Wire app.py/secrets/requirements to the new cookie-based token store

Completes the previous commit -- these didn't get staged there because
git add aborted when one of the paths in that batch (the deleted
token_store.py) no longer existed. app.py now imports
cookie_token_store instead of token_store; secrets.toml/bootstrap_secrets.py
use a [cookies] section instead of [supabase]; requirements.txt swaps
psycopg2-binary for extra-streamlit-components.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -43,11 +43,16 @@ button) only ever handles identity -- it deliberately never exposes a
 logged in, a separate one-time **Connect Google Drive** button appears in the
 sidebar; clicking it runs its own OAuth exchange (`access_type=offline` +
 `prompt=consent`) to force Google to hand back a `refresh_token`, which gets
-encrypted and stored in a Supabase Postgres table keyed by email. From then
-on -- even after closing the browser, or logging in from a different device
--- the app silently mints a fresh access token from that stored refresh_token
-on every login; the Connect Drive button only reappears if that stored token
-is ever revoked (e.g. you remove the app's access in your Google account).
+encrypted and stored in a long-lived browser cookie (via
+`extra-streamlit-components`' `CookieManager`, since Streamlit page code has
+no direct access to set real HttpOnly cookies). From then on, on that same
+browser, the app silently mints a fresh access token from the stored
+refresh_token -- no repeat consent screen -- until it's revoked (e.g. you
+remove the app's access in your Google account) or the browser's cookies are
+cleared. This is per-browser/device, not per-account centrally: a new device
+or browser needs to click Connect Drive once, same as the very first time.
+The cookie only ever holds the encrypted blob; the decryption key lives
+purely in server-side secrets and never reaches the browser.
 
 ### One-time Google Cloud setup
 1. Create an OAuth 2.0 **Web application** Client ID; add your app's URL(s)
@@ -73,14 +78,9 @@ client_id = "<oauth client id>"
 client_secret = "<oauth client secret>"
 server_metadata_url = "https://accounts.google.com/.well-known/openid-configuration"
 
-[supabase]
-db_url = "postgresql://..."          # Supabase connection string
+[cookies]
 encryption_key = "<Fernet.generate_key() output>"
 ```
-The `[supabase]` table (`user_refresh_tokens`) is created automatically on
-first use -- no manual migration needed. Rotate the DB password in Supabase's
-dashboard if it's ever been pasted somewhere outside a secrets file (e.g.
-chat, a ticket, a terminal history you don't control).
 
 ### Hugging Face Space deploy
 `st.login()` only reads `st.secrets`, so `src/bootstrap_secrets.py` assembles
@@ -89,4 +89,4 @@ Variables and secrets), so nothing sensitive needs to live in the repo or the
 image: `AUTH_CLIENT_ID`, `AUTH_CLIENT_SECRET`, `AUTH_COOKIE_SECRET`,
 `AUTH_REDIRECT_URI` (your Space's public URL **with `/oauth2callback`
 appended**, e.g. `https://randomcatlover-boardgames-tracker.hf.space/oauth2callback`),
-`SUPABASE_DB_URL`, `SUPABASE_ENCRYPTION_KEY`.
+`COOKIE_ENCRYPTION_KEY`.

app.py

@@ -11,8 +11,8 @@ ensure_secrets_file()
 
 import streamlit as st
 
+import cookie_token_store
 import google_oauth
-import token_store
 from analytics import inject_umami
 
 st.set_page_config(page_title="Board Game Tracker", layout="wide")
@@ -64,8 +64,8 @@ def _handle_drive_oauth_callback() -> None:
         return
 
     refresh_token = tokens.get("refresh_token")
-    if refresh_token and "supabase" in st.secrets:
-        token_store.save_refresh_token(st.user.email, refresh_token)
+    if refresh_token and "cookies" in st.secrets:
+        cookie_token_store.save_refresh_token(st.user.email, refresh_token)
     _store_access_token(tokens)
     st.query_params.clear()
     st.rerun()
@@ -79,8 +79,8 @@ def _ensure_drive_access() -> None:
     if not st.user.is_logged_in or _access_token_valid():
         return
 
-    if "supabase" in st.secrets:
-        refresh_token = token_store.get_refresh_token(st.user.email)
+    if "cookies" in st.secrets:
+        refresh_token = cookie_token_store.get_refresh_token(st.user.email)
         if refresh_token:
             try:
                 tokens = google_oauth.refresh_access_token(
@@ -91,7 +91,7 @@ def _ensure_drive_access() -> None:
                 _store_access_token(tokens)
                 return
             except Exception:
-                token_store.delete_refresh_token(st.user.email)
+                cookie_token_store.delete_refresh_token(st.user.email)
 
     state = uuid.uuid4().hex
     st.session_state["drive_oauth_state"] = state

requirements.txt

@@ -6,6 +6,6 @@ google-auth
 Authlib
 httpx
 tomli_w
-psycopg2-binary
 cryptography
 requests
+extra-streamlit-components

src/bootstrap_secrets.py

@@ -19,9 +19,8 @@ def ensure_secrets_file() -> None:
             "client_secret": os.environ["AUTH_CLIENT_SECRET"],
             "server_metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
         },
-        "supabase": {
-            "db_url": os.environ["SUPABASE_DB_URL"],
-            "encryption_key": os.environ["SUPABASE_ENCRYPTION_KEY"],
+        "cookies": {
+            "encryption_key": os.environ["COOKIE_ENCRYPTION_KEY"],
         },
     }
     _SECRETS_PATH.write_text(tomli_w.dumps(data))