jbearer / MusicHack

Virtual jukebox for the Spring '16 5c Hackathon
0 stars 0 forks source link

TODO: Let admins add more admins after network creation #8

Open hmc-cs-jbearer opened 8 years ago

hmc-cs-jbearer commented 8 years ago

This could potentially be tricky security-wise. Our Firebase rules can check when a new network is being created (ie the old data doesn't exist) and enforce that the creator and only the creator is an admin. But it's harder, when the network already exists and we're adding more admins, to verify that the request to add an admin is coming from an admin and not someone malicious trying to add themselves.

Maybe we could do some kind of token exchange: the existing admin sends the potential new admin an invitation with a token. When the new admin accepts the invitation they make a request to add themselves to the list of admins using the token as verification. While the invitation is pending we store the token in Firebase somewhere, then when the request comes in we compare it to the stored token, add the new admin (assuming the token checks out) and then destroy the token.

jbearer commented 8 years ago

Security rules should allow this for open networks (security-tests.json:286) we just need to build this feature into the front end.