/user/userGetCurrent should be always accessible #14134

New Issue

GiteaMirror · 2025-11-02T11:03:59-06:00

GiteaMirror commented

2025-11-02 11:03:59 -06:00

Originally created by @AdamMajer on GitHub (Feb 13, 2025).

Feature Description

The endpoint /user/userGetCurrent currently requires [read:user] scope permissions. Would it make sense to make this universally accessible for all tokens? For example, I do not want access to information about other users or tokens, but just information about current token account.

Alternatively, maybe there should be a distinction about getting read permissions to current user vs. read permissions to all users?

Screenshots

No response

Originally created by @AdamMajer on GitHub (Feb 13, 2025). ### Feature Description The endpoint `/user/userGetCurrent` currently requires [read:user] scope permissions. Would it make sense to make this universally accessible for all tokens? For example, I do not want access to information about other users or tokens, but just information about current token account. Alternatively, maybe there should be a distinction about getting read permissions to current user vs. read permissions to all users? ### Screenshots _No response_

GiteaMirror added the type/proposal label 2025-11-02 11:03:59 -06:00

GiteaMirror commented

2025-11-02 11:04:00 -06:00

@lunny commented on GitHub (Feb 13, 2025):

But when you want to give others a token but it can only read repositories or issues, wouldn't it be more strict?

@lunny commented on GitHub (Feb 13, 2025): But when you want to give others a token but it can only read repositories or issues, wouldn't it be more strict?

GiteaMirror commented

2025-11-02 11:04:00 -06:00

@AdamMajer commented on GitHub (Feb 21, 2025):

The main concern here is when you have a token, and can read repositories or issues, you don't know which comments are made by the owner of the token. At least not by just having a token. This is somewhat important if you use issue comments as a data store.

So, I agree with you that it's more strict, but we don't have separate permission to just read current user data. There's only ability to enable reading all users data. Adding more fine grain control to only read current user data would be more than enough.

This is mostly a nit issue and not very important.

@AdamMajer commented on GitHub (Feb 21, 2025): The main concern here is when you have a token, and can read repositories or issues, you don't know which comments are made by the owner of the token. At least not by just having a token. This is somewhat important if you use issue comments as a data store. So, I agree with you that it's more strict, but we don't have separate permission to just read current user data. There's only ability to enable reading *all* users data. Adding more fine grain control to only read current user data would be more than enough. This is mostly a nit issue and not very important.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14134