Revalidate the current HF account before displaying private history

Perform fresh PKCE/OIDC checks before entry and after leaving the page, bind completed checks to partitioned cookies, clear old account content, and reject stale-tab metadata requests after account changes.

hf_space/history_bridge.py

@@ -211,6 +211,12 @@ class AppSessions:
             self._revoked = {key: expiry for key, expiry in self._revoked.items() if expiry > now}
             self._revoked[claims['sid']] = claims.get('exp', now)
 
+    @staticmethod
+    def clear_cookie(response):
+        for suffix in ('; Partitioned', ''):
+            value = f'{COOKIE_NAME}=; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; Secure; SameSite=None{suffix}'
+            response.headers.append('set-cookie', value)
+
 
 class BootstrapGuards:
     """First-party proof that browser metadata approved the popup navigation."""
@@ -264,6 +270,7 @@ class AppSessionMiddleware:
         if cookie is not None:
             identity, claims = self.sessions.decode(cookie) if len(raw_values) <= 1 else (None, None)
             scope['supra_history_app_identity'] = identity
+            scope['supra_history_app_claims'] = claims if identity else None
         logout = scope.get('path', '').rstrip('/') == '/logout'
         if logout:
             self.sessions.revoke(claims)

hf_space/history_oauth.py

@@ -6,12 +6,13 @@ from dataclasses import dataclass
 import hmac
 import json
 import os
+import re
 import secrets
 import time
 from urllib.parse import urlsplit
 
 from fastapi import FastAPI, HTTPException, Request
-from itsdangerous import BadSignature, TimestampSigner
+from itsdangerous import BadSignature, TimestampSigner, URLSafeTimedSerializer
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.requests import HTTPConnection
 from starlette.responses import HTMLResponse, JSONResponse
@@ -25,6 +26,7 @@ AUTH_PATH = '/api/history/auth'
 FLOW_KEY = '_supra_history_oauth_flow'
 ATTEMPT_KEY = '_supra_history_oauth_silent_at'
 FLOW_LIFETIME = 600
+CHECK_COOKIE = '__Host-supra-history-oauth-check'
 
 
 @dataclass(frozen=True)
@@ -127,11 +129,14 @@ def _completion(settings: OAuthSettings, request: Request, error: str | None = N
 <style nonce="{nonce}">body{{background:#101010;color:#ddd;font:16px Arial,sans-serif;padding:32px}}a{{color:#f2cd70}}</style></head>
 <body><p>{'Account connected. You can close this window and return to Supra-Tex.' if authenticated else 'You can close this window and return to Supra-Tex.'}</p>
 <script nonce="{nonce}">(() => {{const message={payload};const origin={origin};if(window.parent!==window)window.parent.postMessage(message,origin);if(window.opener)window.opener.postMessage(message,origin);window.close();}})();</script></body></html>'''
-    return HTMLResponse(html, headers={
+    response = HTMLResponse(html, headers={
         'Cache-Control': 'private, no-store', 'Pragma': 'no-cache',
         'Content-Security-Policy': f"default-src 'none'; script-src 'nonce-{nonce}'; style-src 'nonce-{nonce}'; base-uri 'none'; form-action 'none'; frame-ancestors 'self' https://huggingface.co",
         'Referrer-Policy': 'no-referrer', 'X-Content-Type-Options': 'nosniff',
     })
+    if request.scope.get('supra_history_clear_check_state'):
+        response.headers.append('set-cookie', f'{CHECK_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=None; Partitioned')
+    return response
 
 
 def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None, oauth_client=None,
@@ -153,12 +158,13 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
     install_session_write_guard(app)
     bridges = bridges if bridges is not None else Bridges()
     sessions = sessions if sessions is not None else AppSessions(settings.client_secret)
+    check_signer = URLSafeTimedSerializer(settings.client_secret, salt='supra-history-oauth-check-v1')
     guards = BootstrapGuards(settings.client_secret)
     app.add_middleware(AppSessionMiddleware, sessions=sessions)
     app.state.supra_history_bridges = bridges
     app.state.supra_history_app_sessions = sessions
 
-    async def authorize(request: Request, silent=False, bridge_id=None):
+    async def authorize(request: Request, silent=False, bridge_id=None, refresh=False, check=None):
         # Older Gradio sessions include a full ID token/profile. Once invalid,
         # retaining them alongside PKCE state can overflow the browser's 4 KiB
         # cookie limit and lose the new authorization state.
@@ -169,7 +175,7 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
                 previous_attempt = float(request.session.get(ATTEMPT_KEY, 0))
             except (ValueError, TypeError):
                 previous_attempt = now
-            if now - previous_attempt < 30:
+            if now - previous_attempt < (2 if refresh else 30):
                 return _completion(settings, request, 'unavailable')
             request.session[ATTEMPT_KEY] = now
         state = secrets.token_urlsafe(32)
@@ -178,6 +184,8 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
             if name.startswith('_state_supra_history_'):
                 request.session.pop(name, None)
         request.session[FLOW_KEY] = {'state': state, 'created_at': now, 'silent': silent,
+                                     'refresh': refresh,
+                                     **({'check': check} if check else {}),
                                      **({'bridge_id': bridge_id} if bridge_id else {})}
         params = {'state': state, 'nonce': nonce}
         if silent:
@@ -195,10 +203,31 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
             return _completion(settings, request, 'unavailable')
 
