Final 6.1.3

README.md

@@ -10,6 +10,9 @@ pinned: false
 hf_oauth: true
 # optional, default duration is 8 hours/480 minutes. Max duration is 30 days/43200 minutes.
 hf_oauth_expiration_minutes: 480
+# Required scopes for Qwen model access via Inference API
+hf_oauth_scopes:
+  - inference-api
 short_description: Multi-Agent AI System for GAIA Benchmark Questions
 suggested_hardware: cpu-upgrade
 models:

src/app.py

@@ -438,21 +438,63 @@ def check_oauth_scopes(oauth_token: str) -> Dict[str, any]:
         headers = {"Authorization": f"Bearer {oauth_token}"}
         
         # Test whoami endpoint (requires read scope)
-        whoami_response = requests.get("https://huggingface.co/api/whoami", headers=headers, timeout=5)
-        can_read = whoami_response.status_code == 200
+        logger.info("🔍 Testing OAuth token with whoami endpoint...")
+        try:
+            whoami_response = requests.get("https://huggingface.co/api/whoami", headers=headers, timeout=10)
+            can_read = whoami_response.status_code == 200
+            logger.info(f"✅ Whoami response: {whoami_response.status_code}")
+            
+            if whoami_response.status_code == 401:
+                logger.warning("⚠️ OAuth token unauthorized for whoami endpoint")
+            elif whoami_response.status_code != 200:
+                logger.warning(f"⚠️ Unexpected whoami response: {whoami_response.status_code}")
+                
+        except Exception as whoami_error:
+            logger.error(f"❌ Whoami test failed: {whoami_error}")
+            can_read = False
         
         # Test inference capability by trying a simple model call
+        logger.info("🔍 Testing OAuth token with inference endpoint...")
         can_inference = False
         try:
             # Try a very simple inference call to test scope
             inference_url = "https://api-inference.huggingface.co/models/microsoft/DialoGPT-medium"
             test_payload = {"inputs": "test", "options": {"wait_for_model": False, "use_cache": True}}
-            inference_response = requests.post(inference_url, headers=headers, json=test_payload, timeout=10)
+            inference_response = requests.post(inference_url, headers=headers, json=test_payload, timeout=15)
+            
             # 200 = success, 503 = model loading (but scope works), 401/403 = no scope
             can_inference = inference_response.status_code in [200, 503]
-        except:
+            logger.info(f"✅ Inference response: {inference_response.status_code}")
+            
+            if inference_response.status_code == 401:
+                logger.warning("⚠️ OAuth token unauthorized for inference endpoint - likely missing 'inference' scope")
+            elif inference_response.status_code == 403:
+                logger.warning("⚠️ OAuth token forbidden for inference endpoint - insufficient permissions")
+            elif inference_response.status_code not in [200, 503]:
+                logger.warning(f"⚠️ Unexpected inference response: {inference_response.status_code}")
+                
+        except Exception as inference_error:
+            logger.error(f"❌ Inference test failed: {inference_error}")
             can_inference = False
         
+        # Alternative inference test - try Qwen model directly
+        if not can_inference:
+            logger.info("🔍 Testing OAuth token with Qwen model directly...")
+            try:
+                qwen_url = "https://api-inference.huggingface.co/models/Qwen/Qwen2.5-7B-Instruct"
+                qwen_payload = {"inputs": "Hello", "options": {"wait_for_model": False}}
+                qwen_response = requests.post(qwen_url, headers=headers, json=qwen_payload, timeout=15)
+                
+                qwen_inference = qwen_response.status_code in [200, 503]
+                if qwen_inference:
+                    can_inference = True
+                    logger.info(f"✅ Qwen model response: {qwen_response.status_code}")
+                else:
+                    logger.warning(f"⚠️ Qwen model response: {qwen_response.status_code}")
+                    
+            except Exception as qwen_error:
+                logger.error(f"❌ Qwen model test failed: {qwen_error}")
+        
         # Determine probable scopes based on capabilities
         probable_scopes = []
         if can_read:
@@ -460,9 +502,11 @@ def check_oauth_scopes(oauth_token: str) -> Dict[str, any]:
         if can_inference:
             probable_scopes.append("inference")
         
