2018-11-02 Meeting Notes

• Potential Plan
  • Seth Northrop will reach out to Jennifer Lofthus - Seth is waiting until we do our review
  • Hengyu Liu request for API access - also a developer of the same app
  • For the Campus Web API Group 
    • We will need to do a code review of the application
    • We will need to come up with language that says you will use the student credentials securely that they will need to sign
      • The language will also need to state terms of notifications for potential problems (will this make it an official endorsement which will then create legal liabilities )
      • Most likely we should use the Standard DS (Data Security) agreement
    • We will need to do periodic reviews of the application to ensure the application keeps the security standards in place
  • Our View Point on this Scenario
    • Student developed apps should be given just as much opportunity as staff developed apps
    • Their needs to be a security review of any app that is using an API which requires approval before it's approved through the Campus Web API Gateway
    • Reviews of the application will be with team that developed the application and the API Gateway Team
      • A previous review with a development team can be used to approved any future applications that they create
    • Student developed apps will need to sign extra agreements (like Security DS)
      • Staff developed apps will not need this because the agreement is already part of working on the campus
• App review update
• Request for events APIs
• Diana Antova Will request a discussion with Associated students, Sam Horowitz, Registrar and Jennifer Lofthus. 
• Planning on how to support the students, and provide continuity, either thru hire, or some other method. 

• Diana Antova - Develop Access Request Workflow Requirements (APIGEE-146)
  • Use Scheduled Task to send Email asking for more information on new Access Requests
  • Need to include asking for Form to be filled out
  • Need to include list of API Products being asked for
  • Should include a line asking if a face to face meeting would be better
• Vince Nievares - Document User Access Request Workflow for End Users (APIGEE-120)
  • Vince added text to the Using Your First API Pages.
  • He will create a full page for the whole process and link to the Access Request Form Document and how to use it.
• Diana Antova - Create Access Request Workflow for End Users (APIGEE-87)
  • Requirements: Access Request Workflow Requirements 
• Review API publishing and access request approval process with Registrar - Diana Antova
  • Meeting scheduled for Oct 5 
• How do we allow logged in users to access the form?

• Dev Portal Documentation - How To Use the Publishing Workflow (APIGEE-119) - Ian Lessing (Unlicensed)
• Steven Maglio Test the workflow with the Registrar office (APIGEE-161)
• API publishers - fill in the form for each API, and have them approved by the business owners. 
• How do we allow logged in users to access the form?

• Working on Kevin's Computer (node 8.9.X) (APIGEE-105 & APIGEE-101)
• Apigee Authorization Module (AuthApigee)
• Replacement Functionality Progress Update
  • apps 
    • apps (no|approved|revoked|pending|all)
    • apps (approve|revoke) email developerApp
    • apps (approve|revoke) email developerApp apiProduct
    • apps search
    • apps users?
      • Kevin Wu will implement?
  • devs
    • devs created <days=1>
  • targetserver
    
    • targetserver list <env>
    • targetserver (add|update) <env> <name> <hostname>
    • targetserver delete <env> <name>
  • companies
    • Kevin Wu will implement?
    • Need to build requirements
    • Need to build use cases
    • Need reporting that will display in developer.ucsb.edu
    • Need annual clean up times
• Get operational on GCP
  • Kevin Wu has determined that GCP is not the right platform for the bot because of the difficulty in setting it up.
  • Kevin Wu tried out Heroku and found it really easy to work with. He wants to know if we can use this?
    • Kevin Wu will write-up a request form and submit it to Matt Hall/Elise Meyer.
• Heroku for deployment

Steven Maglio

• Steven Maglio will compare Pingdom and Uptime Robot
• Reinard will check out Zabbix

• Can we ask campus if we can use one of the existing monitoring systems?
• will use uptime robot

• Ian Lessing (Unlicensed), Steven Maglio write requirements - use health check end point
• uptime is separate - checks for an api proxy being there, Steven is ready to deploy it to uptime robot

• More documentation, need testers that will help us define the optimal set. Can we have a link to a documentation page?
  • dedicate a meeting to documentation once a month