Skip to contents

Wrap an existing reactive token as a connection

Source: R/methods__connection.R
oauth_connection.Rd

Combine one module's reactive token with its client and approved API addresses configured on oauth_client(). Call [["request"]]() on the connection to send a request with the current token. It reads the reactive token again after refresh or logout and restricts requests to the configured APIs. This optional wrapper expires with its Shiny session; it does not implement refresh itself or retain credentials across redirects. Clients with token_targets must use the module's connection() factory, which retains the authorization's permission limits alongside its tokens.

Usage

oauth_connection(
  client,
  token_reactive,
  session = shiny::getDefaultReactiveDomain()
)

Arguments

client

An OAuthClient with non-empty resource_bases, created by oauth_client() or smart_client().

token_reactive

A Shiny reactive expression returning the current OAuthToken or NULL, usually shiny::reactive(auth[["token"]]). It must come from the module using client. This association is supplied by the caller; API address restrictions cannot verify an opaque token's audience.

session

The owning Shiny session; defaults to the current session.

Value

An OAuthConnection with [["id"]], [["is_usable"]](), [["summary"]]() and [["request"]](resource_id, path = "", query = NULL, method = "GET", required_scopes = character(), configure = NULL). Requests return httr2 responses. configure can add a body and application headers; see OAuthConnection for its contract.

Details

The module's auth$connection() factory also supports token acquisition and refresh for external packages. This wrapper adapts an existing reactive token.

The reference is bound to its creating Shiny session and checks that session's reactive context. [["summary"]]() excludes tokens, identity claims and extension context. [["is_usable"]]() checks local presence, known expiry and required scopes; it cannot guarantee remote authorization. Unknown token expiry is unusable.

Paths are relative to the selected base directory. Absolute and root-relative references (including pagination links) must stay within that same base. Dot segments and ambiguous encodings are rejected; redirects are never followed. Bearer, DPoP and mTLS use the existing transport and the configured client.

Use request-level required_scopes for optional operations. They must be included in the client's requested scopes and covered by the current grant. The package cannot infer arbitrary API permissions from an HTTP method/path. oauth_module_server() still manages refresh and logout. To retain credentials across Shiny sessions, use oauth_connections() and oauth_connections_server().

Examples

if (FALSE) { # \dontrun{
# Configure outside server():
client <- oauth_client(provider, "registered-app",
  redirect_uri = "https://app.example/callback", scopes = "read",
  resource_bases = c(api = "https://api.example/v1"))
# Inside server():
auth <- oauth_module_server("auth", client)
connection <- oauth_connection(client, shiny::reactive(auth[["token"]]))
data <- shiny::reactive({
  shiny::req(connection[["is_usable"]]())
  connection[["request"]]("api", "records", required_scopes = "read")
})
} # }