test: don't allow login with HF without valid bot-generated link

app.py

@@ -36,17 +36,27 @@ def run_bot():
 threading.Thread(target=run_bot).start()
 
 # Gradio ------------------------------------------------------------------------------------------------------------
-def hello(profile: gr.OAuthProfile | None, request: gr.Request) -> str:
+def validate_link(request: gr.Request) -> bool:
     url_str = str(request.url)
     query_params = parse_qs(urlparse(url_str).query)
     user_id = query_params.get('user_id', [None])[0]
     token = query_params.get('token', [None])[0]
 
     if user_id is None or token is None:
-        return "❌ Invalid link. Missing user_id or token."
+        return False
 
     if int(user_id) not in user_tokens or user_tokens[int(user_id)] != token:
-        return "❌ Invalid or expired token."
+        return False
+
+    return True
+
+def hello(profile: gr.OAuthProfile | None, request: gr.Request) -> str:
+    if not validate_link(request):
+        return "❌ Invalid link. Please use the link provided by the bot."
+
+    url_str = str(request.url)
+    query_params = parse_qs(urlparse(url_str).query)
+    user_id = query_params.get('user_id', [None])[0]
 
     if profile is None:
         return f"❌ Not logged in. User ID: {user_id}"
@@ -57,7 +67,14 @@ with gr.Blocks() as demo:
     gr.Markdown("# Gradio OAuth Space")
     login_button = gr.LoginButton()
     m1 = gr.Markdown()
-    demo.load(hello, inputs=None, outputs=m1)
+
+    def check_link_and_load():
+        if validate_link(gr.Request()):
+            demo.load(hello, inputs=None, outputs=m1)
+        else:
+            m1.update("❌ Invalid link. Please use the link provided by the bot.")
+
+    check_link_and_load()
 
     def check_login_status():
         try: