Package: shinyOAuth 0.6.1.9000

Overview | Browser binding and deployment boundary | Provider metadata and OIDC discovery | JWT client authentication | Issuer comparison and transport policy | Callback pages and application scripts | Provider key-set validation | Trusted ID-token audiences | Mutual TLS (mTLS) | JWT-secured authorization request (JAR) | Request Objects published by the Shiny app | Pushed authorization requests (PAR) | Form Post response mode | Deployment behind an HTTPS proxy | JWT-secured authorization response mode (JARM) | Demonstrating proof-of-possession (DPoP) | Token binding requirements and validation | DPoP in API requests | Signature and encryption support

Logging | Validation and URL policy | Advanced parameter overrides | Async timeout (mirai) | Async condition replay | Token lifetime fallback | HTTP settings (timeout, retries, user agent) | State store | Size caps | State envelope | Callback query | Local debugging

Overview | GitHub app registration | Minimal Shiny module example | Provider, client, and token objects | Authentication state and user information | Manual login and logout buttons | Authenticated API requests | Additional token response fields | Provider configuration and OIDC discovery | Assessing OAuth 2.1 configuration | Multiple authorization servers | Requests bound to a client and resource | Asynchronous execution | Token expiry and session length | Deployment | Posit Connect and Connect Cloud | Multiple R processes | Security checklist | Troubleshooting | Further configuration

Overview | Exporter configuration | Traces and event correlation | Logging and tracing options | Asynchronous workers | Error attributes and redaction | Authorization metadata privacy | Span catalog | Span: shinyOAuth.module.init | Span: shinyOAuth.login.request | Span: shinyOAuth.login.par | Span: shinyOAuth.login.par.http | Span: shinyOAuth.callback | Span: shinyOAuth.form_post | Span: shinyOAuth.form_post.bridge | Span: shinyOAuth.callback.validate | Span: shinyOAuth.callback.worker | Span: shinyOAuth.token.exchange | Span: shinyOAuth.token.exchange.http | Span: shinyOAuth.token.verify | Span: shinyOAuth.userinfo | Span: shinyOAuth.userinfo.http | Span: shinyOAuth.refresh | Span: shinyOAuth.refresh.worker | Span: shinyOAuth.logout | Span: shinyOAuth.session.end.revoke | Span: shinyOAuth.token.revoke | Span: shinyOAuth.token.revoke.http | Span: shinyOAuth.token.revoke.worker | Span: shinyOAuth.token.introspect | Span: shinyOAuth.token.introspect.http | Span: shinyOAuth.token.introspect.worker

Overview | What happens during the authentication flow? | 1. First page load: set a browser token | 2. Decide whether to start login | 3. Build the authorization request | State storage and expiry | Signed and pushed authorization requests (JAR and PAR) | 4. Redirect the browser to the provider | 5. User signs in and authorizes access | 6. Provider returns the browser to the app | HTTP POST callbacks (form_post) | Signed authorization responses (JARM) | 7. Validate the callback and login state | Browser binding and account validation | Multiple authorization servers | 8. Exchange the authorization code for tokens | Client certificates and certificate-bound tokens (mTLS) | Tokens bound to a signing key (DPoP) | 9. Validate the ID token (OIDC) | Signature and claim checks | Requested claims and authentication context (ACR) | 10. Build the OAuthToken object | 11. Check whether the token is active (optional introspection) | 12. Fetch user information (optional) | Signed UserInfo responses | UserInfo with mTLS or DPoP | 13. Mark the session as authenticated | 14. Clean up the callback URL and browser state | 15. Manage the authenticated session | Token refresh | ID tokens during refresh | Refreshing mTLS and DPoP tokens | Reauthentication | Expiry and refresh failures | 16. Logout and token revocation

Overview | Spotify app registration | Shiny app example | API requests and scopes | Full dashboard example

Client configuration and connections | Register two clients | 1. Configure clients outside server() | 2. Keep authorizations when the browser returns | 3. Select a connection and make a request | Requests, permissions and refresh | Keep an ordinary OIDC login alongside SMART connections

Overview | Receiving audit events | Authentication outcomes | Event structure | HTTP context and redaction | Audit events from asynchronous workers | Digest keys across R processes | Event catalog | Authorization redirect issuance | Event: audit_redirect_issued | Callback query rejected | Event: audit_callback_query_rejected | Callback routing rejected | Event: audit_callback_routing_rejected | Callback issuer validation | Event: audit_callback_iss_missing | Event: audit_callback_iss_mismatch | Event: audit_callback_iss_validation_failed | Callback received | Event: audit_callback_received | Callback validation | Event: audit_callback_validation_success | Event: audit_callback_validation_failed | State store access | Event: audit_state_store_lookup_failed | Event: audit_state_store_removal_failed | Token exchange | Event: audit_token_exchange | Event: audit_token_exchange_error | Token introspection | Event: audit_token_introspection | Login result | Event: audit_login_success | Event: audit_login_failed | Logout and session clears | Event: audit_logout | Event: audit_connection_disconnected | Event: audit_connections_disconnected | Event: audit_session_cleared | Token revocation | Event: audit_token_revocation | Refresh failures while keeping the session (indefinite sessions) | Event: audit_refresh_failed_but_kept_session | Browser cookie/WebCrypto error | Event: audit_browser_cookie_error | Invalid browser token | Event: audit_invalid_browser_token | Token refresh | Event: audit_token_refresh | Userinfo fetch | Event: audit_userinfo | State parsing failures | Event: audit_state_parse_failure | Error response state consumption | Event: audit_error_state_consumed | Event: audit_error_state_consumption_failed | Module/session lifecycle | Event: audit_session_started | Event: audit_session_ended | Event: audit_session_ended_revoke | Authentication state changes | Event: audit_authenticated_changed | Error events | Event: error | Event: http_error | Event: transport_error

A single-authorization app | SDK callbacks and databases | Refresh, async work and recovery | Several authorizations and optional UserInfo | Background tasks and result ownership

Declare calendar and contacts targets | Use the same connection interface in either module | Microsoft configuration

FHIR and SMART on FHIR | Before running the example | 1. Discover the server and configure the client | 2. Configure retained connections | 3. Authorize and fetch the patient | Search with the same connection | Patient context and user identity are different | Start from an EHR instead | More than one hospital | Other registration and refresh options