[Bug]: Conflict in multi-user systems with `ui.include_*`

[blairj09]

Component

UI (ui.*)

Severity

P1 - High (major feature broken)

Shiny Version

1.4.0

Python Version

3.13.3

Minimal Reproducible Example

# www/styles.css
body {
  background-color: #f0f8ff;
  font-family: Arial, sans-serif;
}

h1 {
  color: #4682b4;
  border-bottom: 2px solid #4682b4;
  padding-bottom: 10px;
}

.content {
  margin: 20px;
  padding: 15px;
  background-color: white;
  border-radius: 5px;
  box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
}

# app.py
from shiny import App, ui

# Define the UI
app_ui = ui.page_fluid(
    ui.include_css("www/style.css"),  # Reference the external CSS file
    ui.h1("Simple Shiny App with External CSS"),
    ui.div(
        ui.p("This is a simple Shiny app that demonstrates ui.include_css()"),
        ui.p("The styling comes from an external CSS file!"),
        class_="content"
    )
)

# Define the server
def server(input, output, session):
    pass

# Create and run the app
app = App(app_ui, server)

Behavior

When an app calls ui.include_*(), Shiny uses /tmp/shiny_include_files as the base directory for tmp directories storing the included files. If this is invoked by multiple users in a multi-user environment (like Posit Workbench), then it will throw an error for all but the first user due to a permissions issue on /tmp/shiny_include_files:

PermissionError: [Errno 13] Permission denied: '/tmp/shiny_include_files/58c5804dd53be4c706c1c6324aaca60d8b61a520'

This issue impacts packages like querychat that use these ui.include_* functions.

Error Messages (if any)

PermissionError: [Errno 13] Permission denied: '/tmp/shiny_include_files/58c5804dd53be4c706c1c6324aaca60d8b61a520'

Environment

macOS: 15.6 (24G84)
Chrome: Version 139.0.7258.67 (Official Build) (arm64)
Posit Workbench: 2025.08.0+362.pro6, “Cucumberleaf Sunflower” (0d4bde85)

Positron:
Positron Version: 2025.08.1 build 8
Code - OSS Version: 1.102.0
Commit: ed4eabf7f688911cfec20004577a09273896d3cb
Date: 2025-08-15T12:10:40.707Z
Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36

[schloerke]

Thinking is down to:

• chmod all the files to be more friendly
  • Security risk? It may be a tolerable risk
• make each temp directory name include the session id
  • Creates much more clutter

[wch]

I think that it's unsafe to allow users to share these temp files. For example, it would be bad if one user on a Connect server could modify the files that are served by another user's apps. Or suppose one user didn't have permission to view another user's applications, but they could see the files that are being served through this temp dir mechanism.

How about giving each user their own subdir in the temp directory?

[schloerke]

As long as they are cleaned up on removal, I'd be fine with a path that uses the session id.

We could try to reduce it to a the Linux user's group or Linux user name, but I worry about file conflicts unless we chmod as well.

[elnelson575]

Sorry, didn't mean to un-assign you @schloerke 😅