Manage access requests programmatically

[Wauplin]

Solves #1535.

Let's add official support to programmatically manage access requests for gated repos.

The API defines a AccessRequest dataclass with username, email, status, timestamp and fields + 7 endpoints. I reused as much as possible the vocabulary used in the UI. We have:

• list_pending_access_requests => returns "pending" list
• list_accepted_access_requests => returns "accepted" list
• list_rejected_access_requests => returns "rejected" list
• cancel_access_request => moves request to "pending" list
• accept_access_request => moves request to "accepted" list
• reject_access_request => moves request to "rejected" list
• grant_access => add a user to "accepted" list (the user doesn't have to request access first)

Methods docstrings are documented with examples. I don't think it's worth creating a guide dedicated to it in huggingface_hub as it would be quite redundant with the Hub docs already. I suggest to update the Hub docs instead to mention the huggingface_hub implementation but that's it.

TODO:

• update https://huggingface.co/docs/hub/models-gated and https://huggingface.co/docs/hub/datasets-gated once this PR is shipped

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[osanseviero]

Nice!

[LysandreJik]

That's awesome! Very cool API.

Is it worth mentioning what kind of permissions they'll need on the repo to have access to the accepted/pending/rejected requests (is it read/write/admin?)? Especially given the example is Llama-2-7b.

[Wauplin]

Thanks both for the review!

I have addressed your comments. @LysandreJik regarding roles in organization, the user must have "write" or "admin" role. I have updated the docstrings accordingly. (fyi, role contributor also have access to these settings on repos for which they have write access. It's a corner case so I haven't documented it).

I'll wait for the CI to pass and then merge this!

[codecov]

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (2b95d2b) 82.25% compared to head (ceed72a) 82.31%.
Report is 1 commits behind head on main.

Files	Patch %	Lines
src/huggingface_hub/hf_api.py	94.82%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1905      +/-   ##
==========================================
+ Coverage   82.25%   82.31%   +0.06%     
==========================================
  Files          65       65              
  Lines        8029     8087      +58     
==========================================
+ Hits         6604     6657      +53     
- Misses       1425     1430       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[RonanKMcGovern]

@lappemic @Wauplin has something changed here in the last days? After April 18th, my automations querying access seem to have stopped working. Curl requests like this:

curl -X GET \             
  'https://huggingface.co/api/repos/Trelis/Mistral-7B-Instruct-v0.1-Summarize-64k/user-access-request/pending' \
  -H 'Authorization: Bearer TOKEN'

seem not to be working any more

[Wauplin]

has something changed here in the last days?

@RonanKMcGovern shouldn't be the case no.

If you are getting errors, could you open a new ticket and provide more context (requests/script + error message + stacktrace if applicable). Thanks in advance!

[RonanKMcGovern]

Ah very sorry @Wauplin , I just realised I rolled my HF token after a live stream last week without realising it was being used in some automations. Thanks for the quick reply.

[Wauplin]

Glad your issue's solved then!