web3.storage
web3.storage copied to clipboard
Remove message about blocked API tokens when account is restricted
In #1322, messaging was added to the UI so that when a user's account is restrcited it tells them that they can't create new API tokens. This isn't actually true.
When a user's account is restricted, we deliberately don't prevent them from deleting or creating API tokens, this is because:
- One or more of their tokens may have been leaked (which might be why they've used so much storage and their account is restricted), so we want to let them cycle API tokens.
- We still want them to be able to delete files, and if they've got a lot of files then they'll probably want to do that programmatically, not via the web UI, so we still want them to have full token cycling capability. (So that even if a token is leaked, or deleted by mistake, they can replace it and then use the new one to delete their files.)
- Currently, the web3.storage UI doesn’t have full server pagination. If a user has more than 1000 files, programmatic deletion is the only way.
- There’s also currently no web UI to list/remove Pinning requests. Currently the only way to remove a Pin Request is to use the APIs (either directly or through the IPFS cli/app).
- Account restriction is not account blocking. We still let them view their files, delete files, etc; they just can't upload new ones. So adding the arbitrary restriction of not letting them cycle their API tokens would just add friction. If we want to fully disable a user's account then we could go with a more full blocking/disabling of their account as a separate feature.
We should revert the changes to the UI which disable the button for making a new token and which tell you that you can't.
Website initiative will separate concerns in the description above and tackle the issues.