Merge 886f313c0b into 3ed1df2e53

0.6.41

backend/open_webui/config.py

@@ -1306,7 +1306,7 @@ USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_PUBLIC_SHARING = (
 
 USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ALLOW_SHARING = (
     os.environ.get(
-        "USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ALLOW_PUBLIC_SHARING", "False"
+        "USER_PERMISSIONS_WORKSPACE_KNOWLEDGE_ALLOW_SHARING", "False"
     ).lower()
     == "true"
 )
@@ -1345,7 +1345,7 @@ USER_PERMISSIONS_WORKSPACE_TOOLS_ALLOW_PUBLIC_SHARING = (
 
 
 USER_PERMISSIONS_NOTES_ALLOW_SHARING = (
-    os.environ.get("USER_PERMISSIONS_NOTES_ALLOW_PUBLIC_SHARING", "False").lower()
+    os.environ.get("USER_PERMISSIONS_NOTES_ALLOW_SHARING", "False").lower()
     == "true"
 )
 

backend/open_webui/migrations/versions/6283dc0e4d8d_add_channel_file_table.py

@@ -0,0 +1,54 @@
+"""Add channel file table
+
+Revision ID: 6283dc0e4d8d
+Revises: 3e0e00844bb0
+Create Date: 2025-12-10 15:11:39.424601
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+
+# revision identifiers, used by Alembic.
+revision: str = "6283dc0e4d8d"
+down_revision: Union[str, None] = "3e0e00844bb0"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "channel_file",
+        sa.Column("id", sa.Text(), primary_key=True),
+        sa.Column("user_id", sa.Text(), nullable=False),
+        sa.Column(
+            "channel_id",
+            sa.Text(),
+            sa.ForeignKey("channel.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "file_id",
+            sa.Text(),
+            sa.ForeignKey("file.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.BigInteger(), nullable=False),
+        sa.Column("updated_at", sa.BigInteger(), nullable=False),
+        # indexes
+        sa.Index("ix_channel_file_channel_id", "channel_id"),
+        sa.Index("ix_channel_file_file_id", "file_id"),
+        sa.Index("ix_channel_file_user_id", "user_id"),
+        # unique constraints
+        sa.UniqueConstraint(
+            "channel_id", "file_id", name="uq_channel_file_channel_file"
+        ),  # prevent duplicate entries
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("channel_file")

backend/open_webui/migrations/versions/81cc2ce44d79_update_channel_file_and_knowledge_table.py

@@ -0,0 +1,49 @@
+"""Update channel file and knowledge table
+
+Revision ID: 81cc2ce44d79
+Revises: 6283dc0e4d8d
+Create Date: 2025-12-10 16:07:58.001282
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import open_webui.internal.db
+
+
+# revision identifiers, used by Alembic.
+revision: str = "81cc2ce44d79"
+down_revision: Union[str, None] = "6283dc0e4d8d"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Add message_id column to channel_file table
+    with op.batch_alter_table("channel_file", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "message_id",
+                sa.Text(),
+                sa.ForeignKey(
+                    "message.id", ondelete="CASCADE", name="fk_channel_file_message_id"
+                ),
+                nullable=True,
+            )
+        )
+
+    # Add data column to knowledge table
+    with op.batch_alter_table("knowledge", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("data", sa.JSON(), nullable=True))
+
+
+def downgrade() -> None:
+    # Remove message_id column from channel_file table
+    with op.batch_alter_table("channel_file", schema=None) as batch_op:
+        batch_op.drop_column("message_id")
+
+    # Remove data column from knowledge table
+    with op.batch_alter_table("knowledge", schema=None) as batch_op:
+        batch_op.drop_column("data")

backend/open_webui/models/channels.py

@@ -10,7 +10,18 @@ from pydantic import BaseModel, ConfigDict
 from sqlalchemy.dialects.postgresql import JSONB
 
 
-from sqlalchemy import BigInteger, Boolean, Column, String, Text, JSON, case, cast
+from sqlalchemy import (
+    BigInteger,
+    Boolean,
+    Column,
+    ForeignKey,
+    String,
+    Text,
+    JSON,
+    UniqueConstraint,
+    case,
+    cast,
+)
 from sqlalchemy import or_, func, select, and_, text
 from sqlalchemy.sql import exists
 
@@ -137,6 +148,41 @@ class ChannelMemberModel(BaseModel):
     updated_at: Optional[int] = None  # timestamp in epoch (time_ns)
 
 
+class ChannelFile(Base):
+    __tablename__ = "channel_file"
+
+    id = Column(Text, unique=True, primary_key=True)
+    user_id = Column(Text, nullable=False)
+
+    channel_id = Column(
+        Text, ForeignKey("channel.id", ondelete="CASCADE"), nullable=False
+    )
+    message_id = Column(
+        Text, ForeignKey("message.id", ondelete="CASCADE"), nullable=True
+    )
+    file_id = Column(Text, ForeignKey("file.id", ondelete="CASCADE"), nullable=False)
+
+    created_at = Column(BigInteger, nullable=False)
+    updated_at = Column(BigInteger, nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint("channel_id", "file_id", name="uq_channel_file_channel_file"),
+    )
+
+
+class ChannelFileModel(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+
+    channel_id: str
+    file_id: str
+    user_id: str
+
+    created_at: int  # timestamp in epoch (time_ns)
+    updated_at: int  # timestamp in epoch (time_ns)
+
+
 class ChannelWebhook(Base):
     __tablename__ = "channel_webhook"
 
@@ -642,6 +688,135 @@ class ChannelTable:
             channel = db.query(Channel).filter(Channel.id == id).first()
             return ChannelModel.model_validate(channel) if channel else None
 
