Use OAuth access token to make inference API calls

[coyotte508]

Add the option to use the oauth acces token instead of our secret token to make inference API calls when the user is logged in.

Note that currently an oauth access token has a duration of 8 hours, but we can extend it to 30 days if we want.

There's also a refresh token mechanism being worked on on hub's side, once that's done the access token can be refreshed. (When refreshing the token, we need to store the new refresh token, the old one becomes unusable)

The refresh token is valid for 3 months, and each renew/refresh makes is valid for another 3 months

[coyotte508]

Related: #1216

[nsarrazin]

I think that makes sense, I can tackle it once we have the refresh mechanism in place!

Couple questions:

• Does it mean non-PRO users won't be able to use PRO models if we use their token ? Could be a deal breaker, since most HChat models are restricted to PRO users I think.
• Is it safe to store the oauth access token in the DB? Does it have limited scope ?

[coyotte508]

* Does it mean non-PRO users won't be able to use PRO models if we use their token ? Could be a deal breaker, since most HChat models are restricted to PRO users I think.

cc @Narsil @gary149

* Is it safe to store the oauth access token in the DB? Does it have limited scope ?

In our OPENID config we only request the following scopes: "SCOPES": "openid profile inference-api"

So it'll be fine IMO, the only special thing the token can do is make inference API requests on behalf of the user

(we also need to store refresh token in DB)

[hellerphilipp]

Is this still active?

[nsarrazin]

Not at the moment @hellerphilipp the blocker was mostly that we host bigger PRO-only models on HuggingChat that would be unavailable to non-PRO users.

Do you have a use case for something like this in mind ?