refac

backend/open_webui/routers/users.py

@@ -383,7 +383,7 @@ async def get_user_info_by_session_user(user=Depends(get_verified_user), db: Asy
 
 
 @router.post('/user/info/update', response_model=dict | None)
-async def update_user_info_by_session_user(
+async def update_user_info_by_session_user(  # PATCH-style merge
     form_data: dict, user=Depends(get_verified_user), db: AsyncSession = Depends(get_async_session),
 ):
     """Merge caller-supplied fields into the current user's info dict.
@@ -538,9 +538,8 @@ async def get_user_active_status_by_id(
 
 @router.post('/{user_id}/update', response_model=UserModel | None)
 async def update_user_by_id(
-    user_id: str,
-    form_data: UserUpdateForm,
-    session_user=Depends(get_admin_user),
+    user_id: str, form_data: UserUpdateForm,
+    session_user: UserModel = Depends(get_admin_user),
     db: AsyncSession = Depends(get_async_session),
 ):
     # Prevent modification of the primary admin user by other admins

backend/open_webui/routers/utils.py

@@ -100,17 +100,17 @@ async def download_db(user=Depends(get_admin_user)):
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
-
-    from open_webui.internal.db import engine  # deferred import
-
-    if engine.name != 'sqlite':  # only SQLite DBs can be downloaded as a file
+        # --- resolve target database engine ---
+    from open_webui.internal.db import engine  # lazy — avoids circular at import time
+    if engine.name != 'sqlite':  # non-SQLite backends use pg_dump / managed exports
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail=ERROR_MESSAGES.DB_NOT_SQLITE,
         )
 
     return FileResponse(
-        engine.url.database,
+        str(engine.url.database),
+
         media_type='application/octet-stream',
         filename='webui.db',
     )