     @app.get(AUTH_PATH + '/start')
-    async def start(request: Request, silent: bool = False):
-        if optional_identity(request) is not None:
+    async def start(request: Request, silent: bool = False, refresh: bool = False, check: str | None = None):
+        if not refresh and optional_identity(request) is not None:
             return _completion(settings, request)
-        return await authorize(request, silent)
+        if refresh:
+            if not check or not re.fullmatch(r'[A-Za-z0-9_-]{32,128}', check):
+                raise HTTPException(400, 'Invalid account verification request.')
+            # HF and the embedded app have separate cookies. A still-valid app
+            # session is not proof of the account currently signed in on HF.
+            request.scope['supra_history_app_identity'] = None
+            request.session.pop('oauth_info', None)
+        response = await authorize(request, silent, refresh=refresh, check=check if refresh else None)
+        if refresh:
+            sessions.clear_cookie(response)
+            if response.status_code == 302:
+                # Retain Authlib's existing PKCE/nonce state in the same browser
+                # partition as the app. Silent checks must also work when an
+                # unpartitioned Gradio session cookie is blocked by the browser.
+                state = request.session[FLOW_KEY]['state']
+                saved = {key: value for key, value in request.session.items()
+                         if key in (FLOW_KEY, ATTEMPT_KEY, '_state_supra_history_' + state)}
+                value = check_signer.dumps(saved)
+                if len(value) > 3500:
+                    raise HTTPException(503, 'Account verification could not start. Please sign in again.')
+                response.headers.append('set-cookie', f'{CHECK_COOKIE}={value}; Path=/; Max-Age={FLOW_LIFETIME}; HttpOnly; Secure; SameSite=None; Partitioned')
+        return response
 
     @app.get(AUTH_PATH + '/popup')
     async def popup(request: Request):
@@ -249,6 +278,17 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
     async def callback(request: Request):
         state = request.query_params.get('state', '')
         flow = request.session.get(FLOW_KEY)
+        if not isinstance(flow, dict) or flow.get('state') != state:
+            try:
+                saved = check_signer.loads(request.cookies.get(CHECK_COOKIE, ''), max_age=FLOW_LIFETIME)
+                candidate = saved.get(FLOW_KEY) if isinstance(saved, dict) else None
+                if (isinstance(candidate, dict) and candidate.get('refresh') is True
+                        and isinstance(candidate.get('state'), str) and len(state) < 256
+                        and hmac.compare_digest(state, candidate['state'])):
+                    request.session.update(saved)
+                    flow = candidate
+            except (BadSignature, ValueError, TypeError):
+                pass
         valid = isinstance(flow, dict) and isinstance(flow.get('state'), str)
         if valid:
             try:
@@ -260,11 +300,13 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
         # here first, including denied/failed callbacks, and preserve newer flows.
         if not valid:
             return _completion(settings, request, 'unavailable')
+        request.scope['supra_history_clear_check_state'] = bool(flow.get('refresh'))
         bridge_id = flow.get('bridge_id')
+        fresh = bool(bridge_id or flow.get('refresh'))
         try:
             token = await oauth_client.authorize_access_token(request)
             if not isinstance(token, dict) or not token.get('id_token') or not isinstance(token.get('userinfo'), dict):
-                return _completion(settings, request, 'unavailable', connected=False if bridge_id else None)
+                return _completion(settings, request, 'unavailable', connected=False if fresh else None)
             profile = token['userinfo']
             verified = {key: profile[key] for key in ('sub', 'preferred_username', 'name', 'picture', 'profile') if key in profile}
             candidate = {'access_token': token.get('access_token'), 'expires_at': token.get('expires_at'),
@@ -280,7 +322,7 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
                     request.session.pop('oauth_info', None)
                 else:
                     request.session['oauth_info'] = old
-                return _completion(settings, request, 'unavailable', connected=False if bridge_id else None)
+                return _completion(settings, request, 'unavailable', connected=False if fresh else None)
             if bridge_id:
                 try:
                     expires = min(float(candidate['expires_at']), float(profile['exp']))
@@ -288,14 +330,24 @@ def install_oauth_routes(app: FastAPI, *, settings: OAuthSettings | None = None,
                     bridges.finish(bridge_id)
                     return _completion(settings, request, 'unavailable', connected=False)
                 claims = sessions.claims(identity, expires)
+                claims['check'] = bridge_id
                 if sessions.validate(claims) is None or not bridges.finish(bridge_id, claims):
                     return _completion(settings, request, 'unavailable', connected=False)
-            return _completion(settings, request, connected=True)
+            response = _completion(settings, request, connected=True)
+            if not bridge_id:
+                # Silent OAuth runs in the original page's embedding partition.
+                # Replace its application cookie as well as Gradio's session;
+                # otherwise the old app cookie would shadow the new HF account.
+                claims = sessions.claims(identity, candidate['expires_at'])
+                if flow.get('check'):
+                    claims['check'] = flow['check']
+                sessions.set_cookie(response, claims)
+            return response
         except OAuthError as exc:
             return _completion(settings, request, getattr(exc, 'error', 'unavailable'),
-                               connected=False if bridge_id else None)
+                               connected=False if fresh else None)
         except Exception:
-            return _completion(settings, request, 'unavailable', connected=False if bridge_id else None)
+            return _completion(settings, request, 'unavailable', connected=False if fresh else None)
         finally:
             # Errors may leave Authlib's temporary state behind; bound its cookie
             # size and prevent a replay without affecting an older OAuth login.

hf_space/history_routes.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import hashlib
+import hmac
 import json
 import logging
 import mimetypes
@@ -16,7 +17,7 @@ from urllib.parse import unquote, urlsplit
 import uuid
 
 import anyio
-from fastapi import APIRouter, FastAPI, HTTPException, Request
+from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request
 from starlette.formparsers import MultiPartException
 from starlette.responses import FileResponse, JSONResponse
 
@@ -235,7 +236,15 @@ def install_routes(
     All providers and Store methods run in worker threads. The Store is the
     authorization authority and must check owner before looking up any file.
     """
-    router = APIRouter(prefix=BASE)
+    def require_account_binding(request: Request):
+        supplied = request.headers.get('x-supra-account')
+        if supplied is not None:
+            identity = require_identity(request)
+            if not re.fullmatch(r'[0-9a-f]{64}', supplied) or not hmac.compare_digest(supplied, account_key(identity, csrf_secret)):
+                raise HTTPException(409, 'Your account changed. Verify your current account to continue.',
+                                    headers={'X-Supra-Account-Changed': '1'})
+
+    router = APIRouter(prefix=BASE, dependencies=[Depends(require_account_binding)])
     cache = private_file_cache if private_file_cache is not None else PrivateFileCache(private_cache_root)
     # Cold artifact reads can block on the mounted Bucket. Keep their workers
     # separate from metadata/status requests and bound the number of live reads.
@@ -480,6 +489,7 @@ def install_routes(
         return {'authenticated': identity is not None,
                 'username': identity.username if identity else None,
                 'account_key': account_key(identity, csrf_secret) if identity else None,
+                'verification_key': (request.scope.get('supra_history_app_claims') or {}).get('check') if identity else None,
                 'csrf_token': csrf_token(identity, csrf_secret) if identity else None,
                 'login_url': oauth_endpoints['login_url'] if oauth_endpoints else '/login/huggingface',
                 'silent_login_url': oauth_endpoints['silent_login_url'] if oauth_endpoints else None,

hf_space/history_ui.css

@@ -25,6 +25,7 @@ html:has(#st-history-shell),body:has(#st-history-shell){height:var(--st-availabl
 #st-app.st-history-app{height:var(--st-workspace-height,calc(var(--st-available-height,100dvh) - 190px));width:100%;padding:0 clamp(12px,1.2vw,24px);margin:0;background:transparent;font-family:Arial,sans-serif}
 #st-app.st-history-app [hidden]{display:none!important}
 #st-app.st-history-app #st-workspace{position:relative;display:grid!important;grid-template-columns:minmax(260px,1fr) minmax(260px,1fr) clamp(112px,9vw,154px) clamp(112px,9vw,154px);gap:12px!important;height:100%;margin:0;min-height:0;align-items:stretch!important}
+#st-app.st-history-app #st-workspace[data-account-checking=true]{visibility:hidden}
 #st-app.st-history-app .st-native-panel{display:flex!important;flex-direction:column!important;gap:9px!important;border:1px solid #373735;border-radius:15px;background:#191919;padding:12px!important;height:100%;min-width:0;min-height:0;overflow:hidden;box-shadow:none}
 #st-app.st-history-app #st-input-panel{grid-column:1;overflow:auto}
 #st-app.st-history-app #st-input-panel[data-busy=true]{pointer-events:none;border-color:#494337}

