{"action":"created","issue":{"url":"https://api.github.com/repos/pculture/unisubs/issues/2625","repository_url":"https://api.github.com/repos/pculture/unisubs","labels_url":"https://api.github.com/repos/pculture/unisubs/issues/2625/labels{/name}","comments_url":"https://api.github.com/repos/pculture/unisubs/issues/2625/comments","events_url":"https://api.github.com/repos/pculture/unisubs/issues/2625/events","html_url":"https://github.com/pculture/unisubs/issues/2625","id":172466860,"number":2625,"title":"Use stable ids instead of usernames","user":{"login":"bendk","id":1012809,"avatar_url":"https://avatars.githubusercontent.com/u/1012809?v=3","gravatar_id":"","url":"https://api.github.com/users/bendk","html_url":"https://github.com/bendk","followers_url":"https://api.github.com/users/bendk/followers","following_url":"https://api.github.com/users/bendk/following{/other_user}","gists_url":"https://api.github.com/users/bendk/gists{/gist_id}","starred_url":"https://api.github.com/users/bendk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bendk/subscriptions","organizations_url":"https://api.github.com/users/bendk/orgs","repos_url":"https://api.github.com/users/bendk/repos","events_url":"https://api.github.com/users/bendk/events{/privacy}","received_events_url":"https://api.github.com/users/bendk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"bendk","id":1012809,"avatar_url":"https://avatars.githubusercontent.com/u/1012809?v=3","gravatar_id":"","url":"https://api.github.com/users/bendk","html_url":"https://github.com/bendk","followers_url":"https://api.github.com/users/bendk/followers","following_url":"https://api.github.com/users/bendk/following{/other_user}","gists_url":"https://api.github.com/users/bendk/gists{/gist_id}","starred_url":"https://api.github.com/users/bendk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bendk/subscriptions","organizations_url":"https://api.github.com/users/bendk/orgs","repos_url":"https://api.github.com/users/bendk/repos","events_url":"https://api.github.com/users/bendk/events{/privacy}","received_events_url":"https://api.github.com/users/bendk/received_events","type":"User","site_admin":false},"assignees":[{"login":"bendk","id":1012809,"avatar_url":"https://avatars.githubusercontent.com/u/1012809?v=3","gravatar_id":"","url":"https://api.github.com/users/bendk","html_url":"https://github.com/bendk","followers_url":"https://api.github.com/users/bendk/followers","following_url":"https://api.github.com/users/bendk/following{/other_user}","gists_url":"https://api.github.com/users/bendk/gists{/gist_id}","starred_url":"https://api.github.com/users/bendk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bendk/subscriptions","organizations_url":"https://api.github.com/users/bendk/orgs","repos_url":"https://api.github.com/users/bendk/repos","events_url":"https://api.github.com/users/bendk/events{/privacy}","received_events_url":"https://api.github.com/users/bendk/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2016-08-22T14:27:58Z","updated_at":"2016-09-09T13:58:41Z","closed_at":null,"body":"Users can change their usernames in amara, this poses issues whenever we want to use the username as an identifier.  Particularly in the API.\r\n\r\nFor example, suppose I get a username returned in the video.added_by field, or as one of the collaborators in the subtitle request field.  If I try to look up info on that user later, there's no guarantee that they will still have the same username.  In fact, it's possible that a totally different user now has the username.\r\n\r\nOne fix for this is to start using a different identifier that doesn't change.  The id field could be used, although I don't know how great that is since it's an auto-increment field so someone could easily guess them.  I can't think of a particular security issue with that, but there's a possibility.  I think the best way would be either to create a new field that stores a random value, or to encrypt the userid field using our secret key.\r\n\r\nWe then would need to update the API code:\r\n  - Return the identifier in all API responses rather than the username\r\n  - Allow both usernames and user identifiers in the `/api/users/` resource.\r\n   - To do this, we need a way of differentiating usernames from user ids.  Maybe we make all user ids start with a special character.  The only issue is what character, `$` and `@` are in use.  `%` is open, but that's an sql operator so maybe it's not the best.  `!` and `*` are open, although they seem a bit ugly to me.\r\n   - An alternative is to use a different path like `/api/users/ids/`.  Seems a bit ugly to me\r\n   - One more alternative is to add a query param, like `?lookup=id`.  I don't love that changing the querystring changes what resource is referred to, but I think it would work.\r\n   - One nice thing about any of these schemes is that we could extend them to work with alternate identifiers.  For example, we store identifiers for some of our partners.  We could extend the scheme to allow them to use those ids instead of our own ids, or usernames.\r\n\r\nThere's also the non-api issues.  These seem less important, but there could be problems here.\r\n  - We several batch import methods that use usernames to identify users\r\n  - The various ways users interact in a team.  For example, I remember working with \"babyface123\" on a previous collaboration.  But if I now see that username again, maybe it's a different user"},"comment":{"url":"https://api.github.com/repos/pculture/unisubs/issues/comments/245920732","html_url":"https://github.com/pculture/unisubs/issues/2625#issuecomment-245920732","issue_url":"https://api.github.com/repos/pculture/unisubs/issues/2625","id":245920732,"user":{"login":"PCF-Testing","id":288455,"avatar_url":"https://avatars.githubusercontent.com/u/288455?v=3","gravatar_id":"","url":"https://api.github.com/users/PCF-Testing","html_url":"https://github.com/PCF-Testing","followers_url":"https://api.github.com/users/PCF-Testing/followers","following_url":"https://api.github.com/users/PCF-Testing/following{/other_user}","gists_url":"https://api.github.com/users/PCF-Testing/gists{/gist_id}","starred_url":"https://api.github.com/users/PCF-Testing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PCF-Testing/subscriptions","organizations_url":"https://api.github.com/users/PCF-Testing/orgs","repos_url":"https://api.github.com/users/PCF-Testing/repos","events_url":"https://api.github.com/users/PCF-Testing/events{/privacy}","received_events_url":"https://api.github.com/users/PCF-Testing/received_events","type":"User","site_admin":false},"created_at":"2016-09-09T13:58:41Z","updated_at":"2016-09-09T13:58:41Z","body":"/videos/[video-id]/languages/[language_code]/subtitles/notes/ still has \"user\" parameter that returns username as the value. Example:\r\n\r\n       {\r\n            \"user\": \"evaluator1\",\r\n            \"created\": \"2016-07-12T09:14:49Z\",\r\n            \"body\": \"test\"\r\n        }"}}
{"actor":{"display_login":"PCF-Testing"}}