Skip to content

OpenWebUI: return an account-bearing DB to login-less instead of a sign-in wall (#70) - #71

Open
cdamken wants to merge 1 commit into
mainfrom
yakko/webui-loginless-reset
Open

OpenWebUI: return an account-bearing DB to login-less instead of a sign-in wall (#70)#71
cdamken wants to merge 1 commit into
mainfrom
yakko/webui-loginless-reset

Conversation

@cdamken

@cdamken cdamken commented Sep 4, 2026

Copy link
Copy Markdown
Owner

Yakko: closes the root cause behind #70, where a returning user gets stuck on OpenWebUI's "Account Activation Pending / Contact Admin" wall.

Why

chati runs OpenWebUI login-less by default, but that only applies to a FRESH DB. Once a DB has accounts, OpenWebUI keeps auth on forever and refuses to turn it back off, so a new signup lands in pending. A real Mac instance hit exactly this: the old account stopped working, a new one was created, and it went straight to the pending wall with admin@localhost as the only admin.

What

ai_local/ailocal gains a login-less recovery path:

  • webui_db_user_count / webui_db_has_accounts detect an account-bearing DB (via python3 stdlib sqlite3, read-only, no system sqlite3 binary needed).
  • reset_webui_loginless moves the DB (webui.db + -wal/-shm) to a timestamped login-reset-backup-* folder so the next start comes up login-less. Never deletes.
  • Wired in two places:
    • automatically inside upgrade webui, right after the existing snapshot, so an update clears the stale sign-in state (this is the "next update fixes it" behavior);
    • on demand via a new verb ailocal reset webui.
  • Gated: skipped when WEBUI_AUTH is set on, so intentional multi-user setups are never touched.
  • SearXNG web-search wiring is unchanged and applies to the fresh login-less DB as before.

Safety

Non-destructive by construction: the DB is moved, not removed, and upgrade already snapshots via create_backup (so ailocal restore also brings the old state back). This honors the 12.06.2026 data-loss incident.

Tests

tests/run_tests.sh: new test_webui_loginless_reset builds fixture DBs (with accounts / empty user table / missing file) and checks detection through an internal __webui-accounts hook, plus that reset webui is documented and rejects a bad target. Full suite: 128 passed, 0 failed.

Versions bumped: repo 1.31.0 → 1.32.0, ailocal 3.2.0 → 3.3.0. README badge + CHANGELOG updated.

Generic (not macOS-specific), so it belongs in the base and both forks inherit it via git merge upstream/main.

…wall (v1.32.0) (#70)

A pre-existing OpenWebUI DB kept auth on forever, so any new signup landed in
'pending' behind a sign-in wall, defeating chati's login-less default (which
only applied to a fresh DB). ailocal now detects an account-bearing DB and
returns it to login-less, automatically during 'upgrade webui' and on demand
via a new 'ailocal reset webui'. Skipped when WEBUI_AUTH is set (real multi-user
setups untouched) and non-destructive: the old DB moves to a timestamped
login-reset-backup-* folder and 'ailocal restore' still applies. SearXNG
web-search wiring unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant