feat: rebase Flexion customizations onto v0.8.10

Applies all Flexion-specific changes from flex (v0.8.0 base) onto
upstream v0.8.10. Includes Google Cloud Identity OAuth group-based
roles, provider model icons, FlexChat branding, custom functions,
and documentation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lgarceau768

README_FLEXION.md

@@ -0,0 +1,194 @@
+# FlexChat - Flexion's Open WebUI Fork
+
+FlexChat is Flexion's customized deployment of [Open WebUI](https://github.com/open-webui/open-webui), rebranded and configured to integrate with AWS Bedrock via the [Flexion Bedrock Access Gateway](https://github.com/flexion/bedrock-access-gateway).
+
+## Branch Strategy
+
+| Branch | Purpose |
+|--------|---------|
+| `flex` | **Flexion customizations** - Contains all Flexion-specific branding, configurations, and features. This is the primary branch for Flexion development. |
+| `main` | Mirrors the upstream Open WebUI `main` branch. Used for tracking upstream releases. |
+| `dev` | Mirrors the upstream Open WebUI `dev` branch. Used for tracking upstream development. |
+
+### Keeping Up with Upstream
+
+To incorporate upstream Open WebUI updates into our `flex` branch:
+
+```bash
+# Add upstream remote (one-time setup)
+git remote add upstream https://github.com/open-webui/open-webui.git
+```
+
+## Local Development Setup
+
+### Prerequisites
+
+- Docker and Docker Compose
+- AWS credentials configured (for Bedrock Access Gateway)
+- [Flexion Bedrock Access Gateway](https://github.com/flexion/bedrock-access-gateway) running locally (or live connection)
+
+### Architecture Overview
+
+```
+┌─────────────────┐     ┌─────────────────────────┐     ┌─────────────────┐
+│                 │     │                         │     │                 │
+│    FlexChat     │────▶│  Bedrock Access Gateway │────▶│  AWS Bedrock    │
+│   (Port 3000)   │     │      (Port 8000)        │     │                 │
+│                 │     │                         │     │                 │
+└─────────────────┘     └─────────────────────────┘     └─────────────────┘
+```
+
+FlexChat connects to the Bedrock Access Gateway (BAG) which provides an OpenAI-compatible API facade for Amazon Bedrock models.
+
+### Step 1: Start the Bedrock Access Gateway
+
+Before running FlexChat, you need the Bedrock Access Gateway running locally. See the [BAG README_FLEXION.md](https://github.com/flexion/bedrock-access-gateway/blob/main/README_FLEXION.md) for detailed setup instructions.
+
+Quick start for BAG:
+
+```bash
+# Clone the Bedrock Access Gateway repo
+git clone https://github.com/flexion/bedrock-access-gateway.git
+cd bedrock-access-gateway
+
+# Set up virtual environment
+python3 -m venv .venv && source .venv/bin/activate
+pip install -r src/requirements.txt
+
+# Configure AWS and start the gateway
+export AWS_REGION=us-east-1
+export API_KEY=bedrock
+export ALLOWED_MODEL_IDS='["anthropic.*", "us.anthropic.*", "us.meta.*"]'
+
+# Run on port 8000
+uvicorn api.app:app --host 0.0.0.0 --port 8000
+```
+
+### Step 2: Configure FlexChat Environment
+
+Create or update your `.env` file in the FlexChat root directory:
+
+```bash
+# Core Settings
+ENV=dev
+WEBUI_AUTH=FALSE
+ENABLE_LOGIN_FORM=false
+
+# Model Configuration
+BYPASS_MODEL_ACCESS_CONTROL=true
+DEFAULT_MODELS=us.meta.llama3-1-8b-instruct-v1:0
+
+# Bedrock Access Gateway Connection
+# Points to the locally running BAG instance
+OPENAI_API_BASE_URL=http://host.docker.interal:8000/api/v1
+OPENAI_API_KEY=bedrock
+
+# Disable Ollama (we're using Bedrock)
+ENABLE_OLLAMA_API=false
+
+# User Settings
+DEFAULT_USER_ROLE=user
+ENABLE_API_KEYS=true
+USER_PERMISSIONS_FEATURES_API_KEYS=true
+
+
+WEBUI_AUTH=false 
+```
+
+### Step 3: Run FlexChat with Docker Compose
+
+```bash
+# Build and start FlexChat
+docker-compose up --build
+
+# Or run in detached mode
+docker-compose up -d --build
+```
+
+FlexChat will be available at `http://localhost:3000`.
+
+### Docker Compose Configuration
+
+The `docker-compose.yaml` is configured to:
+
+- Build FlexChat from the local Dockerfile
+- Mount a persistent volume for data storage
+- Load environment variables from `.env`
+- Expose local port services like the BAG
+- Add `host.docker.internal` for accessing host services (like the BAG)
+
+```yaml
+services:
+  open-webui:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: open-webui
+    volumes:
+      - open-webui:/app/backend/data
+    network_mode: 'host'
+    env_file:
+      - .env
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    restart: unless-stopped
+```
+
+**Note:** The Ollama service is included in the compose file but is not required when using Bedrock. You can remove or comment out the Ollama service and its dependency if desired.
+
+## Connecting to Bedrock Access Gateway
+
+The `OPENAI_API_BASE_URL` environment variable is set to `http://host.docker.internal:8000/api/v1` to connect FlexChat to the locally running Bedrock Access Gateway.
+
+### Important Notes
+
+- **API Key:** The `OPENAI_API_KEY=bedrock` matches the default API key used by the BAG in local development mode.
+- **Available Models:** The models available in FlexChat depend on the `ALLOWED_MODEL_IDS` configured in the Bedrock Access Gateway.
+
+### Updating OPENAI_API_BASE_URL for Docker
+
+If FlexChat is running in Docker and BAG is running on your host:
+
+```bash
+# In .env, use host.docker.internal for Docker-to-host communication
+OPENAI_API_BASE_URL=http://host.docker.internal:8000/api/v1
+```
+
+## Flexion Customizations
+
+The `flex` branch includes the following Flexion-specific changes:
+
+### Branding
+- Application name changed from "Open WebUI" to "FlexChat"
+- Custom Flexion logo used for favicons and splash screens
+- Updated site manifest and HTML title
+
+### Configuration Defaults
+- Default integration with Bedrock Access Gateway
+- Ollama disabled by default
+- Google OAuth pre-configured (credentials required)
+
+## Troubleshooting
+
+### FlexChat can't connect to models
+
+1. Verify the Bedrock Access Gateway is running on port 8000
+2. Check that `OPENAI_API_BASE_URL` is correctly set
+3. If using Docker, try using `0.0.0.0` and setting `network_mode: 'host'`
+
+### No models appearing in the UI
+
+1. Check BAG logs for any authentication errors
+2. Verify your AWS credentials have Bedrock invoke permissions
+3. Confirm `ALLOWED_MODEL_IDS` in BAG includes the models you expect
+
+### Docker build fails
+
+1. Ensure Docker has sufficient resources allocated
+2. Try clearing Docker cache: `docker-compose build --no-cache`
+
+## Related Documentation
+
+- [Open WebUI Documentation](https://docs.openwebui.com/)
+- [Flexion Bedrock Access Gateway](https://github.com/flexion/bedrock-access-gateway/blob/main/README_FLEXION.md)
+- [Amazon Bedrock Documentation](https://docs.aws.amazon.com/bedrock/)

