Allow deletion of incomplete add-ons?

RESOLVED FIXED in 5.12.4

Status

enhancement
P2
normal
RESOLVED FIXED
10 years ago
4 years ago

People

(Reporter: wenzel, Assigned: davedash)

Tracking

unspecified
5.12.4
Dependency tree / graph

Details

Attachments

(1 attachment)

A user approached me today asking how to delete their add-on. As usual, I mentioned the security risk from "stealing" the GUID, then helped the user by admin-disabling the add-on.

The add-on still seems to show up on his DevCP dashboard however, which makes little sense.

I can think of several possible solutions here:
a) allow deletion of add-ons that are still incomplete and have never been on the AMO site. This way, nobody ever downloaded it, and thus the GUID stealing risk does not exist here.
b) Do not show the user admin-disabled (status = disabled) add-ons in their dev CP anymore, or:
c) hide such add-ons by default and only show them in the user's dev cp at the click of a button.

CCing fligtar who may know more about the rationale behind (not) deleting add-ons and showing/not showing them to the author when disabled.
The user that requested the deletion was me.
As Frédéric Wenzel already mentioned, my extension was still incomplete, so no harm, if I had the option to delete it. (I had to change the guid of the extension in the last second).

In the screenshot, you can see my dashboard with the disabled extension. I deleted the name before it was disabled, so it looks a bit confusing right now.
If we allowed deletion of incomplete add-ons we'd have to track "ever complete" somewhere (like bugzilla does).  Now showing admin-disabled add-ons by default seems easier.  It could be confusing in some cases though, e.g. an author is on vacation and can't respond so we disable his problem add-on.  When he comes back he can't find it in his dev CP.
Admin-disabled add-ons look a bit nicer in the dashboard of the new tools and say that if you have any questions about why your add-on was disabled, to email amo-admins. I think it's important to show it there, otherwise it seems like a bug that the add-on just disappeared.
Perhaps you could add a checkbox or some option to hide disabled add-ons in the dev tools so that it's up to the user.
I think admins should be able to delete add-ons for real or they can disable an add-on.  When an add-on is disabled it shouldn't show up for authors.
Severity: normal → enhancement
Priority: -- → P4
Target Milestone: --- → 4.x (triaged)
Proposal:
- A user can delete their add-on if it's being used by less than 100 users, regardless of status.  After that the UI for deletion is greyed out with a reason that says why.
- Deleting an add-on is permanent and there is no undo.
- A user can elect to disable their add-on at any time.  This can be undone any time.
- An admin can permanently delete any add-on, regardless of users. (permission bit: Admin:DeleteAnyAddon)
- An admin can disable any add-on.  In that case the add-on can only be reenabled by an admin.  Chowse/Jorge can help us figure out the messaging for users and whether it should show up in their control panel by default. (permission bit: Admin:DisableAnyAddon)

Something else which isn't directly related but worth noting is that we do have the ability to blacklist add-on GUIDs right now, so if we need to prevent a GUID from appearing on AMO we can do so.
Assignee: nobody → fligtar
Blocks: 586704
Whiteboard: [ddn]
Target Milestone: 4.x (triaged) → 5.12.1
I think admin-disabled add-ons should be fully accessible from the developer hub. The add-on status should indicate that it has been disabled by an admin.

Regarding the messaging to users, I'm not sure if we should show something more than "add-on not found". Maybe something like "this add-on has been disabled by an admin. To learn more about it, contact us at <amo-editors>".
Not sure what the point of restricting a developer from deleting an add-on?  I understand that it can have some negative effects, but it is *their* add-on and it can be equally destructive to just delete the versions of said add-on which I don't believe is restricted.
Add-on deletion by developers is part of the new Dev Tools, as explained in the "Add-on Deletion" section of the spec: https://docs.google.com/Doc?id=dfntthnr_78f58ztkfz
Assignee: fligtar → nobody
Whiteboard: [ddn]
Thanks.  Kicking to 5.12.2.  DD is doing the deletion via the API, so I think this will fit in well.  This remains a P4.
Assignee: nobody → dd
Target Milestone: 5.12.1 → 5.12.2
Will do the backend once gko is done with his stuff.
Depends on: 599041
Bump this into 5.12.3 since I'm waiting on a blocker.
Target Milestone: 5.12.2 → 5.12.3
Priority: P4 → P2
Target Milestone: 5.12.3 → 5.12.4
http://github.com/jbalogh/zamboni/commit/3741c59
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.