861222 - Gmail contact import should reduce permissions

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Gaia::First Time Experience, defect)

Description

[Dietrich Ayala (:dietrich)]

Currently Gmail contact import shows a permissions request of "manage contacts".

That seems overly broad for an import. Should just request read-only permissions.

OR, if we're actually writing back to the contacts, the language in our app should change to be clear about that.

Comment 1

[Dietrich Ayala (:dietrich)]

Francisco, who worked on this feature?

Comment 2

[Francisco Jordano [:arcturus] [:francisco]]

Hi Dietrich,

Are you talking about the external app, or the version that we embedded in gaia.

I guess that permission request is caused cause we need to write the contacts from google into our mozcontacts db :S

Perhaps I'm missing the point, or just ask (in the 3rd party app) for write access.

Thanks!

Comment 3

[Dietrich Ayala (:dietrich)]

I'm talking about internal import - and about the level of permissions asked of *Google* during the oauth dance.

Comment 4

[Francisco Jordano [:arcturus] [:francisco]]

Hi Dietrich,

Unfortunately google doesn't provide a granular permissions model for their apis. At least that was like that when we developed the app.

Also the current key used in gaia was requested by Dylan Oliver (I'm ccing him here), AFAIK, there is a new console for google services that allows you to 'customise' a bit that screen, perhaps we could explain better what we do with the permissions that we request.

Cheers!
F.

Comment 5

[Dietrich Ayala (:dietrich)]

Thanks Francisco, I found the docs. The "scope" table in the URL below does show that there's only one permissions scope for Google Contacts at this time, which is read/write.

https://developers.google.com/google-apps/contacts/v3/#authorizing_requests_with_oauth_20

(That seems so crazy that I assumed there'd be a read-only scope!)

Comment 6

[Dylan Oliver [:doliver]]

(In reply to Francisco Jordano [:arcturus] from comment #4)
> Also the current key used in gaia was requested by Dylan Oliver (I'm ccing
> him here), AFAIK, there is a new console for google services that allows you
> to 'customise' a bit that screen, perhaps we could explain better what we do
> with the permissions that we request.

The customization for that screen is mostly limited to the product name and a logo image. It would be tough to include any further detail directly on that screen, though you can also include a link to the privacy policy if we wanted to explain ourselves further.