refac

backend/open_webui/main.py

@@ -557,6 +557,7 @@ from open_webui.utils.oauth import (
     get_oauth_client_info_with_static_credentials,
     encrypt_data,
     decrypt_data,
+    resolve_oauth_client_info,
     OAuthManager,
     OAuthClientManager,
     OAuthClientInformationFull,
@@ -2304,10 +2305,8 @@ if len(app.state.config.TOOL_SERVER_CONNECTIONS) > 0:
             auth_type = tool_server_connection.get('auth_type', 'none')
 
             if server_id and auth_type in ('oauth_2.1', 'oauth_2.1_static'):
-                oauth_client_info = tool_server_connection.get('info', {}).get('oauth_client_info', '')
-
                 try:
-                    oauth_client_info = decrypt_data(oauth_client_info)
+                    oauth_client_info = resolve_oauth_client_info(tool_server_connection)
                     app.state.oauth_client_manager.add_client(
                         f'mcp:{server_id}',
                         OAuthClientInformationFull(**oauth_client_info),
@@ -2368,18 +2367,25 @@ async def register_client(request, client_id: str) -> bool:
 
     try:
         if auth_type == 'oauth_2.1_static':
-            # Static credentials: rebuild from stored credentials + fresh metadata
-            existing_client_info = connection.get('info', {}).get('oauth_client_info', '')
-            if not existing_client_info:
-                log.error(f'No stored OAuth client info for static client {client_id}')
-                return False
-            existing_data = decrypt_data(existing_client_info)
+            # Static credentials: rebuild from admin-provided credentials + fresh metadata
+            info = connection.get('info', {})
+            oauth_client_id = info.get('oauth_client_id') or ''
+            oauth_client_secret = info.get('oauth_client_secret') or ''
+            if not oauth_client_id or not oauth_client_secret:
+                # Fall back to blob for backward compatibility
+                existing_client_info = info.get('oauth_client_info', '')
+                if not existing_client_info:
+                    log.error(f'No stored OAuth client info for static client {client_id}')
+                    return False
+                existing_data = decrypt_data(existing_client_info)
+                oauth_client_id = oauth_client_id or existing_data.get('client_id', '')
+                oauth_client_secret = oauth_client_secret or existing_data.get('client_secret', '')
             oauth_client_info = await get_oauth_client_info_with_static_credentials(
                 request,
                 client_id,
                 server_url,
-                oauth_client_id=existing_data.get('client_id', ''),
-                oauth_client_secret=existing_data.get('client_secret', ''),
+                oauth_client_id=oauth_client_id,
+                oauth_client_secret=oauth_client_secret,
             )
         else:
             oauth_client_info = await get_oauth_client_info_with_dynamic_client_registration(

backend/open_webui/routers/configs.py

@@ -27,6 +27,7 @@ from open_webui.utils.oauth import (
     get_oauth_client_info_with_static_credentials,
     encrypt_data,
     decrypt_data,
+    resolve_oauth_client_info,
     OAuthClientInformationFull,
 )
 from mcp.shared.auth import OAuthMetadata
@@ -203,9 +204,7 @@ async def set_tool_servers_config(
 
             if auth_type in ('oauth_2.1', 'oauth_2.1_static') and server_id:
                 try:
-                    oauth_client_info = connection.get('info', {}).get('oauth_client_info', '')
-                    oauth_client_info = decrypt_data(oauth_client_info)
-
+                    oauth_client_info = resolve_oauth_client_info(connection)
                     request.app.state.oauth_client_manager.add_client(
                         f'{server_type}:{server_id}',
                         OAuthClientInformationFull(**oauth_client_info),

backend/open_webui/utils/oauth.py

@@ -548,6 +548,25 @@ async def get_oauth_client_info_with_static_credentials(
         raise e
 
 
+
+def resolve_oauth_client_info(connection: dict) -> dict:
+    """
+    Decrypt OAuth client info from a tool server connection config.
+
+    For oauth_2.1_static, overlays admin-provided credentials from
+    info.oauth_client_id and info.oauth_client_secret onto the blob.
+    """
+    info = connection.get('info', {})
+    data = decrypt_data(info.get('oauth_client_info', ''))
+
+    if connection.get('auth_type') == 'oauth_2.1_static':
+        if info.get('oauth_client_id') and info.get('oauth_client_secret'):
+            data['client_id'] = info['oauth_client_id']
+            data['client_secret'] = info['oauth_client_secret']
+
+    return data
+
+
 class OAuthClientManager:
     def __init__(self, app):
         self.oauth = OAuth()
@@ -624,7 +643,7 @@ class OAuthClientManager:
                 continue
 
             try:
-                oauth_client_info = decrypt_data(oauth_client_info)
+                oauth_client_info = resolve_oauth_client_info(connection)
                 return self.add_client(expected_client_id, OAuthClientInformationFull(**oauth_client_info))['client']
             except Exception as e:
                 log.error(f'Failed to lazily add OAuth client {expected_client_id} from config: {e}')