auth

CLAUDE.md

@@ -114,11 +114,17 @@ Rarity scoring for leaderboard:
 
 ## Authentication Strategy
 
-**Username-based system** (no passwords):
-- Users provide username in requests
-- All data is public (embracing open discovery)
-- User profiles track discoveries and stats
-- Future: Could integrate HuggingFace OAuth
+**Web UI Authentication**:
+- Gradio `auth` protects web interface from casual access
+- Requires username="admin" and password from `ADMIN_PASSWORD` env var
+- Prevents random users from manually creating piclets via UI
+- **Does NOT affect API access** - programmatic clients bypass this
+
+**API-Level Authentication**:
+- OAuth token verification for user attribution
+- Tokens verified via `https://huggingface.co/oauth/userinfo`
+- User profiles keyed by stable HF `sub` (user ID)
+- All discovery data is public (embracing open discovery)
 
 ## Integration with Frontend
 
@@ -159,6 +165,7 @@ git add -A && git commit -m "Update" && git push
 
 ### Environment Variables
 - `HF_TOKEN`: **Required** - HuggingFace write token (set in Space Secrets)
+- `ADMIN_PASSWORD`: **Required** - Password for web UI access (set in Space Secrets)
 - `DATASET_REPO`: Target dataset (default: "Fraser/piclets")
 
 ## Key Implementation Details

README.md

@@ -51,9 +51,10 @@ python app.py
    - Choose Gradio SDK
    - Set to public
 
-2. **Set up HF_TOKEN**:
+2. **Set up secrets**:
    - Go to Space Settings → Repository secrets
    - Add `HF_TOKEN` with write permissions to `Fraser/piclets` dataset
+   - Add `ADMIN_PASSWORD` with a secure password (protects web UI)
 
 3. **Push the code**:
 ```bash
@@ -81,6 +82,18 @@ metadata/
   leaderboard.json    # Top discoverers by rarity score
 ```
 
+## Authentication
+
+**Web UI Access**: Protected by username/password authentication
+- Username: `admin`
+- Password: Set via `ADMIN_PASSWORD` environment variable
+- Prevents casual users from manually creating piclets via the web interface
+
+**API Access**: Programmatic access via Gradio Client works without authentication
+- Your frontend app can call endpoints directly
+- No authentication required for API clients
+- OAuth tokens verified at the API level for user attribution
+
 ## Frontend Integration
 
 ### JavaScript/TypeScript

app.py

@@ -744,4 +744,6 @@ with gr.Blocks(title="Piclets Discovery Server") as app:
     """)
 
 if __name__ == "__main__":
-    app.launch()
+    # Protect web UI with authentication while allowing API access
+    admin_password = os.getenv("ADMIN_PASSWORD", "changeme")
+    app.launch(auth=("admin", admin_password))