Spaces:
Running
Running
| """ | |
| gamify_gate.py — access gate shared by the three Hugging Face Spaces | |
| (Video Processor, Thumbnail Editor, Upload Center). | |
| admin.gamify.pt/home opens each tool in an IFRAME with https://<space>.hf.space/?__theme=dark&gate=<token> | |
| The token comes from make_gate_token() on the admin side: | |
| base64url(JSON {"u": user, "exp": unix_time, "src": "home"}) + "." + base64url(HMAC-SHA256(secret, payload)) | |
| Every request is checked on the server (signature + "exp"). The token is accepted from: | |
| 1. the URL (?gate=...) — the first page load | |
| 2. the page address the browser sends along — Gradio's own requests from that page (Referer) | |
| 3. a cookie set on the first page load — SameSite=None; Secure; Partitioned, so it also | |
| works inside the admin.gamify.pt iframe | |
| Files that are the same for everyone (Gradio's JS/CSS/fonts) are served without a token. | |
| When the token expires, the tool shows "open it again from admin.gamify.pt" and API calls get 401. | |
| Environment (Space settings → Variables and secrets) | |
| GAMIFY_GATE_SECRET (Secret) same value as on admin.gamify.pt — required | |
| GAMIFY_LOGIN_URL (Variable) default https://admin.gamify.pt/home | |
| Usage: from gamify_gate import GamifyGate; app.add_middleware(GamifyGate) | |
| """ | |
| import base64 | |
| import hashlib | |
| import hmac | |
| import html | |
| import json | |
| import logging | |
| import os | |
| import time | |
| from urllib.parse import parse_qsl, urlsplit | |
| COOKIE_NAME = "gamify_gate" | |
| TOKEN_PARAMS = ("gate", "token") | |
| REQUIRED_SRC = "home" | |
| OPEN_PATHS = ("/healthz", "/favicon.ico", "/manifest.json") | |
| OPEN_PREFIXES = ("/assets/", "/static/", "/gradio_api/static/") # Gradio's own JS/CSS/fonts (public anyway) | |
| def _b64e(raw: bytes) -> str: | |
| return base64.urlsafe_b64encode(raw).decode().rstrip("=") | |
| def _b64d(text: str) -> bytes: | |
| return base64.urlsafe_b64decode((text + "=" * (-len(text) % 4)).encode()) | |
| def verify_token(token, secret, now=None): | |
| """Returns the token's data {"u", "exp", "src"} if it is genuine and not expired, else None.""" | |
| if not token or not secret or token.count(".") != 1: | |
| return None | |
| payload, sig = token.split(".") | |
| expected = _b64e(hmac.new(secret.encode(), payload.encode(), hashlib.sha256).digest()) | |
| if not hmac.compare_digest(expected, sig): | |
| return None | |
| try: | |
| data = json.loads(_b64d(payload)) | |
| except (ValueError, TypeError): | |
| return None | |
| exp = data.get("exp") if isinstance(data, dict) else None | |
| if not isinstance(exp, (int, float)) or exp <= (now if now is not None else time.time()): | |
| return None | |
| if REQUIRED_SRC and data.get("src") != REQUIRED_SRC: | |
| return None | |
| return data | |
| def _token_from_query(query_string): | |
| for k, v in parse_qsl(query_string or "", keep_blank_values=True): | |
| if k in TOKEN_PARAMS: | |
| return v | |
| return None | |
| def _header(scope, name): | |
| for k, v in scope.get("headers") or []: | |
| if k.lower() == name: | |
| return v.decode("latin-1") | |
| return "" | |
| def _cookie_value(scope, name=COOKIE_NAME): | |
| for key, value in scope.get("headers") or []: | |
| if key.lower() != b"cookie": | |
| continue | |
| for part in value.decode("latin-1").split(";"): | |
| k, _, v = part.strip().partition("=") | |
| if k == name: | |
| return v | |
| return None | |
| EXPIRED_PAGE = """<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"> | |
| <title>Session expired</title></head> | |
| <body style="margin:0;height:100vh;display:flex;align-items:center;justify-content:center;background:#0D0E12; | |
