Spaces:
Sleeping
Sleeping
Commit History
-
Close four holes in the share link, from review
1. A signed-in visitor could not use a link. authenticate() only consulted the share cookie when nobody was signed in, so a session made `user` truthy and the ACL check then refused them — while REST let the same request through. The page loaded and never synced. The grant now applies whenever the visitor lacks access of their own, signed in or not, and boot says which case it is so the client shows the read-only view to a signed-in stranger too. 2. The token stopped living in the URL. /p/<token> now sets the cookie and redirects to /d/<id>: a rendered page left the credential in the address bar, in history, and — since documents carry external images and links — in the Referer header sent to whatever host those point at. Referrer-Policy: no-referrer is set for the whole app as well. 3. Revoking reaches sockets that are already open. A viewer authenticated before the token changed stayed attached and kept receiving edits, so "revoked" meant "no new vi…830cb4d -
Anyone with the link: read a project without an account
A second way to share, next to inviting people by username: one long unguessable URL that opens the project read-only, for someone who has no Hugging Face account and should not need one. The token (24 random bytes) is exchanged for a cookie the moment the visitor lands on /p/<token>, so nothing downstream has to carry it: the REST snapshot, the websocket handshake and the <img> requests are all covered by the same grant. Lookup is constant-time, and an unknown or revoked token is a 404 that does not confirm the project exists. Read-only is enforced where it counts. The connection is marked readOnly in onAuthenticate, so hocuspocus drops any update or awareness message the client sends: a visitor who types sees their own keystrokes and nothing else does. REST keeps requireUser everywhere except GET of the project and its page tree, so a link cannot suggest, comment, add a page, re-share or delete. The non-editable editor and the hidden buttons are a courtesy on top of that, not the m…3a73292 -
Add a private default agent for each user
Agent Manager314a59f
-
Faster loads: brotli bundles, immutable asset caching, self-hosted font, session+title inlined in the shell, loading skeletons
Verified signatureec6b346
-
Upload folder using huggingface_hub
Verified signature704a62b
-
Upload folder using huggingface_hub
Verified signature93abf36 -
Upload folder using huggingface_hub
Verified signature53148eb -
Upload folder using huggingface_hub
Verified signature3387889 -
Upload folder using huggingface_hub
Verified signature2c39198 -
Upload folder using huggingface_hub
Verified signature0d14b54
-
Upload folder using huggingface_hub
Verified signature99a44ac