Repository: cli/cli
File: pkg/cmd/auth/refresh/refresh.go (Go)

Code before:
			The minimum set of scopes (%[1]srepo%[1]s, %[1]sread:org%[1]s, and %[1]sgist%[1]s) cannot be removed.

			The %[1]s--reset-scopes%[1]s flag resets the scopes for your gh credentials to
			the default set of scopes for your auth flow.

			If you have multiple accounts in %[1]sgh auth status%[1]s and want to refresh the credentials for an
			inactive account, you will have to use %[1]sgh auth switch%[1]s to that account first before using
			this command, and then switch back when you are done.

			For more information on OAuth scopes, see
			<https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps/>.
		`, "`"),
		Example: heredoc.Doc(`
			# Open a browser to add write:org and read:public_key scopes
			$ gh auth refresh --scopes write:org,read:public_key

			# Open a browser to ensure your authentication credentials have the correct minimum scopes
			$ gh auth refresh

			# Open a browser to idempotently remove the delete_repo scope
			$ gh auth refresh --remove-scopes delete_repo

			# Open a browser to re-authenticate with the default minimum scopes
			$ gh auth refresh --reset-scopes

			# Automatically copy one-time OAuth code
			$ gh auth refresh --clipboard
		`),
		RunE: func(cmd *cobra.Command, args []string) error {
			opts.Interactive = opts.IO.CanPrompt()

			if !opts.Interactive && opts.Hostname == "" {
				return cmdutil.FlagErrorf("--hostname required when not running interactively")
			}

			opts.MainExecutable = f.Executable()
			if runF != nil {
				return runF(opts)
			}
			return refreshRun(opts)
		},
	}

	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "The GitHub host to use for authentication")
	cmd.Flags().StringSliceVarP(&opts.Scopes, "scopes", "s", nil, "Additional authentication scopes for gh to have")
	cmd.Flags().StringSliceVarP(&opts.RemoveScopes, "remove-scopes", "r", nil, "Authentication scopes to remove from gh")
	cmd.Flags().BoolVar(&opts.ResetScopes, "reset-scopes", false, "Reset authentication scopes to the default minimum set of scopes")
	cmd.Flags().BoolVarP(&opts.Clipboard, "clipboard", "c", false, "Copy one-time OAuth device code to clipboard")
	// secure storage became the default on 2023/4/04; this flag is left as a no-op for backwards compatibility
	var secureStorage bool
	cmd.Flags().BoolVar(&secureStorage, "secure-storage", false, "Save authentication credentials in secure credential store")

Review comment (security):
```suggestion
			# Open a browser to re-authenticate and copy one-time OAuth code to clipboard
```

Code after:
			The minimum set of scopes (%[1]srepo%[1]s, %[1]sread:org%[1]s, and %[1]sgist%[1]s) cannot be removed.

			The %[1]s--reset-scopes%[1]s flag resets the scopes for your gh credentials to
			the default set of scopes for your auth flow.

			If you have multiple accounts in %[1]sgh auth status%[1]s and want to refresh the credentials for an
			inactive account, you will have to use %[1]sgh auth switch%[1]s to that account first before using
			this command, and then switch back when you are done.

			For more information on OAuth scopes, see
			<https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps/>.
		`, "`"),
		Example: heredoc.Doc(`
			# Open a browser to add write:org and read:public_key scopes
			$ gh auth refresh --scopes write:org,read:public_key

			# Open a browser to ensure your authentication credentials have the correct minimum scopes
			$ gh auth refresh

			# Open a browser to idempotently remove the delete_repo scope
			$ gh auth refresh --remove-scopes delete_repo

			# Open a browser to re-authenticate with the default minimum scopes
			$ gh auth refresh --reset-scopes

			# Open a browser to re-authenticate and copy one-time OAuth code to clipboard
			$ gh auth refresh --clipboard
		`),
		RunE: func(cmd *cobra.Command, args []string) error {
			opts.Interactive = opts.IO.CanPrompt()

			if !opts.Interactive && opts.Hostname == "" {
				return cmdutil.FlagErrorf("--hostname required when not running interactively")
			}

			opts.MainExecutable = f.Executable()
			if runF != nil {
				return runF(opts)
			}
			return refreshRun(opts)
		},
	}

	cmd.Flags().StringVarP(&opts.Hostname, "hostname", "h", "", "The GitHub host to use for authentication")
	cmd.Flags().StringSliceVarP(&opts.Scopes, "scopes", "s", nil, "Additional authentication scopes for gh to have")
	cmd.Flags().StringSliceVarP(&opts.RemoveScopes, "remove-scopes", "r", nil, "Authentication scopes to remove from gh")
	cmd.Flags().BoolVar(&opts.ResetScopes, "reset-scopes", false, "Reset authentication scopes to the default minimum set of scopes")
	cmd.Flags().BoolVarP(&opts.Clipboard, "clipboard", "c", false, "Copy one-time OAuth device code to clipboard")
	// secure storage became the default on 2023/4/04; this flag is left as a no-op for backwards compatibility
	var secureStorage bool
	cmd.Flags().BoolVar(&secureStorage, "secure-storage", false, "Save authentication credentials in secure credential store")