| color:#ECEDF2;font-family:system-ui,sans-serif;text-align:center;padding:20px"> | |
| <div><div style="font-size:18px;font-weight:700;margin-bottom:8px">Session expired</div> | |
| <div style="color:#8C8FA0;margin-bottom:16px">Open this tool again from the GAMIFY admin panel.</div> | |
| <a href="{url}" target="_top" style="background:linear-gradient(90deg,#1ED6E0,#5C7CFF);color:#06131A; | |
| font-weight:800;padding:10px 18px;border-radius:10px;text-decoration:none">Go to admin.gamify.pt</a></div></body></html>""" | |
| class GamifyGate: | |
| """Pure ASGI middleware (doesn't buffer uploads or streams).""" | |
| def __init__(self, app, secret=None, login_url=None): | |
| self.app = app | |
| self.secret = (secret if secret is not None else os.environ.get("GAMIFY_GATE_SECRET", "")).strip() | |
| self.login_url = login_url or os.environ.get("GAMIFY_LOGIN_URL", "https://admin.gamify.pt/home") | |
| if not self.secret: | |
| logging.error("GAMIFY GATE: GAMIFY_GATE_SECRET is not set — nobody can open this tool") | |
| def _valid(self, token): | |
| return verify_token(token, self.secret) | |
| async def _respond(self, send, status, body=b"", headers=()): | |
| await send({"type": "http.response.start", "status": status, "headers": list(headers)}) | |
| await send({"type": "http.response.body", "body": body}) | |
| async def __call__(self, scope, receive, send): | |
| kind = scope.get("type") | |
| path = scope.get("path", "") | |
| if kind not in ("http", "websocket") or path in OPEN_PATHS or path.startswith(OPEN_PREFIXES): | |
| return await self.app(scope, receive, send) | |
| # 1) token in this request's URL (first load of the tool inside the iframe) | |
| url_token = _token_from_query(scope.get("query_string", b"").decode("latin-1")) | |
| data = self._valid(url_token) | |
| if data and kind == "http": | |
| max_age = max(int(data["exp"] - time.time()), 0) | |
| cookie = (f"{COOKIE_NAME}={url_token}; Max-Age={max_age}; Path=/; HttpOnly; " | |
| f"SameSite=None; Secure; Partitioned").encode() | |
| async def send_with_cookie(message): | |
| if message.get("type") == "http.response.start": | |
| message = dict(message) | |
| message["headers"] = list(message.get("headers") or []) + [(b"set-cookie", cookie)] | |
| await send(message) | |
| logging.info(f"GAMIFY GATE: access for {data.get('u')!r} until " | |
| f"{time.strftime('%Y-%m-%d %H:%M UTC', time.gmtime(data['exp']))}") | |
| return await self.app(scope, receive, send_with_cookie) | |
| if data: | |
| return await self.app(scope, receive, send) | |
| # 2) Gradio's own requests from that page carry the page address (with ?gate=...) | |
| referer = _header(scope, b"referer") | |
| if referer and self._valid(_token_from_query(urlsplit(referer).query)): | |
| return await self.app(scope, receive, send) | |
| # 3) the cookie set on the first load | |
| if self._valid(_cookie_value(scope)): | |
| return await self.app(scope, receive, send) | |
| # no valid token: never logged in, tampered, or expired | |
| if kind == "websocket": | |
| await receive() | |
| return await send({"type": "websocket.close", "code": 1008}) | |
| wants_page = scope.get("method") == "GET" and "text/html" in _header(scope, b"accept") | |
| if wants_page: | |
| body = EXPIRED_PAGE.replace("{url}", html.escape(self.login_url, quote=True)).encode() | |
| return await self._respond(send, 401, body, [(b"content-type", b"text/html; charset=utf-8"), | |
| (b"cache-control", b"no-store")]) | |
| return await self._respond( | |
| send, 401, | |
| b'{"error": "Session expired or missing - open this tool again from admin.gamify.pt"}', | |
| [(b"content-type", b"application/json")]) |