From e9684458125c3202ebc3378aef32f0b6015171d8 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Mon, 17 Aug 2026 00:43:47 -0700 Subject: [PATCH] refac --- backend/open_webui/routers/auths.py | 3 +- backend/open_webui/utils/oauth.py | 146 ++++++++++++++-------------- 2 files changed, 74 insertions(+), 75 deletions(-) diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py index 4d08ef1022..63aebf1b60 100644 --- a/backend/open_webui/routers/auths.py +++ b/backend/open_webui/routers/auths.py @@ -1705,12 +1705,11 @@ async def token_exchange( detail='User not found. Please sign in via the web interface first.', ) - user = await oauth_manager.update_user_from_oauth( + user = await oauth_manager.update_user_role_from_oauth( request=request, user=user, user_data=user_data, provider=provider, - token=token_data, db=db, ) if await Config.get('oauth.enable_group_mapping'): diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index c37545a141..fee218d086 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -1585,87 +1585,30 @@ class OAuthManager: return role - async def update_user_from_oauth( + async def update_user_role_from_oauth( self, request, user, user_data, provider, - token: dict | None = None, *, db=None, ): - auth_config = await get_oauth_runtime_config() - determined_role = await self.get_user_role(user, user_data) - if user.role != determined_role: - updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db) - user = updated_user or user - user.role = determined_role - await publish_event( - request, - EVENTS.USER_ROLE_UPDATED, - actor=user, - subject_id=user.id, - source='oauth', - data={'role': determined_role, 'provider': provider}, - ) + if user.role == determined_role: + return user - updated_fields = [] - - if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN: - username_claim = auth_config.OAUTH_USERNAME_CLAIM - if username_claim: - new_name = user_data.get(username_claim) - if new_name and new_name != user.name: - updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db) - if updated_user: - user = updated_user - updated_fields.append('name') - log.debug('Updated name for user %s', user.email) - - if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN: - email_claim = auth_config.OAUTH_EMAIL_CLAIM - if email_claim: - new_email = user_data.get(email_claim) - if new_email and new_email.lower() != user.email.lower(): - existing_user = await Users.get_user_by_email(new_email, db=db) - if existing_user: - log.error( - f'Cannot update email to {new_email} for user {user.id} because it is already taken.' - ) - elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db): - user = await Users.get_user_by_id(user.id, db=db) or user - updated_fields.append('email') - log.debug('Updated email for user %s', user.id) - - if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN: - picture_claim = auth_config.OAUTH_PICTURE_CLAIM - if picture_claim: - new_picture_url = user_data.get( - picture_claim, - OAUTH_PROVIDERS[provider].get('picture_url', ''), - ) - access_token = token.get('access_token') if token else None - processed_picture_url = await self._process_picture_url(new_picture_url, access_token) - if processed_picture_url != user.profile_image_url: - updated_user = await Users.update_user_profile_image_url_by_id( - user.id, processed_picture_url, db=db - ) - if updated_user: - user = updated_user - updated_fields.append('profile_image_url') - log.debug('Updated profile picture for user %s', user.email) - - if updated_fields: - await publish_event( - request, - EVENTS.USER_UPDATED, - actor=user, - subject_id=user.id, - source='oauth', - data={'updated_fields': updated_fields, 'provider': provider}, - ) + updated_user = await Users.update_user_role_by_id(user.id, determined_role, db=db) + user = updated_user or user + user.role = determined_role + await publish_event( + request, + EVENTS.USER_ROLE_UPDATED, + actor=user, + subject_id=user.id, + source='oauth', + data={'role': determined_role, 'provider': provider}, + ) return user @@ -2047,14 +1990,71 @@ class OAuthManager: await Users.update_user_oauth_by_id(user.id, provider, sub, db=db) if user: - user = await self.update_user_from_oauth( + user = await self.update_user_role_from_oauth( request=request, user=user, user_data=user_data, provider=provider, - token=token, db=db, ) + + updated_fields = [] + + if auth_config.OAUTH_UPDATE_NAME_ON_LOGIN: + username_claim = auth_config.OAUTH_USERNAME_CLAIM + if username_claim: + new_name = user_data.get(username_claim) + if new_name and new_name != user.name: + updated_user = await Users.update_user_by_id(user.id, {'name': new_name}, db=db) + if updated_user: + user = updated_user + updated_fields.append('name') + log.debug('Updated name for user %s', user.email) + + if auth_config.OAUTH_UPDATE_EMAIL_ON_LOGIN: + email_claim = auth_config.OAUTH_EMAIL_CLAIM + if email_claim: + new_email = user_data.get(email_claim) + if new_email and new_email.lower() != user.email.lower(): + existing_user = await Users.get_user_by_email(new_email, db=db) + if existing_user: + log.error( + f'Cannot update email to {new_email} for user {user.id} because it is already taken.' + ) + elif await Auths.update_email_by_id(user.id, new_email.lower(), db=db): + user = await Users.get_user_by_id(user.id, db=db) or user + updated_fields.append('email') + log.debug('Updated email for user %s', user.id) + + # Update profile picture if enabled and different from current + if auth_config.OAUTH_UPDATE_PICTURE_ON_LOGIN: + picture_claim = auth_config.OAUTH_PICTURE_CLAIM + if picture_claim: + new_picture_url = user_data.get( + picture_claim, + OAUTH_PROVIDERS[provider].get('picture_url', ''), + ) + processed_picture_url = await self._process_picture_url( + new_picture_url, token.get('access_token') + ) + if processed_picture_url != user.profile_image_url: + updated_user = await Users.update_user_profile_image_url_by_id( + user.id, processed_picture_url, db=db + ) + if updated_user: + user = updated_user + updated_fields.append('profile_image_url') + log.debug('Updated profile picture for user %s', user.email) + + if updated_fields: + await publish_event( + request, + EVENTS.USER_UPDATED, + actor=user, + subject_id=user.id, + source='oauth', + data={'updated_fields': updated_fields, 'provider': provider}, + ) else: # If the user does not exist, check if signups are enabled if auth_config.ENABLE_OAUTH_SIGNUP: