feat: add HF OAuth authentication middleware

- Create auth.ts: resolveUser via whoAmI, extractToken from cookie,
checkWriteAccess against Space repo settings
- Add GET /api/auth/status endpoint returning user info + canEdit flag
- Add onAuthenticate hook to Hocuspocus to protect WebSocket
- Enable hf_oauth in README.md Space config
- Graceful fallback: all users can edit when SPACE_ID is unset

Made-with: Cursor

README.md

@@ -6,6 +6,7 @@ colorTo: blue
 sdk: docker
 app_port: 8080
 pinned: false
+hf_oauth: true
 ---
 
 # Collab Editor

backend/src/auth.ts

@@ -0,0 +1,86 @@
+import { whoAmI, type WhoAmIUser } from "@huggingface/hub";
+
+export interface AuthUser {
+  name: string;
+  fullName: string;
+  avatarUrl: string;
+  canEdit: boolean;
+}
+
+const SPACE_ID = process.env.SPACE_ID || "";
+
+export function isOAuthEnabled(): boolean {
+  return Boolean(SPACE_ID);
+}
+
+/**
+ * Resolve a HF access token into user info + edit permission.
+ * Returns null when the token is missing or invalid.
+ */
+export async function resolveUser(
+  accessToken: string | undefined
+): Promise<AuthUser | null> {
+  if (!accessToken) return null;
+
+  try {
+    const info = (await whoAmI({
+      accessToken,
+      hubUrl: "https://huggingface.co",
+    })) as WhoAmIUser;
+
+    const name = info.name;
+    const fullName = info.fullname || name;
+    const avatarUrl = info.avatarUrl || "";
+
+    const canEdit = await checkWriteAccess(accessToken, name);
+
+    return { name, fullName, avatarUrl, canEdit };
+  } catch (err) {
+    console.warn("[auth] whoAmI failed:", (err as Error).message);
+    return null;
+  }
+}
+
+/**
+ * Check if user has write access to the Space repo.
+ * Falls back to false on any error.
+ */
+async function checkWriteAccess(
+  accessToken: string,
+  _username: string
+): Promise<boolean> {
+  if (!SPACE_ID) return false;
+
+  try {
+    const res = await fetch(
+      `https://huggingface.co/api/spaces/${SPACE_ID}`,
+      { headers: { Authorization: `Bearer ${accessToken}` } }
+    );
+
+    if (!res.ok) return false;
+
+    const data = (await res.json()) as Record<string, unknown>;
+
+    if (data.private === false) {
+      const authorOrg = SPACE_ID.split("/")[0];
+      const res2 = await fetch(
+        `https://huggingface.co/api/spaces/${SPACE_ID}/settings`,
+        { headers: { Authorization: `Bearer ${accessToken}` } }
+      );
+      return res2.ok;
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Extract access token from cookie header string.
+ */
+export function extractToken(cookieHeader: string | undefined): string | undefined {
+  if (!cookieHeader) return undefined;
+  const match = cookieHeader.match(/(?:^|;\s*)access-token=([^;]+)/);
+  return match ? match[1] : undefined;
+}

backend/src/server.ts

@@ -17,6 +17,7 @@ import {
   schedulePush,
   flushAll,
 } from "./hf-storage.js";
+import { resolveUser, extractToken, isOAuthEnabled } from "./auth.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const DATA_DIR = join(__dirname, "..", "data");
@@ -36,7 +37,23 @@ if (hfEnabled) {
   console.log("[server] falling back to local file persistence");
 }
 
+const oauthEnabled = isOAuthEnabled();
+if (oauthEnabled) {
+  console.log("[server] HF OAuth enabled (SPACE_ID set)");
+} else {
+  console.log("[server] HF OAuth disabled (no SPACE_ID), all users can edit");
+}
+
 const hocuspocus = new Hocuspocus({
+  async onAuthenticate({ token }: { token: string }) {
+    if (!oauthEnabled) return;
+
+    const user = await resolveUser(token);
+    if (!user || !user.canEdit) {
+      throw new Error("Unauthorized: no write access");
+    }
+    return { user };
+  },
   extensions: [
     new Database({
       fetch: async ({ documentName }: { documentName: string }) => {
@@ -79,6 +96,33 @@ const { app } = expressWebsockets(express());
 
 app.use(express.json({ limit: "1mb" }));
 
+// ---------- Auth ----------
+
+app.get("/api/auth/status", async (req, res) => {
+  if (!oauthEnabled) {
+    res.json({ authenticated: true, canEdit: true, user: null });
+    return;
+  }
+
+  const token = extractToken(req.headers.cookie);
+  const user = await resolveUser(token);
+
+  if (!user) {
+    res.json({ authenticated: false, canEdit: false, user: null });
+    return;
+  }
+
+  res.json({
+    authenticated: true,
+    canEdit: user.canEdit,
+    user: {
+      name: user.name,
+      fullName: user.fullName,
+      avatarUrl: user.avatarUrl,
+    },
+  });
+});
+
 // ---------- Collab WebSocket ----------
 
 app.ws("/collab/:doc", (ws, req) => {