Sync from GitHub 247bfa13ed0af2a3e2eaf0193f136a55bee6daef

auth/oauth.py

@@ -13,6 +13,14 @@ class HFOAuthError(RuntimeError):
     pass
 
 
+def _first_env(*names: str) -> str:
+    for name in names:
+        value = os.getenv(name, "").strip()
+        if value:
+            return value
+    return ""
+
+
 @dataclass(frozen=True)
 class HFOAuthSettings:
     client_id: str
@@ -24,8 +32,8 @@ class HFOAuthSettings:
 
 
 def get_hf_oauth_settings() -> HFOAuthSettings:
-    client_id = os.getenv("HF_OAUTH_CLIENT_ID", "").strip()
-    client_secret = os.getenv("HF_OAUTH_CLIENT_SECRET", "").strip()
+    client_id = _first_env("HF_OAUTH_CLIENT_ID", "OAUTH_CLIENT_ID")
+    client_secret = _first_env("HF_OAUTH_CLIENT_SECRET", "OAUTH_CLIENT_SECRET")
     if not client_id or not client_secret:
         raise HFOAuthError("HF OAuth client configuration is missing.")
 

auth/session.py

@@ -30,6 +30,14 @@ class AuthBridgeTokenError(ValueError):
     pass
 
 
+def _first_env(*names: str) -> str:
+    for name in names:
+        value = os.getenv(name, "").strip()
+        if value:
+            return value
+    return ""
+
+
 def get_auth_mode() -> str:
     configured = os.getenv("AUTH_MODE", "").strip().lower()
     if configured == AUTH_MODE_DEV:
@@ -37,16 +45,28 @@ def get_auth_mode() -> str:
     if configured in {AUTH_MODE_HF, "oauth"}:
         return AUTH_MODE_HF
     if not configured or configured == "auto":
-        has_hf_client = bool(os.getenv("HF_OAUTH_CLIENT_ID", "").strip())
-        has_hf_secret = bool(os.getenv("HF_OAUTH_CLIENT_SECRET", "").strip())
+        has_hf_client = bool(_first_env("HF_OAUTH_CLIENT_ID", "OAUTH_CLIENT_ID"))
+        has_hf_secret = bool(_first_env("HF_OAUTH_CLIENT_SECRET", "OAUTH_CLIENT_SECRET"))
         if has_hf_client and has_hf_secret:
             return AUTH_MODE_HF
     return AUTH_MODE_DEV
 
 
+def _resolve_session_secret() -> str:
+    configured = os.getenv("APP_SESSION_SECRET", "").strip()
+    if configured:
+        return configured
+    if get_auth_mode() == AUTH_MODE_HF:
+        # In HF Spaces OAuth deployments, OAUTH_CLIENT_SECRET is usually injected.
+        oauth_secret = _first_env("HF_OAUTH_CLIENT_SECRET", "OAUTH_CLIENT_SECRET")
+        if oauth_secret:
+            return oauth_secret
+    return DEFAULT_DEV_SESSION_SECRET
+
+
 def configure_session_middleware(app) -> None:
     """Attach Starlette session middleware once during app setup."""
-    secret = os.getenv("APP_SESSION_SECRET", DEFAULT_DEV_SESSION_SECRET).strip()
+    secret = _resolve_session_secret()
     auth_mode = get_auth_mode()
     if auth_mode == AUTH_MODE_HF and (not secret or secret == DEFAULT_DEV_SESSION_SECRET):
         raise RuntimeError("APP_SESSION_SECRET must be set to a non-default value in hf_oauth mode.")
@@ -70,7 +90,7 @@ def configure_session_middleware(app) -> None:
 
 
 def _bridge_serializer() -> URLSafeTimedSerializer:
-    secret = os.getenv("APP_SESSION_SECRET", DEFAULT_DEV_SESSION_SECRET)
+    secret = _resolve_session_secret()
     return URLSafeTimedSerializer(secret_key=secret, salt=AUTH_BRIDGE_SALT)
 
 

tests/test_auth_mode.py

@@ -19,6 +19,8 @@ def test_get_auth_mode_auto_switches_to_hf(monkeypatch):
     monkeypatch.setenv("AUTH_MODE", "auto")
     monkeypatch.setenv("HF_OAUTH_CLIENT_ID", "client-id")
     monkeypatch.setenv("HF_OAUTH_CLIENT_SECRET", "client-secret")
+    monkeypatch.delenv("OAUTH_CLIENT_ID", raising=False)
+    monkeypatch.delenv("OAUTH_CLIENT_SECRET", raising=False)
     assert get_auth_mode() == AUTH_MODE_HF
 
 
@@ -26,4 +28,15 @@ def test_get_auth_mode_auto_falls_back_to_dev(monkeypatch):
     monkeypatch.setenv("AUTH_MODE", "auto")
     monkeypatch.delenv("HF_OAUTH_CLIENT_ID", raising=False)
     monkeypatch.delenv("HF_OAUTH_CLIENT_SECRET", raising=False)
+    monkeypatch.delenv("OAUTH_CLIENT_ID", raising=False)
+    monkeypatch.delenv("OAUTH_CLIENT_SECRET", raising=False)
     assert get_auth_mode() == AUTH_MODE_DEV
+
+
+def test_get_auth_mode_auto_switches_to_hf_with_space_oauth_vars(monkeypatch):
+    monkeypatch.setenv("AUTH_MODE", "auto")
+    monkeypatch.delenv("HF_OAUTH_CLIENT_ID", raising=False)
+    monkeypatch.delenv("HF_OAUTH_CLIENT_SECRET", raising=False)
+    monkeypatch.setenv("OAUTH_CLIENT_ID", "space-client-id")
+    monkeypatch.setenv("OAUTH_CLIENT_SECRET", "space-client-secret")
+    assert get_auth_mode() == AUTH_MODE_HF

tests/test_hf_oauth_settings.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from auth.oauth import get_hf_oauth_settings
+
+
+def test_hf_oauth_settings_accept_space_oauth_vars(monkeypatch):
+    monkeypatch.delenv("HF_OAUTH_CLIENT_ID", raising=False)
+    monkeypatch.delenv("HF_OAUTH_CLIENT_SECRET", raising=False)
+    monkeypatch.setenv("OAUTH_CLIENT_ID", "space-client-id")
+    monkeypatch.setenv("OAUTH_CLIENT_SECRET", "space-client-secret")
+
+    settings = get_hf_oauth_settings()
+    assert settings.client_id == "space-client-id"
+    assert settings.client_secret == "space-client-secret"