Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support fine grained personal access tokens #458

Open
heasman-proof opened this issue Oct 24, 2024 · 3 comments
Open

Support fine grained personal access tokens #458

heasman-proof opened this issue Oct 24, 2024 · 3 comments
Labels
enhancement New feature or request

Comments

@heasman-proof
Copy link

Is your feature request related to a problem? Please describe.
Add support for fine grained personal access tokens to minimize the permissions needed to retrieve data from tables of interest to the user (up to the user to ensure they have added the right permissions to the FG PAT).

Describe the solution you'd like
This is a simple change in 4 places in connect and connectV4. Everywhere you validate that the supplied token has the ghp_ prefix, also allow the github_pat_ prefix. I tested that this works as expected.

@heasman-proof heasman-proof added the enhancement New feature or request label Oct 24, 2024
@graza-io
Copy link
Contributor

@cbruno10 - thoughts on this? I know we looked at it a year or so ago and had some issues

@ParthaI
Copy link
Contributor

ParthaI commented Oct 24, 2024

@graza-io, @cbruno10, Further more — I have a few findings related to the fine-grained access token.

The error Resource not accessible by personal access token is caused by a GraphQL field error. You can refer to this documentation on how to handle such errors.

I tested the fix with the github_issue and github_my_issue tables, and pushed some changes to the branch add-support-for-fine-grained-access-token. The code changes seem to be working fine.

However, I’m not entirely sure if this is the best solution. Any thoughts would be appreciated.

@ramses999
Copy link

@ParthaI @graza-io @cbruno10

Hello everyone, I support Fine-grained personal access token (github_pat_)
In large enterprise companies, the security department may refuse to use Personal access token (classic).

The permissions that the module requires in the documentation: https://hub.steampipe.io/plugins/turbot/github
Are unacceptable for those who care about their security.
Image

I suggest considering the points below if you are interested in attracting large companies to use your tool:

  1. adding "Fine-grained personal access token" even if this will make some functionality unavailable until GitHub fixes the restrictions on its side.
  2. Suggest in the documentation the smallest set of privileges required to perform checks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants