Teyora/Permissions

This page briefly explains what OAuth permissions Teyora requires and why.

What is OAuth?

OAuth is a user-friendly authentication standard that allows for external tools and websites to access your Wikimedia and other accounts without providing a password or BotPassword. If you've ever clicked a "Log in with Google/Facebook/Apple" button, you've probably used it in the past without knowing it.

Why does Teyora use it?

Teyora needs to know who is using the tool to save your configuration, create your profile, store workplaces and much more. It additionally needs you to approve access to your account and various advanced permissions to make edits and perform actions on your behalf.

Benefits

Teyora can only do what you give it permission to do. You can revoke your OAuth token at any time. Other tools like gadgets may have full account access whether you approve of it or not.
Your OAuth tokens are encrypted and stored more securely than a BotPassword

What security measures are in place?

After you log in, your OAuth tokens (keys that are used to make edits on your behalf) are securely encrypted and integrated into a token that is used to authenticate requests to a Teyora server in a "HttpOnly" cookie (i.e. a value that is only sent when making a request and is inaccessible through JavaScript). This way, unlike other services, the Teyora servers never store OAuth keys, so can't make actions without you initiating them. Because of this security feature, all edit requests you make are sent to a Teyora server which will then make the edit for you.

The only time keys are made accessible to Teyora is when you log in and when you make a request to the server, for example to make an edit or complete an action. They are never saved or stored and are immediately disposed of as soon as they are no longer needed.

Permission breakdown

These are the OAuth permissions Teyora requires.

Perform high volume activity

High-volume editing - Teyora sometimes needs to edit or make changes in quick succession. Usually, these would be blocked to protect Wikis from spam and other abuse - this permission allows Teyora to bypass this limitation.

Perform administrative actions

Import revisions, create accounts, merge page histories, create short URLs, hide users and suppress revisions - these permissions are not yet used by Teyora, but are provided for extensions that may want to provide you with this functionality
Rollback changes to pages - use the rollback feature to revert edits
Block and unblock users - for administrators to block and unblock users from within Teyora
View deleted files and pages - for administrators, view deleted pages and restore them from Teyora
View restricted log entries - for administrators, see a full and detailed log in Teyora regardless of restricted entries
Delete pages, revisions, and log entries - for administrators, delete content from within Teyora
Protect and unprotect pages - for administrators, protect and unprotect pages from within Teyora

Interact with pages, media, watchlist, etc.

These permissions are fairly self explanatory and enable Teyoras functionality.