Fix: load Google credentials from env var for HuggingFace Spaces deployment

Dockerfile

@@ -12,10 +12,7 @@ RUN uv sync --no-dev --no-install-project
 # Copy source
 COPY . .
 
-COPY credentials/creds.json /app/credentials/creds.json
-
 ENV PATH="/app/.venv/bin:$PATH"
-ENV GOOGLE_APPLICATION_CREDENTIALS=/app/credentials/creds.json
 
 EXPOSE 7860
 

src/google_auth.py

@@ -1,3 +1,4 @@
+import json
 import os
 import logging
 from typing import Optional
@@ -14,20 +15,30 @@ _SCOPES = ["https://www.googleapis.com/auth/cloud-platform"]
 def get_google_credentials() -> google.auth.credentials.Credentials:
     """
     Resolution order:
-    1. GOOGLE_APPLICATION_CREDENTIALS env var set & file exists → service account JSON
-    2. Fallback → ADC (gcloud auth application-default login)
+    1. GOOGLE_CREDENTIALS_JSON env var (raw JSON string) → service account info
+    2. GOOGLE_APPLICATION_CREDENTIALS env var set & file exists → service account file
+    3. Fallback → ADC (gcloud auth application-default login)
     """
-    creds_path: Optional[str] = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")
+    creds_json: Optional[str] = os.environ.get("GOOGLE_CREDENTIALS_JSON")
+    if creds_json:
+        logger.info("Google auth: service account dari GOOGLE_CREDENTIALS_JSON")
+        # Value may be raw JSON or base64-encoded JSON
+        try:
+            import base64
+            decoded = base64.b64decode(creds_json).decode("utf-8")
+            info = json.loads(decoded)
+        except Exception:
+            info = json.loads(creds_json)
+        return service_account.Credentials.from_service_account_info(info, scopes=_SCOPES)
 
+    creds_path: Optional[str] = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")
     if creds_path:
         if not os.path.isfile(creds_path):
             raise FileNotFoundError(
                 f"GOOGLE_APPLICATION_CREDENTIALS='{creds_path}' tapi file tidak ditemukan."
             )
         logger.info("Google auth: service account dari %s", creds_path)
-        return service_account.Credentials.from_service_account_file(
-            creds_path, scopes=_SCOPES
-        )
+        return service_account.Credentials.from_service_account_file(creds_path, scopes=_SCOPES)
 
     logger.info("Google auth: menggunakan ADC (gcloud login)")
     credentials, _ = google.auth.default(scopes=_SCOPES)