We're requesting too many privileges. We shouldn't need "commit" access. <p dir="a

I vaguely remember having seen a similar issues earlier... <a class="issue-link js-iss

It seems that we are requesting too many scopes here: <div class="Box Box--con

Too many privileges about stryker-dashboard HOT 4 CLOSED

stryker-mutator commented on June 2, 2024

Too many privileges

from stryker-dashboard.

Comments (4)

mthmulders commented on June 2, 2024

I vaguely remember having seen a similar issues earlier... #95 and #96 also reported too broad permissions. Maybe we should start with again, with an empty list and just adding permissions as they are really needed, instead of going for the convenient approach?

from stryker-dashboard.

ptoonen commented on June 2, 2024

Browsing the code I see that it specifically checks for 'push' access - isn't this a way to verify that someone creating the dashboard account/report actually has ownership of the repo/org they're trying to create the report for?

[edit] As @mthmulders says, #96 actually describes this.

from stryker-dashboard.

nicojs commented on June 2, 2024

It seems that we are requesting too many scopes here:

stryker-dashboard/packages/website-backend/src/api/auth/GithubAuth.ts

Lines 19 to 20 in 87fe0b1

    
             passport.authenticate('github', { scope: ['user:email', 'read:org', 'repo:status'] })(request, response, next); 
        
           }