dwyl / dwyl/github-backup

Set up user authentication with OAuth

Abierto
#7 2 comentarios 1 reacción 2 asignados Reclamado por @parkhabit Ver en GitHub
priority-4
Lenguaje dominante
Elixir
Estrellas
33
Forks
3
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

This issue began as a discussion of the download/authorisation/authentication model of the application. Set up as a github app has been done and so now the next point to be addressed in this issue will be **the authentication of users trying to access their github history/backup using OAuth.**

**As a** gh-backup user
**I want to** be able to authenticate myself to access my github history
**so that** I know that unauthorised users will not have access to my private history.

- [ ] User is redirected to github authentication when trying to access a github-backup page
- [ ] User is redirected to the gh-backup page once they're authentication is successful

---------------------------
**Notes:**

### OAuth Authentication

Once a user (where github-backup has been installed) wants to click on the button to see the history of a given comment they will be taken to the github-backup site and then they will have to authenticate with OAuth to prove that they are from the org. This step technically would not need to be performed in the case of public repos but given that it's essential for private repos, you only have to do it once and that in the future we may introduce writing access it seems like a good idea.

> OAuth2 lets external applications request authorization to private details in a user's GitHub account

— Providing that its a Github App that has been installed by the org owner, will the github API provide a user access to all issues/comments regardless of if they're an author/ mentioned in them?

### Github Apps

To see the github-back up button on each of your comments (which would link you to the github-backup site) we would use github apps.

> To install a GitHub App, you must be an organization owner.

In the case of `github-backup` I envisage this being the case (so that in the long run the organisation can decide whether they wish to accept any costs associated with using the app as opposed to the individual). The other advantage of this is that: 'a GitHub App remains installed if the person who set it up leaves the organization', so this would be continuous as well.

GitHub Apps can request separate access to issues and pull requests without accessing the actual contents of the repository.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.