Add Connect Cloud account retrieval API

[mslynch]

Intent

Resolves #2694.

The API is called as follows:

GET /api/connect-cloud/accounts
Cloud-Auth-Base-Url: https://api.staging.connect.posit.cloud
Authorization: Bearer {token}

//response body:
{
    "accounts": [
      {
        "id": "account1",
        "name": "Account 1",
        "permissionToPublish": true
      },
      {
        "id": "account2",
        "name": "Account 2",
        "permissionToPublish": true
      },
      {
        "id": "account3",
        "name": "Account 3",
        "permissionToPublish": false
      }
    ]
  }

Type of Change

• • Bug Fix
• • New Feature
• • Breaking Change
• • Documentation
• • Refactor
• • Tooling

Approach

The endpoint calls Connect Cloud's GET /users/me endpoint, which returns the accounts the user is a member of and what roles they have. The user's role on the account is used to determine whether they have permission to publish.

User Impact

None until we implement the add credential flow for Connect Cloud.

Automated Tests

Added tests for the new API handler and the new connect cloud API client.

Directions for Reviewers

To test this, we have to call the API manually with a vivid-api JWT. Eventually we'll use the access token from the lucid-auth token exchange, but we don't have all the pieces for that in place yet.

1. Log into Connect Cloud
2. Open dev tools and copy an Authorization header from an API call
3. Run just build && just run ui
4. Call the endpoint: curl -vv 'http://localhost:${your_port}/api/connect-cloud/accounts' -H 'Connect-Cloud-Base-Url: https://api.staging.connect.posit.cloud' -H 'Authorization: Bearer ${token_from_step_2}'

Checklist

• I have updated CHANGELOG.md to cover notable changes.

[dotNomad]

• Log into Connect Cloud
• Open dev tools and copy an Authorization header from an API call
• Run just build && just run ui
• Call the endpoint: curl -vv 'http://localhost:${your_port}/api/connect-cloud/accounts' -H 'Cloud-Auth-Base-Url: https://api.staging.connect.posit.cloud' -H 'Authorization: Bearer ${token_from_step_2}'

I tried this out and am getting a 500 from the curl and a 401 on the Publisher API side.

Preview

I'm using httpie but the concept is the same

❯ http :64555/api/connect-cloud/accounts Authorization:'STRIPPED' Connect-Cloud-Base-Url:https://api.staging.connect.posit.cloud -v
GET /api/connect-cloud/accounts HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Authorization: STRIPPED
Connect-Cloud-Base-Url: https://api.staging.connect.posit.cloud
Connection: keep-alive
Host: localhost:64555
User-Agent: HTTPie/3.2.4



HTTP/1.1 500 Internal Server Error
Content-Length: 41
Content-Type: text/plain
Date: Fri, 11 Jul 2025 20:28:59 GMT
Vary: Origin

unexpected response from the server (401)

and the just run ui output

❯ just run ui
http://127.0.0.1:64555/
time=2025-07-11T13:28:59.993-07:00 level=ERROR msg="unexpected response from the server (401)" method=GET url=/api/connect-cloud/accounts error="unexpected response from the server (401)

Is there anything else I need to setup to get this working? Anything on the Cloud side?

[mslynch]

Just tried this again with my curl and your httpie command and it worked. Which request did you copy the auth header from? I think something is probably off about that.

[rodriin]

Approve, changes look good, just had the one comment request. I will try this locally now to see if it works.

[rodriin]

I tried it and it is working for me, here's my output:

{
  "accounts": [
    {
      "name": "animal-kingdom",
      "id": "019552a2-977e-1135-0cd5-fa4a3e1f6de4",
      "permissionToPublish": true
    },
    {
      "name": "new-york",
      "id": "019610fb-7a7b-d888-eb9b-d8db8acac94c",
      "permissionToPublish": true
    },
    {
      "name": "rodriin",
      "id": "0192c08c-15e5-0852-130e-586b8e957ca0",
      "permissionToPublish": true
    },
    {
      "name": "magic-kingdom",
      "id": "019552a0-dfbf-8041-4d13-fca2b7060dae",
      "permissionToPublish": true
    },
    {
      "name": "epcot",
      "id": "019552a2-44fe-31de-1825-5885284e3039",
      "permissionToPublish": true
    },
    {
      "name": "hollywood-studios",
      "id": "019552a2-6ccf-0898-2962-2c71268bb8ad",
      "permissionToPublish": true
    }
  ]
}

[dotNomad]

Just tried this again with my curl and your httpie command and it worked. Which request did you copy the auth header from? I think something is probably off about that.

I just pulled this down again and tried it and am still getting the same thing I posted above.

I'm copying the Authorization request header from the /v1/users/me request that Connect Posit Cloud makes.

[dotNomad]

I was not pointed at staging - got this working with @rodriin after pointing that out 😄