Spaces:
Sleeping
Sleeping
Commit History
-
added good working stuff
69c9e26 -
Fix refresh_token cookie never actually being written
st.rerun() immediately after cookie_manager.set(...) aborted the script run before the browser could mount the cookie-manager's 'set' component and run the JS that actually writes document.cookie -- so the encrypted refresh_token never reached the browser, and every later visit correctly (if uselessly) reported no cookie present. Removed the rerun; the callback already updates session_state directly, so the rest of this same run (sidebar, page) already reflects the fresh access token without needing to restart the script. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>fcb850d -
Surface Drive-connection failures instead of swallowing them
Every failure in the Connect Drive / silent-refresh path was being caught and turned into a generic re-show-the-button state, with no way to tell what actually went wrong (missing refresh_token from Google, expired/revoked token, cookie decrypt failure from a changed encryption key). Now each failure mode shows a specific message, and a 'Drive connection diagnostics' expander reports whether a token cookie is present. Also switched the cookie's SameSite from this library's default 'strict' to 'lax', matching Streamlit's own auth cookie policy. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>fe83ebb -
Fix CachedWidgetWarning: don't cache the CookieManager component
st.cache_resource froze the component after its first render, so cookie reads/writes never reflected later changes. Fixed by constructing exactly one CookieManager per script run in app.py and threading it into cookie_token_store's functions as a parameter, rather than each function lazily constructing (and risking a second, same-keyed) instance internally -- calling stx.CookieManager(key=...) twice in one run raises DuplicateWidgetID. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>5be8e7e -
Wire app.py/secrets/requirements to the new cookie-based token store
Completes the previous commit -- these didn't get staged there because git add aborted when one of the paths in that batch (the deleted token_store.py) no longer existed. app.py now imports cookie_token_store instead of token_store; secrets.toml/bootstrap_secrets.py use a [cookies] section instead of [supabase]; requirements.txt swaps psycopg2-binary for extra-streamlit-components. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>2f83d3e -
Replace Supabase Postgres refresh-token storage with an encrypted cookie
Supabase connectivity didn't work out (this sandbox also can't reach port 5432 directly, and the pooler swap didn't resolve it either). Per user's direction, drop the Postgres dependency entirely and store the Google refresh_token in a long-lived, Fernet-encrypted browser cookie instead (extra-streamlit-components' CookieManager, since Streamlit page code has no direct access to set real HttpOnly cookies). Trade-off vs. the DB approach: this is per-browser/device, not centrally keyed by account -- a new device still needs to click Connect Drive once. The cookie only ever holds ciphertext; the decryption key stays server-side in secrets and never reaches the browser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>68e5370 -
Add Umami page-view tracking
Uses st.html(..., unsafe_allow_javascript=True) rather than components.html: the latter sandboxes content in its own iframe, so Umami would only ever see a meaningless iframe-scoped page instead of real top-level pageviews. Guarded by an element id so a Streamlit rerun (which happens on every interaction, not just navigation) never injects a duplicate script tag or fires an extra pageview beacon. Website ID/script URL are plain constants, not secrets -- they're visible in any page's source regardless. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>40f139d -
Document the Connect Drive / Supabase refresh-token flow
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>c5a7532 -
Add saved-players/game-history tabs and persistent Drive access via Supabase
- Points Tracker setup now has New Game / Saved Players / Game History tabs. Game name is picked from history (with a + New game name fallback) instead of always free-typed; Saved Players and Game History are read-only browsers backed by sheets_backend.list_players and the new list_game_names helper. - st.login() alone can never give us a refresh_token -- Streamlit's own _auth_callback discards anything but id_token/access_token before user code runs. Added a separate, one-time Connect Google Drive flow (src/google_oauth.py) using access_type=offline plus prompt=consent to force Google to issue one, and store it Fernet- encrypted in a Supabase Postgres table (src/token_store.py). On every subsequent login, app.py silently redeems a fresh access token from the stored refresh_token -- no repeat consent screen. Falls back to showing the Connect Drive button only when no valid session token and no usable stored refresh_token exist, and clears a revoked/invalid …76b596f
-
Document the required /oauth2callback redirect_uri path
Login appeared to succeed (no error) but st.user.is_logged_in never became True. Root cause: Streamlit only processes the OAuth code exchange at the hardcoded /oauth2callback route, but redirect_uri was set to the bare app URL, matching what was already registered in Google Cloud Console. Google therefore redirected back to the plain home page, whose normal route silently ignores the leftover code/state query params, so the auth cookie never gets set. Fixed local secrets.toml and documented that both the Google Cloud OAuth client's authorized redirect URIs and AUTH_REDIRECT_URI need the /oauth2callback suffix. Verified by inspecting the real /auth/login redirect Location header end-to-end. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>62e957f -
Add missing httpx dependency for Authlib's Starlette OAuth client
Deployed login crashed with ModuleNotFoundError: httpx, since Authlib's starlette_client integration imports httpx for its async HTTP client but it wasn't in requirements.txt. Verified by hitting the real /auth/login route end-to-end and confirming it now 302s to Google's consent screen instead of 500ing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>6c653a2 -
Switch Sheets persistence to per-user OAuth instead of a service account
Service accounts have zero Drive storage quota, so they can never create a new file (even in a folder shared with them) -- confirmed by testing the raw Drive API directly. Instead, request the drive.file scope during Google login and expose the resulting access token via Streamlit's expose_tokens=["access"], so each user's own account creates and owns their spreadsheet directly. Drops the service account, shared folder, and index-spreadsheet machinery entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>1b35f8e -
Add optional Google login with Sheets-backed persistence for Points Tracker
Anonymous play is unchanged. Logging in via the sidebar provisions a per-user Google Sheet (owned by a service account) with players and games_played worksheets, and Points Tracker writes player/round data to it as you play. Secrets are gitignored locally and can be assembled from individual env vars on deploy (src/bootstrap_secrets.py) so nothing sensitive needs to live in the image. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>5d4959a -
added better multigame
7e1ff1d
-
new tracker
2377378
-
Update pages/skull_king.py
Verified signatureincriment 10f7b1a7b -
Update Dockerfile
Verified signature01fc953 -
Upload 4 files
Verified signature7d74b4c -
initial commit
Verified signature694ff80 -
Duplicate from streamlit/streamlit-template-space
Co-authored-by: Franck Abgrall <FranckAbgrall@users.noreply.huggingface.co>c6ed446
