maxlath / wikibase-cli

read and edit a Wikibase instance from the command line
MIT License
223 stars 24 forks source link

Improve OAuth authentication flow #90

Closed waldyrious closed 4 years ago

waldyrious commented 4 years ago

Originally reported in #21. Copying the relevant comment below, for convenience.

I think the OAuth authentication UX needs a little polish:

❯ wd set-label Q4115189 pt "Testing wikidata-cli"
This operation requires to set your crendentials for https://www.wikidata.org
Which authentification mecanism would you like to use to login to https://www.wikidata.org ?:
/!\ Beware that those will be stored in plain text on your computer
1 - OAuth tokens (recommanded)
2 - username - password
- 1

If you don't have OAuth tokens yet, you can request owner-only tokens OAuth consumers at

https://meta.wikimedia.org/wiki/Special:OAuthConsumerRegistration/propose?wpname=wikibase-cli-myusername&wpdescription=tokens%20for%20wikibase-cli%20%28https%3A%2F%2Fgithub.com%2Fmaxlath%2Fwikibase-cli%29&wpownerOnly=1

Select "Request authorization for specific permissions" and adjust to your needs.
Required authorizations:
- Edit existing pages
Recommanded authorizations:
- Create, edit, and move pages

A clear message and call should be shown, e.g. "You don't seem to have an OAuth token set yet; please open the following URL to create one".

Especially since when I open that URL I see this huge and complex form:

Screenshot_2019-10-02 OAuth consumer registration - Meta

...when I expected an authorization screen like those that appear when I authorize a Labs tool on mediawiki.org (i.e. a dialog where I can just click "Authorize").

maxlath commented 4 years ago

unfortunately, the possible improvements are limited: those services where you just click "Authorize" use multi-users OAuth consumers, as all the requests pass by their servers. Having such a centralized point is not a desired feature for wikibase-cli, so we are left to having to ask users to make a bit of the work. We should try to keep it minimal and well documented though: I tried to improve the process in 280d123, please let me know if you see further possible improvements, given the constrains explained above.