CI deploy b5b8ab30

app.py

@@ -764,16 +764,15 @@ def build_app() -> gr.Blocks:
         # is exactly what broke the UI while leaving the API working.
         demo.load(fn=None, inputs=None, outputs=None, js=BRIDGE_LOAD_JS)
 
-        # Sign-in state is only meaningful on a Space. Off-Space, Gradio mocks
-        # OAuth by calling whoami and raises without a token, so this handler
-        # is only registered where OAuth actually exists.
-        if ON_SPACE:
-            def whoami(st, profile: gr.OAuthProfile | None = None):
-                st = copy.deepcopy(st)
-                st["user"] = getattr(profile, "username", None) if profile else None
-                return st, render_top(st, None)
-
-            demo.load(whoami, [state], [state, top_html])
+        # No OAuth-annotated `demo.load` here, deliberately. A handler that
+        # takes `gr.OAuthProfile` asks Gradio for an authenticated session; on
+        # a *load* event that fires every render, an unauthenticated visitor is
+        # sent to sign in, comes back, fires load again, and is sent to sign in
+        # again -- the browser reports it as "redirected you too many times".
+        #
+        # `gr.LoginButton` already shows signed-in state on its own, and the
+        # profile is read where it is actually needed: the user-initiated
+        # extension handlers in src/extension.py.
 
     return demo
 

tests/test_ui.py

@@ -736,3 +736,44 @@ def test_bridge_js_is_loaded_without_outputs():
 
     src = inspect.getsource(bitapp.build_app)
     assert "demo.load(fn=None, inputs=None, outputs=None, js=BRIDGE_LOAD_JS)" in src
+
+
+def test_no_oauth_annotated_load_handler():
+    """A `demo.load` handler that takes `gr.OAuthProfile` asks for an
+    authenticated session on every page render. An unauthenticated visitor is
+    sent to sign in, returns, fires load again, and is sent back -- an infinite
+    redirect. The profile belongs on user-initiated handlers only."""
+    import inspect
+    import re
+
+    src = inspect.getsource(bitapp.build_app)
+    # Strip comments so the explanation of this rule does not trip it.
+    code = "\n".join(ln for ln in src.splitlines()
+                     if not ln.lstrip().startswith("#"))
+    assert "OAuthProfile" not in code, \
+        "an OAuth-annotated handler is registered in build_app"
+
+    for call in re.findall(r"demo\.load\((.*?)\)\n", code, re.S):
+        assert "profile" not in call, f"load handler takes a profile: {call[:80]}"
+
+
+def test_profile_is_read_only_on_user_initiated_handlers():
+    """Where the profile *is* needed, it must hang off a click, not a load."""
+    import inspect
+
+    from src import extension
+
+    for fn in (extension.extend_ui, extension.add_model_ui):
+        params = inspect.signature(fn).parameters
+        assert "profile" in params, f"{fn.__name__} should receive the profile"
+
+
+def test_login_button_is_the_only_sign_in_mechanism():
+    import inspect
+
+    from src.ui import shell
+
+    src = inspect.getsource(bitapp.build_app)
+    assert "gr.LoginButton" in src
+    # The header must not also hand-roll a link to the OAuth route.
+    assert "/login/huggingface" not in shell.top_bar(on_space=True)