Deploy PropNode ZeroGPU gateway (2026-11-01 13:26:08 UTC)

app.py

@@ -3,6 +3,10 @@
 - Keeps the real codebase private in GitHub (`Gini-Eddie/propnode-admin`).
 - Displays a public decoy Gradio interface at `/` to regular Hugging Face visitors.
 - Unlocks the real PropNode Admin portal only via `/gate/<GATEWAY_KEY>` or authorized origins.
+
+ZeroGPU only registers @spaces.GPU functions when the app starts through
+`demo.launch()`. The gateway is therefore attached as ASGI middleware on Gradio's
+own server (via `app_kwargs`), instead of running a separate Uvicorn server.
 """
 import hashlib
 import hmac
@@ -32,9 +36,8 @@ if not hasattr(huggingface_hub, "HfFolder"):
 import gradio as gr
 import spaces
 import torch
-import uvicorn
-from fastapi import FastAPI
-from fastapi.responses import RedirectResponse
+from starlette.middleware import Middleware
+from starlette.responses import RedirectResponse
 
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("propnode.gateway")
@@ -102,7 +105,8 @@ def _load_private_admin_app():
         check=False,
     )
     if result.returncode != 0:
-        logger.error("Failed to clone private repository (code %s): %s", result.returncode, result.stderr)
+        # stderr may contain the token-bearing URL; do not log it verbatim.
+        logger.error("Failed to clone private repository (code %s).", result.returncode)
         return None
 
     sys.path.insert(0, str(RUNTIME_DIR))
@@ -118,36 +122,7 @@ def _load_private_admin_app():
 admin_app = _load_private_admin_app()
 
 # ---------------------------------------------------------------------------
-# 3. Public Decoy + Secret Gate FastAPI App (Mounted at `/` for Gradio 5)
-# ---------------------------------------------------------------------------
-public_app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
-
-
-@public_app.get("/gate/{key}")
-async def unlock_gateway(key: str):
-    """Secret entry URL that sets an HttpOnly pass cookie and opens the admin login."""
-    expected = _expected_key()
-    if not expected or not hmac.compare_digest(key, expected):
-        return RedirectResponse(url="/", status_code=302)
-
-    response = RedirectResponse(url="/login.html", status_code=302)
-    response.set_cookie(
-        GATE_COOKIE,
-        _gate_token(),
-        httponly=True,
-        secure=True,
-        samesite="lax",
-        path="/",
-        max_age=86400 * 30,
-    )
-    return response
-
-
-public_app = gr.mount_gradio_app(public_app, demo, path="/")
-
-
-# ---------------------------------------------------------------------------
-# 4. Zero-Leakage ASGI Gateway Dispatcher
+# 3. Gateway Middleware (runs in front of Gradio's own server)
 # ---------------------------------------------------------------------------
 GRADIO_PREFIXES = (
     "/gradio_api",
@@ -163,74 +138,96 @@ GRADIO_PREFIXES = (
 )
 
 
-class GatewayRouter:
-    def __init__(self, decoy_asgi, private_asgi):
-        self.decoy_asgi = decoy_asgi
-        self.private_asgi = private_asgi
-
-    def _is_authorized(self, scope: dict) -> bool:
-        if self.private_asgi is None or scope.get("type") != "http":
-            return False
-
-        path: str = scope.get("path", "")
-        if path.startswith("/gate/") or path.startswith(GRADIO_PREFIXES):
-            return False
-
-        headers = {
-            k.decode("latin1").lower(): v.decode("latin1")
-            for k, v in scope.get("headers", [])
-        }
-
-        # Never expose the admin app inside the Hugging Face Space iframe
-        if headers.get("sec-fetch-dest") == "iframe":
-            return False
-
-        # 1. Check browser gateway cookie set via /gate/<GATEWAY_KEY>
-        raw_cookie = headers.get("cookie", "")
-        if raw_cookie:
-            cookie = SimpleCookie()
-            try:
-                cookie.load(raw_cookie)
-                if GATE_COOKIE in cookie:
-                    val = cookie[GATE_COOKIE].value
-                    if hmac.compare_digest(val, _gate_token()):
-                        return True
-            except Exception:
-                pass
-
-        # 2. Check explicit X-Gateway-Key header (from a reverse proxy)
-        expected = _expected_key()
-        header_key = headers.get("x-gateway-key", "")
-        if expected and header_key and hmac.compare_digest(header_key, expected):
-            return True
-
-        # 3. Check allowed external domain origin on /api/ calls
-        origin = headers.get("origin", "").rstrip("/")
-        allowed_origins = {
-            o.strip().rstrip("/")
-            for o in os.environ.get("ADMIN_ALLOWED_ORIGINS", "").split(",")
-            if o.strip() and not o.strip().endswith(".hf.space")
-        }
-        if origin and origin in allowed_origins and path.startswith("/api/"):
-            return True
+def _headers(scope: dict) -> dict:
+    return {k.decode("latin1").lower(): v.decode("latin1") for k, v in scope.get("headers", [])}
+
+
+def _is_authorized(scope: dict) -> bool:
+    if admin_app is None or scope.get("type") != "http":
+        return False
+
+    path: str = scope.get("path", "")
+    if path.startswith(GRADIO_PREFIXES):
+        return False
+
+    headers = _headers(scope)
 
