bhetherman/open-webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refac

Browse Source
This commit is contained in:
Timothy Jaeryang Baek
2026-08-17 00:43:47 -07:00
parent d799e81edb
commit e968445812
2 changed files with 74 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/auths.py
+1 -2
View File
@@ -1705,12 +1705,11 @@ async def token_exchange(
detail='User not found. Please sign in via the web interface first.',
)
user = await oauth_manager.update_user_from_oauth(
user = await oauth_manager.update_user_role_from_oauth(
request=request,
user=user,
user_data=user_data,
provider=provider,
token=token_data,
db=db,
)
if await Config.get('oauth.enable_group_mapping'):
backend/open_webui/utils/oauth.py
+73 -73
View File
@@ -1585,87 +1585,30 @@ class OAuthManager:
return role
async def update_user_from_oauth(
async def update_user_role_from_oauth(
self,
request,
user,
user_data,
provider,
token: dict | None = None,
*,
db=None,
):
auth_config = await get_oauth_runtime_config()
determined_role = await self.get_user_role(user, user_data)
if user.role != determined_role:
updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db)
user = updated_user or user
user.role = determined_role
await publish_event(
request,
EVENTS.USER_ROLE_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'role': determined_role, 'provider': provider},
)
if user.role == determined_role:
return user
updated_fields = []
if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN:
username_claim = auth_config.OAUTH_USERNAME_CLAIM
if username_claim:
new_name = user_data.get(username_claim)
if new_name and new_name != user.name:
updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db)
if updated_user:
user = updated_user
updated_fields.append('name')
log.debug('Updated name for user %s', user.email)
if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN:
email_claim = auth_config.OAUTH_EMAIL_CLAIM
if email_claim:
new_email = user_data.get(email_claim)
if new_email and new_email.lower() != user.email.lower():
existing_user = await Users.get_user_by_email(new_email, db=db)
if existing_user:
log.error(
f'Cannot update email to {new_email} for user {user.id} because it is already taken.'
)
elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db):
user = await Users.get_user_by_id(user.id, db=db) or user
updated_fields.append('email')
log.debug('Updated email for user %s', user.id)
if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN:
picture_claim = auth_config.OAUTH_PICTURE_CLAIM
if picture_claim:
new_picture_url = user_data.get(
picture_claim,
OAUTH_PROVIDERS[provider].get('picture_url', ''),
)
access_token = token.get('access_token') if token else None
processed_picture_url = await self._process_picture_url(new_picture_url, access_token)
if processed_picture_url != user.profile_image_url:
updated_user = await Users.update_user_profile_image_url_by_id(
user.id, processed_picture_url, db=db
)
if updated_user:
user = updated_user
updated_fields.append('profile_image_url')
log.debug('Updated profile picture for user %s', user.email)
if updated_fields:
await publish_event(
request,
EVENTS.USER_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'updated_fields': updated_fields, 'provider': provider},
)
updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db)
user = updated_user or user
user.role = determined_role
await publish_event(
request,
EVENTS.USER_ROLE_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'role': determined_role, 'provider': provider},
)
return user
@@ -2047,14 +1990,71 @@ class OAuthManager:
await Users.update_user_oauth_by_id(user.id, provider, sub, db=db)
if user:
user = await self.update_user_from_oauth(
user = await self.update_user_role_from_oauth(
request=request,
user=user,
user_data=user_data,
provider=provider,
token=token,
db=db,
)
updated_fields = []
if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN:
username_claim = auth_config.OAUTH_USERNAME_CLAIM
if username_claim:
new_name = user_data.get(username_claim)
if new_name and new_name != user.name:
updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db)
if updated_user:
user = updated_user
updated_fields.append('name')
log.debug('Updated name for user %s', user.email)
if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN:
email_claim = auth_config.OAUTH_EMAIL_CLAIM
if email_claim:
new_email = user_data.get(email_claim)
if new_email and new_email.lower() != user.email.lower():
existing_user = await Users.get_user_by_email(new_email, db=db)
if existing_user:
log.error(
f'Cannot update email to {new_email} for user {user.id} because it is already taken.'
)
elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db):
user = await Users.get_user_by_id(user.id, db=db) or user
updated_fields.append('email')
log.debug('Updated email for user %s', user.id)
# Update profile picture if enabled and different from current
if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN:
picture_claim = auth_config.OAUTH_PICTURE_CLAIM
if picture_claim:
new_picture_url = user_data.get(
picture_claim,
OAUTH_PROVIDERS[provider].get('picture_url', ''),
)
processed_picture_url = await self._process_picture_url(
new_picture_url, token.get('access_token')
)
if processed_picture_url != user.profile_image_url:
updated_user = await Users.update_user_profile_image_url_by_id(
user.id, processed_picture_url, db=db
)
if updated_user:
user = updated_user
updated_fields.append('profile_image_url')
log.debug('Updated profile picture for user %s', user.email)
if updated_fields:
await publish_event(
request,
EVENTS.USER_UPDATED,
actor=user,
subject_id=user.id,
source='oauth',
data={'updated_fields': updated_fields, 'provider': provider},
)
else:
# If the user does not exist, check if signups are enabled
if auth_config.ENABLE_OAUTH_SIGNUP: