Decide: viewer access to raw usage rows vs calculated summaries only #17

New issue

Closed

opened 2026-07-17 01:17:58 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-17 01:17:58 +00:00

Contributor

Open Question carried over from docs/roadmap.md.

Do viewers need access to raw usage rows, or only calculated summaries and reports?

Privacy-relevant: hourly whole-home usage data reveals occupancy patterns. A ''viewer'' shared with someone outside the household is a different trust level than a co-owner.

Current state: viewer/editor/owner authorization is enforced on home-scoped routes, and role-aware shared dashboards exist. This question is about whether the viewer role should be able to reach the raw usage rows at all, or be restricted to aggregates.

Answering this may narrow existing route permissions rather than add new code.

Open Question carried over from `docs/roadmap.md`. > Do viewers need access to raw usage rows, or only calculated summaries and reports? Privacy-relevant: hourly whole-home usage data reveals occupancy patterns. A ''viewer'' shared with someone outside the household is a different trust level than a co-owner. Current state: viewer/editor/owner authorization is enforced on home-scoped routes, and role-aware shared dashboards exist. This question is about whether the viewer role should be able to reach the raw `usage` rows at all, or be restricted to aggregates. Answering this may narrow existing route permissions rather than add new code.

claude-bot added this to the Open Questions milestone

2026-07-17 01:17:58 +00:00

claude-bot added the

decision

label

2026-07-17 01:17:58 +00:00

claude-bot referenced this issue

2026-07-17 03:07:15 +00:00

Add admin authorization to /api/admin/* and /api/users #27

claude-bot commented

2026-07-17 15:21:16 +00:00

Author

Contributor

Decision (Ryan, 2026-07-17): viewers get aggregates, calculated summaries, and reports only — no raw hourly usage rows.

Rationale: hourly whole-home data reveals occupancy patterns, and nothing a viewer legitimately needs requires row-level access. A viewer shared outside the household is a different trust level than a co-owner.

Implementation: narrow the existing route permissions so raw usageReadings (and any other row-level usage endpoints) require editor/owner, leaving calculation results, analytics summaries, and reports at viewer level. This is folded into the #27 authorization pass — one trust-boundary PR instead of two.

Closing as decided; implementation tracked in #27.

**Decision (Ryan, 2026-07-17): viewers get aggregates, calculated summaries, and reports only — no raw hourly usage rows.** Rationale: hourly whole-home data reveals occupancy patterns, and nothing a viewer legitimately needs requires row-level access. A viewer shared outside the household is a different trust level than a co-owner. Implementation: narrow the existing route permissions so raw `usageReadings` (and any other row-level usage endpoints) require editor/owner, leaving calculation results, analytics summaries, and reports at viewer level. This is folded into the #27 authorization pass — one trust-boundary PR instead of two. Closing as decided; implementation tracked in #27.

claude-bot referenced this issue

2026-07-17 15:21:16 +00:00

Add admin authorization to /api/admin/* and /api/users #27

claude-bot closed this issue

2026-07-17 15:21:20 +00:00