+        logger.info(f"📊 Final scope assessment: {probable_scopes}")
+        
         # Get user info if available
         user_info = {}
-        if can_read:
+        if can_read and whoami_response.status_code == 200:
             try:
                 user_data = whoami_response.json()
                 user_info = {
@@ -470,7 +514,9 @@ def check_oauth_scopes(oauth_token: str) -> Dict[str, any]:
                     "fullname": user_data.get("fullName", ""),
                     "avatar": user_data.get("avatarUrl", "")
                 }
-            except:
+                logger.info(f"✅ User info retrieved: {user_info.get('name', 'unknown')}")
+            except Exception as user_error:
+                logger.warning(f"⚠️ Could not parse user info: {user_error}")
                 user_info = {}
         
         return {
@@ -483,6 +529,7 @@ def check_oauth_scopes(oauth_token: str) -> Dict[str, any]:
         }
         
     except Exception as e:
+        logger.error(f"❌ OAuth scope check failed: {e}")
         return {
             "logged_in": True,
             "scopes": ["unknown"],
@@ -495,7 +542,7 @@ def check_oauth_scopes(oauth_token: str) -> Dict[str, any]:
 def format_auth_status(profile: gr.OAuthProfile | None) -> str:
     """Format authentication status for display in UI"""
     
-    # Check for HF_TOKEN first
+    # Check for HF_TOKEN first (best performance)
     hf_token = os.getenv("HF_TOKEN")
     
     if hf_token:
@@ -521,18 +568,34 @@ def format_auth_status(profile: gr.OAuthProfile | None) -> str:
 💡 **Status**: Optimal configuration for GAIA benchmark performance with real AI agents.
 """
     
+    # Check HuggingFace Spaces OAuth configuration
+    oauth_scopes = os.getenv("OAUTH_SCOPES")
+    oauth_client_id = os.getenv("OAUTH_CLIENT_ID")
+    has_inference_scope = oauth_scopes and "inference-api" in oauth_scopes
+    
     if not profile:
-        return """
+        oauth_status = ""
+        if oauth_client_id:
+            if has_inference_scope:
+                oauth_status = "**🔑 OAuth Configuration**: ✅ Space configured with `inference-api` scope"
+            else:
+                oauth_status = "**⚠️ OAuth Configuration**: Space OAuth enabled but missing `inference-api` scope"
+        else:
+            oauth_status = "**❌ OAuth Configuration**: Space not configured for OAuth (missing `hf_oauth: true` in README.md)"
+        
+        return f"""
 ### 🔐 Authentication Status: Not Logged In
 
 Please log in to access GAIA evaluation with Qwen models and LangGraph workflow.
 
+{oauth_status}
+
 **What you need:**
-- 🔑 HuggingFace login with `read` and `inference` permissions
+- 🔑 HuggingFace login with `read` and `inference-api` permissions
 - 🤖 Access to Qwen 2.5 models via HF Inference API
 - 🧠 LangGraph multi-agent system capabilities
 
-**🔑 OAuth Configuration**: Login requests both `read` and `inference` scopes for Qwen model access.
+**🔑 OAuth Scopes**: Login requests `inference-api` scope for Qwen model access.
 **📈 Expected Performance**: 30%+ GAIA score with full LangGraph workflow and Qwen models.
 **⚠️ No Fallbacks**: System requires proper authentication - no simplified responses.
 """
@@ -540,7 +603,33 @@ Please log in to access GAIA evaluation with Qwen models and LangGraph workflow.
     username = profile.username
     oauth_token = getattr(profile, 'oauth_token', None) or getattr(profile, 'token', None)
     
-    scope_info = check_oauth_scopes(oauth_token)
+    # Try multiple methods to extract OAuth token
+    if not oauth_token:
+        for attr in ['access_token', 'id_token', 'bearer_token']:
+            token = getattr(profile, attr, None)
+            if token:
+                oauth_token = token
+                logger.info(f"🔑 Found OAuth token via {attr}")
+                break
+    
+    # If still no token, check if profile has any token-like attributes
+    if not oauth_token and hasattr(profile, '__dict__'):
+        token_attrs = [attr for attr in profile.__dict__.keys() if 'token' in attr.lower()]
+        if token_attrs:
+            logger.info(f"🔍 Available token attributes: {token_attrs}")
+            # Try the first available token attribute
+            oauth_token = getattr(profile, token_attrs[0], None)
+            if oauth_token:
+                logger.info(f"🔑 Using token from {token_attrs[0]}")
+    
+    scope_info = check_oauth_scopes(oauth_token) if oauth_token else {
+        "logged_in": True,
+        "scopes": [],
+        "can_inference": False,
+        "can_read": False,
+        "user_info": {},
+        "message": "Logged in but no OAuth token found"
+    }
     
     status_parts = [f"### 🔐 Authentication Status: Logged In as {username}"]
     
@@ -549,9 +638,19 @@ Please log in to access GAIA evaluation with Qwen models and LangGraph workflow.
     if user_info and user_info.get("fullname"):
         status_parts.append(f"**Full Name**: {user_info['fullname']}")
     
