Is it possible to give access to only one folder in Dropbox?

[safijari]

Is your feature request related to a problem? Please describe.
I would like to restrict organice to only one folder in my Dropbox. Based on the permissions request at sign in that doesn't seem to be possible.

Describe the solution you'd like
I would like there to be a way to give organice access only to one folder in my Dropbox

Describe alternatives you've considered
Using the other sync mechanisms, though I would prefer to avoid that.

[safijari]

Maybe having "App folder" as an option?

[safijari]

Nvmnd this appears to be an app level setting. Going to fork and use my own app for this kind of auth.

[munen]

Good question. This is not implemented. However, it isn't implemented for a reason: organice is a front-end application, there is no back-end and no monitoring whatsoever. So, when you login to Dropbox, only your browser will have access to your Dropbox. So, from a security perspective, you're not giving too much access to a server - your data cannot be seen by anyone else but you.

The synchronization code for Dropbox is also pretty straight forward and can easily be reviewed, it's less than 200LOC.

I hope that answers your question. If there's a reason to limit access that I'm missing, I'd be happy to get a response^^

[schoettl]

If there's a reason to limit access that I'm missing, I'd be happy to get a response^^

1. It would be easier/faster to navigate to the org files I want to edit.

I know, in the browser, I can bookmark Organice directly with a file. But at least on three Android versions, putting Organice to the home screen, it does not keep the full URL. It always opens / instead.

2. I think, security concerns are still valid. E.g. if you use Dropbox for many important other files. In that case you probably don't want to share all your important other files with some "notes app" ^^

But I don't know if the Dropbox API allows such sharing options at all...

[munen]

I know, in the browser, I can bookmark Organice directly with a file. But at least on three Android versions, putting Organice to the home screen, it does not keep the full URL. It always opens / instead.

I didn't know that. On iOS, bookmarks work as bookmarks are intended^^

That would certainly be a good UX improvement to debug and figure out what's going wrong here. Or is this something that all PWAs suffer on Android?

With regards to your first point: That's assuming all Org files are within the same folder. For me, for example, that's not true. I have several folders on the top level of Dropbox that are shared with different people, so that I can use Org and organice for collaboration. Hence, just giving access to one folder wouldn't even allow my usecase.

With regards to your second point: What's the vector of attack of giving a SPA access to your files? Imo it's the same as not giving your text editor access to your files. There's no way I can MITM what someone has accessed on their local browser unless there's a security flaw in which case we should address that.

[aspiers]

0ec0b2e may be helpful regarding bookmarks on Android.

[safijari]

Any movement on this issue would require you folks to create a second app under Dropbox which uses an app folder and give the user a choice at sign up. As far as I can tell almost no one asks for this so I'm perfectly happy making my own such app under Dropbox and throwing up another instance of organice that uses it instead.

I understand that only my browser has access and the only time it would be a security concern is if there's a bug in the browser code but even there I would prefer only one folder to be affected rather than my entire Dropbox (which contains a bunch of stuff from my employer).

[schoettl]

@munen

With regards to your second point: What's the vector of attack of giving a SPA access to your files? Imo it's the same as not giving your text editor access to your files.

The attack I see is an Organice app that deletes/manipulates/extracts data from my Dropbox. As a user, I have to trust the programs I'm using to a certain degree. But I always like to limit potential damage, following the principle of least privilege.

Well, I don't plan to work on this. So I don't mind if we close the issue. I'm just saying, that it would be nice to be able to limit access to a folder (with subfolders) :)

[munen]

@schoettl Ok, I understand the vector you're describing. I'm the same with proprietary software. I don't trust them with 'all of my 2TB dropbox'. With FOSS that I'm working on, it's different, of course.

But I also understand that you're arguing from the position of an end user who hasn't read the source code.

@safijari You're described workflow sounds the best. However, I also haven't seen an application that gives both options. The reason for that is, that this is not possible to my understanding. When creating an App in the Dropbox App console, you have you decide the 'permission type'. For organice, it's 'Full Dropbox'. There is only one type. I wouldn't know how a user can decide on login which "App" to use.

If a user needs something different, she can always go ahead and create their own instance with a different set of permissions.

[munen]

Of course, the debate here was highly valuable. Hence, I have added more documentation here: #313

The documentation is deployed already: https://organice.200ok.ch/documentation.html#faq_dropbox

Since everyone agreed that this issue can be closed and has no further actionables, this is what I'll do.

Thank you all for the valued discussion! 🙏