From 9b30e8f6894c8c8bad0a9ce4693eab810962adc9 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 11 Feb 2026 17:53:01 -0600
Subject: [PATCH] refac

---
 backend/open_webui/routers/auths.py | 110 ++++++++++++++++++----------
 1 file changed, 70 insertions(+), 40 deletions(-)

diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py
index 387a0181f..0bafc7d9e 100644
--- a/backend/open_webui/routers/auths.py
+++ b/backend/open_webui/routers/auths.py
@@ -19,6 +19,7 @@ from open_webui.models.auths import (
     UpdatePasswordForm,
 )
 from open_webui.models.users import (
+    UserModel,
     UserProfileImageResponse,
     Users,
     UpdateProfileForm,
@@ -603,10 +604,11 @@ async def signin(
                 pass
 
         if not Users.get_user_by_email(email.lower(), db=db):
-            await signup(
+            await signup_handler(
                 request,
-                response,
-                SignupForm(email=email, password=str(uuid.uuid4()), name=name),
+                email,
+                str(uuid.uuid4()),
+                name,
                 db=db,
             )
 
@@ -634,10 +636,11 @@ async def signin(
             if Users.has_users(db=db):
                 raise HTTPException(400, detail=ERROR_MESSAGES.EXISTING_USERS)
 
-            await signup(
+            await signup_handler(
                 request,
-                response,
-                SignupForm(email=admin_email, password=admin_password, name="User"),
+                admin_email,
+                admin_password,
+                "User",
                 db=db,
             )
 
@@ -679,6 +682,62 @@ async def signin(
 ############################
 
 
+async def signup_handler(
+    request: Request,
+    email: str,
+    password: str,
+    name: str,
+    profile_image_url: str = "/user.png",
+    *,
+    db: Session,
+) -> UserModel:
+    """
+    Core user-creation logic shared by the signup endpoint and
+    trusted-header / no-auth auto-registration flows.
+
+    Returns the newly created UserModel.
+    Raises HTTPException on failure.
+    """
+    has_users = Users.has_users(db=db)
+    role = "admin" if not has_users else request.app.state.config.DEFAULT_USER_ROLE
+    hashed = get_password_hash(password)
+
+    user = Auths.insert_new_auth(
+        email=email.lower(),
+        password=hashed,
+        name=name,
+        profile_image_url=profile_image_url,
+        role=role,
+        db=db,
+    )
+    if not user:
+        raise HTTPException(500, detail=ERROR_MESSAGES.CREATE_USER_ERROR)
+
+    if request.app.state.config.WEBHOOK_URL:
+        await post_webhook(
+            request.app.state.WEBUI_NAME,
+            request.app.state.config.WEBHOOK_URL,
+            WEBHOOK_MESSAGES.USER_SIGNUP(user.name),
+            {
+                "action": "signup",
+                "message": WEBHOOK_MESSAGES.USER_SIGNUP(user.name),
+                "user": user.model_dump_json(exclude_none=True),
+            },
+        )
+
+    if not has_users:
+        # Disable signup after the first user is created
+        request.app.state.config.ENABLE_SIGNUP = False
+
+    apply_default_group_assignment(
+        request.app.state.config.DEFAULT_GROUP_ID,
+        user.id,
+        db=db,
+    )
+
+    return user
+
+
 @router.post("/signup", response_model=SessionUserResponse)
 async def signup(
     request: Request,
@@ -717,44 +776,15 @@ async def signup(
         except Exception as e:
             raise HTTPException(400, detail=str(e))
 
-        hashed = get_password_hash(form_data.password)
-
-        role = "admin" if not has_users else request.app.state.config.DEFAULT_USER_ROLE
-        user = Auths.insert_new_auth(
-            form_data.email.lower(),
-            hashed,
+        user = await signup_handler(
+            request,
+            form_data.email,
+            form_data.password,
             form_data.name,
             form_data.profile_image_url,
-            role,
             db=db,
         )
-
-        if user:
-            if request.app.state.config.WEBHOOK_URL:
-                await post_webhook(
-                    request.app.state.WEBUI_NAME,
-                    request.app.state.config.WEBHOOK_URL,
-                    WEBHOOK_MESSAGES.USER_SIGNUP(user.name),
-                    {
-                        "action": "signup",
-                        "message": WEBHOOK_MESSAGES.USER_SIGNUP(user.name),
-                        "user": user.model_dump_json(exclude_none=True),
-                    },
-                )
-
-            if not has_users:
-                # Disable signup after the first user is created
-                request.app.state.config.ENABLE_SIGNUP = False
-
-            apply_default_group_assignment(
-                request.app.state.config.DEFAULT_GROUP_ID,
-                user.id,
-                db=db,
-            )
-
-            return create_session_response(request, user, db, response, set_cookie=True)
-        else:
-            raise HTTPException(500, detail=ERROR_MESSAGES.CREATE_USER_ERROR)
+        return create_session_response(request, user, db, response, set_cookie=True)
     except HTTPException:
         raise
     except Exception as err: