{"action":"created","issue":{"url":"https://api.github.com/repos/akvo/akvo-flow/issues/2522","repository_url":"https://api.github.com/repos/akvo/akvo-flow","labels_url":"https://api.github.com/repos/akvo/akvo-flow/issues/2522/labels{/name}","comments_url":"https://api.github.com/repos/akvo/akvo-flow/issues/2522/comments","events_url":"https://api.github.com/repos/akvo/akvo-flow/issues/2522/events","html_url":"https://github.com/akvo/akvo-flow/issues/2522","id":302252593,"number":2522,"title":"Handling captured photos' and videos' urls","user":{"login":"janagombitova","id":12456965,"avatar_url":"https://avatars2.githubusercontent.com/u/12456965?v=4","gravatar_id":"","url":"https://api.github.com/users/janagombitova","html_url":"https://github.com/janagombitova","followers_url":"https://api.github.com/users/janagombitova/followers","following_url":"https://api.github.com/users/janagombitova/following{/other_user}","gists_url":"https://api.github.com/users/janagombitova/gists{/gist_id}","starred_url":"https://api.github.com/users/janagombitova/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janagombitova/subscriptions","organizations_url":"https://api.github.com/users/janagombitova/orgs","repos_url":"https://api.github.com/users/janagombitova/repos","events_url":"https://api.github.com/users/janagombitova/events{/privacy}","received_events_url":"https://api.github.com/users/janagombitova/received_events","type":"User","site_admin":false},"labels":[{"id":742953694,"url":"https://api.github.com/repos/akvo/akvo-flow/labels/data%20privacy","name":"data privacy","color":"ce2b82","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-05T10:49:07Z","updated_at":"2018-03-06T11:19:45Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"This issue possibly holds multiple changes. I have put it here so we do not need to switch repositories. If needed please break down the implementation to smaller separate issues. \r\n\r\n# Context \r\n\r\nWith GDPR coming in force in May 2018 we started auditing how we treat personal data. We are looking closely on how we handle data of our users in our tools and how to handle the data our users capture in our tools, in Flow. \r\n\r\nWe agreed that access to data must fully comply with one's given roles and permissions. \r\n\r\n## Why\r\nUsers capture photos to have a visual support of their data. They capture photos of the participant, of the subject of their data collection as the well, school, farm, of documents, etc. \r\n\r\nAfterwards the photos are used to validate the data, to add to their visualisations of the data to make the insights more attractive or the photos are added to reports and other outputs. \r\n\r\n## Issue 1 - viewing photos/videos in Flow\r\nCurrently in Flow, once a photo or a video is submitted to a form, the Flow users can see the item either on the app directly, or on the online workspace by clicking the link pointing to the photo/video. This link is also exported with the data set when a user exports data. Then anyone, regardless of their access to Flow, can copy the url, paste it in her browser and see the photo/video.\r\n\r\nThis situation then means, that anyone who gets the link, can see a photo/video captured with Flow without having access to Flow.\r\n\r\n![34485165-62deee50-efc9-11e7-9ef2-9ad2313e581b](https://user-images.githubusercontent.com/12456965/36971007-b13aeee2-206a-11e8-8f64-11528b805e40.png)\r\n\r\n## Issue 2 - using photos/videos outside of Flow \r\n\r\nSecondly, users have no way currently to get the captured photos/videos out of Flow and on to their machines for further use. \r\n\r\nSome partners open the photo one by one and then download the image from the browser. I also have the feeling our Technical account managers have a script to get all the photos submitted to a question out of Flow and into a file on the computer.   \r\n\r\n# Opportunity\r\n\r\n## Opportunity for issue 1 \r\nWe must ensure data captured with Flow is only accessible when logged in to Flow and following user's roles and permissions. \r\n\r\nHow might we ensure we do not use the image urls but actually show the photos videos in the UI? How will we then handle the photo/video columns in the data exports to the image urls are not easily openly shared? \r\n\r\n## Opportunity for issue 2\r\nUsers want to be able to see the photos/videos they have captured with Flow without having to be connected to a network and want to store their photos/videos separately on their own devices. They want to be able to get a photo out of Flow and add it to a report or presentation.\r\n\r\nHow might we enable users to download all photos in a simple way?\r\n\r\n# Other older related issues:  \r\nhttps://github.com/akvo/akvo-flow/issues/1459\r\nhttps://github.com/akvo/akvo-flow/issues/683\r\n"},"comment":{"url":"https://api.github.com/repos/akvo/akvo-flow/issues/comments/370749475","html_url":"https://github.com/akvo/akvo-flow/issues/2522#issuecomment-370749475","issue_url":"https://api.github.com/repos/akvo/akvo-flow/issues/2522","id":370749475,"user":{"login":"stellanl","id":399534,"avatar_url":"https://avatars1.githubusercontent.com/u/399534?v=4","gravatar_id":"","url":"https://api.github.com/users/stellanl","html_url":"https://github.com/stellanl","followers_url":"https://api.github.com/users/stellanl/followers","following_url":"https://api.github.com/users/stellanl/following{/other_user}","gists_url":"https://api.github.com/users/stellanl/gists{/gist_id}","starred_url":"https://api.github.com/users/stellanl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stellanl/subscriptions","organizations_url":"https://api.github.com/users/stellanl/orgs","repos_url":"https://api.github.com/users/stellanl/repos","events_url":"https://api.github.com/users/stellanl/events{/privacy}","received_events_url":"https://api.github.com/users/stellanl/received_events","type":"User","site_admin":false},"created_at":"2018-03-06T11:19:45Z","updated_at":"2018-03-06T11:19:45Z","author_association":"MEMBER","body":"Some approaches to issue one: \r\n\r\n1. Make an endpoint in GAE to act as a proxy for the S3 images. It already has libraries and keys for picking up the rest of the submissions.\r\n2. Hand out some sort of (time-limited?) session token for S3 to the user's browser.\r\n3. Stop storing the images on S3 at all. Keep them in some kind of GAE storage bucket or the database itself."}}
{"actor":{"display_login":"stellanl"}}