+    def get_channels_by_file_id(self, file_id: str) -> list[ChannelModel]:
+        with get_db() as db:
+            channel_files = (
+                db.query(ChannelFile).filter(ChannelFile.file_id == file_id).all()
+            )
+            channel_ids = [cf.channel_id for cf in channel_files]
+            channels = db.query(Channel).filter(Channel.id.in_(channel_ids)).all()
+            return [ChannelModel.model_validate(channel) for channel in channels]
+
+    def get_channels_by_file_id_and_user_id(
+        self, file_id: str, user_id: str
+    ) -> list[ChannelModel]:
+        with get_db() as db:
+            # 1. Determine which channels have this file
+            channel_file_rows = (
+                db.query(ChannelFile).filter(ChannelFile.file_id == file_id).all()
+            )
+            channel_ids = [row.channel_id for row in channel_file_rows]
+
+            if not channel_ids:
+                return []
+
+            # 2. Load all channel rows that still exist
+            channels = (
+                db.query(Channel)
+                .filter(
+                    Channel.id.in_(channel_ids),
+                    Channel.deleted_at.is_(None),
+                    Channel.archived_at.is_(None),
+                )
+                .all()
+            )
+            if not channels:
+                return []
+
+            # Preload user's group membership
+            user_group_ids = [g.id for g in Groups.get_groups_by_member_id(user_id)]
+
+            allowed_channels = []
+
+            for channel in channels:
+                # --- Case A: group or dm => user must be an active member ---
+                if channel.type in ["group", "dm"]:
+                    membership = (
+                        db.query(ChannelMember)
+                        .filter(
+                            ChannelMember.channel_id == channel.id,
+                            ChannelMember.user_id == user_id,
+                            ChannelMember.is_active.is_(True),
+                        )
+                        .first()
+                    )
+                    if membership:
+                        allowed_channels.append(ChannelModel.model_validate(channel))
+                    continue
+
+                # --- Case B: standard channel => rely on ACL permissions ---
+                query = db.query(Channel).filter(Channel.id == channel.id)
+
+                query = self._has_permission(
+                    db,
+                    query,
+                    {"user_id": user_id, "group_ids": user_group_ids},
+                    permission="read",
+                )
+
+                allowed = query.first()
+                if allowed:
+                    allowed_channels.append(ChannelModel.model_validate(allowed))
+
+            return allowed_channels
+
+    def get_channel_by_id_and_user_id(
+        self, id: str, user_id: str
+    ) -> Optional[ChannelModel]:
+        with get_db() as db:
+            # Fetch the channel
+            channel: Channel = (
+                db.query(Channel)
+                .filter(
+                    Channel.id == id,
+                    Channel.deleted_at.is_(None),
+                    Channel.archived_at.is_(None),
+                )
+                .first()
+            )
+
+            if not channel:
+                return None
+
+            # If the channel is a group or dm, read access requires membership (active)
+            if channel.type in ["group", "dm"]:
+                membership = (
+                    db.query(ChannelMember)
+                    .filter(
+                        ChannelMember.channel_id == id,
+                        ChannelMember.user_id == user_id,
+                        ChannelMember.is_active.is_(True),
+                    )
+                    .first()
+                )
+                if membership:
+                    return ChannelModel.model_validate(channel)
+                else:
+                    return None
+
+            # For channels that are NOT group/dm, fall back to ACL-based read access
+            query = db.query(Channel).filter(Channel.id == id)
+
+            # Determine user groups
+            user_group_ids = [
+                group.id for group in Groups.get_groups_by_member_id(user_id)
+            ]
+
+            # Apply ACL rules
+            query = self._has_permission(
+                db,
+                query,
+                {"user_id": user_id, "group_ids": user_group_ids},
+                permission="read",
+            )
+
+            channel_allowed = query.first()
+            return (
+                ChannelModel.model_validate(channel_allowed)
+                if channel_allowed
+                else None
+            )
+
     def update_channel_by_id(
         self, id: str, form_data: ChannelForm
     ) -> Optional[ChannelModel]:
@@ -663,6 +838,65 @@ class ChannelTable:
             db.commit()
             return ChannelModel.model_validate(channel) if channel else None
 
+    def add_file_to_channel_by_id(
+        self, channel_id: str, file_id: str, user_id: str
+    ) -> Optional[ChannelFileModel]:
+        with get_db() as db:
+            channel_file = ChannelFileModel(
+                **{
+                    "id": str(uuid.uuid4()),
+                    "channel_id": channel_id,
+                    "file_id": file_id,
+                    "user_id": user_id,
+                    "created_at": int(time.time()),
+                    "updated_at": int(time.time()),
+                }
+            )
+
+            try:
+                result = ChannelFile(**channel_file.model_dump())
+                db.add(result)
+                db.commit()
+                db.refresh(result)
+                if result:
+                    return ChannelFileModel.model_validate(result)
+                else:
+                    return None
+            except Exception:
+                return None
+
+    def set_file_message_id_in_channel_by_id(
+        self, channel_id: str, file_id: str, message_id: str
+    ) -> bool:
+        try:
+            with get_db() as db:
+                channel_file = (
+                    db.query(ChannelFile)
+                    .filter_by(channel_id=channel_id, file_id=file_id)
+                    .first()
+                )
+                if not channel_file:
+                    return False
+
+                channel_file.message_id = message_id
+                channel_file.updated_at = int(time.time())
+
+                db.commit()
+                return True
+        except Exception:
+            return False
+
+    def remove_file_from_channel_by_id(self, channel_id: str, file_id: str) -> bool:
+        try:
+            with get_db() as db:
+                db.query(ChannelFile).filter_by(
+                    channel_id=channel_id, file_id=file_id
+                ).delete()
+                db.commit()
+                return True
+        except Exception:
+            return False
+
     def delete_channel_by_id(self, id: str):
         with get_db() as db:
             db.query(Channel).filter(Channel.id == id).delete()

backend/open_webui/models/knowledge.py

@@ -232,6 +232,21 @@ class KnowledgeTable:
         except Exception:
             return None
 
+    def get_knowledge_by_id_and_user_id(
+        self, id: str, user_id: str
+    ) -> Optional[KnowledgeModel]:
+        knowledge = self.get_knowledge_by_id(id)
+        if not knowledge:
+            return None
+
+        if knowledge.user_id == user_id:
+            return knowledge
+
+        user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user_id)}
+        if has_access(user_id, "write", knowledge.access_control, user_group_ids):
+            return knowledge
+        return None
+
     def get_knowledges_by_file_id(self, file_id: str) -> list[KnowledgeModel]:
         try:
             with get_db() as db:

backend/open_webui/models/notes.py

@@ -255,7 +255,9 @@ class NoteTable:
                     query = query.filter(
                         or_(
                             Note.title.ilike(f"%{query_key}%"),
-                            Note.data["content"]["md"].ilike(f"%{query_key}%"),
+                            cast(Note.data["content"]["md"], Text).ilike(
+                                f"%{query_key}%"
+                            ),
                         )
                     )
 

backend/open_webui/routers/channels.py

@@ -1093,6 +1093,15 @@ async def post_new_message(
 
     try:
         message, channel = await new_message_handler(request, id, form_data, user)
+        try:
+            if files := message.data.get("files", []):
+                for file in files:
+                    Channels.set_file_message_id_in_channel_by_id(
+                        channel.id, file.get("id", ""), message.id
+                    )
+        except Exception as e:
+            log.debug(e)
+
         active_user_ids = get_user_ids_from_room(f"channel:{channel.id}")
 
         async def background_handler():

backend/open_webui/routers/files.py

@@ -27,6 +27,7 @@ from open_webui.constants import ERROR_MESSAGES
 from open_webui.env import SRC_LOG_LEVELS
 from open_webui.retrieval.vector.factory import VECTOR_DB_CLIENT
 
+from open_webui.models.channels import Channels
 from open_webui.models.users import Users
 from open_webui.models.files import (
     FileForm,
@@ -91,6 +92,10 @@ def has_access_to_file(
             if knowledge_base.id == knowledge_base_id:
                 return True
 
+    channels = Channels.get_channels_by_file_id_and_user_id(file_id, user.id)
+    if access_type == "read" and channels:
+        return True
+
     return False
 
 
@@ -138,6 +143,7 @@ def process_uploaded_file(request, file, file_path, file_item, file_metadata, us
                 f"File type {file.content_type} is not provided, but trying to process anyway"
             )
             process_file(request, ProcessFileForm(file_id=file_item.id), user=user)
+
     except Exception as e:
         log.error(f"Error processing file: {file_item.id}")
         Files.update_file_data_by_id(
@@ -247,6 +253,13 @@ def upload_file_handler(
             ),
         )
 
+        if "channel_id" in file_metadata:
+            channel = Channels.get_channel_by_id_and_user_id(
+                file_metadata["channel_id"], user.id
+            )
+            if channel:
+                Channels.add_file_to_channel_by_id(channel.id, file_item.id, user.id)
+
         if process:
             if background_tasks and process_in_background:
                 background_tasks.add_task(

backend/open_webui/routers/groups.py

@@ -78,7 +78,7 @@ async def create_new_group(form_data: GroupForm, user=Depends(get_admin_user)):
 
 
 @router.get("/id/{id}", response_model=Optional[GroupResponse])
-async def get_group_by_id(id: str, user=Depends(get_admin_user)):
+async def get_group_by_id(id: str, user=Depends(get_verified_user)):
     group = Groups.get_group_by_id(id)
     if group:
         return GroupResponse(

backend/open_webui/routers/knowledge.py

@@ -41,7 +41,11 @@ router = APIRouter()
 ############################
 
 
-@router.get("/", response_model=list[KnowledgeUserResponse])
+class KnowledgeAccessResponse(KnowledgeUserResponse):
+    write_access: Optional[bool] = False
+
+
+@router.get("/", response_model=list[KnowledgeAccessResponse])
 async def get_knowledge(user=Depends(get_verified_user)):
     # Return knowledge bases with read access
     knowledge_bases = []
@@ -51,27 +55,35 @@ async def get_knowledge(user=Depends(get_verified_user)):
         knowledge_bases = Knowledges.get_knowledge_bases_by_user_id(user.id, "read")
 
     return [
-        KnowledgeUserResponse(
+        KnowledgeAccessResponse(
             **knowledge_base.model_dump(),
             files=Knowledges.get_file_metadatas_by_id(knowledge_base.id),
+            write_access=(
+                user.id == knowledge_base.user_id
+                or has_access(user.id, "write", knowledge_base.access_control)
+            ),
         )
         for knowledge_base in knowledge_bases
     ]
 
 
-@router.get("/list", response_model=list[KnowledgeUserResponse])
+@router.get("/list", response_model=list[KnowledgeAccessResponse])
 async def get_knowledge_list(user=Depends(get_verified_user)):
     # Return knowledge bases with write access
     knowledge_bases = []
     if user.role == "admin" and BYPASS_ADMIN_ACCESS_CONTROL:
         knowledge_bases = Knowledges.get_knowledge_bases()
     else:
-        knowledge_bases = Knowledges.get_knowledge_bases_by_user_id(user.id, "write")
+        knowledge_bases = Knowledges.get_knowledge_bases_by_user_id(user.id, "read")
 
     return [
-        KnowledgeUserResponse(
+        KnowledgeAccessResponse(
             **knowledge_base.model_dump(),
             files=Knowledges.get_file_metadatas_by_id(knowledge_base.id),
+            write_access=(
+                user.id == knowledge_base.user_id
+                or has_access(user.id, "write", knowledge_base.access_control)
+            ),
         )
         for knowledge_base in knowledge_bases
     ]
@@ -187,6 +199,7 @@ async def reindex_knowledge_files(request: Request, user=Depends(get_verified_us
 
 class KnowledgeFilesResponse(KnowledgeResponse):
     files: list[FileMetadataResponse]
+    write_access: Optional[bool] = False
 
 
 @router.get("/{id}", response_model=Optional[KnowledgeFilesResponse])
@@ -203,6 +216,10 @@ async def get_knowledge_by_id(id: str, user=Depends(get_verified_user)):
             return KnowledgeFilesResponse(
                 **knowledge.model_dump(),
                 files=Knowledges.get_file_metadatas_by_id(knowledge.id),
+                write_access=(
+                    user.id == knowledge.user_id
+                    or has_access(user.id, "write", knowledge.access_control)
+                ),
             )
     else:
         raise HTTPException(
@@ -363,11 +380,6 @@ def add_file_to_knowledge_by_id(
             detail=ERROR_MESSAGES.FILE_NOT_PROCESSED,
         )
 