+    # Never expose the admin app inside the Hugging Face Space iframe
+    if headers.get("sec-fetch-dest") == "iframe":
         return False
 
+    # 1. Browser gateway cookie set via /gate/<GATEWAY_KEY>
+    raw_cookie = headers.get("cookie", "")
+    if raw_cookie:
+        cookie = SimpleCookie()
+        try:
+            cookie.load(raw_cookie)
+            if GATE_COOKIE in cookie and hmac.compare_digest(cookie[GATE_COOKIE].value, _gate_token()):
+                return True
+        except Exception:
+            pass
+
+    # 2. Explicit X-Gateway-Key header (from a reverse proxy)
+    expected = _expected_key()
+    header_key = headers.get("x-gateway-key", "")
+    if expected and header_key and hmac.compare_digest(header_key, expected):
+        return True
+
+    # 3. API call from an explicitly allowed external domain (e.g. https://admin.propnode.app)
+    origin = headers.get("origin", "").rstrip("/")
+    allowed_origins = {
+        o.strip().rstrip("/")
+        for o in os.environ.get("ADMIN_ALLOWED_ORIGINS", "").split(",")
+        if o.strip() and not o.strip().endswith(".hf.space")
+    }
+    if origin and origin in allowed_origins and path.startswith("/api/"):
+        return True
+
+    return False
+
+
+class GatewayMiddleware:
+    """Pure ASGI middleware: routes authorized traffic to PropNode Admin, the rest to Gradio."""
+
+    def __init__(self, app):
+        self.app = app  # Gradio's ASGI app
+
     async def __call__(self, scope, receive, send):
-        if self._is_authorized(scope):
-            await self.private_asgi(scope, receive, send)
+        if scope.get("type") == "http" and scope.get("path", "").startswith("/gate/"):
+            key = scope["path"][len("/gate/"):].strip("/")
+            expected = _expected_key()
+            if admin_app is None or not expected or not hmac.compare_digest(key, expected):
+                await RedirectResponse(url="/", status_code=302)(scope, receive, send)
+                return
+            response = RedirectResponse(url="/login.html", status_code=302)
+            response.set_cookie(
+                GATE_COOKIE,
+                _gate_token(),
+                httponly=True,
+                secure=True,
+                samesite="lax",
+                path="/",
+                max_age=86400 * 30,
+            )
+            await response(scope, receive, send)
             return
 
-        await self.decoy_asgi(scope, receive, send)
+        if _is_authorized(scope):
+            await admin_app(scope, receive, send)
+            return
 
+        await self.app(scope, receive, send)
 
-app = GatewayRouter(public_app, admin_app)
 
+# ---------------------------------------------------------------------------
+# 4. Launch through Gradio so ZeroGPU detects the @spaces.GPU function
+# ---------------------------------------------------------------------------
 if __name__ == "__main__":
-    # Hugging Face routes public traffic to GRADIO_SERVER_PORT (7860).
-    # Do NOT use $PORT here: on ZeroGPU it points to an internal port (7861) already in use.
-    port = int(os.environ.get("GRADIO_SERVER_PORT", 7860))
-    host = os.environ.get("GRADIO_SERVER_NAME", "0.0.0.0")
-    uvicorn.run(app, host=host, port=port, reload=False)
+    demo.launch(
+        server_name=os.environ.get("GRADIO_SERVER_NAME", "0.0.0.0"),
+        server_port=int(os.environ.get("GRADIO_SERVER_PORT", 7860)),
+        ssr_mode=False,
+        app_kwargs={"middleware": [Middleware(GatewayMiddleware)]},
+    )
 
-# Deployed: 2026-11-01 13:08:42 UTC
+# Deployed: 2026-11-01 13:26:08 UTC