Improve HF token validation with better error messages and debugging

app.py

@@ -361,18 +361,58 @@ with st.sidebar:
     # Check if we're on Hugging Face Spaces (not local)
     is_hf_space = os.getenv("SPACE_ID") is not None or os.getenv("HF_ENDPOINT") is not None
     
-    def validate_hf_token(token: str) -> tuple[bool, str]:
-        """Validate HF token and return (is_valid, username)."""
+    def validate_hf_token(token: str) -> tuple[bool, str, str]:
+        """Validate HF token and return (is_valid, username, error_message)."""
+        token = token.strip()
+        if not token:
+            return False, "", "Token cannot be empty"
+        
+        # Use the HF whoami endpoint
+        endpoint = "https://huggingface.co/api/whoami"
+        headers = {"Authorization": f"Bearer {token}"}
+        
         try:
-            headers = {"Authorization": f"Bearer {token}"}
-            resp = requests.get("https://huggingface.co/api/whoami", headers=headers, timeout=5)
+            resp = requests.get(endpoint, headers=headers, timeout=10)
+            
             if resp.status_code == 200:
                 user_data = resp.json()
-                username = user_data.get("name", "")
-                return True, username
-            return False, ""
-        except Exception:
-            return False, ""
+                # Try different possible username fields
+                username = (
+                    user_data.get("name") or 
+                    user_data.get("username") or 
+                    user_data.get("user") or
+                    ""
+                )
+                if username:
+                    return True, username, ""
+                else:
+                    # Log the response for debugging
+                    return False, "", f"Token validated but username not found. Please try regenerating your token."
+            elif resp.status_code == 401:
+                error_detail = ""
+                try:
+                    error_data = resp.json()
+                    error_detail = error_data.get("error", "")
+                except:
+                    pass
+                return False, "", f"Invalid token (401 Unauthorized). {error_detail} Please check your token at https://huggingface.co/settings/tokens"
+            elif resp.status_code == 403:
+                return False, "", f"Token access denied (403 Forbidden). Please ensure your token has read permissions."
+            else:
+                error_text = ""
+                try:
+                    error_data = resp.json()
+                    error_text = error_data.get("error", resp.text[:100])
+                except:
+                    error_text = resp.text[:100] if hasattr(resp, 'text') else f"Status {resp.status_code}"
+                return False, "", f"Authentication failed (Status {resp.status_code}): {error_text}"
+                
+        except requests.exceptions.Timeout:
+            return False, "", "Request timed out. Please check your internet connection and try again."
+        except requests.exceptions.RequestException as e:
+            return False, "", f"Network error: {str(e)}. Please try again."
+        except Exception as e:
+            return False, "", f"Validation error: {str(e)}. Please try again."
     
     if is_hf_space:
         # On HF Spaces - require token authentication for security
@@ -390,14 +430,16 @@ with st.sidebar:
             
             if st.button("Authenticate", use_container_width=True, type="primary"):
                 if token_input.strip():
-                    is_valid, username = validate_hf_token(token_input.strip())
+                    with st.spinner("Validating token..."):
+                        is_valid, username, error_msg = validate_hf_token(token_input.strip())
                     if is_valid and username:
                         st.session_state.hf_authenticated_user = username
                         st.session_state.hf_token = token_input.strip()  # Store for future use
                         st.success(f"✅ Authenticated as **{username}**")
                         st.rerun()
                     else:
-                        st.error("❌ Invalid token. Please check your Hugging Face access token.")
+                        error_display = error_msg if error_msg else "Invalid token. Please check your Hugging Face access token."
+                        st.error(f"❌ {error_display}")
                 else:
                     st.error("Please enter your access token")
             st.info("💡 **Privacy Note:** Your token is stored only in this session and never shared.")