Closed Bug 1106594 Opened 10 years ago Closed 8 years ago

Fix or remove restricted users

Categories

(Marketplace Graveyard :: Admin Tools, defect, P4)

Avenir
x86
macOS
defect

Tracking

(Not tracked)

RESOLVED WONTFIX

People

(Reporter: robhudson, Unassigned)

Details

(Whiteboard: [marketplace-transition])

In bug 753995 we added the ability to restrict user accounts. The Marketplace code has moved around a lot since then and this feature is partially broken.

Should we simply remove the remaining bits? Or should we fix what was broken?

Currently on Marketplace it looks like this feature was never used -- there are no users associated with this group.
ni: amyt, eviljeff to decide. Once decide the bug will be to execute.
Flags: needinfo?(awilliamson)
Flags: needinfo?(atsay)
I think this is a useful features, and I can see its uses.  Some thoughts:

- the implementation using permission groups seems strange to me - I can't see why this isn't a flag on the user account.  At the risk of inflating the amount of work involved somewhat, I'd say remove the group and have the UGC block be a column on user.  

- what's the use case of a UGC block vs. deleting the account.  The only reason I can think of where we'd delete an account is for spammers.  And enabling the UGC block is supposed to delete their spammy content, with the added bonus that they can't recreate the account with the same email.
Flags: needinfo?(awilliamson)
(In reply to Andrew Williamson [:eviljeff] from comment #2)
> - the implementation using permission groups seems strange to me - I can't
> see why this isn't a flag on the user account.  At the risk of inflating the
> amount of work involved somewhat, I'd say remove the group and have the UGC
> block be a column on user.  

I'd say think of this as just an implementation detail. It's a simple way to flag a user as restricted or not vs adding a new field on the user table which has 4MM records in it and takes half an hour for a migration. Sure a boolean on the user table would be simpler but at this point I wouldn't change it.

> - what's the use case of a UGC block vs. deleting the account.  The only
> reason I can think of where we'd delete an account is for spammers.  And
> enabling the UGC block is supposed to delete their spammy content, with the
> added bonus that they can't recreate the account with the same email.

I'm not sure exactly what the different use cases are but it'd be nice if we could have one way to do this if it serves all purposes. Restricted users seems like the user can still use our site but they are now limited to what they can do -- e.g. they can't submit any more reviews (which is the only restricted function at the moment).
(In reply to Rob Hudson [:robhudson] from comment #3)
> (In reply to Andrew Williamson [:eviljeff] from comment #2)
> > - what's the use case of a UGC block vs. deleting the account.  The only
> > reason I can think of where we'd delete an account is for spammers.  And
> > enabling the UGC block is supposed to delete their spammy content, with the
> > added bonus that they can't recreate the account with the same email.
> 
> I'm not sure exactly what the different use cases are but it'd be nice if we
> could have one way to do this if it serves all purposes. Restricted users
> seems like the user can still use our site but they are now limited to what
> they can do -- e.g. they can't submit any more reviews (which is the only
> restricted function at the moment).

if deleting users also removes their reviews; and deleteing users has little/no impact (i.e. it suddenly doesn't break their app installs, etc) then i'm okay with removing the duplicate functionality.
Flags: needinfo?(atsay)
(In reply to Andrew Williamson [:eviljeff] from comment #4)
> if deleting users also removes their reviews; and deleteing users has
> little/no impact (i.e. it suddenly doesn't break their app installs, etc)
> then i'm okay with removing the duplicate functionality.

It turns out that deleting a user does nothing but set deleted=True on the user model.
So deleting users is effectively entirely broken: 
After the account is 'deleted' they can log in and use the account - bug 1090370 ;
Users can't delete their own account ;
And admins deleting the account doesn't delete any of the user generated content - bug 889906

For this bug I suppose removing the UGC group and code doesn't make the user deletion issue any worse or better so isn't a blocker.
Priority: -- → P4
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WONTFIX
Whiteboard: [marketplace-transition]
You need to log in before you can comment on or make changes to this bug.