fix: preserve HTTPException status in import_models and honor bypass flags in functions.py

Two follow-ups on the base-model access chain fix:

Address review feedback: import_models wrapped the new base-model
access checks in a broad except that converted the 403s they raise
into 500s, hiding authz failures as server errors. Add an explicit
except HTTPException: raise before the broad handler so intentional
statuses (the 403 from check_base_model_access, the 400 from JSON
validation) are preserved.

The base-model check in the functions.py pipe dispatcher was not
threaded through BYPASS_MODEL_ACCESS_CONTROL / BYPASS_ADMIN_ACCESS_CONTROL,
so deployments that intentionally bypass model access control still saw
base-model enforcement on this path — inconsistent with the equivalent
checks in main.py, routers/openai.py, and routers/ollama.py. Compute
the same bypass decision locally and pass it through.

backend/open_webui/functions.py

@@ -36,7 +36,8 @@ from open_webui.utils.plugin import (
 )
 from open_webui.utils.access_control import check_base_model_access
 
-from open_webui.env import GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL, BYPASS_MODEL_ACCESS_CONTROL
+from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
 
 from open_webui.utils.misc import (
     add_or_update_system_message,
@@ -260,7 +261,12 @@ async def generate_function_chat_completion(request, form_data, user, models: di
     if model_info:
         if model_info.base_model_id:
             form_data['model'] = model_info.base_model_id
-            await check_base_model_access(user, model_info.base_model_id)
+            await check_base_model_access(
+                user,
+                model_info.base_model_id,
+                bypass_filter=BYPASS_MODEL_ACCESS_CONTROL
+                or (isinstance(user, UserModel) and user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL),
+            )
 
         params = model_info.params.model_dump()
 

backend/open_webui/routers/models.py

@@ -332,6 +332,11 @@ async def import_models(
             return True
         else:
             raise HTTPException(status_code=400, detail='Invalid JSON format')
+    except HTTPException:
+        # Preserve intentional HTTP status codes (e.g. 403 from base-model access
+        # checks, 400 from validation). The broad handler below otherwise masks
+        # them as 500, which misreports authz failures as server errors.
+        raise
     except Exception as e:
         log.exception(e)
         raise HTTPException(status_code=500, detail=str(e))