[Feature] Add option to add deploy history to widget

[Hahlh]

Especially for use cases with only one site (which should be the majority?) there is a lot of free space to put to good use:

It would be wonderful to be able to:

• see the history of past deploys
• see what triggered those deploys
• see how long the deploys took
• ..

Anymore ideas? 🙂

[mornir]

https://github.com/robinpyon/sanity-plugin-dashboard-widget-vercel 🤤

[Hahlh]

We gotta get @robinpyon to start using Netlify 😁

[mornir]

The following plugin has a deeper integration with Netlify, using the Netlify API with a registered oauth application: https://github.com/dorelljames/sanity-plugin-netlify-deploy-status-badge

But in my case, I work for a web agency making websites for many clients, which do not have access to our Netlify account. But the only way to get access to the deploy logs (if they are set to private) is to login into Netlify within the Studio (oauth), which our clients cannot do (I could login for them, but then I don't know how long the login is valid). It's also a pain to register an oauth application for every website. And the whole thing is probably not very wise in terms of security.

That is why I came to the conclusion that the authentication required to access the deploys endpoint is an overkill compared to what is provided for my content editors.

The best would be for Netlify to allow for users to generate auth token scoped to websites and specific endpoints (like for the build token).

sanity-plugin-netlify-deploy-status-badge (and probably sanity-plugin-dashboard-widget-vercel) only make sense if the owner of the Sanity account and of the Netlify account is the same organisation.

@dorelljames sorry to ping you, but do you share the same opinion (especially about the last part)?

[dorelljames]

@mornir personally, I held back implementing using Personal Tokens which would solve everyone's problem especially in your case where your clients don't have access to your Netlify account. The primary reason why is that the generated token means overall access, and when I say overall, I mean everything, like e-v-e-r-y-t-h-i-n-g. In so many ways it could go so wrong. I'm not even 100% sure that the OAuth route is secure enough but at least upon careful consideration, I thought we could just go with it.

Anyhows, I sort of kinda agree that it's probably best if we could generate a token with scopes, much more like how we can create one in GitHub. But that's probably something that would require much time to develop and I don't think it's within Netlify's interest as of yet.

PS: This plugin never asked for any tokens or Oauth or anything that has to deal with authorization, and it is designed as it should be. Beyond the features that are implemented already, it's not possible yet.

[Hahlh]

I suppose that creating a thread in Netlify's community forum linking to this issue would be a good first step to get eyes on this use case and maybe even get it on the agenda at some point. Or there might come up a worthwhile workaround that allows for more details.

I will go ahead and create that thread. As soon as I have done so, I will link it here.

Thank you @dorelljames and @mornir for pointing out the security implications.

[Hahlh]

It seems that there is already a feature request that would fit that bill:

https://answers.netlify.com/t/restrict-auth-tokens-to-certain-actions-create-deploy/24098

I roughly described the problem and linked to this issue.

Please consider adding your support and voice, if you believe this feature is important.