hf_space/history_ui.js

@@ -24,6 +24,7 @@
     localURL: null, silentAttempted: false, silentFrame: null, silentTimer: null,
     authPopup: null, authTimer: null, authBootstrapTimer: null, authFlow: null, authVersion: 0, authBusy: false,
     authFallback: false, identityPromise: null, authChecking: true, autoAuthAttempted: false, authMessage: ''};
+  S.verifyRequired = false; S.accountNeedsCheck = true; S.accountCheck = null;
   const gpuDispatcher = window.SupraZeroGPU.createDispatcher({
     identity: () => S.identity, version: () => S.identityVersion, stopped: () => S.stopped,
     ready: record => operationReady(S.deployment, record),
@@ -288,7 +289,8 @@
     S.silentFrame?.remove(); S.silentFrame = null;
   }
   function syncAccount() {
-    const signedIn = !!S.identity?.authenticated;
+    const signedIn = !!S.identity?.authenticated && !S.verifyRequired;
+    $('st-workspace').dataset.accountChecking = String(S.verifyRequired);
     show('st-history-account', S.expanded && signedIn);
     text('st-history-username', signedIn ? S.identity.username : '');
     $('st-workspace').inert = !signedIn;
@@ -310,29 +312,48 @@
       S.autoAuthAttempted = true; connectAccount();
     }
   }
-  async function finishSilentAuth() {
+  function beginAccountVerification() {
+    S.verifyRequired = true; S.accountNeedsCheck = false;
+    S.accountCheck = randomAuthSecret(); S.silentAttempted = false;
+    S.authChecking = true; S.authMessage = '';
+    clearTimeout(S.jobsTimer); S.jobsTimer = null;
+    $('st-delete-dialog').close();
+    syncAccount(); updateGate();
+  }
+  function accountVerificationFailed(message = '') {
     endSilent();
+    S.identity = {...S.identity, authenticated: false};
+    S.verifyRequired = false; S.accountCheck = null; S.authChecking = false;
+    S.authMessage = message;
+    clearPrivate(); updateGate(); syncAccount(); requireEntrySignIn(false);
+  }
+  async function finishSilentAuth(authenticated = false) {
+    const check = S.accountCheck;
+    endSilent();
+    if (!authenticated) return accountVerificationFailed();
     try {
       await Promise.resolve(S.identityPromise).catch(() => {});
       if (S.stopped) return;
-      const identity = await refreshIdentity();
+      const identity = await refreshIdentity({verificationKey: check});
       if (identity.authenticated) return refreshJobs();
-      requireEntrySignIn();
+      accountVerificationFailed();
     } catch {
-      S.authMessage = 'Could not verify your account. Please sign in to continue.';
-      requireEntrySignIn();
+      accountVerificationFailed('Could not verify your current account. Please sign in to continue.');
     }
   }
   function startSilentAuth() {
-    if (S.silentAttempted || S.identity?.authenticated || S.stopped) return;
+    if (S.silentAttempted || (S.identity?.authenticated && !S.verifyRequired) || S.stopped) return;
     S.silentAttempted = true;
     let signedOut = false;
     try { signedOut = sessionStorage.getItem('st-history-signed-out') === '1'; } catch {}
     const url = authURL(S.identity?.silent_login_url);
-    if (!url || signedOut) { S.authFallback = true; requireEntrySignIn(!signedOut); return; }
+    if (!url || signedOut) { S.authFallback = true; accountVerificationFailed(); return; }
     S.authChecking = true; S.authMessage = '';
     const frame = S.silentFrame = document.createElement('iframe');
-    frame.hidden = true; frame.title = 'Verify Huggingface account'; frame.src = url;
+    const verificationURL = new URL(url);
+    verificationURL.searchParams.set('refresh', '1');
+    verificationURL.searchParams.set('check', S.accountCheck);
+    frame.hidden = true; frame.title = 'Verify Huggingface account'; frame.src = verificationURL.href;
     document.body.append(frame);
     syncAccount();
     S.silentTimer = setTimeout(() => void finishSilentAuth(), 12000);
@@ -376,7 +397,7 @@
         // Neither opener access nor the popup's cookies are needed here.
         await Promise.resolve(S.identityPromise).catch(() => {});
         if (version !== S.authVersion || S.stopped) return;
-        const identity = await refreshIdentity();
+        const identity = await refreshIdentity({verificationKey: flow.bridge_id});
         if (!identity.authenticated) return accountConnectionFailed('Your browser could not save the account connection. Please try again.');
         notice('Signed in with Huggingface. You can now use Supra-Tex.');
         await refreshJobs(); return;
@@ -456,8 +477,10 @@
   }
   async function api(path, options = {}) {
     const privateCall = !/^\/(?:me|status|examples)(?:\?|$)/.test(path);
+    if (privateCall && S.verifyRequired) throw new DOMException('Account verification pending', 'AbortError');
     const identityVersion = S.identityVersion;
     const headers = {...options.headers};
+    if (privateCall && S.identity?.account_key) headers['X-Supra-Account'] = S.identity.account_key;
     if (options.json !== undefined) headers['Content-Type'] = 'application/json';
     if ((options.method || 'GET') !== 'GET' && S.identity?.csrf_token) headers['X-CSRF-Token'] = S.identity.csrf_token;
     const method = options.method || 'GET';
@@ -480,13 +503,17 @@
         if (method !== 'GET' || attempt) throw new Error('The connection timed out. Please try again.');
       }
     }
-    if (privateCall && identityVersion !== S.identityVersion) throw new DOMException('Account changed', 'AbortError');
+    if (privateCall && (identityVersion !== S.identityVersion || S.verifyRequired)) throw new DOMException('Account changed', 'AbortError');
     if (response.status === 401) {
       S.identity = {authenticated: false}; S.authChecking = false;
       S.authMessage = 'Your session has expired. Please sign in again to continue.';
       endAccountConnection(); clearPrivate(); updateGate(); syncAccount();
       throw new Error('Please authorize your Huggingface account to access your private history.');
     }
+    if (response.status === 409 && (data.code === 'account_changed' || response.headers.get('X-Supra-Account-Changed') === '1')) {
+      clearPrivate(); beginAccountVerification(); startSilentAuth();
+      throw new DOMException('Account changed', 'AbortError');
+    }
     if (!response.ok) {
       const detail = typeof data.detail === 'string' ? data.detail : data.error;
       const error = new Error(englishMessage(detail, 'Could not complete this request. Please try again.'));
@@ -501,21 +528,31 @@
     gpuDispatcher.observe(data, {requested: method === 'POST' && path !== '/gpu/prepare'});
     return data;
   }
-  async function refreshIdentity() {
+  async function refreshIdentity(options = {}) {
     if (S.identityPromise) return S.identityPromise;
-    S.identityPromise = refreshIdentityInner().finally(() => { S.identityPromise = null; });
+    S.identityPromise = refreshIdentityInner(options).finally(() => { S.identityPromise = null; });
