enh: WEBUI_AUTH_TRUSTED_ROLE_HEADER

Author: tjbck

backend/open_webui/env.py

@@ -473,6 +473,7 @@ def parse_section(section):
 WEBUI_AUTH_TRUSTED_EMAIL_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_EMAIL_HEADER', None)
 WEBUI_AUTH_TRUSTED_NAME_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_NAME_HEADER', None)
 WEBUI_AUTH_TRUSTED_GROUPS_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_GROUPS_HEADER', None)
+WEBUI_AUTH_TRUSTED_ROLE_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_ROLE_HEADER', None)
 
 
 ENABLE_PASSWORD_VALIDATION = os.environ.get('ENABLE_PASSWORD_VALIDATION', 'False').lower() == 'true'

backend/open_webui/routers/auths.py

@@ -35,6 +35,7 @@
     WEBUI_AUTH_TRUSTED_EMAIL_HEADER,
     WEBUI_AUTH_TRUSTED_NAME_HEADER,
     WEBUI_AUTH_TRUSTED_GROUPS_HEADER,
+    WEBUI_AUTH_TRUSTED_ROLE_HEADER,
     WEBUI_AUTH_COOKIE_SAME_SITE,
     WEBUI_AUTH_COOKIE_SECURE,
     WEBUI_AUTH_SIGNOUT_REDIRECT_URL,
@@ -572,6 +573,16 @@ async def signin(
             if group_names:
                 Groups.sync_groups_by_group_names(user.id, group_names, db=db)
 
+        if WEBUI_AUTH_TRUSTED_ROLE_HEADER and user:
+            trusted_role = request.headers.get(WEBUI_AUTH_TRUSTED_ROLE_HEADER, '').lower().strip()
+            if trusted_role in {'admin', 'user', 'pending'}:
+                if user.role != trusted_role:
+                    Users.update_user_role_by_id(user.id, trusted_role, db=db)
+            elif trusted_role:
+                log.warning(
+                    f'Ignoring invalid trusted role header value: {trusted_role}'
+                )
+
     elif WEBUI_AUTH == False:
         admin_email = 'admin@localhost'
         admin_password = 'admin'