+    # HuggingFace Spaces OAuth Environment Status
+    if oauth_client_id:
+        if has_inference_scope:
+            status_parts.append("**🏠 Space OAuth**: ✅ Configured with `inference-api` scope")
+        else:
+            status_parts.append("**🏠 Space OAuth**: ⚠️ Missing `inference-api` scope in README.md")
+            status_parts.append(f"**Available Scopes**: {oauth_scopes}")
+    else:
+        status_parts.append("**🏠 Space OAuth**: ❌ Not configured (`hf_oauth: true` missing)")
+    
     # Safely access scopes
     scopes = scope_info.get("scopes", [])
-    status_parts.append(f"**Detected Scopes**: {', '.join(scopes) if scopes else 'None detected'}")
+    status_parts.append(f"**Detected Token Scopes**: {', '.join(scopes) if scopes else 'None detected'}")
     status_parts.append("")
     status_parts.append("**System Capabilities:**")
     
@@ -585,6 +684,17 @@ Please log in to access GAIA evaluation with Qwen models and LangGraph workflow.
     ])
     
     if not can_inference:
+        if not has_inference_scope:
+            status_parts.extend([
+                "",
+                "🔧 **Space Configuration Issue**: Add `inference-api` scope to README.md:",
+                "```yaml",
+                "hf_oauth_scopes:",
+                "  - inference-api",
+                "```",
+                "**After updating**: Space will restart and request proper scopes on next login."
+            ])
+        
         status_parts.extend([
             "",
             "🔑 **Authentication Required**: Your OAuth session lacks inference permissions.",
@@ -592,6 +702,15 @@ Please log in to access GAIA evaluation with Qwen models and LangGraph workflow.
             "**Alternative**: Set HF_TOKEN as a Space secret for guaranteed Qwen model access.",
             "**Note**: System requires Qwen model access - no simplified fallbacks available."
         ])
+        
+        # Add specific guidance if we couldn't find an OAuth token
+        if not oauth_token:
+            status_parts.extend([
+                "",
+                "🔍 **OAuth Token Issue**: Could not extract OAuth token from your session.",
+                "**Troubleshooting**: Click '🔍 Debug OAuth' button above to investigate.",
+                "**Common Fix**: Logout and login again to refresh your OAuth session."
+            ])
     else:
         status_parts.extend([
             "",
@@ -1152,6 +1271,7 @@ Please log in to access GAIA evaluation features with full inference access.
                         # The scopes will be configured at the interface level
                     )
                     refresh_auth_button = gr.Button("🔄 Refresh Auth Status", variant="secondary", scale=1)
+                    debug_auth_button = gr.Button("🔍 Debug OAuth", variant="secondary", scale=1)
                 
                 unit4_run_button = gr.Button(
                     "🔒 Login Required for GAIA Evaluation", 
@@ -1293,24 +1413,88 @@ Please log in to access GAIA evaluation features with full inference access.
             return status, table, auth_status, csv_update, json_update, summary_update
         
         def refresh_auth_status(request: gr.Request):
-            """Refresh authentication status display"""
-            profile = getattr(request, 'oauth_profile', None)
-            return format_auth_status(profile)
+            """Refresh authentication status display with enhanced debugging"""
+            try:
+                # Get OAuth profile from request with debugging
+                profile = getattr(request, 'oauth_profile', None)
+                
+                # Try multiple ways to get user info
+                user = getattr(request, 'user', None)
+                session = getattr(request, 'session', None)
+                headers = getattr(request, 'headers', {})
+                
+                # Log debug information
+                logger.info(f"🔍 OAuth Debug - Profile: {profile is not None}")
+                logger.info(f"🔍 OAuth Debug - User: {user is not None}")
+                logger.info(f"🔍 OAuth Debug - Session: {session is not None}")
+                
+                if profile:
+                    logger.info(f"✅ Profile found: username={getattr(profile, 'username', 'unknown')}")
+                    
+                    # Try different ways to extract OAuth token
+                    oauth_token = None
+                    for attr in ['oauth_token', 'token', 'access_token', 'id_token']:
+                        token = getattr(profile, attr, None)
+                        if token:
+                            oauth_token = token
+                            logger.info(f"🔑 Found token via {attr}: {len(token) if token else 0} chars")
+                            break
+                    
+                    if not oauth_token and hasattr(profile, '__dict__'):
+                        logger.info(f"🔍 Profile attributes: {list(profile.__dict__.keys())}")
+                else:
+                    logger.warning("⚠️ No OAuth profile found in request")
+                
+                # Check for HF_TOKEN as fallback
+                hf_token = os.getenv("HF_TOKEN")
+                if hf_token:
+                    logger.info("✅ HF_TOKEN environment variable available")
+                else:
+                    logger.info("ℹ️ No HF_TOKEN environment variable")
+                
+                return format_auth_status(profile)
+                
+            except Exception as e:
+                logger.error(f"❌ Error in refresh_auth_status: {e}")
+                return f"### ❌ Authentication Error\n\nError checking auth status: {str(e)}"
         