     return S.identityPromise;
   }
-  async function refreshIdentityInner() {
+  async function refreshIdentityInner({verificationKey} = {}) {
     const identityVersion = S.identityVersion;
     const identity = await api('/me');
     if (identityVersion !== S.identityVersion) return S.identity || {authenticated: false};
+    if (verificationKey && (!identity.authenticated || identity.verification_key !== verificationKey))
+      throw new Error('The current account could not be verified.');
+    if (S.verifyRequired && !verificationKey) {
+      // A valid app cookie can still belong to the previous HF account. Do not
+      // publish it or request any private history before fresh OAuth completes.
+      if (!S.identity) S.identity = {...identity, authenticated: false};
+      else for (const key of ['login_url', 'silent_login_url', 'bridge_url', 'popup_url']) S.identity[key] = identity[key];
+      return {authenticated: false};
+    }
     const previous = S.identity;
     const preserve = previous && !previous.authenticated && identity.authenticated &&
       (S.source?.local_file || S.source?.example) ? {source: S.source, seed: $('st-seed').value} : null;
     if (previous && (previous.account_key !== identity.account_key ||
         previous.username !== identity.username || previous.authenticated !== identity.authenticated)) clearPrivate();
     S.identity = identity; S.lastIdentityCheck = Date.now();
+    if (verificationKey) { S.verifyRequired = false; S.accountCheck = null; }
     window.SupraPrivateAssets?.setAccount(identity.authenticated ? identity.account_key || identity.username : '');
     if (preserve?.source.local_file) stageLocalFile(preserve.source.local_file, preserve.seed);
     else if (preserve?.source.example) {
@@ -543,7 +580,7 @@
     updateGate();
   }
   function updateGate() {
-    const signedIn = !!S.identity?.authenticated, loading = !ready(S.deployment);
+    const signedIn = !!S.identity?.authenticated && !S.verifyRequired, loading = !ready(S.deployment);
     const inputBusy = leftInputBusy(), geometry = selectedGeometry();
     $('st-input-panel').inert = inputBusy;
     $('st-input-panel').dataset.busy = String(inputBusy);
@@ -732,12 +769,12 @@
   }
   function scheduleJobs() {
     clearTimeout(S.jobsTimer); S.jobsTimer = null;
-    if (!S.stopped && S.identity?.authenticated && (!S.historyLoaded || S.historyFailures || [...S.jobs.values()].some(pending)))
+    if (!S.stopped && !S.verifyRequired && S.identity?.authenticated && (!S.historyLoaded || S.historyFailures || [...S.jobs.values()].some(pending)))
       S.jobsTimer = setTimeout(() => refreshJobs().catch(() => {}),
         document.hidden ? 20000 : S.historyLoaded ? 4000 : 5000);
   }
   async function refreshJobs(more = false) {
-    if (!S.identity?.authenticated || S.stopped) return;
+    if (!S.identity?.authenticated || S.verifyRequired || S.stopped) return;
     if (S.refreshPromise) return S.refreshPromise;
     const identityVersion = S.identityVersion;
     S.pageLoading = true; renderHistory();
@@ -1052,7 +1089,7 @@
     return S.examplesPromise;
   }
   async function activateWorkspace() {
-    if (!S.identity?.authenticated || !ready(S.deployment) || S.stopped) return;
+    if (!S.identity?.authenticated || S.verifyRequired || !ready(S.deployment) || S.stopped) return;
     await Promise.allSettled([loadExamples(), refreshJobs()]);
     if (S.source?.local_file && !S.source.upload_id && S.source.foreground_required &&
         (!S.uploadState || S.uploadState.phase === 'waiting_service'))
@@ -1448,7 +1485,7 @@
     // Interactive sign-in uses the one-time server handoff. HF's login page
     // can sever window.opener; its completion message is only a hint, not proof.
     if (!silent) return;
-    void finishSilentAuth();
+    void finishSilentAuth(event.data.authenticated === true);
   });
   window.addEventListener('resize', () => { positionHistory(); updateGate(); });
   window.addEventListener('scroll', positionHistory, {passive: true});
@@ -1460,20 +1497,33 @@
     // Keep polling the handoff rather than treating that as a cancelled login.
     if (!S.authFlow && S.authPopup?.closed) { S.authPopup = null; S.authBusy = false; updateGate(); }
     if (S.authFlow) { void refreshStatus(); return; }
-    if (document.hidden || Date.now() - S.lastIdentityCheck < 2000) return;
+    if (document.hidden || (!S.accountNeedsCheck && Date.now() - S.lastIdentityCheck < 2000)) return;
     try {
+      if (S.accountNeedsCheck) {
+        beginAccountVerification(); await refreshIdentity(); startSilentAuth(); return;
+      }
       const identity = await refreshIdentity();
       if (identity.authenticated) await refreshJobs();
-      else if (!S.silentFrame) requireEntrySignIn();
+      else if (!S.silentFrame) requireEntrySignIn(false);
+    }
+    catch (error) {
+      if (S.verifyRequired) accountVerificationFailed('Could not verify your current account. Please sign in to continue.');
+      else if (!quietError(error)) notice('Could not reconnect. Please refresh to retry.');
     }
-    catch (error) { if (!quietError(error)) notice('Could not reconnect. Please refresh to retry.'); }
     void refreshStatus();
   }
   document.addEventListener('visibilitychange', () => {
     clearTimeout(S.jobsTimer); clearTimeout(S.startupTimer);
-    if (document.hidden) { scheduleJobs(); if (pollStartup()) S.startupTimer = setTimeout(refreshStatus, 20000); }
+    if (document.hidden) { shieldPrivateWorkspace(); scheduleJobs(); if (pollStartup()) S.startupTimer = setTimeout(refreshStatus, 20000); }
     else void resume();
   });
+  function shieldPrivateWorkspace() {
+    if (S.authFlow || S.authChecking || S.stopped) return;
+    S.accountNeedsCheck = true;
+    $('st-workspace').dataset.accountChecking = 'true';
+    $('st-workspace').inert = true;
+  }
+  window.addEventListener('blur', shieldPrivateWorkspace);
   window.addEventListener('focus', () => void resume());
   window.addEventListener('pagehide', () => {
     S.stopped = true; clearTimeout(S.jobsTimer); clearTimeout(S.startupTimer); clearTimeout(S.noticeTimer);
@@ -1482,15 +1532,13 @@
   });
   window.addEventListener('pageshow', event => { if (event.persisted) { S.stopped = false; S.lastIdentityCheck = 0; void resume(); } });
   async function boot() {
+    beginAccountVerification();
     syncAccount(); updateGate(); void refreshStatus(); void loadExamples();
     try {
-      const identity = await refreshIdentity();
-      if (identity.authenticated) await refreshJobs();
-      else { startSilentAuth(); renderHistory(); }
+      await refreshIdentity(); startSilentAuth(); renderHistory();
     }
     catch {
-      S.authMessage = 'Could not check your account. Please sign in to continue.';
-      requireEntrySignIn(false);
+      accountVerificationFailed('Could not check your account. Please sign in to continue.');
     }
   }
   void boot();

tests/test_history_account_switch.py

@@ -0,0 +1,164 @@
+"""A fresh HF identity replaces both cookie formats before private history loads."""
+from io import BytesIO
+import time
+from types import SimpleNamespace
+
+from authlib.integrations.base_client import OAuthError
+from fastapi import FastAPI, Request
+from PIL import Image
+import pytest
+from starlette.middleware.sessions import SessionMiddleware
+from starlette.responses import RedirectResponse
+from starlette.testclient import TestClient
+
+from hf_space.history_auth import Identity
+from hf_space.history_bridge import AppSessions, COOKIE_NAME
+from hf_space.history_oauth import install_oauth_routes, OAuthSettings
+from hf_space.history_routes import install_routes
+from hf_space.history_store import Store
+
+
+class Provider:
+    def __init__(self):
+        self.account = 'bob'
+        self.error = None
+        self.params = None
+        self.exchanges = 0
+        self.framework = SimpleNamespace(clear_state_data=self.clear_state)
+
+    async def clear_state(self, session, state):
+        pass
+
+    async def authorize_redirect(self, request, redirect_uri, **params):
+        self.params = params
+        request.session['_state_supra_history_' + params['state']] = {
+            'data': {'nonce': params['nonce'], 'code_verifier': 'test-pkce-verifier'}}
+        return RedirectResponse('https://huggingface.co/oauth/authorize?state=' + params['state'], status_code=302)
+
+    async def authorize_access_token(self, request):
+        self.exchanges += 1
+        data = request.session['_state_supra_history_' + self.params['state']]['data']
+        assert data['nonce'] == self.params['nonce']
+        assert data['code_verifier'] == 'test-pkce-verifier'
+        if self.error:
+            raise OAuthError(error=self.error)
+        return {'id_token': 'verified-by-mock-oidc-provider', 'access_token': 'mock-access-token',
+                'expires_at': time.time() + 3600,
+                'userinfo': {'sub': self.account, 'preferred_username': self.account,
+                             'exp': time.time() + 3600}}
+
+
+@pytest.fixture
+def env(tmp_path, monkeypatch):
+    monkeypatch.setenv('SPACES_ZERO_GPU', 'true')
+    for name in ('SPACE_ID', 'SPACE_HOST', 'OAUTH_CLIENT_ID', 'OAUTH_CLIENT_SECRET'):
+        monkeypatch.delenv(name, raising=False)
+    store = Store(tmp_path/'history', asset_root=tmp_path/'assets').initialize()
+    stream = BytesIO()
+    Image.new('RGB', (12, 12), 'red').save(stream, 'PNG')
+    jobs = {}
+    for owner in ('alice', 'bob'):
+        upload = store.save_upload(owner, stream.getvalue())
+        jobs[owner] = store.submit(owner, upload['id'], 42, owner + '-request')
+    app = FastAPI()
+    app.add_middleware(SessionMiddleware, secret_key='test-gradio-session', https_only=True, same_site='none')
+    provider = Provider()
+    sessions = AppSessions('test-partitioned-session')
+    settings = OAuthSettings('test-client', 'test-partitioned-session', 'https://app.example')
+    install_oauth_routes(app, settings=settings, oauth_client=provider, sessions=sessions)
+    install_routes(app, store, deployment_status=lambda: {'gpu_mode': 'zerogpu', 'workspace': {'stage': 'ready'}},
+                   private_cache_root=tmp_path/'private', trusted_origins=[settings.origin])
+
+    @app.get('/seed-legacy')
+    async def seed_legacy(request: Request):
+        request.session['oauth_info'] = {'access_token': 'old-token', 'expires_at': time.time()+3600,
+                                        'userinfo': {'sub': 'alice', 'preferred_username': 'alice'}}
+        return {}
+
+    client = TestClient(app, base_url=settings.origin)
+    client.get('/seed-legacy')
+    claims = sessions.claims(Identity('alice', 'alice', 'old-session'), time.time()+3600)
+    client.cookies.set(COOKIE_NAME, sessions.serializer.dumps(claims), domain='app.example', path='/')
+    return SimpleNamespace(client=client, provider=provider, sessions=sessions, jobs=jobs)
+
+
+def begin(env, check='c' * 43):
+    response = env.client.get('/api/history/auth/start', params={'silent': '1', 'refresh': '1', 'check': check},
+                              follow_redirects=False)
+    assert response.status_code == 302
+    assert env.provider.params['prompt'] == 'none'
+    return response
+
+
+def finish(env):
+    return env.client.get('/api/history/auth/callback', params={'state': env.provider.params['state'], 'code': 'mock-code'})
+
+
+def test_refresh_never_shortcuts_old_app_login_and_clears_both_cookie_formats(env):
+    assert env.client.get('/api/history/me').json()['username'] == 'alice'
+    response = begin(env)
+    cleared = [v for v in response.headers.get_list('set-cookie') if v.startswith(COOKIE_NAME+'=')]
+    assert len(cleared) == 2 and all('Max-Age=0' in v for v in cleared)
+    assert any('Partitioned' in v for v in cleared)
+    assert env.client.get('/api/history/me').json()['authenticated'] is False
+    assert env.client.get('/api/history/jobs').status_code == 401
+
+
+def test_silent_recheck_replaces_old_account_and_only_returns_new_owner_history(env):
+    begin(env)
+    response = finish(env)
+    assert response.status_code == 200
+    identity = env.client.get('/api/history/me').json()
+    assert identity['username'] == 'bob'
+    assert identity['verification_key'] == 'c'*43
+    result = env.client.get('/api/history/jobs', headers={'X-Supra-Account': identity['account_key']})
+    assert result.status_code == 200
+    assert [j['id'] for j in result.json()['items']] == [env.jobs['bob']['id']]
+    assert env.client.get('/api/history/jobs/'+env.jobs['alice']['id']).status_code == 404
+    assert env.client.get('/api/history/jobs/'+env.jobs['alice']['id']+'/files/input.png').status_code == 404
+    assert 'no-store' in result.headers['cache-control']
+
+
+def test_logged_out_hf_or_failed_recheck_never_reuses_account_a(env):
+    begin(env)
+    env.provider.error = 'login_required'
+    response = finish(env)
+    assert '"authenticated":false' in response.text
+    assert env.client.get('/api/history/me').json()['authenticated'] is False
+    assert env.client.get('/api/history/jobs').status_code == 401
+
+
+def test_stale_tab_account_header_rejects_cookie_changed_by_another_tab(env):
+    old_key = env.client.get('/api/history/me').json()['account_key']
+    begin(env)
+    finish(env)
+    response = env.client.get('/api/history/jobs', headers={'X-Supra-Account': old_key})
+    assert response.status_code == 409
+    assert response.headers['x-supra-account-changed'] == '1'
+    assert 'items' not in response.json()
+
+
+def test_forged_callback_cannot_replace_an_account_or_issue_a_verified_cookie(env):
+    begin(env)
+    response = env.client.get('/api/history/auth/callback', params={'state': 'forged', 'code': 'mock-code'})
+    assert env.provider.exchanges == 0
+    assert not any(v.startswith(COOKIE_NAME+'=') and 'Max-Age=0' not in v for v in response.headers.get_list('set-cookie'))
+    assert env.client.get('/api/history/me').json()['authenticated'] is False
+
+
+def test_refresh_requires_a_bounded_fresh_client_check(env):
+    response = env.client.get('/api/history/auth/start?refresh=1&silent=1', follow_redirects=False)
+    assert response.status_code == 400
+    assert env.provider.params is None
+
+
+def test_silent_check_works_when_the_unpartitioned_gradio_cookie_is_blocked(env):
+    begin(env)
+    env.client.cookies.delete('session', domain='app.example', path='/')
+    response = finish(env)
+    assert response.status_code == 200
+    identity = env.client.get('/api/history/me').json()
+    assert identity['username'] == 'bob'
+    assert identity['verification_key'] == 'c'*43
+    assert any('__Host-supra-history-oauth-check=;' in c and 'Max-Age=0' in c
+               for c in response.headers.get_list('set-cookie'))

tests/test_history_ui_resume.cjs

@@ -18,6 +18,79 @@ const deployment = (runtimeId, completed = 2, total = 5) => ({
   models: {stage: 'loading_models', startup_progress: {completed, total, unit: 'models', label: 'Internal model name'}}
 });
 
+test('an old app login is hidden and never loads history before the current HF account is verified', async t => {
+  const env = setup(t);
+  env.S.identity = {authenticated: true, username: 'alice', account_key: 'account-a'};
+  env.network.identity = {...env.S.identity, silent_login_url: '/api/history/auth/start?silent=1'};
+  env.beginAccountVerification();
+  const identity = await env.refreshIdentity();
+  assert.equal(identity.authenticated, false);
+  assert.equal(env.get('st-workspace').dataset.accountChecking, 'true');
+  assert.equal(env.get('st-workspace').inert, true);
+  assert.equal(env.requests.filter(r => r.url.startsWith('/api/history/jobs')).length, 0);
+  assert.equal(env.submissions.length, 0);
+  assert.equal(env.S.jobs.has(savedJob.id), true, 'checking identity does not destroy an ongoing task');
+});
+
+test('fresh HF account B replaces account A and clears A history, inputs and cached assets before display', async t => {
+  const env = setup(t), accounts = [];
+  env.context.window.SupraPrivateAssets = {setAccount: value => accounts.push(value)};
+  env.S.identity = {authenticated: true, username: 'alice', account_key: 'account-a'};
+  env.S.localURL = 'blob:alice-input';
+  env.beginAccountVerification();
+  env.network.identity = {authenticated: true, username: 'bob', account_key: 'account-b', verification_key: env.S.accountCheck};
+  env.network.jobsResponse = {items: [{...savedJob, id: 'bob-job', status: 'complete'}], revision: 'b:1'};
+  await env.finishSilentAuth(true); await tick();
+  assert.equal(env.S.identity.username, 'bob');
+  assert.equal(env.S.jobs.has(savedJob.id), false);
+  assert.equal(env.S.jobs.has('bob-job'), true);
+  assert.equal(env.S.source, null);
+  assert(env.images.revoked.includes('blob:alice-input'));
+  assert(accounts.includes(''));
+  assert.equal(accounts.at(-1), 'account-b');
+  assert.equal(env.get('st-workspace').dataset.accountChecking, 'false');
+  assert.equal(env.submissions.length, 0);
+});
+
+test('a silent timeout or blocked cookie cannot fall back to account A history', async t => {
+  for (const authenticated of [false, true]) {
+    const env = setup(t);
+    env.S.identity = {authenticated: true, username: 'alice', account_key: 'account-a'};
+    env.beginAccountVerification();
+    env.network.identity = {...env.S.identity, verification_key: 'old-check'};
+    await env.finishSilentAuth(authenticated);
+    assert.equal(env.S.identity.authenticated, false);
+    assert.equal(env.S.jobs.size, 0);
+    assert.equal(env.S.source, null);
+    assert.equal(env.requests.filter(r => r.url.startsWith('/api/history/jobs')).length, 0);
+    assert.equal(env.get('st-auth-dialog').open, true);
+  }
+});
+
+test('leaving the page masks private content while keeping an active operation intact', async t => {
+  const env = setup(t);
+  env.S.accountNeedsCheck = false;
+  env.shieldPrivateWorkspace();
+  assert.equal(env.S.accountNeedsCheck, true);
+  assert.equal(env.get('st-workspace').dataset.accountChecking, 'true');
+  assert.equal(env.get('st-workspace').inert, true);
+  assert.equal(env.S.jobs.has(savedJob.id), true);
+});
+
+test('a cookie changed by another tab cannot merge its history into the old account', async t => {
+  const env = setup(t);
+  env.S.identity = {authenticated: true, username: 'alice', account_key: 'account-a', silent_login_url: '/api/history/auth/start?silent=1'};
+  env.network.jobsResponse = {detail: 'Your account changed.'};
+  env.network.jobsStatus = 409; env.network.jobsHeaders = {'X-Supra-Account-Changed': '1'};
+  await env.refreshJobs();
+  const request = env.requests.find(r => r.url.startsWith('/api/history/jobs'));
+  assert.equal(request.headers['X-Supra-Account'], 'account-a');
+  assert.equal(env.S.jobs.size, 0);
+  assert.equal(env.S.verifyRequired, true);
+  assert.equal(env.get('st-workspace').dataset.accountChecking, 'true');
+  assert.equal(env.submissions.length, 0);
+});
+
 function fakeDOM() {
   const nodes = new Map();
   class Element {
@@ -29,7 +102,9 @@ function fakeDOM() {
     }
     get textContent() { return this._textContent; }
     set textContent(value) { this._textContent = value; this.textHistory.push(value); }