-    # Add file to knowledge base
-    Knowledges.add_file_to_knowledge_by_id(
-        knowledge_id=id, file_id=form_data.file_id, user_id=user.id
-    )
-
     # Add content to the vector database
     try:
         process_file(
@@ -375,6 +387,11 @@ def add_file_to_knowledge_by_id(
             ProcessFileForm(file_id=form_data.file_id, collection_name=id),
             user=user,
         )
+
+        # Add file to knowledge base
+        Knowledges.add_file_to_knowledge_by_id(
+            knowledge_id=id, file_id=form_data.file_id, user_id=user.id
+        )
     except Exception as e:
         log.debug(e)
         raise HTTPException(

src/lib/components/channel/Channel.svelte

@@ -365,6 +365,7 @@
 						bind:chatInputElement
 						bind:replyToMessage
 						{typingUsers}
+						{channel}
 						userSuggestions={true}
 						channelSuggestions={true}
 						disabled={!channel?.write_access}

src/lib/components/channel/MessageInput.svelte

@@ -42,9 +42,10 @@
 	import XMark from '../icons/XMark.svelte';
 
 	export let placeholder = $i18n.t('Type here...');
+	export let chatInputElement;
 
 	export let id = null;
-	export let chatInputElement;
+	export let channel = null;
 
 	export let typingUsers = [];
 	export let inputLoading = false;
@@ -459,15 +460,16 @@
 		try {
 			// During the file upload, file content is automatically extracted.
 			// If the file is an audio file, provide the language for STT.
-			let metadata = null;
-			if (
-				(file.type.startsWith('audio/') || file.type.startsWith('video/')) &&
+			let metadata = {
+				channel_id: channel.id,
+				// If the file is an audio file, provide the language for STT.
+				...((file.type.startsWith('audio/') || file.type.startsWith('video/')) &&
 				$settings?.audio?.stt?.language
-			) {
-				metadata = {
-					language: $settings?.audio?.stt?.language
-				};
-			}
+					? {
+							language: $settings?.audio?.stt?.language
+						}
+					: {})
+			};
 
 			const uploadedFile = await uploadFile(localStorage.token, file, metadata, process);
 

src/lib/components/notes/Notes.svelte

@@ -337,7 +337,7 @@
 					>
 						<Plus className="size-3" strokeWidth="2.5" />
 
-						<div class=" md:ml-1 text-xs">{$i18n.t('New Note')}</div>
+						<div class=" ml-1 text-xs">{$i18n.t('New Note')}</div>
 					</button>
 				</div>
 			</div>

src/lib/components/workspace/Knowledge.svelte

@@ -196,39 +196,35 @@
 			<!-- The Aleph dreams itself into being, and the void learns its own name -->
 			<div class=" my-2 px-3 grid grid-cols-1 lg:grid-cols-2 gap-2">
 				{#each filteredItems as item}
-					<Tooltip content={item?.description ?? item.name}>
-						<button
-							class=" flex space-x-4 cursor-pointer text-left w-full px-3 py-2.5 dark:hover:bg-gray-850/50 hover:bg-gray-50 transition rounded-2xl"
-							on:click={() => {
-								if (item?.meta?.document) {
-									toast.error(
-										$i18n.t(
-											'Only collections can be edited, create a new knowledge base to edit/add documents.'
-										)
-									);
-								} else {
-									goto(`/workspace/knowledge/${item.id}`);
-								}
-							}}
-						>
-							<div class=" w-full">
-								<div class=" self-center flex-1">
-									<div class="flex items-center justify-between -my-1">
-										<div class=" flex gap-2 items-center">
-											<div>
-												{#if item?.meta?.document}
-													<Badge type="muted" content={$i18n.t('Document')} />
-												{:else}
-													<Badge type="success" content={$i18n.t('Collection')} />
-												{/if}
-											</div>
-
-											<div class=" text-xs text-gray-500 line-clamp-1">
-												{$i18n.t('Updated')}
-												{dayjs(item.updated_at * 1000).fromNow()}
-											</div>
+					<button
+						class=" flex space-x-4 cursor-pointer text-left w-full px-3 py-2.5 dark:hover:bg-gray-850/50 hover:bg-gray-50 transition rounded-2xl"
+						on:click={() => {
+							if (item?.meta?.document) {
+								toast.error(
+									$i18n.t(
+										'Only collections can be edited, create a new knowledge base to edit/add documents.'
+									)
+								);
+							} else {
+								goto(`/workspace/knowledge/${item.id}`);
+							}
+						}}
+					>
+						<div class=" w-full">
+							<div class=" self-center flex-1 justify-between">
+								<div class="flex items-center justify-between -my-1 h-8">
+									<div class=" flex gap-2 items-center justify-between w-full">
+										<div>
+											<Badge type="success" content={$i18n.t('Collection')} />
 										</div>
 
+										{#if !item?.write_access}
+											<div>
+												<Badge type="muted" content={$i18n.t('Read Only')} />
+											</div>
+										{/if}
+									</div>
+									{#if item?.write_access}
 										<div class="flex items-center gap-2">
 											<div class=" flex self-center">
 												<ItemMenu
@@ -239,33 +235,42 @@
 												/>
 											</div>
 										</div>
-									</div>
+									{/if}
+								</div>
 
-									<div class=" flex items-center gap-1 justify-between px-1.5">
+								<div class=" flex items-center gap-1 justify-between px-1.5">
+									<Tooltip content={item?.description ?? item.name}>
 										<div class=" flex items-center gap-2">
 											<div class=" text-sm font-medium line-clamp-1 capitalize">{item.name}</div>
 										</div>
+									</Tooltip>
 
-										<div>
-											<div class="text-xs text-gray-500">
-												<Tooltip
-													content={item?.user?.email ?? $i18n.t('Deleted User')}
-													className="flex shrink-0"
-													placement="top-start"
-												>
-													{$i18n.t('By {{name}}', {
-														name: capitalizeFirstLetter(
-															item?.user?.name ?? item?.user?.email ?? $i18n.t('Deleted User')
-														)
-													})}
-												</Tooltip>
+									<div class="flex items-center gap-2">
+										<Tooltip content={dayjs(item.updated_at * 1000).format('LLLL')}>
+											<div class=" text-xs text-gray-500 line-clamp-1">
+												{$i18n.t('Updated')}
+												{dayjs(item.updated_at * 1000).fromNow()}
 											</div>
+										</Tooltip>
+
+										<div class="text-xs text-gray-500">
+											<Tooltip
+												content={item?.user?.email ?? $i18n.t('Deleted User')}
+												className="flex shrink-0"
+												placement="top-start"
+											>
+												{$i18n.t('By {{name}}', {
+													name: capitalizeFirstLetter(
+														item?.user?.name ?? item?.user?.email ?? $i18n.t('Deleted User')
+													)
+												})}
+											</Tooltip>
 										</div>
 									</div>
 								</div>
 							</div>
-						</button>
-					</Tooltip>
+						</div>
+					</button>
 				{/each}
 			</div>
 		{:else}

src/lib/components/workspace/Knowledge/KnowledgeBase.svelte

@@ -206,16 +206,16 @@
 
 		fileItems = [...(fileItems ?? []), fileItem];
 		try {
-			// If the file is an audio file, provide the language for STT.
-			let metadata = null;
-			if (
-				(file.type.startsWith('audio/') || file.type.startsWith('video/')) &&
+			let metadata = {
+				knowledge_id: knowledge.id,
+				// If the file is an audio file, provide the language for STT.
+				...((file.type.startsWith('audio/') || file.type.startsWith('video/')) &&
 				$settings?.audio?.stt?.language
-			) {
-				metadata = {
-					language: $settings?.audio?.stt?.language
-				};
-			}
+					? {
+							language: $settings?.audio?.stt?.language
+						}
+					: {})
+			};
 
 			const uploadedFile = await uploadFile(localStorage.token, file, metadata).catch((e) => {
 				toast.error(`${e}`);
@@ -429,7 +429,7 @@
 			});
 
 			if (res) {
-				knowledge = res;
+				fileItems = [];
 				toast.success($i18n.t('Knowledge reset successfully.'));
 
 				// Upload directory
@@ -441,16 +441,14 @@
 	};
 
 	const addFileHandler = async (fileId) => {
-		const updatedKnowledge = await addFileToKnowledgeById(localStorage.token, id, fileId).catch(
-			(e) => {
-				toast.error(`${e}`);
-				return null;
-			}
-		);
+		const res = await addFileToKnowledgeById(localStorage.token, id, fileId).catch((e) => {
+			toast.error(`${e}`);
+			return null;
+		});
 
-		if (updatedKnowledge) {
-			knowledge = updatedKnowledge;
+		if (res) {
 			toast.success($i18n.t('File added successfully.'));
+			init();
 		} else {
 			toast.error($i18n.t('Failed to add file.'));
 			fileItems = fileItems.filter((file) => file.id !== fileId);
@@ -462,13 +460,12 @@
 			console.log('Starting file deletion process for:', fileId);
 
 			// Remove from knowledge base only
-			const updatedKnowledge = await removeFileFromKnowledgeById(localStorage.token, id, fileId);
+			const res = await removeFileFromKnowledgeById(localStorage.token, id, fileId);
+			console.log('Knowledge base updated:', res);
 
-			console.log('Knowledge base updated:', updatedKnowledge);
-
-			if (updatedKnowledge) {
-				knowledge = updatedKnowledge;
+			if (res) {
 				toast.success($i18n.t('File removed successfully.'));
+				await init();
 			}
 		} catch (e) {
 			console.error('Error in deleteFileHandler:', e);
@@ -569,6 +566,11 @@
 		e.preventDefault();
 		dragged = false;
 
+		if (!knowledge?.write_access) {
+			toast.error($i18n.t('You do not have permission to upload files to this knowledge base.'));
+			return;
+		}
+
 		const handleUploadingFileFolder = (items) => {
 			for (const item of items) {
 				if (item.isFile) {
@@ -750,6 +752,7 @@
 								class="text-left w-full font-medium text-lg font-primary bg-transparent outline-hidden flex-1"
 								bind:value={knowledge.name}
 								placeholder={$i18n.t('Knowledge Name')}
+								disabled={!knowledge?.write_access}
 								on:input={() => {
 									changeDebounceHandler();
 								}}
@@ -766,21 +769,27 @@
 							</div>
 						</div>
 
-						<div class="self-center shrink-0">
-							<button
-								class="bg-gray-50 hover:bg-gray-100 text-black dark:bg-gray-850 dark:hover:bg-gray-800 dark:text-white transition px-2 py-1 rounded-full flex gap-1 items-center"
-								type="button"
-								on:click={() => {
-									showAccessControlModal = true;
-								}}
-							>
-								<LockClosed strokeWidth="2.5" className="size-3.5" />
+						{#if knowledge?.write_access}
+							<div class="self-center shrink-0">
+								<button
+									class="bg-gray-50 hover:bg-gray-100 text-black dark:bg-gray-850 dark:hover:bg-gray-800 dark:text-white transition px-2 py-1 rounded-full flex gap-1 items-center"
+									type="button"
+									on:click={() => {
+										showAccessControlModal = true;
+									}}
+								>
+									<LockClosed strokeWidth="2.5" className="size-3.5" />
 
-								<div class="text-sm font-medium shrink-0">
-									{$i18n.t('Access')}
-								</div>
-							</button>
-						</div>
+									<div class="text-sm font-medium shrink-0">
+										{$i18n.t('Access')}
+									</div>
+								</button>
+							</div>
+						{:else}
+							<div class="text-xs shrink-0 text-gray-500">
+								{$i18n.t('Read Only')}
+							</div>
+						{/if}
 					</div>
 
 					<div class="flex w-full">
@@ -789,6 +798,7 @@
 							class="text-left text-xs w-full text-gray-500 bg-transparent outline-hidden"
 							bind:value={knowledge.description}
 							placeholder={$i18n.t('Knowledge Description')}
+							disabled={!knowledge?.write_access}
 							on:input={() => {
 								changeDebounceHandler();
 							}}
@@ -815,22 +825,24 @@
 						}}
 					/>
 
-					<div>
-						<AddContentMenu
-							on:upload={(e) => {
-								if (e.detail.type === 'directory') {
-									uploadDirectoryHandler();
-								} else if (e.detail.type === 'text') {
-									showAddTextContentModal = true;
-								} else {
-									document.getElementById('files-input').click();
-								}
-							}}
-							on:sync={(e) => {
-								showSyncConfirmModal = true;
-							}}
-						/>
-					</div>
+					{#if knowledge?.write_access}
+						<div>
+							<AddContentMenu
+								on:upload={(e) => {
+									if (e.detail.type === 'directory') {
+										uploadDirectoryHandler();
+									} else if (e.detail.type === 'text') {
+										showAddTextContentModal = true;
+									} else {
+										document.getElementById('files-input').click();
+									}
+								}}
+								on:sync={(e) => {
+									showSyncConfirmModal = true;
+								}}
+							/>
+						</div>
+					{/if}
 				</div>
 			</div>
 
