feat: use parent postMessage for likes instead of API calls

Use the HF-provided postMessage protocol to like spaces from within
the iframe. The parent frame (huggingface.co) handles auth via session
cookies, bypassing CORS and OAuth token issues entirely.

Protocol: parent.postMessage({type: "LIKE_REPO_REQUEST", repo: {type: "space", name: "..."}})
Response: LIKE_REPO_RESPONSE with status (done/already_liked/not_logged_in) or error

Also removes write-discussions OAuth scope (no longer needed).

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -6,8 +6,6 @@ colorTo: purple
 sdk: docker
 pinned: true
 hf_oauth: true
-hf_oauth_scopes:
-  - write-discussions
 thumbnail: >-
   https://cdn-uploads.huggingface.co/production/uploads/671faa3a541a76b548647676/XWNDlOu0R4fHXR0kCW3Wd.png
 short_description: All about Reachy Mini, from building to getting started

src/context/AuthContext.jsx

@@ -5,6 +5,9 @@ const AuthContext = createContext(null);
 
 const HF_API = 'https://huggingface.co';
 
+// Whether we're running inside an iframe (i.e. embedded on huggingface.co)
+const isInIframe = typeof window !== 'undefined' && window.parent !== window;
+
 /**
  * Fetch OAuth config (clientId, scopes) from our Express server.
  * Docker Spaces don't auto-inject window.huggingface.variables like static Spaces,
@@ -41,13 +44,40 @@ async function fetchUserLikedSpaces(username) {
   }
 }
 
+/**
+ * Send a like request to the HF parent frame via postMessage.
+ * Returns a Promise that resolves with the response data.
+ * The parent frame (huggingface.co) handles auth via session cookies.
+ */
+function likeViaPostMessage(spaceId) {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      window.removeEventListener('message', handler);
+      reject(new Error('Like request timed out'));
+    }, 5000);
+
+    function handler(event) {
+      if (event.data?.type !== 'LIKE_REPO_RESPONSE') return;
+      clearTimeout(timeout);
+      window.removeEventListener('message', handler);
+      resolve(event.data);
+    }
+
+    window.addEventListener('message', handler);
+    window.parent.postMessage(
+      { type: 'LIKE_REPO_REQUEST', repo: { type: 'space', name: spaceId } },
+      '*'
+    );
+  });
+}
+
 // Provider component
 export function AuthProvider({ children }) {
   const [user, setUser] = useState(null); // { name, avatarUrl }
   const [likedSpaceIds, setLikedSpaceIds] = useState(new Set());
   const [isLoading, setIsLoading] = useState(true);
   const [oauthConfig, setOauthConfig] = useState(null); // { clientId, scopes }
-  const pendingLikes = useRef(new Set()); // Track in-flight like/unlike requests
+  const pendingLikes = useRef(new Set()); // Track in-flight like requests
 
   // On mount: fetch OAuth config + check if user just completed OAuth redirect
   useEffect(() => {
@@ -65,12 +95,11 @@ export function AuthProvider({ children }) {
         // Check if user just completed OAuth redirect
         const oauthResult = await oauthHandleRedirectIfPresent();
         if (oauthResult) {
-          const { accessToken, userInfo } = oauthResult;
+          const { userInfo } = oauthResult;
           const userData = {
             name: userInfo.name,
             preferredUsername: userInfo.preferred_username || userInfo.name,
             avatarUrl: userInfo.picture,
-            accessToken: accessToken,
           };
           setUser(userData);
 
@@ -125,65 +154,68 @@ export function AuthProvider({ children }) {
   );
 
   /**
-   * Toggle like/unlike with optimistic update.
-   * Uses OAuth Bearer token (requires write-discussions scope).
+   * Like a space via the HF parent frame postMessage protocol.
+   * The parent (huggingface.co) handles auth via session cookies.
+   * Like-only (no unlike) — if already liked, it's a no-op.
    */
   const toggleLike = useCallback(
     async (spaceId) => {
-      if (!user) {
-        login();
-        return;
-      }
-
       const spaceIdLower = spaceId?.toLowerCase();
       if (!spaceIdLower) return;
 
-      // Prevent duplicate requests for the same space
+      // Already liked → no-op (postMessage only supports like, not unlike)
+      if (likedSpaceIds.has(spaceIdLower)) return;
+
+      // Not in iframe → can't use postMessage, prompt OAuth login as fallback
+      if (!isInIframe) {
+        console.warn('[Auth] Not in iframe, postMessage unavailable');
+        return;
+      }
+
+      // Prevent duplicate requests
       if (pendingLikes.current.has(spaceIdLower)) return;
       pendingLikes.current.add(spaceIdLower);
 
-      const wasLiked = likedSpaceIds.has(spaceIdLower);
-      const method = wasLiked ? 'DELETE' : 'POST';
-
       // Optimistic update
       setLikedSpaceIds((prev) => {
         const next = new Set(prev);
-        if (wasLiked) {
-          next.delete(spaceIdLower);
-        } else {
-          next.add(spaceIdLower);
-        }
+        next.add(spaceIdLower);
         return next;
       });
 
       try {
-        const response = await fetch(`${HF_API}/api/spaces/${spaceId}/like`, {
-          method,
-          headers: {
-            Authorization: `Bearer ${user.accessToken}`,
-          },
-        });
+        const result = await likeViaPostMessage(spaceId);
 
-        if (!response.ok) {
-          throw new Error(`Like API returned ${response.status}`);
+        if (result.error) {
+          throw new Error(`${result.error.code}: ${result.error.message}`);
         }
+
+        if (result.status === 'not_logged_in') {
+          // User not logged in to HF → revert and prompt login
+          throw new Error('not_logged_in');
+        }
+
+        // "done" or "already_liked" → success
+        console.log(`[Auth] Liked ${spaceId}: ${result.status}`, result.likes != null ? `(${result.likes} likes)` : '');
       } catch (err) {
-        console.error(`[Auth] Failed to ${wasLiked ? 'unlike' : 'like'} ${spaceId}:`, err);
-        // Revert optimistic update on error
+        console.error(`[Auth] Failed to like ${spaceId}:`, err.message);
+
+        // Revert optimistic update
         setLikedSpaceIds((prev) => {
           const reverted = new Set(prev);
-          if (wasLiked) {
-            reverted.add(spaceIdLower);
-          } else {
-            reverted.delete(spaceIdLower);
-          }
+          reverted.delete(spaceIdLower);
           return reverted;
         });
+
+        // If not logged in, prompt OAuth login
+        if (err.message === 'not_logged_in') {
+          login();
+        }
       } finally {
         pendingLikes.current.delete(spaceIdLower);
       }
     },
-    [user, likedSpaceIds, login]
+    [likedSpaceIds, login]
   );
 
   return (
@@ -193,6 +225,7 @@ export function AuthProvider({ children }) {
         isLoggedIn: !!user,
         isLoading,
         isOAuthAvailable: !!oauthConfig?.clientId,
+        isInIframe,
         likedSpaceIds,
         login,
         logout,