Remove fixed researcher access code

app.py

@@ -19,7 +19,6 @@ from gradio_client import Client
 from pydantic import BaseModel, Field
 
 
-ACCESS_CODE = os.getenv("ACCESS_CODE", "")
 SESSION_SECRET = os.getenv("SESSION_SECRET", "")
 HF_TOKEN = os.getenv("HF_TOKEN", "")
 TARGET_SPACE_ID = os.getenv("TARGET_SPACE_ID", "ASQ2/ASQ")
@@ -34,10 +33,6 @@ PAIRING_TTL_SECONDS = int(os.getenv("PAIRING_TTL_SECONDS", "600"))
 logger = logging.getLogger("asq_gateway")
 
 
-class AuthRequest(BaseModel):
-    code: str = Field(min_length=6, max_length=6, pattern=r"^\d{6}$")
-
-
 class PrepareRequest(BaseModel):
     background: str = Field(min_length=20, max_length=MAX_BACKGROUND_CHARS)
 
@@ -91,7 +86,7 @@ def _new_interview_code() -> str:
     _cleanup_expired()
     for _ in range(100):
         code = f"{secrets.randbelow(1_000_000):06d}"
-        if code != ACCESS_CODE and code not in interview_codes:
+        if code not in interview_codes:
             return code
     raise RuntimeError("Could not allocate an interview code")
 
@@ -100,7 +95,7 @@ def _new_pairing_code() -> str:
     _cleanup_expired()
     for _ in range(100):
         code = f"{secrets.randbelow(1_000_000):06d}"
-        if code != ACCESS_CODE and code not in pairing_codes and code not in interview_codes:
+        if code not in pairing_codes and code not in interview_codes:
             return code
     raise RuntimeError("Could not allocate a pairing code")
 
@@ -262,7 +257,7 @@ def session_view(session: dict[str, Any], role: str) -> dict[str, Any]:
     return response
 
 
-api = FastAPI(title="ASQ Rokid Gateway", version="0.3.0")
+api = FastAPI(title="ASQ Rokid Gateway", version="0.4.0")
 api.add_middleware(
     CORSMiddleware,
     allow_origins=["*"],
@@ -280,18 +275,16 @@ def mobile_app() -> str:
 def health() -> dict[str, Any]:
     return {
         "ok": True,
-        "configured": bool(ACCESS_CODE and SESSION_SECRET and HF_TOKEN),
+        "configured": bool(SESSION_SECRET and HF_TOKEN),
         "target": TARGET_SPACE_ID,
-        "version": "0.3.0",
+        "version": "0.4.0",
     }
 