backend/open_webui/routers/models.py

@@ -1,5 +1,6 @@
 from typing import Optional
 import io
+import os
 import base64
 import json
 import asyncio
@@ -42,6 +43,73 @@
 
 router = APIRouter()
 
+# Provider icon configuration is loaded from providers.json for easier maintenance
+# See static/static/providers/providers.json for the configuration
+_PROVIDER_CONFIG = None
+_PROVIDER_CONFIG_PATH = f"{STATIC_DIR}/providers/providers.json"
+
+
+def _load_provider_config() -> dict:
+    """Load provider icon configuration from JSON file."""
+    global _PROVIDER_CONFIG
+    if _PROVIDER_CONFIG is None:
+        try:
+            with open(_PROVIDER_CONFIG_PATH, "r") as f:
+                _PROVIDER_CONFIG = json.load(f)
+        except Exception as e:
+            log.warning(f"Failed to load provider config: {e}")
+            _PROVIDER_CONFIG = {
+                "providers": {},
+                "region_prefixes": [],
+                "model_prefix_aliases": {},
+            }
+    return _PROVIDER_CONFIG
+
+
+def get_provider_from_model_id(model_id: str) -> Optional[str]:
+    """
+    Extract the provider name from a model ID.
+
+    Examples:
+        'anthropic.claude-3-sonnet' → 'anthropic'
+        'us.anthropic.claude-3-sonnet' → 'anthropic'
+        'gpt-4o' → 'openai' (via alias)
+    """
+    config = _load_provider_config()
+    model_id_lower = model_id.lower()
+
+    # Check for special aliases first (e.g., 'gpt-' → 'openai')
+    for alias, provider in config.get("model_prefix_aliases", {}).items():
+        if model_id_lower.startswith(alias.lower()):
+            return provider
+
+    # Strip known region prefixes (us., eu., global., apac.)
+    for prefix in config.get("region_prefixes", []):
+        if model_id_lower.startswith(prefix.lower()):
+            model_id_lower = model_id_lower[len(prefix):]
+            break
+
+    # Extract provider from first segment (before the first dot)
+    if "." in model_id_lower:
+        return model_id_lower.split(".")[0]
+
+    return None
+
+
+def get_provider_icon_path(model_id: str) -> Optional[str]:
+    """
+    Returns the path to a provider-specific icon based on model ID.
+    Returns None if no matching provider icon is found.
+    """
+    config = _load_provider_config()
+    provider = get_provider_from_model_id(model_id)
+
+    if provider and provider in config.get("providers", {}):
+        icon_filename = config["providers"][provider]
+        return f"{STATIC_DIR}/providers/{icon_filename}"
+
+    return None
+
 
 def is_valid_model_id(model_id: str) -> bool:
     return model_id and len(model_id) <= 256
@@ -393,32 +461,43 @@ def get_model_profile_image(id: str, user=Depends(get_verified_user)):
         etag = f'"{model.updated_at}"' if model.updated_at else None
 
         if model.meta.profile_image_url:
-            if model.meta.profile_image_url.startswith("http"):
-                return Response(
-                    status_code=status.HTTP_302_FOUND,
-                    headers={"Location": model.meta.profile_image_url},
-                )
-            elif model.meta.profile_image_url.startswith("data:image"):
-                try:
-                    header, base64_data = model.meta.profile_image_url.split(",", 1)
-                    image_data = base64.b64decode(base64_data)
-                    image_buffer = io.BytesIO(image_data)
-                    media_type = header.split(";")[0].lstrip("data:")
-
-                    headers = {"Content-Disposition": "inline"}
-                    if etag:
-                        headers["ETag"] = etag
-
-                    return StreamingResponse(
-                        image_buffer,
-                        media_type=media_type,
-                        headers=headers,
+            # Check if it's NOT the default favicon (custom image was set)
+            if not model.meta.profile_image_url.endswith("/favicon.png"):
+                if model.meta.profile_image_url.startswith("http"):
+                    return Response(
+                        status_code=status.HTTP_302_FOUND,
+                        headers={"Location": model.meta.profile_image_url},
                     )
-                except Exception as e:
-                    pass
+                elif model.meta.profile_image_url.startswith("data:image"):
+                    try:
+                        header, base64_data = model.meta.profile_image_url.split(",", 1)
+                        image_data = base64.b64decode(base64_data)
+                        image_buffer = io.BytesIO(image_data)
+                        media_type = header.split(";")[0].lstrip("data:")
+
+                        headers = {"Content-Disposition": "inline"}
+                        if etag:
+                            headers["ETag"] = etag
+
+                        return StreamingResponse(
+                            image_buffer,
+                            media_type=media_type,
+                            headers=headers,
+                        )
+                    except Exception as e:
+                        pass
+
+        # Try to find a provider-specific icon based on model ID
+        provider_icon_path = get_provider_icon_path(id)
+        if provider_icon_path and os.path.exists(provider_icon_path):
+            return FileResponse(provider_icon_path, media_type="image/png")
 
         return FileResponse(f"{STATIC_DIR}/favicon.png")
     else:
+        # Model not found in database - check provider icon based on ID
+        provider_icon_path = get_provider_icon_path(id)
+        if provider_icon_path and os.path.exists(provider_icon_path):
+            return FileResponse(provider_icon_path, media_type="image/png")
         return FileResponse(f"{STATIC_DIR}/favicon.png")