729370 - Enforce restrictions on users with developer privileges

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Description

[krupa raj[:krupa]]

steps to reproduce:
1. Log in to an account with developer privileges.
2. Load https://marketplace-dev.allizom.org/en-US/developers/app/linerage-1/payments
3. Notice that the 'Save changes' button is enabled.
4. Load https://marketplace-dev.allizom.org/en-US/developers/app/linerage-1/ownership
5. Notice that the 'Save changes' button is enabled.

expected behavior:
Users with developers privileges shouldn't be able to edit Authors or Payments.

actual behavior:
The buttons are enabled on both pages for users with Developer privileges. Upon edit, a blank pages loads with a 403 status. We shouldn't allow that though.

Comment 1

[Rob Hudson [:robhudson]]

https://github.com/mozilla/zamboni/commit/1e7b7e4

Comment 2

[Rob Hudson [:robhudson]]

Reverted b/c it wasn't working before our push.

Comment 3

[Rob Hudson [:robhudson]]

https://github.com/mozilla/zamboni/commit/89fe578

Comment 4

[krupa raj[:krupa]]

Why are we not allowing developers to disable an app?

Also, the last time I checked with fligtar he was okay with allowing developers to set up Paypal.

Comment 5

[Wil Clouser [:clouserw]]

Spec says Developer have access to "everything except Authors and Payments".  Fair to say Developers can't disable the app either if they can't do those operations.

https://docs.google.com/document/d/1-Zb-foJIQL5LyjQc53bN2hhibiIPD3ZOzbopl45Ywy0/edit

Comment 6

[Rob Hudson [:robhudson]]

Allowing devs to enable/disable apps (which is what we allow in the view):
https://github.com/mozilla/zamboni/commit/9ef57d2

Comment 7

[krupa raj[:krupa]]

This works now. Thanks, rob!