OAuth/Passwordless Mirroring
Description
The current mirroring features require a username and password to be specified in order to be able to push to the upstream repository. I would like to be able to use the OAuth credentials associated with my account for supported upstream sites in order to authenticate when pushing.
Currently, a username and password must be given as part of the URL which, if I am not mistaken, is visible to all project masters. Even using a personal access token, those users would be able to obtain a username and password that can be used to push to any repository on the upstream service that I have access to (due to the granularity limitations of the tokens).
Additionally, the management of these tokens is a mess, having to provide if for every project. If a password or token was compromised or I wanted to rotate and generate a new token I would have to go to each project one by one and update this password.
I would like to shift to using GitLab.com to host my repositories but would like to keep my GitHub presence and so having this ability will be extremely useful to me as well as providing some security improvements.
Proposal
- Users can link their account with external services granting OAuth access for GitLab to be able to read and write from those remote repositories. This should build on what is already implemented for importing projects from these sites, however, if I am not mistaken, the token is currently not stored. A section in user settings to see, add and revoke access to linked accounts should be provided so that these links can be managed.
- Projects should be linkable to repositories from these supported sites from the Mirror Repository settings. Below the text box links can be given to clone from one of the supported sites and then allow you to choose a repository which you have access to, similar to how importing a project works.
- Any project owner can click a link to change take ownership of the pushes to themselves, providing they have access (it should not be assignable to another user for security reasons).
- If the token is not permanent then email notifications should be sent when the token is coming up to expire 7, 3 and 1 day before expiry so that the account token can be renewed.
- Ability to create a new repository on other sites as well as being able to mirror to an existing repository.