Package: shinyOAuth 0.5.0.9000

Overview | Start with discovery when possible | Mutual TLS (mTLS) | JWT-secured authorization request (JAR) | Pushed authorization requests (PAR) | Form Post response mode | JWT-secured authorization response mode (JARM) | Demonstrating proof-of-possession (DPoP)

Overview | Receiving audit events | Event structure | HTTP context sanitization | Excluding HTTP context entirely | Audit events from async workers (mirai daemons) | Digest fields and keying | Event catalog | Authorization redirect issuance | Event: audit_redirect_issued | Callback query rejected | Event: audit_callback_query_rejected | Callback issuer validation | Event: audit_callback_iss_missing | Event: audit_callback_iss_mismatch | Event: audit_callback_iss_validation_failed | Callback received | Event: audit_callback_received | Callback validation | Event: audit_callback_validation_success | Event: audit_callback_validation_failed | State store access | Event: audit_state_store_lookup_failed | Event: audit_state_store_removal_failed | Token exchange | Event: audit_token_exchange | Event: audit_token_exchange_error | Token introspection | Event: audit_token_introspection | Login result | Event: audit_login_success | Event: audit_login_failed | Logout and session clears | Event: audit_logout | Event: audit_session_cleared | Token revocation | Event: audit_token_revocation | Refresh failures while keeping the session (indefinite sessions) | Event: audit_refresh_failed_but_kept_session | Browser cookie/WebCrypto error | Event: audit_browser_cookie_error | Invalid browser token | Event: audit_invalid_browser_token | Token refresh | Event: audit_token_refresh | Userinfo fetch | Event: audit_userinfo | State parsing failures | Event: audit_state_parse_failure | Error response state consumption | Event: audit_error_state_consumed | Event: audit_error_state_consumption_failed | Module/session lifecycle | Event: audit_session_started | Event: audit_session_ended | Event: audit_session_ended_revoke | Authentication state changes | Event: audit_authenticated_changed | Error events | Event: error | Event: http_error | Event: transport_error

Overview | Minimal Shiny module example | Manual login button variant | Making authenticated API calls | Async mode to keep UI responsive | 'mirai' async backend (recommended) | 'future' async backend | Logout | Using response_mode = "form_post" | Deploying on Posit Connect Cloud (avoiding embedded deployment) | Global options | Observability/logging | Networking/security | Extra parameter overrides | Async timeout (mirai) | Async condition replay | Token lifetime fallback | HTTP settings (timeout, retries, user agent) | State store | Size caps | State envelope | Callback query | Development/debugging | Browser cookie & preventing XSS | Multi‑process deployments: share state store, key, and policy | Security checklist

Overview | What happens during the authentication flow? | 1. First page load: set a browser token | 2. Decide whether to start login | 3. Build the authorization URL (prepare_call()) | 4. App redirects to the provider | 5. User authenticates and authorizes | 6. Provider redirects user back to the app | What changes with response_mode = "form_post"? | 7. Callback processing & state verification (oauth_module_server()) | 8. Exchange authorization code for tokens | What changes when mTLS is enabled (RFC 8705) | What changes when DPoP is enabled (RFC 9449) | 9. Validate ID token (OIDC only) | 10. Fetch userinfo (optional) | 11. Build the OAuthToken object | 12. Token introspection (optional) | 13. Mark session as authenticated | 14. Clean URL & tidy UI; clear browser token | 15. Post-flow session management | Refresh behavior (refresh_token()) | 16. Logout and token revocation

Overview | Logs | Traces | Span catalog | Span: shinyOAuth.module.init | Span: shinyOAuth.login.request | Span: shinyOAuth.login.par | Span: shinyOAuth.login.par.http | Span: shinyOAuth.callback | Span: shinyOAuth.form_post | Span: shinyOAuth.form_post.bridge | Span: shinyOAuth.callback.validate | Span: shinyOAuth.callback.worker | Span: shinyOAuth.token.exchange | Span: shinyOAuth.token.exchange.http | Span: shinyOAuth.token.verify | Span: shinyOAuth.userinfo | Span: shinyOAuth.userinfo.http | Span: shinyOAuth.refresh | Span: shinyOAuth.refresh.worker | Span: shinyOAuth.logout | Span: shinyOAuth.session.end.revoke | Span: shinyOAuth.token.revoke | Span: shinyOAuth.token.revoke.http | Span: shinyOAuth.token.revoke.worker | Span: shinyOAuth.token.introspect | Span: shinyOAuth.token.introspect.http | Span: shinyOAuth.token.introspect.worker

Overview | Code