Add HF auth QR dashboard and saved generation backend

analytics_caller_app_patch.sql

@@ -0,0 +1,138 @@
+alter table public.analytics_generation_events
+  add column if not exists caller_app text;
+
+alter table public.analytics_download_events
+  add column if not exists caller_app text;
+
+alter table public.analytics_validation_events
+  add column if not exists caller_app text;
+
+create index if not exists analytics_generation_events_caller_app_idx
+  on public.analytics_generation_events (caller_app, timestamp desc);
+
+create index if not exists analytics_download_events_caller_app_idx
+  on public.analytics_download_events (caller_app, timestamp desc);
+
+create index if not exists analytics_validation_events_caller_app_idx
+  on public.analytics_validation_events (caller_app, timestamp desc);
+
+create or replace view public.analytics_generation_outcomes as
+select
+  g.generation_id,
+  g.timestamp as generation_timestamp,
+  g.source,
+  g.caller_app,
+  g.pipeline,
+  g.analytics_opt_in,
+  g.status,
+  g.error_bucket,
+  exists (
+    select 1
+    from public.analytics_download_events d
+    where d.generation_id = g.generation_id
+  ) as has_download
+from public.analytics_generation_events g;
+
+create or replace view public.analytics_download_events_inferred as
+select
+  d.id,
+  d.generation_id,
+  d.timestamp,
+  d.product,
+  d.caller_app,
+  d.source,
+  d.pipeline,
+  d.tool_name,
+  d.analytics_opt_in,
+  d.format,
+  d.anonymous_id,
+  d.qr_payload_full,
+  d.seed,
+  d.created_at,
+  case
+    when d.tool_name like '%_standard' then 'standard'
+    when d.tool_name like '%_artistic' then 'artistic'
+    when d.source = 'mcp' and d.tool_name like '%_1' then 'standard'
+    when d.source = 'mcp' and d.tool_name not like '%_1' then 'artistic'
+    else d.pipeline
+  end as pipeline_inferred
+from public.analytics_download_events d;
+
+create or replace view public.analytics_generation_signals as
+with ordered_generations as (
+  select
+    g.id,
+    g.generation_id,
+    g.timestamp,
+    g.product,
+    g.caller_app,
+    g.source,
+    g.pipeline,
+    g.tool_name,
+    g.analytics_opt_in,
+    g.status,
+    g.error_bucket,
+    g.anonymous_id,
+    g.prompt_full,
+    g.qr_payload_full,
+    g.settings_full,
+    g.created_at,
+    lead(g.timestamp) over (
+      partition by g.source, g.anonymous_id, g.pipeline, coalesce(g.caller_app, '')
+      order by g.timestamp
+    ) as next_generation_timestamp
+  from public.analytics_generation_events g
+), generation_with_downloads as (
+  select
+    g.generation_id,
+    g.timestamp,
+    g.product,
+    g.caller_app,
+    g.source,
+    g.pipeline,
+    g.analytics_opt_in,
+    g.status,
+    g.error_bucket,
+    g.anonymous_id,
+    g.prompt_full,
+    g.qr_payload_full,
+    g.settings_full,
+    g.next_generation_timestamp,
+    exists (
+      select 1
+      from public.analytics_download_events d
+      where d.source = g.source
+        and coalesce(d.caller_app, '') = coalesce(g.caller_app, '')
+        and d.anonymous_id = g.anonymous_id
+        and d.timestamp >= g.timestamp
+        and d.timestamp <= g.timestamp + interval '10 minutes'
+    ) as has_download_within_10m
+  from ordered_generations g
+)
+select
+  generation_id,
+  timestamp,
+  product,
+  caller_app,
+  source,
+  pipeline,
+  analytics_opt_in,
+  status,
+  error_bucket,
+  anonymous_id,
+  prompt_full,
+  qr_payload_full,
+  settings_full,
+  has_download_within_10m,
+  next_generation_timestamp,
+  case
+    when error_bucket = 'infra_limited' then 'infra_limited'
+    when status = 'success' and has_download_within_10m then 'happy'
+    when status = 'success'
+      and next_generation_timestamp is not null
+      and next_generation_timestamp <= timestamp + interval '10 minutes'
+      and not has_download_within_10m then 'unhappy'
+    when status = 'error' then 'error'
+    else 'neutral'
+  end as outcome_signal
+from generation_with_downloads;

