Sharing link gives record access to accounts that not permissioned

[ythuang123]

The staging site doesn't seem to distinguish between folks who do and don't have record access. Instead, it always gives record access even if that box isn't checked. I checked the link on multiple browsers and devices, and I'm always able to make new recordings that show up on the shared scrapbook.

I'm using: Chrome / Window 10 Enterprise v. 1909 (OS build 18563.959) / ThinkPad X1 Carbon 4G iPhone SE (version iOS 13.5.1) on Safari (latest?).

[jkhartshorne]

Interesting. I definitely had the permissioning work for me a couple days ago. MACOS 10.15.6 / chrome

On Thu, Aug 13, 2020, 9:27 PM ythuang123 notifications@github.com wrote:

The staging site doesn't seem to distinguish between folks who do and don't have record access. Instead, it always gives record access even if that box isn't checked. I checked the link on multiple browsers and devices, and I'm always able to make new recordings that show up on the shared scrapbook.

[image: image] https://user-images.githubusercontent.com/68764650/90202282-48474d80-ddab-11ea-9945-606926419d69.png [image: 2020-08-13_21-24-21_000] https://user-images.githubusercontent.com/68764650/90202436-b8ee6a00-ddab-11ea-8883-c5f66fb09715.png [image: 2020-08-13_21-24-30_000] https://user-images.githubusercontent.com/68764650/90202438-ba1f9700-ddab-11ea-803f-6318f1e43a40.png

I'm using: Chrome / Window 10 Enterprise v. 1909 (OS build 18563.959) / ThinkPad X1 Carbon 4G iPhone SE (version iOS 13.5.1) on Safari (latest?).

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/jkhartshorne/KidTalkIssues/issues/38, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABOVVY7RVUUCHNX5YRAINYDSASHHNANCNFSM4P7AKZEA .

[alexchippendale]

@ythuang123 @jkhartshorne I think there might be some confusion on "record access". We don't disable a user's ability to record anything when using the app. Anyone who logs in to an account can make recordings of their own children or themselves. This permission allows the invited user who has created their own account to also tag the inviter's child in recordings. Obviously there is no way for us to physically stop someone from making a recording with the inviter's child if they interact with them but we do not allow them to tag the that child.

Shared with only -> You can view recordings of the child in the scrapbook BUT can't tag the child in your own recordings Shared with record access (that checkmark) -> You can view recordings of the child in the scrapbook AND tag your own recordings with that child

If you are able to tag that child without record access then there is a bug, otherwise it is working as expected.

Let me know if that makes sense. We can always tweak the language to make it more clear. Thanks!

[jkhartshorne]

Yes, that's what I meant. It worked that way foe me. Yi Ting?

On Fri, Aug 14, 2020, 2:15 PM alexchippendale notifications@github.com wrote:

@ythuang123 https://github.com/ythuang123 @jkhartshorne https://github.com/jkhartshorne I think there might be some confusion on "record access". We don't disable a user's ability to record anything when using the app. Anyone who logs in to an account can make recordings of their own children or themselves. This permission allows the invited user who has created their own account to also tag the inviter's child in recordings. Obviously there is no way for us to physically stop someone from making a recording with the inviter's child if they interact with them but we do not allow them to tag the that child.

Shared with only -> You can view recordings of the child in the scrapbook BUT can't tag the child in your own recordings Shared with record access (that checkmark) -> You can view recordings of the child in the scrapbook AND tag your own recordings with that child

If you are able to tag that child without record access then there is a bug, otherwise it is working as expected.

Let me know if that makes sense. We can always tweak the language to make it more clear. Thanks!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/jkhartshorne/KidTalkIssues/issues/38#issuecomment-674200606, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABOVVY2SBCYIXOYJO3OAR6TSAV5LHANCNFSM4P7AKZEA .

[ythuang123]

@alexchippendale -- Thanks for the explanation. Very helpful. I was thinking that the "Share with only" access is like the "view only" version of a Google doc (i.e., you can see but you can't edit). But what you described about recording but not tagging is what I'm experiencing. So when someone shares, all the files go into a single scrapbook. E.g., grandpa can make recordings of himself in TX (but can't tag kiddo) while the parents + kiddo can make recordings of themselves in NJ. I don't have strong opinions about whether this function is useful or not because I don't know anyone who's used it. The record access with tagging makes sense for parents with different phones, but I'm not sure when/who it'd make sense to do the record without tagging. But thanks taking the time to explain.

[jkhartshorne]

So it occurs to me that I don't know how this was working. I think you share children, not scrapbooks. So if you share a child with someone with record permission, then when they record something AND tag the child, it'll show up in your scrapbook, too. But if they record something and don't tag that child, it should be in their scrapbook but not yours.

That's the way it was supposed to be. Is it not?

The reason for this is for mixed families. So you may have to share one child with your non-resident co-parent, but not necessarily share recordings of your step-children with your ex-spouse!

[alexchippendale]

@ythuang123 No Problem!

For your last sentence, one case I can think of off the top of my head would be another parent who uses the app who you want to give the ability to listen and comment on recordings of your child, but who you do not want to post recordings of your child. BTW to make sure it's clear, the "record access" permission you give to another user when you share your child is specifically about tagging your child, NOT the ability to tag recordings in general. The other parent you shared with can always tag their own children or family members regardless of their access to view or tag other parents' children.

[alexchippendale]

@jkhartshorne That's correct, and that's how it works currently. Access to view the child's recordings and the ability to tag that child (if given "record access") are shared, not the scrapbook itself.

[ythuang123]

@alexchippendale @jkhartshorne -- got it, thanks. Yes, it makes sense to share recordings of specific children and not the whole scrapbook. So recordings that the permissioned person (who doesn't have record access) makes shouldn't show up on the scrapbook of the permissioner. I've created more recordings with different tags, and I think that's what's happening. Thanks again for walking me through this.

[alexchippendale]

@ythuang123 Absolutely, no problem!