feat: emit auth.login on SSO logins and attribute SSO logouts (#27619)

* feat: emit the auth.login event on SSO logins

* feat: attribute SSO logouts in the auth.logout event payload

backend/open_webui/routers/auths.py

@@ -961,6 +961,9 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen
     if token is None:
         token = request.cookies.get('token')
 
+    oauth_session_id = request.cookies.get('oauth_session_id')
+    session = await OAuthSessions.get_session_by_id(oauth_session_id, db=db) if oauth_session_id else None
+
     if token:
         actor = None
         data = decode_token(token)
@@ -973,6 +976,7 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen
             actor=actor,
             subject_id=actor.id if actor else None,
             subject_type='user' if actor else None,
+            **({'source': 'oauth', 'data': {'auth_method': 'oauth', 'provider': session.provider}} if session else {}),
         )
 
     response.delete_cookie('token')
@@ -984,12 +988,9 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen
     response.delete_cookie('oui-session')
     response.delete_cookie('oauth_id_token')
 
-    oauth_session_id = request.cookies.get('oauth_session_id')
     if oauth_session_id:
         response.delete_cookie('oauth_session_id')
 
-        session = await OAuthSessions.get_session_by_id(oauth_session_id, db=db)
-
         # If a custom end_session_endpoint is configured (e.g. AWS Cognito), redirect
         # there directly instead of attempting OIDC discovery.
         openid_end_session_endpoint = await Config.get('oauth.end_session_endpoint')

backend/open_webui/utils/oauth.py

@@ -2162,6 +2162,16 @@ class OAuthManager:
             **({'max_age': cookie_max_age} if cookie_max_age is not None else {}),
         )
 
+        await publish_event(
+            request,
+            EVENTS.AUTH_LOGIN,
+            actor=user,
+            subject_id=user.id,
+            subject_type='user',
+            source='oauth',
+            data={'auth_method': 'oauth', 'provider': provider},
+        )
+
         # Legacy cookies for compatibility with older frontend versions
         if ENABLE_OAUTH_ID_TOKEN_COOKIE:
             response.set_cookie(