refac

backend/open_webui/routers/auths.py

@@ -768,7 +768,17 @@ async def signin(
                 trusted_role = request.headers.get(WEBUI_AUTH_TRUSTED_ROLE_HEADER, '').lower().strip()
                 if trusted_role in {'admin', 'user', 'pending'}:
                     if user.role != trusted_role:
-                        await Users.update_user_role_by_id(user.id, trusted_role, db=db)
+                        updated_user = await Users.update_user_role_by_id(user.id, trusted_role, db=db)
+                        if updated_user:
+                            user = updated_user
+                            await publish_event(
+                                request,
+                                EVENTS.USER_ROLE_UPDATED,
+                                actor=updated_user,
+                                subject_id=updated_user.id,
+                                source='trusted_header',
+                                data={'role': updated_user.role},
+                            )
                 elif trusted_role:
                     log.warning(f'Ignoring invalid trusted role header value: {trusted_role}')
 

backend/open_webui/routers/scim.py

@@ -700,15 +700,27 @@ async def update_user(
         await Users.update_user_scim_by_id(user_id, provider, user_data.externalId, db=db)
         updated_user = await Users.get_user_by_id(user_id, db=db)
 
-    await publish_event(
-        request,
-        EVENTS.USER_UPDATED,
-        subject_id=user_id,
-        source='scim',
-        data={
-            'updated_fields': list(update_data.keys()) + (['externalId'] if user_data.externalId else []),
-        },
-    )
+    updated_fields = list(update_data.keys()) + (['externalId'] if user_data.externalId else [])
+    role_changed = updated_user.role != user.role
+    user_updated_fields = [field for field in updated_fields if field != 'role']
+
+    if user_updated_fields:
+        await publish_event(
+            request,
+            EVENTS.USER_UPDATED,
+            subject_id=user_id,
+            source='scim',
+            data={'updated_fields': user_updated_fields},
+        )
+
+    if role_changed:
+        await publish_event(
+            request,
+            EVENTS.USER_ROLE_UPDATED,
+            subject_id=user_id,
+            source='scim',
+            data={'role': updated_user.role},
+        )
 
     return await user_to_scim(updated_user, request, db=db)
 
@@ -764,13 +776,26 @@ async def patch_user(
     else:
         updated_user = user
 
-    await publish_event(
-        request,
-        EVENTS.USER_UPDATED,
-        subject_id=user_id,
-        source='scim',
-        data={'updated_fields': list(update_data.keys())},
-    )
+    role_changed = updated_user.role != user.role
+    user_updated_fields = [field for field in update_data.keys() if field != 'role']
+
+    if user_updated_fields:
+        await publish_event(
+            request,
+            EVENTS.USER_UPDATED,
+            subject_id=user_id,
+            source='scim',
+            data={'updated_fields': user_updated_fields},
+        )
+
+    if role_changed:
+        await publish_event(
+            request,
+            EVENTS.USER_ROLE_UPDATED,
+            subject_id=user_id,
+            source='scim',
+            data={'role': updated_user.role},
+        )
 
     return await user_to_scim(updated_user, request, db=db)
 

backend/open_webui/routers/users.py

@@ -36,7 +36,6 @@ from open_webui.models.access_grants import AccessGrants
 from open_webui.models.knowledge import Knowledges
 from open_webui.models.models import Models
 from open_webui.models.tools import Tools
-from open_webui.socket.main import disconnect_user_sessions
 from open_webui.utils.access_control import get_permissions, has_permission
 from open_webui.utils.auth import (
     get_admin_user,
@@ -990,10 +989,19 @@ async def update_user_by_id(
             updated_user = user
 
         if updated_user:
-            # If the role changed, disconnect all socket sessions so stale
-            # privileges cached in SESSION_POOL are invalidated.
-            if updated_user.role != user.role:
-                await disconnect_user_sessions(user_id)
+            updated_fields = [field for field in update_data.keys() if field != 'role']
+            role_changed = updated_user.role != user.role
+
+            if updated_fields:
+                await publish_event(
+                    request,
+                    EVENTS.USER_UPDATED,
+                    actor=session_user,
+                    subject_id=user_id,
+                    data={'updated_fields': updated_fields},
+                )
+
+            if role_changed:
                 await publish_event(
                     request,
                     EVENTS.USER_ROLE_UPDATED,
@@ -1001,14 +1009,7 @@ async def update_user_by_id(
                     subject_id=user_id,
                     data={'role': updated_user.role},
                 )
-            else:
-                await publish_event(
-                    request,
-                    EVENTS.USER_UPDATED,
-                    actor=session_user,
-                    subject_id=user_id,
-                    data={'updated_fields': list(update_data.keys())},
-                )
+
             if form_data.password:
                 await publish_event(
                     request,
@@ -1061,7 +1062,6 @@ async def delete_user_by_id(
         result = await Auths.delete_auth_by_id(user_id, db=db)
 
         if result:
-            await disconnect_user_sessions(user_id)
             await publish_event(
                 request,
                 EVENTS.USER_DELETED,