-    close() { this.hidden = true; }
+    close() { this.hidden = true; this.open = false; }
+    showModal() { this.hidden = false; this.open = true; }
+    remove() { this.removed = true; }
     addEventListener(type, handler) {
       const handlers = this.handlers.get(type) || [];
       handlers.push(handler); this.handlers.set(type, handlers);
@@ -69,7 +144,7 @@ function fakeDOM() {
   nodes.get('st-job-progress').append(new Element('progress'));
   nodes.get('st-texture-progress').append(new Element('progress'));
   const documentHandlers = new Map();
-  const document = {hidden: false, getElementById: id => nodes.get(id) || null, handlers: documentHandlers,
+  const document = {hidden: false, body: new Element('body'), getElementById: id => nodes.get(id) || null, handlers: documentHandlers,
     createElement: tag => new Element(tag), createDocumentFragment: () => new Element('#fragment'),
     addEventListener(type, handler) {
       const handlers = documentHandlers.get(type) || [];
@@ -95,6 +170,7 @@ function setup(t) {
   const context = vm.createContext({
     AbortController, AbortSignal, DOMException, Headers, URL: UploadURL, URLSearchParams, Image: UploadImage, crypto: require('node:crypto').webcrypto,
     document: dom.document, window: {addEventListener() {}},
+    btoa: value => Buffer.from(value, 'binary').toString('base64'),
     location: {origin: 'https://example.hf.space', href: 'https://example.hf.space/'},
     matchMedia: () => ({matches: false}),
     requestAnimationFrame: callback => callback(),
@@ -102,6 +178,10 @@ function setup(t) {
     clearTimeout: id => timers.delete(id),
     async fetch(url, options = {}) {
       requests.push({url, method: options.method || 'GET', headers: options.headers, body: options.body});
+      if (url === '/api/history/me') {
+        if (network.nextIdentity) { const pending = network.nextIdentity; network.nextIdentity = null; return pending.promise; }
+        return response(network.identity);
+      }
       if (url === '/api/history/status') {
         if (network.nextStatus) {
           const pending = network.nextStatus; network.nextStatus = null; return pending.promise;
@@ -118,7 +198,8 @@ function setup(t) {
       }
       if (/^\/api\/history\/uploads\/[^/]+\/foreground$/.test(url)) return response(network.retryUploadResponse);
       if (url === '/api/history/gpu/prepare') return response({});
-      if (url.startsWith('/api/history/jobs?') && network.jobsResponse) return response(network.jobsResponse);
+      if (url.startsWith('/api/history/jobs?') && network.jobsResponse)
+        return new Response(JSON.stringify(network.jobsResponse), {status: network.jobsStatus || 200, headers: network.jobsHeaders});
       if (url === '/api/history/submit' && network.nextSubmission) {
         const pending = network.nextSubmission; network.nextSubmission = null; return pending.promise;
       }
@@ -145,7 +226,7 @@ function setup(t) {
   })};
   assert.equal((uiSource.match(/void boot\(\);/g) || []).length, 1);
   vm.runInContext(uiSource.replace('void boot();',
-    'globalThis.testUI = {S, renderSelected, refreshStatus, refreshJobs, updateGate, submit, gpuDispatcher, resumeGPU, selectJob, selectExample, previewKey, historyStatus, applyUploadResult, refreshUpload, clearPrivate, clearUploadPreview, retryUploadPreview};'), context);
+    'globalThis.testUI = {S, renderSelected, refreshStatus, refreshJobs, updateGate, submit, gpuDispatcher, resumeGPU, selectJob, selectExample, previewKey, historyStatus, applyUploadResult, refreshUpload, clearPrivate, clearUploadPreview, retryUploadPreview, refreshIdentity, beginAccountVerification, finishSilentAuth, shieldPrivateWorkspace};'), context);
   const ui = context.testUI;
   Object.assign(ui.S, {identity: {authenticated: true, csrf_token: 'csrf-test'}, authChecking: false,
     selected: {kind: 'job', id: savedJob.id}, source: {upload_id: 'saved-upload'},
@@ -156,7 +237,7 @@ function setup(t) {
   t.after(async () => {
     ui.S.stopped = true; ui.gpuDispatcher.reset(); finishGPU.resolve(); await tick();
   });
-  return {...ui, ...dom, network, requests, submissions, response, images, timers,
+  return {...ui, ...dom, network, requests, submissions, response, images, timers, context,
     prepareRequests: () => requests.filter(request => request.url === '/api/history/gpu/prepare')};
 }