Repository navigation
Add ability to mint Personal Acess Tokens from CLI #1245
Description
Activity
- changed the title
[-]Publish the cli utils[/-][+]Add ability to mint Personal Acess Tokens from CLI[/+]on Jun 18, 2020 @Zylvian Thanks for the suggestion! Right now this is not supported by our API, but we will keep this open in case something changes on the platform side. #297 (comment)
Thanks for the response! What an incredible timing to release it haha, just a month short haha
Well until then, do you have any suggestions how to replicate it? I've scoured the internet for a Github interactive OAuth flow but there is actually none. From what I gathered from your code, I have to open a local socket, open the authorize page in the browser, then listen for the resulting token?
Also, do you guys save the token env variable GITHUB_TOKEN locally in the virtual environment?Well until then, do you have any suggestions how to replicate it?
Sure! Register your own OAuth app on github with a
http://127.0.0.1/callbackcallback URL and then you could use ourauth/oauth.goimplemenation:import "github.com/cli/cli/auth" flow := &auth.OAuthFlow{ Hostname: "github.com", ClientID: oauthClientID, ClientSecret: oauthClientSecret, Scopes: []string{"repo"}, WriteSuccessHTML: func(w io.Writer) { fmt.Fprintln(w, "yay, you did it!") }, VerboseStream: os.Stderr, } token, err := flow.ObtainAccessToken()
We are planning to extract this to a package so it's easier to use.
Thanks for the response!
So I'm creating my app in Python, any idea how to either implement your method or recreate it?So I'm creating my app in Python, any idea how to either implement your method or recreate it?
Whoops, now we went from “could GitHub CLI expose so and so feature” to “help me write my Python app” 😆
For obvious reasons, I can't really advise you on how to implement the OAuth flow in Python. I would suggest using libraries that already do that.
I will close this now because we have other tickets already open for improving our authorization flow.
Yeah, apologies for that question, it was more of what strategies to apply when saving the tokens etc., but I was able to deduce that from your code and finished the OAuth process.
One particular problem I have though, is that I have the same scopes as CLI ("gist repo org:read"), yet I require manual authorization confirmation to access the internal org repo I'm trying to access, whereas CLI doesn't seem to need this whatsoever. Using the access token from your OAuth flow grants me the access I need, yet my access token with exactly the same scopes needs manual approval to work. Any idea why this might be?
CLI OAuth app:
https://i.imgur.com/xvsTI6t.pngMy OAuth app:
https://i.imgur.com/SGk3fP1.pngyet I require manual authorization confirmation to access the internal org repo I'm trying to access, whereas CLI doesn't seem to need this whatsoever.
Yes: the reason is that because our OAuth app is "1st-party" (meaning: owned by GitHub), GitHub treats is as pre-approved. All other OAuth apps need to be approved per-org by admins of those orgs.
- Interesting! I was thinking that but didn't find any info on it so I thought I'd ask. Thanks for the reply as always! :D…On Thu, 25 Jun 2020, 15:46 Mislav Marohnić, ***@***.***> wrote: yet I require manual authorization confirmation to access the internal org repo I'm trying to access, whereas CLI doesn't seem to need this whatsoever. Yes: the reason is that because our OAuth app is "1st-party" (meaning: owned by GitHub), GitHub treats is as pre-approved. All other OAuth apps need to be approved per-org by admins of those orgs. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1245 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AH63OXKLTCYGR6C4HR2FN7DRYNILBANCNFSM4OBS4VYA> .
In config_setup, you state that it's safe to embed both the client_id and client_secret in version control. Why is that?
@Zylvian The code for any client app (as opposed to a hosted web app) is distributed to its users. Every client app, even if it's just compiled binaries, thus embeds its client_secret that is trivially extracted. So for client apps, we treat their OAuth secret as non-secret.
I'm currently working on a Python app where I quite simply want to check active issues in the private repo that the project is in, but as I want to publish the package. I obviously can't store secrets in the project.
I've used cli in the past, and the interactive authorization flow is amazing. It would be great to have access to it for Github authentication.