925835 - Lock down developer tools for shared accounts

Status: RESOLVED WORKSFORME

(Marketplace Graveyard :: Payments/Refunds, defect, P3)

Description

[Andy McKay]

If a developer links to a shared account, they should not be able to on the following screen:

http://cl.ly/image/0B2J0c0r0q3S

Accept the terms, delete or access the bango portal. Obviously the back end views need locking down appropriately as well.

Comment 1

[Bram Pitoyo [:bram]]

Users who don’t create payment account might not be able to delete or modify it, but they should be able to access the portal and view information, right?

Comment 2

[krupa raj[:krupa]]

Who will have access to delete/modify the shared account?

Comment 3

[Andy McKay]

Apps that use a shared account should not be to access the bango portal. That would contain information from all the apps that use the account.

The user who created the shared account will be able to delete or modify it.

Comment 4

[Andy McKay]

I don't think there's anything to do here, the appropriate calls check the right permissions. Most of the code to land using a shared account is in bug 925834.