analytics_view_recreate.sql

@@ -0,0 +1,124 @@
+drop view if exists public.analytics_generation_signals;
+drop view if exists public.analytics_download_events_inferred;
+drop view if exists public.analytics_generation_outcomes;
+
+create view public.analytics_generation_outcomes as
+select
+  g.generation_id,
+  g.timestamp as generation_timestamp,
+  g.source,
+  g.caller_app,
+  g.pipeline,
+  g.analytics_opt_in,
+  g.status,
+  g.error_bucket,
+  exists (
+    select 1
+    from public.analytics_download_events d
+    where d.generation_id = g.generation_id
+  ) as has_download
+from public.analytics_generation_events g;
+
+create view public.analytics_download_events_inferred as
+select
+  d.id,
+  d.generation_id,
+  d.timestamp,
+  d.product,
+  d.caller_app,
+  d.source,
+  d.pipeline,
+  d.tool_name,
+  d.analytics_opt_in,
+  d.format,
+  d.anonymous_id,
+  d.qr_payload_full,
+  d.seed,
+  d.created_at,
+  case
+    when d.tool_name like '%_standard' then 'standard'
+    when d.tool_name like '%_artistic' then 'artistic'
+    when d.source = 'mcp' and d.tool_name like '%_1' then 'standard'
+    when d.source = 'mcp' and d.tool_name not like '%_1' then 'artistic'
+    else d.pipeline
+  end as pipeline_inferred
+from public.analytics_download_events d;
+
+create view public.analytics_generation_signals as
+with ordered_generations as (
+  select
+    g.id,
+    g.generation_id,
+    g.timestamp,
+    g.product,
+    g.caller_app,
+    g.source,
+    g.pipeline,
+    g.tool_name,
+    g.analytics_opt_in,
+    g.status,
+    g.error_bucket,
+    g.anonymous_id,
+    g.prompt_full,
+    g.qr_payload_full,
+    g.settings_full,
+    g.created_at,
+    lead(g.timestamp) over (
+      partition by g.source, g.anonymous_id, g.pipeline, coalesce(g.caller_app, '')
+      order by g.timestamp
+    ) as next_generation_timestamp
+  from public.analytics_generation_events g
+), generation_with_downloads as (
+  select
+    g.generation_id,
+    g.timestamp,
+    g.product,
+    g.caller_app,
+    g.source,
+    g.pipeline,
+    g.analytics_opt_in,
+    g.status,
+    g.error_bucket,
+    g.anonymous_id,
+    g.prompt_full,
+    g.qr_payload_full,
+    g.settings_full,
+    g.next_generation_timestamp,
+    exists (
+      select 1
+      from public.analytics_download_events d
+      where d.source = g.source
+        and coalesce(d.caller_app, '') = coalesce(g.caller_app, '')
+        and d.anonymous_id = g.anonymous_id
+        and d.timestamp >= g.timestamp
+        and d.timestamp <= g.timestamp + interval '10 minutes'
+    ) as has_download_within_10m
+  from ordered_generations g
+)
+select
+  generation_id,
+  timestamp,
+  product,
+  caller_app,
+  source,
+  pipeline,
+  analytics_opt_in,
+  status,
+  error_bucket,
+  anonymous_id,
+  prompt_full,
+  qr_payload_full,
+  settings_full,
+  has_download_within_10m,
+  next_generation_timestamp,
+  case
+    when error_bucket = 'infra_limited' then 'infra_limited'
+    when status = 'success' and has_download_within_10m then 'happy'
+    when status = 'success'
+      and next_generation_timestamp is not null
+      and next_generation_timestamp <= timestamp + interval '10 minutes'
+      and not has_download_within_10m then 'unhappy'
+    when status = 'error' then 'error'
+    else 'neutral'
+  end as outcome_signal
+from generation_with_downloads;

app.py

@@ -30,6 +30,12 @@ from huggingface_hub import hf_hub_download
 from PIL import Image
 import kornia.color  # For RGB→HSV conversion in Stable Cascade filter
 from runtime_config import get_analytics_product
+from hf_dashboard import (
+    DashboardError,
+    get_generation_detail,
+    list_my_generations,
+    persist_generation,
+)
 
 # ── Export helpers (PNG + embedded SVG download) ──────────────────────────────
 import base64
@@ -319,9 +325,135 @@ def _append_status_note(status: str | None, note: str | None) -> str | None:
         return status
     if not status:
         return note
+    if note in status:
+        return status
     return f"{status}\n\n{note}"
 
 
+def _coerce_pil_image(image: Any) -> Image.Image:
+    if isinstance(image, Image.Image):
+        return image
+    return Image.fromarray(np.asarray(image))
+
+
+def _dashboard_empty_payload(message: str):
+    return (
+        message,
+        gr.update(value=[]),
+        [],
+        "Select a saved QR to inspect analytics and reload settings.",
+        None,
+        [],
+        [],
+        "{}",
+        gr.update(visible=False),
+        gr.update(visible=False),
+    )
+
+
+def _load_my_qr_dashboard(request: Union[gr.Request, None] = None):
+    try:
+        payload = list_my_generations(request)
+    except DashboardError as exc:
+        return _dashboard_empty_payload(f"My QR Codes unavailable: {exc}")
+    except Exception as exc:
+        print("[dashboard-load]", traceback.format_exc())
+        return _dashboard_empty_payload(
+            f"My QR Codes unavailable: {_format_exception_message(exc)}"
+        )
+
+    if not payload.get("authenticated"):
+        return _dashboard_empty_payload(str(payload.get("status") or "Sign in required."))
+
+    records = payload.get("records") or []
+    gallery = payload.get("gallery") or []
+    if not records:
+        return (
+            str(payload.get("status") or "No saved QR codes yet."),
+            gr.update(value=[]),
+            records,
+            "No saved QR codes yet. Generate one while signed in, then come back here.",
+            None,
+            [],
+            [],
+            "{}",
+            gr.update(visible=False),
+            gr.update(visible=False),
+        )
+
+    return (
