Implement official HuggingFace Hub authentication and remove offline mode

- Replace custom API calls with official huggingface_hub.whoami() function
- Remove offline mode, demo tester functionality, and development workarounds
- Update authentication to use proper HF Hub error handling with HfHubHTTPError
- Simplify authentication flow to only support valid HuggingFace tokens
- Remove offline_toggle from Gradio interface and related event handlers
- Update user creation to handle official HF Hub API response format

This provides more secure and reliable authentication using official HF methods.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

digipal/auth/auth_manager.py

@@ -3,11 +3,10 @@ HuggingFace authentication manager for DigiPal application.
 """
 
 import logging
-import requests
-import json
-from datetime import datetime, timedelta
+from datetime import datetime
 from typing import Optional, Dict, Any
-from pathlib import Path
+from huggingface_hub import HfApi, whoami
+from huggingface_hub.utils import HfHubHTTPError
 
 from .models import User, AuthSession, AuthResult, AuthStatus
 from .session_manager import SessionManager
@@ -17,34 +16,24 @@ logger = logging.getLogger(__name__)
 
 
 class AuthManager:
-    """Manages HuggingFace authentication with offline support."""
+    """Manages HuggingFace authentication using official HF Hub methods."""
     
-    # HuggingFace API endpoints
-    HF_API_BASE = "https://huggingface.co/api"
-    HF_USER_ENDPOINT = f"{HF_API_BASE}/whoami"
-    
-    def __init__(self, db_connection: DatabaseConnection, offline_mode: bool = False, cache_dir: Optional[str] = None):
+    def __init__(self, db_connection: DatabaseConnection, cache_dir: Optional[str] = None):
         """
         Initialize authentication manager.
         
         Args:
             db_connection: Database connection for user storage
-            offline_mode: Enable offline development mode
             cache_dir: Directory for authentication cache
         """
         self.db = db_connection
-        self.offline_mode = offline_mode
         self.session_manager = SessionManager(db_connection, cache_dir)
         
-        # Request session for connection pooling
-        self.session = requests.Session()
-        self.session.timeout = 10  # 10 second timeout
-        
-        logger.info(f"AuthManager initialized (offline_mode: {offline_mode})")
+        logger.info("AuthManager initialized with official HuggingFace Hub authentication")
     
     def authenticate(self, token: str) -> AuthResult:
         """
-        Authenticate user with HuggingFace token.
+        Authenticate user with HuggingFace token using official HF Hub methods.
         
         Args:
             token: HuggingFace authentication token
@@ -52,12 +41,16 @@ class AuthManager:
         Returns:
             Authentication result with user and session info
         """
-        if self.offline_mode:
-            return self._authenticate_offline(token)
+        if not token or not token.strip():
+            return AuthResult(
+                status=AuthStatus.INVALID_TOKEN,
+                error_message="Token cannot be empty"
+            )
         
         try:
-            # Validate token with HuggingFace API
-            user_info = self._validate_hf_token(token)
+            # Validate token using official HuggingFace Hub whoami function
+            user_info = whoami(token=token.strip())
+            
             if not user_info:
                 return AuthResult(
                     status=AuthStatus.INVALID_TOKEN,
@@ -65,7 +58,7 @@ class AuthManager:
                 )
             
             # Create or update user
-            user = self._create_or_update_user(user_info, token)
+            user = self._create_or_update_user(user_info, token.strip())
             if not user:
                 return AuthResult(
                     status=AuthStatus.USER_NOT_FOUND,
@@ -73,7 +66,7 @@ class AuthManager:
                 )
             
             # Create session
-            session = self.session_manager.create_session(user, token)
+            session = self.session_manager.create_session(user, token.strip())
             
             logger.info(f"Successfully authenticated user: {user.username}")
             return AuthResult(
@@ -82,10 +75,19 @@ class AuthManager:
                 session=session
             )
             
-        except requests.exceptions.RequestException as e:
-            logger.warning(f"Network error during authentication: {e}")
-            # Try offline authentication as fallback
-            return self._authenticate_offline(token)
+        except HfHubHTTPError as e:
+            if e.response.status_code == 401:
+                logger.warning("Invalid HuggingFace token")
+                return AuthResult(
+                    status=AuthStatus.INVALID_TOKEN,
+                    error_message="Invalid or expired HuggingFace token"
+                )
+            else:
+                logger.error(f"HuggingFace API error: {e}")
+                return AuthResult(
+                    status=AuthStatus.NETWORK_ERROR,
+                    error_message=f"HuggingFace API error: {str(e)}"
+                )
         
         except Exception as e:
             logger.error(f"Authentication error: {e}")
@@ -125,9 +127,8 @@ class AuthManager:
         # Refresh session
         self.session_manager.refresh_session(user_id)
         
-        status = AuthStatus.OFFLINE_MODE if session.is_offline else AuthStatus.SUCCESS
         return AuthResult(
-            status=status,
+            status=AuthStatus.SUCCESS,
             user=user,
             session=session
         )
@@ -186,17 +187,14 @@ class AuthManager:
         Returns:
             Updated user object
         """
-        if self.offline_mode:
-            return self.get_user(user_id)
-        
         try:
             # Get current session to get token
             session = self.session_manager.get_session(user_id)
-            if not session or session.is_offline:
+            if not session:
                 return self.get_user(user_id)
             
-            # Fetch updated user info
-            user_info = self._validate_hf_token(session.token)
+            # Fetch updated user info using official HF Hub methods
+            user_info = whoami(token=session.token)
             if user_info:
                 user = self._create_or_update_user(user_info, session.token)
                 logger.info(f"Refreshed profile for user: {user_id}")
@@ -211,124 +209,26 @@ class AuthManager:
         """Clean up expired sessions."""
         return self.session_manager.cleanup_expired_sessions()
     
-    def _authenticate_offline(self, token: str) -> AuthResult:
-        """
-        Authenticate in offline mode using cached data.
-        
-        Args:
-            token: Authentication token
-            
-        Returns:
-            Authentication result for offline mode
-        """
-        # In offline mode, we create a development user
-        # This is for development purposes only
-        
-        if not token or len(token) < 10:
-            return AuthResult(
-                status=AuthStatus.INVALID_TOKEN,
-                error_message="Token too short for offline mode"
-            )
-        
-        # Create a deterministic user ID from token
-        import hashlib
-        user_id = f"offline_{hashlib.md5(token.encode()).hexdigest()[:16]}"
-        username = f"dev_user_{user_id[-8:]}"
-        
-        # Check if offline user exists
-        user = self.get_user(user_id)
-        if not user:
-            # Create offline development user
-            user = User(
-                id=user_id,
-                username=username,
-                email=f"{username}@offline.dev",
-                full_name=f"Development User {username}",
-                created_at=datetime.now()
-            )
-            
-            # Save to database
-            try:
-                self.db.execute_update(
-                    '''INSERT OR REPLACE INTO users 
-                       (id, username, huggingface_token, created_at, last_login) 
-                       VALUES (?, ?, ?, ?, ?)''',
-                    (user.id, user.username, token, 
-                     user.created_at.isoformat(), datetime.now().isoformat())
-                )
-            except Exception as e:
-                logger.error(f"Error creating offline user: {e}")
-                return AuthResult(
-                    status=AuthStatus.NETWORK_ERROR,
-                    error_message="Failed to create offline user"
-                )
-        
-        # Create offline session
-        session = self.session_manager.create_session(
-            user, token, expires_hours=168, is_offline=True  # 1 week for offline
-        )
-        
-        logger.info(f"Offline authentication successful for: {username}")
-        return AuthResult(
-            status=AuthStatus.OFFLINE_MODE,
-            user=user,
-            session=session
-        )
-    
-    def _validate_hf_token(self, token: str) -> Optional[Dict[str, Any]]:
-        """
-        Validate token with HuggingFace API.
-        
-        Args:
-            token: HuggingFace token
-            
-        Returns:
-            User info dict if valid, None otherwise
-        """
-        try:
-            headers = {
-                'Authorization': f'Bearer {token}',
-                'User-Agent': 'DigiPal/1.0'
-            }
-            
-            response = self.session.get(self.HF_USER_ENDPOINT, headers=headers)
-            
-            if response.status_code == 200:
-                user_info = response.json()
-                logger.debug(f"HF API response: {user_info}")
-                return user_info
-            elif response.status_code == 401:
-                logger.warning("Invalid HuggingFace token")
-                return None
-            else:
-                logger.error(f"HF API error: {response.status_code} - {response.text}")
-                return None
-                
-        except requests.exceptions.RequestException as e:
-            logger.error(f"Network error validating HF token: {e}")
-            raise
-        except Exception as e:
-            logger.error(f"Error validating HF token: {e}")
-            return None
     
     def _create_or_update_user(self, user_info: Dict[str, Any], token: str) -> Optional[User]:
         """
         Create or update user from HuggingFace user info.
         
