freq = parts.get('FREQ', '')
+
+    if freq in ('MINUTELY', 'HOURLY'):
+        epoch = datetime(2000, 1, 1, 0, 0, 0)
+        return rrulestr(s, dtstart=epoch, ignoretz=True)
+    return rrulestr(s, ignoretz=True)
+
+
+def validate_rrule(s: str, tz: str = None) -> None:
+    """Raise ValueError if the RRULE is malformed or exhausted.
+
+    When *tz* is provided the "now" reference uses the user's local
+    clock so that near-future schedules are not incorrectly rejected
+    on servers whose system clock is ahead (e.g. UTC vs US timezones).
+    """
+    try:
+        rule = _parse_rule(s)
+    except Exception as e:
+        raise ValueError(ERROR_MESSAGES.AUTOMATION_INVALID_RRULE(e))
+    zi = _resolve_tz(tz)
+    now = datetime.now(zi).replace(tzinfo=None) if zi else datetime.now()
+    if rule.after(now) is None:
+        raise ValueError(ERROR_MESSAGES.AUTOMATION_NO_FUTURE_RUNS)
+
+
+def next_run_ns(s: str, tz: str = None) -> Optional[int]:
+    """Next occurrence as epoch nanoseconds, respecting user timezone."""
+    zi = _resolve_tz(tz)
+    now = datetime.now(zi) if zi else datetime.now()
+    dt = _parse_rule(s).after(now.replace(tzinfo=None))
+    if dt is None:
+        return None
+    if zi:
+        dt = dt.replace(tzinfo=zi)
+    return int(dt.timestamp() * 1_000_000_000)
+
+
+def next_n_runs_ns(s: str, n: int = 5, tz: str = None) -> list[int]:
+    """Compute next N occurrences for UI preview.
+
+    Uses the user's timezone for the starting "now" so that the
+    preview matches the user's local clock (same as next_run_ns).
+    """
+    zi = _resolve_tz(tz)
+    rule = _parse_rule(s)
+    result = []
+    now = datetime.now(zi).replace(tzinfo=None) if zi else datetime.now()
+    dt = now
+    for _ in range(n):
+        dt = rule.after(dt)
+        if not dt:
+            break
+        if zi:
+            dt_tz = dt.replace(tzinfo=zi)
+            result.append(int(dt_tz.timestamp() * 1_000_000_000))
+        else:
+            result.append(int(dt.timestamp() * 1_000_000_000))
+    return result
+
+
+def rrule_interval_seconds(s: str) -> Optional[int]:
+    """Approximate interval between recurrences in seconds.
+
+    Returns None for one-shot (COUNT=1) schedules or rules
+    with fewer than two future occurrences.
+    """
+    if 'COUNT=1' in s:
+        return None
+    rule = _parse_rule(s)
+    now = datetime.now()
+    first = rule.after(now)
+    if first is None:
+        return None
+    second = rule.after(first)
+    if second is None:
+        return None
+    return int((second - first).total_seconds())
+
+
+############################
+# Worker Loop
+############################
+
+
+# Keep the old name as an alias so any stale imports still work.
+async def automation_worker_loop(app) -> None:
+    """Deprecated alias — use scheduler_worker_loop."""
+    await scheduler_worker_loop(app)
+
+
+async def scheduler_worker_loop(app) -> None:
+    """Unified background scheduler for all time-based work.
+
+    Handles:
+      1. Automation execution  (ENABLE_AUTOMATIONS)
+      2. Calendar event alerts (ENABLE_CALENDAR)
+
+    Runs on every instance. Poll interval is configurable via
+    SCHEDULER_POLL_INTERVAL env var (default: 10 seconds).
+    """
+    log.info(f'Scheduler worker started (poll interval: {SCHEDULER_POLL_INTERVAL}s)')
+    while True:
+        try:
+            # ── Automations ──
+            if getattr(app.state.config, 'ENABLE_AUTOMATIONS', False):
+                try:
+                    async with get_async_db() as db:
+                        batch = await Automations.claim_due(int(time.time_ns()), limit=10, db=db)
+                    if batch:
+                        log.info(f'Claimed {len(batch)} due automation(s)')
+                    for automation in batch:
+                        asyncio.create_task(execute_automation(app, automation))
+                except Exception:
+                    log.exception('Scheduler: automation error')
+
+            # ── Calendar Alerts ──
+            if getattr(app.state.config, 'ENABLE_CALENDAR', False):
+                try:
+                    await _check_calendar_alerts(app)
+                except Exception:
+                    log.exception('Scheduler: calendar alert error')
+
+        except Exception:
+            log.exception('Scheduler worker error')
+
+        # Jitter to spread load across instances
+        await asyncio.sleep(SCHEDULER_POLL_INTERVAL + random.uniform(0, 2))
+
+
+##########################
+# Execute
+####################
+
+
+def _build_request(app) -> Request:
+    """Build a minimal ASGI Request for chat_completion.
+
+    Mirrors the mock-request pattern used in main.py lifespan
+    (model pre-fetch, tool server init) for consistency.
+    """
+    scope = {
+        'type': 'http',
+        'asgi': {'version': '3.0', 'spec_version': '2.0'},
+        'method': 'POST',
+        'path': '/api/v1/automations/internal',
+        'query_string': b'',
+        'headers': Headers({}).raw,
+        'client': ('127.0.0.1', 0),
+        'server': ('127.0.0.1', 80),
+        'scheme': 'http',
+        'app': app,
+    }
+    request = Request(scope)
+    # Ensure request.state is initialized with required attributes
+    request.state.token = None
+    request.state.enable_api_keys = False
+    return request
+
+
+def _resolve_model_tool_ids(app, model_id: str) -> list[str]:
+    """Read model-attached tool_ids from model config.
+
+    The frontend does this in Chat.svelte (model.info.meta.toolIds).
+    The backend never auto-resolves them, so we must do it explicitly.
+    """
+    models = getattr(app.state, 'MODELS', {})
+    model = models.get(model_id, {})
+    tool_ids = model.get('info', {}).get('meta', {}).get('toolIds', [])
+    return list(tool_ids) if tool_ids else []
+
+
+def _resolve_model_features(app, model_id: str) -> dict:
+    """Read model default features from model config.
+
+    The frontend does this in Chat.svelte (model.info.meta.defaultFeatureIds
+    + model.info.meta.capabilities). Enables features like web_search,
+    code_interpreter, image_generation when the model has them as defaults
+    AND the capability is enabled AND the admin has enabled the feature.
+    """
+    models = getattr(app.state, 'MODELS', {})
+    model = models.get(model_id, {})
+    meta = model.get('info', {}).get('meta', {})
+
+    default_feature_ids = meta.get('defaultFeatureIds', [])
+    if not default_feature_ids:
+        return {}
+
+    capabilities = meta.get('capabilities', {})
+    config = app.state.config
+    features = {}
+
+    # code_interpreter is excluded: it requires the frontend event emitter
+    # and does not work in headless backend execution.
+    feature_checks = {
+        'web_search': getattr(config, 'ENABLE_WEB_SEARCH', False),
+        'image_generation': getattr(config, 'ENABLE_IMAGE_GENERATION', False),
+    }
+
+    for feature_id in default_feature_ids:
+        if feature_id in feature_checks:
+            # Feature must be: in defaultFeatureIds + capability enabled + admin enabled
+            if capabilities.get(feature_id) and feature_checks[feature_id]:
+                features[feature_id] = True
+
+    return features
+
+
+def _resolve_model_filter_ids(app, model_id: str) -> list[str]:
+    """Read model default filter_ids from model config."""
+    models = getattr(app.state, 'MODELS', {})
+    model = models.get(model_id, {})
+    filter_ids = model.get('info', {}).get('meta', {}).get('defaultFilterIds', [])
+    return list(filter_ids) if filter_ids else []
+
+
+def _resolve_model_terminal_id(app, model_id: str) -> Optional[str]:
+    """Read model default terminal_id from model config.
+
+    The frontend does this in Chat.svelte (model.info.meta.terminalId).
+    """
+    models = getattr(app.state, 'MODELS', {})
+    model = models.get(model_id, {})
+    return model.get('info', {}).get('meta', {}).get('terminalId') or None
+
+
+async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) -> None:
+    """Set the working directory on a terminal server via the proxy.
+
+    Routes through the open-webui terminal proxy endpoint so that
+    auth headers, orchestrator policy routing, and X-User-Id are
+    handled correctly — same path the frontend uses.
+    """
+    import aiohttp
+    from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
+
+    connections = getattr(getattr(app, 'state', None), 'config', None)
+    if connections is None:
+        return
+    connections = getattr(connections, 'TERMINAL_SERVER_CONNECTIONS', None) or []
+    connection = next((c for c in connections if c.get('id') == server_id), None)
+    if connection is None:
+        log.warning(f'Terminal server {server_id} not found for CWD set')
+        return
+
+    base_url = (connection.get('url') or '').rstrip('/')
+    if not base_url:
+        return
+
+    # Build target URL — route through orchestrator policy if configured
+    policy_id = connection.get('policy_id')
+    if connection.get('server_type') == 'orchestrator' and policy_id:
+        target_url = f'{base_url}/p/{policy_id}/files/cwd'
+    else:
+        target_url = f'{base_url}/files/cwd'
+
+    headers = {'Content-Type': 'application/json', 'X-User-Id': user.id}
+    if chat_id:
+        headers['X-Session-Id'] = chat_id
+
+    auth_type = connection.get('auth_type', 'bearer')
+    if auth_type == 'bearer':
+        headers['Authorization'] = f'Bearer {connection.get("key", "")}'
+
+    try:
+        async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=10)) as session:
+            async with session.post(
+                target_url,
+                json={'path': cwd},
+                headers=headers,
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
+            ) as resp:
+                if resp.status != 200:
+                    body = await resp.text()
+                    log.warning(f'Failed to set terminal CWD to {cwd}: HTTP {resp.status} — {body[:200]}')
+    except Exception as e:
+        log.warning(f'Failed to set terminal CWD: {e}')
+
+
+async def execute_automation(app, automation: AutomationModel) -> None:
+    """Execute an automation through the full chat completion pipeline.
+
+    Creates a real chat, then calls chat_completion exactly like the frontend:
+    session_id + chat_id + message_id → async task → pipeline handles everything
+    (filters, model params, knowledge/RAG, tools, DB saves, webhooks).
+    """
+    try:
+        user = await Users.get_user_by_id(automation.user_id)
+        if not user:
+            await _record_run(automation.id, 'error', error='User not found')
+            return
+
+        prompt = prompt_template(automation.data['prompt'], user)
+        model_id = automation.data['model_id']
+        terminal_config = automation.data.get('terminal')
+
+        # Generate proper UUIDs for messages (same as frontend)
+        user_msg_id = str(uuid4())
+        assistant_msg_id = str(uuid4())
+
+        chat_id = str(uuid4())
+        chat = await Chats.insert_new_chat(
+            chat_id,
+            automation.user_id,
+            ChatForm(
+                chat={
+                    'title': automation.name,
+                    'models': [model_id],
+                    'history': {
+                        'currentId': assistant_msg_id,
+                        'messages': {
+                            user_msg_id: {
+                                'id': user_msg_id,
+                                'parentId': None,
+                                'role': 'user',
+                                'content': prompt,
+                                'childrenIds': [assistant_msg_id],
+                                'timestamp': int(time.time()),
+                                'models': [model_id],
+                            },
+                            assistant_msg_id: {
+                                'id': assistant_msg_id,
+                                'parentId': user_msg_id,
+                                'role': 'assistant',
+                                'content': '',
+                                'done': False,
+                                'model': model_id,
+                                'childrenIds': [],
+                                'timestamp': int(time.time()),
+                            },
+                        },
+                    },
+                    'messages': [
+                        {'role': 'user', 'content': prompt},
+                    ],
+                    'meta': {'automation_id': automation.id},
+                }
+            ),
+        )
+
+        if not chat:
+            await _record_run(automation.id, 'error', error='Failed to create chat')
+            return
+
+        # Notify frontend to refresh chat list
+        from open_webui.socket.main import sio
+
+        await sio.emit(
+            'events',
+            {
+                'chat_id': chat.id,
+                'message_id': user_msg_id,
+                'data': {'type': 'chat:list'},
+            },
+            room=f'user:{automation.user_id}',
+        )
+
+        # Resolve model defaults (frontend does this, backend doesn't)
+        tool_ids = _resolve_model_tool_ids(app, model_id)
+        features = _resolve_model_features(app, model_id)
+        filter_ids = _resolve_model_filter_ids(app, model_id)
+
+        # Resolve terminal from model config
+        terminal_id = _resolve_model_terminal_id(app, model_id)
+
+        # Build the same payload the frontend sends to /api/chat/completions
+        form_data = {
+            'model': model_id,
+            'messages': [{'role': 'user', 'content': prompt}],
+            'stream': True,
+            'chat_id': chat.id,
+            'id': assistant_msg_id,
+            'parent_id': None,  # Root message (chat already created above)
+            'user_message': {
+                'id': user_msg_id,
+                'parentId': None,
+                'role': 'user',
+                'content': prompt,
+            },
+            'session_id': f'automation:{automation.id}',
+            'background_tasks': {},
+        }
+        if tool_ids:
+            form_data['tool_ids'] = tool_ids
+        if features:
+            form_data['features'] = features
+        if filter_ids:
+            form_data['filter_ids'] = filter_ids
+        if terminal_id:
+            form_data['terminal_id'] = terminal_id
+
+        # Call the full chat completion pipeline (same as POST /api/chat/completions).
+        # The handler reference is stored on app.state to avoid circular imports.
+        request = _build_request(app)
+        await app.state.CHAT_COMPLETION_HANDLER(request, form_data, user=user)
+
+        # Notify user
+        from open_webui.socket.main import sio
+
+        await sio.emit(
+            'automation:result',
+            {
+                'automation_id': automation.id,
+                'name': automation.name,
+                'chat_id': chat.id,
+                'status': 'success',
+            },
+            room=f'user:{automation.user_id}',
+        )
+
+        await _record_run(automation.id, 'success', chat_id=chat.id)
+
+    except Exception as e:
+        log.exception(f'Automation {automation.id} failed')
+        await _record_run(automation.id, 'error', error=str(e)[:4000])
+
+
+####################
+# Internals
+####################
+
+
+async def _check_calendar_alerts(app) -> None:
+    """Check for upcoming calendar events and send alert notifications.
+
+    De-duplication is DB-backed via meta.alerted_at — survives restarts
+    and works across multiple instances.
+    """
+    from open_webui.models.calendar import CalendarEvents, CalendarEventUpdateForm
+    from open_webui.socket.main import sio
+
+    now_ns = int(time.time_ns())
+    default_lookahead_ns = CALENDAR_ALERT_LOOKAHEAD_MINUTES * 60 * 1_000_000_000
+
+    async with get_async_db() as db:
+        upcoming = await CalendarEvents.get_upcoming_events(now_ns, default_lookahead_ns, db=db)
+
+    if not upcoming:
+        return
+
+    for event, user_tz in upcoming:
+        # Skip if already alerted for this start time
+        if event.meta and event.meta.get('alerted_at'):
+            continue
+
+        # Compute minutes until event starts
+        minutes_until = max(0, int((event.start_at - now_ns) / (60 * 1_000_000_000)))
+
+        alert_data = {
+            'event_id': event.id,
+            'title': event.title,
+            'description': event.description or '',
+            'start_at': event.start_at,
+            'minutes_until': minutes_until,
+            'calendar_id': event.calendar_id,
+            'location': event.location or '',
+        }
+
+        await sio.emit(
+            'events',
+            {
+                'data': {
+                    'type': 'calendar:alert',
+                    'data': alert_data,
+                },
+            },
+            room=f'user:{event.user_id}',
+        )
+
+        # Mark as alerted in DB so it survives restarts / multi-instance
+        try:
+            await CalendarEvents.update_event_by_id(
+                event.id,
+                CalendarEventUpdateForm(meta={'alerted_at': now_ns}),
+            )
+        except Exception:
+            log.debug(f'Failed to mark event {event.id} as alerted', exc_info=True)
+
+        # Send webhook notification if user has one configured
+        try:
+            webui_name = getattr(app.state, 'WEBUI_NAME', 'Open WebUI')
+            enable_user_webhooks = getattr(app.state.config, 'ENABLE_USER_WEBHOOKS', False)
+
+            if enable_user_webhooks:
+                user = await Users.get_user_by_id(event.user_id)
+                if user and user.settings:
+                    webhook_url = (
+                        user.settings.get('ui', {}).get('notifications', {}).get('webhook_url', None)
+                        if isinstance(user.settings, dict)
+                        else getattr(getattr(user.settings, 'ui', None), 'get', lambda *a: None)(
+                            'notifications', {}
+                        ).get('webhook_url', None)
+                        if hasattr(user.settings, 'ui')
+                        else None
+                    )
+                    if webhook_url:
+                        from open_webui.utils.webhook import post_webhook
+
+                        time_str = f'in {minutes_until} min' if minutes_until > 0 else 'now'
+                        await post_webhook(
+                            webui_name,
+                            webhook_url,
+                            f'{event.title} — starting {time_str}',
+                            {
+                                'action': 'calendar_alert',
+                                'title': event.title,
+                                'minutes_until': minutes_until,
+                                'event_id': event.id,
+                            },
+                        )
+        except Exception:
+            log.debug(f'Failed to send webhook for calendar alert {event.id}', exc_info=True)
+
+
+async def _record_run(
+    automation_id: str,
+    status: str,
+    chat_id: str = None,
+    error: str = None,
+):
+    """Insert a run record into automation_run."""
+    async with get_async_db() as db:
+        await AutomationRuns.insert(automation_id, status, chat_id=chat_id, error=error, db=db)

backend/open_webui/utils/calendar.py

@@ -0,0 +1,83 @@
+"""
+Calendar utilities.
+
+RRULE expansion reusing the automation infra.
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Optional
+from zoneinfo import ZoneInfo
+
+from open_webui.utils.automations import _parse_rule
+
+log = logging.getLogger(__name__)
+
+
+def expand_recurring_event(
+    event_dict: dict,
+    range_start_ns: int,
+    range_end_ns: int,
+    tz: Optional[str] = None,
+    max_instances: int = 5000,
+) -> list[dict]:
+    """Expand a recurring event into individual instances within a date range.
+
+    Takes an event dict (from CalendarEventModel.model_dump()) and produces
+    one dict per occurrence, with adjusted start_at / end_at.
+    """
+    from dateutil.rrule import rrulestr
+
+    rrule_str = event_dict.get('rrule')
+    if not rrule_str:
+        return [event_dict]
+
+    range_start_dt = datetime.fromtimestamp(range_start_ns / 1_000_000_000)
+    range_end_dt = datetime.fromtimestamp(range_end_ns / 1_000_000_000)
+    scan_start = range_start_dt - timedelta(days=1)
+
+    try:
+        # Parse with dtstart near the range so we never iterate from epoch
+        rule = rrulestr(rrule_str, dtstart=scan_start, ignoretz=True)
+    except Exception:
+        log.warning(f'Failed to parse RRULE for event {event_dict.get("id")}: {rrule_str}')
+        return [event_dict]
+
+    original_start_ns = event_dict['start_at']
+    original_end_ns = event_dict.get('end_at')
+    duration_ns = (original_end_ns - original_start_ns) if original_end_ns else None
+
+    instances = []
+    dt = rule.after(scan_start, inc=True)
+
+    while dt and dt < range_end_dt and len(instances) < max_instances:
+        if tz:
+            try:
+                dt_tz = dt.replace(tzinfo=ZoneInfo(tz))
+                instance_start_ns = int(dt_tz.timestamp() * 1_000_000_000)
+            except Exception:
+                instance_start_ns = int(dt.timestamp() * 1_000_000_000)
+        else:
+            instance_start_ns = int(dt.timestamp() * 1_000_000_000)
+
+        if instance_start_ns >= range_start_ns:
+            instance = {
+                **event_dict,
+                'start_at': instance_start_ns,
+                'end_at': (instance_start_ns + duration_ns) if duration_ns else None,
+                'instance_id': f'{event_dict["id"]}_{instance_start_ns}',
+            }
+            instances.append(instance)
+
+        dt = rule.after(dt)
+
+    return instances
+
+
+def ns_from_date(year: int, month: int, day: int, tz: Optional[str] = None) -> int:
+    """Create epoch nanoseconds from a date."""
+    if tz:
+        dt = datetime(year, month, day, tzinfo=ZoneInfo(tz))
+    else:
+        dt = datetime(year, month, day)
+    return int(dt.timestamp() * 1_000_000_000)

backend/open_webui/utils/chat.py

@@ -10,7 +10,7 @@ import json
 import uuid
 import asyncio
 
-from fastapi import Request, status
+from fastapi import HTTPException, Request, status
 from starlette.responses import Response, StreamingResponse, JSONResponse
 
 
@@ -72,7 +72,7 @@ async def generate_direct_chat_completion(
     session_id = metadata.get('session_id')
     request_id = str(uuid.uuid4())  # Generate a unique request ID
 
-    event_caller = get_event_call(metadata)
+    event_caller = await get_event_call(metadata)
 
     channel = f'{user_id}:{session_id}:{request_id}'
     logging.info(f'WebSocket channel: {channel}')
@@ -199,7 +199,7 @@ async def generate_chat_completion(
         # Check if user has access to the model
         if not bypass_filter and user.role == 'user':
             try:
-                check_model_access(user, model)
+                await check_model_access(user, model)
             except Exception as e:
                 raise e
 
@@ -316,6 +316,10 @@ async def chat_completed(request: Request, form_data: dict, user: Any):
         models = request.app.state.MODELS
 
     data = form_data
+
+    if not data.get('id'):
+        raise Exception('Missing message id')
+
     model_id = data['model']
     if model_id not in models:
         raise Exception('Model not found')
@@ -324,9 +328,14 @@ async def chat_completed(request: Request, form_data: dict, user: Any):
 
     try:
         data = await process_pipeline_outlet_filter(request, data, user, models)
+    except HTTPException:
+        raise
     except Exception as e:
         raise Exception(f'Error: {e}')
 
+    if not data.get('id'):
+        raise Exception('Missing message id')
+
     metadata = {
         'chat_id': data['chat_id'],
         'message_id': data['id'],
@@ -336,8 +345,8 @@ async def chat_completed(request: Request, form_data: dict, user: Any):
     }
 
     extra_params = {
-        '__event_emitter__': get_event_emitter(metadata),
-        '__event_call__': get_event_call(metadata),
+        '__event_emitter__': await get_event_emitter(metadata),
+        '__event_call__': await get_event_call(metadata),
         '__user__': user.model_dump() if isinstance(user, UserModel) else {},
         '__metadata__': metadata,
         '__request__': request,
@@ -345,8 +354,8 @@ async def chat_completed(request: Request, form_data: dict, user: Any):
     }
 
     try:
-        filter_ids = get_sorted_filter_ids(request, model, metadata.get('filter_ids', []))
-        filter_functions = Functions.get_functions_by_ids(filter_ids)
+        filter_ids = await get_sorted_filter_ids(request, model, metadata.get('filter_ids', []))
+        filter_functions = await Functions.get_functions_by_ids(filter_ids)
 
         result, _ = await process_filter_functions(
             request=request,

backend/open_webui/utils/embeddings.py

@@ -68,7 +68,7 @@ async def generate_embeddings(
     # Access filtering
     if not getattr(request.state, 'direct', False):
         if not bypass_filter and user.role == 'user':
-            check_model_access(user, model)
+            await check_model_access(user, model)
 
     # Ollama backend — use /api/embed which supports batch input natively
     if model.get('owned_by') == 'ollama':

backend/open_webui/utils/files.py

@@ -20,42 +20,66 @@ from open_webui.models.files import Files
 from open_webui.routers.files import upload_file_handler
 from open_webui.retrieval.web.utils import validate_url
 
+import asyncio
 import mimetypes
 import base64
 import io
 import re
 
-import requests
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK
+from open_webui.utils.session_pool import get_session
 
 BASE64_IMAGE_URL_PREFIX = re.compile(r'data:image/\w+;base64,', re.IGNORECASE)
 MARKDOWN_IMAGE_URL_PATTERN = re.compile(r'!\[(.*?)\]\((.+?)\)', re.IGNORECASE)
 
+# Extension-based MIME fallback, only used when ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK is True.
+_IMAGE_MIME_FALLBACK = {
+    '.webp': 'image/webp',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.bmp': 'image/bmp',
+    '.tiff': 'image/tiff',
+    '.tif': 'image/tiff',
+    '.ico': 'image/x-icon',
+    '.heic': 'image/heic',
+    '.heif': 'image/heif',
+    '.avif': 'image/avif',
+}
 
-def get_image_base64_from_url(url: str) -> Optional[str]:
+
+async def get_image_base64_from_url(url: str) -> Optional[str]:
     try:
         if url.startswith('http'):
             # Validate URL to prevent SSRF attacks against local/private networks
             validate_url(url)
             # Download the image from the URL
-            response = requests.get(url)
-            response.raise_for_status()
-            image_data = response.content
-            encoded_string = base64.b64encode(image_data).decode('utf-8')
-            content_type = response.headers.get('Content-Type', 'image/png')
-            return f'data:{content_type};base64,{encoded_string}'
+            session = await get_session()
+            async with session.get(url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as response:
+                response.raise_for_status()
+                image_data = await response.read()
+                encoded_string = base64.b64encode(image_data).decode('utf-8')
+                content_type = response.headers.get('Content-Type', 'image/png')
+                return f'data:{content_type};base64,{encoded_string}'
         else:
-            file = Files.get_file_by_id(url)
+            file = await Files.get_file_by_id(url)
 
             if not file:
                 return None
 
-            file_path = Storage.get_file(file.path)
+            file_path = await asyncio.to_thread(Storage.get_file, file.path)
             file_path = Path(file_path)
 
             if file_path.is_file():
                 with open(file_path, 'rb') as image_file:
                     encoded_string = base64.b64encode(image_file.read()).decode('utf-8')
-                    content_type, _ = mimetypes.guess_type(file_path.name)
+                    content_type = mimetypes.guess_type(file_path.name)[0] or (file.meta or {}).get('content_type')
+                    if not content_type and ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK:
+                        content_type = _IMAGE_MIME_FALLBACK.get(file_path.suffix.lower())
+                    if not content_type:
+                        return None
                     return f'data:{content_type};base64,{encoded_string}'
             else:
                 return None
@@ -64,13 +88,13 @@ def get_image_base64_from_url(url: str) -> Optional[str]:
         return None
 
 
-def get_image_url_from_base64(request, base64_image_string, metadata, user):
+async def get_image_url_from_base64(request, base64_image_string, metadata, user):
     if BASE64_IMAGE_URL_PREFIX.match(base64_image_string):
         image_url = ''
         # Extract base64 image data from the line
-        image_data, content_type = get_image_data(base64_image_string)
+        image_data, content_type = await get_image_data(base64_image_string)
         if image_data is not None:
-            _, image_url = upload_image(
+            _, image_url = await upload_image(
                 request,
                 image_data,
                 content_type,
@@ -82,17 +106,26 @@ def get_image_url_from_base64(request, base64_image_string, metadata, user):
     return None
 
 
-def convert_markdown_base64_images(request, content: str, metadata, user):
-    def replace(match):
-        base64_string = match.group(2)
-        MIN_REPLACEMENT_URL_LENGTH = 1024
-        if len(base64_string) > MIN_REPLACEMENT_URL_LENGTH:
-            url = get_image_url_from_base64(request, base64_string, metadata, user)
-            if url:
-                return f'![{match.group(1)}]({url})'
-        return match.group(0)
+async def convert_markdown_base64_images(request, content: str, metadata, user):
+    MIN_REPLACEMENT_URL_LENGTH = 1024
+    result_parts = []
+    last_end = 0
 
-    return MARKDOWN_IMAGE_URL_PATTERN.sub(replace, content)
+    for match in MARKDOWN_IMAGE_URL_PATTERN.finditer(content):
+        result_parts.append(content[last_end : match.start()])
+        base64_string = match.group(2)
+        if len(base64_string) > MIN_REPLACEMENT_URL_LENGTH:
+            url = await get_image_url_from_base64(request, base64_string, metadata, user)
+            if url:
+                result_parts.append(f'![{match.group(1)}]({url})')
+            else:
+                result_parts.append(match.group(0))
+        else:
+            result_parts.append(match.group(0))
+        last_end = match.end()
+
+    result_parts.append(content[last_end:])
+    return ''.join(result_parts)
 
 
 def load_b64_audio_data(b64_str):
@@ -110,7 +143,7 @@ def load_b64_audio_data(b64_str):
         return None, None
 
 
-def upload_audio(request, audio_data, content_type, metadata, user):
+async def upload_audio(request, audio_data, content_type, metadata, user):
     audio_format = mimetypes.guess_extension(content_type)
     file = UploadFile(
         file=io.BytesIO(audio_data),
@@ -119,7 +152,7 @@ def upload_audio(request, audio_data, content_type, metadata, user):
             'content-type': content_type,
         },
     )
-    file_item = upload_file_handler(
+    file_item = await upload_file_handler(
         request,
         file=file,
         metadata=metadata,
@@ -130,13 +163,13 @@ def upload_audio(request, audio_data, content_type, metadata, user):
     return url
 
 
-def get_audio_url_from_base64(request, base64_audio_string, metadata, user):
+async def get_audio_url_from_base64(request, base64_audio_string, metadata, user):
     if 'data:audio/wav;base64' in base64_audio_string:
         audio_url = ''
         # Extract base64 audio data from the line
         audio_data, content_type = load_b64_audio_data(base64_audio_string)
         if audio_data is not None:
-            audio_url = upload_audio(
+            audio_url = await upload_audio(
                 request,
                 audio_data,
                 content_type,
@@ -147,30 +180,32 @@ def get_audio_url_from_base64(request, base64_audio_string, metadata, user):
     return None
 
 
-def get_file_url_from_base64(request, base64_file_string, metadata, user):
+async def get_file_url_from_base64(request, base64_file_string, metadata, user):
     if BASE64_IMAGE_URL_PREFIX.match(base64_file_string):
-        return get_image_url_from_base64(request, base64_file_string, metadata, user)
+        return await get_image_url_from_base64(request, base64_file_string, metadata, user)
     elif 'data:audio/wav;base64' in base64_file_string:
-        return get_audio_url_from_base64(request, base64_file_string, metadata, user)
+        return await get_audio_url_from_base64(request, base64_file_string, metadata, user)
     return None
 
 
-def get_image_base64_from_file_id(id: str) -> Optional[str]:
-    file = Files.get_file_by_id(id)
+async def get_image_base64_from_file_id(id: str) -> Optional[str]:
+    file = await Files.get_file_by_id(id)
     if not file:
         return None
 
     try:
-        file_path = Storage.get_file(file.path)
+        file_path = await asyncio.to_thread(Storage.get_file, file.path)
         file_path = Path(file_path)
 
         # Check if the file already exists in the cache
         if file_path.is_file():
-            import base64
-
             with open(file_path, 'rb') as image_file:
                 encoded_string = base64.b64encode(image_file.read()).decode('utf-8')
-                content_type, _ = mimetypes.guess_type(file_path.name)
+                content_type = mimetypes.guess_type(file_path.name)[0] or (file.meta or {}).get('content_type')
+                if not content_type and ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK:
+                    content_type = _IMAGE_MIME_FALLBACK.get(file_path.suffix.lower())
+                if not content_type:
+                    return None
                 return f'data:{content_type};base64,{encoded_string}'
         else:
             return None

backend/open_webui/utils/filter.py

@@ -10,44 +10,53 @@ from open_webui.models.functions import Functions
 log = logging.getLogger(__name__)
 
 
-def get_function_module(request, function_id, load_from_db=True):
+async def get_function_module(request, function_id, load_from_db=True):
     """
     Get the function module by its ID.
     """
-    function_module, _, _ = get_function_module_from_cache(request, function_id, load_from_db)
+    function_module, _, _ = await get_function_module_from_cache(request, function_id, load_from_db)
     return function_module
 
 
-def get_sorted_filter_ids(request, model: dict, enabled_filter_ids: list = None):
-    def get_priority(function_id):
+async def get_sorted_filter_ids(request, model: dict, enabled_filter_ids: list = None):
+    async def get_priority(function_id):
         try:
-            function_module = get_function_module(request, function_id)
+            function_module = await get_function_module(request, function_id)
             if function_module and hasattr(function_module, 'Valves'):
-                valves_db = Functions.get_function_valves_by_id(function_id)
+                valves_db = await Functions.get_function_valves_by_id(function_id)
                 valves = function_module.Valves(**(valves_db if valves_db else {}))
                 return getattr(valves, 'priority', 0)
         except Exception:
             pass
         return 0
 
-    filter_ids = [function.id for function in Functions.get_global_filter_functions()]
+    filter_ids = [function.id for function in await Functions.get_global_filter_functions()]
     if 'info' in model and 'meta' in model['info']:
         filter_ids.extend(model['info']['meta'].get('filterIds', []))
         filter_ids = list(set(filter_ids))
-    active_filter_ids = {function.id for function in Functions.get_functions_by_type('filter', active_only=True)}
+    active_filter_ids = {function.id for function in await Functions.get_functions_by_type('filter', active_only=True)}
 
-    def get_active_status(filter_id):
-        function_module = get_function_module(request, filter_id)
+    async def get_active_status(filter_id):
+        function_module = await get_function_module(request, filter_id)
 
         if getattr(function_module, 'toggle', None):
             return filter_id in (enabled_filter_ids or set())
 
         return True
 
-    active_filter_ids = {filter_id for filter_id in active_filter_ids if get_active_status(filter_id)}
+    # Pre-compute active status for each filter (async functions can't be used in set comprehensions)
+    resolved_active = {}
+    for filter_id in active_filter_ids:
+        resolved_active[filter_id] = await get_active_status(filter_id)
+    active_filter_ids = {fid for fid, is_active in resolved_active.items() if is_active}
 
     filter_ids = [fid for fid in filter_ids if fid in active_filter_ids]
-    filter_ids.sort(key=lambda fid: (get_priority(fid), fid))
+
+    # Pre-compute priorities (async functions can't be used in sort keys)
+    priorities = {}
+    for fid in filter_ids:
+        priorities[fid] = await get_priority(fid)
+    filter_ids.sort(key=lambda fid: (priorities.get(fid, 0), fid))
 
     return filter_ids
 
@@ -63,7 +72,7 @@ async def process_filter_functions(request, filter_functions, filter_type, form_
         if not filter:
             continue
 
-        function_module = get_function_module(request, filter_id, load_from_db=(filter_type != 'stream'))
+        function_module = await get_function_module(request, filter_id, load_from_db=(filter_type != 'stream'))
         # Prepare handler function
         handler = getattr(function_module, filter_type, None)
         if not handler:
@@ -75,7 +84,7 @@ async def process_filter_functions(request, filter_functions, filter_type, form_
 
         # Apply valves to the function
         if hasattr(function_module, 'valves') and hasattr(function_module, 'Valves'):
-            valves = Functions.get_function_valves_by_id(filter_id)
+            valves = await Functions.get_function_valves_by_id(filter_id)
             function_module.valves = function_module.Valves(**(valves if valves else {}))
 
         try:
@@ -100,7 +109,7 @@ async def process_filter_functions(request, filter_functions, filter_type, form_
                 if hasattr(function_module, 'UserValves'):
                     try:
                         params['__user__']['valves'] = function_module.UserValves(
-                            **Functions.get_user_valves_by_id_and_user_id(filter_id, params['__user__']['id'])
+                            **await Functions.get_user_valves_by_id_and_user_id(filter_id, params['__user__']['id'])
                         )
                     except Exception as e:
                         log.exception(f'Failed to get user values: {e}')

backend/open_webui/utils/groups.py

@@ -4,7 +4,7 @@ from open_webui.models.groups import Groups
 log = logging.getLogger(__name__)
 
 
-def apply_default_group_assignment(
+async def apply_default_group_assignment(
     default_group_id: str,
     user_id: str,
     db=None,
@@ -18,6 +18,6 @@ def apply_default_group_assignment(
     """
     if default_group_id:
         try:
-            Groups.add_users_to_group(default_group_id, [user_id], db=db)
+            await Groups.add_users_to_group(default_group_id, [user_id], db=db)
         except Exception as e:
             log.error(f'Failed to add user {user_id} to default group {default_group_id}: {e}')

backend/open_webui/utils/images/comfyui.py

@@ -1,49 +1,51 @@
-import asyncio
 import json
 import logging
 import random
-import requests
-import aiohttp
 import urllib.parse
-import urllib.request
 from typing import Optional
 
-import websocket  # NOTE: websocket-client (https://github.com/websocket-client/websocket-client)
+import aiohttp
 from pydantic import BaseModel
 
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
+from open_webui.utils.session_pool import get_session
+
 log = logging.getLogger(__name__)
 
 default_headers = {'User-Agent': 'Mozilla/5.0'}
 
 
-def queue_prompt(prompt, client_id, base_url, api_key):
+async def queue_prompt(prompt, client_id, base_url, api_key):
     log.info('queue_prompt')
     p = {'prompt': prompt, 'client_id': client_id}
-    data = json.dumps(p).encode('utf-8')
-    log.debug(f'queue_prompt data: {data}')
+    log.debug(f'queue_prompt data: {p}')
     try:
-        req = urllib.request.Request(
+        session = await get_session()
+        async with session.post(
             f'{base_url}/prompt',
-            data=data,
+            json=p,
             headers={**default_headers, 'Authorization': f'Bearer {api_key}'},
-        )
-        response = urllib.request.urlopen(req).read()
-        return json.loads(response)
+            ssl=AIOHTTP_CLIENT_SESSION_SSL,
+        ) as r:
+            r.raise_for_status()
+            return await r.json()
     except Exception as e:
         log.exception(f'Error while queuing prompt: {e}')
-        raise e
+        raise
 
 
-def get_image(filename, subfolder, folder_type, base_url, api_key):
+async def get_image(filename, subfolder, folder_type, base_url, api_key):
     log.info('get_image')
     data = {'filename': filename, 'subfolder': subfolder, 'type': folder_type}
     url_values = urllib.parse.urlencode(data)
-    req = urllib.request.Request(
+    session = await get_session()
+    async with session.get(
         f'{base_url}/view?{url_values}',
         headers={**default_headers, 'Authorization': f'Bearer {api_key}'},
-    )
-    with urllib.request.urlopen(req) as response:
-        return response.read()
+        ssl=AIOHTTP_CLIENT_SESSION_SSL,
+    ) as r:
+        r.raise_for_status()
+        return await r.read()
 
 
 def get_image_url(filename, subfolder, folder_type, base_url):
@@ -53,32 +55,39 @@ def get_image_url(filename, subfolder, folder_type, base_url):
     return f'{base_url}/view?{url_values}'
 
 
-def get_history(prompt_id, base_url, api_key):
+async def get_history(prompt_id, base_url, api_key):
     log.info('get_history')
-
-    req = urllib.request.Request(
+    session = await get_session()
+    async with session.get(
         f'{base_url}/history/{prompt_id}',
         headers={**default_headers, 'Authorization': f'Bearer {api_key}'},
-    )
-    with urllib.request.urlopen(req) as response:
-        return json.loads(response.read())
+        ssl=AIOHTTP_CLIENT_SESSION_SSL,
+    ) as r:
+        r.raise_for_status()
+        return await r.json()
 
 
-def get_images(ws, workflow, client_id, base_url, api_key):
-    prompt_id = queue_prompt(workflow, client_id, base_url, api_key)['prompt_id']
+async def _ws_get_images(ws, workflow, client_id, base_url, api_key):
+    """Queue a prompt and wait on *ws* for ComfyUI to finish executing it.
+
+    Returns a dict of ``{'data': [{'url': ...}, ...]}``.
+    """
+    prompt_id = (await queue_prompt(workflow, client_id, base_url, api_key))['prompt_id']
     output_images = []
-    while True:
-        out = ws.recv()
-        if isinstance(out, str):
-            message = json.loads(out)
+
+    async for msg in ws:
+        if msg.type == aiohttp.WSMsgType.TEXT:
+            message = json.loads(msg.data)
             if message['type'] == 'executing':
                 data = message['data']
                 if data['node'] is None and data['prompt_id'] == prompt_id:
                     break  # Execution is done
-        else:
-            continue  # previews are binary data
+        elif msg.type in (aiohttp.WSMsgType.CLOSED, aiohttp.WSMsgType.ERROR):
+            log.error(f'WebSocket closed unexpectedly: {msg.type}')
+            break
+        # binary messages (previews) are silently skipped
 
-    history = get_history(prompt_id, base_url, api_key)[prompt_id]
+    history = (await get_history(prompt_id, base_url, api_key))[prompt_id]
     for node_id in history['outputs']:
         node_output = history['outputs'][node_id]
         if node_id in workflow and workflow[node_id].get('class_type') in [
@@ -105,10 +114,10 @@ async def comfyui_upload_image(image_file_item, base_url, api_key):
     form.add_field('image', file_bytes, filename=filename, content_type=mime_type)
     form.add_field('type', 'input')  # required by ComfyUI
 
-    async with aiohttp.ClientSession() as session:
-        async with session.post(url, data=form, headers=headers) as resp:
-            resp.raise_for_status()
-            return await resp.json()
+    session = await get_session()
+    async with session.post(url, data=form, headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
+        resp.raise_for_status()
+        return await resp.json()
 
 
 class ComfyUINodeInput(BaseModel):
@@ -136,11 +145,9 @@ class ComfyUICreateImageForm(BaseModel):
     seed: Optional[int] = None
 
 
-async def comfyui_create_image(model: str, payload: ComfyUICreateImageForm, client_id, base_url, api_key):
-    ws_url = base_url.replace('http://', 'ws://').replace('https://', 'wss://')
-    workflow = json.loads(payload.workflow.workflow)
-
-    for node in payload.workflow.nodes:
+def _apply_workflow_nodes(workflow, nodes, model, payload):
+    """Mutate *workflow* dict in-place based on typed node definitions."""
+    for node in nodes:
         if node.type:
             if node.type == 'model':
                 for node_id in node.node_ids:
@@ -151,6 +158,14 @@ async def comfyui_create_image(model: str, payload: ComfyUICreateImageForm, clie
             elif node.type == 'negative_prompt':
                 for node_id in node.node_ids:
                     workflow[node_id]['inputs'][node.key if node.key else 'text'] = payload.negative_prompt
+            elif node.type == 'image':
+                if isinstance(payload.image, list):
+                    for idx, node_id in enumerate(node.node_ids):
+                        if idx < len(payload.image):
+                            workflow[node_id]['inputs'][node.key] = payload.image[idx]
+                else:
+                    for node_id in node.node_ids:
+                        workflow[node_id]['inputs'][node.key] = payload.image
             elif node.type == 'width':
                 for node_id in node.node_ids:
                     workflow[node_id]['inputs'][node.key if node.key else 'width'] = payload.width
@@ -171,24 +186,31 @@ async def comfyui_create_image(model: str, payload: ComfyUICreateImageForm, clie
             for node_id in node.node_ids:
                 workflow[node_id]['inputs'][node.key] = node.value
 
+
+async def comfyui_create_image(model: str, payload: ComfyUICreateImageForm, client_id, base_url, api_key):
+    ws_url = base_url.replace('http://', 'ws://').replace('https://', 'wss://')
+    workflow = json.loads(payload.workflow.workflow)
+    _apply_workflow_nodes(workflow, payload.workflow.nodes, model, payload)
+
+    headers = {'Authorization': f'Bearer {api_key}'}
+    session = await get_session()
+
     try:
-        ws = websocket.WebSocket()
-        headers = {'Authorization': f'Bearer {api_key}'}
-        ws.connect(f'{ws_url}/ws?clientId={client_id}', header=headers)
-        log.info('WebSocket connection established.')
-    except Exception as e:
+        async with session.ws_connect(
+            f'{ws_url}/ws?clientId={client_id}',
+            headers=headers,
+            ssl=AIOHTTP_CLIENT_SESSION_SSL,
+        ) as ws:
+            log.info('WebSocket connection established.')
+            log.info('Sending workflow to WebSocket server.')
+            log.info(f'Workflow: {workflow}')
+            images = await _ws_get_images(ws, workflow, client_id, base_url, api_key)
+    except aiohttp.WSServerHandshakeError as e:
         log.exception(f'Failed to connect to WebSocket server: {e}')
         return None
-
-    try:
-        log.info('Sending workflow to WebSocket server.')
-        log.info(f'Workflow: {workflow}')
-        images = await asyncio.to_thread(get_images, ws, workflow, client_id, base_url, api_key)
     except Exception as e:
-        log.exception(f'Error while receiving images: {e}')
-        images = None
-
-    ws.close()
+        log.exception(f'Error during image generation: {e}')
+        return None
 
     return images
 
@@ -209,64 +231,26 @@ class ComfyUIEditImageForm(BaseModel):
 async def comfyui_edit_image(model: str, payload: ComfyUIEditImageForm, client_id, base_url, api_key):
     ws_url = base_url.replace('http://', 'ws://').replace('https://', 'wss://')
     workflow = json.loads(payload.workflow.workflow)
+    _apply_workflow_nodes(workflow, payload.workflow.nodes, model, payload)
 
-    for node in payload.workflow.nodes:
-        if node.type:
-            if node.type == 'model':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key] = model
-            elif node.type == 'image':
-                if isinstance(payload.image, list):
-                    # check if multiple images are provided
-                    for idx, node_id in enumerate(node.node_ids):
-                        if idx < len(payload.image):
-                            workflow[node_id]['inputs'][node.key] = payload.image[idx]
-                else:
-                    for node_id in node.node_ids:
-                        workflow[node_id]['inputs'][node.key] = payload.image
-            elif node.type == 'prompt':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'text'] = payload.prompt
-            elif node.type == 'negative_prompt':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'text'] = payload.negative_prompt
-            elif node.type == 'width':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'width'] = payload.width
-            elif node.type == 'height':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'height'] = payload.height
-            elif node.type == 'n':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'batch_size'] = payload.n
-            elif node.type == 'steps':
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key if node.key else 'steps'] = payload.steps
-            elif node.type == 'seed':
-                seed = payload.seed if payload.seed else random.randint(0, 1125899906842624)
-                for node_id in node.node_ids:
-                    workflow[node_id]['inputs'][node.key] = seed
-        else:
-            for node_id in node.node_ids:
-                workflow[node_id]['inputs'][node.key] = node.value
+    headers = {'Authorization': f'Bearer {api_key}'}
+    session = await get_session()
 
     try:
-        ws = websocket.WebSocket()
-        headers = {'Authorization': f'Bearer {api_key}'}
-        ws.connect(f'{ws_url}/ws?clientId={client_id}', header=headers)
-        log.info('WebSocket connection established.')
-    except Exception as e:
+        async with session.ws_connect(
+            f'{ws_url}/ws?clientId={client_id}',
+            headers=headers,
+            ssl=AIOHTTP_CLIENT_SESSION_SSL,
+        ) as ws:
+            log.info('WebSocket connection established.')
+            log.info('Sending workflow to WebSocket server.')
+            log.info(f'Workflow: {workflow}')
+            images = await _ws_get_images(ws, workflow, client_id, base_url, api_key)
+    except aiohttp.WSServerHandshakeError as e:
         log.exception(f'Failed to connect to WebSocket server: {e}')
         return None
-
-    try:
-        log.info('Sending workflow to WebSocket server.')
-        log.info(f'Workflow: {workflow}')
-        images = await asyncio.to_thread(get_images, ws, workflow, client_id, base_url, api_key)
     except Exception as e:
-        log.exception(f'Error while receiving images: {e}')
-        images = None
-
-    ws.close()
+        log.exception(f'Error during image editing: {e}')
+        return None
 
     return images