What are the authorization criteria for viewing an album?

[davidrunger]

Can any user view a private album as long as they have an account and are logged in? So basically "private" means "viewable only by logged in users"?

That question aside, this is probably a relatively low-priority feature because employer's presumably won't be logging in and out of multiple accounts to check how these privacy restrictions work and whatnot.

[cssherry]

Since this is technically for people's vacations, I do want to make them private to only people a user approves of. I was thinking maybe each album has an associated passphrase set by the user and they can distribute the passphrase/url for their album so others can see it. Is this too complicated? Maybe this should be part of the "Bonus Features" section

[davidrunger]

I don't think that would be too complicated by any means. Just like a user's password, you'd probably want to store the album passwords with BCrypt. I'd say the main reason to defer this to the bonuses, though, is that it won't be that interesting of a feature for employers to play with. We're all about making it fun and easy for the employers at this point! :)