use OAuth instead of prompting for GitHub password

[keturn]

I'm new to Ohm, the editor is working well, I go to save my grammar and—

Is that prompting for my GitHub password?

oh dear. That's not good practice for users, to give their GitHub password to anyone but GitHub, and not good practice for Ohm, as you don't want the liability of having full unconstrained access to anyone's GitHub account.

I think the proper approach here is to use the web OAuth flow to request a token with permission for the gist scope.

[pdubroy]

Hi @keturn, you're absolutely right that should be using OAuth. We implemented this back when the Ohm Editor was more of a research project than anything, and I simply haven't gotten around to implementing it properly.

Not that it makes it much better, but nothing is sent to our servers — it uses the GitHub JS client library to fetch from the client. But yeah, we definitely shouldn't do this!