connectcreds: Manage 'OAuth' Credentials from 'Posit Connect'

Description

A toolkit for making use of credentials mediated by 'Posit Connect'. It handles the details of communicating with the Connect API correctly, 'OAuth' token caching, and refresh behaviour.

Author(s)

Maintainer: Aaron Jacobs aaron.jacobs@posit.co

Other contributors:

• Posit Software, PBC [copyright holder, funder]

See Also

Useful links:

• https://github.com/posit-dev/connectcreds

• Report bugs at https://github.com/posit-dev/connectcreds/issues

Service account credentials on Posit Connect

Description

Request an OAuth access token for a third-party resource from Posit Connect. The OAuth token will belong to the client (usually a "service principal" or "service account") managed by Connect, not the publisher.

Usage

connect_service_account_token(
  resource = NULL,
  scope = NULL,
  content_token = Sys.getenv("CONNECT_CONTENT_SESSION_TOKEN"),
  server_url = Sys.getenv("CONNECT_SERVER"),
  api_key = Sys.getenv("CONNECT_API_KEY")
)

has_service_account_token(...)

Arguments

Details

connect_service_account_token() handles caching automatically.

Value

connect_service_account_token() returns an httr2::oauth_token.

has_service_account_token() returns TRUE if there is a Connect-managed service account avaiable and FALSE otherwise.

Examples

token <- "default-token"
if (has_service_account_token()) {
  token <- connect_service_account_token()
}

Viewer-based credentials on Posit Connect

Description

Request an OAuth access token for a third-party resource belonging to the user associated with a given Shiny session. This works by exchanging a short-lived session credential for OAuth tokens issued to the client managed by the Connect server, without the Shiny app in question having to manage the user's authentication flow (or the associated client credentials) itself.

Usage

connect_viewer_token(
  resource = NULL,
  scope = NULL,
  session = get_connect_session(),
  server_url = Sys.getenv("CONNECT_SERVER"),
  api_key = Sys.getenv("CONNECT_API_KEY")
)

has_viewer_token(..., session = get_connect_session())

Arguments

Details

connect_viewer_token() handles caching automatically.

Value

connect_viewer_token() returns an httr2::oauth_token.

has_viewer_token() returns TRUE if the session has a viewer token and FALSE otherwise.

Examples

token <- "default-token"
if (has_viewer_token()) {
  token <- connect_viewer_token()
}

Workload identity tokens on Posit Connect

Description

Request an OpenID Connect identity token suitable for workload identity federation with a third-party service.

Usage

connect_workload_token(
  ...,
  content_token = Sys.getenv("CONNECT_CONTENT_SESSION_TOKEN"),
  server_url = Sys.getenv("CONNECT_SERVER"),
  api_key = Sys.getenv("CONNECT_API_KEY")
)

has_workload_token(...)

Arguments

Details

connect_workload_token() handles caching automatically.

Value

connect_workload_token() returns an httr2::oauth_token.

has_workload_token() returns TRUE if a workload identity token is available and FALSE otherwise.

Examples

integration_guid <- "891db041-22d6-4f5f-9fee-fc715a33929e"
token <- "default-token"
if (has_workload_token(audience = integration_guid)) {
  token <- connect_workload_token(audience = integration_guid)
}

Mock responses from the Posit Connect server

Description

These functions can be used to temporarily mock responses from the Connect server, which is useful for writing tests that verify the behaviour of viewer-based or service account credentials.

Usage

with_mocked_connect_responses(
  code,
  mock = NULL,
  token = NULL,
  error = FALSE,
  env = caller_env()
)

local_mocked_connect_responses(
  mock = NULL,
  token = NULL,
  error = FALSE,
  env = caller_env()
)

Arguments

Value

with_mocked_connect_responses() returns the result of evaluating code.

Examples

with_mocked_connect_responses(
  connect_viewer_token(),
  token = "test"
)

with_mocked_connect_responses(
  connect_service_account_token(),
  token = "test"
)