Use signed-in user's HF OAuth token for inference

The Space README declares `hf_oauth: true` with `inference-api` scope,
so the token granted to each user on sign-in is already authorized for
HF inference. createInferenceClient now prefers that user token over a
server-side HF_TOKEN env var, removing the need to provision a PAT.

Each HF helper accepts opts.accessToken again; routes pass
session.accessToken from the JWT. Server-side HF_TOKEN remains a
fallback (e.g. for background jobs) and still gets the JWT-shape
diagnostic if it's misconfigured.

app/api/dialogues/route.ts

@@ -24,6 +24,7 @@ export async function POST(req: NextRequest) {
       nativeLang: session.nativeLang ?? "en",
       level,
       scenario,
+      accessToken: session.accessToken,
     });
 
     return NextResponse.json(

app/api/phrases/route.ts

@@ -26,6 +26,7 @@ export async function POST(req: Request) {
       targetLang: session.targetLang,
       nativeLang: session.nativeLang ?? "en",
       level: (parsed.data.level ?? session.level) as Level,
+      accessToken: session.accessToken,
     });
 
     return NextResponse.json(result);

app/api/stories/route.ts

@@ -21,6 +21,7 @@ export async function POST(req: Request) {
       nativeLang: session.nativeLang ?? "en",
       level: session.level as Level,
       topic: parsed.data.topic,
+      accessToken: session.accessToken,
     });
 
     return NextResponse.json({

app/api/translate/route.ts

@@ -30,7 +30,7 @@ export async function POST(req: Request) {
   if (cache.has(key)) return NextResponse.json({ translation: cache.get(key), cached: true });
 
   try {
-    const translation = await translate({ text, from, to });
+    const translation = await translate({ text, from, to, accessToken: session.accessToken });
     if (cache.size >= MAX_CACHE) {
       const firstKey = cache.keys().next().value;
       if (firstKey) cache.delete(firstKey);

app/api/vision/analyze/route.ts

@@ -33,6 +33,7 @@ export async function POST(req: Request) {
       targetLang: session.targetLang,
       nativeLang: session.nativeLang,
       level,
+      accessToken: session.accessToken,
     });
 
     const mappedObjects = result.objects.map((o) => ({

lib/hf/client.ts

@@ -1,24 +1,25 @@
 import { InferenceClient } from "@huggingface/inference";
 
-function assertTokenShape(token: string) {
-  // OAuth access tokens are JWTs: three base64url segments separated by dots, starting with "eyJ".
-  // Personal Access Tokens start with "hf_" and never expire. Inference must use a PAT — OAuth
-  // tokens have an `exp` claim and HF returns 401 once it passes.
-  const looksLikeJwt = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
-  if (looksLikeJwt) {
-    throw new Error(
-      "HF_TOKEN looks like an OAuth access token (JWT). HF inference requires a long-lived Personal Access Token starting with `hf_`. Create one at https://huggingface.co/settings/tokens and set it as the HF_TOKEN secret in your HF Space.",
-    );
+const JWT_SHAPE = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+
+export function createInferenceClient(userAccessToken?: string) {
+  // Prefer the signed-in user's HF OAuth access token (granted via the
+  // `inference-api` scope on sign-in). Falls back to a server-side
+  // HF_TOKEN env var if no user token is present (e.g. background jobs).
+  if (userAccessToken) {
+    return new InferenceClient(userAccessToken);
   }
-}
 
