Add support for viewer-based credentials on Posit Connect

[atheriel]

This commit brings support for Posit Connect's "viewer-based credentials" feature to gh.

Similar to the recent work in odbc, the way this is exposed to R users is to require them to pass a Shiny session argument to gh_token(), either directly or via gh() or gh_gql().

Checks for viewer-based credentials are designed to fall back gracefully to existing authentication methods. This is intended to allow users to -- for example -- develop and test a Shiny app that uses GitHub credentials in desktop Positron/RStudio or Posit Workbench and deploy it with no code changes to Connect.

Most of the actual work is outsourced to a new shared package, connectcreds.

Unit tests are included.

[atheriel]

This is an edited version of the example from Connect's cookbook that shows how this works in practice:

library(shiny)
library(bslib)
library(gh)
library(connectcreds)

ui <- page_sidebar(
  title = "GitHub Credentials Demo",
  sidebar = sidebar(
    p(strong("User:"), textOutput("login", inline = TRUE)),
    textInput(
      "gh_repo",
      strong("Repository"),
      value = "octocat/Hello-World"
    )
  ),
  layout_column_wrap(
    card(card_header("assigned"), verbatimTextOutput("assigned")),
    card(card_header("issues"), verbatimTextOutput("issues")),
    card(card_header("prs"), verbatimTextOutput("prs"))
  )
)

server <- function(input, output, session) {
  output$login <- renderText({
    user <- gh_whoami()
    user$login
  })

  output$assigned <- renderText ({
    assigned <- gh("GET /issues")
    paste(assigned)
  })

  output$issues <- renderText({
    req(input$gh_repo)
    my_issues <- gh("GET /repos/{gh_repo}/issues", gh_repo = input$gh_repo)
    paste(my_issues)
  })

  output$prs <- renderText({
    req(input$gh_repo)
    my_pulls <- gh("GET /repos/{gh_repo}/pulls", gh_repo = input$gh_repo)
    paste(my_pulls)
  })
}

shinyApp(ui, server)

[atheriel]

Took a second go at this per @jennybc's advice; it now makes far less invasive changes to gh.

[nealrichardson]

This is really the Shiny session, when running on Connect, right?

Might be relevant to make that distinction because with the client credentials flow, IIUC it will be possible to use oauth tokens from Connect in non-Shiny contexts (R markdown or otherwise).

[atheriel]

Yes, although GitHub doesn't support the client credentials flow, so this isn't directly relevant to the gh package.

(I'm planning to add a dedicated API to connectcreds for service accounts, but it won't consume a Shiny session.)

[hadley]

The approach of auto-detecting the session seems reasonable to me.

[atheriel]

Updated to use the latest version of connectcreds, which has a much simpler API, and is available on CRAN as of this morning.

Because the API of that package has been dramatically simplified, the changes to gh are far less invasive than in previous patches. The unit test story is also much better, because connectcreds includes comprehensive mocking features.

[gaborcsardi]

Thanks!