Gitlab oauth/personal access token confusion

[ederuiter]

Since #10104 the interactive prompt for gitlab authorization points the to personal access token profile page of gitlab. This is confusing as it implies that it generated an personal access token, which it does not. It always generates an oauth token, and that the right url should be: -/profile/applications

It would be nice if composer would indeed generate personal access tokens as since recent changes in gitlab the oauth tokens are only valid for a maximum of 2 hours: https://northflank.com/blog/supporting-expiring-oauth-access-tokens-for-gitlab
Unfortunately the api to create personal access tokens is only available for admins: https://docs.gitlab.com/ee/api/personal_access_tokens.html#create-a-personal-access-token-administrator-only

My proposal would be to:

• change to url to -/profile/applications
• add additional text to indicate the limited lifetime of the oauth token
• add additional text with instructions how to create a personal access token and store it in your composer/auth.json

[tlueder]

Once this #10988 is approved oauth token expiration is not an issue anymore.

[ederuiter]

Nice! I was trying to find some time to implement this myself. Regarding the url: I think it still has to change; #10988 still refers to the personal access token page which is incorrect for oauth tokens.
Maybe the wording can be changed to something like this:

To revoke access to this token you can visit '.$scheme.'://'.$originUrl.'/-/profile/applications
Alternatively you can setup an personal access token on  '.$scheme.'://'.$originUrl.'/-/profile/personal_access_token and store it under 'gitlab-token' see https://getcomposer.org/doc/articles/authentication-for-private-packages.md#gitlab-token for more details.

Note: this should be done for both authorizeOAuthInteractively and authorizeOAuthRefresh

[tlueder]

Ok, i've updated the note to your suggestion.

[Seldaek]

Hopefully fixed by #10988 - it'd be great to get confirmation that things work well now with the latest snapshot (composer self-update --snapshot)