{"comment":{"url":"https://api.github.com/repos/amiv-eth/amivapi/comments/16525911","html_url":"https://github.com/amiv-eth/amivapi/commit/1d3a88c0129e74e1808659a96ec4f9b71e89c355#commitcomment-16525911","id":16525911,"user":{"login":"NotSpecial","id":7079143,"avatar_url":"https://avatars.githubusercontent.com/u/7079143?v=3","gravatar_id":"","url":"https://api.github.com/users/NotSpecial","html_url":"https://github.com/NotSpecial","followers_url":"https://api.github.com/users/NotSpecial/followers","following_url":"https://api.github.com/users/NotSpecial/following{/other_user}","gists_url":"https://api.github.com/users/NotSpecial/gists{/gist_id}","starred_url":"https://api.github.com/users/NotSpecial/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NotSpecial/subscriptions","organizations_url":"https://api.github.com/users/NotSpecial/orgs","repos_url":"https://api.github.com/users/NotSpecial/repos","events_url":"https://api.github.com/users/NotSpecial/events{/privacy}","received_events_url":"https://api.github.com/users/NotSpecial/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":null,"commit_id":"1d3a88c0129e74e1808659a96ec4f9b71e89c355","created_at":"2016-03-06T22:28:02Z","updated_at":"2016-03-06T22:28:02Z","body":"Consider this:\r\n\r\nBefore the patch, anybody could indeed sign up for any amiv event like excursions etc. or join various groups only intended to be public for amiv members (e.g. a group to receive amiv board meeting minutes)\r\n\r\nSo either we would need more logic to differentiate between \"can log in\" or \"can log in and is actually member\" or require some admins to check all signups etc.\r\n\r\nOn the other hand I can only think of one two events we did where non amiv members could join: lan party and skiing weekend, and I think the latter one has signups done for each organisation independently anyways.\r\n\r\nOur authentication logic is already the biggest part of our api and I dont think the use cases justify making it more complicated.\r\n\r\nFor the few events that require signup from all eth members i think our email singup for public events is good enough.\r\n\r\nFor those reasons I implemented the harder restrictions. Am I maybe missing something?"}}