+        str(payload.get("status") or "Loaded."),
+        gr.update(value=gallery),
+        records,
+        "Select a saved QR to inspect analytics and reload settings.",
+        None,
+        [],
+        [],
+        "{}",
+        gr.update(visible=False),
+        gr.update(visible=False),
+    )
+
+
+def _select_my_qr_generation(
+    records: list[dict[str, Any]],
+    evt: gr.SelectData,
+    request: Union[gr.Request, None] = None,
+):
+    if not records:
+        return (
+            "No saved QR codes are loaded yet.",
+            None,
+            [],
+            [],
+            "{}",
+            gr.update(visible=False),
+            gr.update(visible=False),
+        )
+    try:
+        detail = get_generation_detail(request, records, int(evt.index))
+    except DashboardError as exc:
+        return (
+            f"Could not load QR details: {exc}",
+            None,
+            [],
+            [],
+            "{}",
+            gr.update(visible=False),
+            gr.update(visible=False),
+        )
+    except Exception as exc:
+        print("[dashboard-select]", traceback.format_exc())
+        return (
+            f"Could not load QR details: {_format_exception_message(exc)}",
+            None,
+            [],
+            [],
+            "{}",
+            gr.update(visible=False),
+            gr.update(visible=False),
+        )
+
+    return (
+        detail["detail_markdown"],
+        detail["image"],
+        detail["top_countries_rows"],
+        detail["scans_by_day_rows"],
+        detail["settings_json"],
+        gr.update(visible=detail["is_standard"]),
+        gr.update(visible=detail["is_artistic"]),
+    )
+
+
+def _load_standard_settings_from_dashboard(settings_json: str):
+    return (*load_settings_from_json_standard(settings_json), gr.update(selected="standard-tab"))
+
+
+
+def _load_artistic_settings_from_dashboard(settings_json: str):
+    return (*load_settings_from_json_artistic(settings_json), gr.update(selected="artistic-tab"))
+
+
 def _build_shortener_note(shortener_result: Mapping[str, Any] | None) -> str | None:
     if not shortener_result:
         return None
@@ -366,6 +498,8 @@ def _maybe_shorten_url_for_qr(
     result = {
         "applied": False,
         "effective_qr_text": fallback_qr_text,
+        "short_link_id": None,
+        "short_code": None,
         "short_url": None,
         "expires_at": None,
         "existed": False,
@@ -416,6 +550,8 @@ def _maybe_shorten_url_for_qr(
         return {
             "applied": True,
             "effective_qr_text": _normalize_qr_text_for_validation(short_url, "URL"),
+            "short_link_id": payload.get("short_link_id"),
+            "short_code": payload.get("code"),
             "short_url": short_url,
             "expires_at": payload.get("expires_at"),
             "existed": bool(payload.get("existed")),
@@ -2732,10 +2868,29 @@ def generate_standard_qr(
                     request=request,
                 )
             )
+        dashboard_note = None
+        try:
+            dashboard_note = persist_generation(
+                request=request,
+                generation_id=generation_id,
+                qr_mode="standard",
+                prompt=prompt,
+                text_input=text_input,
+                input_type=input_type,
+                status="completed",
+                settings_dict=settings_dict,
+                url_normalization=url_normalization,
+                shortener_result=shortener_result,
+                final_image=_coerce_pil_image(final_image),
+            )
+        except Exception as exc:
+            print("[dashboard-save][standard]", traceback.format_exc())
+            dashboard_note = f"Could not save to My QR Codes: {_format_exception_message(exc)}"
+        final_status_with_dashboard = _append_status_note(final_status, dashboard_note)
         yield (
             final_image,
             _append_status_note(
-                _append_status_note(final_status, url_normalization_note),
+                _append_status_note(final_status_with_dashboard, url_normalization_note),
                 shortener_note,
             ),
             gr.update(value=settings_json),
@@ -3060,10 +3215,29 @@ def generate_artistic_qr(
                     request=request,
                 )
             )
+        dashboard_note = None
+        try:
+            dashboard_note = persist_generation(
+                request=request,
+                generation_id=generation_id,
+                qr_mode="artistic",
+                prompt=prompt,
+                text_input=text_input,
+                input_type=input_type,
+                status="completed",
+                settings_dict=settings_dict,
+                url_normalization=url_normalization,
+                shortener_result=shortener_result,
+                final_image=_coerce_pil_image(final_image),
+            )
+        except Exception as exc:
+            print("[dashboard-save][artistic]", traceback.format_exc())
+            dashboard_note = f"Could not save to My QR Codes: {_format_exception_message(exc)}"
+        final_status_with_dashboard = _append_status_note(final_status, dashboard_note)
         yield (
             final_image,
             _append_status_note(
-                _append_status_note(final_status, url_normalization_note),
+                _append_status_note(final_status_with_dashboard, url_normalization_note),
                 shortener_note,
             ),
             gr.update(value=settings_json),
@@ -4766,9 +4940,9 @@ with gr.Blocks(delete_cache=(3600, 3600)) as demo:
     )
 
     # Add tabs for different generation methods
-    with gr.Tabs():
+    with gr.Tabs() as qr_tabs:
         # ARTISTIC QR TAB
-        with gr.TabItem("Artistic QR"):
+        with gr.TabItem("Artistic QR", id="artistic-tab"):
             # Short description
             gr.Markdown("""
                 🎨 **Create artistic QR codes that blend seamlessly with your creative vision**
@@ -5802,7 +5976,7 @@ with gr.Blocks(delete_cache=(3600, 3600)) as demo:
             )
 
         # STANDARD QR TAB
-        with gr.TabItem("Standard QR"):
+        with gr.TabItem("Standard QR", id="standard-tab"):
             # Short description
             gr.Markdown("""
                 ⚡ **2x faster than Artistic pipeline** - perfect for quota management
@@ -6429,6 +6603,203 @@ with gr.Blocks(delete_cache=(3600, 3600)) as demo:
                 label="Example Presets (Click to Load)",
             )
 
+        with gr.TabItem("My QR Codes", id="dashboard-tab"):
+            gr.Markdown(
+                """
+                Sign in with Hugging Face, then refresh to see your saved QR generations.
+                Click any saved QR to inspect scan analytics and load its exact settings back into the generator tabs.
+                """
+            )
+            with gr.Row():
+                dashboard_login_btn = gr.LoginButton("Sign in with Hugging Face")
+                dashboard_refresh_btn = gr.Button("Refresh My QR Codes", variant="primary")
+            dashboard_status = gr.Markdown(
+                "Sign in with Hugging Face to see your saved QR codes and analytics."
+            )
+            my_qr_records_state = gr.State([])
+            my_qr_gallery = gr.Gallery(
+                label="My QR Generations",
+                value=[],
+                columns=3,
+                rows=2,
+                height="auto",
+                allow_preview=True,
+                object_fit="cover",
+                show_download_button=False,
+            )
+            with gr.Row():
+                with gr.Column(scale=1):
+                    my_qr_detail_image = gr.Image(
+                        label="Selected QR",
+                        visible=True,
+                        interactive=False,
+                    )
+                with gr.Column(scale=1):
+                    my_qr_detail_markdown = gr.Markdown(
+                        "Select a saved QR to inspect analytics and reload settings."
+                    )
+            with gr.Row():
+                my_qr_top_countries = gr.Dataframe(
+                    headers=["Country", "Scans"],
+                    datatype=["str", "number"],
+                    row_count=10,
+                    col_count=(2, "fixed"),
+                    label="Top countries",
+                    interactive=False,
+                    value=[],
+                )
+                my_qr_scans_by_day = gr.Dataframe(
+                    headers=["Day", "Scans"],
+                    datatype=["str", "number"],
+                    row_count=10,
+                    col_count=(2, "fixed"),
+                    label="Scans by day",
+                    interactive=False,
+                    value=[],
+                )
+            my_qr_settings_json = gr.Textbox(
+                label="Saved settings JSON",
+                lines=10,
+                interactive=True,
+                show_copy_button=True,
+                value="{}",
+            )
+            with gr.Row():
+                load_standard_from_dashboard_btn = gr.Button(
+                    "Load into Standard QR",
+                    variant="secondary",
+                    visible=False,
+                )
+                load_artistic_from_dashboard_btn = gr.Button(
+                    "Load into Artistic QR",
+                    variant="secondary",
+                    visible=False,
+                )
+
+            dashboard_refresh_btn.click(
+                fn=_load_my_qr_dashboard,
+                inputs=[],
+                outputs=[
+                    dashboard_status,
+                    my_qr_gallery,
+                    my_qr_records_state,
+                    my_qr_detail_markdown,
+                    my_qr_detail_image,
+                    my_qr_top_countries,
+                    my_qr_scans_by_day,
+                    my_qr_settings_json,
+                    load_standard_from_dashboard_btn,
+                    load_artistic_from_dashboard_btn,
+                ],
+            )
+
+            demo.load(
+                fn=_load_my_qr_dashboard,
+                inputs=[],
+                outputs=[
+                    dashboard_status,
+                    my_qr_gallery,
+                    my_qr_records_state,
+                    my_qr_detail_markdown,
+                    my_qr_detail_image,
+                    my_qr_top_countries,
+                    my_qr_scans_by_day,
+                    my_qr_settings_json,
+                    load_standard_from_dashboard_btn,
+                    load_artistic_from_dashboard_btn,
+                ],
+            )
+
+            my_qr_gallery.select(
+                fn=_select_my_qr_generation,
+                inputs=[my_qr_records_state],
+                outputs=[
+                    my_qr_detail_markdown,
+                    my_qr_detail_image,
+                    my_qr_top_countries,
+                    my_qr_scans_by_day,
+                    my_qr_settings_json,
+                    load_standard_from_dashboard_btn,
+                    load_artistic_from_dashboard_btn,
+                ],
+            )
+
+            load_standard_from_dashboard_btn.click(
+                fn=_load_standard_settings_from_dashboard,
+                inputs=[my_qr_settings_json],
+                outputs=[
+                    prompt_input,
+                    negative_prompt_standard,
+                    text_input,
+                    input_type,
+                    use_temporary_short_link,
+                    image_size,
+                    border_size,
+                    error_correction,
+                    module_size,
+                    module_drawer,
+                    use_custom_seed,
+                    seed,
+                    enable_upscale,
+                    enable_animation,
+                    controlnet_strength_standard_first,
+                    controlnet_strength_standard_final,
+                    enable_color_quantization,
+                    num_colors,
+                    color_1,
+                    color_2,
+                    color_3,
+                    color_4,
+                    apply_gradient_filter,
+                    gradient_strength,
+                    variation_steps,
+                    import_status_standard,
+                    qr_tabs,
+                ],
+            )
+
+            load_artistic_from_dashboard_btn.click(
+                fn=_load_artistic_settings_from_dashboard,
+                inputs=[my_qr_settings_json],
+                outputs=[
+                    artistic_prompt_input,
+                    negative_prompt_artistic,
+                    artistic_text_input,
+                    artistic_input_type,
+                    artistic_use_temporary_short_link,
+                    artistic_image_size,
+                    artistic_border_size,
+                    artistic_error_correction,
+                    artistic_module_size,
+                    artistic_module_drawer,
+                    artistic_use_custom_seed,
+                    artistic_seed,
+                    artistic_enable_upscale,
+                    artistic_enable_animation,
+                    enable_freeu_artistic,
+                    freeu_b1,
+                    freeu_b2,
+                    freeu_s1,
+                    freeu_s2,
+                    enable_sag,
+                    sag_scale,
+                    sag_blur_sigma,
+                    controlnet_strength_first,
+                    controlnet_strength_final,
+                    artistic_enable_color_quantization,
+                    artistic_num_colors,
+                    artistic_color_1,
+                    artistic_color_2,
+                    artistic_color_3,
+                    artistic_color_4,
+                    artistic_apply_gradient_filter,
+                    artistic_gradient_strength,
+                    artistic_variation_steps,
+                    import_status_artistic,
+                    qr_tabs,
+                ],
+            )
+
         # ARTISTIC QR TAB
 
