Support for additional claims in the JWT tokens, needed for Google's Identity-Aware Proxy

R/oauth-server-side.R

@@ -1,10 +1,11 @@
 
-init_oauth_service_account <- function(secrets, scope = NULL, sub = NULL) {
+init_oauth_service_account <- function(secrets, scope = NULL, sub = NULL, ...) {
   signature <- jwt_signature(
     secrets,
     aud = secrets$token_uri,
     scope = scope,
-    sub = sub
+    sub = sub,
+    ...
   )
 
   res <- POST(
@@ -40,6 +41,7 @@ init_oauth_service_account <- function(secrets, scope = NULL, sub = NULL) {
 #'   00:00:00 UTC, January 1, 1970. This value has a maximum of 1 hour from
 #'   the issued time.
 #' @param duration Duration of token, in seconds.
+#' @param ... any additional claims for the token.
 #' @keywords internal
 #' @examples
 #' \dontrun{
@@ -52,14 +54,16 @@ jwt_signature <- function(credentials,
                           sub = NULL,
                           iat = as.integer(Sys.time()),
                           exp = iat + duration,
-                          duration = 60L * 60L) {
+                          duration = 60L * 60L,
+                          ...) {
   cs <- compact(list(
     iss = credentials$client_email,
     scope = scope,
     aud = aud,
     sub = sub,
     iat = iat,
-    exp = exp
+    exp = exp,
+    ...
   ))
 
   jwt_sign(cs, credentials$private_key)

R/oauth-token.r

@@ -301,6 +301,7 @@ Token2.0 <- R6::R6Class("Token2.0", inherit = Token, list(
 #' @inheritParams oauth2.0_token
 #' @inheritParams jwt_signature
 #' @param secrets Secrets loaded from JSON file, downloaded from console.
+#' @param ... any additional claims for the token
 #' @family OAuth
 #' @export
 #' @examples
@@ -311,7 +312,7 @@ Token2.0 <- R6::R6Class("Token2.0", inherit = Token, list(
 #'
 #' token <- oauth_service_token(endpoint, secrets, scope)
 #' }
-oauth_service_token <- function(endpoint, secrets, scope = NULL, sub = NULL) {
+oauth_service_token <- function(endpoint, secrets, scope = NULL, sub = NULL, ...) {
   if (!is.oauth_endpoint(endpoint)) {
     stop("`endpoint` must be an OAuth endpoint", call. = FALSE)
   }
@@ -324,7 +325,7 @@ oauth_service_token <- function(endpoint, secrets, scope = NULL, sub = NULL) {
   TokenServiceAccount$new(
     endpoint = endpoint,
     secrets = secrets,
-    params = list(scope = scope, sub = sub)
+    params = list(scope = scope, sub = sub, ...)
   )
 }
 
@@ -343,16 +344,12 @@ TokenServiceAccount <- R6::R6Class("TokenServiceAccount", inherit = Token2.0, li
     TRUE
   },
   refresh = function() {
-    self$credentials <- init_oauth_service_account(
-      self$secrets,
-      scope = self$params$scope,
-      sub = self$params$sub
-    )
+    self$credentials <- do.call(init_oauth_service_account, c(list(secrets = self$secrets), self$params))
     self
   },
   sign = function(method, url) {
     config <- add_headers(
-      Authorization = paste("Bearer", self$credentials$access_token)
+      Authorization = paste("Bearer", self$credentials$access_token %||% self$credentials$id_token)
     )
     request_build(method = method, url = url, config)
   },