Keep role names from OIDC

backend/open_webui/main.py

@@ -2273,7 +2273,7 @@ async def get_app_config(request: Request):
                     else {}
                 ),
             }
-            if user is not None and (user.role in ['admin', 'user'])
+            if user is not None and (user.role in ['admin', 'user', 'builder', 'local-admin'])
             else {
                 **(
                     {

backend/open_webui/routers/chats.py

@@ -682,7 +682,7 @@ async def delete_all_user_chats(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
-    if user.role == 'user' and not await has_permission(user.id, 'chat.delete', await Config.get('user.permissions')):
+    if (user.role == 'user' or user.role == 'builder') and not await has_permission(user.id, 'chat.delete', await Config.get('user.permissions')):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,

backend/open_webui/routers/ollama.py

@@ -490,8 +490,8 @@ async def get_ollama_tags(
         key = get_api_key(url_idx, url, (await Config.get('ollama.api_configs', {})))
         result = await send_request(f'{url}/api/tags', 'GET', key=key, user=user)
 
-    if user.role == 'user' and not BYPASS_MODEL_ACCESS_CONTROL:
-        result['models'] = await get_filtered_models(result, user)
+    if (user.role == 'user' or user.role == 'builder') and not BYPASS_MODEL_ACCESS_CONTROL:
+        models['models'] = await get_filtered_models(models, user)
 
     return result
 
@@ -1493,7 +1493,7 @@ async def get_openai_models(
     now_ts = int(time.time())
     models = [{'id': m['model'], 'object': 'model', 'created': now_ts, 'owned_by': 'openai'} for m in raw_models]
 
-    if user.role == 'user' and not BYPASS_MODEL_ACCESS_CONTROL:
+    if (user.role == 'user' or user.role == 'builder') and not BYPASS_MODEL_ACCESS_CONTROL:
         model_ids = [m['id'] for m in models]
         model_infos = {mi.id: mi for mi in await Models.get_models_by_ids(model_ids, db=db)}
         user_group_ids = {g.id for g in await Groups.get_groups_by_member_id(user.id, db=db)}

backend/open_webui/routers/openai.py

@@ -779,7 +779,7 @@ async def get_models(request: Request, url_idx: int | None = None, user=Depends(
                 error_detail = f'Unexpected error: {str(e)}'
                 raise HTTPException(status_code=500, detail=error_detail)
 
-    if user.role == 'user' and not BYPASS_MODEL_ACCESS_CONTROL:
+    if (user.role == 'user' or user.role == 'builder') and not BYPASS_MODEL_ACCESS_CONTROL:
         models['data'] = await get_filtered_models(models, user)
 
     return models

backend/open_webui/utils/auth.py

@@ -488,7 +488,7 @@ async def get_current_user_by_api_key(request, api_key: str):
     return user
 
 
-VERIFIED_USER_ROLES = {'user', 'admin'}
+VERIFIED_USER_ROLES = {'user', 'admin', 'builder', 'local-admin'}
 
 
 def get_verified_user(user=Depends(get_current_user)):

backend/open_webui/utils/chat.py

@@ -199,7 +199,7 @@ async def generate_chat_completion(
         return await generate_direct_chat_completion(request, form_data, user=user, models=models)
     else:
         # Check if user has access to the model
-        if not bypass_filter and user.role == 'user':
+        if not bypass_filter and (user.role == 'user' or user.role == 'builder'):
             try:
                 await check_model_access(user, model)
             except Exception as e:

backend/open_webui/utils/embeddings.py

@@ -67,7 +67,7 @@ async def generate_embeddings(
 
     # Access filtering
     if not getattr(request.state, 'direct', False):
-        if not bypass_filter and user.role == 'user':
+        if not bypass_filter and (user.role == 'user' or user.role == 'builder'):
             await check_model_access(user, model)
 
     # Ollama backend — use /api/embed which supports batch input natively

backend/open_webui/utils/models.py

@@ -475,7 +475,10 @@ async def check_model_access(user, model, model_info=None, db=None):
 async def get_filtered_models(models, user, db=None):
     # Filter out models that the user does not have access to
     if (
-        user.role == 'user' or (user.role == 'admin' and not BYPASS_ADMIN_ACCESS_CONTROL)
+        user.role == 'user'
+        or user.role == 'builder'
+        or (user.role == 'admin' and not BYPASS_ADMIN_ACCESS_CONTROL)
+
     ) and not BYPASS_MODEL_ACCESS_CONTROL:
         model_infos = {}
         for model in models:

backend/open_webui/utils/oauth.py

@@ -1518,8 +1518,12 @@ async def get_user_role(self, user, user_data):
                 matched = False
                 for allowed_role in oauth_allowed_roles:
                     if allowed_role == '*' or allowed_role in oauth_roles:
-                        log.debug('Assigned user the user role')
-                        role = 'user'
+                        log.debug(f'Using first role from OAuth: {oauth_roles[0]}')
+                        first_role = oauth_roles[0]
+                        if first_role == "end-user":
+                            role = 'user'
+                        else:
+                            role = first_role
                         matched = True
                         break
                 for admin_role in oauth_admin_roles:

src/lib/components/admin/Users/UserList/EditUserModal.svelte

@@ -145,9 +145,11 @@
 												disabled={_user.id == sessionUser.id}
 												required
 											>
-												<option value="admin">{$i18n.t('Admin')}</option>
-												<option value="user">{$i18n.t('User')}</option>
-												<option value="pending">{$i18n.t('Pending')}</option>
+                                                <option value="admin">{$i18n.t('Admin')}</option>
+                                                <option value="user">{$i18n.t('User')}</option>
+                                                <option value="local-admin">{$i18n.t('Local admin')}</option>
+                                                <option value="builder">{$i18n.t('Builder')}</option>
+                                                <option value="pending">{$i18n.t('Pending')}</option>
 											</select>
 										</div>
 									</div>

src/routes/(app)/+layout.svelte

@@ -248,7 +248,7 @@
 			await gotoAuth();
 			return;
 		}
-		if (!['user', 'admin'].includes($user?.role)) {
+		if (['pending'].includes($user?.role)) {
 			return;
 		}
 
@@ -456,7 +456,7 @@
 		<div
 			class=" text-gray-700 dark:text-gray-100 bg-white dark:bg-gray-900 h-screen max-h-[100dvh] overflow-auto flex flex-row justify-end"
 		>
-			{#if !['user', 'admin'].includes($user?.role)}
+			{#if ['pending'].includes($user?.role)}
 				<AccountPending />
 			{:else}
 				{#if localDBChats.length > 0}