RFC-106: Future of Forge versioning - Permissions

[AndreasEbert]

From an app’s perspective we’d prefer forced updates as the simplest solution, mainly because of these advantages:

1. No customers on old app versions (for very long time).
2. No code-complexity due to checks for optional permissions in our app.

If for whatever reason this cannot be, I can see the benefit of at least solving for advantage 1 (no customer on old app versions), because for us that is more painful than more complex code due to permission checks. At least, the permission checks give us app developers real agency in nudging/forcing customers to approve new/optional permissions (i.e. the level of heavy-handedness that Scott mentioned).

Of course, for this to be really meaningful, we need a way to address the decision-makers, i.e. the admins. For that, I second Mark and Daniels posts:

@danielwester

@markrekveld

I understand that there will be some UI for admins to review the new permissions and take action, however, how will the admins be notified if there is something to review? Not all admins will come to the Connected Apps screen on a daily bases, so how do we get them to go there when there is something to review. Ideally the platform itself can be used to notify the correct people to take action.

This is really important. We need a notification system or someway of getting hold of the admins. Today we don’t have their contact information.