Skip to content

Better support "xet-write-token" API authorization model and LFS Batch Api change#498

Merged
seanses merged 8 commits intomainfrom
di/use-refresh-route-if-exists
Sep 23, 2025
Merged

Better support "xet-write-token" API authorization model and LFS Batch Api change#498
seanses merged 8 commits intomainfrom
di/use-refresh-route-if-exists

Conversation

@seanses
Copy link
Collaborator

@seanses seanses commented Sep 17, 2025

  1. This PR updates the hub client xet access token request to use custom rev in addition to the default "main". This better supports the "xet-write-token" API authorization model:
    Clients can get a xet write token, if
  • the "rev" is a regular branch, with a HF write token;
  • the "rev" is a pr branch with an corresponding open PR, with a HF write or read token;
  • it intends to create a pr and repo is enabled for discussion, with a HF write or read token.
  1. Fixed a bug when getting the current branch name in a repo, which didn't parse branch names with "/" correctly: change refs_heads_branch.rsplit('/').next() to refs_heads_branch.strip_prefix("refs/heads/").

  2. Also updated xet transfer agent to use the refresh route in the LFS Batch Api response.

  3. Use the session id in the LFS Batch Api response for token refresh and CAS requests.

@seanses seanses changed the title use refresh route sent by server if exists Better support "xet-write-token" API authorization model Sep 17, 2025
@seanses seanses marked this pull request as ready for review September 17, 2025 22:42
seanses added a commit that referenced this pull request Sep 23, 2025
According to PR feedback
#498 (comment),
move error constructors into the enum impls.
LFS Batch Api response is updated in
huggingface-internal/moon-landing#15121 that
- makes token refresh route mandatory (in field `action.href`) and puts
CAS URL in the headers map;
- sends a session id in the headers map;

This PR builds on top of
#498 and updates how client
uses the information according to the above changes.
@seanses seanses changed the title Better support "xet-write-token" API authorization model Better support "xet-write-token" API authorization model and LFS Batch Api change Sep 23, 2025
@seanses seanses merged commit 75952ae into main Sep 23, 2025
6 checks passed
@seanses seanses deleted the di/use-refresh-route-if-exists branch September 23, 2025 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants