How to configure Settings Sync without Github Application Access?

[ranasaria]

🐛 Describe the bug
Currently to setup settings sync, a user is required to give access to shanalikhan on github for their setting. We should decouple this feature from this dependency so users are not required to give such permissions to another individual

[CollinChaffin]

That is my primary concern installing this extension. Is there a way to install and pre-populate a gist myself first to then not require this grant?

[shanalikhan]

As Settings Sync requires two things to setup.

1. GitHub Token
2. GitHub Gist ID

In order to manually configure the Settings Sync.

1. You need to get the token from GitHub manually with the gist permissions. Note the token somewhere.
2. Create new GitHub Gist and get the ID of Gist.
3. Open the Settings Sync Global Settings (see readme for global settings) and insert GitHub token you saved from 1. and paste the value over there.
4. Paste the GitHub Gist ID in the configuration of sync.gist inside Code User Settings.
5. Once these are all done, you can perform upload and download as usual.

Settings Sync required manual creation of token before v3.4 and users were able to create token to setup Settings Sync, as this feature has been removed and Settings Sync now gets the GitHub token by itself by an application. I would recommend you to use that. Code is open source, you can always clear your assumptions.

Thanks.
Closing this issue.

[CollinChaffin]

Thanks @shanalikhan but it's not the source code, it's the fact of THIS that is I believe what the OP was referring to, and is my concern:

As far as I can tell, that permission grants endless perpetual permission to you to not only access and read, but delete every single private gist I have.

So, as the OP asked, shouldn't this be de-coupled from YOU personally and perhaps instead be an optional convenience grant (for those that do not want to follow the above manual instructions) instead assigned to an audit-able APPLICATION account instead?

Just a thought but thanks much for the manual instructions!

[shanalikhan]

@CollinChaffin

So, as the OP asked, shouldn't this be de-coupled from YOU personally

What do you suggest for it? In any way, the GitHub application needs to be own by someone.

perhaps instead be an optional convenience grant (for those that do not want to follow the above manual instructions) instead assigned to an audit-able APPLICATION account instead?

So, I think details can be added for users who don't want to provide Grant. I'll add details on the readme.

[FranklinYu]

I think details can be added for users who don't want to provide Grant. I'll add details on the readme.

I would like to see this in ReadMe as well. Or did I miss anything?