706069 - Apps with incomplete submission process cannot be deleted using BrowserID password

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P1)

Description

[Cristian Boldan]

Steps to reproduce:
1. Login to AMO apps page https://apps-preview-dev.allizom.org/en-US/apps/
2. Click on "Tools -> Manage my apps"
3. Click "Delete" link on an app with incomplete submission process
4. Enter your password and click "Delete App"

Expected Results:
The app is deleted and no longer showing in user uploaded apps

Actual Results:
Error message is displayed "Password was incorrect." and user is redirected to the submission process

Notes/Issues:
Verified on IE9 and Safari
Screencast for this issue http://screencast.com/t/shkEqSm2o

Comment 2

[Wil Clouser [:clouserw]]

Moving to browserid sounds like we'll need to remove password prompts for regular users and developers.  Fligtar - is that a problem?

Ben - For some parts of AMO where major changes can be done (eg. deleting an app) we prompt the user to reconfirm their password even though they have a valid session.  Is this a use case browserid has thought about or has a solution for?  Asking them to log in again with the big browserid popup could be confusing and is a heavy/jarring flow.

Comment 3

[Ben Adida [:benadida]]

(In reply to Wil Clouser [:clouserw] from comment #2)
> Ben - For some parts of AMO where major changes can be done (eg. deleting an
> app) we prompt the user to reconfirm their password even though they have a
> valid session.  Is this a use case browserid has thought about or has a
> solution for?

This is what Crystal calls "reauth", and yes we are working on exactly that. We don't support it yet.

Comment 4

[Ben Adida [:benadida]]

(In reply to Wil Clouser [:clouserw] from comment #2)
> Ben - For some parts of AMO where major changes can be done (eg. deleting an
> app) we prompt the user to reconfirm their password even though they have a
> valid session.  Is this a use case browserid has thought about or has a
> solution for?  Asking them to log in again with the big browserid popup
> could be confusing and is a heavy/jarring flow.

Here's the issue that tracks this feature:

https://github.com/mozilla/browserid/issues/895

Comment 5

[Justin Scott [:fligtar]]

I'm fine with removing the password requirement until reauth is supported.

Comment 6

[Christopher Van Wiemeersch [:cvan]]

Until reauth is supported, we will disable the password requirement (that's bug 722905).

Comment 7

[Rob Hudson [:robhudson]]

https://github.com/mozilla/zamboni/commit/62e94c8

Comment 8

[Cristian Boldan]

Verified as fixed in https://marketplace-dev.allizom.org/en-US/developers/submissions
Postfix screencast for this issue http://screencast.com/t/xCkDTZHCme
Closing bug.