Add password gate for Phase I dashboard

Dockerfile

@@ -0,0 +1,7 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+COPY app.py /app/app.py
+
+EXPOSE 7860
+CMD ["python", "/app/app.py"]

README.md

@@ -1,10 +1,22 @@
 ---
-title: Phase1 Aai Source Coverage Gate
-emoji: 🚀
-colorFrom: purple
-colorTo: gray
+title: Phase I AAI Dashboard Gate
 sdk: docker
+app_port: 7860
 pinned: false
+license: other
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Phase I AAI Dashboard Gate
+
+Public HuggingFace Space with server-side HTTP Basic Auth for the private Phase I
+AAI dashboard.
+
+Required Space secrets:
+
+- `DASHBOARD_PASSWORD`
+- `HF_PRIVATE_READ_TOKEN`
+
+Required Space variables:
+
+- `DASHBOARD_USERNAME`
+- `PRIVATE_DASHBOARD_URL`

app.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""Password gate for the private Phase I AAI dashboard."""
+
+from __future__ import annotations
+
+import base64
+import hmac
+import os
+import time
+import urllib.error
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+
+USERNAME = os.environ.get("DASHBOARD_USERNAME", "richard")
+PASSWORD = os.environ.get("DASHBOARD_PASSWORD", "")
+HF_READ_TOKEN = os.environ.get("HF_PRIVATE_READ_TOKEN", "")
+PRIVATE_DASHBOARD_URL = os.environ.get(
+    "PRIVATE_DASHBOARD_URL",
+    "https://huggingface.co/spaces/andreaparker/phase1-aai-source-coverage-dashboard/raw/main/index.html",
+)
+CACHE_TTL_SECONDS = int(os.environ.get("CACHE_TTL_SECONDS", "300"))
+
+_cached_html: bytes | None = None
+_cached_at = 0.0
+
+
+def require_env() -> None:
+    missing = [
+        name
+        for name, value in {
+            "DASHBOARD_PASSWORD": PASSWORD,
+            "HF_PRIVATE_READ_TOKEN": HF_READ_TOKEN,
+        }.items()
+        if not value
+    ]
+    if missing:
+        raise RuntimeError(f"Missing required environment variable(s): {', '.join(missing)}")
+
+
+def fetch_dashboard() -> bytes:
+    global _cached_html, _cached_at
+    now = time.time()
+    if _cached_html and now - _cached_at < CACHE_TTL_SECONDS:
+        return _cached_html
+
+    req = urllib.request.Request(
+        PRIVATE_DASHBOARD_URL,
+        headers={"Authorization": f"Bearer {HF_READ_TOKEN}"},
+    )
+    with urllib.request.urlopen(req, timeout=45) as response:
+        html = response.read()
+    _cached_html = html
+    _cached_at = now
+    return html
+
+
+def parse_basic_auth(header: str) -> tuple[str, str] | None:
+    prefix = "Basic "
+    if not header.startswith(prefix):
+        return None
+    try:
+        decoded = base64.b64decode(header[len(prefix) :], validate=True).decode("utf-8")
+    except Exception:
+        return None
+    username, sep, password = decoded.partition(":")
+    if not sep:
+        return None
+    return username, password
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "Phase1DashboardGate/1.0"
+
+    def log_message(self, fmt: str, *args: object) -> None:
+        print(f"{self.address_string()} - {fmt % args}")
+
+    def is_authorized(self) -> bool:
+        parsed = parse_basic_auth(self.headers.get("Authorization", ""))
+        if not parsed:
+            return False
+        username, password = parsed
+        return hmac.compare_digest(username, USERNAME) and hmac.compare_digest(password, PASSWORD)
+
+    def send_login(self) -> None:
+        body = b"Authentication required.\n"
+        self.send_response(401)
+        self.send_header("WWW-Authenticate", 'Basic realm="Phase I AAI Dashboard"')
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self) -> None:
+        if self.path == "/healthz":
+            body = b"ok\n"
+            self.send_response(200)
+            self.send_header("Content-Type", "text/plain; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+
+        if self.path not in {"/", "/index.html"}:
+            self.send_response(302)
+            self.send_header("Location", "/")
+            self.end_headers()
+            return
+
+        if not self.is_authorized():
+            self.send_login()
+            return
+
+        try:
+            html = fetch_dashboard()
+        except urllib.error.HTTPError as exc:
+            body = f"Could not fetch private dashboard: HTTP {exc.code}\n".encode("utf-8")
+            self.send_response(502)
+            self.send_header("Content-Type", "text/plain; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+        except Exception as exc:
+            body = f"Could not fetch private dashboard: {type(exc).__name__}\n".encode("utf-8")
+            self.send_response(502)
+            self.send_header("Content-Type", "text/plain; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            return
+
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Cache-Control", "private, max-age=60")
+        self.send_header("Content-Length", str(len(html)))
+        self.end_headers()
+        self.wfile.write(html)
+
+
+def main() -> None:
+    require_env()
+    port = int(os.environ.get("PORT", "7860"))
+    server = ThreadingHTTPServer(("0.0.0.0", port), Handler)
+    print(f"Serving password-gated dashboard on port {port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()