         Args:
-            user_info: User info from HuggingFace API
+            user_info: User info from HuggingFace Hub API
             token: Authentication token
             
         Returns:
             User object
         """
         try:
-            # Extract user data from HF response
+            # Extract user data from HF Hub API response
+            # The official HF Hub API returns different field names
             user_id = user_info.get('name', user_info.get('id', ''))
             username = user_info.get('name', user_id)
             email = user_info.get('email')
-            full_name = user_info.get('fullname', user_info.get('name'))
-            avatar_url = user_info.get('avatarUrl')
+            full_name = user_info.get('fullname', user_info.get('fullName', username))
+            avatar_url = user_info.get('avatarUrl', user_info.get('avatar_url'))
             
             if not user_id:
                 logger.error("No user ID in HuggingFace response")
@@ -378,7 +278,3 @@ class AuthManager:
             logger.error(f"Error creating/updating user: {e}")
             return None
     
-    def __del__(self):
-        """Cleanup resources."""
-        if hasattr(self, 'session'):
-            self.session.close()

digipal/ui/gradio_interface.py

@@ -124,13 +124,6 @@ class GradioInterface:
                         "",
                         elem_classes=["auth-status"]
                     )
-                    
-                    # Offline mode toggle for development (outside accordion to avoid context issues)
-                    offline_toggle = gr.Checkbox(
-                        label="Enable Offline Mode (Development)",
-                        value=False,
-                        info="For development without HuggingFace token"
-                    )
                 
                 with gr.Column(scale=1):
                     pass  # Empty column for centering
@@ -154,8 +147,7 @@ class GradioInterface:
         return {
             'token_input': token_input,
             'login_btn': login_btn,
-            'auth_status': auth_status,
-            'offline_toggle': offline_toggle
+            'auth_status': auth_status
         }
     
     def _create_egg_selection_interface(self) -> Dict[str, Any]:
@@ -430,7 +422,6 @@ class GradioInterface:
             fn=self._handle_login,
             inputs=[
                 auth_components['token_input'],
-                auth_components['offline_toggle'],
                 user_state,
                 token_state
             ],
@@ -600,27 +591,22 @@ class GradioInterface:
             outputs=[main_components['status_info']]
         )
     
-    def _handle_login(self, token: str, offline_mode: bool, 
-                     current_user: Optional[str], current_token: Optional[str]) -> Tuple:
-        """Handle user login."""
-        if not token:
+    def _handle_login(self, token: str, current_user: Optional[str], current_token: Optional[str]) -> Tuple:
+        """Handle user login with HuggingFace authentication."""
+        if not token or not token.strip():
             return (
-                '<div class="error">Please enter a token</div>',
+                '<div class="error">Please enter a valid HuggingFace token</div>',
                 current_user,
                 current_token,
                 gr.update(selected="auth_tab")  # Stay on auth tab
             )
         
-        # Set offline mode if requested
-        if offline_mode:
-            self.auth_manager.offline_mode = True
-        
-        # Authenticate user
-        auth_result = self.auth_manager.authenticate(token)
+        # Authenticate user using official HuggingFace Hub methods
+        auth_result = self.auth_manager.authenticate(token.strip())
         
-        if auth_result.status in [AuthStatus.SUCCESS, AuthStatus.OFFLINE_MODE]:
+        if auth_result.status == AuthStatus.SUCCESS:
             self.current_user_id = auth_result.user.id
-            self.current_token = token
+            self.current_token = token.strip()
             
             # Check if user has existing DigiPal
             existing_pet = self.digipal_core.load_existing_pet(auth_result.user.id)
@@ -628,25 +614,21 @@ class GradioInterface:
             if existing_pet:
                 # User has existing pet, go to main interface
                 status_msg = f'<div class="success">Welcome back, {auth_result.user.username}!</div>'
-                if auth_result.status == AuthStatus.OFFLINE_MODE:
-                    status_msg += '<div class="info">Running in offline mode</div>'
                 
                 return (
                     status_msg,
                     auth_result.user.id,
-                    token,
+                    token.strip(),
                     gr.update(selected="main_tab")  # Go to main tab
                 )
             else:
                 # New user, go to egg selection
                 status_msg = f'<div class="success">Welcome, {auth_result.user.username}! Choose your first egg.</div>'
-                if auth_result.status == AuthStatus.OFFLINE_MODE:
-                    status_msg += '<div class="info">Running in offline mode</div>'
                 
                 return (
                     status_msg,
                     auth_result.user.id,
-                    token,
+                    token.strip(),
                     gr.update(selected="egg_tab")  # Go to egg tab
                 )
         else: