Token revocation scenario

[prayerslayer]

In worst case we would have to revoke all access tokens we got via Github web UI and delete them from our database.

Think of a way to restore functionality with minimal user effort (ie ideally not more than logging in).

[mfellner]

Given #25 we are going to store a valid token with each check when it is enabled.

• Tokens are initially created when users log in and complete the OAUTH flow
• No additional tokens are created
• We can revoke all those user tokens through the Github application settings
• Users cannot revoke these tokens themselves (only the complete application access)

Given these facts, the general flow would be:

1. revoke user tokens in the application settings
2. delete all user sessions in the database
3. users are forced to log in again, going through the OAUTH flow
4. We add the new tokens to any already enabled checks (not yet implemented)

[LappleApple]

Hey @prayerslayer @mfellner @spaudanjo, can we close this issue? It dates back to March 2016.

Or, we could add a "Help Wanted" label.

[mawenzel]

Cleaned up during backlog grooming