Minimize Github API access

[Hofer-Julian]

When trying to connect fasterthanli.me with my Github, I saw that it would give you read access to organization data.
I might be naive there, but I've hoped that you can verify me without this kind of data.
I assume many companies will not be fond of their private project boards leaking that way.

[fasterthanlime]

The "private project boards" thing (and wording) is news to me.

I /think/ the reasoning is that I needed to be able to query if an organisation you're a part of is sponsoring me to grant you the early access bonus?

I can probably make this opt-in though (at the very least) so it only asks for it, if it finds you don't support me directly. (Or maybe organisations supporting me shouldn't give access to all their members anyway..)

I'll definitely take a look at this (no ETA guarantees, but I agree this looks fishy)

[fasterthanlime]

I've deployed a version of the codebase that only asks for user:read. I think org:read was a mistake and never needed.

I've also deleted all records from the github_credentials table:

app=# delete from github_credentials;
DELETE 835
app=#

...which means I don't have "too-powerful" credentials in my DB anymore and can't accidentally use them.

⚠️ However, if me, or someone with my OAuth credentials, were malicious, they still could obtain tokens with org:read permissions, because GitHub remembers consent was given.

To reset this:

• Go to https://github.com/settings/applications
• Scroll to fasterthanli.me
• Hit the three-dots menu
• Click Revoke
• Click I understand, revoke access

(This doesn't delete your user settings on fasterthanli.me.)

After that, Log out and Log into fasterthanli.me again. Hopefully everything still works!

---

New flow:

/profile shows your access level:

---

Thanks for catching this!

[fasterthanlime]

Okay, so the mystery is now fully solved: the scope was useful, but only for me!

I run a different set of GraphQL queries to generate the list at https://fasterthanli.me/patron-list - and those require the read:org scope.

I simply added code that asks me (and only me) to re-log in with broader scopes when I log in with GitHub.