Authenticate requests to private agent Space

.env.example

@@ -5,8 +5,10 @@ FRONTEND_URL=http://localhost:8080
 BACKEND_URL=http://localhost:4000
 ANALYSIS_PROXY_SECRET=replace-with-a-random-secret-of-at-least-32-characters
 # Deploy the stateless Agent service separately and use its private URL/key here.
-AGENT_API_URL=https://your-agent-service.example.com
+AGENT_API_URL=https://shoraky-sporalize-agent.hf.space
 AGENT_API_KEY=replace-with-the-Agent-service-secret
+# Read-scoped Hugging Face token for the private Agent Space.
+AGENT_HF_TOKEN=hf_read_token_for_the_private_Agent_Space
 # Optional: use the same random secret in the Colab notebook to register its worker.
 # COLAB_WORKER_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
 SUPABASE_URL=https://your-project.supabase.co

src/agent-session.ts

@@ -73,9 +73,15 @@ export async function generateSessionFeedback(db: SupabaseClient, sessionId: str
       results: { metrics: current.inActionMetrics ?? [], analytics: current.rawAnalytics ?? {} }, references });
   }
   if (!actions.length) return;
+  const agentHeaders: Record<string, string> = {
+    "content-type": "application/json",
+    "x-api-key": env.AGENT_API_KEY,
+    "x-user-id": userId,
+  };
+  if (env.AGENT_HF_TOKEN) agentHeaders.authorization = `Bearer ${env.AGENT_HF_TOKEN}`;
   const response = await fetch(new URL("/api/session/generate", env.AGENT_API_URL), {
     method: "POST",
-    headers: { "content-type": "application/json", "x-api-key": env.AGENT_API_KEY, "x-user-id": userId },
+    headers: agentHeaders,
     body: JSON.stringify({ session_id: sessionId, player, actions }),
     signal: AbortSignal.timeout(150000),
   });

src/config.ts

@@ -10,6 +10,7 @@ const envSchema = z.object({
   ANALYSIS_API_URL: z.string().url().default("http://127.0.0.1:8000"),
   AGENT_API_URL: z.string().url().optional(),
   AGENT_API_KEY: z.string().min(16).optional(),
+  AGENT_HF_TOKEN: z.string().optional(),
   ANALYSIS_PROXY_SECRET: z.string().min(32),
   COLAB_WORKER_SECRET: z.string().optional(),
   SUPABASE_URL: z.string().url(),

src/server.ts

@@ -790,8 +790,10 @@ app.post("/api/agent/chat", async (req, res, next) => {
       if (!player) return res.sendStatus(404);
       context.player = player;
     }
+    const agentHeaders: Record<string, string> = { "content-type": "application/json", "x-api-key": env.AGENT_API_KEY, "x-user-id": current.user.id };
+    if (env.AGENT_HF_TOKEN) agentHeaders.authorization = `Bearer ${env.AGENT_HF_TOKEN}`;
     const upstream = await fetch(new URL("/api/chat", env.AGENT_API_URL), {
-      method: "POST", headers: { "content-type": "application/json", "x-api-key": env.AGENT_API_KEY, "x-user-id": current.user.id },
+      method: "POST", headers: agentHeaders,
       body: JSON.stringify({ actions: [], context, message: input.message, history: input.history }),
       signal: AbortSignal.timeout(95000),
     });