OpenWebUI/open-webui-custom
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refac: decouple api key restrictions from get user

Browse Source
This commit is contained in:
Timothy Jaeryang Baek
2025-11-13 19:52:04 -05:00
parent e2ff2ae252
commit b160eef7eb
2 changed files with 41 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
backend/open_webui/utils/auth.py
View File

@@ -233,24 +233,6 @@ def get_current_user(
status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.API_KEY_NOT_ALLOWED
)
if request.app.state.config.ENABLE_API_KEY_ENDPOINT_RESTRICTIONS:
allowed_paths = [
path.strip()
for path in str(
request.app.state.config.API_KEY_ALLOWED_ENDPOINTS
).split(",")
]
# Check if the request path matches any allowed endpoint.
if not any(
request.url.path == allowed
or request.url.path.startswith(allowed + "/")
for allowed in allowed_paths
):
raise HTTPException(
status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.API_KEY_NOT_ALLOWED
)
user = get_current_user_by_api_key(token)
# Add user info to current span
@@ -260,7 +242,6 @@ def get_current_user(
current_span.set_attribute("client.user.email", user.email)
current_span.set_attribute("client.user.role", user.role)
current_span.set_attribute("client.auth.type", "api_key")
return user
# auth by jwt token