diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py index 63aebf1b60..73e7858825 100644 --- a/backend/open_webui/routers/auths.py +++ b/backend/open_webui/routers/auths.py @@ -961,6 +961,9 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen if token is None: token = request.cookies.get('token') + oauth_session_id = request.cookies.get('oauth_session_id') + session = await OAuthSessions.get_session_by_id(oauth_session_id, db=db) if oauth_session_id else None + if token: actor = None data = decode_token(token) @@ -973,6 +976,7 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen actor=actor, subject_id=actor.id if actor else None, subject_type='user' if actor else None, + **({'source': 'oauth', 'data': {'auth_method': 'oauth', 'provider': session.provider}} if session else {}), ) response.delete_cookie('token') @@ -984,12 +988,9 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen response.delete_cookie('oui-session') response.delete_cookie('oauth_id_token') - oauth_session_id = request.cookies.get('oauth_session_id') if oauth_session_id: response.delete_cookie('oauth_session_id') - session = await OAuthSessions.get_session_by_id(oauth_session_id, db=db) - # If a custom end_session_endpoint is configured (e.g. AWS Cognito), redirect # there directly instead of attempting OIDC discovery. openid_end_session_endpoint = await Config.get('oauth.end_session_endpoint') diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index fee218d086..28e7beb0ce 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -2162,6 +2162,16 @@ class OAuthManager: **({'max_age': cookie_max_age} if cookie_max_age is not None else {}), ) + await publish_event( + request, + EVENTS.AUTH_LOGIN, + actor=user, + subject_id=user.id, + subject_type='user', + source='oauth', + data={'auth_method': 'oauth', 'provider': provider}, + ) + # Legacy cookies for compatibility with older frontend versions if ENABLE_OAUTH_ID_TOKEN_COOKIE: response.set_cookie(