Deploy Step 4A-5-R3 native cookie session restore

README.md

@@ -7,8 +7,8 @@ sdk: streamlit
 app_file: app.py
 pinned: false
 short_description: Agent Article
-sdk_version: 1.32.0
+sdk_version: 1.38.0
 python_version: 3.11
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

managed_auth.py

@@ -11,6 +11,7 @@ import os
 import time
 from datetime import datetime, timezone
 from typing import Any, Callable
+from urllib.parse import unquote
 
 import qrcode
 import requests
@@ -203,10 +204,14 @@ def _clear_session(*, clear_restore: bool = False) -> None:
 
 
 def _read_restore_cookie() -> str:
+    """Read the restore cookie supplied with the initial Streamlit request."""
     try:
-        cookies = getattr(st.context, "cookies", {})
-        return str(cookies.get(RESTORE_COOKIE_NAME, "") or "").strip()
+        context = getattr(st, "context", None)
+        cookies = getattr(context, "cookies", {}) if context is not None else {}
+        raw_value = str(cookies.get(RESTORE_COOKIE_NAME, "") or "").strip()
+        return unquote(raw_value)
     except Exception:
+        # Compatibility fallback: never interrupt the approved login page.
         return ""
 
 
@@ -214,8 +219,9 @@ def _render_restore_cookie_command(
     token: str | None,
     *,
     expires_at: str | None = None,
+    reload_parent: bool = False,
 ) -> None:
-    """Write or delete a random recovery cookie in the top-level page."""
+    """Write or delete the recovery cookie without changing visible UI."""
     safe_name = json.dumps(RESTORE_COOKIE_NAME)
     safe_token = json.dumps(str(token or ""))
     max_age = RESTORE_COOKIE_DEFAULT_DAYS * 24 * 60 * 60
@@ -227,33 +233,65 @@ def _render_restore_cookie_command(
         )
     if not token:
         max_age = 0
+
     script = f"""
     <script>
     (() => {{
+      const name = {safe_name};
+      const value = {safe_token};
+      const maxAge = {int(max_age)};
+      const reloadParent = {str(bool(reload_parent)).lower()};
+      const cookieText = `${{name}}=${{encodeURIComponent(value)}}; Max-Age=${{maxAge}}; Path=/; Secure; SameSite=Strict`;
+
+      let targetDocument = document;
+      let cookieActionSucceeded = false;
+
       try {{
-        const name = {safe_name};
-        const value = {safe_token};
-        const maxAge = {int(max_age)};
-        const parentDoc = window.parent.document;
-        parentDoc.cookie = `${{name}}=${{encodeURIComponent(value)}}; Max-Age=${{maxAge}}; Path=/; Secure; SameSite=Strict`;
-      }} catch (_) {{}}
+        if (window.parent && window.parent.document) {{
+          targetDocument = window.parent.document;
+        }}
+        targetDocument.cookie = cookieText;
+        const cookiePresent = targetDocument.cookie
+          .split("; ")
+          .some((entry) => entry.startsWith(`${{name}}=`));
+        cookieActionSucceeded = maxAge === 0
+          ? !cookiePresent
+          : cookiePresent;
+      }} catch (error) {{
+        console.error("SmartPaper restore-cookie action failed", error);
+      }}
+
+      if (!cookieActionSucceeded) {{
+        console.error("SmartPaper restore-cookie verification failed");
+      }}
+
+      if (reloadParent && cookieActionSucceeded) {{
+        window.setTimeout(() => {{
+          try {{
+            window.parent.location.reload();
+          }} catch (error) {{
+            window.location.reload();
+          }}
+        }}, 180);
+      }}
     }})();
     </script>
     """
     components.html(script, height=0, width=0)
 
 
-def _sync_restore_cookie_to_browser() -> None:
+def _sync_restore_cookie_to_browser(*, reload_parent: bool = False) -> None:
     token = str(st.session_state.get("sp_restore_token") or "").strip()
     if token:
         _render_restore_cookie_command(
             token,
             expires_at=st.session_state.get("sp_restore_expires_at"),
+            reload_parent=reload_parent,
         )
 
 
-def _delete_restore_cookie() -> None:
-    _render_restore_cookie_command(None)
+def _delete_restore_cookie(*, reload_parent: bool = False) -> None:
+    _render_restore_cookie_command(None, reload_parent=reload_parent)
 
 
 def _verify_existing_session() -> bool:
@@ -322,7 +360,11 @@ def _create_login_request() -> dict[str, Any]:
     return request_data
 
 
-def _store_authenticated_session(result: dict[str, Any]) -> None:
+def _store_authenticated_session(
+    result: dict[str, Any],
+    *,
+    reload_after_cookie: bool = False,
+) -> None:
     session_token = result.get("session_token")
     user = result.get("user")
 
@@ -341,7 +383,9 @@ def _store_authenticated_session(result: dict[str, Any]) -> None:
         st.session_state["sp_restore_expires_at"] = result.get(
             "restore_expires_at"
         )
-        _sync_restore_cookie_to_browser()
+        _sync_restore_cookie_to_browser(
+            reload_parent=reload_after_cookie,
+        )
     _clear_login_request()
 
 
@@ -594,9 +638,16 @@ def _poll_login_once(
         st.stop()
 
     if status == "authenticated":
-        _store_authenticated_session(result)
+        # Cookie assignment is synchronous in the browser. The hidden command
+        # then reloads the top-level page, so the new initial request carries
+        # the restore cookie and the approved login UI is not mixed with the
+        # writing interface in the same Streamlit run.
+        _store_authenticated_session(
+            result,
+            reload_after_cookie=True,
+        )
         status_box.success(tr(language, "login_auto_success"))
-        st.rerun()
+        st.stop()
 
     _clear_login_request()
 
@@ -733,11 +784,13 @@ def logout_alipay_session(
         except Exception:
             pass
 
-    _delete_restore_cookie()
+    # Delete the browser token first, then let browser JavaScript reload the
+    # page. This avoids interrupting the cookie deletion with st.rerun().
+    _delete_restore_cookie(reload_parent=True)
     _clear_session(clear_restore=True)
     _clear_login_request()
     _clear_generation_session_state()
-    st.rerun()
+    st.stop()
 
 
 def render_logged_in_account(

requirements.txt

@@ -1,4 +1,4 @@
-streamlit==1.32.0
+streamlit==1.38.0
 requests
 python-docx
 pandas
@@ -15,4 +15,3 @@ tabulate
 pycryptodome
 qrcode[pil]>=8.0,<9
 streamlit-autorefresh==1.0.1
-extra-streamlit-components==0.1.71