Use standard HF PKCE redirect across OAuth opener isolation

DATA_POLICY.md

@@ -35,11 +35,14 @@ of physical RAM/disk erasure, prevention of swap, or deletion of response buffer
 No claim is made about hosting-provider logs or infrastructure retention.
 
 Optional HF sign-in uses the official HF OAuth authorization-code/PKCE flow with
-only openid/profile scopes. Credentials and basic profile details live in browser
+only openid/profile scopes. Access tokens and basic profile details live in browser
 page memory, not cookies, localStorage, recipes, or a server session database.
-HF handles password entry and authorization. The callback briefly carries a
-one-use authorization code and state in its URL; the app clears that URL before
-returning to the main window. HF/proxy infrastructure handling is outside this
+Only the one-use PKCE verifier/nonce and start time are temporarily saved in
+tab-local sessionStorage to survive the full-page redirect, with a five-minute
+acceptance limit; they are removed on return, error, or a fresh app load. Closing
+the tab loses them. HF handles password entry and authorization. The callback
+briefly carries a one-use authorization code and state in its URL; the app clears
+that URL before loading the OAuth helper. HF/proxy infrastructure handling is outside this
 application's deletion guarantee. The app does not request email, billing,
 repository access, or persistent bucket access.
 

RELEASE_MANIFEST.json

@@ -2,13 +2,13 @@
   "backend": "cpu+zerogpu",
   "files": {
     "BETA_TESTING.md": "d511965b9d675a092571f8815348da991ef1ef6be3766266c1f98ff393fd3a4d",
-    "DATA_POLICY.md": "72bf2be8b87d948501ea44cbdcb2d6d7680f7387ed1c39fd1d3afdf094cf5487",
+    "DATA_POLICY.md": "8a954c46d39783582b2d4fbaa0fa2510e2e13446b0dff0b3c66f8817341b0289",
     "FRONTEND_SOURCE.json": "1e31b153757fd42c3bc2abaa1982a44e19a2ed7dc259d32781f36bb9a3ee10b7",
     "GODOT_LICENSE": "fb2b3bb82c60f1e76841ba2122eb902f8e39c151476fe21ce10c9a05d1045304",
     "IMPORTER_BUILD_RECEIPT.json": "4ba5c533cc617105478e4d85c83f456a7dfa68b1388049624619871ba9e42e9d",
     "LICENSE": "53d5851b6440feeae36f72a5f57fcab37858c48b7084765ece4b0c54b9a28ed8",
     "README.md": "11abed635d4192b5ea8d8891fc38e3a60989ad5b4696683d0321f3bc12eba20f",
-    "STORAGE_BOUNDARY.md": "3b91d8db71ece1bb55f38685610d722b162a78af0a602926c16792075e48ef99",
+    "STORAGE_BOUNDARY.md": "85442bbaffdf1208a1b7d3359cf1f0a2000a2d1ca46594b3a5fe23d52db41e00",
     "app.py": "704f789a41846b0a5bc1d3f6f5305d7ac5a6b1719ff77c23585b89fd3e68d55d",
     "app_release.py": "7482559c667a665fd3cb6aa8af6c78422a822b515e14589db8306f7fd4860a8b",
     "assets/formula_template.json": "80f745df82bb7be45af52785fd582460bcddc63c5a4e1d8375d85b3122db4c6b",
@@ -18,12 +18,11 @@
     "client.js": "79a34470942132a4e4a4100ae92b805ff02f7fe344e7962cfcff6a1208cef54a",
     "delivery.py": "4f5a4e45df92e5cbfdef6eb449ede9ba26217fe24da376fafddae5cbbb73847a",
     "gpu_tickets.py": "c32cb5de751d49d3e1cd970c7d6328a42ebe71602dd9fd3788c872eef42611da",
-    "hf-auth-callback.html": "07a753a8a70a145d4fc22ae4b259259f4aa202e3d3ae58b9077d271a8ccb7928",
-    "hf-auth.js": "d39981c98eec48d941a8e8b31b49ba0c44b7debe628c92681dfd26324782e545",
+    "hf-auth.js": "743fa2b62c611fcc6064664691e133efb5d163412955b2a9d0a562a428412864",
     "hf_identity.py": "6993d0238ada835606dbdc3275c17a3fe5a5cac5ad2156ab78230acf2d051eba",
     "index.html": "9e5b6bd69dd587f0e5c0f551b291de4d6a729e601916042cde0449ba2162bee8",
     "requirements.txt": "9b532747e51bd052e82090ece860d6dafe027407f4512dc74272c148ea104c22",
-    "server.py": "f0fa001000a55503ac62498105cb9f3a3798051582eac27c46b56ff592d5c734",
+    "server.py": "dda63ffe8e9ea0191c940fcb996ed790cbb21b8be96e83aeca2a67c33ce45582",
     "training_config.py": "2b9768876fdc60b16afb45b98023c6c31666e30f7c56f1292f6071775e6da0c5",
     "vendor/gradio-client/LICENSE": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
     "vendor/gradio-client/dist/index.min.js": "fdd776db8633354f118fe2908c980592283968737e6b91dc3aa86d648da5c3fd",

STORAGE_BOUNDARY.md

@@ -12,7 +12,8 @@ same settings contract is used independently of the selected storage policy.
 | Single-run output | Memory result store and random job key | Receipt ACK in automatic mode, manual delete, fixed 30-minute expiry, or shutdown |
 | Batch intermediates | Same job contract, always automatic | Verified size/hash and deletion ACK before advancement |
 | Received candidate / receipt | Browser page memory | Explicit discard, replacement, page reload/close; explicit export to disk |
-| Optional HF identity / token / PKCE state | Browser page memory, separate from job/recipe storage | Sign out, expiry, or page reload/close; no app auth cookie or server session database |
+| Optional HF identity / token | Browser page memory, separate from job/recipe storage | Sign out, expiry, or page reload/close; no app auth cookie or server session database |
+| One-use HF PKCE verifier/nonce | Tab-local sessionStorage for the sign-in redirect only | Five-minute acceptance limit; removed on return/error/fresh app load or tab close; never stores access tokens or files |
 | User bucket | Not implemented | Must require an explicit opt-in adapter and separate retention policy |
 
 `recipes.cjs` has no host/network dependency. Its `createStore(storage)` receives

hf-auth.js

@@ -1,19 +1,20 @@
 'use strict';
-// Official HF PKCE helpers; nonce/verifier and visitor token live in page RAM only.
+// Official HF PKCE redirect helpers. Only the one-use verifier crosses navigation;
+// account access tokens and profile details stay in this page's memory.
 (() => {
-  const node=id=>document.getElementById(id);
-  let session=null,pending=null,locked=false,ready=false,config=null,exchanging=false;
+  const node=id=>document.getElementById(id),flowKey='tiga.ald.hf.pkce.v1';
+  let session=null,locked=false,ready=false,config=null,exchanging=false;
   const message=text=>{node('hfIdentity').textContent=text;};
   function render(){
-    node('hfSignIn').disabled=locked||!!pending||!ready;
-    node('hfSignOut').disabled=locked||!!pending||!session;
-    node('hfVerify').disabled=locked||!!pending||!session;
+    node('hfSignIn').disabled=locked||exchanging||!ready;
+    node('hfSignOut').disabled=locked||exchanging||!session;
+    node('hfVerify').disabled=locked||exchanging||!session;
   }
   function clear(){session=null;window.dispatchEvent(new Event('hf-auth-change'));render();}
   window.HFAuth={
     setBusy(value){locked=value;render();},
     credentials(){
-      if(pending||exchanging)throw Error('Complete or cancel HF sign-in before starting GPU');
+      if(exchanging)throw Error('Complete HF sign-in before starting GPU');
       if(session && session.accessTokenExpiresAt.getTime()<=Date.now()){
         clear();message('HF sign-in expired. Sign in again before an account GPU request.');
         throw Error('HF sign-in expired; sign in again');
@@ -32,49 +33,52 @@
     catch{message('Queue identity check failed. No GPU request started. Sign in again or use CPU.');}
   };
   node('hfSignIn').onclick=async()=>{
-    if(locked||pending||!ready)return;
-    const popup=window.open('about:blank','ald-hf-sign-in','popup,width=620,height=760');
-    if(!popup){message('Sign-in window blocked. Allow this sign-in popup or use anonymous CPU.');return;}
-    const state={};
-    pending={popup,state,started:Date.now()};render();
+    if(locked||exchanging||!ready)return;
+    if((node('track').files.length||node('network').files.length) &&
+       !confirm('HF sign-in navigates away. Selected files and unsaved editor changes are lost; saved recipes remain. Continue, then reselect files?'))return;
+    exchanging=true;render();
     try{
+      const state={};
       const helpers=await import('/hf-oauth.js');
       const url=await helpers.oauthLoginUrl({clientId:config.client_id,scopes:'openid profile',
-        redirectUrl:location.origin+'/auth/callback',localStorage:state});
-      if(!pending || pending.popup!==popup)return;
-      popup.location.href=url;message('Complete the optional sign-in on Hugging Face. No password or personal token is entered here.');
+        redirectUrl:location.origin+'/',localStorage:state});
+      sessionStorage.setItem(flowKey,JSON.stringify({...state,started:Date.now()}));
+      message('Opening Hugging Face sign-in. No password or personal token is entered here.');
+      location.href=url;
     }catch{
-      pending=null;popup.close();render();message('HF sign-in could not start. CPU remains available.');
+      exchanging=false;render();message('HF sign-in could not start. Tab-local sign-in storage is required; CPU remains available.');
     }
   };
-  window.addEventListener('message',async event=>{
-    if(!pending||event.origin!==location.origin||event.source!==pending.popup||event.data?.type!=='hf-oauth-return')return;
