[multiuser] Signup with thin scopes for GitHub.

[monaka]

Is your enhancement related to a problem? Please describe.

Currently, user must accept to give scopes repo,user,write:public_key to Che.
IMO, this is too strong (or risky) for entry users who don't use full functions.

Describe the solution you'd like

The bast is to enable no scope on their signup/login. (read:user, read:email may be safe.)

And Che asks adding more scope permission to the user logged in when it was required.

I guess it can be implemented by calling add_scopes via PATCH /authorizations/:authorization_id provided by GitHub API.

Describe alternatives you've considered

Additional context

[skabashnyuk]

@monaka do you know what kind of auth/authorization is required to call PATCH /authorizations/:authorization_id ?

[monaka]

@skabashnyuk I checked the official document and ...

You can only access this API via Basic Authentication using your username and password, not tokens.

Hmm, my approach won't fit to Che.
But I believe there will be the another way to do it because GitPod do.
After I approved more scopes, GitHub send me the mail like this.

[monaka]

I inspected Gitpod in shallow. It looks just calling https://github.com/login/oauth/authorize with newly required scopes, redirect_url, and some more parameters.

[rhopp]

@skabashnyuk Do you think we should trigger something like this for GA? To me it seems like nice enhancement, but I'm not sure we add another enhancement into GA.
Maring this one as sev2 & Che 7.1 milestone for now.

[skabashnyuk]

Do you think we should trigger something like this for GA

No, because we need to figure out if that possible at all. I mean manipulation of token scopes on Kyecloak side.

[monaka]

I agree. It's enough to be realized on 7.1.0 or later.

[slemeur]

Downgrading the priority. This is a very good enhancement request which will need to get prioritized - but regarding the other areas that needs hardening, this has a lower impact right now.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.