{"action":"created","issue":{"url":"https://api.github.com/repos/codeforamerica/clean/issues/341","labels_url":"https://api.github.com/repos/codeforamerica/clean/issues/341/labels{/name}","comments_url":"https://api.github.com/repos/codeforamerica/clean/issues/341/comments","events_url":"https://api.github.com/repos/codeforamerica/clean/issues/341/events","html_url":"https://github.com/codeforamerica/clean/issues/341","id":57858823,"number":341,"title":"Store verification documents and send links to HSA (not attachments)","user":{"login":"daguar","id":994938,"avatar_url":"https://avatars.githubusercontent.com/u/994938?v=3","gravatar_id":"","url":"https://api.github.com/users/daguar","html_url":"https://github.com/daguar","followers_url":"https://api.github.com/users/daguar/followers","following_url":"https://api.github.com/users/daguar/following{/other_user}","gists_url":"https://api.github.com/users/daguar/gists{/gist_id}","starred_url":"https://api.github.com/users/daguar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daguar/subscriptions","organizations_url":"https://api.github.com/users/daguar/orgs","repos_url":"https://api.github.com/users/daguar/repos","events_url":"https://api.github.com/users/daguar/events{/privacy}","received_events_url":"https://api.github.com/users/daguar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/codeforamerica/clean/labels/dev","name":"dev","color":"009800"},{"url":"https://api.github.com/repos/codeforamerica/clean/labels/ready","name":"ready","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"daguar","id":994938,"avatar_url":"https://avatars.githubusercontent.com/u/994938?v=3","gravatar_id":"","url":"https://api.github.com/users/daguar","html_url":"https://github.com/daguar","followers_url":"https://api.github.com/users/daguar/followers","following_url":"https://api.github.com/users/daguar/following{/other_user}","gists_url":"https://api.github.com/users/daguar/gists{/gist_id}","starred_url":"https://api.github.com/users/daguar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daguar/subscriptions","organizations_url":"https://api.github.com/users/daguar/orgs","repos_url":"https://api.github.com/users/daguar/repos","events_url":"https://api.github.com/users/daguar/events{/privacy}","received_events_url":"https://api.github.com/users/daguar/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-02-16T22:29:18Z","updated_at":"2015-02-18T08:07:36Z","closed_at":null,"body":"We've experienced the pain of submitting verification documents by creating giant attachments and sending over email to the agency ( #333, #331 ). SendGrid limits us to ~20mb emails, and even if they didn't, we'd hit major issues relatively soon with big attachments.\r\n\r\nHere's what I think the an MVP spec for this looks like:\r\n\r\n- User flow:\r\n - Same flow for as now for the applicant/assistor\r\n - For the agency receiving the email, they would now receive an email with a URL instead of an attachment: the URL would still be for a password-protected zip file, but that zip file would contain two PDFs (application + verification documents)\r\n- Backend:\r\n - Store as binary data in Postgres (or S3, though I have some security concerns there)\r\n\r\nRandom questions:\r\n- Do we combine all the documents into one like before? Or do we just give individual files? (Which may be higher quality, since no Imagemagick conversion occurs.)\r\n- *Securing the files*\r\n - Do we make downloading the files require some sort of login? (basic authentication? actual login system for agencies? I'd vote basic auth at max for now.)\r\n - Do we password-protect the files (like an encrypted, password-protected zip as currently?)\r\n - Or do we do the minimum: provide an obfuscated URL over HTTPS (I don't recommend this; seems too insecure.)\r\n- How long do we store files for?\r\n- Should we use S3, or store the files as binary data in Postgres? (I'd probably vote S3, but some security considerations.)\r\n- Do we put both the application and the verification documents in the same zip file? Or do we want to attach the application and use a URL for the documents only?\r\n"},"comment":{"url":"https://api.github.com/repos/codeforamerica/clean/issues/comments/74826898","html_url":"https://github.com/codeforamerica/clean/issues/341#issuecomment-74826898","issue_url":"https://api.github.com/repos/codeforamerica/clean/issues/341","id":74826898,"user":{"login":"lippytak","id":2533112,"avatar_url":"https://avatars.githubusercontent.com/u/2533112?v=3","gravatar_id":"","url":"https://api.github.com/users/lippytak","html_url":"https://github.com/lippytak","followers_url":"https://api.github.com/users/lippytak/followers","following_url":"https://api.github.com/users/lippytak/following{/other_user}","gists_url":"https://api.github.com/users/lippytak/gists{/gist_id}","starred_url":"https://api.github.com/users/lippytak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lippytak/subscriptions","organizations_url":"https://api.github.com/users/lippytak/orgs","repos_url":"https://api.github.com/users/lippytak/repos","events_url":"https://api.github.com/users/lippytak/events{/privacy}","received_events_url":"https://api.github.com/users/lippytak/received_events","type":"User","site_admin":false},"created_at":"2015-02-18T08:07:36Z","updated_at":"2015-02-18T08:07:36Z","body":"And not to mix issues but this may be a good time to redo the frontend (or a bad time?). For starters we should probably allow multiple file selection so users don't have to repeat the same flow over and over. We could use something like: https://blueimp.github.io/jQuery-File-Upload/ (supports all our things: https://github.com/blueimp/jQuery-File-Upload#browsers) but not sure how it interacts with camera etc."}}