functions that write to the filesystem

[ijlyttle]

These need to be looked at with suspicion and scrutiny:

• box_auth_on_attach() writes to the .Renviron file (and is perhaps more trouble than it's worth)
• box_auth() writes a file to the working directory (necessarily so)

[nathancday]

I personally use box_auth_on_attach() in my day-to-day because I am constantly refreshing my Rsession and re-running a script from scratch. That said I don't think this is necessarily needed, my co-workers just use box_auth(). I don't see the harm in removing box_auth_on_attach if we still keep the Renviron special variable and demonstrate how to replicated the behavior by editing the .Renviron directly, similar to install_github() pulling the PAT from .Renviron for private repos.

box_auth() seems like it has to stay as is or am I missing something?

[ijlyttle]

Absolutely, box_auth() has to stay!

I guess I am a bit nervous about box_auth_on_attach(), given the notes that @brendan-r made about reproducibility and the newer CRAN rules about writing to the file system (I suspect particularly so for dot files). Whenever we do this, I think we need to be especially clear to the user about what the function will do.

[nathancday]

I defer to your CRAN knowledge and think it would be okay to remove box_auth_on_attach as an exported function and replace it with a vignette of how to edit .Renviron for similar behavior

[ijlyttle]

I think it might be a matter doing something like usethis does: copy the lines to your clipboard, then open the .Renviron file for editing.

[brendan-r]

Oof, box_auth_on_attach was always a nasty hack that encouraged 'bad' behavior. I felt unsure when writing it, and sort of wanted to kill it off myself.

If this is causing problems for CRAN submission, I wouldn't feel too bad getting rid of it. AFAICT this shouldn't cause problems for users; the function was more to set preferences (a 'one off') rather than to be invoked as part of a script.

If there's concern that people were using it in-place of box_auth() in analysis scripts, we could just make it call box_auth,with a warning message that use of box_auth_on_attach is no longer recommended, and will be removed in the next release.

[ijlyttle]

Perhaps box_auth_on_attach() could invoke warning if it is not used interactively. I suspect that there are some safe ways to implement and keep box_auth_on_attach(), I think we just need to be deliberate about it.