Repository navigation
feat: allow reading github integrations with personal API key - #38921
Merged
Merged
Conversation
joshsny
reviewed
Oct 1, 2025
Contributor
There was a problem hiding this comment.
can we add some permissions tests here?
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
|
Size Change: 0 B Total Size: 3.06 MB ℹ️ View Unchanged
|
…g into integrations-personal-api
joshsny
approved these changes
Oct 1, 2025
|
|
||
| def safely_get_queryset(self, queryset): | ||
| if isinstance(self.request.successful_authenticator, PersonalAPIKeyAuthentication): | ||
| return queryset.filter(kind="github") |
Contributor
There was a problem hiding this comment.
why do we want to only return github integrations?
Contributor
Author
There was a problem hiding this comment.
I don't know how diligent people have been when separating config and sensitive_config on the Organization model for different integrations, so just reducing blast radius by only exposing our use case
MarconLP
added a commit
that referenced
this pull request
Apr 29, 2026
PR #38921 narrowed the integrations endpoint to only return GitHub integrations when authenticated via personal API key (and #40246 extended the same restriction to OAuth access tokens). The intent was to scope the surface to GitHub for the Tasks product, but the side effect was that any other tool authenticating via API key — MCP, future products, custom scripts — could no longer read Slack, Stripe, Hubspot, or any other integration kind despite holding the `integration:read` scope. Drop the kind filter so the endpoint returns whatever the scope permission grants. The serializer already excludes `sensitive_config`, so this change exposes the same metadata-only view (id, kind, config, created_at, errors, display_name) for all kinds rather than just github. Per #38921 (comment).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
To allow Github Repository selection for a task in our tasks product, we need to expose the Github integration.
Changes
API keys with scope
integration:readcan now:I constrained this to only allowing Github related reads by limiting the queryset.
How did you test this code?
Manually
👉 Stay up-to-date with PostHog coding conventions for a smoother review.
Changelog: (features only) Is this feature complete?