Separate job keys from private HF hosting authentication

RELEASE_MANIFEST.json

@@ -10,8 +10,8 @@
     "assets/formula_template.json": "80f745df82bb7be45af52785fd582460bcddc63c5a4e1d8375d85b3122db4c6b",
     "bin/altd-sim": "2f2f2144ae14b0ef599ca8510f95712da00243c6875881491d384b394e7499f7",
     "bin/extract_saved_track": "3a7733c45b4301a786fcbfe92660a1c484749272da5f608d62f34878bd4ff31a",
-    "client.js": "828d29ae0291d9696364415397c113e907d1c512e01c0ef4cb771da63e5a48bf",
-    "delivery.py": "effc7e33c11c2e999b48620feaae263975a13df59c85f9c3a12c3f038ad47a5a",
+    "client.js": "c80281f2ab24c4efcb6801885cad6a70cb426512c0979397d90e920352ec8dec",
+    "delivery.py": "4f5a4e45df92e5cbfdef6eb449ede9ba26217fe24da376fafddae5cbbb73847a",
     "index.html": "cf4c0670c81184f8ea2726041457ae3cecc6c79b9030a41fe545b1bc503f0a47",
     "requirements.txt": "dbdedd8a6f30e16dc41bc3e210c1a936f679655420075f8f89bdd40bdd03f91b",
     "server.py": "df0f3d22c55653de9216da2443d17cd098cf5552f66a0fafb742160b5b29eefe",

client.js

@@ -33,7 +33,7 @@ async function encoded(file) {
   let text=''; for (let i=0;i<bytes.length;i+=8192) text+=String.fromCharCode(...bytes.subarray(i,i+8192));
   return btoa(text);
 }
-const headers = () => ({Authorization:'Bearer '+job.key});
+const headers = () => ({'X-Job-Key':job.key});
 $('run').onclick = async () => {
   localResult=null;
   const started=performance.now();

delivery.py

@@ -119,10 +119,9 @@ def create_api(store=None):
         response.headers['X-Content-Type-Options']='nosniff'
         return response
 
-    def key(authorization):
-        if not authorization or not authorization.startswith('Bearer '):
+    def key(value):
+        if not value:
             raise HTTPException(404,'Job unavailable')
-        value = authorization[7:]
         if not value.isascii() or len(value)>128: raise HTTPException(404,'Job unavailable')
         return value
 
@@ -131,21 +130,21 @@ def create_api(store=None):
         except Unavailable: raise HTTPException(404,'Job unavailable') from None
 
     @app.get('/api/jobs/{ident}')
-    def status(ident:str,authorization:str|None=Header(default=None)):
-        return call(store.status,ident,key(authorization))
+    def status(ident:str,x_job_key:str|None=Header(default=None)):
+        return call(store.status,ident,key(x_job_key))
 
     @app.post('/api/jobs/{ident}/download')
-    def download(ident:str,authorization:str|None=Header(default=None)):
-        data,receipt = call(store.download,ident,key(authorization))
+    def download(ident:str,x_job_key:str|None=Header(default=None)):
+        data,receipt = call(store.download,ident,key(x_job_key))
         return Response(data,media_type='application/octet-stream',headers={
             'Content-Disposition':'attachment; filename="candidate.evolution"',
             'X-Delivery-Receipt':receipt})
 
     @app.post('/api/jobs/{ident}/ack')
-    def ack(ident:str,body:Acknowledgment,authorization:str|None=Header(default=None)):
-        return call(store.acknowledge,ident,key(authorization),body.receipt)
+    def ack(ident:str,body:Acknowledgment,x_job_key:str|None=Header(default=None)):
+        return call(store.acknowledge,ident,key(x_job_key),body.receipt)
 
     @app.delete('/api/jobs/{ident}')
-    def delete(ident:str,authorization:str|None=Header(default=None)):
-        return call(store.delete,ident,key(authorization))
+    def delete(ident:str,x_job_key:str|None=Header(default=None)):
+        return call(store.delete,ident,key(x_job_key))
     return app