refac

backend/open_webui/utils/auth.py

@@ -42,6 +42,7 @@ from open_webui.utils.access_control import has_permission
 from open_webui.utils.json_codec import JSONCodec
 from open_webui.utils.misc import parse_duration
 from pytz import UTC
+from redis.exceptions import RedisError
 
 log = logging.getLogger(__name__)
 
@@ -254,8 +255,13 @@ async def is_valid_token(decoded, redis=None) -> bool:
     1. Per-token (jti) — used by user-initiated sign-out (known jti).
     2. Per-user (revoked_at) — used by password changes and OIDC back-channel
        logout when individual jti values are unknown; rejects tokens with iat <= revoked_at.
+
+    Fail open on Redis errors to preserve availability; revoked tokens may be accepted.
     """
-    if redis:
+    if not redis:
+        return True
+
+    try:
         # Per-token revocation
         jti = decoded.get('jti')
         if jti:
@@ -276,6 +282,8 @@ async def is_valid_token(decoded, redis=None) -> bool:
                         return False
                 except (ValueError, TypeError):
                     pass
+    except RedisError as e:
+        log.warning('Revocation check failed; accepting token: %s', e)
 
     return True