[Auth Flow] Restricted app tokens while logging in
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Allow applications to only request an restricted app token (without file-access) for applications like Talk or Groupware-integrations which do not need file-access.
We may want to consider to give the user the permission to edit this permissions already while logging in, but I think this makes less sense, because using Nextcloud Files-app without Files-access e.g. does not work at all (for good reasons 😅).
With this introduced, we should emphasize in the login flow, that all apps, which login without restrictions can view/edit/remove all your files in a way without making the user fear to much.
Facebook (example):
As discussed with @rullzer
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the login flow and application-token handling; the issue names no files or tests, so trace those entry points first. Done means applications can request tokens without file access and the login flow clearly communicates the permissions granted to unrestricted applications.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100