1200777 - Allow a developer to re-use the GUID from one of his previously deleted add-ons

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Mathieu Agopian [:magopian]]

At the moment, when an add-on is (soft) deleted, its GUID is added to a blacklist, to prevent bad players from re-using it.

This would however prevent the developers themselves to reuse the GUID. To cater for that, admins (Jorge, Kris) would then remove the GUID from the blacklist on request. For that to work, we nullified the GUID of the add-on as soon as it was (soft) deleted.

What we should do instead:
1/ when a user (soft) deletes an add-ons, we don't nullify its GUID anymore (see https://github.com/mozilla/olympia/pull/612), and don't store the guid in the blacklist table either
2/ if somebody tries to submit an add-on, we check for the guid over all the add-ons (including the soft deleted ones, that's not something we did in the past, hence the blacklist table), and against the blacklisted
GUIDs (see note below)
3/ if there's an existing GUID, we forbid the submission, unless the GUID is for an add-on that is owned by the user trying to submit the new add-on
4/ if it's the owner, then we change the soft deleted addon's GUID to be something like "replaced-by-<the new add-on private key>", to keep some history about it

That should also simplify the life of reviewers, as they won't have to deal with users deleting their add-ons, hoping that they can re-submit it with the same GUID. And it gives users a way to "switch" their add-on from listed to unlisted (or the other way round).

Note: the current state is that we have 3761 blacklisted GUIDs that we can't trace back to their original add-on. This means that we can't stop using the blacklisted GUIDs table, and it also means that users that deleted their add-on before the solution presented here will still need to go through the reviewers so they manually delete the entry in the
blacklisted table, if they ever want to re-upload their add-on with the same GUID.

Comment 2

[Andrew Williamson [:eviljeff]]

https://github.com/mozilla/olympia/pull/1471

Comment 3

[Andreas Wagner [:TheOne] [use NI]]

https://github.com/mozilla/olympia/commit/c34741f3763abfefee285c5283dbf244e2b5b195