Handling Nebula User Data (Long-term)

[WillieCubed]

We need to develop a separate repository layer to store user data synced from Nebula services, including Planner and the Guide. How would we go about doing that?

@CharlieMahana document your thoughts here.

[CharlieMahana]

Since we're already in the process of developing three applications simultaneously with the goal of developing and integrating more in the future, I would advise for the use of creating a Nebula Profile that would be used across all Nebula applications. Creating a Nebula Profile would solve a lot of problems by putting all Nebula user data in one central location that could be streamlined to provide Nebula-wide data syncing, an SSO authentication provider, and an authorization handler for Nebula Apps.

Data Security
With all sensitive data handled by a single Nebula system, we'll be able to better secure Nebula as a whole by enabling us to focus security efforts on one central system with dedicated security maintainers. This would likely improve security as a distributed security system across multiple applications will inevitably be inconsistent and security vulnerabilities could be harder to locate and patch. The only downfall of a centralized system is that there is much more pressure for this team to get it right. Fortunately, any security patches on this system would inevitably affect all of Nebula instantaneously making response times much faster.

Authentication
With a centralized authentication system, we could implement SSO across Nebula using SAML by sending the authentication data/certs to each Nebula application.

Authorization
With all data centralized in one location, we would have to distribute identity certificates to all Nebula applications so that they could access, read, and update data user data. We could easily assign privileges to each system so that they only have the authorization to read and manipulate respective user data.

Privacy
With a central data platform for Nebula, meeting user requests to see what data we have about them and deleting their data in the event that they request an account deletion becomes trivial.

I certainly haven't covered all the benefits and potential concerns of this sort of system since I've only given it one days worth of thought but I'd like to hear what everyone else thinks about this sort of system. It could be a reasonable amount of work upfront but would greatly reduce development overhead for future Nebula app integration. Please list your opinion on this as well as any thoughts or concerns.