I'm trying to use the apps-script-oauth2 library to access the GitHub API in a Google Apps Script. I'm creating the service like this:
function getGithubService(client_id, client_secret) {
return OAuth2.createService("GitHub")
.setAuthorizationBaseUrl("https://github.com/login/oauth/authorize")
.setTokenUrl("https://github.com/login/oauth/access_token")
.setClientId(client_id)
.setClientSecret(client_secret)
.setCallbackFunction("authCallback")
.setPropertyStore(PropertiesService.getUserProperties())
.setCache(CacheService.getUserCache())
.setLock(LockService.getUserLock())
.setScope("repo");
}
function authCallback(request) {
let github_service = getGithubService();
if (github_service.handleCallback(request)) {
return HtmlService.createHtmlOutput("Success!");
}
return false;
}
I can launch the authentication endpoint okay and get a valid access token back. But the token I get doesn't seem to be authorised for any scopes. I can log the token and try to use it in a curl request:
$ token=ghu_<censored>
$ curl -i -H "Authorization: bearer ${token}" https://api.github.com/user
...
x-oauth-scopes:
x-accepted-oauth-scopes:
...
The result of this is that any request I make for a resource that requires an authorised scope either fails or returns an empty list. In particular, the /org/{org-name}/repos endpoint just returns [] even though I've specified the repo scope in the service configuration above.
(Update: my org only has private repos; if I request this endpoint for an org with public repos, I get a useable repo list. Apparently I need the repo scope to get private repos.)
I'm requesting the repo list like this:
let service = getGithubService(client_id, client_secret);
let org_name = "...";
let url = `https://api.github.com/orgs/${org_name}/repos`;
let response = UrlFetchApp.fetch(url, {
headers: {
Authorization: `token ${service.getAccessToken()}`,
Accept: "application/vnd.github.v3+json"
}
});
let repos = JSON.parse(response.getContentText());
On a possibly-related point, is there supposed to be some way to relate the scope names used in OAuth2 requests to the permissions you can give an app in the GitHub developer settings page? I'm not at all sure I've granted the right set of permissions to the GitHub app to be able to request the repo scope in an auth request, but there doesn't seem to be any documentation at all on how the two relate.
