Permission settings for OAuth

[Derdrom-TJM]

I am loving what I'm seeing in the GitHub Educators walkthrough video. I tried to log in to classroom50.org and had a question about permissions. Does this app have access to all my public and private repos, or only those listed in the organization?

I don't have many concerns about my private repos, but I think others might be hesitant to share all their repos with an open-source app.

Would someone be able to clarify?

[rongxin-liu]

Indeed, right now, signing in does grant access to all your repositories, public and private, not just the org's.

That's because Classroom50 logs you in as a classic GitHub OAuth App using the repo scope, and GitHub's repo scope is all-or-nothing: there's no way to limit it to a single org's repos.

The app is essentially a web layer on top of the same workflows the GitHub CLI (gh) uses, so it requests similar broad scopes to those gh does (repo, workflow, read:org, etc.). That keeps behavior consistent with our CLI implementation, but it inherits the same constraint: gh also asks for full repo access, because that scope can't be narrowed to specific repositories.

A few things worth knowing:

1. Your token is stored only in your own browser, not on our server (the current solution is serverless by design).
2. It's open source, so the exact scopes are inspectable. (We will make the source code public, and the website is deployed and hosted on GitHub Pages.)
3. You can revoke it anytime at GitHub → Settings → Applications → Authorized OAuth Apps.
4. Org owners can also require approval via the org's OAuth App access policy. See this post for more details.