From 443908b14c64dc716906dcb17735a63d793d35d3 Mon Sep 17 00:00:00 2001
From: G30 <50341825+silentoplayz@users.noreply.github.com>
Date: Thu, 22 Jan 2026 16:25:00 -0500
Subject: [PATCH] fix: enforce Allow Chat Valves permission in integrations
 menu (#20691)

- The "Allow Chat Valves" permission was only hiding valves in the Chat Controls sidebar, but users could still bypass this by accessing valves through the integrations menu in the chat input field. This fix adds the permission check to hide Valves buttons for both tools and filters/functions in the integrations menu.
---
 src/lib/components/chat/MessageInput/IntegrationsMenu.svelte | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/chat/MessageInput/IntegrationsMenu.svelte b/src/lib/components/chat/MessageInput/IntegrationsMenu.svelte
index 348d23d07..38e3228c1 100644
--- a/src/lib/components/chat/MessageInput/IntegrationsMenu.svelte
+++ b/src/lib/components/chat/MessageInput/IntegrationsMenu.svelte
@@ -178,7 +178,7 @@
 										</div>
 									</div>
 
-									{#if filter?.has_user_valves}
+									{#if filter?.has_user_valves && ($user?.role === 'admin' || ($user?.permissions?.chat?.valves ?? true))}
 										<div class=" shrink-0">
 											<Tooltip content={$i18n.t('Valves')}>
 												<button
@@ -371,7 +371,7 @@
 								</div>
 							</div>
 
-							{#if tools[toolId]?.has_user_valves}
+							{#if tools[toolId]?.has_user_valves && ($user?.role === 'admin' || ($user?.permissions?.chat?.valves ?? true))}
 								<div class=" shrink-0">
 									<Tooltip content={$i18n.t('Valves')}>
 										<button