Spaces:
Running
Running
Commit History
-
Cleanup: Remove debug logs and development config
- Remove reload=True from uvicorn config (production safety) - Remove DEBUG print statements from knowledge_graphs.py - Remove toast debug console.log from NotificationContext - Remove proxy debug console.log from vite.config.ts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>96a9109 -
Security: Fix critical vulnerabilities before public release
- Restrict CORS to specific allowed origins (was wildcard *) - Add path traversal protection in agentgraph.py - Remove error detail leakage in 46 API endpoints (no longer expose str(e)) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>bcbd2ec
-
Security & HF Spaces fixes: Enable CSRF, auth middleware, persistent storage
- Re-enable CSRF state verification in OAuth callback (auth.py:165-177) - Re-enable ConditionalAuthMiddleware in app.py - Add /auth/oauth-callback to excluded paths in auth middleware - Centralize DB_URI config to use /data persistent storage in HF Spaces - Update database/__init__.py and init_db.py to use central config - Add graceful error handling for /data directory creation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>ea856a6 -
Add comprehensive perturbation testing system with E2E tests
Features: - New config.py with Pydantic models for perturbation test configuration - New concurrent_executor.py for parallel test execution with retry logic - Enhanced jailbreak testing with configurable num_techniques parameter - Enhanced counterfactual bias testing with comparison modes (vs_baseline, all_pairs, both) - New testing.py router with API endpoints for presets, demographics, and jailbreak prompts - Frontend PerturbationTestConfig.tsx component for configuration UI Tests: - 130 unit and integration tests for the perturbation testing system - Tests cover config validation, concurrent execution, jailbreak testing, bias detection - API integration tests for all new endpoints 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>795b72e
-
Fix: Auth status endpoint response format and frontend cache
🐛 Problems: 1. Frontend using old cached JavaScript (index-fe30a47e.js vs index-9bb815aa.js) 2. Backend /auth/status returns user_authenticated but frontend expects authenticated 3. Frontend expects complete user object but backend returns user_info ✅ Solutions: Backend /auth/status endpoint: - Added authenticated: bool(user) field for frontend compatibility - Added user: user field containing complete user object - Maintained legacy fields for backward compatibility Frontend build: - Cleared dist/ cache and rebuilt with latest session detection code - New build should force HF Spaces to use updated JavaScript files 🔧 Technical Changes: Backend Response Format: - authenticated: boolean (NEW - frontend expects this) - user: object (NEW - complete user data) - user_authenticated: boolean (legacy) - user_info: object (legacy) Expected Flow: 1. Frontend loads → calls /auth/status 2. Backend returns session user if exists 3. Frontend detects authenticated: true + user data 4. AuthCont…2157a09 -
Fix: Correct OAuth callback URL path mismatch
🐛 Problem: - Frontend uses /oauth-callback but backend expects /auth/oauth-callback - HF OAuth redirects to /oauth-callback which returns 404 - Path inconsistency between frontend and backend routes ✅ Solution: - Updated frontend redirectUri to use /auth/oauth-callback - Updated backend redirect_uri construction to match - Now both frontend and backend use consistent /auth/oauth-callback path 🔧 Technical Changes: Frontend: - AuthContext: redirectUri = /auth/oauth-callback Backend: - auth.py: redirect_uri = /auth/oauth-callback (all instances) - Maintains router prefix consistency: /auth + /oauth-callback 🎯 Expected Result: - OAuth callback should now route correctly to backend handler - No more 404 errors after HF authorization - Complete OAuth flow from authorization to app logina093720 -
Fix: Add /oauth-callback endpoint for OAuth flow
🐛 Problem: - OAuth callback URL /oauth-callback returns 404 error - HF redirects to /oauth-callback but backend only has /auth/callback - Frontend and backend using different callback paths ✅ Solution: - Added new /auth/oauth-callback endpoint route - Unified callback handler handle_oauth_callback() - Updated redirect_uri to use /oauth-callback consistently - Keep legacy /auth/callback for compatibility 🔧 Technical Changes: Backend: - @router.get('/oauth-callback') -> oauth_callback_new() - Refactored oauth_callback logic into shared handle_oauth_callback() - Updated all redirect_uri to use /oauth-callback path - Maintains backward compatibility with existing /auth/callback 🎯 Expected Result: - OAuth callback should work correctly - No more 404 errors after HF authorization - Successful authentication and redirect to app5434c66 -
