openwebui: enable user scoped integrations to avoid cross user data leakage

packages/api/src/router/integration/integration-router.ts

@@ -99,6 +99,7 @@ export const integrationRouter = createTRPCRouter({
             name: integration.name,
             kind: integration.kind,
             url: integration.url,
+            creatorId: integration.creatorId,
             permissions: {
               hasUseAccess:
                 permissions.includes("use") || permissions.includes("interact") || permissions.includes("full"),
@@ -350,6 +351,15 @@ export const integrationRouter = createTRPCRouter({
         url: input.url,
         kind: input.kind,
         appId,
+        creatorId: ctx.session.user.id,
+      });
+
+      // Auto-grant the creator "full" permission so they can immediately use
+      // and manage the integration they just created.
+      await ctx.db.insert(integrationUserPermissions).values({
+        integrationId,
+        userId: ctx.session.user.id,
+        permission: "full",
       });
 
       if (input.secrets.length >= 1) {

packages/api/src/router/test/integration/integration-router.spec.ts

@@ -301,6 +301,10 @@ describe("create should create a new integration", () => {
       deviceType: undefined,
       session: defaultSessionWithPermissions(["integration-create"]),
     });
+
+    // The creator must exist in the DB for the creatorId foreign key
+    await db.insert(users).values({ id: defaultUserId });
+
     const input = {
       name: "Jellyfin",
       kind: "jellyfin" as const,
@@ -317,10 +321,18 @@ describe("create should create a new integration", () => {
 
     const dbIntegration = await db.query.integrations.findFirst();
     const dbSecret = await db.query.integrationSecrets.findFirst();
+    const dbPermission = await db.query.integrationUserPermissions.findFirst();
     expect(dbIntegration).toBeDefined();
     expect(dbIntegration!.name).toBe(input.name);
     expect(dbIntegration!.kind).toBe(input.kind);
     expect(dbIntegration!.url).toBe(input.url);
+    expect(dbIntegration!.creatorId).toBe(defaultUserId);
+
+    // Creator should be auto-granted "full" permission
+    expect(dbPermission).toBeDefined();
+    expect(dbPermission!.integrationId).toBe(dbIntegration!.id);
+    expect(dbPermission!.userId).toBe(defaultUserId);
+    expect(dbPermission!.permission).toBe("full");
 
     expect(dbSecret!.integrationId).toBe(dbIntegration!.id);
     expect(dbSecret).toBeDefined();
@@ -336,6 +348,10 @@ describe("create should create a new integration", () => {
       deviceType: undefined,
       session: defaultSessionWithPermissions(["integration-create"]),
     });
+
+    // The creator must exist in the DB for the creatorId foreign key
+    await db.insert(users).values({ id: defaultUserId });
+
     const input = {
       name: "Jellyseerr",
       kind: "jellyseerr" as const,
@@ -357,6 +373,7 @@ describe("create should create a new integration", () => {
     expect(dbIntegration!.name).toBe(input.name);
     expect(dbIntegration!.kind).toBe(input.kind);
     expect(dbIntegration!.url).toBe(input.url);
+    expect(dbIntegration!.creatorId).toBe(defaultUserId);
 
     expect(dbSecret!.integrationId).toBe(dbIntegration!.id);
     expect(dbSecret).toBeDefined();
@@ -374,6 +391,10 @@ describe("create should create a new integration", () => {
       deviceType: undefined,
       session: defaultSessionWithPermissions(["integration-create", "app-create"]),
     });
+
+    // The creator must exist in the DB for the creatorId foreign key
+    await db.insert(users).values({ id: defaultUserId });
+
     const input = {
       name: "Jellyfin",
       kind: "jellyfin" as const,
@@ -405,6 +426,7 @@ describe("create should create a new integration", () => {
     expect(dbIntegration!.name).toBe(input.name);
     expect(dbIntegration!.kind).toBe(input.kind);
     expect(dbIntegration!.url).toBe(input.url);
+    expect(dbIntegration!.creatorId).toBe(defaultUserId);
     expect(dbIntegration!.app!.name).toBe(input.app.name);
     expect(dbIntegration!.app!.pingUrl).toBe(input.app.pingUrl);
     expect(dbIntegration!.app!.href).toBe(input.app.href);
@@ -431,6 +453,10 @@ describe("create should create a new integration", () => {
       deviceType: undefined,
       session: defaultSessionWithPermissions(["integration-create"]),
     });
+
+    // The creator must exist in the DB for the creatorId foreign key
+    await db.insert(users).values({ id: defaultUserId });
+
     const input = {
       name: "Jellyfin",
       kind: "jellyfin" as const,
@@ -455,6 +481,7 @@ describe("create should create a new integration", () => {
     expect(dbIntegration!.kind).toBe(input.kind);
     expect(dbIntegration!.url).toBe(input.url);
     expect(dbIntegration!.appId).toBe(appId);
+    expect(dbIntegration!.creatorId).toBe(defaultUserId);
 
     expect(dbSecret!.integrationId).toBe(dbIntegration!.id);
     expect(dbSecret).toBeDefined();

packages/api/src/router/widgets/open-webui.ts

@@ -1,4 +1,5 @@
 import { observable } from "@trpc/server/observable";
+import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
@@ -19,6 +20,24 @@ import { createTRPCRouter, protectedProcedure, publicProcedure } from "../../trp
 
 const logger = createLogger({ module: "openWebUiRouter" });
 
+/**
+ * Open WebUI integrations hold a personal API key that grants access to a
+ * single user's data (chat history, files, notes, knowledge bases).  To prevent
+ * other Homarr users from reading that data, every procedure that touches the
+ * integration verifies that the caller is the integration's creator.
+ *
+ * The check is intentionally placed **after** the integration middleware (which
+ * already validates the caller's permission level) so the error message does
+ * not leak whether the integration exists.
+ */
+const throwIfNotCreator = (integration: { creatorId?: string | null }, userId: string | undefined) => {
+  // Existing integrations that predate the creatorId column have a null
+  // creatorId; we skip the check for backward compatibility.
+  if (integration.creatorId && integration.creatorId !== userId) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "Only the integration creator can access this data" });
+  }
+};
+
 const messageSchema = z.object({
   role: z.enum(["system", "user", "assistant"]),
   content: z.string(),
@@ -104,30 +123,39 @@ const groundMessagesAsync = async (
 
 export const openWebUiRouter = createTRPCRouter({
   getModels: publicProcedure.concat(createOneIntegrationMiddleware("query", "openWebUi")).query(async ({ ctx }) => {
+    throwIfNotCreator(ctx.integration, ctx.session?.user.id);
     const handler = openWebUiModelsRequestHandler.handler(ctx.integration, {});
     const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
     return data;
   }),
 
-  getChats: publicProcedure.concat(createOneIntegrationMiddleware("query", "openWebUi")).query(async ({ ctx }) => {
-    const handler = openWebUiChatsRequestHandler.handler(ctx.integration, {});
-    const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
-    return data;
-  }),
+  // Chat history exposes private user data, so we require "interact" access
+  // (not just "query") and verify the caller is the integration's creator.
+  getChats: protectedProcedure
+    .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
+    .query(async ({ ctx }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
+      const handler = openWebUiChatsRequestHandler.handler(ctx.integration, {});
+      const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
+      return data;
+    }),
 
   getKnowledge: publicProcedure.concat(createOneIntegrationMiddleware("query", "openWebUi")).query(async ({ ctx }) => {
+    throwIfNotCreator(ctx.integration, ctx.session?.user.id);
     const handler = openWebUiKnowledgeRequestHandler.handler(ctx.integration, {});
     const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
     return data;
   }),
 
   getFiles: publicProcedure.concat(createOneIntegrationMiddleware("query", "openWebUi")).query(async ({ ctx }) => {
+    throwIfNotCreator(ctx.integration, ctx.session?.user.id);
     const handler = openWebUiFilesRequestHandler.handler(ctx.integration, {});
     const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
     return data;
   }),
 
   getNotes: publicProcedure.concat(createOneIntegrationMiddleware("query", "openWebUi")).query(async ({ ctx }) => {
+    throwIfNotCreator(ctx.integration, ctx.session?.user.id);
     const handler = openWebUiNotesRequestHandler.handler(ctx.integration, {});
     const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
     return data;
@@ -137,6 +165,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ noteId: z.string() }))
     .concat(createOneIntegrationMiddleware("query", "openWebUi"))
     .query(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session?.user.id);
       const handler = openWebUiNoteRequestHandler.handler(ctx.integration, { noteId: input.noteId });
       const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
       return data;
@@ -146,6 +175,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ knowledgeId: z.string() }))
     .concat(createOneIntegrationMiddleware("query", "openWebUi"))
     .query(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session?.user.id);
       const handler = openWebUiKnowledgeFilesRequestHandler.handler(ctx.integration, {
         knowledgeId: input.knowledgeId,
       });
@@ -159,6 +189,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ url: z.string().url() }))
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .mutation(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const client = await createIntegrationAsync(ctx.integration);
       return await client.processWebAsync(input.url);
     }),
@@ -169,6 +200,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ filename: z.string(), contentBase64: z.string(), contentType: z.string() }))
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .mutation(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const client = await createIntegrationAsync(ctx.integration);
       return await client.uploadFileAsync(input.filename, input.contentBase64, input.contentType);
     }),
@@ -178,15 +210,18 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ filename: z.string(), contentBase64: z.string(), contentType: z.string() }))
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .mutation(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const client = await createIntegrationAsync(ctx.integration);
       const text = await client.transcribeAudioAsync(input.filename, input.contentBase64, input.contentType);
       return { text };
     }),
 
-  getChat: publicProcedure
+  // Full chat messages contain private user data; restrict to the creator.
+  getChat: protectedProcedure
     .input(z.object({ chatId: z.string() }))
-    .concat(createOneIntegrationMiddleware("query", "openWebUi"))
+    .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .query(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const handler = openWebUiChatRequestHandler.handler(ctx.integration, { chatId: input.chatId });
       const { data } = await handler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
       return data;
@@ -196,6 +231,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(chatPayloadSchema)
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .mutation(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const client = await createIntegrationAsync(ctx.integration);
       const chat = await client.createChatAsync({
         title: input.title,
@@ -210,6 +246,7 @@ export const openWebUiRouter = createTRPCRouter({
     .input(z.object({ chatId: z.string(), chat: chatPayloadSchema }))
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .mutation(async ({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session.user.id);
       const client = await createIntegrationAsync(ctx.integration);
       const chat = await client.updateChatAsync(input.chatId, input.chat);
       await openWebUiChatsRequestHandler.handler(ctx.integration, {}).invalidateAsync();
@@ -237,6 +274,7 @@ export const openWebUiRouter = createTRPCRouter({
     )
     .concat(createOneIntegrationMiddleware("interact", "openWebUi"))
     .subscription(({ ctx, input }) => {
+      throwIfNotCreator(ctx.integration, ctx.session?.user.id);
       return observable<StreamEvent>((emit) => {
         const controller = new AbortController();