 # Queue is required for gr.Progress() to work!

hf_dashboard.py

@@ -0,0 +1,503 @@
+from __future__ import annotations
+
+import io
+import json
+import os
+from collections import Counter
+from datetime import datetime, timezone
+from typing import Any, Mapping
+from urllib import error as urllib_error
+from urllib import parse as urllib_parse
+from urllib import request as urllib_request
+
+from PIL import Image
+
+SUPABASE_URL = os.getenv("SUPABASE_URL", "").rstrip("/")
+SUPABASE_SERVICE_ROLE_KEY = os.getenv("SUPABASE_SERVICE_ROLE_KEY", "")
+GENERATIONS_BUCKET = os.getenv("SUPABASE_GENERATIONS_BUCKET", "qr-generations")
+
+
+class DashboardError(RuntimeError):
+    pass
+
+
+_BUCKET_READY = False
+
+
+def _require_supabase() -> None:
+    if not SUPABASE_URL or not SUPABASE_SERVICE_ROLE_KEY:
+        raise DashboardError(
+            "Supabase is not configured. Set SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY."
+        )
+
+
+def _quote_filter(value: str) -> str:
+    return urllib_parse.quote(str(value), safe="")
+
+
+def _headers(*, json_body: bool = True, extra: Mapping[str, str] | None = None) -> dict[str, str]:
+    headers = {
+        "apikey": SUPABASE_SERVICE_ROLE_KEY,
+        "Authorization": f"Bearer {SUPABASE_SERVICE_ROLE_KEY}",
+        "User-Agent": "Mozilla/5.0 Hermes/1.0",
+    }
+    if json_body:
+        headers["Content-Type"] = "application/json"
+    if extra:
+        headers.update(dict(extra))
+    return headers
+
+
+def _request_json(
+    method: str,
+    path: str,
+    *,
+    payload: Any | None = None,
+    headers: Mapping[str, str] | None = None,
+    timeout: float = 20,
+) -> Any:
+    _require_supabase()
+    data = None
+    body_headers = _headers(json_body=True, extra=headers)
+    if payload is not None:
+        data = json.dumps(payload).encode("utf-8")
+    req = urllib_request.Request(
+        f"{SUPABASE_URL}{path}",
+        data=data,
+        headers=body_headers,
+        method=method,
+    )
+    try:
+        with urllib_request.urlopen(req, timeout=timeout) as response:
+            raw = response.read()
+            if not raw:
+                return None
+            return json.loads(raw.decode("utf-8"))
+    except urllib_error.HTTPError as exc:
+        detail = exc.read().decode("utf-8", "ignore")
+        raise DashboardError(f"Supabase request failed ({exc.code} {method} {path}): {detail}") from exc
+    except urllib_error.URLError as exc:
+        raise DashboardError(f"Supabase request failed ({method} {path}): {exc}") from exc
+
+
+def _request_bytes(
+    method: str,
+    path: str,
+    *,
+    data: bytes,
+    content_type: str,
+    headers: Mapping[str, str] | None = None,
+    timeout: float = 30,
+) -> None:
+    _require_supabase()
+    body_headers = _headers(
+        json_body=False,
+        extra={"Content-Type": content_type, **(dict(headers or {}))},
+    )
+    req = urllib_request.Request(
+        f"{SUPABASE_URL}{path}",
+        data=data,
+        headers=body_headers,
+        method=method,
+    )
+    try:
+        with urllib_request.urlopen(req, timeout=timeout):
+            return None
+    except urllib_error.HTTPError as exc:
+        detail = exc.read().decode("utf-8", "ignore")
+        raise DashboardError(f"Supabase upload failed ({exc.code} {method} {path}): {detail}") from exc
+    except urllib_error.URLError as exc:
+        raise DashboardError(f"Supabase upload failed ({method} {path}): {exc}") from exc
+
+
+def _table_select(table: str, *, query: str) -> list[dict[str, Any]]:
+    result = _request_json("GET", f"/rest/v1/{table}?{query}")
+    if isinstance(result, list):
+        return result
+    return []
+
+
+def _insert_row(table: str, row: Mapping[str, Any], *, upsert: bool = False) -> list[dict[str, Any]]:
+    prefer = "return=representation"
+    if upsert:
+        prefer += ",resolution=merge-duplicates"
+    result = _request_json(
+        "POST",
+        f"/rest/v1/{table}",
+        payload=row,
+        headers={"Prefer": prefer},
+    )
+    if isinstance(result, list):
+        return result
+    return []
+
+
+def _patch_rows(table: str, *, filters: str, values: Mapping[str, Any]) -> list[dict[str, Any]]:
+    result = _request_json(
+        "PATCH",
+        f"/rest/v1/{table}?{filters}",
+        payload=values,
+        headers={"Prefer": "return=representation"},
+    )
+    if isinstance(result, list):
+        return result
+    return []
+
+
+def _ensure_bucket() -> None:
+    global _BUCKET_READY
+    if _BUCKET_READY:
+        return
+    try:
+        _request_json(
+            "POST",
+            "/storage/v1/bucket",
+            payload={
+                "id": GENERATIONS_BUCKET,
+                "name": GENERATIONS_BUCKET,
+                "public": True,
+            },
+        )
+    except DashboardError as exc:
+        message = str(exc)
+        if "Duplicate" not in message and "already exists" not in message:
+            raise
+    _BUCKET_READY = True
+
+
+def _png_bytes(image: Image.Image, *, max_size: int | None = None) -> bytes:
+    image = image.convert("RGB")
+    if max_size is not None:
+        image = image.copy()
+        image.thumbnail((max_size, max_size))
+    buf = io.BytesIO()
+    image.save(buf, format="PNG", optimize=True)
+    return buf.getvalue()
+
+
+def _upload_public_png(*, image: Image.Image, object_path: str, max_size: int | None = None) -> str:
+    _ensure_bucket()
+    _request_bytes(
+        "POST",
+        f"/storage/v1/object/{GENERATIONS_BUCKET}/{urllib_parse.quote(object_path, safe='/')}",
+        data=_png_bytes(image, max_size=max_size),
+        content_type="image/png",
+        headers={"x-upsert": "true"},
+    )
+    return f"{SUPABASE_URL}/storage/v1/object/public/{GENERATIONS_BUCKET}/{object_path}"
+
+
+def _session_oauth_info(request: Any | None) -> dict[str, Any]:
+    if request is None:
+        return {}
+    session = getattr(request, "session", None) or {}
+    oauth_info = session.get("oauth_info") if isinstance(session, Mapping) else None
+    if isinstance(oauth_info, Mapping):
+        return dict(oauth_info)
+    return {}
+
+