Fix: Add backend OAuth config API for client_id
🐛 Problem: - HF OAuth requires client_id parameter in authorization URL - Frontend can't directly access server environment variables - Getting 400 'client_id is required' error ✅ Solution: - Created /api/auth/oauth-config endpoint in backend - Returns public OAuth config (client_id, scopes, provider_url) - Frontend fetches config before OAuth redirect - Secure: Only returns public info, never client_secret 🔧 Technical Changes: Backend: - Added get_oauth_config_for_frontend() route - Returns OAuth config from environment variables - Includes safety checks for auth_enabled status Frontend: - Fetch OAuth config from backend API before login - Use backend-provided client_id in OAuth URL - Enhanced error handling for config fetch failures - Debug logging for OAuth config validation 🎯 Expected Result: - OAuth URL now includes proper client_id parameter - Should successfully redirect to HF OAuth page - No more '400 client_id required' errors5d5103b -
add
041fce6 -
Fix HF Spaces iframe session persistence with localStorage fallback
🔧 Enhanced Authentication for HF Spaces iframe: - Added localStorage backup for user data in login success page - Frontend sends localStorage data as header fallback - Backend checks X-HF-User-Backup header when session fails - Improved message passing between login window and parent - Session data restored from localStorage backup 💡 This addresses the critical iframe cookie issues in HF Spaces where session cookies may not persist properly across windows. 🔄 Flow: Login → localStorage backup → Header fallback → Session restoreba6eacd -
Implement HF Spaces best practice: new tab login flow
🔧 HF Spaces OAuth Best Practice: - Login button now opens in new tab (target='_blank') - Added success page that notifies parent window - Implemented message passing between tabs - Added periodic auth status checking during login - Beautiful success page with auto-close functionality 📚 Based on HF documentation: 'You should use target=_blank on the button to open the sign-in page in a new tab, unless you run the space outside its iframe. Otherwise, you might encounter issues with cookies.' This should resolve the session cookie issues in iframe environment.5a2b931 -
Add debug logging to auth status endpoint
🔍 Debug additions: - Add logging to auth status endpoint to track user data - Log user from request.state and session - This will help identify why authenticated users appear as anonymous Next step: Check HF logs to see what's happening with session data.cf1d34e -
Simplify authentication flow to fix login issues
🔧 Simplification: - Remove complex URL parameter handling - Remove unnecessary OAuth success detection - Simplify AuthContext initialization - Add comprehensive logging for debugging - Remove redundant event listeners 🎯 Goal: Return to a more reliable authentication flow like the original full-page login system but with popup modal. The previous complex state management was causing authentication loops and unreliable state detection.ae27f4a -
Fix login modal authentication issues
🔧 Critical Fixes: - Fix YouTube iframe permissions policy violations (removed web-share) - Fix authentication loop after successful OAuth login - Improve auth status endpoint to return complete user data - Add URL parameter detection for successful authentication - Add page focus listener to refresh auth status - Enhanced logging for better debugging 🐛 Issues Resolved: - Users no longer get stuck in login loop after OAuth success - Iframe permission violations eliminated - Auth state properly recognized after login - Login modal correctly disappears after successful authentication These fixes address the core authentication flow issues identified in HF Spaces deployment.0d7ac2b -
Implement popup login modal system
