refac

backend/open_webui/routers/users.py

@@ -384,21 +384,22 @@ async def get_user_info_by_session_user(user=Depends(get_verified_user), db: Asy
 
 @router.post('/user/info/update', response_model=dict | None)
 async def update_user_info_by_session_user(
-    form_data: dict, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session)
+    form_data: dict, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session),
 ):
-    # Merges against the auth-time snapshot of user.info. The previous pre-merge
-    # refetch only narrowed (did not eliminate) the lost-update window on concurrent
-    # same-user writes; real safety needs row locking or a version column.
-    existing_info = user.info or {}
-    updated = await Users.update_user_by_id(user.id, {'info': {**existing_info, **form_data}}, db=db)
-    if updated:
-        return updated.info
-    else:
+    """Merge caller-supplied fields into the current user's info dict.
+
+    Uses the auth-time snapshot of ``user.info`` as the merge base.  This does
+    NOT eliminate lost-update races on concurrent same-user writes; real safety
+    would need row locking or an optimistic-concurrency version column.
+    """
+    merged_info = {**(user.info or {}), **form_data}
+    updated = await Users.update_user_by_id(user.id, {'info': merged_info}, db=db)
+    if not updated:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail=ERROR_MESSAGES.USER_NOT_FOUND,
         )
-
+    return updated.info
 
 ############################
 # GetUserById