Add sharing API

[hampelm]

Add an API to let survey owners share full access & ownership with another user.

Two scenarios: Sharee already has an account. Easy:

• [ ] Add the user to the survey

Sharee does not have an account. Harder:

• [ ] Create a new user (we'll need their name and email)
• [ ] Add the user to the survey
• [ ] Create a password reset token
• [ ] Email an introductory note to the user
• [ ] Make it possible to resend the invite if it expires

[hampelm]

How does this relate to organizations? Eg is it easier to just have an organization management interface?

[prashtx]

What does "sharing" mean here? Is the second user a full owner/user for the survey? Or do they just have read rights (more relevant for private surveys)?

[hampelm]

We probably want to have both. Some orgs won't want to share all surveys with everyone. But which is easier to implement first?

[hampelm]

@prashtx Second user is a full owner.

[hampelm]

We've discussed this before, but in implementing, there are a couple hangups that have me reconsidering the sharing strategy. I vote B, which is a shift from earlier, unless there's a more straightforward way to structure A.

A. Server-side

This is what we've discussed. We'd have a route like app.put('/api/surveys/:surveyId/users', users.ensureAuthenticated, users.ensureSurveyAccess, surveys.addUser); That would find a user and add them to the survey.

Pros: Simpler client-side implementation (nicer for consumers, including any future apps we make). Easier to test.

Cons: More complicated logic to maintain. How to handle removing users from surveys? We could issue a DEL with a body, but that seems messy.

B. Client-side

In this method, most of the work would happen client-side:

1. User enters email address to share
2. API gets the user's id and sends it back to the client
3. Client adds the user's id to the survey
4. Client saves the updated survey

Pros: Less to add and test on the AP (just need to find users). Easy to remove users from a survey.

Cons: More verbose on the client. Harder to test.

[hampelm]

PUT surveys/:id/users/name@example.org

DEL surveys/:id/users/name@example.org