         def check_login_state(request: gr.Request):
-            """Check if user is logged in and update UI accordingly"""
-            profile = getattr(request, 'oauth_profile', None)
-            
-            if profile:
-                # User is logged in - return updated auth status
-                auth_status = format_auth_status(profile)
-                # Enable the run button
-                button_update = gr.update(interactive=True, value="🚀 Run GAIA Evaluation & Submit All Answers")
-                return auth_status, button_update
-            else:
-                # User not logged in - show login required message
-                auth_status = format_auth_status(None)
-                # Disable the run button  
+            """Check if user is logged in and update UI accordingly with enhanced detection"""
+            try:
+                profile = getattr(request, 'oauth_profile', None)
+                
+                # Enhanced profile detection
+                if not profile:
+                    # Try alternative ways to get profile
+                    user = getattr(request, 'user', None)
+                    if user and hasattr(user, 'username'):
+                        # Create a minimal profile object if we have user info
+                        class MockProfile:
+                            def __init__(self, username):
+                                self.username = username
+                                self.oauth_token = None
+                        profile = MockProfile(user.username)
+                        logger.info(f"🔄 Created mock profile for user: {user.username}")
+                
+                if profile:
+                    # User is logged in - return updated auth status
+                    auth_status = format_auth_status(profile)
+                    # Enable the run button
+                    button_update = gr.update(interactive=True, value="🚀 Run GAIA Evaluation & Submit All Answers")
+                    logger.info(f"✅ User detected as logged in: {getattr(profile, 'username', 'unknown')}")
+                    return auth_status, button_update
+                else:
+                    # User not logged in - show login required message
+                    auth_status = format_auth_status(None)
+                    # Disable the run button  
+                    button_update = gr.update(interactive=False, value="🔒 Login Required for GAIA Evaluation")
+                    logger.info("ℹ️ No user login detected")
+                    return auth_status, button_update
+                    
+            except Exception as e:
+                logger.error(f"❌ Error in check_login_state: {e}")
+                # Return safe defaults
+                auth_status = f"### ❌ Error\n\nError checking login state: {str(e)}"
                 button_update = gr.update(interactive=False, value="🔒 Login Required for GAIA Evaluation")
                 return auth_status, button_update
         
@@ -1333,6 +1517,132 @@ Please log in to access GAIA evaluation features with full inference access.
             outputs=[auth_status_display]
         )
         
