Upload 4 files

README.md

@@ -133,4 +133,4 @@ See `CHANGELOG_V194.md` for the Model Pre-scan Decision Card UI pass.
 See `CHANGELOG_V195.md` for the Runtime CSS Cleanup with Legacy Safety Net pass.
 
 
-Current release: Agentic Space Factory v198.23.1.
+Current release: Agentic Space Factory v198.23.2.

app.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import os
 import re
 from pathlib import Path
 from typing import Any
@@ -408,11 +409,11 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
 
     @fastapi_app.get("/login/huggingface")
     async def login_redirect():  # type: ignore[no-untyped-def]
-        return RedirectResponse("/oauth/huggingface/login")
+        return RedirectResponse("/oauth/huggingface/login?_target_url=/")
 
     @fastapi_app.get("/logout")
     async def logout_redirect():  # type: ignore[no-untyped-def]
-        return RedirectResponse("/oauth/huggingface/logout")
+        return RedirectResponse("/oauth/huggingface/logout?_target_url=/")
 
     @fastapi_app.get("/api/app-info")
     async def api_app_info(request: Request):  # type: ignore[no-untyped-def]
@@ -522,8 +523,43 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
 
     @fastapi_app.get("/api/oauth/diagnostics")
     async def api_oauth_diagnostics(request: Request):  # type: ignore[no-untyped-def]
-        ctx = extract_oauth_context(request)
-        return JSONResponse({"user": public_oauth_context(ctx), "token_identity": verify_token_identity(ctx)})
+        """Public-safe OAuth diagnostics for iframe/sign-in troubleshooting.
+
+        This endpoint never exposes secrets. It is intentionally readable while
+        signed out so the UI/operator can tell whether OAuth routes and Space
+        metadata-derived environment variables are present before login works.
+        """
+        env_status = {
+            "space_id_present": bool(os.getenv("SPACE_ID")),
+            "space_host_present": bool(os.getenv("SPACE_HOST")),
+            "oauth_client_id_present": bool(os.getenv("OAUTH_CLIENT_ID")),
+            "oauth_client_secret_present": bool(os.getenv("OAUTH_CLIENT_SECRET")),
+            "oauth_scopes_present": bool(os.getenv("OAUTH_SCOPES")),
+            "openid_provider_url_present": bool(os.getenv("OPENID_PROVIDER_URL")),
+        }
+        try:
+            ctx = extract_oauth_context(request)
+        except HTTPException as exc:
+            return JSONResponse(
+                {
+                    "authenticated": False,
+                    "reason": exc.detail,
+                    "oauth_env": env_status,
+                    "login_url": "/oauth/huggingface/login?_target_url=/",
+                    "logout_url": "/oauth/huggingface/logout?_target_url=/",
+                    "embedded_login_advice": "Open sign-in in a new tab/window when the Space is embedded in an iframe.",
+                }
+            )
+        return JSONResponse(
+            {
+                "authenticated": True,
+                "user": public_oauth_context(ctx),
+                "token_identity": verify_token_identity(ctx),
+                "oauth_env": env_status,
+                "login_url": "/oauth/huggingface/login?_target_url=/",
+                "logout_url": "/oauth/huggingface/logout?_target_url=/",
+            }
+        )
 
     @fastapi_app.get("/api/billing/status")
     async def api_billing_status(request: Request):  # type: ignore[no-untyped-def]