You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am testing github integration for several Autolab courses. Autolab is latest -- v2.12.0.
Docs claim a minimal set of permissions:
Git Submission works by having students performing OAuth with your Github
application in order to be granted access to access their private repositories.
Only the minimum set of permissions to achieve this is requested.
But when I attempt to connect my git account with Oauth I am presented with an authorization request which looks like:
Repositories
Public and private
This application will be able to read and write all public and private repository data. This
includes the following:
Code
Issues
Pull requests
Wikis
Settings
Webhooks and services
Deploy keys
Collaboration invites
Note: In addition to repository related resources, the repo scope also grants access to
manage organization attributes and organization-owned resources including projects,
invitations, team memberships and webhooks. This scope also grants the ability to
manage projects owned by users.
Is this the intended "minimum set of permissions" to pull the tgz -- Read/Write/Manage looks like administrator scope at my organization level, *.*
I tested with a newly created non associated GitHub account just in case there was weirdness with the Oauth app and requesting user being in the same organization. Same result.
What permissions should this be requesting? Is there some flag or configuration I need to change to achieve a minimal permission request? Is there something I need to change about the GitHub app itself?
The text was updated successfully, but these errors were encountered:
brandonfranzke
changed the title
Oauth permissions for github integration are excessive
Oauth scope (permissions) during github integration are excessive
Jan 23, 2024
It looks like its just a 1-for-1 replacement with the existing OAtuth token. So even just a user field to "update" token might work, but it would be even better -- given the security implications -- to simply prompt -- "Personal Access Token" or "Oauth" (understand its not so simple in implementation, especially user facing.
Thanks for the feature request! This is definitely a possibility we could look into—we'd need to integrate Github Apps to allow for more fine grained access so that would require some work on that end.
I am testing github integration for several Autolab courses. Autolab is latest -- v2.12.0.
Docs claim a minimal set of permissions:
https://docs.autolabproject.com/features/git-submission/
But when I attempt to connect my git account with Oauth I am presented with an authorization request which looks like:
Is this the intended "minimum set of permissions" to pull the tgz -- Read/Write/Manage looks like administrator scope at my organization level, *.*
I tested with a newly created non associated GitHub account just in case there was weirdness with the Oauth app and requesting user being in the same organization. Same result.
What permissions should this be requesting? Is there some flag or configuration I need to change to achieve a minimal permission request? Is there something I need to change about the GitHub app itself?
The text was updated successfully, but these errors were encountered: