Allow importing from GH organization repos

[vBm]

Currently we can only import from user accounts. Would be nice if we could import repos from organizations.

Thanks in advance.

[Zren]

https://openuserjs.org/users/Zren/github/repos?user=OpenUserJS https://openuserjs.org/users/Zren/github/repo?user=OpenUserJs&repo=OpenUserJS.org

https://openuserjs.org/libs/Zren/jquery-1.10.2.min

Nope. We just don't document those query parameters, which I guess is the same thing from a user's prospective.

[vBm]

Nice, thanks for letting me know. Works like a charm :)

[Martii]

Changing issue subject from:

Allow importing from GH organization repos

to current based off of https://github.com/OpenUserJs/OpenUserJS.org/issues/231#issuecomment-47546649 of success and https://github.com/OpenUserJs/OpenUserJS.org/issues/231#issuecomment-47537408 indicating that it can be with a QSP.

[Zren]

Probably need to also test the import pages with a user that isn't authed with GitHub. We can add a GET form with an <input name="user"> box on the "Not Authed with GitHub" import page, and on the top of the /github/repos page.

[sizzlemctwizzle]

I really don't want to let users import scripts from repos that aren't theirs. The only exception I'd make is for organization repos. Anyone can import from those.

[sizzlemctwizzle]

Also, I don't think it's unreasonable to require authentication with GitHub before you can import from GitHub.

[Zren]

We don't even need a user to auth to GitHub if we have an input box. All we do when the user is authed is find out their ghUsername.

Edit: Just remembered you mentioning that awhile ago. Perhaps instead of Labeling it as GitHub Username, label it as GitHub Orginization on the input form. Most users wouldn't think to put a regular username there probably.

On 6/30/14, Mike Medley notifications@github.com wrote:

Also, I don't think it's unreasonable to require authentication with GitHub before you can import from GitHub.

---

Reply to this email directly or view it on GitHub: https://github.com/OpenUserJs/OpenUserJS.org/issues/231#issuecomment-47587184

/ Chris

[Martii]

Putting on a security label as #236 is being encountered... It is a little vague between the:

Nope

and the...

Works like a charm

comments and the ensuing conversation here.

[Martii]

I really don't want to let users import scripts from repos that aren't theirs.

Is there a way to read in the "teams" like we have for our project at https://github.com/orgs/OpenUserJs/teams and allow only those ppl to import to our OUJS accounts for other organizations? If so this may entail @vBm to add a public team to his project, if not present, since https://github.com/orgs/OmertaBeyond/teams seems to have issues resolving here on GH and redirects to GH account page at https://github.com/OmertaBeyond ... EDIT: or perhaps "members" at https://github.com/orgs/OmertaBeyond/members ??

[Martii]

@vBm Are you able to auto sync to your vBm account on OUJS with Omerta Beyond or do you have to do it manually with upload/paste/reimport?

[vBm]

@Martii I made a fork on my account and gave access to members so they push to my fork and that fork has OUJS hook which properly syncs script.

[devnoname120]

@Martii This should work for finding out whether a user owns an organization or not.

[Martii]

@devnoname120 Seems to be a newer API function... I'll see what I dig up in our code... 'til then you might try vBm's suggestion as the work-around... we do have some other more serious fires that I'm working with sizzle on getting done with higher priority... I wasn't aware that forks could be sync'd to OUJS... my bad.

Thanks @vBm.

[devnoname120]

@Martii I will wait, because I think that this workaround is hacky, and I don't want to keep a fork up-to-date.

[Martii]

Well no promises on a time-table but I appreciate the assistance on the v3 API for Organizations... that's a GH RSS feed I should probably be following as this is the first I've heard of it.

[Mottie]

I think it should be okay for anyone to import a userscript, if the license allows it; OUJS allows forking, as does GitHub, GitLab and Bitbucket. The catch would be that only users or organizations that set up a webhook^† that matches the userscript @updateURL should get an auto-update.

---

† Webhooks documentation:

• GitHub webhooks
• GitLab webhooks
• Bitbucket webhooks

[Martii]

... if the license allows it;

This being one of the keys... related of #438 and probable https://spdx.org/licenses/ usage ... then perhaps. The other logistical changes need to take priority over this for a while though.

The catch...

Isn't there always one of those? ;)

Btw the current dep we utilize for GH is https://github.com/mikedeboer/node-github but it's still good to have the other links too. :)

Thanks for those and your feedback.

[Martii]

@sizzlemctwizzle

I really don't want to let users import scripts from repos that aren't theirs. The only exception I'd make is for organization repos. Anyone can import from those.

Not without a total rework even beyond GH import routines. This is disabled for the the time being. We'll talk in private in a while.

Renamed the issue back to it's original subject.

[Martii]

Btw for those listening/watching here... each of you needs to relogin to OUJS with GH auth to enable browsing your own repository lists... otherwise the webhook will reject your script updates from GH. e.g. you have to resync this yourself with a login. You shouldn't have to reimport but that's always an option if your webhook doesn't get processed.