-
-
Notifications
You must be signed in to change notification settings - Fork 94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ability to mint access_tokens with restricted scope. #725
Comments
Yes I would certainly like to see this! A few thoughts I've had on this, although they don't completely match the bullet points you have listed as they are rather thought of mostly with bot accounts in mind:
Set of commands could be an endpoint-oriented JSON pattern "firewall list" like: Obviously there's a big risk of scope creep here 🙄. |
fwiw https://github.com/turt2live/matrix-oauth exists as a very early proof of concept for this sort of thing, with intentions of expanding it out as a playground before a formal MSC. |
related matrix-org/synapse#5323 |
Given I spent a decent amount of time on matrix-org/matrix-spec-proposals#531 and I'm no longer a pumpkin, I'd love to take this up again and implement it in Dendrite. This issue wasn't as important 5.5 years ago when I wrote that issue, but is definitely more important now as Matrix has a strong native community which has accounts which want to be protected. |
MSC laying out the path for this: matrix-org/matrix-spec-proposals#2967 |
I think there is a significant use case for accounts controlling parts of other accounts as you outline here. I have two concerns however with this:
|
matrix-org/matrix-spec-proposals#2967 currently has the best chance of being approved, and if not it's a thing we want to do anyways. Let's triage this through the proposals process rather than as an idea, now that we have an MSC to link to. |
There are many scenarios where it'd be useful to be able to give a client or AS or bot or widget or some other service limited access to your account:
In the past this has got a bit derailed by the idea of replacing our auth system entirely by OAuth2: https://github.com/matrix-org/matrix-doc/issues/2615 - and meanwhile an MSC trying to do something very similar to this got abandoned: matrix-org/matrix-spec-proposals#531. So I'm reopening this as a high level issue for folks to upvote and coordinate via.
The text was updated successfully, but these errors were encountered: