Update app.py

app.py

@@ -506,16 +506,23 @@ async def dashboard(request: Request):
 
 @app.get("/login")
 async def login(request: Request):
-    # Retrieve App redirect URI dynamically from host domain
-    host = request.headers.get("host", "")
-    protocol = "https" if "hf.space" in host or request.headers.get("x-forwarded-proto") == "https" else "http"
-    redirect_uri = f"{protocol}://{host}/callback"
+    # Retrieve App redirect URI dynamically (supporting Hugging Face reverse proxy)
+    space_host = os.environ.get("SPACE_HOST")
+    if space_host:
+        redirect_uri = f"https://{space_host}/callback"
+    else:
+        host = request.headers.get("host", "")
+        protocol = "https" if "hf.space" in host or request.headers.get("x-forwarded-proto") == "https" else "http"
+        redirect_uri = f"{protocol}://{host}/callback"
+    
+    logger.info(f"Login URL redirect_uri generated: {redirect_uri}")
     
     auth_url = (
         f"https://id.ctrader.com/my/settings/openapi/grantingaccess/"
         f"?client_id={CLIENT_ID}"
         f"&redirect_uri={redirect_uri}"
-        f"&scope=accounts,trade"
+        f"&scope=accounts,trading"
+        f"&product=web"
     )
     return RedirectResponse(auth_url)
 
@@ -524,9 +531,15 @@ async def callback(request: Request, code: str = None):
     if not code:
         raise HTTPException(status_code=400, detail="Authorization code missing")
         
-    host = request.headers.get("host", "")
-    protocol = "https" if "hf.space" in host or request.headers.get("x-forwarded-proto") == "https" else "http"
-    redirect_uri = f"{protocol}://{host}/callback"
+    space_host = os.environ.get("SPACE_HOST")
+    if space_host:
+        redirect_uri = f"https://{space_host}/callback"
+    else:
+        host = request.headers.get("host", "")
+        protocol = "https" if "hf.space" in host or request.headers.get("x-forwarded-proto") == "https" else "http"
+        redirect_uri = f"{protocol}://{host}/callback"
+        
+    logger.info(f"Callback redirect_uri generated: {redirect_uri}")
     
     payload = {
         "grant_type": "authorization_code",