From 754c4b5762ed0d79954ff28c4e06631004dc31b3 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Mon, 21 Sep 2026 10:25:20 -0400
Subject: [PATCH] refac

Co-Authored-By: Classic298 <27028174+Classic298@users.noreply.github.com>
---
 backend/open_webui/routers/models.py | 32 +++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/backend/open_webui/routers/models.py b/backend/open_webui/routers/models.py
index f8b89ea5e8..e8426b1dae 100644
--- a/backend/open_webui/routers/models.py
+++ b/backend/open_webui/routers/models.py
@@ -27,7 +27,7 @@ from open_webui.env import (
 )
 from open_webui.events import EVENTS, publish_event
 from open_webui.internal.db import get_async_session
-from open_webui.models.access_grants import AccessGrants
+from open_webui.models.access_grants import AccessGrants, normalize_access_grants
 from open_webui.models.config import Config
 from open_webui.models.files import Files
 from open_webui.models.groups import Groups
@@ -985,13 +985,29 @@ async def update_model_by_id(
         form_data.meta.background_image_url = model.meta.background_image_url
     await _verify_background_image(form_data.meta.background_image_url, user, db, model.meta.background_image_url)
 
-    form_data.access_grants = await filter_allowed_access_grants(
-        await Config.get('user.permissions'),
-        user.id,
-        user.role,
-        form_data.access_grants,
-        'sharing.public_models',
-    )
+    if form_data.access_grants is not None:
+        # The editor resends every stored grant, so re-checking them would strip sharing this user cannot re-create.
+        existing_access_grants = {
+            (grant.principal_type, grant.principal_id, grant.permission) for grant in model.access_grants
+        }
+        submitted_access_grants_map = {
+            (grant['principal_type'], grant['principal_id'], grant['permission']): grant
+            for grant in normalize_access_grants(form_data.access_grants)
+        }
+        preserved_access_grants = [
+            grant for key, grant in submitted_access_grants_map.items() if key in existing_access_grants
+        ]
+        new_access_grants = [
+            grant for key, grant in submitted_access_grants_map.items() if key not in existing_access_grants
+        ]
+
+        form_data.access_grants = preserved_access_grants + await filter_allowed_access_grants(
+            await Config.get('user.permissions'),
+            user.id,
+            user.role,
+            new_access_grants,
+            'sharing.public_models',
+        )
 
     model = await Models.update_model_by_id(form_data.id, ModelForm(**form_data.model_dump()), db=db)
     if model: