Why does Zotero need permission to delete my files?

jkolko
I'm new to the tool, and it looks very useful. But when I install it in Google Docs, so I can add citations, it requests permissions to add, edit, and delete all of my files. Why does this tool need permission to delete my files; if this is a grouped scoping issue in Google API, why not ask permission on a file-by-file basis, or at least make that a choice?
  • poettli
    https://www.zotero.org/support/google_docs#authorization
  • jkolko
    Yes, I know - I read that. But that wasn't the question, which was "Why does this tool need permission to delete my files"?

    Thanks -
  • dstillman
    Because that's the most granular permission available.
  • jkolko
    Why not ask permission on a file-by-file basis, or at least make that a choice?
  • dstillman
    Because that's not an option. The available permission allows editing all documents.

    External web apps can show a Google Drive file picker and limit their access to a single selected file, but that wouldn't work for a plugin like this that needs to operate on the currently open document. We can't start showing a file picker and asking people to find and re-select the document they already have open from among all of their Drive files.
  • jkolko
    Why? Understanding the usability issues, would it be possible to use https://www.googleapis.com/auth/drive.file with the file picker solution you note - Launch the picker, Ask to select the document even if it’s open, Store the resulting file ID, and then use the API on that file?

    This doesn't need to be the default behavior, it could just be an option for people who are worried about giving an app full delete access to their drive. I have no doubt you and your team are not trying to do any harm, but defects get introduced into code all the time by mistake.
  • dstillman
    edited 4 days ago
    Sorry, we're not going to do that.

    Again:
    The plugin doesn't do anything else with your document content and doesn't access documents other than the ones on which it's triggered. The integration works entirely locally on your computer, so even when you trigger the plugin on a given document, nothing is sent to Zotero servers.
    There's no scenario where the plugin starts operating on any other file in your Drive, let alone deleting files.

    But if you're not comfortable with this, I'm afraid the plugin won't work for you.
  • jkolko
    Thank you. I will probably fork; I appreciate your responses, and appreciate your making this open source.
Sign In or Register to comment.