Add OAuth scopes for extended user data

[alrocar]

Some applications are gonna need reading some public user data to personalize the UI. For instance:

• The user avatar
• The actual user name and last name.
• etc.

Same for organization data:

• Who is the owner
• Who are admins
• etc.

[alrocar]

Taking a look at what other OAuth providers do:

• Most of them distinguish between user public profile (avatar, name, job, etc.) and user contact details (email, phone, etc.)
• In some cases there are read and write permissions.
• Some services provide the user public profile as the default scope.

Proposal for our scopes:

• user:profile:read -> Read access to: avatar_url, name, last_name

• org:profile:read -> Read access to: display_name, description, owner

• Eventually we could have user:profile:write and org:profile:write scopes.

Thoughts? @javitonino

[javitonino]

How would you add the "contact details" permission to that?

[alrocar]

I assume it would be a different scope, user:contact_details:read or something like that.

[javitonino]

8 scopes for this: (user/org, profile/contact, read/write) is maybe a bit too much :D Some ideas, not sure if they make sense (writing as I think):

• Merge user:profile with org:profile. It's probably better to merge them so the same scope works for orgs and plan users
• Have a single user:write that modifies the profile and other parameters. We'll probably never implement this though, it's quite dangerous... 🤔 Maybe we can avoid the read part of the scope for now?

Also, where would something like job profile fit? It's not really part of the public profile, but not contact details. But yeah, maybe we can have user:private_info or something like that...

[alrocar]

Personally I think the fewer scopes the better... so yep having a user:profilefor the user info aforementioned above could work.

[alrocar]

Closing this as we have added the required scope to unblock other related issues.

At some point we'll probably need to add new scopes, but at the moment I think it's fine open new issues it as it's required for other apps.