Enabling login for oauth changes

Dockerfile

@@ -0,0 +1,21 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+RUN chmod +x /app/entrypoint.sh
+
+EXPOSE 8501
+
+HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health
+
+ENTRYPOINT ["/app/entrypoint.sh"]

README.md

@@ -3,9 +3,8 @@ title: NotebookLM
 emoji: 🚀
 colorFrom: red
 colorTo: red
-sdk: streamlit
-sdk_version: "1.44.1"
-app_file: app.py
+sdk: docker
+app_port: 8501
 hf_oauth: true
 hf_oauth_expiration_minutes: 480
 tags:

auth.py

@@ -2,23 +2,12 @@ import streamlit as st
 import os
 
 
-def _get_hf_user_info():
-    """Try available Streamlit user APIs (handles version differences)."""
-    # HF Streamlit SDK injects st.experimental_user with OAuth info
-    if hasattr(st, "experimental_user"):
-        return st.experimental_user
-    # Newer Streamlit versions may use st.user
-    if hasattr(st, "user") and callable(getattr(st.user, "get", None)):
-        return st.user
-    return None
-
-
 def get_current_user() -> dict | None:
     """
-    Get the currently logged-in user.
+    Get the currently logged-in user via Streamlit's native auth (st.user).
 
-    On HF Spaces (sdk: streamlit + hf_oauth: true):
-        HF handles OAuth and injects user info into Streamlit.
+    On HF Spaces: secrets.toml is auto-generated from HF OAuth env vars
+                  by entrypoint.sh, so st.login()/st.user just works.
     Locally: uses a dev user so the app is testable without OAuth.
 
     Returns dict with 'id' and 'name', or None if not authenticated.
@@ -26,15 +15,13 @@ def get_current_user() -> dict | None:
     is_hf_space = os.environ.get("SPACE_ID") is not None
 
     if is_hf_space:
-        user_info = _get_hf_user_info()
-        if user_info and user_info.get("is_logged_in"):
+        if st.user.is_logged_in:
             return {
-                "id": user_info.get("sub", user_info.get("name", "unknown")),
-                "name": user_info.get("name", "User"),
+                "id": st.user.get("sub", st.user.get("name", "unknown")),
+                "name": st.user.get("name", st.user.get("preferred_username", "User")),
             }
         return None
     else:
-        # Local development — use a mock user
         return {
             "id": "dev_user",
             "name": "Dev User (local)",
@@ -52,18 +39,14 @@ def require_auth() -> dict:
         st.markdown(
             '<div style="text-align:center; padding:60px 20px;">'
             '<h1>NotebookLM</h1>'
-            '<p style="color:#888; font-size:1.1rem;">Please log in with your Hugging Face account to continue.</p>'
+            '<p style="color:#888; font-size:1.1rem;">Sign in with your Hugging Face account to continue.</p>'
             "</div>",
             unsafe_allow_html=True,
         )
         _col1, col2, _col3 = st.columns([1, 1, 1])
         with col2:
-            st.link_button(
-                "Sign in with Hugging Face",
-                "/oauth/login",
-                use_container_width=True,
-                type="primary",
-            )
+            if st.button("Sign in with Hugging Face", use_container_width=True, type="primary"):
+                st.login()
         st.stop()
 
     return user

entrypoint.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+# Generate .streamlit/secrets.toml from HF OAuth environment variables
+mkdir -p /app/.streamlit
+
+REDIRECT="https://${SPACE_HOST}/oauth2callback"
+
+cat > /app/.streamlit/secrets.toml <<EOF
+[auth]
+redirect_uri = "${REDIRECT}"
+cookie_secret = "$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
+client_id = "${OAUTH_CLIENT_ID}"
+client_secret = "${OAUTH_CLIENT_SECRET}"
+server_metadata_url = "${OPENID_PROVIDER_URL}/.well-known/openid-configuration"
+EOF
+
+echo "Generated secrets.toml with redirect_uri=${REDIRECT}"
+
+exec streamlit run app.py \
+    --server.port=8501 \
+    --server.address=0.0.0.0 \
+    --server.enableCORS=false \
+    --server.enableXsrfProtection=false

requirements.txt

@@ -1 +1,2 @@
-streamlit>=1.31.0
+streamlit>=1.42.0
+authlib>=1.3.2