Implement HF token authentication - prevent unauthorized memory access

app.py

@@ -361,28 +361,56 @@ with st.sidebar:
     # Check if we're on Hugging Face Spaces (not local)
     is_hf_space = os.getenv("SPACE_ID") is not None or os.getenv("HF_ENDPOINT") is not None
     
+    def validate_hf_token(token: str) -> tuple[bool, str]:
+        """Validate HF token and return (is_valid, username)."""
+        try:
+            headers = {"Authorization": f"Bearer {token}"}
+            resp = requests.get("https://huggingface.co/api/whoami", headers=headers, timeout=5)
+            if resp.status_code == 200:
+                user_data = resp.json()
+                username = user_data.get("name", "")
+                return True, username
+            return False, ""
+        except Exception:
+            return False, ""
+    
     if is_hf_space:
-        # On HF Spaces - require username input for security
-        if "hf_username" not in st.session_state:
-            st.warning("⚠️ Please enter your Hugging Face username to access your personalized memories.")
-            username_input = st.text_input(
-                "Enter your Hugging Face username",
-                key="hf_username_input",
-                placeholder="your-hf-username"
+        # On HF Spaces - require token authentication for security
+        if "hf_authenticated_user" not in st.session_state:
+            st.warning("🔐 **Authentication Required**")
+            st.caption("To protect your memories, please authenticate with your Hugging Face account.")
+            
+            token_input = st.text_input(
+                "Enter your Hugging Face Access Token",
+                key="hf_token_input",
+                type="password",
+                placeholder="hf_xxxxxxxxxxxxxxxxxxxxx",
+                help="Get your token from: https://huggingface.co/settings/tokens"
             )
-            if st.button("Set Username", use_container_width=True):
-                if username_input.strip():
-                    st.session_state.hf_username = username_input.strip()
-                    st.rerun()
+            
+            if st.button("Authenticate", use_container_width=True, type="primary"):
+                if token_input.strip():
+                    is_valid, username = validate_hf_token(token_input.strip())
+                    if is_valid and username:
+                        st.session_state.hf_authenticated_user = username
+                        st.session_state.hf_token = token_input.strip()  # Store for future use
+                        st.success(f"✅ Authenticated as **{username}**")
+                        st.rerun()
+                    else:
+                        st.error("❌ Invalid token. Please check your Hugging Face access token.")
                 else:
-                    st.error("Please enter a valid username")
+                    st.error("Please enter your access token")
+            st.info("💡 **Privacy Note:** Your token is stored only in this session and never shared.")
             st.stop()
         else:
-            # Username is set - lock it
-            persona_name = st.session_state.hf_username
-            st.info(f"👤 Using account: **{persona_name}**")
-            if st.button("Change Username", use_container_width=True):
-                del st.session_state.hf_username
+            # User is authenticated - lock to their username
+            persona_name = st.session_state.hf_authenticated_user
+            st.success(f"🔐 Authenticated as: **{persona_name}**")
+            st.caption("Your memories are secured to your account only.")
+            if st.button("🔓 Sign Out", use_container_width=True):
+                del st.session_state.hf_authenticated_user
+                if "hf_token" in st.session_state:
+                    del st.session_state.hf_token
                 st.rerun()
     elif hf_user_id:
         # HF user ID detected automatically