 
 @api.post("/auth")
-def authenticate(request: AuthRequest) -> dict[str, Any]:
-    if not ACCESS_CODE or not SESSION_SECRET:
+def create_owner_session() -> dict[str, Any]:
+    if not SESSION_SECRET:
         raise HTTPException(status_code=503, detail="Gateway is not configured")
-    if not hmac.compare_digest(request.code, ACCESS_CODE):
-        raise HTTPException(status_code=401, detail="Incorrect code")
     _cleanup_expired()
     session_id = secrets.token_urlsafe(18)
     expires_at = int(time.time()) + SESSION_TTL_SECONDS
@@ -454,24 +447,24 @@ button{border:0;background:#087a54;color:#fff;padding:14px;font-weight:700;margi
 .hypo{white-space:pre-wrap;line-height:1.5;background:#f7faf8;padding:14px;border-radius:12px;max-height:320px;overflow:auto}
 </style></head><body><main class="card">
 <h1>ASQ Interview Setup</h1><p class="muted">Open ASQ on the Rokid glasses first. The glasses will display a six-digit pairing code; enter that code on this phone.</p>
-<section id="login"><label for="access">Researcher access code</label><input id="access" inputmode="numeric" maxlength="6" placeholder="Six digits"><button id="loginBtn">Continue</button></section>
-<section id="prepare" class="step hidden"><label for="pairingCode">Code shown on the glasses</label><input id="pairingCode" inputmode="numeric" maxlength="6" placeholder="Six digits"><label for="background" style="margin-top:16px">Case and interview background</label><textarea id="background" placeholder="Enter the case facts, context, existing evidence, interview goals, and any constraints..."></textarea><button id="prepareBtn">Connect glasses and prepare interview</button></section>
+<section id="prepare"><label for="pairingCode">Code shown on the glasses</label><input id="pairingCode" inputmode="numeric" maxlength="6" placeholder="Six digits"><label for="background" style="margin-top:16px">Case and interview background</label><textarea id="background" placeholder="Enter the case facts, context, existing evidence, interview goals, and any constraints..."></textarea><button id="prepareBtn" disabled>Connect glasses and prepare interview</button></section>
 <section id="progress" class="step hidden"><div id="status" class="status">Connecting the glasses…</div><div id="hypoWrap" class="hidden"><h2>Initial hypotheses</h2><div id="hypotheses" class="hypo"></div></div></section>
 </main><script>
 let token="", timer=null; const $=id=>document.getElementById(id);
 async function api(path, options={}){const headers={"Content-Type":"application/json",...(options.headers||{})};if(token)headers.Authorization=`Bearer ${token}`;const r=await fetch(path,{...options,headers});let data={};try{data=await r.json()}catch{}if(!r.ok)throw new Error(data.detail||`Request failed (${r.status})`);return data}
 function errorMessage(e){$("status").textContent=e.message;$("progress").classList.remove("hidden")}
-$("loginBtn").onclick=async()=>{try{const data=await api("/auth",{method:"POST",body:JSON.stringify({code:$("access").value.trim()})});token=data.token;$("login").classList.add("hidden");$("prepare").classList.remove("hidden")}catch(e){errorMessage(e)}};
+async function begin(){try{const data=await api("/auth",{method:"POST"});token=data.token;$("prepareBtn").disabled=false}catch(e){errorMessage(e)}}
 $("prepareBtn").onclick=async()=>{const pairingCode=$("pairingCode").value.trim();const background=$("background").value.trim();if(!/^\d{6}$/.test(pairingCode)){errorMessage("Enter the six-digit code shown on the glasses.");return}if(background.length<20){errorMessage("Please provide at least 20 characters of background.");return}$("prepareBtn").disabled=true;$("progress").classList.remove("hidden");$("status").textContent="Connecting the glasses and generating initial hypotheses…";try{await api("/pair/claim",{method:"POST",body:JSON.stringify({code:pairingCode})});const data=await api("/prepare",{method:"POST",body:JSON.stringify({background})});show(data);timer=setInterval(poll,3000)}catch(e){errorMessage(e);$("prepareBtn").disabled=false}};
 async function poll(){try{show(await api("/session"))}catch(e){clearInterval(timer);errorMessage(e)}}
 function show(data){if(data.status==="ready"){clearInterval(timer);$("status").textContent="Ready. The glasses are connected and can begin the interview.";$("hypotheses").textContent=data.hypotheses||"No hypotheses returned.";$("hypoWrap").classList.remove("hidden")}else if(data.status==="error"){clearInterval(timer);$("status").textContent=data.error||"Model startup failed.";$("prepareBtn").disabled=false}else{$("status").textContent="Glasses connected. Starting the model and generating initial hypotheses…"}}
+begin();
 </script></body></html>"""
 
 
 with gr.Blocks(title="ASQ Rokid Gateway") as status_page:
     gr.Markdown(
         "# ASQ Rokid Gateway\n"
-        "This service provides the authenticated phone preparation and Rokid interview APIs.\n\n"
+        "This service provides phone preparation and Rokid interview pairing APIs.\n\n"
         "Open the site root on a phone to prepare an interview. Use `GET /health` for service status."
     )