Fix HF user info parsing and OAuth scope issues

- Add detailed logging for HF API user info response
- Improve username field detection with fallbacks
- Fix OAuth scope to use only supported 'read-repos'
- Handle multiple possible field names from HF API
- Better error handling for missing user data fields

backend/routers/auth.py

@@ -91,7 +91,7 @@ async def login(request: Request):
         f"?client_id={oauth_config['client_id']}"
         f"&redirect_uri={redirect_uri}"
         f"&response_type=code"
-        f"&scope={oauth_config['scopes']}"
+        f"&scope=read-repos"  # Use only supported scope
         f"&state={state}"
     )
     
@@ -174,17 +174,28 @@ async def oauth_callback(request: Request, code: str, state: str):
         user_response.raise_for_status()
         user_info = user_response.json()
         
+        # Debug: log user info structure
+        logger.info(f"🔍 HF User info received: {list(user_info.keys())}")
+        logger.info(f"📝 User details - id: {user_info.get('id')}, name: {user_info.get('name')}, login: {user_info.get('login')}")
+        
     except requests.RequestException as e:
         logger.error(f"User info fetch failed: {e}")
         raise HTTPException(status_code=400, detail="Failed to fetch user information")
     
     # Store user in session
+    # Try multiple fields for username as HF API might use different field names
+    username = (user_info.get("login") or 
+               user_info.get("username") or 
+               user_info.get("name") or 
+               user_info.get("id") or 
+               "unknown_user")
+    
     user_data = {
         "id": user_info.get("id"),
-        "name": user_info.get("name"),
-        "username": user_info.get("login"),  # HF username
+        "name": user_info.get("name") or user_info.get("fullName") or username,
+        "username": username,
         "email": user_info.get("email"),
-        "avatar_url": user_info.get("avatarUrl"),
+        "avatar_url": user_info.get("avatarUrl") or user_info.get("avatar"),
         "access_token": access_token,  # Store for future API calls if needed
         "auth_method": "oauth"
     }