895054 - Warn developers that require features that require privileges greater than their app requests

Status: RESOLVED DUPLICATE of bug 879049

(Marketplace Graveyard :: Validation, defect)

Description

[krupa raj[:krupa]]

With buchets, we detect APIs being used by the app and also allow the developer to select additional apis from a list during submission and mark them as "required". However, we don't enforce that the app have the right levels of privilege to access those APIs. This may result in unnecessary churn between reviewers and devs and lead to frustration.

Let's do the following:

a. For APIs which require the app to be privileged, let's show a clear warning
b. Let's flags app which are accessing such APIs so that reviewers can confirm that those apps are marked as privileged in the manifest.

Comment 1

[Matt Basta [:basta]]

We already do this in the validator. If you submit an app that uses an API but you don't have the privileges to use it, we throw an error. If it's not happening in the validator, please file individual bugs for the APIs that are not being detected as privileged-only.

We also shouldn't disable APIs in the buchet list that are privileged for non-privileged apps because the app may not use the API directly, it may itself install or side-load an app that uses the API (which is totally legit). You wouldn't want to have an installer app that installs a more complicated app be visible but the app it installs is incompatible with a device.

Comment 2

[krupa raj[:krupa]]

Basta and I talked about this over coffee and this bug is just about providing more info to devs and reviewers and nothing will be disabled.

Comment 3

[Matt Basta [:basta]]

I misunderstood, this is to add a warning, not to throw errors.

Comment 4

[Matt Basta [:basta]]

This is essentially the same thing as bug 879049.