Better Github Authorization system

[pragmaticivan]

Currently the app requires this:
This application will be able to read and write all public and private repository data. This includes the following:

I want to be able to choose which repos I want to allow this app to pick data from.

Why should this app have permission to write data in my private repo?

Why should this app have permission to handle all those things? instead just read them ?

Code
Issues
Pull requests
Wikis
Settings
Webhooks and services
Deploy keys

[rimenes]

Agree on that. Also "read and write all public and private repository data" is a no no.

[zenorocha]

I agree too! In fact, I had the same initial shock as you all had, that's why I wrote this https://devspace.io/privacy.

In order to show events from private repositories, the app needs to request write access to your public and private repositories. It doesn't make any sense, but that's how GitHub's permission system is, even though the app is 100% readonly :/

[pragmaticivan]

There's no option like that? :

• I just want the app to use my public repo.
• If I want to try private, I can give any permission the app needs.

For me looks like a better approach.

[zenorocha]

Yep, that's definitely the best approach.

[zenorocha]

As a reference, here are the permission scopes we use: user and repo.

https://developer.github.com/v3/oauth/#scopes

[pragmaticivan]

Cool, I would like to see this feature soon, even if you have a private policy explaining everything, we still don't know how the database, security, access layers of this app infrastructure are now.

For me not having this for this beta version is a little bit dangerous.

Not familiar with this technique but maybe someone can get in the server, get the token, and simulate requests inside your app. And with those rights would be pretty easy to download the latest release of a private repo.
(Just speculation haha not familiar with this kind of penetration test)

[zenorocha]

There's no such thing. oAuth tokens are generated in the client-side and they're not stored in the server.

[maracaipe]

+1 @pragmaticivan.
I don't mind this much with my public repos, but my private. When you offer a way to the app don't need the read/write access to it I would love to beta test this app.

[zenorocha]

I talked to GitHub's support but they have no plans to fix this. Working on an open letter now.

[pragmaticivan]

@zenorocha you have a simple option for that, two kind of auth. I experienced some apps using a choose button, where you make 2 types of requests, one for just public and one for private. A good example is Waffle.io:

The permission request are different. You can start with that, would be a really awesome feature.

[zenorocha]

That's super awesome! Thanks @pragmaticivan

[shawn42]

+1 for public only version. Until then I cannot beta test what looks to be a very useful app.

[zenorocha]

Totally understand. That's why betas are for, thanks a lot for your feedback guys ;D

[jfunez]

Hi @zenorocha this public+private access issue is the only point I've found that don't let me use the app :(
Hope you can fix it soon to test the app.

[jolaurin]

+1 for this. I can't wait to test the app. :-)