From f5fcf4c89fb27ed39825875d573446fa84aa2a5b Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Mon, 7 Sep 2026 12:40:44 -0400
Subject: [PATCH] refac

---
 .../utils/access_control/__init__.py          | 22 +++++++++++++++++++
 backend/open_webui/utils/models.py            | 15 +++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/backend/open_webui/utils/access_control/__init__.py b/backend/open_webui/utils/access_control/__init__.py
index 2f8c89a1d6..0853597b13 100644
--- a/backend/open_webui/utils/access_control/__init__.py
+++ b/backend/open_webui/utils/access_control/__init__.py
@@ -1,3 +1,4 @@
+import logging
 from typing import Any
 
 from open_webui.config import DEFAULT_USER_PERMISSIONS
@@ -14,6 +15,8 @@ from open_webui.models.users import UserModel
 from open_webui.utils.json_codec import JSONCodec
 from sqlalchemy.ext.asyncio import AsyncSession
 
+log = logging.getLogger(__name__)
+
 
 def fill_missing_permissions(permissions: dict[str, Any], default_permissions: dict[str, Any]) -> dict[str, Any]:
     """
@@ -325,6 +328,13 @@ async def has_base_model_access(
         seen.add(base_model_id)
         base_model_info = await Models.get_model_by_id(base_model_id, db=db)
         if base_model_info is None:
+            if user_role != 'admin':
+                log.warning(
+                    'Model access denied: user_id=%r model_id=%r base_model_id=%r reason=base_model_unregistered',
+                    user_id,
+                    model_info.id,
+                    base_model_id,
+                )
             return user_role == 'admin'
         if not (
             user_id == base_model_info.user_id
@@ -337,6 +347,12 @@ async def has_base_model_access(
                 db=db,
             )
         ):
+            log.warning(
+                'Model access denied: user_id=%r model_id=%r base_model_id=%r reason=base_model_read_denied',
+                user_id,
+                model_info.id,
+                base_model_id,
+            )
             return False
         base_model_id = getattr(base_model_info, 'base_model_id', None)
     return True
@@ -381,6 +397,11 @@ async def check_model_access(
                     user_group_ids=user_group_ids,
                 )
             ):
+                log.warning(
+                    'Model access denied: user_id=%r model_id=%r reason=model_read_denied',
+                    user.id,
+                    model_info.id,
+                )
                 raise HTTPException(status_code=403, detail='Model not found')
 
             # Enforce access on chained base models
@@ -388,4 +409,5 @@ async def check_model_access(
                 raise HTTPException(status_code=403, detail='Model not found')
     else:
         if user.role != 'admin':
+            log.warning('Model access denied: user_id=%r reason=model_unregistered', user.id)
             raise HTTPException(status_code=403, detail='Model not found')
diff --git a/backend/open_webui/utils/models.py b/backend/open_webui/utils/models.py
index 1022fccffa..3926bfa9be 100644
--- a/backend/open_webui/utils/models.py
+++ b/backend/open_webui/utils/models.py
@@ -468,12 +468,22 @@ async def check_model_access(user, model, model_info=None, db=None):
             access_grants=access_grants,
             db=db,
         ):
+            log.warning(
+                'Model access denied: user_id=%r model_id=%r reason=arena_read_denied',
+                user.id,
+                model.get('id'),
+            )
             raise Exception('Model not found')
     else:
         # Callers that already fetched the row (chat completion entry) pass it in
         if model_info is None or model_info.id != model.get('id'):
             model_info = await Models.get_model_by_id(model.get('id'), db=db)
         if not model_info:
+            log.warning(
+                'Model access denied: user_id=%r model_id=%r reason=model_unregistered',
+                user.id,
+                model.get('id'),
+            )
             raise Exception('Model not found')
 
         # One group-membership fetch shared by the direct check and every
@@ -493,6 +503,11 @@ async def check_model_access(user, model, model_info=None, db=None):
                 db=db,
             )
         ):
+            log.warning(
+                'Model access denied: user_id=%r model_id=%r reason=model_read_denied',
+                user.id,
+                model_info.id,
+            )
             raise Exception('Model not found')
 
         # Enforce access on chained base models