Use one rfigshare app

[hadley]

Each user shouldn't need there own - it's safe to distribute app key and secret in the package.

[karthik]

Except that keys are tied to individual accounts. We can't all upload data into a single account. Each researcher needs their own to maintain research collections, track metrics etc.

[hadley]

Each user needs their own account, but not their own app. i.e. FigshareKey and FiguresharePrivateKey can be shared across all users, FigureshareToken and FigsharePrivateToken are user specific.

[karthik]

Ah, right. Good point. I forgot that Figshare does this (most other data providers don't distinguish from application specific keys to user keys).

I like this plan and I think we can implement it. It would be great too, because we can ask the figshare folks for data on usage based on the app key.

[cboettig]

@hadley Yes, this makes sense, and would streamline users getting up and running. We would then just use a call to oauth1.0_token with key and privateKey already built in, and the user could authenticate once in the browser and then benefit from caching thereafter.

Unfortunately, my first stab at this didn't work. After authenticating successfully in the browser, R just gives me the error I described earlier:
#70 (comment)

Not sure where I've gone wrong.

[hadley]

@cboettig Which error? The 405? Or the cache related?

[cboettig]

@hadley the 405 error. Sorry I should have copy-pasted.

  request <- "request_token"
  authorize <- "authorize" 
  access <- "access_token"
  base_url <- "http://api.figshare.com/v1/pbl/oauth"
  endpoint <- oauth_endpoint(request, authorize, access, base_url=base_url)
  # endpoint <- oauth_endpoint(NULL, authorize, access, base_url=base_url) # tried this too since docs say oauth 1 doesn't need a request token? a bit confused, no dice.  

  myapp <- oauth_app("rfigshare", key = cKey, secret=cSecret)
  token <- oauth1.0_token(endpoint, myapp)

This takes me to the figshare website where I sign in and click "allow" as expected, then R gives me the error:

 token <- oauth1.0_token(endpoint, myapp)
Waiting for authentication in browser...
Press Esc/Ctrl + C to abort
Authentication complete.
Error in init_oauth1.0(endpoint, app, permission = params$permission) : 
  client error: (405) Method Not Allowed

[hadley]

You're sure you're running the latest httr?

[cboettig]

@hadley apparently I'm not, whoops! Works like a charm. If only I was better at managing my versions...

Time to update rfigshare....

[cboettig]

@hadley A few quick questions

1. where would you recommend storing the app key and secret key? Directly as the default arguments to the function call? Hardwired in the function definition? Or stored in some other file somewhere and read in?

2. I must admit I cannot seem to figure out the caching commands for httr correctly. The OAuth1.0 demos don't seem to show caching and just pass the the token directly. I can continue to do what we were doing at the start to cache the token in a new environment,

token <- oauth1.0_token(endpoint, myapp)
assign('token', token, envir=FigshareAuthCache)

but that seems like I'm just sidestepping the httr mechanism. Alternately, it looks like you've defined methods for Token1.0 object, but I try:

> cache(token)
Error: could not find function "cache"

and get that error. How should I be caching?

(I did check token is otherwise working as expected in GET, PUT, and POST calls).

> token
<Token>
<oauth_endpoint>
 request:   http://api.figshare.com/v1/pbl/oauth/request_token
 authorize: http://api.figshare.com/v1/pbl/oauth/authorize
 access:    http://api.figshare.com/v1/pbl/oauth/access_token
<ouath_app> rfigshare
  key:    Kazwg91wCdBB9ggypFVVJg
  secret: <hidden>
<credentials> oauth_token, oauth_token_secret, xoauth_figshare_id

[hadley]

1. I'd hardwire into the function definition

2. You shouldn't need to do anything to cache the token, it will just happen automatically.

[cboettig]

@hadley

1. Cool, will do.

2. Um, your magic goes straight over my head. If I literally ignore doing something with the token, I get an error (after interactively agreeing to have my token cached):

oauth <- oauth1.0_token(endpoint, myapp)
GET("http://api.figshare.com/v1/my_data/articles")

gives me the error

Response [http://api.figshare.com/v1/my_data/articles]
  Status: 401
  Content-type: application/json; charset=UTF-8
{"error": "No Authorization header present!. Make sure you add oauth parameters in header"} 

How was I supposed to tell GET to load the token from the cache?

[hadley]

You still need to do GET("http://api.figshare.com/v1/my_data/articles", oauth).

But you should still save the token in an environment - httr's caching is mostly aimed at caching across sessions. In other words, people won't need to record their api key and secret key any more, because httr will do that for them.

Combined with including the app key & secret that should mean that you don't need to do any setup to use rfigshare.

[cboettig]

Ah, very good, that all makes perfect sense. was slowly coming to this
realization...

On Tue, Mar 18, 2014 at 1:52 PM, Hadley Wickham notifications@github.comwrote:

You still need to do GET("http://api.figshare.com/v1/my_data/articles",
oauth).

But you should still save the token in an environment - httr's caching is
mostly aimed at caching across sessions. In other words, people won't need
to record their api key and secret key any more, because httr will do that
for them.

Combined with including the app key & secret that should mean that you
don't need to do any setup to use rfigshare.

Reply to this email directly or view it on GitHubhttps://github.com//issues/72#issuecomment-37986304
.

Carl Boettiger
UC Santa Cruz
http://carlboettiger.info/

[cboettig]

@hadley One more strange thing here: everything works fine if I load httr explicitly, but I get an error otherwise (though httr is in IMPORTS).

Working from the current devel branch:

> require(rfigshare)
Loading required package: rfigshare
fs)> fs_auth()
Error: cache should be length 1 vector

Enter a frame number, or 0 to exit   

1: fs_auth()
2: oauth1.0_token(endpoint, myapp)
3: new_token(Token1.0, endpoint, app, params, cache = cache)
4: use_cache(cache)

errors, while:

> library(httr)
> fs_auth()
Use a local file to cache OAuth access credentials between R sessions?
1: Yes
2: No

Selection: 1
Adding .httr-oauth to .gitignore
Loading required package: httpuv
Loading required package: Rcpp
Waiting for authentication in browser...
Press Esc/Ctrl + C to abort
Authentication complete.
Authentication successful
> 

works fine.

[hadley]

Can you please try again now? I just pushed a probable fix.

http://had.co.nz/

[cboettig]

Yup, that worked! thanks!

[jcolomb]

hi guys,

will it still possible to use keys hardwired in a R code?
I am asking because my plan is to make a specific figshare user to upload data coming from my software (whoever is using it), the author of the data will then be accessible in the metadata uploaded itself, while users won’t have to register to figshare to use it.

Thanks for all your work, rfigshare is great!

On 18 mars 2014, at 22:21, Carl Boettiger notifications@github.com wrote:

Yup, that worked! thanks!

—
Reply to this email directly or view it on GitHub.

[cboettig]

@jcolomb rfigshare will still upload to whatever user account you want using the same commands it always has used. The first time you'll be asked to login to figshare, just like you have to do the first time you currently use rfigshare in order to look up your tokens. The only difference is that now instead of having to look up your tokens manually and paste them in manually, it just happens automatically with the click of a button. That will be the only change. Everything else is the same.

As far as whether you share the login credentials or the token credentials of some shared figshare account, that's all up to you. Giving a bunch of users a copy of the tokens for an account isn't functionally different then giving them the account name and password, and I suspect the latter is more intuitive for everyone.

[cboettig]

@jcolomb Would you mind test-driving rfigshare before we release this update to CRAN? The current version (0.2.9) is now on the master branch, so you should be able to grab it with

 library(devtools)
install_github("rfigshare", "ropensci")

Let me know if you have any issues.