Github OAuth permissions too demanding

[joshsouza]

Description

When enabling the Github OAuth integration, Portus requests:

• Read org and team membership (Sensible)
• Update all user data (Overly permissive)

Can we either get documentation on why Portus needs to have access to write user data (this can include things like SSH keys, which is a potential security problem), or can it be adjusted to be read-only, and only use the minimum necessary for authentication?

Steps to reproduce

1. Enable GitHub OAuth integration
2. Log in using GitHub integration for the first time
3. Observe the requested permissions

• Expected behavior: I expect only read access to org/team/user data
• Actual behavior: Write access to user data requested

Portus version: 2.3.1@a4ca664b9c30c7a464296297d1868ba301d791cf

[Vad1mo]

This is currently requested:

{ scope: "user,read:org" }

Looking at the docs
read:org | Read-only access to organization, teams, and membership. This is mandatory for providing access to only certain members in a groupd.

Regarding the user scope, we might get away with read:user or/and user:email if one or both are needed.

[joshsouza]

It'd be great if we could update it to just read:user and user:email. Definitely would appease our security reviewers.

[mssola]

@joshsouza fixed with #1800 and cherry-picked into the v2.3 branch (we will roll out these changes into the Docker image shortly). Thanks about noticing these kinds of things 👍

[joshsouza]

Thanks for the quick response!