changed oauth link to redirect to _self instead of _blank

mycoder/app.py

@@ -23,14 +23,15 @@ OPENID_PROVIDER_URL = os.getenv("OPENID_PROVIDER_URL", "https://huggingface.co")
 SCOPES = os.getenv("OAUTH_SCOPES", "openid profile")  # spaces fills this env var
 
 def oauth_login_url():
-    state = secrets.token_urlsafe(24)
-    st.session_state["oauth_state"] = state
+    if "oauth_state" not in st.session_state or not st.session_state["oauth_state"]:
+        st.session_state["oauth_state"] = secrets.token_urlsafe(24)
+
     query = urlencode({
         "client_id": OAUTH_CLIENT_ID,
         "redirect_uri": REDIRECT_URI,
         "response_type": "code",
         "scope": SCOPES,
-        "state": state,
+        "state": st.session_state["oauth_state"],
     })
     return f"{AUTH_URL}?{query}"
 
@@ -76,14 +77,15 @@ if code and "user" not in st.session_state:
     user = get_userinfo(tokens["access_token"])
     st.session_state["tokens"] = tokens
     st.session_state["user"] = user
+    st.session_state["oauth_state"] = None
     st.query_params.clear()  # remove code/state from URL
     st.rerun()
 
 # UI
 if "user" not in st.session_state:
     login_url = oauth_login_url()
-    # HF docs recommend opening auth in a new tab in iframe contexts
-    st.markdown(f'<a href="{login_url}" target="_blank">Sign in with Hugging Face</a>', unsafe_allow_html=True)
+    # Open in the same tab so Streamlit session_state survives the callback.
+    st.markdown(f'<a href="{login_url}" target="_self">Sign in with Hugging Face</a>', unsafe_allow_html=True)
     st.stop()
 
 st.success(f"Signed in as @{st.session_state['user'].get('preferred_username', 'unknown')}")
@@ -122,4 +124,4 @@ if st.button("Run Query2Plot"):
     if os.path.exists("output/plot.png"):
         st.image("output/plot.png", caption="Generated Figure")
 
-        
+