Fix OAuth protected resource metadata for gen-ui

scripts/hub_search_prefab_server.py

@@ -8,7 +8,7 @@ from pathlib import Path
 
 from starlette.middleware import Middleware
 from starlette.middleware.cors import CORSMiddleware
-from starlette.responses import JSONResponse, PlainTextResponse
+from starlette.responses import PlainTextResponse
 
 def _discover_workspace_root() -> Path:
     env_root = os.getenv("CODE_TOOLS_ROOT")
@@ -71,6 +71,15 @@ from prefab_hub_ui import (
     parse_runtime_payload,
 )
 
+
+class _RootResourceRemoteAuthProvider(RemoteAuthProvider):
+    """Advertise the Space root as the protected resource."""
+
+    def _get_resource_url(self, path: str | None = None) -> AnyHttpUrl | None:
+        del path
+        return self.base_url
+
+
 def _get_oauth_config() -> tuple[str | None, list[str], str]:
     oauth_provider = os.environ.get("FAST_AGENT_SERVE_OAUTH", "").lower()
     if oauth_provider in ("hf", "huggingface"):
@@ -100,11 +109,10 @@ fast.load_agents(PREFAB_LLM_CHAIN_CARD_FILE)
 
 _oauth_provider, _oauth_scopes, _oauth_resource_url = _get_oauth_config()
 _auth_provider = None
-_oauth_metadata: dict[str, object] | None = None
 _middleware = list(CORS_MIDDLEWARE)
 
 if _oauth_provider == "huggingface":
-    _auth_provider = RemoteAuthProvider(
+    _auth_provider = _RootResourceRemoteAuthProvider(
         token_verifier=PresenceTokenVerifier(
             provider="huggingface",
             scopes=_oauth_scopes,
@@ -115,14 +123,6 @@ if _oauth_provider == "huggingface":
         resource_name="gen-ui",
         resource_documentation=AnyHttpUrl("https://huggingface.co/spaces/evalstate/gen-ui"),
     )
-    _oauth_metadata = {
-        "resource": f"{str(AnyHttpUrl(_oauth_resource_url)).rstrip('/')}{PATH}",
-        "authorization_servers": ["https://huggingface.co/"],
-        "scopes_supported": _oauth_scopes,
-        "bearer_methods_supported": ["header"],
-        "resource_name": "gen-ui",
-        "resource_documentation": "https://huggingface.co/spaces/evalstate/gen-ui",
-    }
     _middleware.append(Middleware(HFAuthHeaderMiddleware))
 
 mcp = FastMCP(
@@ -137,13 +137,6 @@ async def root_info(request) -> PlainTextResponse:
     return PlainTextResponse("gen-ui MCP server. Use /mcp for MCP and /.well-known/oauth-protected-resource for auth discovery.")
 
 
-if _oauth_metadata is not None:
-
-    @mcp.custom_route("/.well-known/oauth-protected-resource", methods=["GET", "OPTIONS"])
-    async def oauth_protected_resource_alias(request) -> JSONResponse:
-        return JSONResponse(_oauth_metadata)
-
-
 async def _run_raw(query: str) -> str:
     async with fast.run() as agents:
         return await getattr(agents, RAW_AGENT).send(query)