Git-updater: oAuth for GitHub

[afragen]

I recently received a notice from GitHub that authorization via an access token query parameter is being deprecated.

https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters

https://developer.github.com/v3/auth/

The long term seems to be oAuth and I could use some help.

[soderlind]

I got 108 notices from GitHub today :)

I believe, also mentioned in https://github.com/afragen/github-updater/issues/323#issuecomment-242515699, that PHP League's OAuth 2.0 Client, and it's providers, might be the easiest solution.

The GitHub Provider for OAuth 2.0 Client is at https://github.com/thephpleague/oauth2-github.

Would love to help with this, but I haven't done any OAuth coding before.

[afragen]

@soderlind I welcome any help I can get. I’ve looked at that library and will likely use it. I have done any oAuth coding either.

[DuckDivers]

Hi @afragen

I came here looking for answer re: the email from GitHub that I also got several yesterday.

I've written plugins for wordpress that use OAuth 2.0 with wordpress wp_remote_request. I'm happy to contribute if you need...

[afragen]

@DuckDivers thats awesome!

What I'm looking for is a solution that I can adapt for using with GitHub, Bitbucket, GitLab, as well as private instances of those git servers too. At the moment I'll settle for something that works with GitHub. See #323

I'll push out a branch so we can work on it. Everything will likely be in a separate class.

[mattras82]

@afragen @DuckDivers

Looks like there are already provider libraries for Bitbucket & GitLab, according to their 3rd party provider doc.

[afragen]

The only thing that concerns me about the 3rd party libs is that they don’t seem to be as up to date as the primary client library.

[afragen]

I've created an oauth branch for us to work on. I've added league/oauth2-client to the composer requirements too.

[afragen]

It also seems that I can pass an Auth header with the access token. I'm working on that too as it may be a faster fix.

[afragen]

I think I have a working branch github-basic-auth that solves this problem. You should be able to use the branch switching to test. This is now in develop

Please let me know how it works.

I doesn't work with private repos -- yet.

[DuckDivers]

Testing now on a few sites... I'll see if I get the email from GitHub

[afragen]

I've merged these changes into develop. Also, please test updating especially of GitHub private repos and GitHub repos that use release assets.

[pbiron]

What's in developer seems to work with private repos w/ release assets...and no more "nasty-grams" from GitHub...yeah!

The first couple updates I tried failed, but I think those were because of connection problems between me and GitHub. Everything seems to work fine now.

Good job Andy!

[DuckDivers]

HI @afragen - it seems as though your change has broken some other OAuth plugins I've created for constant contact. With github-updater active, it is unable to perform the refresh token, and/or authenticate. I have to disable github-updater for that functionality to work again.

[afragen]

@DuckDivers which version are you currently using?

[DuckDivers]

@afragen 9.3.0 older versions don't break my plugin, but then I get the github depreciation email.

[afragen]

Try the develop branch and let me know.

[DuckDivers]

Develop seems to work as expected. I am able to connect to constant contact now on one of the sites i have this in use on.

Thanks.