#108: an organization can turn on OAuth app access restrictions. While
they are on, a key issued to an OAuth app reaches none of the
organization's repositories until an admin approves the app.
- Enforced on every request the key makes, so refreshed keys are
covered: at the GitHub layer's repository gate (GraphQL and REST), in
git over HTTP, and on creating a repository in the organization. A
blocked app gets 404 on the repository, 403 on the create.
- gh and other apps built into Ghost, the organization's own apps and
keys made in Ghost's settings are always allowed.
- Members ask for an app; admins approve, deny or revoke. Admins see
each app's owner, description and the scopes members granted it.
- Migration 0056: organization_settings.oauth_app_restrictions and the
organization_oauth_app table.
- Web: an "OAuth app access" settings page for organizations, and an
organization access list with "Request access" on the approval
screen and the authorized apps page. The scope list is one shared
component.
- The web flow forwards `prompt`, so prompt=consent asks again.