diff --git a/backend/open_webui/models/users.py b/backend/open_webui/models/users.py index 3222aa27a..a5dd9467b 100644 --- a/backend/open_webui/models/users.py +++ b/backend/open_webui/models/users.py @@ -95,6 +95,7 @@ class UserRoleUpdateForm(BaseModel): class UserUpdateForm(BaseModel): + role: str name: str email: str profile_image_url: str diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py index 8702ae50b..4046dc72d 100644 --- a/backend/open_webui/routers/users.py +++ b/backend/open_webui/routers/users.py @@ -165,22 +165,6 @@ async def update_default_user_permissions( return request.app.state.config.USER_PERMISSIONS -############################ -# UpdateUserRole -############################ - - -@router.post("/update/role", response_model=Optional[UserModel]) -async def update_user_role(form_data: UserRoleUpdateForm, user=Depends(get_admin_user)): - if user.id != form_data.id and form_data.id != Users.get_first_user().id: - return Users.update_user_role_by_id(form_data.id, form_data.role) - - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail=ERROR_MESSAGES.ACTION_PROHIBITED, - ) - - ############################ # GetUserSettingsBySessionUser ############################ @@ -333,11 +317,22 @@ async def update_user_by_id( # Prevent modification of the primary admin user by other admins try: first_user = Users.get_first_user() - if first_user and user_id == first_user.id and session_user.id != user_id: - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail=ERROR_MESSAGES.ACTION_PROHIBITED, - ) + if first_user: + if user_id == first_user.id: + if session_user.id != user_id: + # If the user trying to update is the primary admin, and they are not the primary admin themselves + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail=ERROR_MESSAGES.ACTION_PROHIBITED, + ) + + if form_data.role != "admin": + # If the primary admin is trying to change their own role, prevent it + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail=ERROR_MESSAGES.ACTION_PROHIBITED, + ) + except Exception as e: log.error(f"Error checking primary admin status: {e}") raise HTTPException( @@ -365,6 +360,7 @@ async def update_user_by_id( updated_user = Users.update_user_by_id( user_id, { + "role": form_data.role, "name": form_data.name, "email": form_data.email.lower(), "profile_image_url": form_data.profile_image_url, diff --git a/src/lib/apis/users/index.ts b/src/lib/apis/users/index.ts index f8ab88ff5..391bdca56 100644 --- a/src/lib/apis/users/index.ts +++ b/src/lib/apis/users/index.ts @@ -393,6 +393,7 @@ export const updateUserById = async (token: string, userId: string, user: UserUp }, body: JSON.stringify({ profile_image_url: user.profile_image_url, + role: user.role, email: user.email, name: user.name, password: user.password !== '' ? user.password : undefined diff --git a/src/lib/components/admin/Users/UserList.svelte b/src/lib/components/admin/Users/UserList.svelte index 31eec1fbd..42f3b9dc1 100644 --- a/src/lib/components/admin/Users/UserList.svelte +++ b/src/lib/components/admin/Users/UserList.svelte @@ -52,27 +52,6 @@ let showUserChatsModal = false; let showEditUserModal = false; - let showUpdateRoleModal = false; - - const onUpdateRole = (user) => { - if (user.role === 'user') { - updateRoleHandler(user.id, 'admin'); - } else if (user.role === 'pending') { - updateRoleHandler(user.id, 'user'); - } else { - updateRoleHandler(user.id, 'pending'); - } - }; - const updateRoleHandler = async (id, role) => { - const res = await updateUserRole(localStorage.token, id, role).catch((error) => { - toast.error(`${error}`); - return null; - }); - - if (res) { - getUserList(); - } - }; const deleteUserHandler = async (id) => { const res = await deleteUserById(localStorage.token, id).catch((error) => { @@ -133,21 +112,6 @@ }} /> - { - onUpdateRole(selectedUser); - }} - message={$i18n.t(`Are you sure you want to update this user\'s role to **{{ROLE}}**?`, { - ROLE: - selectedUser?.role === 'user' - ? 'admin' - : selectedUser?.role === 'pending' - ? 'user' - : 'pending' - })} -/> - {#key selectedUser} { selectedUser = user; - showUpdateRoleModal = true; + showEditUserModal = !showEditUserModal; }} >
+
+
{$i18n.t('Role')}
+ +
+ +
+
+
{$i18n.t('Email')}