+def get_current_user_context(request: Any | None) -> dict[str, Any] | None:
+    oauth_info = _session_oauth_info(request)
+    raw_userinfo = oauth_info.get("userinfo")
+    userinfo: Mapping[str, Any] = raw_userinfo if isinstance(raw_userinfo, Mapping) else {}
+    provider_subject = str(userinfo.get("sub") or "").strip()
+    username = str(userinfo.get("preferred_username") or getattr(request, "username", "") or "").strip()
+    display_name = str(userinfo.get("name") or username or "").strip()
+    avatar_url = str(userinfo.get("picture") or "").strip()
+    profile_url = str(userinfo.get("profile") or (f"https://huggingface.co/{username}" if username else "")).strip()
+    email = str(userinfo.get("email") or "").strip() or None
+    if not provider_subject or not username:
+        return None
+    return {
+        "provider": "huggingface",
+        "provider_subject": provider_subject,
+        "username": username,
+        "display_name": display_name or username,
+        "avatar_url": avatar_url or None,
+        "profile_url": profile_url or None,
+        "email": email,
+        "raw_profile": {"userinfo": userinfo, "oauth_info": {k: v for k, v in oauth_info.items() if k != "access_token"}},
+    }
+
+
+def ensure_app_user_for_request(request: Any | None) -> dict[str, Any] | None:
+    user = get_current_user_context(request)
+    if user is None:
+        return None
+
+    filters = (
+        f"provider=eq.{_quote_filter(user['provider'])}"
+        f"&provider_subject=eq.{_quote_filter(user['provider_subject'])}"
+        "&select=id,app_user_id"
+        "&limit=1"
+    )
+    existing = _table_select("user_identities", query=filters)
+    app_user_id = str(existing[0].get("app_user_id") or "").strip() if existing else ""
+
+    now_iso = datetime.now(timezone.utc).isoformat()
+    if not app_user_id:
+        inserted_users = _insert_row(
+            "app_users",
+            {
+                "display_name": user["display_name"],
+                "avatar_url": user["avatar_url"],
+                "created_at": now_iso,
+                "updated_at": now_iso,
+                "last_login_at": now_iso,
+            },
+        )
+        if not inserted_users:
+            raise DashboardError("Failed to create app user row.")
+        app_user_id = str(inserted_users[0]["id"])
+        _insert_row(
+            "user_identities",
+            {
+                "app_user_id": app_user_id,
+                "provider": user["provider"],
+                "provider_subject": user["provider_subject"],
+                "username": user["username"],
+                "email": user["email"],
+                "raw_profile": user["raw_profile"],
+                "created_at": now_iso,
+                "updated_at": now_iso,
+            },
+            upsert=True,
+        )
+    else:
+        _patch_rows(
+            "app_users",
+            filters=f"id=eq.{_quote_filter(app_user_id)}",
+            values={
+                "display_name": user["display_name"],
+                "avatar_url": user["avatar_url"],
+                "updated_at": now_iso,
+                "last_login_at": now_iso,
+            },
+        )
+        identity_filters = (
+            f"provider=eq.{_quote_filter(user['provider'])}"
+            f"&provider_subject=eq.{_quote_filter(user['provider_subject'])}"
+        )
+        _patch_rows(
+            "user_identities",
+            filters=identity_filters,
+            values={
+                "username": user["username"],
+                "email": user["email"],
+                "raw_profile": user["raw_profile"],
+                "updated_at": now_iso,
+            },
+        )
+
+    return {
+        **user,
+        "app_user_id": app_user_id,
+    }
+
+
+def persist_generation(
+    *,
+    request: Any | None,
+    generation_id: str,
+    qr_mode: str,
+    prompt: str,
+    text_input: str,
+    input_type: str,
+    status: str,
+    settings_dict: Mapping[str, Any],
+    url_normalization: Mapping[str, Any] | None,
+    shortener_result: Mapping[str, Any] | None,
+    final_image: Image.Image,
+) -> str | None:
+    user = ensure_app_user_for_request(request)
+    if user is None:
+        return None
+
+    timestamp = datetime.now(timezone.utc)
+    object_prefix = f"users/{user['app_user_id']}/{timestamp.strftime('%Y/%m/%d')}/{generation_id}"
+    completed_image_url = _upload_public_png(
+        image=final_image,
+        object_path=f"{object_prefix}.png",
+    )
+    thumbnail_url = _upload_public_png(
+        image=final_image,
+        object_path=f"{object_prefix}_thumb.png",
+        max_size=320,
+    )
+
+    normalized_destination_url = None
+    if input_type == "URL" and url_normalization:
+        normalized_destination_url = str(url_normalization.get("normalized_url") or "").strip() or None
+
+    short_link_id = None
+    short_code = None
+    short_url = None
+    shortener_expires_at = None
+    shortener_applied = False
+    if shortener_result:
+        short_link_id = str(shortener_result.get("short_link_id") or "").strip() or None
+        short_code = str(shortener_result.get("code") or "").strip() or None
+        short_url = str(shortener_result.get("short_url") or "").strip() or None
+        shortener_expires_at = str(shortener_result.get("expires_at") or "").strip() or None
+        shortener_applied = bool(shortener_result.get("applied"))
+
+    credit_cost = 4 if str(qr_mode).lower() == "artistic" else 1
+    row = {
+        "id": generation_id,
+        "user_id": user["app_user_id"],
+        "app_user_id": user["app_user_id"],
+        "destination_url": str(text_input or ""),
+        "qr_mode": str(qr_mode or "standard"),
+        "preset_id": None,
+        "prompt": prompt,
+        "status": status,
+        "credit_cost": credit_cost,
+        "input_type": input_type,
+        "destination_url_normalized": normalized_destination_url,
+        "effective_qr_text": str(settings_dict.get("effective_qr_text") or text_input or ""),
+        "shortener_applied": shortener_applied,
+        "short_link_id": short_link_id,
+        "short_code": short_code,
+        "short_url": short_url,
+        "shortener_expires_at": shortener_expires_at,
+        "completed_image_url": completed_image_url,
+        "thumbnail_url": thumbnail_url,
+        "metadata": {
+            "settings": dict(settings_dict),
+            "auth": {
+                "provider": user["provider"],
+                "provider_subject": user["provider_subject"],
+                "username": user["username"],
+                "display_name": user["display_name"],
+                "profile_url": user["profile_url"],
+            },
+        },
+        "updated_at": timestamp.isoformat(),
+    }
+    _insert_row("generations", row)
+    return f"Saved to My QR Codes for @{user['username']}."
+
+
+def list_my_generations(request: Any | None) -> dict[str, Any]:
+    user = ensure_app_user_for_request(request)
+    if user is None:
+        return {
+            "authenticated": False,
+            "status": "Sign in with Hugging Face to see your saved QR codes and analytics.",
+            "gallery": [],
+            "records": [],
+            "user": None,
+        }
+
+    query = (
+        "select=id,created_at,updated_at,status,input_type,qr_mode,prompt,destination_url_original,destination_url_normalized,"
+        "effective_qr_text,shortener_applied,short_link_id,short_code,short_url,shortener_expires_at,completed_image_url,thumbnail_url,metadata"
+        f"&app_user_id=eq.{_quote_filter(user['app_user_id'])}"
+        "&order=created_at.desc"
+    )
+    rows = _table_select("dashboard_generation_summaries", query=query)
+    gallery: list[tuple[str, str]] = []
+    for row in rows:
+        image = str(row.get("thumbnail_url") or row.get("completed_image_url") or "").strip()
+        created = str(row.get("created_at") or "")[:16].replace("T", " ")
+        label = f"{str(row.get('qr_mode') or 'qr').title()} · {created}"
+        gallery.append((image, label))
+
+    display_name = user.get("display_name") or user.get("username")
+    return {
+        "authenticated": True,
+        "status": f"Signed in as {display_name} (@{user['username']}). Found {len(rows)} saved QR code(s).",
+        "gallery": gallery,
+        "records": rows,
+        "user": user,
+    }
+
+
+def _extract_short_link_id(record: Mapping[str, Any]) -> str | None:
+    short_link_id = str(record.get("short_link_id") or "").strip()
+    if short_link_id:
+        return short_link_id
+
+    short_code = str(record.get("short_code") or "").strip()
+    if not short_code:
+        short_url = str(record.get("short_url") or "").strip()
+        if short_url:
+            short_code = short_url.rstrip("/").rsplit("/", 1)[-1]
+    if not short_code:
+        return None
+
+    rows = _table_select(
+        "short_links",
+        query=f"select=id&code=eq.{_quote_filter(short_code)}&limit=1",
+    )
+    if not rows:
+        return None
+    return str(rows[0].get("id") or "").strip() or None
+
+
+def get_generation_detail(request: Any | None, records: list[dict[str, Any]], index: int) -> dict[str, Any]:
+    user = ensure_app_user_for_request(request)
+    if user is None:
+        raise DashboardError("Please sign in first.")
+    if index < 0 or index >= len(records):
+        raise DashboardError("Selected QR code is out of range.")
+
+    record = records[index]
+    if str(record.get("app_user_id") or "") != str(user.get("app_user_id") or ""):
+        raise DashboardError("That QR code does not belong to the current user.")
+
+    short_link_id = _extract_short_link_id(record)
+    scan_rows: list[dict[str, Any]] = []
+    if short_link_id:
+        scan_rows = _table_select(
+            "short_link_scan_events",
+            query=(
+                "select=scanned_at,country_code,visitor_hash,is_bot,is_prefetch"
+                f"&short_link_id=eq.{_quote_filter(short_link_id)}"
+                "&order=scanned_at.desc"
+                "&limit=1000"
+            ),
+        )
+
+    total_scans = len(scan_rows)
+    last_scanned_at = str(scan_rows[0].get("scanned_at") or "").replace("T", " ")[:19] if scan_rows else "Never"
+    unique_scans = len({str(row.get('visitor_hash') or '') for row in scan_rows if str(row.get('visitor_hash') or '').strip()})
+
+    countries = Counter(str(row.get("country_code") or "Unknown") for row in scan_rows)
+    scans_by_day = Counter(str(row.get("scanned_at") or "")[:10] for row in scan_rows if str(row.get("scanned_at") or ""))
+
+    top_countries_rows = [[country, count] for country, count in countries.most_common(10)]
+    scans_by_day_rows = [[day, scans_by_day[day]] for day in sorted(scans_by_day.keys())]
+
+    metadata = record.get("metadata")
+    metadata_map: Mapping[str, Any] = metadata if isinstance(metadata, Mapping) else {}
+    raw_settings = metadata_map.get("settings")
+    settings: Mapping[str, Any] = raw_settings if isinstance(raw_settings, Mapping) else {}
+    settings_json = json.dumps(settings, indent=2, ensure_ascii=False) if settings else "{}"
+
+    detail_markdown = "\n".join(
+        [
+            f"### {str(record.get('qr_mode') or 'QR').title()} QR",
+            f"- Created: {str(record.get('created_at') or '').replace('T', ' ')[:19]}",
+            f"- Status: {record.get('status') or 'unknown'}",
+            f"- Input type: {record.get('input_type') or 'unknown'}",
+            f"- Destination: {record.get('destination_url_original') or '—'}",
+            f"- Short URL: {record.get('short_url') or '—'}",
+            f"- Effective QR text: {record.get('effective_qr_text') or '—'}",
+            f"- Total scans: {total_scans}",
+            f"- Approx. unique scans: {unique_scans}",
+            f"- Last scanned at: {last_scanned_at}",
+        ]
+    )
+
+    return {
+        "record": record,
+        "detail_markdown": detail_markdown,
+        "image": record.get("completed_image_url") or record.get("thumbnail_url"),
+        "top_countries_rows": top_countries_rows,
+        "scans_by_day_rows": scans_by_day_rows,
+        "settings_json": settings_json,
+        "is_standard": str(record.get("qr_mode") or "").lower() == "standard",
+        "is_artistic": str(record.get("qr_mode") or "").lower() == "artistic",
+    }

hf_space_dashboard_bootstrap.sql

@@ -0,0 +1,30 @@
+create extension if not exists pgcrypto;
+
+create table if not exists public.generations (
+  id uuid primary key default gen_random_uuid(),
+  user_id text not null,
+  destination_url text not null,
+  qr_mode text not null check (qr_mode in ('standard', 'artistic')),
+  preset_id text,
+  prompt text not null,
+  status text not null default 'mocked' check (status in ('queued', 'processing', 'completed', 'failed', 'mocked')),
+  credit_cost integer not null default 1 check (credit_cost > 0),
+  created_at timestamptz not null default now()
+);
+
+create table if not exists public.generation_variants (
+  id uuid primary key default gen_random_uuid(),
+  generation_id uuid not null references public.generations(id) on delete cascade,
+  variant_index integer not null,
+  image_url text,
+  thumbnail_url text,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  unique (generation_id, variant_index)
+);
+
+create index if not exists generations_user_id_created_at_idx
+  on public.generations(user_id, created_at desc);
+
+create index if not exists generation_variants_generation_id_idx
+  on public.generation_variants(generation_id);

tests-unit/hf_dashboard_test.py

@@ -0,0 +1,165 @@
+from __future__ import annotations
+
+import json
+
+import hf_dashboard
+
+
+class FakeRequest:
+    def __init__(self, username: str = "alice", oauth_info: dict | None = None):
+        self.username = username
+        self.session = {"oauth_info": oauth_info or {}}
+
+
+HF_OAUTH_INFO = {
+    "userinfo": {
+        "sub": "hf-user-123",
+        "preferred_username": "alice",
+        "name": "Alice Example",
+        "profile": "https://huggingface.co/alice",
+        "picture": "https://huggingface.co/alice.png",
+        "email": "alice@example.com",
+    },
+    "access_token": "secret-token",
+}
+
+
+def test_get_current_user_context_reads_hf_oauth_session() -> None:
+    request = FakeRequest(oauth_info=HF_OAUTH_INFO)
+
+    user = hf_dashboard.get_current_user_context(request)
+
+    assert user is not None
+    assert user["provider"] == "huggingface"
+    assert user["provider_subject"] == "hf-user-123"
+    assert user["username"] == "alice"
+    assert user["display_name"] == "Alice Example"
+    assert user["profile_url"] == "https://huggingface.co/alice"
+    assert "access_token" not in user["raw_profile"]["oauth_info"]
+
+
+def test_list_my_generations_requires_sign_in(monkeypatch) -> None:
+    monkeypatch.setattr(hf_dashboard, "ensure_app_user_for_request", lambda request: None)
+
+    payload = hf_dashboard.list_my_generations(request=None)
+
+    assert payload["authenticated"] is False
+    assert "Sign in" in payload["status"]
+    assert payload["records"] == []
+
+
+def test_list_my_generations_returns_gallery_and_records(monkeypatch) -> None:
+    monkeypatch.setattr(
+        hf_dashboard,
+        "ensure_app_user_for_request",
+        lambda request: {"app_user_id": "user-1", "username": "alice", "display_name": "Alice"},
+    )
+    monkeypatch.setattr(
+        hf_dashboard,
+        "_table_select",
+        lambda table, query: [
+            {
+                "id": "gen-1",
+                "app_user_id": "user-1",
+                "created_at": "2026-05-31T10:00:00+00:00",
+                "qr_mode": "standard",
+                "thumbnail_url": "https://cdn.example/thumb.png",
+                "completed_image_url": "https://cdn.example/full.png",
+                "metadata": {"settings": {"pipeline": "standard", "prompt": "hello"}},
+            }
+        ],
+    )
+
+    payload = hf_dashboard.list_my_generations(FakeRequest(oauth_info=HF_OAUTH_INFO))
+
+    assert payload["authenticated"] is True
+    assert len(payload["records"]) == 1
+    assert payload["gallery"] == [
+        ("https://cdn.example/thumb.png", "Standard · 2026-05-31 10:00")
+    ]
+
+
+def test_get_generation_detail_aggregates_scan_analytics(monkeypatch) -> None:
+    monkeypatch.setattr(
+        hf_dashboard,
+        "ensure_app_user_for_request",
+        lambda request: {"app_user_id": "user-1", "username": "alice", "display_name": "Alice"},
+    )
+
+    def fake_table_select(table: str, query: str):
+        if table == "short_link_scan_events":
+            return [
+                {
+                    "scanned_at": "2026-05-31T12:00:00+00:00",
+                    "country_code": "US",
+                    "visitor_hash": "v1",
+                    "is_bot": False,
+                    "is_prefetch": False,
+                },
+                {
+                    "scanned_at": "2026-05-31T13:00:00+00:00",
+                    "country_code": "NL",
+                    "visitor_hash": "v2",
+                    "is_bot": False,
+                    "is_prefetch": False,
+                },
+                {
+                    "scanned_at": "2026-05-31T14:00:00+00:00",
+                    "country_code": "US",
+                    "visitor_hash": "v1",
+                    "is_bot": False,
+                    "is_prefetch": False,
+                },
+            ]
+        raise AssertionError(f"Unexpected table: {table}")
+
+    monkeypatch.setattr(hf_dashboard, "_table_select", fake_table_select)
+    records = [
+        {
+            "id": "gen-1",
+            "app_user_id": "user-1",
+            "created_at": "2026-05-31T10:00:00+00:00",
+            "status": "completed",
+            "input_type": "URL",
+            "qr_mode": "standard",
+            "destination_url_original": "https://example.com",
+            "short_link_id": "short-link-1",
+            "short_url": "https://qrcut.co/abc123",
+            "effective_qr_text": "qrcut.co/abc123",
+            "completed_image_url": "https://cdn.example/full.png",
+            "metadata": {"settings": {"pipeline": "standard", "prompt": "hello"}},
+        }
+    ]
+
+    detail = hf_dashboard.get_generation_detail(FakeRequest(oauth_info=HF_OAUTH_INFO), records, 0)
+
+    assert "Total scans: 3" in detail["detail_markdown"]
+    assert "Approx. unique scans: 2" in detail["detail_markdown"]
+    assert detail["image"] == "https://cdn.example/full.png"
+    assert detail["top_countries_rows"] == [["US", 2], ["NL", 1]]
+    assert detail["scans_by_day_rows"] == [["2026-05-31", 3]]
+    assert json.loads(detail["settings_json"])["pipeline"] == "standard"
+
+
+def test_ensure_app_user_for_request_creates_identity_when_missing(monkeypatch) -> None:
+    request = FakeRequest(oauth_info=HF_OAUTH_INFO)
+    calls: list[tuple[str, dict]] = []
+
+    monkeypatch.setattr(hf_dashboard, "_table_select", lambda table, query: [])
+
+    def fake_insert(table: str, row: dict, upsert: bool = False):
+        calls.append((table, row))
+        if table == "app_users":
+            return [{"id": "app-user-1"}]
+        if table == "user_identities":
+            return [{"id": "identity-1", "app_user_id": "app-user-1"}]
+        raise AssertionError(table)
+
+    monkeypatch.setattr(hf_dashboard, "_insert_row", fake_insert)
+    monkeypatch.setattr(hf_dashboard, "_patch_rows", lambda *args, **kwargs: [])
+
+    user = hf_dashboard.ensure_app_user_for_request(request)
+
+    assert user is not None
+    assert user["app_user_id"] == "app-user-1"
+    assert [table for table, _row in calls] == ["app_users", "user_identities"]