Loading Private Spaces via `gr.Interface.load()` doesn't work for certain components

[abidlabs]

Describe the bug

As part of reviewing #2594, we noticed that if you gr.Interface.load() a Private Space (even if you provide an API token), it does't work for certain components, specifically:

• Model3D component doesn't show up correctly in the input
• Dataframe component preview doesn't show up in the Dataset

Is there an existing issue for this?

• I have searched the existing issues

Reproduction

import gradio as gr

gr.Interface.load("spaces/gradio/test-loading-examples-private").launch()

Screenshot

No response

Logs

CORS stuff in the js console

System Info

3.8

Severity

annoying

[abidlabs]

Looking into this, it seems like there is an issue with Spaces blocking CORS access for private Spaces. Have asked the Spaces team if it's possible to change this: https://huggingface.slack.com/archives/C048K60MPNF/p1674081005834629

[abidlabs]

Update: @XciD is working on a fix to allow CORS here: https://github.com/huggingface/spaces-app-manager/pull/544, thanks @XciD <3

[abidlabs]

So the Spaces side is fixed, as can be seen by running the following:

var url = "https://gradio-test-loading-examples-private.hf.space/file=/tmp/tmpnt7v9r32/Bunnyc7iy75is.obj";
var bearer_token = ... // your HF token
var bearer = 'Bearer ' + bearer_token;
fetch(url, {
        method: 'GET',
        headers: {
            'Authorization': bearer,
        }
    }).then(responseJson => {
        console.log(responseJson)
    })

But now we just need to pass along the bearer token when making the fetch requests

[XciD]

One last thing, doing this in front end will expose the api token to users

[abidlabs]

Good point @XciD! Hmm this actually presents a security problem -- we cannot pass along the bearer token to the frontend because if someone was to create a Space where they load their HF token safely (e.g. through Secrets), and then pass it along to gr.Interface.load(), we would expose the API token if we were to pass it to the frontend to make fetch() requests.

[abidlabs]

I can't see any way around this. The best thing might be to just print a warning if someone does gr.Interface.load() on a Private Space saying that some components may not work properly when loading private Spaces. Thoughts @freddyaboulton @aliabid94 @XciD?

[freddyaboulton]

Can we download the files from the upstream private space on the backend (where the token is safe) ?

[abidlabs]

Yeah that's what I was thinking as well. We can modify the /file= route to be able to do this. I'll implement this in the next few days