Scratchpad: Permissions/Data visibility

[agilaz]

Opening this issue to discuss how we want to handle permissions going forward. As far as reading data goes, we should decide what information should be publicly accessible, and what information a user should be able to control visibility of. For writing, we should consider if we want a more complex edit permissions model, or if the current system is sufficient.

We can tweak this for each data model individually depending on how we want to set this up, but reasonable groupings to discuss might be:

1. Users
2. Gyms+Routes
3. Sessions+Workouts
4. Videos

[agilaz]

I think one reasonable model would be that users, gyms, and routes are publicly discoverable, but all other data requires a mutual friendship to view.

• We could implement some sort of gym search/discovery feature, where a user can opt in to the gyms that show up on their gyms page. We could also include this information in a user's profile, so that a user's friends can easily see the gyms they follow.
• For user permissions, we could switch the current "follow" system to be a true "friends" system, where users could see and manage pending friend requests
• A user's activity feed could show all of their friends' data across all gyms

For editing data, I think the best system to go along with this is that a gym's owner can grant edit privileges (allow editing gym info and creating/updating/retiring routes) and admin privileges (allow adding other users along with deleting the gym/routes) on a user-by-user basis. We could add some convenience features like the ability to automatically grant edit access to all friends, or the ability for a user to request certain permissions rather than the owner having to initiate it, but I think those could be follow ups.

[ngattusohw]

I think that works... def think its a step in the right direction;

I think in the discovery process in order to avoid people adding duplicate gyms, we should add some quick metrics showing hours climbed // routes climbed // how many people climbed; Etc;; something like that... In hopes to delete the possibility of duplicate gyms being added.

On that topic, this is just a brain dump on some future maintenance / admin stuff that would need to be there in order to ensure a good experience for everyone involved; how its handled is up in the air but just a brain dump like I said... :

• Ability for a gym/chain like gravity vault to "Claim" a gym
• Ability to report duplicate gyms, request to delete / merge gyms
• Not to be morbid, but what happens if super admin of gym gets hit by a bus? I think we need a fluid/easy way to manage the transfer of ownership of the gym