As this is a group to-do app, there should be groups. And preferably not just a single group that everyone is a part of.

Some important parts of the app that aren't part of the group flow:
Landing page
Registration page
Group creation page

Groups should have the option of being private. A private group is password protected. The password lets a user view the group page, where there is a button to let the user join the group.

Make sure that user has the correct permissions for the api call that is being made.

For example, for a private group, only users within the group should be able to get the events in that group.

I'm thinking that all api methods should be rewritten as callback methods that get passed into a method that determines the user's permissions then calls the callback with an object specifying the user's permissions for that group.

I've been using group-do throughout the project, but I'm not set on it yet. Firstly, if I do want to go with some variant of "Group do", I could go with any of the following:
groupdo
group-do
groupDO
GroupDo
Group Do

I also like "Let's do" or some variant of that:
letsdo
lets-do
let's-do
letsDO
let'sDO
LetsDo
Let'sDo
Lets Do
Let's Do

Users should be able to vote on events

This way, what's sent in plaintext over the wire is a hash of the password.

This obviously doesn't really provide security, but it at least shields the plaintext of the password. This is important in the (pretty likely) case that the user uses the same password for other services. This is just for development. Eventually I won't need to do this because I'll be using HTTPS.

Groups should have admins. The creator would automatically be added to the admin group. This would just be implemented as a User array in the Group model called admins.

Admins would have the power to:

• boot users
• delete events?
• add/demote other admins?
• etc.

Maybe only the creator should be able to add/demote admins. So the creator is kind of a superadmin.

For example, getEvents should return all events in a certain group, not all of the events in the system.

Users should be able to leave comments on events

Make it look nice. I'll try to make it look nicer later, but it should look like I at least spent a few minutes on it.

Get rid of TODOs. Clarify unclear parts.

All of the group related stuff, like adding events, commenting or voting on events, etc. should be on a single page.

Handle forgotten passwords. This might mean I'll need to collect the user's email address.

If an unauthenticated user goes to a page they shouldn't be on, whether it's through the normal flow of the app, or by just typing the url into the browser, they should be redirected away from it.

Facebook auth might make sense here. There's really no need for a separate account. It's a more trusted identity, it comes with a picture, this removes the need for #14 . I guess the only downsides are that some people don't like using Facebook auth or Facebook in general, and the fact that I have the app depend on Facebook.

Currently, all of the session info is destroyed when the server is killed. Use connect-mongoose or connect-redis to store the session info in a database.

When creating a new user, the username should not already be taken.