feat(app/web): bypass metrics.api.github.overuse with OAuth
#1171
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return {login, graphql: octokit.graphql.defaults({headers: {authorization: `token ${token}`}}), rest: new OctokitRest.Octokit({auth: token})} | ||
| } | ||
| else if (session) | ||
| console.debug(`metrics/app/session > unknown session ${session.substring(0, 6)}, using default octokit`) |
Check failure
Code scanning / CodeQL
Log injection
| <body> | ||
| Redirecting... | ||
| <script> | ||
| const query = new URLSearchParams(location.search) |
Check failure
Code scanning / CodeQL
SQL database query built from user-controlled sources (experimental)
| localStorage.setItem("session.metrics", session) | ||
| const to = query.get("to") | ||
| if (to) | ||
| window.location.href = to |
Check warning
Code scanning / CodeQL
Client-side cross-site scripting
| localStorage.setItem("session.metrics", session) | ||
| const to = query.get("to") | ||
| if (to) | ||
| window.location.href = to |
Check warning
Code scanning / CodeQL
Client-side URL redirect
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The aim of this PR is to lets users authenticate themselves on a web instance through GitHub with OAuth so they can use their own token (instead of the shared one).
When authenticated, the
metrics.api.github.overuserestriction would automatically be lifted allowing users to use plugins that consume much more API requests.It could also lead to additional features that would be available only when logged but not sure about this yet.
This PR also brings some UI changes, and also make it clearer which options are supported by the web instance depending on set policy