scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-11 22:52:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

refac

Browse source
This commit is contained in:
Timothy Jaeryang Baek 2026-09-08 12:38:07 -04:00
parent 9a4b643130
commit aaaf26fb8e
1 changed files with 14 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
backend/open_webui/utils/oauth.py
View file

@ -202,7 +202,7 @@ NON_EXPIRING_TOKEN_EXPIRES_AT = 253402300799 # 9999-12-31 23:59:59 UTC
def _normalize_token_expiry(token: dict) -> dict:
"""Ensure a token dict always has a numeric ``expires_at``.
"""Ensure a token dict always has a numeric access-token ``expires_at``.
Resolution order:
1. If *expires_at* is already present and non-None, trust it.
@ -233,16 +233,6 @@ def _normalize_token_expiry(token: dict) -> dict:
)
expires_at = NON_EXPIRING_TOKEN_EXPIRES_AT
id_token = token.get('id_token')
if id_token:
# Cap at the id_token expiry so pipes and tools never receive an expired JWT
try:
exp = jwt.decode(id_token, options={'verify_signature': False}).get('exp')
if exp is not None:
expires_at = min(expires_at, int(exp))
except Exception as e:
log.debug('Could not read exp from id_token: %s', e)
token['expires_at'] = expires_at
return token
@ -1372,10 +1362,21 @@ class OAuthManager:
)
return None
# SSO integrations may consume the ID token as well as the access token.
expires_at = session.expires_at
id_token = session.token.get('id_token')
if id_token and expires_at is not None:
try:
exp = jwt.decode(id_token, options={'verify_signature': False}).get('exp')
if exp is not None:
expires_at = min(expires_at, int(exp))
except Exception as e:
log.debug('Could not read exp from id_token: %s', e)
if (
force_refresh
or session.expires_at is None
or datetime.now() + timedelta(minutes=5) >= datetime.fromtimestamp(session.expires_at)
or expires_at is None
or datetime.now() + timedelta(minutes=5) >= datetime.fromtimestamp(expires_at)
):
log.debug('Token refresh needed for user %s, provider %s', user_id, session.provider)
refreshed_token = await self._refresh_token(session)