Fix OAuth: get username from Starlette Request session (tested and working)

app.py

@@ -228,55 +228,83 @@ def check_user_access(request: gr.Request) -> Tuple[str, bool]:
     # 在 Hugging Face Space 中，OAuth 登录后用户名可能在多个地方
     username = None
     
-    # 方法1: 直接从 request.username 获取（Gradio 6.0）
-    if hasattr(request, 'username') and request.username:
+    # 方法1: 从 Starlette Request 的 session 中获取（OAuth 信息存在这里）
+    if hasattr(request, 'request') and hasattr(request.request, 'session'):
+        session = request.request.session
+        # OAuth 用户信息可能在 session 的 'oauth_info' 或 'user' 中
+        if 'oauth_info' in session:
+            oauth_info = session.get('oauth_info', {})
+            username = oauth_info.get('preferred_username') or oauth_info.get('name') or oauth_info.get('sub')
+            if username:
+                logger.info(f"从 session['oauth_info'] 获取用户名: {username}")
+        elif 'user' in session:
+            user_info = session.get('user', {})
+            username = user_info.get('preferred_username') or user_info.get('name') or user_info.get('username')
+            if username:
+                logger.info(f"从 session['user'] 获取用户名: {username}")
+        elif session:
+            # 打印 session 内容用于调试
+            logger.info(f"Session keys: {list(session.keys())}")
+            logger.info(f"Session content: {session}")
+    
+    # 方法2: 直接从 request.username 获取（Gradio 可能已经解析）
+    if not username and hasattr(request, 'username') and request.username:
         username = request.username
         logger.info(f"从 request.username 获取用户名: {username}")
     
-    # 方法2: 从 request.client.username 获取
-    elif hasattr(request, 'client') and hasattr(request.client, 'username') and request.client.username:
-        username = request.client.username
-        logger.info(f"从 request.client.username 获取用户名: {username}")
-    
-    # 方法3: 从 cookies 中获取（HF OAuth 可能设置 cookie）
-    elif hasattr(request, 'cookies'):
-        # 检查常见的 HF cookie 名称
-        for cookie_name in ['hf_user', 'username', 'user', 'hf_username']:
-            if cookie_name in request.cookies:
-                username = request.cookies[cookie_name]
+    # 方法3: 从 Starlette Request 的 state 中获取
+    if not username and hasattr(request, 'request') and hasattr(request.request, 'state'):
+        state = request.request.state
+        if hasattr(state, 'user'):
+            user_info = state.user
+            if isinstance(user_info, dict):
+                username = user_info.get('preferred_username') or user_info.get('name')
+            else:
+                username = str(user_info)
+            if username:
+                logger.info(f"从 request.request.state.user 获取用户名: {username}")
+    
+    # 方法4: 从 cookies 中获取
+    if not username and hasattr(request, 'request') and hasattr(request.request, 'cookies'):
+        cookies = request.request.cookies
+        for cookie_name in ['hf_user', 'username', 'user', 'hf_username', 'oauth_profile']:
+            if cookie_name in cookies:
+                username = cookies[cookie_name]
                 logger.info(f"从 cookie {cookie_name} 获取用户名: {username}")
                 break
     
-    # 方法4: 从 headers 中获取（HF OAuth 常用方式）
-    elif hasattr(request, 'headers'):
-        # HF OAuth 通常在 headers 中设置 X-User
-        header_value = None
-        for header_name in ['X-User', 'x-user', 'X-HF-User', 'x-hf-user', 'X-Username', 'x-username']:
-            if header_name in request.headers:
-                header_value = request.headers[header_name]
-                logger.info(f"从 header {header_name} 获取: {header_value}")
-                username = header_value
+    # 方法5: 从 headers 中获取
+    if not username and hasattr(request, 'request') and hasattr(request.request, 'headers'):
+        headers = request.request.headers
+        for header_name in ['x-user', 'x-hf-user', 'x-username']:
+            if header_name in headers:
+                username = headers[header_name]
+                logger.info(f"从 header {header_name} 获取用户名: {username}")
                 break
-        
-        # 如果没有找到，尝试从 authorization header 解析
-        if not username and 'authorization' in request.headers:
-            auth_header = request.headers.get('authorization', '')
-            logger.info(f"找到 authorization header: {auth_header[:50]}...")
-            # 这里可以解析 JWT token 获取用户名（如果需要）
-    
-    # 方法5: 从环境变量获取（如果 Space 设置了）
-    if not username:
-        username = os.getenv('HF_USERNAME', '')
-        if username:
-            logger.info(f"从环境变量 HF_USERNAME 获取用户名: {username}")
     
     # 调试：打印 request 对象的所有属性
     if not username:
-        logger.warning("无法获取用户名，request 对象属性:")
-        if hasattr(request, '__dict__'):
-            logger.warning(f"request.__dict__: {request.__dict__}")
-        logger.warning(f"request 类型: {type(request)}")
-        logger.warning(f"request dir: {[attr for attr in dir(request) if not attr.startswith('_')]}")
+        logger.warning("无法获取用户名，正在调试...")
+        if hasattr(request, 'request'):
+            starlette_request = request.request
+            logger.warning(f"Starlette Request type: {type(starlette_request)}")
+            
+            # 打印 session
+            if hasattr(starlette_request, 'session'):
+                logger.warning(f"Session keys: {list(starlette_request.session.keys())}")
+                logger.warning(f"Session: {dict(starlette_request.session)}")
+            
+            # 打印 state
+            if hasattr(starlette_request, 'state'):
+                logger.warning(f"State: {starlette_request.state.__dict__}")
+            
+            # 打印 cookies
+            if hasattr(starlette_request, 'cookies'):
+                logger.warning(f"Cookies: {dict(starlette_request.cookies)}")
+            
+            # 打印 headers
+            if hasattr(starlette_request, 'headers'):
+                logger.warning(f"Headers: {dict(starlette_request.headers)}")
     
     if not username:
         return "", False