api/auth.py

"""HF token resolution: signed-in user's OAuth token first, env fallback."""

from __future__ import annotations

import os

import gradio as gr
from huggingface_hub import get_token

# What Gradio 6's mocked local login injects as the access token — useless
# against the Hub, so fall through to the real local credentials instead.
LOCAL_MOCK_TOKEN = "mock-oauth-token-for-local-dev"


def resolve_token(oauth_token: gr.OAuthToken | None) -> str | None:
    """The signed-in user's OAuth token on Spaces; HF_TOKEN / cached login otherwise."""
    if oauth_token is not None and oauth_token.token != LOCAL_MOCK_TOKEN:
        return oauth_token.token
    return os.getenv("HF_TOKEN") or get_token()