-export function createInferenceClient() {
   const serverToken = process.env.HF_TOKEN?.trim();
   if (!serverToken) {
     throw new Error(
-      "HF_TOKEN is not configured for inference. Set it to a Personal Access Token (starts with `hf_`) from https://huggingface.co/settings/tokens.",
+      "No HuggingFace token available. Sign in to use your OAuth token, or set HF_TOKEN to a Personal Access Token (starts with `hf_`) from https://huggingface.co/settings/tokens.",
+    );
+  }
+  if (JWT_SHAPE.test(serverToken)) {
+    throw new Error(
+      "HF_TOKEN looks like an OAuth access token (JWT). For server-side inference set HF_TOKEN to a long-lived Personal Access Token starting with `hf_` from https://huggingface.co/settings/tokens, or remove HF_TOKEN and rely on per-user OAuth.",
     );
   }
-  assertTokenShape(serverToken);
   return new InferenceClient(serverToken);
 }

lib/hf/dialogue.ts

@@ -18,8 +18,9 @@ export async function generateDialogue(opts: {
   nativeLang: string;
   level: Level;
   scenario?: string;
+  accessToken?: string;
 }): Promise<{ title: string; scenario: string; turns: DialogueTurn[] }> {
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const lang = languageName(opts.targetLang);
   const native = languageName(opts.nativeLang);
   const hint = SCENARIO_HINTS[opts.level];

lib/hf/gemma-vision.ts

@@ -39,6 +39,7 @@ export async function analyzeWithGemma(opts: {
   targetLang: string;
   nativeLang: string;
   level: Level;
+  accessToken?: string;
 }): Promise<GemmaVisionResult> {
   const lang = languageName(opts.targetLang);
   const brief = LEVEL_SENTENCE_BRIEF[opts.level];
@@ -71,7 +72,7 @@ Output STRICT JSON:
   ]
 }`;
 
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const res = await hf.chatCompletion({
     provider: "novita",
     model: GEMMA_MODEL,

lib/hf/inference.ts

@@ -19,6 +19,7 @@ export async function generateStory(opts: {
   nativeLang: string;
   level: Level;
   topic?: string;
+  accessToken?: string;
 }): Promise<{ title: string; content: string; vocab: StoryVocab[] }> {
   const lang = languageName(opts.targetLang);
   const native = languageName(opts.nativeLang);
@@ -35,7 +36,7 @@ export async function generateStory(opts: {
     `Output STRICT JSON with keys: title (string in ${lang}), content (string in ${lang} - paragraphs separated by \\n\\n), vocab (array of 6-10 objects each with "word" in ${lang} and "gloss" in ${native}).${japaneseRule}`;
   const user = `Write a story about: ${topic}.`;
 
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const res = await hf.chatCompletion({
     provider: "novita",
     model: STORY_MODEL,
@@ -67,9 +68,10 @@ export async function translate(opts: {
   text: string;
   from: string;
   to: string;
+  accessToken?: string;
 }): Promise<string> {
   if (!opts.text.trim()) return "";
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const res = await hf.translation({
     model: TRANSLATE_MODEL,
     inputs: opts.text,

lib/hf/phrases.ts

@@ -53,8 +53,9 @@ export async function analyzePhrase(opts: {
   targetLang: string;
   nativeLang: string;
   level: Level;
+  accessToken?: string;
 }): Promise<PhraseAnalysis> {
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const lang = languageName(opts.targetLang);
   const native = languageName(opts.nativeLang);
   const phrase = opts.text.trim();

lib/hf/sentences.ts

@@ -11,6 +11,7 @@ export async function generateSentencesForImage(opts: {
   targetLang: string;
   nativeLang: string;
   level: Level;
+  accessToken?: string;
 }): Promise<ExampleSentence[]> {
   const target = languageName(opts.targetLang);
   const native = languageName(opts.nativeLang);
@@ -20,7 +21,7 @@ export async function generateSentencesForImage(opts: {
     `Output STRICT JSON: {"sentences": [{"target": string, "gloss": string}, ...]}.`;
   const user = `Caption: ${opts.captionEn}\nObjects: ${opts.objectsEn.join(", ") || "(none)"}\n`;
 
-  const hf = createInferenceClient();
+  const hf = createInferenceClient(opts.accessToken);
   const res = await hf.chatCompletion({
     provider: "novita",
     model: MODEL,