{"action":"created","issue":{"url":"https://api.github.com/repos/realistforeningen/rf-members/issues/2","labels_url":"https://api.github.com/repos/realistforeningen/rf-members/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/realistforeningen/rf-members/issues/2/comments","events_url":"https://api.github.com/repos/realistforeningen/rf-members/issues/2/events","html_url":"https://github.com/realistforeningen/rf-members/issues/2","id":67589133,"number":2,"title":"Authorization and accountability","user":{"login":"judofyr","id":499,"avatar_url":"https://avatars.githubusercontent.com/u/499?v=3","gravatar_id":"","url":"https://api.github.com/users/judofyr","html_url":"https://github.com/judofyr","followers_url":"https://api.github.com/users/judofyr/followers","following_url":"https://api.github.com/users/judofyr/following{/other_user}","gists_url":"https://api.github.com/users/judofyr/gists{/gist_id}","starred_url":"https://api.github.com/users/judofyr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/judofyr/subscriptions","organizations_url":"https://api.github.com/users/judofyr/orgs","repos_url":"https://api.github.com/users/judofyr/repos","events_url":"https://api.github.com/users/judofyr/events{/privacy}","received_events_url":"https://api.github.com/users/judofyr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-04-10T12:57:46Z","updated_at":"2015-04-12T12:35:47Z","closed_at":null,"body":"A few issues:\r\n\r\n- We probably want several user levels (e.g. not everyone can add lifetime members or delete old members).\r\n- But we don't want each user of the app to have a separate account. What's going to happen is that the password to one account will to shared anyway, so we can't really protect against this.\r\n\r\nI'm suggesting this:\r\n\r\n- We add a `added_by (string)` column to `members` (good idea @velfundert!)\r\n- We have two passwords that are hardcoded in the config file. One for admin, one for \"regular\" access.\r\n- When users log in they type their own name and the password. The name is only for the `added_by` and it can be anything. It's not checked or anything."},"comment":{"url":"https://api.github.com/repos/realistforeningen/rf-members/issues/comments/92050092","html_url":"https://github.com/realistforeningen/rf-members/issues/2#issuecomment-92050092","issue_url":"https://api.github.com/repos/realistforeningen/rf-members/issues/2","id":92050092,"user":{"login":"velfundert","id":6074094,"avatar_url":"https://avatars.githubusercontent.com/u/6074094?v=3","gravatar_id":"","url":"https://api.github.com/users/velfundert","html_url":"https://github.com/velfundert","followers_url":"https://api.github.com/users/velfundert/followers","following_url":"https://api.github.com/users/velfundert/following{/other_user}","gists_url":"https://api.github.com/users/velfundert/gists{/gist_id}","starred_url":"https://api.github.com/users/velfundert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/velfundert/subscriptions","organizations_url":"https://api.github.com/users/velfundert/orgs","repos_url":"https://api.github.com/users/velfundert/repos","events_url":"https://api.github.com/users/velfundert/events{/privacy}","received_events_url":"https://api.github.com/users/velfundert/received_events","type":"User","site_admin":false},"created_at":"2015-04-12T12:35:47Z","updated_at":"2015-04-12T12:35:47Z","body":"I think:\r\n\r\n1. It won't be a problem for HS to temporarily run the server if they wanted to check the memberships\r\n2. If you want to read info about the memberships you should use the verified database, which won't be the same as the one this app is using.\r\n3. If you want proper statistics you probably want to use a different app anyway \r\n4. If we want anyone to be able to check their memberships, we should make a different app that doesn't need authorization, and reads from the verified database."}}