@@ -899,6 +911,7 @@
 									<div class=" flex overflow-y-auto h-full w-full scrollbar-hidden text-xs">
 										<Files
 											files={fileItems}
+											{knowledge}
 											{selectedFileId}
 											onClick={(fileId) => {
 												selectedFileId = fileId;
@@ -962,28 +975,31 @@
 											{selectedFile?.meta?.name}
 										</div>
 
-										<div>
-											<button
-												class="flex self-center w-fit text-sm py-1 px-2.5 dark:text-gray-300 dark:hover:text-white hover:bg-black/5 dark:hover:bg-white/5 rounded-lg disabled:opacity-50 disabled:cursor-not-allowed"
-												disabled={isSaving}
-												on:click={() => {
-													updateFileContentHandler();
-												}}
-											>
-												{$i18n.t('Save')}
-												{#if isSaving}
-													<div class="ml-2 self-center">
-														<Spinner />
-													</div>
-												{/if}
-											</button>
-										</div>
+										{#if knowledge?.write_access}
+											<div>
+												<button
+													class="flex self-center w-fit text-sm py-1 px-2.5 dark:text-gray-300 dark:hover:text-white hover:bg-black/5 dark:hover:bg-white/5 rounded-lg disabled:opacity-50 disabled:cursor-not-allowed"
+													disabled={isSaving}
+													on:click={() => {
+														updateFileContentHandler();
+													}}
+												>
+													{$i18n.t('Save')}
+													{#if isSaving}
+														<div class="ml-2 self-center">
+															<Spinner />
+														</div>
+													{/if}
+												</button>
+											</div>
+										{/if}
 									</div>
 
 									{#key selectedFile.id}
 										<textarea
 											class="w-full h-full text-sm outline-none resize-none px-3 py-2"
 											bind:value={selectedFileContent}
+											disabled={!knowledge?.write_access}
 											placeholder={$i18n.t('Add content here')}
 										/>
 									{/key}

src/lib/components/workspace/Knowledge/KnowledgeBase/Files.svelte

@@ -16,6 +16,7 @@
 	import XMark from '$lib/components/icons/XMark.svelte';
 	import Spinner from '$lib/components/common/Spinner.svelte';
 
+	export let knowledge = null;
 	export let selectedFileId = null;
 	export let files = [];
 
@@ -50,7 +51,9 @@
 
 						<div class="line-clamp-1">
 							{file?.name ?? file?.meta?.name}
-							<span class="text-xs text-gray-500">{formatFileSize(file?.meta?.size)}</span>
+							{#if file?.meta?.size}
+								<span class="text-xs text-gray-500">{formatFileSize(file?.meta?.size)}</span>
+							{/if}
 						</div>
 					</div>
 				</div>
@@ -77,19 +80,21 @@
 				</div>
 			</button>
 
-			<div class="flex items-center">
-				<Tooltip content={$i18n.t('Delete')}>
-					<button
-						class="p-1 rounded-full hover:bg-gray-100 dark:hover:bg-gray-850 transition"
-						type="button"
-						on:click={() => {
-							onDelete(file?.id ?? file?.tempId);
-						}}
-					>
-						<XMark />
-					</button>
-				</Tooltip>
-			</div>
+			{#if knowledge?.write_access}
+				<div class="flex items-center">
+					<Tooltip content={$i18n.t('Delete')}>
+						<button
+							class="p-1 rounded-full hover:bg-gray-100 dark:hover:bg-gray-850 transition"
+							type="button"
+							on:click={() => {
+								onDelete(file?.id ?? file?.tempId);
+							}}
+						>
+							<XMark />
+						</button>
+					</Tooltip>
+				</div>
+			{/if}
 		</div>
 	{/each}
 </div>

src/lib/components/workspace/common/AccessControl.svelte

@@ -3,11 +3,11 @@
 
 	const i18n = getContext('i18n');
 
-	import { getGroups } from '$lib/apis/groups';
 	import Tooltip from '$lib/components/common/Tooltip.svelte';
 	import Plus from '$lib/components/icons/Plus.svelte';
 	import UserCircleSolid from '$lib/components/icons/UserCircleSolid.svelte';
 	import XMark from '$lib/components/icons/XMark.svelte';
+	import MemberSelector from '$lib/components/workspace/common/MemberSelector.svelte';
 	import Badge from '$lib/components/common/Badge.svelte';
 
 	export let onChange: Function = () => {};
@@ -18,8 +18,6 @@
 	export let share = true;
 	export let sharePublic = true;
 
-	let selectedGroupId = '';
-	let groups = [];
 
 	$: if (!sharePublic && accessControl === null) {
 		initPublicAccess();
@@ -41,8 +39,8 @@
 		}
 	};
 
+
 	onMount(async () => {
-		groups = await getGroups(localStorage.token, true);
 
 		if (accessControl === null) {
 			initPublicAccess();
@@ -144,109 +142,21 @@
 
 	{#if share}
 		{#if accessControl !== null}
-			{@const accessGroups = groups.filter((group) =>
-				(accessControl?.read?.group_ids ?? []).includes(group.id)
-			)}
-			<div>
+			<div class="mt-4">
 				<div class="">
 					<div class="flex justify-between mb-2.5">
 						<div class="text-xs font-medium text-gray-500">
-							{$i18n.t('Groups')}
+							{$i18n.t('Add Members')}
 						</div>
 					</div>
 
