For current melang users, authorize github

[westonplatter]

Farooq - I updated the requirements in this first message that came from Alex's and my conversation below.

For users already given account acces, create authorization process with GitHub.

GitHub acocunt authorization scope = user and repo. The scope is user and not no_scope since we need to get their email, which may not be public info. Scope includes repo because we want to create a melang repo on their behalf.

I think the best place for the user to see their authorizations, is in their account panel,
http://localhost:3000/users/edit

[wenzowski]

I would prefer to do the initial auth with no scope, and request additional scope authorization from the user as necessary the first time the user performs an action requiring a specific scope.

I expect this approach to help build user trust in the application.

[westonplatter]

I see value in that.

What about the comparative value for the user in,

1. keeping track of multiple email/passwords
2. authorizing GitHub account access

Thoughts?

[wenzowski]

Assumption: most regular github users log in once on their dev laptop and stay logged in, much like people do with facebook.

If we allow login (oauth) with github in addition to sign-up with github then this reduces the number of passwords necessary for the user.

Is the github api like the facebook api: can you request a specific set of scopes and have a successful auth where the user has authorized only a subset of the scopes requested?

[westonplatter]

Is the github api like the facebook api: can you request a specific set of scopes and have a successful auth where the user has authorized only a subset of the scopes requested?

Yes. http://developer.github.com/v3/oauth/#scopes

This allows our site to request a scoped authorization to their GitHub account. The user explicitly sees what access they are granting. For a functional example, http://issuetriage.herokuapp.com

[wenzowski]

In that case, this app needs to check bearer token scope before performing an action with it.

Handling the scope not found on token scenario will be necessary anyway, so we're not adding additional complexity by requesting fewer permissions up front.

[westonplatter]

@wenzowski So then you good with requesting github user profile authoirzation for the invite request?

[wenzowski]

The user explicitly sees what access they are granting.

That's exactly why I expect that requesting permission only when said permission is necessary would help build trust.

https://github.com/settings/applications

There doesn't appear to be a way for users to modify an app's authorized scopes from the UI, though the api doc previously linked does demonstrate it's possible.

[wenzowski]

@westonplatter I do definitely agree that we should allow github oauth as a means to request an invite. My only concern is requesting more permissions from the user than are necessary to send the invite at this time. Are you suggesting using user instead of (no scope)?

I'm not sure we should be requesting write access to user info, do you disagree?

[westonplatter]

There doesn't appear to be a way for users to modify an app's authorized scopes from the UI, though the api doc previously linked does demonstrate it's possible.

Actually, I think this will work by having 2 TOKENS,

• TOKEN_1 is used to request user account authorization
• TOKEN_2 is used to request melang site repository authoization

[westonplatter]

@wenzowski

Are you suggesting using user instead of (no scope)?

Yes, because we need their email info, which may not be public info.

[wenzowski]

we need their email info, which may not be public info

gotcha