Spaces:
Running on Zero
Running on Zero
| """Read-only visitor identity check; never retain or log bearer credentials.""" | |
| import json | |
| import os | |
| from urllib.request import Request, urlopen | |
| def oauth_config(): | |
| client_id = os.environ.get('OAUTH_CLIENT_ID', '') | |
| configured_scopes = set(os.environ.get('OAUTH_SCOPES', '').split()) | |
| storage_enabled = bool(client_id and 'write-repos' in configured_scopes) | |
| config = {'enabled': bool(client_id), 'client_id': client_id, | |
| 'scopes': 'openid profile', 'storage_enabled': storage_enabled} | |
| if storage_enabled: | |
| config['storage_scopes'] = 'openid profile write-repos' | |
| return config | |
| def visitor_identity(headers): | |
| authorization = headers.get('authorization', '') | |
| if not authorization: | |
| return {'authenticated': False, 'auth_path': 'anonymous'} | |
| if not authorization.startswith('Bearer ') or len(authorization) > 8192: | |
| raise ValueError('Visitor authentication is invalid; sign in again') | |
| # Fixed HF endpoint only: no caller-controlled network destinations. | |
| try: | |
| request = Request('https://huggingface.co/oauth/userinfo', | |
| headers={'Authorization': authorization}) | |
| with urlopen(request, timeout=8) as response: | |
| profile = json.loads(response.read(65536)) | |
| username = profile['preferred_username'] | |
| if not isinstance(username, str) or not username or len(username) > 200: | |
| raise ValueError() | |
| return {'authenticated': True, 'username': username, | |
| 'auth_path': 'queue-bearer', 'is_pro': profile.get('isPro') is True} | |
| except Exception: | |
| # Never echo provider bodies, headers, credentials, or callback URLs. | |
| raise ValueError('Visitor identity could not be verified; sign in again') from None | |