936444 - Auto-approve (don't review) updates to non-privileged apps

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Developer Pages, enhancement, P2)

Description

[Andrew Williamson [:eviljeff]]

Currently, a developer can submit a hosted app to Marketplace, have it approved, and then update all the content without us reviewing it further.  We only take a second look if something significantly is changed in the manifest.  If that developer packages up that app into a zip, with the same functionality, content and permissions, then each time the update is reviewed by us.  This is inconsistent, and a largely unnecessary use of our reviewer resource.

So instead, updates to non-privileged packages apps should be auto-approved by Marketplace.  Any significant manifest changes (such as a name change) would be flagged, as with hosted apps. Privileged apps will continue to be fully code reviewed on every update as now (as would an existing non-privileged app that changed to be privileged).

The risks are the update is broken in some way, or contains something prohibited by our review guidelines - but those risks are shared by hosted apps now so we would deal with them in the same way (i.e. abuse reports and other feedback).

Changes needed in upload flow:
* if privileged version then continue as now
* if non privileged version then change status to FULLY REVIEWED and show different messaging post upload to indicate that the update has been auto-approved and is live immediately.
* if non privileged version and there are significant changes in the manifest - whatever is currently detected for hosted apps in the cron job (changes in name, developer name?) - then flag for re-review.

Comment 1

[Andrew Williamson [:eviljeff]]

thoughts on this David?

Comment 2

[David Bialer [:dbialer]]

This seems a good idea. I can't think of any security implications.   Perhaps it is a [repoman?] bug.

Comment 3

[Andrew Williamson [:eviljeff]]

(In reply to Andrew Williamson [:eviljeff] from comment #0)
> * if non privileged version then change status to FULLY REVIEWED and show
> different messaging post upload to indicate that the update has been
> auto-approved and is live immediately.

The status would be approved but waiting (or whatever is the exact status is) for those apps that have that option selected too.