Fix/shiny oauth arcgis compatibility

DESCRIPTION

@@ -52,7 +52,7 @@ Suggests:
     jsonify,
     testthat (>= 3.0.0),
     vctrs,
-    shinyOAuth,
+    shinyOAuth (>= 0.6.0),
     nanoparquet
 Config/rextendr/version: 0.4.2
 Config/testthat/edition: 3

NEWS.md

@@ -1,5 +1,8 @@
 # arcgisutils 0.6.1 (development)
 
+- Shiny authentication now identifies the signed-in user by their user ID instead of the organization ID.
+- Shiny login and refresh accept ArcGIS token responses that omit `token_type`. This integration now requires shinyOAuth 0.6.0 or later.
+
 - `arc_gp_job` gains `submit_path` and `results_path`, so services that are not `GPServer` endpoints can use it. A tile export submits to `exportTiles` and reads its download URL off the job resource, and no longer needs a parallel job class of its own.
 
 - `arc_gp_job$await()` gains a `timeout` argument, defaulting to `Inf`.

R/auth-shiny.R

@@ -9,7 +9,7 @@
 #'
 #' @details
 #'
-#' Authentication with `auth_shiny()` requires the package `shinyOAuth`.
+#' Authentication with `auth_shiny()` requires `shinyOAuth` 0.6.0 or later.
 #' When creating an OAuth app in ArcGIS Online / Enterprise, ensure that
 #' the app has a valid redirect URI. This **must be** the same redirect URI
 #' that is used by `shinyOAuth` and **must be** the same port as the
@@ -25,6 +25,7 @@
 #'
 #' The user info returned from `auth$token@userinfo` has the same structure
 #' as [arc_portal_self()]. See that function's documentation for available fields.
+#' The authenticated user is identified by `user$id` in that response.
 #'
 #' The below example is derived from the shinyOAuth documentation.
 #'
@@ -87,14 +88,15 @@ oauth_provider_arcgis <- function(
   ver <- utils::packageVersion("arcgisutils")
   arc_ver <- paste0("arcgisutils v", ver)
 
-  rlang::check_installed("shinyOAuth")
+  rlang::check_installed("shinyOAuth", version = "0.6.0")
   shinyOAuth::oauth_provider(
     name = arc_ver,
     auth_url = paste0(host, "/sharing/rest/oauth2/authorize"),
     token_url = paste0(host, "/sharing/rest/oauth2/token"),
     token_auth_style = "body",
+    allow_missing_token_type = TRUE,
     userinfo_url = paste0(host, "/sharing/rest/portals/self?f=json"),
-    userinfo_id_selector = function(x) x$id
+    userinfo_id_selector = function(x) x$user$id
   )
 }
 
@@ -110,7 +112,7 @@ auth_shiny <- function(
   host = arc_host(),
   ...
 ) {
-  rlang::check_installed("shinyOAuth")
+  rlang::check_installed("shinyOAuth", version = "0.6.0")
   dots <- rlang::list2(...)
   check_dots_named(dots)
 

tests/testthat/test-auth-shiny.R

@@ -0,0 +1,76 @@
+test_that("Shiny OAuth identifies users within the same organization", {
+  skip_if_not_installed("shinyOAuth", minimum_version = "0.6.0")
+  provider <- oauth_provider_arcgis()
+  select_id <- provider@userinfo_id_selector
+
+  alice <- list(id = "organization-id", user = list(id = "alice-id"))
+  bob <- list(id = "organization-id", user = list(id = "bob-id"))
+  expect_identical(select_id(alice), "alice-id")
+  expect_identical(select_id(bob), "bob-id")
+  expect_null(select_id(list(id = "organization-id")))
+  expect_null(select_id(list(id = "organization-id", user = list())))
+})
+
+test_that("Shiny login and refresh accept ArcGIS responses without token_type", {
+  skip_if_not_installed("shinyOAuth", minimum_version = "0.6.0")
+  client <- auth_shiny(
+    client = "test-client",
+    secret = "test-secret",
+    redirect_uri = "http://localhost:8100"
+  )
+  expect_true(client@provider@allow_missing_token_type)
+  expect_identical(client@provider@allowed_token_types, "Bearer")
+  token_requests <- 0L
+  userinfo_requests <- 0L
+  authorization <- NULL
+  httr2::local_mocked_responses(function(req) {
+    if (identical(req$url, client@provider@token_url)) {
+      token_requests <<- token_requests + 1L
+      body <- if (token_requests == 1L) {
+        '{"access_token":"first-access","expires_in":1800,"username":"alice","ssl":true,"refresh_token":"refresh","refresh_token_expires_in":604799}'
+      } else {
+        '{"access_token":"refreshed-access","expires_in":1800,"username":"alice","ssl":true}'
+      }
+    } else {
+      userinfo_requests <<- userinfo_requests + 1L
+      authorization <<- httr2::req_dry_run(
+        req,
+        quiet = TRUE,
+        redact_headers = FALSE
+      )$headers[["authorization"]]
+      body <- '{"id":"organization-id","user":{"id":"alice-id","username":"alice"}}'
+    }
+    httr2::response(
+      url = req$url,
+      status_code = 200L,
+      headers = list("Content-Type" = "application/json"),
+      body = charToRaw(body)
+    )
+  })
+
+  browser <- paste(rep("ab", 64), collapse = "")
+  url <- shinyOAuth::prepare_call(client, browser_token = browser)
+  state <- httr2::url_parse(url)$query$state
+  token <- shinyOAuth::handle_callback(
+    client,
+    code = "test-code",
+    state = state,
+    browser_token = browser
+  )
+  expect_identical(token@access_token, "first-access")
+  expect_identical(token@token_type, "Bearer")
+  expect_identical(
+    client@provider@userinfo_id_selector(token@userinfo),
+    "alice-id"
+  )
+  expect_identical(authorization, "Bearer first-access")
+
+  refreshed <- shinyOAuth::refresh_token(client, token)
+  expect_identical(refreshed@access_token, "refreshed-access")
+  expect_identical(refreshed@token_type, "Bearer")
+  expect_identical(refreshed@refresh_token, "refresh")
+  expect_identical(refreshed@userinfo, token@userinfo)
+  expect_identical(authorization, "Bearer refreshed-access")
+  expect_identical(token_requests, 2L)
+  expect_identical(userinfo_requests, 2L)
+})