-					{#if accessGroups.length > 0}
-						<div class="flex flex-col gap-1.5 mb-2 px-0.5 mx-0.5">
-							{#each accessGroups as group}
-								<div class="flex items-center gap-3 justify-between text-sm w-full transition">
-									<div class="flex items-center gap-1.5 w-full">
-										<div>
-											{group.name} <span class="text-xs text-gray-500">{group?.member_count}</span>
-										</div>
-									</div>
-
-									<div class="w-full flex justify-end items-center gap-0.5">
-										<button
-											class=""
-											type="button"
-											on:click={() => {
-												if (accessRoles.includes('write')) {
-													if ((accessControl?.write?.group_ids ?? []).includes(group.id)) {
-														accessControl.write.group_ids = (
-															accessControl?.write?.group_ids ?? []
-														).filter((group_id) => group_id !== group.id);
-													} else {
-														accessControl.write.group_ids = [
-															...(accessControl?.write?.group_ids ?? []),
-															group.id
-														];
-													}
-													onChange(accessControl);
-												}
-											}}
-										>
-											{#if (accessControl?.write?.group_ids ?? []).includes(group.id)}
-												<Badge type={'success'} content={$i18n.t('Write')} />
-											{:else}
-												<Badge type={'info'} content={$i18n.t('Read')} />
-											{/if}
-										</button>
-
-										<button
-											class=" rounded-full p-1 hover:bg-gray-100 dark:hover:bg-gray-850 transition"
-											type="button"
-											on:click={() => {
-												accessControl.read.group_ids = (
-													accessControl?.read?.group_ids ?? []
-												).filter((id) => id !== group.id);
-												accessControl.write.group_ids = (
-													accessControl?.write?.group_ids ?? []
-												).filter((id) => id !== group.id);
-												onChange(accessControl);
-											}}
-										>
-											<XMark />
-										</button>
-									</div>
-								</div>
-							{/each}
-						</div>
-					{/if}
-
-					<!-- <div class="flex items-center justify-center">
-						<div class="text-gray-500 text-xs text-center py-2 px-10">
-							{$i18n.t('No groups with access, add a group to grant access')}
-						</div>
-					</div> -->
-
 					<div class="mb-1">
 						<div class="flex w-full">
 							<div class="flex flex-1 items-center">
 								<div class="w-full px-0.5">
-									<select
-										class="dark:bg-gray-900 outline-hidden bg-transparent text-sm block w-full pr-10 max-w-full
-									{selectedGroupId ? '' : 'text-gray-500'}
-									dark:placeholder-gray-500"
-										bind:value={selectedGroupId}
-										on:change={() => {
-											if (selectedGroupId !== '') {
-												accessControl.read.group_ids = [
-													...(accessControl?.read?.group_ids ?? []),
-													selectedGroupId
-												];
-
-												selectedGroupId = '';
-												onChange(accessControl);
-											}
-										}}
-									>
-										<option class=" text-gray-700" value="" disabled selected
-											>{$i18n.t('Select a group')}</option
-										>
-										{#each groups.filter((group) => !(accessControl?.read?.group_ids ?? []).includes(group.id)) as group}
-											<option class=" text-gray-700" value={group.id}>{group.name}</option>
-										{/each}
-									</select>
+									<div class="">
+										<MemberSelector bind:accessControl bind:accessRoles {onChange} includeGroups={true} manageAccess={true} />
+									</div>
 								</div>
 							</div>
 						</div>

src/lib/components/workspace/common/MemberSelector.svelte

@@ -16,13 +16,19 @@
 	import ChevronDown from '$lib/components/icons/ChevronDown.svelte';
 	import Spinner from '$lib/components/common/Spinner.svelte';
 	import Checkbox from '$lib/components/common/Checkbox.svelte';
-	import { getGroups } from '$lib/apis/groups';
+	import Badge from '$lib/components/common/Badge.svelte';
+	import { getGroups, getGroupById } from '$lib/apis/groups';
+
+	export let onChange: Function = () => {};
 
 	export let includeGroups = true;
 	export let pagination = false;
+	export let manageAccess = false;
 
 	export let groupIds = [];
 	export let userIds = [];
+	export let accessRoles = ['read'];
+	export let accessControl = {};
 
 	let groups = null;
 	let filteredGroups = [];
@@ -31,7 +37,7 @@
 		? groups.filter((group) => group.name.toLowerCase().includes(query.toLowerCase()))
 		: [];
 
-	let selectedGroup = {};
+	let selectedGroups = {};
 	let selectedUsers = {};
 
 	let page = 1;
@@ -66,6 +72,10 @@
 
 	onMount(async () => {
 		groups = await getGroups(localStorage.token, true);
+		if(manageAccess){
+			userIds = accessControl?.read?.user_ids ?? [];
+			groupIds = accessControl?.read?.group_ids ?? [];
+		}
 		if (userIds.length > 0) {
 			userIds.forEach(async (id) => {
 				const res = await getUserById(localStorage.token, id).catch((error) => {
@@ -77,6 +87,27 @@
 				}
 			});
 		}
+		if (groupIds.length > 0) {
+			groupIds.forEach(async (id) => {
+				const res = await getGroupById(localStorage.token, id).catch((error) => {
+					console.error(error);
+					return null;
+				});
+				if (res) {
+					selectedGroups[id] = res;
+					// Check if group with this ID already exists in groups array
+					const existingGroupIndex = groups.findIndex(group => group.id === res.id);
+					if (existingGroupIndex === -1) {
+						// If not found, add the new group
+					groups = [
+						...groups,
+						res
+						];
+					}
+				}
+			});
+		}
+		console.log(selectedUsers)
 	});
 </script>
 
@@ -86,7 +117,7 @@
 			<Spinner className="size-5" />
 		</div>
 	{:else}
-		{#if groupIds.length > 0}
+		{#if groupIds.length > 0  && !manageAccess}
 			<div class="mx-1 mb-1.5">
 				<div class="text-xs text-gray-500 mx-0.5 mb-1">
 					{groupIds.length}
@@ -94,18 +125,18 @@
 				</div>
 				<div class="flex gap-1 flex-wrap">
 					{#each groupIds as id}
-						{#if selectedGroup[id]}
+						{#if selectedGroups[id]}
 							<button
 								type="button"
 								class="inline-flex items-center space-x-1 px-2 py-1 bg-gray-100/50 dark:bg-gray-850 rounded-lg text-xs"
 								on:click={() => {
 									groupIds = groupIds.filter((gid) => gid !== id);
-									delete selectedGroup[id];
+									delete selectedGroups[id];
 								}}
 							>
 								<div>
-									{selectedGroup[id].name}
-									<span class="text-xs text-gray-500">{selectedGroup[id].member_count}</span>
+									{selectedGroups[id].name}
+									<span class="text-xs text-gray-500">{selectedGroups[id].member_count}</span>
 								</div>
 
 								<div>
@@ -118,7 +149,7 @@
 			</div>
 		{/if}
 
-		{#if userIds.length > 0}
+		{#if userIds.length > 0 && !manageAccess}
 			<div class="mx-1 mb-1.5">
 				<div class="text-xs text-gray-500 mx-0.5 mb-1">
 					{userIds.length}
@@ -190,12 +221,45 @@
 										class=" dark:border-gray-850 text-xs flex items-center justify-between w-full"
 										type="button"
 										on:click={() => {
+											if (manageAccess && !accessRoles.includes('write')) {
+												return
+											}
+
 											if ((groupIds ?? []).includes(group.id)) {
-												groupIds = groupIds.filter((id) => id !== group.id);
-												delete selectedGroup[group.id];
+												if (!manageAccess || (manageAccess && (accessControl?.write?.group_ids ?? []).includes(group.id))){
+													groupIds = groupIds.filter((id) => id !== group.id);
+													delete selectedGroups[group.id];
+												}
+
+												if(manageAccess){
+													if ((accessControl?.write?.group_ids ?? []).includes(group.id)) {
+														accessControl.write.group_ids = (
+															accessControl?.write?.group_ids ?? []
+														).filter((group_id) => group_id !== group.id);
+														accessControl.read.group_ids = (
+															accessControl?.read?.group_ids ?? []
+														).filter((group_id) => group_id !== group.id);
+													} else {
+														accessControl.write.group_ids = [
+															...(accessControl?.write?.group_ids ?? []),
+															group.id
+														];
+													}														
+												}	
+
 											} else {
 												groupIds = [...groupIds, group.id];
-												selectedGroup[group.id] = group;
+												selectedGroups[group.id] = group;
+												if(manageAccess){
+													accessControl.read.group_ids = [
+														...(accessControl?.read?.group_ids ?? []),
+														group.id
+													];
+												}
+											}
+
+											if(manageAccess){
+												onChange(accessControl);
 											}
 										}}
 									>
@@ -211,9 +275,15 @@
 
 										<div class="px-3 py-1">
 											<div class=" translate-y-0.5">
-												<Checkbox
-													state={(groupIds ?? []).includes(group.id) ? 'checked' : 'unchecked'}
-												/>
+												{#if manageAccess && (accessControl?.write?.group_ids ?? []).includes(group.id)}
+													<Badge type={'success'} content={$i18n.t('Write')} />
+												{:else if manageAccess && (accessControl?.read?.group_ids ?? []).includes(group.id)}
+													<Badge type={'info'} content={$i18n.t('Read')} />
+												{:else}
+													<Checkbox
+														state={(groupIds ?? []).includes(group.id) ? 'checked' : 'unchecked'}
+													/>
+												{/if}
 											</div>
 										</div>
 									</button>
@@ -232,27 +302,70 @@
 										class=" dark:border-gray-850 text-xs flex items-center justify-between w-full"
 										type="button"
 										on:click={() => {
-											if ((userIds ?? []).includes(user.id)) {
-												userIds = userIds.filter((id) => id !== user.id);
-												delete selectedUsers[user.id];
-											} else {
-												userIds = [...userIds, user.id];
-												selectedUsers[user.id] = user;
-											}
+												if (manageAccess && !accessRoles.includes('write')) {
+													return
+												}
+
+												if ((userIds ?? []).includes(user.id)) {
+													if (!manageAccess || (manageAccess && (accessControl?.write?.user_ids ?? []).includes(user.id))){
+														userIds = userIds.filter((id) => id !== user.id);
+														delete selectedUsers[user.id];
+													}
+
+													if(manageAccess){
+														if ((accessControl?.write?.user_ids ?? []).includes(user.id)) {
+															accessControl.write.user_ids = (
+																accessControl?.write?.user_ids ?? []
+															).filter((user_id) => user_id !== user.id);
+															accessControl.read.user_ids = (
+																accessControl?.read?.user_ids ?? []
+															).filter((user_id) => user_id !== user.id);
+														} else {
+															accessControl.write.user_ids = [
+																...(accessControl?.write?.user_ids ?? []),
+																user.id
+															];
+														}														
+													}										
+												} else {
+													userIds = [...userIds, user.id];
+													selectedUsers[user.id] = user;
+													if(manageAccess){
+														accessControl.read.user_ids = [
+															...(accessControl?.read?.user_ids ?? []),
+															user.id
+														];
+													}
+												}
+
+												if(manageAccess){
+													onChange(accessControl);
+												}
 										}}
 									>
 										<div class="px-3 py-1.5 font-medium text-gray-900 dark:text-white flex-1">
 											<div class="flex items-center gap-2">
-												<ProfilePreview {user} side="right" align="center" sideOffset={6}>
+												{#if manageAccess}
 													<img
 														class="rounded-2xl w-6 h-6 object-cover flex-shrink-0"
 														src={`${WEBUI_API_BASE_URL}/users/${user.id}/profile/image`}
 														alt="user"
 													/>
-												</ProfilePreview>
-												<Tooltip content={user.email} placement="top-start">
-													<div class="font-medium truncate">{user.name}</div>
-												</Tooltip>
+													<Tooltip content={user.email} placement="top-start">
+														<div class="font-medium truncate">{user.name} <span class="text-xs text-gray-500">{user?.email}</span></div>
+													</Tooltip>
+												{:else}
+													<ProfilePreview {user} side="right" align="center" sideOffset={6}>
+														<img
+															class="rounded-2xl w-6 h-6 object-cover flex-shrink-0"
+															src={`${WEBUI_API_BASE_URL}/users/${user.id}/profile/image`}
+															alt="user"
+														/>
+													</ProfilePreview>
+													<Tooltip content={user.email} placement="top-start">
+														<div class="font-medium truncate">{user.name}</div>
+													</Tooltip>
+												{/if}
 
 												{#if user?.is_active}
 													<div>
@@ -270,9 +383,15 @@
 
 										<div class="px-3 py-1">
 											<div class=" translate-y-0.5">
-												<Checkbox
-													state={(userIds ?? []).includes(user.id) ? 'checked' : 'unchecked'}
-												/>
+												{#if manageAccess && (accessControl?.write?.user_ids ?? []).includes(user.id)}
+													<Badge type={'success'} content={$i18n.t('Write')} />
+												{:else if manageAccess && (accessControl?.read?.user_ids ?? []).includes(user.id)}
+													<Badge type={'info'} content={$i18n.t('Read')} />
+												{:else}
+													<Checkbox
+														state={(userIds ?? []).includes(user.id) ? 'checked' : 'unchecked'}
+													/>
+												{/if}
 											</div>
 										</div>
 									</button>