+        # Debug OAuth information
+        def debug_oauth_info(request: gr.Request):
+            """Debug function to show OAuth information"""
+            try:
+                debug_info = []
+                debug_info.append("# 🔍 OAuth Debug Information\n")
+                
+                # Check HuggingFace Spaces OAuth Environment Variables
+                debug_info.append("## 🏠 HuggingFace Spaces OAuth Environment")
+                oauth_client_id = os.getenv("OAUTH_CLIENT_ID")
+                oauth_client_secret = os.getenv("OAUTH_CLIENT_SECRET") 
+                oauth_scopes = os.getenv("OAUTH_SCOPES")
+                openid_provider_url = os.getenv("OPENID_PROVIDER_URL")
+                
+                debug_info.append(f"**OAUTH_CLIENT_ID**: {oauth_client_id is not None}")
+                debug_info.append(f"**OAUTH_CLIENT_SECRET**: {oauth_client_secret is not None}")
+                debug_info.append(f"**OAUTH_SCOPES**: {oauth_scopes}")
+                debug_info.append(f"**OPENID_PROVIDER_URL**: {openid_provider_url}")
+                
+                if oauth_scopes:
+                    scopes_list = oauth_scopes.split()
+                    debug_info.append(f"**Available Scopes**: {', '.join(scopes_list)}")
+                    debug_info.append(f"**Has inference-api scope**: {'inference-api' in scopes_list}")
+                
+                # Check request attributes  
+                debug_info.append("\n## 🔍 Request Analysis")
+                profile = getattr(request, 'oauth_profile', None)
+                user = getattr(request, 'user', None)
+                session = getattr(request, 'session', None)
+                
+                debug_info.append(f"**Profile Object**: {profile is not None}")
+                debug_info.append(f"**User Object**: {user is not None}")
+                debug_info.append(f"**Session Object**: {session is not None}")
+                
+                # Try to access Gradio's built-in OAuth info
+                try:
+                    # Check if Gradio has OAuth info in the request state
+                    state = getattr(request, 'state', None)
+                    if state:
+                        debug_info.append(f"**Request State**: {type(state)}")
+                        if hasattr(state, '__dict__'):
+                            state_attrs = [attr for attr in state.__dict__.keys() if 'oauth' in attr.lower() or 'user' in attr.lower() or 'auth' in attr.lower()]
+                            if state_attrs:
+                                debug_info.append(f"**State Auth Attributes**: {', '.join(state_attrs)}")
+                except Exception as state_error:
+                    debug_info.append(f"**State Check Error**: {state_error}")
+                
+                if profile:
+                    debug_info.append(f"**Profile Type**: {type(profile)}")
+                    debug_info.append(f"**Profile Username**: {getattr(profile, 'username', 'N/A')}")
+                    
+                    # Check all profile attributes
+                    if hasattr(profile, '__dict__'):
+                        attrs = list(profile.__dict__.keys())
+                        debug_info.append(f"**Profile Attributes**: {', '.join(attrs)}")
+                        
+                        # Check for token attributes
+                        for attr in attrs:
+                            if 'token' in attr.lower():
+                                value = getattr(profile, attr, None)
+                                debug_info.append(f"**{attr}**: {len(str(value)) if value else 0} chars")
+                    
+                    # Try to extract OAuth token using different methods
+                    oauth_token = None
+                    token_source = None
+                    for attr in ['oauth_token', 'token', 'access_token', 'id_token', 'bearer_token']:
+                        token = getattr(profile, attr, None)
+                        if token:
+                            oauth_token = token
+                            token_source = attr
+                            break
+                    
+                    if oauth_token:
+                        debug_info.append(f"**Token Found**: Via {token_source}, {len(oauth_token)} chars")
+                        
+                        # Test the token
+                        scope_info = check_oauth_scopes(oauth_token)
+                        debug_info.append(f"**Token Valid**: {scope_info.get('logged_in', False)}")
+                        debug_info.append(f"**Detected Scopes**: {', '.join(scope_info.get('scopes', []))}")
+                        debug_info.append(f"**Can Read**: {scope_info.get('can_read', False)}")
+                        debug_info.append(f"**Can Inference**: {scope_info.get('can_inference', False)}")
+                    else:
+                        debug_info.append("**Token Found**: ❌ No OAuth token found in profile")
+                
+                if user:
+                    debug_info.append(f"**User Type**: {type(user)}")
+                    if hasattr(user, '__dict__'):
+                        user_attrs = list(user.__dict__.keys())
+                        debug_info.append(f"**User Attributes**: {', '.join(user_attrs)}")
+                
+                # Check environment variables
+                debug_info.append("\n## 🔧 Environment Variables")
+                hf_token = os.getenv("HF_TOKEN")
+                debug_info.append(f"**HF_TOKEN Available**: {hf_token is not None}")
+                if hf_token:
+                    debug_info.append(f"**HF_TOKEN Length**: {len(hf_token)} chars")
+                
+                # Check request headers for any auth info
+                headers = getattr(request, 'headers', {})
+                auth_headers = [h for h in headers.keys() if 'auth' in h.lower() or 'token' in h.lower()]
+                if auth_headers:
+                    debug_info.append(f"**Auth Headers**: {', '.join(auth_headers)}")
+                
+                # Gradio-specific OAuth checks
+                debug_info.append("\n## 🎨 Gradio OAuth Integration")
+                try:
+                    # Check if we're in an authenticated Gradio context
+                    import gradio as gr
+                    debug_info.append(f"**Gradio Version**: {gr.__version__}")
+                    
+                    # Try to access OAuth through Gradio's context
+                    # This might work differently in newer Gradio versions
+                    
+                except Exception as gradio_error:
+                    debug_info.append(f"**Gradio OAuth Error**: {gradio_error}")
+                
+                return "\n".join(debug_info)
+                
+            except Exception as e:
+                return f"# ❌ Debug Error\n\nError during OAuth debug: {str(e)}"
+        
+        debug_auth_button.click(
+            fn=debug_oauth_info,
+            outputs=[auth_status_display]
+        )
+        
         # Event handlers for manual testing
         def process_and_update(question, file_input, show_reasoning):
             """Process question with authentication check"""