-    const flow=pending;pending=null;ready=false;exchanging=true;render();
-    try{
-      const returned=new URL(event.data.url);
-      if(returned.origin!==location.origin||returned.pathname!=='/auth/callback')throw Error();
+  const returned=location.href,params=new URL(returned).searchParams;
+  const isCallback=params.has('code')||params.has('error');
+  if(isCallback){history.replaceState(null,'','/');exchanging=true;}
+  fetch('/api/auth/config',{cache:'no-store',credentials:'omit'}).then(async response=>{
+    if(!response.ok)throw Error();config=await response.json();ready=config.enabled===true;
+    if(isCallback){
+      let flow;
+      try{flow=JSON.parse(sessionStorage.getItem(flowKey));}
+      finally{sessionStorage.removeItem(flowKey);}
+      if(!ready||!flow?.nonce||!flow?.codeVerifier||Date.now()-flow.started>300000||flow.started>Date.now())throw Error();
       const helpers=await import('/hf-oauth.js');
-      const result=await helpers.oauthHandleRedirect({redirectedUrl:returned.href,
-        nonce:flow.state.nonce,codeVerifier:flow.state.codeVerifier});
+      const result=await helpers.oauthHandleRedirect({redirectedUrl:returned,nonce:flow.nonce,codeVerifier:flow.codeVerifier});
+      flow.nonce=null;flow.codeVerifier=null;
       const scopes=new Set(result.scope.split(/\s+/));
       if([...scopes].some(scope=>!['openid','profile'].includes(scope)))throw Error();
       if(!result.accessToken||!result.userInfo.preferred_username||result.accessTokenExpiresAt.getTime()<=Date.now())throw Error();
       session=result;window.dispatchEvent(new Event('hf-auth-change'));
       message('Signed in with HF: '+result.userInfo.preferred_username+'. Verify queue identity before GPU use.');
-    }catch{
-      clear();message('HF sign-in was cancelled or could not be verified. No GPU request started; CPU remains available.');
-    }finally{
-      flow.state.nonce=null;flow.state.codeVerifier=null;ready=true;exchanging=false;render();
+    }else{
+      sessionStorage.removeItem(flowKey);
+      message(ready?'Optional: sign in with HF before choosing files. CPU needs no sign-in. Token stays in page memory; only a one-use sign-in verifier crosses the redirect in tab-local storage.':
+        'HF sign-in is not configured on this deployment. CPU remains anonymous.');
     }
-  });
+  }).catch(()=>{
+    try{sessionStorage.removeItem(flowKey);}catch{}
+    clear();message('HF sign-in unavailable, cancelled, expired, or not verified. No GPU request started; CPU remains anonymous.');
+  }).finally(()=>{exchanging=false;render();});
   setInterval(()=>{
-    if(pending&&(pending.popup.closed||Date.now()-pending.started>300000)){
-      pending.popup.close();pending=null;render();message('HF sign-in window closed or timed out. CPU remains available.');
+    if(session&&session.accessTokenExpiresAt.getTime()<=Date.now()){
+      clear();message('HF sign-in expired. Sign in again to identify account GPU requests. CPU remains available.');
     }
   },1000);
-  fetch('/api/auth/config',{cache:'no-store',credentials:'omit'}).then(async response=>{
-    if(!response.ok)throw Error();config=await response.json();ready=config.enabled===true;render();
-    message(ready?'Optional: sign in with HF to identify account GPU requests. CPU needs no sign-in. Token stays in this page’s memory until sign-out, expiry, or page close.':
-      'HF sign-in is not configured on this deployment. CPU remains anonymous.');
-  }).catch(()=>{message('HF sign-in unavailable. CPU remains anonymous.');render();});
 })();

server.py

@@ -19,10 +19,6 @@ def create_app(worker=run_reported,store=None,gpu_worker=None):
     @app.get('/api/auth/config')
     def auth_config():
         return JSONResponse(oauth_config(),headers={'Cache-Control':'no-store'})
-    @app.get('/auth/callback')
-    def auth_callback():
-        return FileResponse(ROOT/'hf-auth-callback.html',media_type='text/html',
-            headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'})
     @app.get('/hf-auth.js')
     def auth_script(): return FileResponse(ROOT/'hf-auth.js',media_type='text/javascript')
     @app.get('/hf-oauth.js')
@@ -36,7 +32,8 @@ def create_app(worker=run_reported,store=None,gpu_worker=None):
         # iframe subresource access can fail before an external script runs.
         script=(ROOT/'client.js').read_text().replace('</script','<\\/script')
         return HTMLResponse((ROOT/'index.html').read_text().replace(
-            '<script src="/client.js"></script>','<script>'+script+'</script>'))
+            '<script src="/client.js"></script>','<script>'+script+'</script>'),
+            headers={'Referrer-Policy':'no-referrer','Cache-Control':'no-store'})
     @app.get('/client.js')
     def script(): return FileResponse(ROOT/'client.js',media_type='text/javascript')
     @app.get('/policy')