[Bug] Arena Embedded Space Login Failure (401 "User not found")

[ugurobothand]

Describe the bug

When attempting to log in via the embedded Hugging Face Space (lmarena-ai/arena-leaderboard), the UI displays a "Signed in successfully!" notification, but the session is not saved, and the sidebar remains in a logged-out state.

Technical Diagnostic Logs

• arena.ai/api/history/unified returns 401 with {"message":"User not found"}.
• Chrome has no hf_oauth, token, session, or Arena auth cookie—only Hugging Face’s non-auth aws-waf-token.
• The auth request sent zero cookies; DevTools reported no blocked-cookie reasons.
• No CORS or WebSocket failure was found. The 401 response is same-origin; its CORS header is permissive.
• Console shows an unrelated 500 for arena.ai/nextjs-api/autoeval/release-banner, plus report-only CSP warnings for help-page fetches.

Root Cause Analysis

The Arena login flow reports success client-side, but no persistent Arena session/user record is established. This is not Hugging Face account state syncing: the Space embeds static.hf.space, which embeds arena.ai as a third-party iframe. The iframe is not credentialless and storage access is available. The backend’s “User not found” response points to failed account provisioning/session issuance in the Arena auth flow.

Environment / Platform

• Platform: Hugging Face Spaces (lmarena-ai/arena-leaderboard)
• Browser: Google Chrome