Read *and* write access required?

[mikebroberts]

Hi Erik. I just installed CCMenu2 for the first time, and got to the GitHub permissions part. I noticed that under Repositories the request says "The application will be able to read and write all public and private repository data". The "and write" part worries me, especially since my GitHub user has elevated privileges for client organizations (which I can't remove from this screen). Is this an access level you can reduce? I'm only familiar with GitHub App permissions, not Github OAuth App permissions.

[mikebroberts]

Answering my own question .. I don't think you can reduce the access level due to the scope model of Github OAuth Apps. At https://github.com/ccmenu/ccmenu2/blob/main/CCMenu/Source/Server%20Monitor/GitHubAPI.swift#L60 you specify "scope": "repo", which I think is indeed the minimum necessary to read the necessary objects. But the problem is that, from https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps, "repo" grants a lot. But I don't see an alternative scope - maybe I missed something?

I think the issue is the Github OAuth Apps are, basically, "I'm going to act as the user who installed me", and so GitHub don't provide super fine-grained permissions.

I'm going to try with a different Github User that doesn't have access to my clients' organizations

[erikdoe]

Just to confirm: that's my understanding, too. The alternative is to use a GitHub App, but that comes with different limitations. I wrote about that here: #4 (comment)