1011227 - Reviewed API keys have "mozillians"-level access to user fields

Status: VERIFIED FIXED

(Participation Infrastructure :: Phonebook, defect)

Description

[Justin Crawford [:hoosteeno] [:jcrawford]]

When we undertake bug 1011209, we'll create a mechanism for any vouched user of Mozillians.org to get an API key that can access the API with "public"-level access (bug 1011220). We'll also have a class of keys that can access the API with "mozillians"-level access. These keys will have access to information that users of the platform have shared only inside the network. Therefore, they will be subject to greater scrutiny and must meet higher standards. The working name for this class of keys is "reviewed".

API users with a reviewed key can request data from any API resource and get a complete list of matching records in response, including fields on user records marked as both "public" and "mozillians".

Comment 1

[Giorgos Logiotatidis [:giorgos]]

Clarification: 

Reviewed API keys may get "mozillians" OR greater access. E.g. some keys can get "privileged" access. The level of access will be decided by the reviewers and the application needs.

Comment 2

[John Giannelos [:nemo-yiannis]]

Merged here: https://github.com/mozilla/mozillians/pull/1152

At the moment this can be done in /admin