Update app.py

app.py

@@ -4,7 +4,7 @@ from pathlib import Path
 import os
 from huggingface_hub import list_models
 
-# list_spaces is not guaranteed to exist in all HF runtimes
+# Optional: Spaces API might not exist
 try:
     from huggingface_hub import list_spaces
 except ImportError:
@@ -13,8 +13,8 @@ except ImportError:
 # ===============================
 # Configuration
 # ===============================
-OWNER_USERNAME = "RetroGazzaSpurs"  # HF username
-current_user = os.environ.get("HUGGINGFACE_HUB_USER", "")
+# Password is stored securely as a Hugging Face secret, not in code
+UPLOAD_PASSWORD = os.environ.get("UPLOAD_PASSWORD")  # must be set in Space secrets
 
 WORKFLOW_DIR = Path("/data/workflows")
 WORKFLOW_IMG_DIR = Path("/data/workflows_images")
@@ -27,11 +27,14 @@ for d in [WORKFLOW_DIR, WORKFLOW_IMG_DIR, LORA_DIR, LORA_IMG_DIR]:
 ALLOWED_FILE_EXTS = {".json", ".yaml", ".yml", ".png", ".safetensors", ".ckpt"}
 ALLOWED_IMG_EXTS = {".png", ".jpg", ".jpeg", ".webp"}
 
-
 # ===============================
 # Upload handlers
 # ===============================
-def upload_workflow(file, image=None):
+def upload_workflow(file, image=None, password=""):
+    if UPLOAD_PASSWORD is None:
+        return "❌ Upload password not set in Space secrets."
+    if password != UPLOAD_PASSWORD:
+        return "❌ Unauthorized"
     if file is None:
         return "No file uploaded."
     src = Path(file.name)
@@ -40,7 +43,6 @@ def upload_workflow(file, image=None):
         return f"❌ Unsupported file type: `{ext}`"
     dest = WORKFLOW_DIR / src.name
     shutil.copy(src, dest)
-    # handle optional image
     if image:
         img_ext = Path(image.name).suffix.lower()
         if img_ext in ALLOWED_IMG_EXTS:
@@ -48,7 +50,11 @@ def upload_workflow(file, image=None):
     return f"✅ Saved workflow: `{dest.name}`"
 
 
-def upload_lora(file, image=None):
+def upload_lora(file, image=None, password=""):
+    if UPLOAD_PASSWORD is None:
+        return "❌ Upload password not set in Space secrets."
+    if password != UPLOAD_PASSWORD:
+        return "❌ Unauthorized"
     if file is None:
         return "No file uploaded."
     src = Path(file.name)
@@ -63,9 +69,8 @@ def upload_lora(file, image=None):
             shutil.copy(image.name, LORA_IMG_DIR / (src.stem + img_ext))
     return f"✅ Saved LoRA: `{dest.name}`"
 
-
 # ===============================
-# Listing functions with images
+# Listing functions
 # ===============================
 def list_uploaded_workflows():
     files = sorted(WORKFLOW_DIR.glob("*"))
@@ -94,7 +99,6 @@ def list_uploaded_loras():
             md += f"### {f.name}\n(no image)\n---\n"
     return md
 
-
 # ===============================
 # Hub browsing functions
 # ===============================
@@ -108,9 +112,7 @@ def browse_loras(limit=20):
     if not models:
         return "No LoRAs found."
     return "\n---\n".join(
-        f"### {m.modelId}\n"
-        f"⬇️ {m.downloads or 0} | ⭐ {m.likes or 0}\n"
-        f"https://huggingface.co/{m.modelId}"
+        f"### {m.modelId}\n⬇️ {m.downloads or 0} | ⭐ {m.likes or 0}\nhttps://huggingface.co/{m.modelId}"
         for m in models
     )
 
@@ -144,7 +146,6 @@ def browse_workflows(limit=20):
             remote_md = "No community workflows found."
     return uploaded_md + "\n\n" + remote_md
 
-
 # ===============================
 # Gradio UI
 # ===============================
@@ -168,41 +169,40 @@ with gr.Blocks() as demo:
                 outputs=lora_out,
             )
 
-        # Upload tabs visible only to owner
-        if current_user == OWNER_USERNAME:
-            # Upload Workflow
-            with gr.Tab("⬆️ Upload Workflow"):
-                gr.Markdown("Upload workflow files with optional reference image (.json/.yaml/.png).")
-                wf_file = gr.File(label="Workflow file")
-                wf_image = gr.File(label="Reference image (optional)")
-                wf_status = gr.Markdown()
-                gr.Button("Upload").click(
-                    upload_workflow,
-                    inputs=[wf_file, wf_image],
-                    outputs=wf_status,
-                )
-                wf_list = gr.Markdown()
-                gr.Button("Refresh Uploaded Workflows").click(
-                    list_uploaded_workflows,
-                    outputs=wf_list,
-                )
-
-            # Upload LoRA
-            with gr.Tab("⬆️ Upload LoRA"):
-                gr.Markdown("Upload LoRA files with optional reference image (.safetensors/.ckpt/.png).")
-                lora_file = gr.File(label="LoRA file")
-                lora_image = gr.File(label="Reference image (optional)")
-                lora_status = gr.Markdown()
-                gr.Button("Upload").click(
-                    upload_lora,
-                    inputs=[lora_file, lora_image],
-                    outputs=lora_status,
-                )
-                lora_list = gr.Markdown()
-                gr.Button("Refresh Uploaded LoRAs").click(
-                    list_uploaded_loras,
-                    outputs=lora_list,
-                )
+        # Upload Workflow Tab (always visible, password-protected)
+        with gr.Tab("⬆️ Upload Workflow"):
+            gr.Markdown("Upload workflow files with optional reference image (.json/.yaml/.png). Owner only (password required).")
+            wf_file = gr.File(label="Workflow file")
+            wf_image = gr.File(label="Reference image (optional)")
+            wf_password = gr.Textbox(label="Password", type="password")
+            wf_status = gr.Markdown()
+            gr.Button("Upload").click(
+                upload_workflow,
+                inputs=[wf_file, wf_image, wf_password],
+                outputs=wf_status,
+            )
+            wf_list = gr.Markdown()
+            gr.Button("Refresh Uploaded Workflows").click(
+                list_uploaded_workflows,
+                outputs=wf_list,
+            )
+
+        # Upload LoRA Tab (always visible, password-protected)
+        with gr.Tab("⬆️ Upload LoRA"):
+            gr.Markdown("Upload LoRA files with optional reference image (.safetensors/.ckpt/.png). Owner only (password required).")
+            lora_file = gr.File(label="LoRA file")
+            lora_image = gr.File(label="Reference image (optional)")
+            lora_password = gr.Textbox(label="Password", type="password")
+            lora_status = gr.Markdown()
+            gr.Button("Upload").click(
+                upload_lora,
+                inputs=[lora_file, lora_image, lora_password],
+                outputs=lora_status,
+            )
+            lora_list = gr.Markdown()
+            gr.Button("Refresh Uploaded LoRAs").click(
+                list_uploaded_loras,
+                outputs=lora_list,
+            )
 
 demo.launch()
-