From 40320c113637f80e0466e30cae63ab9ac1ba596e Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Thu, 23 Jul 2026 22:44:04 -0400
Subject: [PATCH] refac

---
 backend/open_webui/config.py | 60 +++++++++++++++++-------------------
 1 file changed, 29 insertions(+), 31 deletions(-)

diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py
index fceedd0a87..116ac77ade 100644
--- a/backend/open_webui/config.py
+++ b/backend/open_webui/config.py
@@ -2567,6 +2567,24 @@ if _oauth_authorize_params:
         log.warning('OAUTH_AUTHORIZE_PARAMS is not valid JSON, ignoring')
 
 
+def oauth_client_kwargs(scope: str, **kwargs):
+    client_kwargs = {
+        'scope': scope,
+        **kwargs,
+        **({'timeout': int(OAUTH_TIMEOUT)} if OAUTH_TIMEOUT else {}),
+    }
+
+    if OAUTH_CODE_CHALLENGE_METHOD == 'S256':
+        client_kwargs['code_challenge_method'] = 'S256'
+    elif OAUTH_CODE_CHALLENGE_METHOD:
+        raise Exception(
+            'Code challenge methods other than "%s" not supported. Given: "%s"'
+            % ('S256', OAUTH_CODE_CHALLENGE_METHOD)
+        )
+
+    return client_kwargs
+
+
 def load_oauth_providers():
     OAUTH_PROVIDERS.clear()
     if GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET:
@@ -2577,10 +2595,7 @@ def load_oauth_providers():
                 client_id=GOOGLE_CLIENT_ID,
                 client_secret=GOOGLE_CLIENT_SECRET,
                 server_metadata_url='https://accounts.google.com/.well-known/openid-configuration',
-                client_kwargs={
-                    'scope': GOOGLE_OAUTH_SCOPE,
-                    **({'timeout': int(OAUTH_TIMEOUT)} if OAUTH_TIMEOUT else {}),
-                },
+                client_kwargs=oauth_client_kwargs(GOOGLE_OAUTH_SCOPE),
                 redirect_uri=GOOGLE_REDIRECT_URI,
                 **({'authorize_params': GOOGLE_OAUTH_AUTHORIZE_PARAMS} if GOOGLE_OAUTH_AUTHORIZE_PARAMS else {}),
             )
@@ -2598,10 +2613,7 @@ def load_oauth_providers():
                 client_id=MICROSOFT_CLIENT_ID,
                 client_secret=MICROSOFT_CLIENT_SECRET,
                 server_metadata_url=f'{MICROSOFT_CLIENT_LOGIN_BASE_URL}/{MICROSOFT_CLIENT_TENANT_ID}/v2.0/.well-known/openid-configuration?appid={MICROSOFT_CLIENT_ID}',
-                client_kwargs={
-                    'scope': MICROSOFT_OAUTH_SCOPE,
-                    **({'timeout': int(OAUTH_TIMEOUT)} if OAUTH_TIMEOUT else {}),
-                },
+                client_kwargs=oauth_client_kwargs(MICROSOFT_OAUTH_SCOPE),
                 redirect_uri=MICROSOFT_REDIRECT_URI,
             )
             return client
@@ -2622,10 +2634,7 @@ def load_oauth_providers():
                 authorize_url='https://github.com/login/oauth/authorize',
                 api_base_url='https://api.github.com',
                 userinfo_endpoint='https://api.github.com/user',
-                client_kwargs={
-                    'scope': GITHUB_CLIENT_SCOPE,
-                    **({'timeout': int(OAUTH_TIMEOUT)} if OAUTH_TIMEOUT else {}),
-                },
+                client_kwargs=oauth_client_kwargs(GITHUB_CLIENT_SCOPE),
                 redirect_uri=GITHUB_CLIENT_REDIRECT_URI,
             )
             return client
@@ -2638,30 +2647,19 @@ def load_oauth_providers():
     if OAUTH_CLIENT_ID and (OAUTH_CLIENT_SECRET or OAUTH_CODE_CHALLENGE_METHOD) and OPENID_PROVIDER_URL:
 
         def oidc_oauth_register(oauth: OAuth):
-            client_kwargs = {
-                'scope': OAUTH_SCOPES,
-                **(
-                    {'token_endpoint_auth_method': OAUTH_TOKEN_ENDPOINT_AUTH_METHOD}
-                    if OAUTH_TOKEN_ENDPOINT_AUTH_METHOD
-                    else {}
-                ),
-                **({'timeout': int(OAUTH_TIMEOUT)} if OAUTH_TIMEOUT else {}),
-            }
-
-            if OAUTH_CODE_CHALLENGE_METHOD and OAUTH_CODE_CHALLENGE_METHOD == 'S256':
-                client_kwargs['code_challenge_method'] = 'S256'
-            elif OAUTH_CODE_CHALLENGE_METHOD:
-                raise Exception(
-                    'Code challenge methods other than "%s" not supported. Given: "%s"'
-                    % ('S256', OAUTH_CODE_CHALLENGE_METHOD)
-                )
-
             client = oauth.register(
                 name='oidc',
                 client_id=OAUTH_CLIENT_ID,
                 client_secret=OAUTH_CLIENT_SECRET,
                 server_metadata_url=OPENID_PROVIDER_URL,
-                client_kwargs=client_kwargs,
+                client_kwargs=oauth_client_kwargs(
+                    OAUTH_SCOPES,
+                    **(
+                        {'token_endpoint_auth_method': OAUTH_TOKEN_ENDPOINT_AUTH_METHOD}
+                        if OAUTH_TOKEN_ENDPOINT_AUTH_METHOD
+                        else {}
+                    ),
+                ),
                 redirect_uri=OPENID_REDIRECT_URI,
             )
             return client