From 7f1b618727fe76669158bd42e2ce18fbcca63481 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sun, 25 Oct 2026 13:59:14 +0900
Subject: [PATCH] refac

---
 backend/open_webui/config.py                          |  5 +++++
 backend/open_webui/routers/users.py                   |  1 +
 .../components/admin/Users/Groups/Permissions.svelte  | 11 +++++++++++
 .../components/workspace/Models/ModelEditor.svelte    |  7 +++++--
 src/lib/constants/permissions.ts                      |  1 +
 static/pyodide/pyodide-lock.json                      |  6 +++---
 6 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py
index 5f9b04f752..0f8bff5c34 100644
--- a/backend/open_webui/config.py
+++ b/backend/open_webui/config.py
@@ -1786,6 +1786,10 @@ USER_PERMISSIONS_WORKSPACE_MODELS_EXPORT = (
     os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_EXPORT', 'False').lower() == 'true'
 )
 
+USER_PERMISSIONS_WORKSPACE_MODELS_HIDDEN = (
+    os.getenv('USER_PERMISSIONS_WORKSPACE_MODELS_HIDDEN', 'False').lower() == 'true'
+)
+
 USER_PERMISSIONS_WORKSPACE_PROMPTS_IMPORT = (
     os.getenv('USER_PERMISSIONS_WORKSPACE_PROMPTS_IMPORT', 'False').lower() == 'true'
 )
@@ -1978,6 +1982,7 @@ DEFAULT_USER_PERMISSIONS = {
         'skills': USER_PERMISSIONS_WORKSPACE_SKILLS_ACCESS,
         'models_import': USER_PERMISSIONS_WORKSPACE_MODELS_IMPORT,
         'models_export': USER_PERMISSIONS_WORKSPACE_MODELS_EXPORT,
+        'models_hidden': USER_PERMISSIONS_WORKSPACE_MODELS_HIDDEN,
         'prompts_import': USER_PERMISSIONS_WORKSPACE_PROMPTS_IMPORT,
         'prompts_export': USER_PERMISSIONS_WORKSPACE_PROMPTS_EXPORT,
         'tools_import': USER_PERMISSIONS_WORKSPACE_TOOLS_IMPORT,
diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py
index 66525f8b9a..4d5f35e2c3 100644
--- a/backend/open_webui/routers/users.py
+++ b/backend/open_webui/routers/users.py
@@ -202,6 +202,7 @@ class WorkspacePermissions(BaseModel):
     skills: bool = False
     models_import: bool = False
     models_export: bool = False
+    models_hidden: bool = False
     prompts_import: bool = False
     prompts_export: bool = False
     tools_import: bool = False
diff --git a/src/lib/components/admin/Users/Groups/Permissions.svelte b/src/lib/components/admin/Users/Groups/Permissions.svelte
index 770c00dfe1..5f8527f3ba 100644
--- a/src/lib/components/admin/Users/Groups/Permissions.svelte
+++ b/src/lib/components/admin/Users/Groups/Permissions.svelte
@@ -71,6 +71,17 @@
 							ariaLabel={$i18n.t('Export Models')}
 						/>
 					</div>
+					<div class="flex w-full justify-between">
+						<Tooltip content={$i18n.t('Allow selecting hidden models as base models.')}>
+							<div class="self-center text-xs">
+								{$i18n.t('Hidden Models')}
+							</div>
+						</Tooltip>
+						<Switch
+							bind:state={permissions.workspace.models_hidden}
+							ariaLabel={$i18n.t('Hidden Models')}
+						/>
+					</div>
 				</div>
 			{:else if defaultPermissions?.workspace?.models}
 				<div class="pb-0.5">
diff --git a/src/lib/components/workspace/Models/ModelEditor.svelte b/src/lib/components/workspace/Models/ModelEditor.svelte
index 96c0884b60..e3dfff7698 100644
--- a/src/lib/components/workspace/Models/ModelEditor.svelte
+++ b/src/lib/components/workspace/Models/ModelEditor.svelte
@@ -329,6 +329,9 @@
 
 	$: chatVariablesPreview = getChatVariablesPreview(system ?? '');
 
+	$: includeHidden =
+		$user?.role === 'admin' || ($user?.permissions?.workspace?.models_hidden ?? false);
+
 	const getBaseModelItems = (models: any[] = []) => {
 		const currentModelId = (model as any)?.id;
 
@@ -341,7 +344,7 @@
 					(!baseModel?.preset || (edit && baseModel.id === info.base_model_id)) &&
 					baseModel?.owned_by !== 'arena' &&
 					!(baseModel?.direct ?? false) &&
-					($user?.role === 'admin' ||
+					(includeHidden ||
 						!(baseModel?.info?.meta?.hidden ?? false) ||
 						baseModel.id === info.base_model_id)
 			)
@@ -1286,7 +1289,7 @@
 													items={getBaseModelItems($models)}
 													triggerClassName="text-xs font-normal text-gray-900 dark:text-gray-100"
 													selectionOnly
-													includeHidden={$user?.role === 'admin'}
+													{includeHidden}
 													bind:value={info.base_model_id}
 												/>
 											</div>
diff --git a/src/lib/constants/permissions.ts b/src/lib/constants/permissions.ts
index 57bc7bcb03..9b23d642c6 100644
--- a/src/lib/constants/permissions.ts
+++ b/src/lib/constants/permissions.ts
@@ -7,6 +7,7 @@ export const DEFAULT_PERMISSIONS = {
 		skills: false,
 		models_import: false,
 		models_export: false,
+		models_hidden: false,
 		prompts_import: false,
 		prompts_export: false,
 		tools_import: false,
diff --git a/static/pyodide/pyodide-lock.json b/static/pyodide/pyodide-lock.json
index d60870f5e3..2bf53cbc19 100644
--- a/static/pyodide/pyodide-lock.json
+++ b/static/pyodide/pyodide-lock.json
@@ -5238,10 +5238,10 @@
     },
     "xlsxwriter": {
       "name": "xlsxwriter",
-      "version": "3.2.9",
-      "file_name": "xlsxwriter-3.2.9-py3-none-any.whl",
+      "version": "3.3.0",
+      "file_name": "xlsxwriter-3.3.0-py3-none-any.whl",
       "install_dir": "site",
-      "sha256": "9a5db42bc5dff014806c58a20b9eae7322a134abb6fce3c92c181bfb275ec5b3",
+      "sha256": "5f04772d43281da5109af66f39b65153359a203e896847c416476e709b024469",
       "package_type": "package",
       "imports": [
         "xlsxwriter"