Use new auth lib

Dockerfile

@@ -1,27 +1,16 @@
-FROM google/cloud-sdk:slim AS retriever
-# Get service account key from HF Spaces' secrets
-# https://huggingface.co/docs/hub/spaces-sdks-docker#buildtime
-RUN --mount=type=secret,id=BUILD_CREDENTIALS,mode=0444,required=true \
-  --mount=type=secret,id=BUILD_ASSET_BUCKET,mode=0444,required=true \
-  --mount=type=secret,id=BUILD_ASSET_NAME,mode=0444,required=true \
-  cat /run/secrets/BUILD_CREDENTIALS > /tmp/creds.json && \
-  /bin/gcloud auth activate-service-account --key-file=/tmp/creds.json > /dev/null 2>&1 && \
-  GOOGLE_APPLICATION_CREDENTIALS=/tmp/creds.json /bin/gcloud storage cp gs://$(cat /run/secrets/BUILD_ASSET_BUCKET)/$(cat /run/secrets/BUILD_ASSET_NAME) /tmp/ > /dev/null 2>&1 && \
-  rm /tmp/creds.json
-
 FROM python:3.11-slim AS gradio
 RUN useradd -m -u 1000 app
 USER app
 ENV HOME=/home/app \
-	PATH=/home/app/.local/bin:$PATH
+  PATH=/home/app/.local/bin:$PATH
 WORKDIR ${HOME}
-COPY --from=retriever /tmp/*_linux_amd64.tar.gz ${HOME}/
-RUN tar -xf *_linux_amd64.tar.gz && rm *_linux_amd64.tar.gz
-
 COPY . .
+# https://huggingface.co/docs/hub/spaces-sdks-docker#buildtime
+RUN --mount=type=secret,id=EXTRA_INDEX_URL,mode=0444,required=true \
+  pip install --no-cache-dir --extra-index-url=$(cat /run/secrets/EXTRA_INDEX_URL) cycloud-sdk-python-auth > /dev/null 2>&1
 RUN pip install --no-cache-dir -r requirements.txt
 RUN --mount=type=secret,id=LLM_CREDENTIALS,mode=0444,required=true \
-   cat /run/secrets/LLM_CREDENTIALS > ${HOME}/credentials.json
+  cat /run/secrets/LLM_CREDENTIALS > ${HOME}/credentials.json
 EXPOSE 7860
 
 ENV GRADIO_SERVER_NAME="0.0.0.0"

app.py

@@ -4,6 +4,7 @@ import httpx
 import subprocess
 import os
 from openai import OpenAI
+from cycloud.auth import load_default_credentials
 
 from const import (
     LLM_BASE_URL,
@@ -19,27 +20,10 @@ from const import (
 )
 
 
-def get_token() -> str:
-    try:
-        t = (
-            subprocess.run(
-                AUTH_CMD,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.DEVNULL,
-                env=os.environ.copy(),
-            )
-            .stdout.decode("utf-8")
-            .strip()
-        )
-        assert t, "Failed to get auth token"
-        return t
-    except Exception:
-        raise ValueError("Failed to get auth token")
-
-
 def get_headers(host: str) -> dict:
+    creds = load_default_credentials()
     return {
-        "Authorization": f"Bearer {get_token()}",
+        "Authorization": f"Bearer {creds.access_token}",
         "Host": host,
         "Accept": "application/json",
         "Content-Type": "application/json",