Forward signed-in HF identity to allocator

README.md

@@ -97,7 +97,11 @@ Three modes, picked by env (`/api/config` tells the client which one is active):
 - **`LOAD_BALANCER_URL` env** — the original flow: the browser POSTs the
   same-origin `/api/session` proxy, the server forwards to the LB, and the
   browser dials the per-session compute URL the LB hands back. The LB address
-  never reaches the browser; the Settings URL field is hidden.
+  never reaches the browser; the Settings URL field is hidden. When a visitor
+  signs in with Hugging Face, the proxy also forwards their OAuth access token
+  to the LB through `X-Reachy-Mini-Authorization`, matching the Reachy Mini
+  client. Anonymous requests carry no token, and the token is never returned to
+  browser JavaScript.
 - **Neither** — **Settings → Speech-to-speech server URL**: paste a full
   `connect_url` (`wss://host/v1/realtime?...`) or a bare host like `localhost:8080`
   (the app adds `/v1/realtime`), and the browser connects to it directly.

auth.py

@@ -106,6 +106,19 @@ def current_user(request):
     return _field(current_oauth(request), "user_info")
 
 
+def current_access_token(request) -> "str | None":
+    """The signed-in user's HF OAuth access token, or None.
+
+    Keep this server-side: it is used to attribute load-balancer session
+    requests to the signed-in HF account and must never be returned to the
+    browser.
+    """
+    token = _field(current_oauth(request), "access_token")
+    if token is None:
+        return None
+    return str(token).strip() or None
+
+
 def _user_org_names(user) -> "set[str]":
     """The user's organisations from the OAuth userinfo, by username/name/id."""
     names = set()

server.py

@@ -81,6 +81,7 @@ SERPER_URL = "https://google.serper.dev/search"
 # Cap results so the tool output stays small enough to feed back to the model.
 MAX_RESULTS = 5
 HERE = os.path.dirname(os.path.abspath(__file__))
+LB_USER_AGENT = "hf-realtime-voice-space"
 
 app = FastAPI(title="s2s-demo")
 
@@ -250,7 +251,11 @@ async def session(request: Request):
     url = f"{LOAD_BALANCER_URL.rstrip('/')}/session"
     try:
         async with httpx.AsyncClient(timeout=15.0) as http:
-            lb = await http.post(url, headers={"Content-Type": "application/json"}, content="{}")
+            lb = await http.post(
+                url,
+                headers=_load_balancer_headers(request),
+                content="{}",
+            )
     except httpx.RequestError as exc:
         logger.warning("Load balancer unreachable: %r", exc)
         raise HTTPException(status_code=502, detail="Speech service unreachable.")
@@ -286,6 +291,24 @@ async def session(request: Request):
     return await _finalize_grant(data, keys, tier, tracked, set_cookie)
 
 
+def _load_balancer_headers(request: Request) -> dict[str, str]:
+    """Headers for the server-to-server session allocation request.
+
+    Reachy Mini uses this dedicated header for an optional HF user token. The
+    load balancer fingerprints it immediately and resolves the account through
+    whoami asynchronously, so allocation remains fast. Anonymous visitors send
+    no credential header.
+    """
+    headers = {
+        "Content-Type": "application/json",
+        "User-Agent": LB_USER_AGENT,
+    }
+    token = auth.current_access_token(request)
+    if token:
+        headers["X-Reachy-Mini-Authorization"] = f"Bearer {token}"
+    return headers
+
+
 @app.get("/api/queue/{queue_id}")
 async def queue_status(queue_id: str, request: Request):
     """Poll a waiting ticket: relay the position, or — when the head of the line