From aaaf26fb8ede28854dd660b11b85ba6bafe64007 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Tue, 8 Sep 2026 12:38:07 -0400 Subject: [PATCH] refac --- backend/open_webui/utils/oauth.py | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index 81cdec4267..c88c4c2dab 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -202,7 +202,7 @@ NON_EXPIRING_TOKEN_EXPIRES_AT = 253402300799 # 9999-12-31 23:59:59 UTC def _normalize_token_expiry(token: dict) -> dict: - """Ensure a token dict always has a numeric ``expires_at``. + """Ensure a token dict always has a numeric access-token ``expires_at``. Resolution order: 1. If *expires_at* is already present and non-None, trust it. @@ -233,16 +233,6 @@ def _normalize_token_expiry(token: dict) -> dict: ) expires_at = NON_EXPIRING_TOKEN_EXPIRES_AT - id_token = token.get('id_token') - if id_token: - # Cap at the id_token expiry so pipes and tools never receive an expired JWT - try: - exp = jwt.decode(id_token, options={'verify_signature': False}).get('exp') - if exp is not None: - expires_at = min(expires_at, int(exp)) - except Exception as e: - log.debug('Could not read exp from id_token: %s', e) - token['expires_at'] = expires_at return token @@ -1372,10 +1362,21 @@ class OAuthManager: ) return None + # SSO integrations may consume the ID token as well as the access token. + expires_at = session.expires_at + id_token = session.token.get('id_token') + if id_token and expires_at is not None: + try: + exp = jwt.decode(id_token, options={'verify_signature': False}).get('exp') + if exp is not None: + expires_at = min(expires_at, int(exp)) + except Exception as e: + log.debug('Could not read exp from id_token: %s', e) + if ( force_refresh - or session.expires_at is None - or datetime.now() + timedelta(minutes=5) >= datetime.fromtimestamp(session.expires_at) + or expires_at is None + or datetime.now() + timedelta(minutes=5) >= datetime.fromtimestamp(expires_at) ): log.debug('Token refresh needed for user %s, provider %s', user_id, session.provider) refreshed_token = await self._refresh_token(session)