Fix OAuth token authorization for Space logging

[abidlabs]

Summary

• use the Hub repository write-check endpoint instead of parsing whoami()["auth"]["accessToken"]
• support refreshed OAuth credentials while preserving the Space-secret fast path
• keep authorization failures distinct from transient Hub errors
• cache authorization results for up to 256 distinct tokens
• keep the existing huggingface-hub>=1.10.0,<2 constraint because HfApi.auth_check(..., write=True) is available in 1.10.0

Reproduction

Before this change, a valid OAuth-shaped whoami response without auth.accessToken crashes the Space write check:

whoami = {"name": "user", "orgs": [], "auth": {}}
check_hf_token_has_write_access("refreshed-oauth-token")
# KeyError: 'accessToken'

The fix asks the Hub whether the token has write access to the exact Space, avoiding assumptions about token metadata.

Verification

pytest tests/unit/test_token_auth.py tests/unit/test_gradio_api_spaces.py tests/unit/test_artifact_server.py tests/unit/test_frontend_server.py -q
24 passed

ruff check --select I trackio/server.py tests/unit/test_token_auth.py
ruff format --check trackio/server.py tests/unit/test_token_auth.py
git diff --check

The reproduction was run inline; no demo file was committed.

[gradio-pr-bot]

🪼 branch checks and previews

•	Name	Status	URL
🦄	Changes	detected!	Details

[gradio-pr-bot]

🦄 change detected

This Pull Request includes changes to the following packages.

Package	Version
trackio	patch

---

• Fix OAuth token authorization for Space logging

---

Something isn't right?

• Maintainers can change the version label to modify the version bump.
• If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

[Copilot]

🟡 Changes recommended

Authorization caching remains stale indefinitely, regression tests are missing, and the changeset should be bot-generated.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates Space logging authorization to use the Hub’s repository write-access check.

Changes:

• Replaces token metadata parsing with HfApi.auth_check.
• Expands authorization caching and preserves the Space-secret fast path.
• Adds patch release metadata.

File summaries

File	Description
trackio/server.py	Updates Space token authorization.
.changeset/soft-ears-find.md	Adds release metadata.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.