add-relay

app.py

@@ -26,7 +26,7 @@ from dataclasses import dataclass, field
 from typing import Any, Optional
 
 from fastapi import Depends, FastAPI, Header, HTTPException, Request
-from fastapi.responses import HTMLResponse
+from fastapi.responses import HTMLResponse, RedirectResponse
 from huggingface_hub import attach_huggingface_oauth, parse_huggingface_oauth, whoami
 from pydantic import BaseModel
 
@@ -224,6 +224,48 @@ async def dispatch(req: DispatchReq, request: Request) -> dict[str, Any]:
     return {"status": "queued", "command_id": cmd.id}
 
 
+# === OAuth relay for grabette devices ========================================
+@app.get("/oauth/grabette/callback")
+async def grabette_oauth_relay(
+    code: str | None = None,
+    state: str | None = None,
+    error: str | None = None,
+    error_description: str | None = None,
+) -> RedirectResponse | HTMLResponse:
+    """Relay the HF OAuth callback to the originating grabette on the local network.
+
+    The grabette encodes its mDNS hostname into the OAuth state as
+    ``{hostname}|{session_id}``. This endpoint splits that apart and issues a
+    302 redirect so the user's browser (on the same LAN as the grabette) reaches
+    ``http://{hostname}.local:8000/api/hf-auth/oauth/callback``.
+
+    Only this Space URL needs to be registered as a redirect_uri in the HF
+    OAuth app — one entry covers every grabette regardless of hostname.
+    """
+    if not state or "|" not in state:
+        return HTMLResponse("Missing or invalid state parameter.", status_code=400)
+
+    hostname, session_id = state.split("|", 1)
+    from urllib.parse import urlencode
+    base = f"http://{hostname}.local:8000/api/hf-auth/oauth/callback"
+
+    if error:
+        # Forward the error to the grabette so it can mark the session as failed
+        # and stop the polling loop on the frontend.
+        params: dict = {"error": error, "state": session_id}
+        if error_description:
+            params["error_description"] = error_description
+        return RedirectResponse(f"{base}?{urlencode(params)}", status_code=302)
+
+    if not code:
+        return HTMLResponse("Missing code.", status_code=400)
+
+    return RedirectResponse(
+        f"{base}?{urlencode({'code': code, 'state': session_id})}",
+        status_code=302,
+    )
+
+
 # === UI ======================================================================
 @app.get("/")
 async def index() -> HTMLResponse: