From b1519090c57b89b56f71f1a9fe63b380b8dcc0e3 Mon Sep 17 00:00:00 2001 From: Radek Stepan Date: Tue, 9 Sep 2014 19:15:28 -0700 Subject: [PATCH] account upgrades --- NOTES.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/NOTES.md b/NOTES.md index b4e9441..3b4e9cf 100644 --- a/NOTES.md +++ b/NOTES.md @@ -172,6 +172,10 @@ When fetching the issues, we can constrain on a `milestone` and `state`. - [ ] remove our `repo` under the `user`, no questions asked. All subscribers are switched off and views disposed of +###Deleting a user + +- [ ] execute a `remove()` in FB if our tokens match for a user, will remove all repos too + ###Upgrading an account to private repos Private repos (extra `scope` in FB login) are part of a paid plan. Need to recognize that a user has an active paid account with us, before using the extended scope. @@ -180,4 +184,11 @@ GH repositories have a `private` flag. Since we do not *trust* users it is I that need to be upgrading users, at the same time it needs to be automatic. -We should not kill a user if they are no longer paid, maybe they got behind a payment, just disable latest data from private repos. \ No newline at end of file +We should not kill a user if they are no longer paid, maybe they got behind a payment, just disable latest data from private repos. + +Set the private scope on all auth and put the burden on me to proove who has paid for an account or not, since someone could send a request to FB saying that a repo is public when it is not. + +I can run a script once in a while to see whose repo returns 404 when it is set as `private = false`, put the burden on me to prove. + +- [ ] fetch updates for a `private` repo only if we have a status as `subscriber` on user which is not writable by them +- [ ] use an in-between service to process payment from say Stripe