The trouble with this approach is that it leaves the owner's data vulnerable to a malicious gadget, which could write anything it wanted into the owner's data fields.
I'll give you a hypothetical "leave comments" app to show you how I've been structuring my applications to work around this. Imagine an application where the owner installs the app to their profile and sets a text field on the application as a welcome message to display to viewers. Viewers of the app should be able to comment on the message (sort of a "wall" or "scraps" application).
First I'd check for cases where OWNER==VIEWER (the owner of the app is looking at the app on their profile). If true:
* Display an edit box so the owner can change the message to their friends
* Save all data to the VIEWER (who is the owner in this case).
Second, I'd check to see if VIEWER is in OWNER_FRIENDS (viewer is friends with the owner). If true:
* Display a box where they can add a comment
* Save the comment, a timestamp, and the owner's ID to the VIEWER's (who is the owner's friend) data store.
If neither case is true:
* Display a message to the user where the comment box would be: "Sorry, only friends of <name> can comment on this application. Why not add <name> as a friend?"
Then to render the application:
* Pull the OWNER's data to get the text to display as the top message
* Pull the OWNER_FRIENDS' data to get a list of each friend's comments, timestamps, and the id of the profile that they commented on
* If the id stored in a person's comment matches the current owner's id, the comment was made on this profile.
* Push all comments made on the current profile into an array and sort it based on the timestamps of each comment.
* Display the resulting sorted array.
Hope that helps,
~Arne
is that I've been putting in another check to see if the VIEWER is included in OWNER_FRIENDS. If this is true, then I expo