Refined-github: API calls need Personal Token to support frequent calls and private repos

[fregante]

Refined GitHub needs

• [x] [Personal token](https://github.com/settings/tokens) field in the options
• [x] Automatic token usage by https://github.com/sindresorhus/refined-github/blob/master/source/libs/api.js, if present

[notlmn]

Features that can use API:

• Embedded gists (https://developer.github.com/v3/gists/#get-a-single-gist)
• Public gist count
• Searching issues
• CI/CD status links (https://developer.github.com/v3/repos/statuses/#get-the-combined-status-for-a-specific-ref)
• Get users full name (https://developer.github.com/v3/users/#get-a-single-user)

Can also use GraphQL API to request only required data.

[yakov116]

Maybe its just me, I feel very unconformable with the token being displayed with one click. In your issue linker its 2 steps (1. click the ext. 2. Click options).

Can we collapse the token area once its filled in (add a + symbol)?

[fregante]

In your issue linker its 2 steps (1. click the ext. 2. Click options).

How is it different here? The token appears in the options

[yakov116]

Its 2 steps

1.

Then Step 2 opens the options

[fregante]

Right, how is that different from Refined GitHub?

[yakov116]

@bfred-it clicking on the ext shows the token.

[fregante]

Why is your button not hidden in the overflow? It's pretty much useless

[yakov116]

Why is your button not hidden in the overflow? It's pretty much useless

What?

[fregante]

This overflow:

[yakov116]

@bfred-it 👍, ok...

Would rather not do that.

Im not saying that there is no way to get my key, I just feel unconformable the way its setup now.

[fregante]

@sindresorhus thoughts?

[sindresorhus]

If someone has access/control of your computer, all bets are off anyway, so I don't fully agree with your reasoning. That being said, I don't mind making it a password type input. GitHub hides it too: https://github.com/settings/tokens

[yakov116]

The issue is not the access, it just doesn't feel right to have it displayed in plain text.
@bfred-it had an issue with using password as it gives a false sense of security.

Also I work in an office and a screenshot is taken every min of my screen, so having it in plain text...

[fregante]

@sindresorhus GitHub doesn't store them on your computer in plain text like Chrome does

Also I work in an office and a screenshot is taken every min of my screen, so having it in plain text...

That's some serious trust issues. We can think of something...

[fregante]

type=password is the last resort, so how about making the field shorter so it won't be displayed in full? Am I thinking too hard?

[sindresorhus]

Also I work in an office and a screenshot is taken every min of my screen, so having it in plain text...

😔

[fregante]

@yakov116 now I wonder how you're going to get that token in the first place without having it on screen since GitHub does this: 😅

[yakov116]

@bfred-it lol,
I have my ways :)

Just want to point out its nothing to do with trust. My boss does it so we know that he CAN look back at what we were doing.
But knowing that he can....

[yakov116]

Can we collapse the text area after its full? And only show it with clicking the + symbol?

[borekb]

Which scopes should be selected for the token? Just repo or anything else?

[fregante]

Can you open a new issue for that? We can change the url to include the required scopes

[borekb]

Done: https://github.com/sindresorhus/refined-github/issues/1425

[archon810]

Some instructions on the scopes that should be given to the token would be very welcome. Right now, there are a lot, and I'm not sure which ones RG can utilize.

[jerone]

@archon810 No need to do anything else. The "Repo" scope is automatically checked.

[archon810]

Understood, but to the user, it's not obvious. A small clarification that the right set has been pre-selected would go a long way.

[busches]

@archon810 PRs are welcome to make it more obvious or an issue with mockups of what you would propose to change.