From ec18ce2ca08232421330fc33df7f86807d986012 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Fri, 24 Jul 2026 05:53:59 +0200
Subject: [PATCH] fix: persist access_grants.allow_groups in default
 permissions (#27124)

AccessGrantsPermissions only declared allow_users, so allow_groups was
missing from the model backing the default user permissions endpoints.
Pydantic ignores undeclared fields, so POST /users/default/permissions
dropped allow_groups before model_dump(), it never reached the persisted
user.permissions config, and fill_missing_permissions restored it to the
default on the next read. Turning "Allow Sharing With Groups" off in
Admin Settings silently reverted to on, while the same toggle worked when
set per group, since group permissions are stored as a plain dict.

GET /users/default/permissions and /users/default/permissions/defaults
dropped it from their responses for the same reason.

Declare allow_groups on the model so it round-trips, matching the
access_grants block in DEFAULT_USER_PERMISSIONS. It defaults to True, so
existing payloads that omit it are unaffected.
---
 backend/open_webui/routers/users.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py
index cff598b236..f0cbb6dd16 100644
--- a/backend/open_webui/routers/users.py
+++ b/backend/open_webui/routers/users.py
@@ -207,6 +207,7 @@ class SharingPermissions(BaseModel):
 
 class AccessGrantsPermissions(BaseModel):
     allow_users: bool = True
+    allow_groups: bool = True
 
 
 class ChatPermissions(BaseModel):