✨ Major UX Improvement: - Replace full-page login with overlay modal - Users can now see the platform in background before login - Created AuthContext for centralized auth state management - Added LoginModal component with embedded video and paper - Modified API to trigger login modal on 401 errors - Removed forced auth redirect from root route 🎨 Design Features: - Glass-morphism modal design consistent with platform - Embedded demo video and research paper download - Responsive layout with proper backdrop blur - Smooth loading states and transitions 🔧 Technical Changes: - New AuthContext with HF Spaces detection - Custom auth-required events from API layer - Conditional authentication based on environment - Proper error handling for unauthorized requests This provides a much better user experience where users can explore the interface before deciding to authenticate.aad2775
-
Separate login page to HTML template for better maintainability
2175f7f -
Use shadcn/ui design system for login page consistency
64857c1 -
✨ Simplify landing page: Bigger CTA & cleaner design
🎯 Key Changes: - Made 'Access Research Platform' button much larger and more prominent - Increased button padding (24px 48px), font size (20px), and weight (700) - Enhanced button shadow and hover effects - Set minimum width (280px) for better presence 🧹 Content Simplification: - Removed feature grid (4 feature cards) - too much information - Simplified description to one concise sentence - Shortened authentication message - Kept only essential content: title, subtitle, description, CTA 🎨 Visual Focus: - Button now clearly the primary action element - Cleaner information hierarchy - More breathing room around CTA - Maintained premium dark theme aesthetic User feedback: 'Access button too small and not obvious enough, too much information'5bdf3b9 -
🎨 Complete redesign: Premium research platform landing page
✨ Features: - Dark gradient hero section with subtle animations - Research paper-inspired content and terminology - Four feature highlights (Interactive Graphs, Failure Detection, Robustness Testing, Causal Analysis) - Professional institutions credit (Holistic AI × UCL) - Premium glass-morphism design elements 🎨 Visual Design: - Dark theme with gradient background (#0f172a → #334155) - Inter font family for modern typography - Gradient text effects and backdrop blur - Floating video container with 'Live Demo' badge - Hover effects and smooth transitions - Mobile-responsive two-column layout 📝 Content Updates: - Full research paper subtitle - Academic-style feature descriptions - Professional 'Research Platform' badge - Institutional collaboration credits - Research-focused authentication messaging 🚀 User Experience: - Hero section spans full viewport - Clean information hierarchy - Call-to-action: 'Access Research Platform' - Embedded demo video with enhanced styling - Responsiv…35f32c6 -
Redesign login page with cleaner, minimal design
✨ New Features: - Clean, minimal design without emojis - Embedded YouTube demo video (btrS9pfDYJY) - Two-column layout (text + video) - Responsive design for mobile 🎨 Design Changes: - Removed all emojis and decorative elements - Clean typography with modern font stack - Subtle shadows and minimal color palette - Professional blue button styling - Mobile-first responsive grid layout 📱 Mobile Optimized: - Single column layout on mobile - Proper video container aspect ratio - Touch-friendly button sizinga362bd4 -
Remove target='_blank' for single-page login experience
- Remove target='_blank' from login button - Remove auto-refresh JavaScript - Keep the critical SameSite=None session fix for iframe compatibility - User preference: login in same page instead of new tab9036c1d -
Fix iframe cookie issues for HF Spaces
Based on HF official docs about iframe cookie problems: 1. Ensure SameSite=None for iframe cookies in HF Spaces - Critical for cross-origin iframe cookie support 2. Add target='_blank' to login button - Opens login in new tab as recommended by HF docs - Avoids iframe cookie restrictions 3. Add auto-refresh login detection - JavaScript checks login status every 3s - Auto-redirects when user is authenticated - Better UX for iframe login flow This should fix the session persistence issue we've been seeing.66e834a -
Fix OAuth according to HF official documentation
Based on https://huggingface.co/docs/hub/en/spaces-oauth: 1. Fix OAuth scopes: - Include 'openid profile' as required by HF - These are automatically included but we specify them explicitly 2. Use SPACE_HOST environment variable: - Official recommended way to get redirect URI - Fallback to manual construction if not available 3. Update README.md with proper HF OAuth configuration This should fix the session/cookie issues we've been experiencing.b9161fb -
Fix UnboundLocalError and add environment detection debug
- Remove duplicate is_huggingface_space import in auth.py - Add environment detection debugging in app.py - This will show if HF Spaces detection is working - Should fix the 500 error in auth callbackfd80df3 -
Add comprehensive session debugging
- Fix SessionMiddleware parameters (remove unsupported options) - Add session debugging in auth callback after saving - Fix cookie name check to use default 'session' - Compare session state between save and read operations - This will show exactly where session data is lost2431039 -
Fix HF user info parsing and OAuth scope issues
- Add detailed logging for HF API user info response - Improve username field detection with fallbacks - Fix OAuth scope to use only supported 'read-repos' - Handle multiple possible field names from HF API - Better error handling for missing user data fields0a06f26 -
Fix session persistence and add detailed debugging
- Enhance session save/verification in OAuth callback - Add comprehensive session debugging in auth middleware - Create debug endpoint to inspect session state - Improve error handling for session access failures - Add auth_method field to user data for better trackingdbeb044 -
Fix OAuth state verification and permissions policy issues
- Add detailed logging for OAuth state save/verification process - Temporarily skip state verification for debugging OAuth flow - Add Permissions-Policy meta tag to prevent browser security warnings - Improve error handling in session access - Add viewport meta tag for better mobile experienceceaf757 -
Fix OAuth redirect URI for HF Spaces
- Convert SPACE_ID format for proper domain construction - Use holistic-ai-agentgraph.hf.space format for redirect URIs - Fix both login and callback redirect URI generation - Ensure OAuth flow works correctly in HF Spaces environment823f4d7 -
Fix middleware order and session access issues
- Reorder middleware stack: Session -> UsageTracking -> Auth -> CORS - Fix session access in authentication middleware with try-catch - Add proper error handling for session not available scenarios - Ensure SessionMiddleware runs before ConditionalAuthMiddlewarec89d79e -
Enhance authentication requirements for root and agentgraph endpoints
- Update root endpoint to require authentication, adding comments for clarity. - Modify agentgraph endpoint documentation to indicate authentication necessity. - Remove root and agentgraph from excluded paths in authentication middleware to enforce security.3dc5183 -
Fix missing Request import in observability router
- Add missing Request import to backend/routers/observability.py - This was causing 'name Request is not defined' error on startup3c3bac2 -
Implement mandatory authentication and usage tracking for OpenAI API protection
- Enable strict authentication requirement for all users - Add comprehensive usage tracking middleware - Monitor OpenAI API calls with detailed logging - Create beautiful login page explaining security requirements - Add usage summary endpoint for monitoring - Protect against abuse and track costs7da14b7 -
Fix HF Spaces authentication: support __sign parameter and make auth optional
9fdf42c -
Implement conditional authentication middleware and OAuth routes for Hugging Face Spaces integration. Enhance environment debugging and add environment info endpoint. Update README with OAuth configuration details and improve startup logging.
c8243d5
-
add
1e144a5
-
add
7bc750c
-
🧹 Clean up: Remove backend/scripts/ and __pycache__ files
✅ Security improvements: • Removed backend/scripts/ directory (dev/maintenance tools only) • Eliminated hardcoded Langfuse API keys security risk • Removed fetch_langfuse_logs.py with exposed credentials �� Optimization benefits: • Reduced image size by ~50MB • Simplified deployment (removed non-core functionality) • Cleaned up Python cache files 🔧 Files removed: • backend/scripts/fetch_example_dataset.py • backend/scripts/fetch_langfuse_logs.py (had hardcoded API keys) • backend/scripts/langsmith_exporter.py • All __pycache__ directories and .pyc files7348bb7 -
🚀 Deploy AgentGraph: Complete agent monitoring and knowledge graph system
Features: - 📊 Real-time agent monitoring dashboard - 🕸️ Knowledge graph extraction from traces - 📈 Interactive visualizations and analytics - 🔄 Multi-agent system with CrewAI - 🎨 Modern React + FastAPI architecture Ready for Docker deployment on HF Spaces (port 7860)c2ea5ed