Fix CachedWidgetWarning: don't cache the CookieManager component

st.cache_resource froze the component after its first render, so
cookie reads/writes never reflected later changes. Fixed by
constructing exactly one CookieManager per script run in app.py and
threading it into cookie_token_store's functions as a parameter,
rather than each function lazily constructing (and risking a second,
same-keyed) instance internally -- calling
stx.CookieManager(key=...) twice in one run raises DuplicateWidgetID.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.py

@@ -41,7 +41,7 @@ def _access_token_valid() -> bool:
     )
 
 
-def _handle_drive_oauth_callback() -> None:
+def _handle_drive_oauth_callback(cookie_manager) -> None:
     """Completes the one-time "Connect Google Drive" exchange, if we're mid-flow."""
     if not st.user.is_logged_in:
         return
@@ -64,14 +64,14 @@ def _handle_drive_oauth_callback() -> None:
         return
 
     refresh_token = tokens.get("refresh_token")
-    if refresh_token and "cookies" in st.secrets:
-        cookie_token_store.save_refresh_token(st.user.email, refresh_token)
+    if refresh_token and cookie_manager is not None:
+        cookie_token_store.save_refresh_token(cookie_manager, st.user.email, refresh_token)
     _store_access_token(tokens)
     st.query_params.clear()
     st.rerun()
 
 
-def _ensure_drive_access() -> None:
+def _ensure_drive_access(cookie_manager) -> None:
     """Populates session_state's Drive access token, silently refreshing from a
     stored refresh_token when possible. Shows a one-time "Connect Google Drive"
     link only when neither a live token nor a stored refresh_token exists.
@@ -79,8 +79,8 @@ def _ensure_drive_access() -> None:
     if not st.user.is_logged_in or _access_token_valid():
         return
 
-    if "cookies" in st.secrets:
-        refresh_token = cookie_token_store.get_refresh_token(st.user.email)
+    if cookie_manager is not None:
+        refresh_token = cookie_token_store.get_refresh_token(cookie_manager, st.user.email)
         if refresh_token:
             try:
                 tokens = google_oauth.refresh_access_token(
@@ -91,7 +91,7 @@ def _ensure_drive_access() -> None:
                 _store_access_token(tokens)
                 return
             except Exception:
-                cookie_token_store.delete_refresh_token(st.user.email)
+                cookie_token_store.delete_refresh_token(cookie_manager, st.user.email)
 
     state = uuid.uuid4().hex
     st.session_state["drive_oauth_state"] = state
@@ -101,8 +101,11 @@ def _ensure_drive_access() -> None:
     st.link_button("Connect Google Drive", authorize_url)
 
 
+# Constructed at most once per script run -- see get_cookie_manager's docstring.
+_cookie_manager = cookie_token_store.get_cookie_manager() if "cookies" in st.secrets else None
+
 if "auth" in st.secrets:
-    _handle_drive_oauth_callback()
+    _handle_drive_oauth_callback(_cookie_manager)
 
 with st.sidebar:
     if "auth" not in st.secrets:
@@ -112,7 +115,7 @@ with st.sidebar:
     else:
         st.caption(f"Logged in as {st.user.email}")
         st.button("Log out", on_click=st.logout)
-        _ensure_drive_access()
+        _ensure_drive_access(_cookie_manager)
 
 home_page = st.Page("pages/home.py", title="Home", url_path="home", default=True)
 skull_king_page = st.Page("pages/skull_king.py", title="Skull King", url_path="skull_king")

src/cookie_token_store.py

@@ -8,8 +8,16 @@ from cryptography.fernet import Fernet
 _COOKIE_MAX_AGE_DAYS = 400  # ~ the longest lifetime browsers allow anyway (Chrome caps at 400 days)
 
 
-@st.cache_resource
-def _cookie_manager() -> stx.CookieManager:
+def get_cookie_manager() -> stx.CookieManager:
+    """Constructs the cookie-sync component.
+
+    Must be called exactly once per script run (not cached, not called more
+    than once) -- the underlying component re-renders every rerun to report
+    the browser's current cookies back to Python, so caching it (via
+    st.cache_resource or otherwise) freezes it stale, and constructing a
+    second instance with the same key in the same run raises
+    DuplicateWidgetID.
+    """
     return stx.CookieManager(key="bgt_cookie_manager")
 
 
@@ -22,16 +30,15 @@ def _cookie_name(email: str) -> str:
     return "bgt_rt_" + hashlib.sha256(email.encode()).hexdigest()[:16]
 
 
-def save_refresh_token(email: str, refresh_token: str) -> None:
+def save_refresh_token(cookie_manager: stx.CookieManager, email: str, refresh_token: str) -> None:
     encrypted = _fernet().encrypt(refresh_token.encode()).decode()
     expires_at = datetime.now(timezone.utc) + timedelta(days=_COOKIE_MAX_AGE_DAYS)
-    _cookie_manager().set(
-        _cookie_name(email), encrypted, expires_at=expires_at, key=f"set_{_cookie_name(email)}"
-    )
+    name = _cookie_name(email)
+    cookie_manager.set(name, encrypted, expires_at=expires_at, key=f"set_{name}")
 
 
-def get_refresh_token(email: str) -> str | None:
-    encrypted = _cookie_manager().get(_cookie_name(email))
+def get_refresh_token(cookie_manager: stx.CookieManager, email: str) -> str | None:
+    encrypted = cookie_manager.get(_cookie_name(email))
     if not encrypted:
         return None
     try:
@@ -40,7 +47,7 @@ def get_refresh_token(email: str) -> str | None:
         return None
 
 
-def delete_refresh_token(email: str) -> None:
+def delete_refresh_token(cookie_manager: stx.CookieManager, email: str) -> None:
     name = _cookie_name(email)
-    if _cookie_manager().get(name) is not None:
-        _cookie_manager().delete(name, key=f"delete_{name}")
+    if cookie_manager.get(name) is not None:
+        cookie_manager.delete(name, key=f"delete_{name}")