Spaces:
Sleeping
Sleeping
Commit History
-
added good working stuff
69c9e26 -
Surface Drive-connection failures instead of swallowing them
Every failure in the Connect Drive / silent-refresh path was being caught and turned into a generic re-show-the-button state, with no way to tell what actually went wrong (missing refresh_token from Google, expired/revoked token, cookie decrypt failure from a changed encryption key). Now each failure mode shows a specific message, and a 'Drive connection diagnostics' expander reports whether a token cookie is present. Also switched the cookie's SameSite from this library's default 'strict' to 'lax', matching Streamlit's own auth cookie policy. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>fe83ebb -
Fix CachedWidgetWarning: don't cache the CookieManager component
st.cache_resource froze the component after its first render, so cookie reads/writes never reflected later changes. Fixed by constructing exactly one CookieManager per script run in app.py and threading it into cookie_token_store's functions as a parameter, rather than each function lazily constructing (and risking a second, same-keyed) instance internally -- calling stx.CookieManager(key=...) twice in one run raises DuplicateWidgetID. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>5be8e7e -
Wire app.py/secrets/requirements to the new cookie-based token store
Completes the previous commit -- these didn't get staged there because git add aborted when one of the paths in that batch (the deleted token_store.py) no longer existed. app.py now imports cookie_token_store instead of token_store; secrets.toml/bootstrap_secrets.py use a [cookies] section instead of [supabase]; requirements.txt swaps psycopg2-binary for extra-streamlit-components. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>2f83d3e -
Replace Supabase Postgres refresh-token storage with an encrypted cookie
Supabase connectivity didn't work out (this sandbox also can't reach port 5432 directly, and the pooler swap didn't resolve it either). Per user's direction, drop the Postgres dependency entirely and store the Google refresh_token in a long-lived, Fernet-encrypted browser cookie instead (extra-streamlit-components' CookieManager, since Streamlit page code has no direct access to set real HttpOnly cookies). Trade-off vs. the DB approach: this is per-browser/device, not centrally keyed by account -- a new device still needs to click Connect Drive once. The cookie only ever holds ciphertext; the decryption key stays server-side in secrets and never reaches the browser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>68e5370 -
Add Umami page-view tracking
Uses st.html(..., unsafe_allow_javascript=True) rather than components.html: the latter sandboxes content in its own iframe, so Umami would only ever see a meaningless iframe-scoped page instead of real top-level pageviews. Guarded by an element id so a Streamlit rerun (which happens on every interaction, not just navigation) never injects a duplicate script tag or fires an extra pageview beacon. Website ID/script URL are plain constants, not secrets -- they're visible in any page's source regardless. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>40f139d -
Add saved-players/game-history tabs and persistent Drive access via Supabase
- Points Tracker setup now has New Game / Saved Players / Game History tabs. Game name is picked from history (with a + New game name fallback) instead of always free-typed; Saved Players and Game History are read-only browsers backed by sheets_backend.list_players and the new list_game_names helper. - st.login() alone can never give us a refresh_token -- Streamlit's own _auth_callback discards anything but id_token/access_token before user code runs. Added a separate, one-time Connect Google Drive flow (src/google_oauth.py) using access_type=offline plus prompt=consent to force Google to issue one, and store it Fernet- encrypted in a Supabase Postgres table (src/token_store.py). On every subsequent login, app.py silently redeems a fresh access token from the stored refresh_token -- no repeat consent screen. Falls back to showing the Connect Drive button only when no valid session token and no usable stored refresh_token exist, and clears a revoked/invalid …76b596f
-
Switch Sheets persistence to per-user OAuth instead of a service account
Service accounts have zero Drive storage quota, so they can never create a new file (even in a folder shared with them) -- confirmed by testing the raw Drive API directly. Instead, request the drive.file scope during Google login and expose the resulting access token via Streamlit's expose_tokens=["access"], so each user's own account creates and owns their spreadsheet directly. Drops the service account, shared folder, and index-spreadsheet machinery entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>1b35f8e -
Add optional Google login with Sheets-backed persistence for Points Tracker
Anonymous play is unchanged. Logging in via the sidebar provisions a per-user Google Sheet (owned by a service account) with players and games_played worksheets, and Points Tracker writes player/round data to it as you play. Secrets are gitignored locally and can be assembled from individual env vars on deploy (src/bootstrap_secrets.py) so nothing sensitive needs to live in the image. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>5d4959a
-
Duplicate from streamlit/streamlit-template-space
Co-authored-by: Franck Abgrall <FranckAbgrall@users.noreply.huggingface.co>c6ed446
