Upload 4 files

README.md

@@ -133,9 +133,9 @@ See `CHANGELOG_V194.md` for the Model Pre-scan Decision Card UI pass.
 See `CHANGELOG_V195.md` for the Runtime CSS Cleanup with Legacy Safety Net pass.
 
 
-Current release: Agentic Space Factory v198.26.11.
+Current release: Agentic Space Factory v198.26.12.
 
 
-## v198.26.11 — Live Test Clarity
+## v198.26.12 — OAuth Recovery
 
-See `CHANGELOG_V198_26_11.md`.
+See `CHANGELOG_V198_26_12.md`.

app.py

@@ -97,6 +97,53 @@ def _oauth_context_from_request(request: Request) -> dict[str, Any]:
         "warnings": oauth_warning_messages(ctx),
     }
 
+
+def _clear_local_oauth_session(request: Request) -> dict[str, Any]:
+    """Clear ASF/HF OAuth session state without requiring a valid token.
+
+    This is intentionally tolerant: expired OAuth sessions must be recoverable
+    even when parse_huggingface_oauth/extract_oauth_context can no longer
+    deserialize or validate the token.
+    """
+    cleared_keys: list[str] = []
+    had_session = False
+    try:
+        session = request.session  # type: ignore[attr-defined]
+        had_session = bool(session)
+        for key in list(session.keys()):
+            key_l = str(key).lower()
+            if "oauth" in key_l or "huggingface" in key_l or key_l in {"state", "nonce", "next", "redirect_uri"}:
+                cleared_keys.append(str(key))
+        session.clear()
+    except Exception:
+        had_session = False
+    return {"cleared": True, "had_session": had_session, "cleared_keys": sorted(set(cleared_keys))}
+
+
+def _auth_recovery_payload(reason: str = "not_authenticated", detail: str | None = None) -> dict[str, Any]:
+    reason_l = (reason or "not_authenticated").lower()
+    if "expired" in reason_l or (detail and "expired" in detail.lower()):
+        reason_l = "oauth_expired"
+        message = "Your Hugging Face OAuth session expired. Refresh sign-in to continue."
+    else:
+        reason_l = "not_signed_in" if reason_l in {"not_authenticated", "please sign in with hugging face first."} else reason_l
+        message = "Sign in with Hugging Face to continue."
+    return {
+        "authenticated": False,
+        "reason": reason_l,
+        "message": message,
+        "login_url": "/oauth/huggingface/login",
+        "refresh_login_url": "/auth/refresh-login",
+        "reset_url": "/auth/logout-local",
+        "logout_url": "/auth/logout-local",
+        "recovery": {
+            "primary_action": "refresh_sign_in" if reason_l == "oauth_expired" else "sign_in",
+            "refresh_login_url": "/auth/refresh-login",
+            "reset_local_auth_url": "/auth/logout-local",
+            "open_in_new_tab_recommended": True,
+        },
+    }
+
 def _json_error(exc: Exception) -> HTTPException:
     if isinstance(exc, HTTPException):
         return exc
@@ -548,6 +595,37 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
         # redirect without custom target parameters to avoid OAuth loops.
         return RedirectResponse("/oauth/huggingface/logout", status_code=307)
 
+    @fastapi_app.get("/auth/logout-local")
+    async def auth_logout_local(request: Request):  # type: ignore[no-untyped-def]
+        # Local reset must work even when the HF OAuth token is expired and the
+        # official helper can no longer parse the session.
+        _clear_local_oauth_session(request)
+        response = RedirectResponse("/", status_code=303)
+        response.delete_cookie("session")
+        response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        return response
+
+    @fastapi_app.get("/auth/refresh-login")
+    async def auth_refresh_login(request: Request):  # type: ignore[no-untyped-def]
+        # Force a clean re-authorization path. This avoids stale oauth_info
+        # state after token expiry and should make Space duplication unnecessary.
+        _clear_local_oauth_session(request)
+        response = RedirectResponse("/oauth/huggingface/login", status_code=303)
+        response.delete_cookie("session")
+        response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        return response
+
+    @fastapi_app.get("/auth/logout-and-refresh")
+    async def auth_logout_and_refresh(request: Request):  # type: ignore[no-untyped-def]
+        _clear_local_oauth_session(request)
+        response = RedirectResponse("/auth/refresh-login", status_code=303)
+        response.delete_cookie("session")
+        response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
+        response.headers["Pragma"] = "no-cache"
+        return response
+
     @fastapi_app.get("/", response_class=HTMLResponse)
     @fastapi_app.get("/custom", response_class=HTMLResponse)
     async def custom_index():  # type: ignore[no-untyped-def]
@@ -589,16 +667,24 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
                 "custom_ui_status": "root_custom_ui",
                 "user": {"username": ctx["username"], "missing_scopes": ctx.get("missing_scopes", []), "warnings": ctx.get("warnings", []), "auth_lifetime": ctx.get("auth_lifetime")} if ctx else None,
                 "login_url": "/oauth/huggingface/login",
-                "logout_url": "/oauth/huggingface/logout",
+                "refresh_login_url": "/auth/refresh-login",
+                "reset_auth_url": "/auth/logout-local",
+                "logout_url": "/auth/logout-local",
                 "anonymous_eval": public_eval_config(ctx["username"] if ctx else None),
             }
         )
 
     @fastapi_app.get("/api/me")
     async def api_me(request: Request):  # type: ignore[no-untyped-def]
-        ctx = _oauth_context_from_request(request)
+        try:
+            ctx = _oauth_context_from_request(request)
+        except HTTPException as exc:
+            payload = _auth_recovery_payload(str(exc.detail), str(exc.detail))
+            payload["anonymous_eval"] = public_eval_config(None)
+            return JSONResponse(payload, status_code=401)
         return JSONResponse(
             {
+                "authenticated": True,
                 "username": ctx["username"],
                 "profile": {
                     "name": ctx["profile"].get("name"),
@@ -614,7 +700,9 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
                 "anonymous_eval": public_eval_config(ctx["username"] if ctx else None),
                 "expires_at": ctx.get("expires_at"),
                 "login_url": "/oauth/huggingface/login",
-                "logout_url": "/oauth/huggingface/logout",
+                "refresh_login_url": "/auth/refresh-login",
+                "reset_url": "/auth/logout-local",
+                "logout_url": "/auth/logout-local",
             }
         )
 
@@ -723,7 +811,10 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
                     "reason": exc.detail,
                     "oauth_env": env_status,
                     "login_url": "/oauth/huggingface/login",
-                    "logout_url": "/oauth/huggingface/logout",
+                    "refresh_login_url": "/auth/refresh-login",
+                    "reset_url": "/auth/logout-local",
+                    "logout_url": "/auth/logout-local",
+                    "recommended_action": "refresh_sign_in" if "expired" in str(exc.detail).lower() else "sign_in",
                 }
             )
         return JSONResponse(
@@ -733,7 +824,9 @@ def register_custom_routes(fastapi_app: FastAPI) -> None:
                 "token_identity": verify_token_identity(ctx),
                 "oauth_env": env_status,
                 "login_url": "/oauth/huggingface/login",
-                "logout_url": "/oauth/huggingface/logout",
+                "refresh_login_url": "/auth/refresh-login",
+                "reset_url": "/auth/logout-local",
+                "logout_url": "/auth/logout-local",
             }
         )