Questionable permission level

[shaedrich]

What do you need that excessive permissions for? I thought, you just need to read from a simple gist?

[thomasdavis]

Thanks for the report. It should only need;

• read and write public gist
• read user profile

The current permissions are set here -> https://github.com/jsonresume/jsonresume.org/blob/master/apps/registry/auth.js#L12

I will check it out later if no one else knows how to reduce those permissions

[thomasdavis]

Just need to change it to read:user for read only user.

But I don't think it's possible to scope it to public gist only

[shaedrich]

that seems to be included as the default: See: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes

[thomasdavis]

Yeah but it doesn't support writing gist which is needed for the editor

[shaedrich]

Ah, okay. You are right. This would need the gist permission then

[thomasdavis]

I've updated it to just read user profile in this commit https://github.com/jsonresume/jsonresume.org/commit/8e5b9dc908c20ece1dd965c154294b1b904af78c

Will keep this open for a little while to see if anyone has any good ideas to let people keep their gists private.

[shaedrich]

Awesome! Thanks 👍🏻

[thomasdavis]

✅ Permissions Minimized

Verified current OAuth scopes in apps/registry/auth.js:12:

scope: 'read:user gist'

Current Permissions:

• ✅ read:user - Read-only access to user profile (email, name, username)
• ✅ gist - Read/write access to gists (required for editor functionality)

These are the minimum permissions required for JSON Resume to function:

1. User profile - Needed to identify the user and fetch their resume
2. Gist access - Required to read resume.json and update it via the editor

GitHub API Limitation:

Unfortunately, GitHub doesn't offer a "public gist only" scope. The gist scope grants access to both public and private gists. This is a limitation of GitHub's OAuth implementation, not JSON Resume.

Alternatives Considered:

• Using only public APIs would prevent editing functionality
• A separate "read-only" mode could use no gist scope, but users couldn't edit their resume

The current implementation strikes the best balance between functionality and minimal permissions.

Closing as the permissions have been reduced to the absolute minimum required.

[shaedrich]

Thanks a lot!