Github Write Permissions?

[defensivedepth]

Hello there!

I am attempting to submit a new license for inclusion to the license list, using the web form at http://13.57.134.254/app/submit_new_license/

It appears that I am required to give the SPDX Online Tools app write access to all of my public repos? Can you clarify why this permission would be needed for me to submit a web form?

Thanks!

[goneall]

@defensivedepth The online tools requires access in order to create an issue in the license-list-XML repository.

I don't know if write access is required or if there is a lesser permission would allow for an issue to be created.

If we can create issues without write access, I would be all for changing the permission request.

[goneall]

@defensivedepth @rtgdk Any ideas if it is possible to create an issue without write access? If not, let's close the issue since the legal team requires the issue to be submitted with the user's github username.

[rtgdk]

@goneall We definitely don't need "Deploy keys", "Webhooks and Services", "Wikis" and "Code" permissions to create an Issue in the license-list repo. Can you update the github app permission and try to create a dummy issue?

[defensivedepth]

Unfortunately I still don't see how I could give this app read/write access to the settings/issues/pull requests for all of my public repos - If you only need the email address, I would think you could just select that permission?

[goneall]

@rtgdk @defensivedepth I will experiment with the permissions. Since we are creating an issue on behalf of the user, I believe we will need more than email permission, but I'll do some experiments and find out if there is a reduced set that will work.

[goneall]

@rtgdk I did not find any settings for a finer grained access in the Github configuration. It looks like the scope of the request is set in the settings at

spdx-online-tools/src/src/settings.py

Line 158 in 0173b08

SOCIAL_AUTH_GITHUB_SCOPE = ['public_repo', 'user:email']

It is only asking for public repo and email.

Let me know if you know of a way to request finer grained permissions.

[rtgdk]

@goneall Yeah, I tried a bunch of combinations but "public_repo" access is needed for Github Oauth apps. If we move to Github Apps, they have finer-grained permissions but Oauth apps seem to have a limited no of fixed permission with no way to modify the read/write access: https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/#available-scopes
Opened an issue for moving to Github Apps #204 , but for the time being we would have to use this Oauth app perms only.

[defensivedepth]

Thanks all for looking into this. You may want to consider modifying this particular workflow - you probably don't want to take on the risk of having your app have R/W access to user's public repos, just so that they can submit a request for inclusion of a new license.

At this point, I will submit my request via email -

[goneall]

@rtgdk Thanks for the research on this.

@defensivedepth Agree with reducing the permissions. Rather than email, you could submit an issue directly to the SPDX License List XML repo rather than using the online tools app.

[defensivedepth]

@goneall Done, thanks!

spdx/license-list-XML#1075