access to and proper handling of private data from mountainhub

[emiliom]

CSO uses the MountainHub timeline API [1] to access and import mountainhub snow depth observations via the mountainhub "provider" in the cso-api import API. Currently the mountainhub timeline API does not provide access to private data.

An issue was opened [2] in February 2021 in the mountainhub API repo to develop this functionality.

Once private data become available, additional, separate work will have to be done "downstream" in CSO infrastructure to properly support this new, sensitive data:

• Modify the CSO database to add a boolean flag (a new column) indicating whether the observation is public
• Modify the CSO import API to handle both the change to the mountainhub timeline api (new public/private flag plus likely an authentication key passed to the api call) and more generically the handling of the new private/public flag (database column) across the board
• Modify the cso snapshot api to only include public data. The json file generated by the snapshot api is what's used by the web map app. Therefore, as long as the snapshot data don't include private data, no additional changes will be needed on the web map app
• Modify the cso observations api to accept a new authentication key that would include private data, and to include the private/public flag in the response

[1] A private repo in the github.com/avatech-inc (mountainhub) organization that's not accessible to everyone here

[2] Same private repo, so access is limited. I followed up today to ask about the status and plans