2.x.x. Security Audit

[joshuapowell]

Just to keep things on track I want to make sure that I am testing all possible permutations of our security layer. Below are a simple list of questions that the system should be able to quickly answer.

​Application

Who created/owns this Applications?

​
The Minimum Requirement for this security check would be to have a single owner field that would create a one-to-one relationship with a User and Application object, storing the resulting User.id in the Application.owner field.

The Deluxe Version would allow for multiple user's being directly associated with the Application object through an application_users table. This would allow the possibility for users to come and go (e.g., Facebook Page Admin, Google+ Page Admin) without the need for complicated transfer processes (e.g., Github.com Repo Transfer). This would also allow us to pull together Application pages on the forward facing user interface in the future giving credit to those individuals that maintain the application.

Creators/Owners of an Application can

• read and write the Application object
• read and write all associated Template objects

Template

Field

Feature Collection

Feature

Activity/Notification