{"action":"created","issue":{"url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/90","labels_url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/90/comments","events_url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/90/events","html_url":"https://github.com/interledger/five-bells-ledger/pull/90","id":125518139,"number":90,"title":"Allow admin to disable/enable accounts","user":{"login":"MatthewPhinney","id":4961057,"avatar_url":"https://avatars.githubusercontent.com/u/4961057?v=3","gravatar_id":"","url":"https://api.github.com/users/MatthewPhinney","html_url":"https://github.com/MatthewPhinney","followers_url":"https://api.github.com/users/MatthewPhinney/followers","following_url":"https://api.github.com/users/MatthewPhinney/following{/other_user}","gists_url":"https://api.github.com/users/MatthewPhinney/gists{/gist_id}","starred_url":"https://api.github.com/users/MatthewPhinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MatthewPhinney/subscriptions","organizations_url":"https://api.github.com/users/MatthewPhinney/orgs","repos_url":"https://api.github.com/users/MatthewPhinney/repos","events_url":"https://api.github.com/users/MatthewPhinney/events{/privacy}","received_events_url":"https://api.github.com/users/MatthewPhinney/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-08T00:47:47Z","updated_at":"2016-01-15T23:04:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/interledger/five-bells-ledger/pulls/90","html_url":"https://github.com/interledger/five-bells-ledger/pull/90","diff_url":"https://github.com/interledger/five-bells-ledger/pull/90.diff","patch_url":"https://github.com/interledger/five-bells-ledger/pull/90.patch"},"body":"resolves #75\r\n\r\nMy concerns with this PR are:\r\n1. Had to add a new file to check if accounts are disabled. When creating a transfer, the only place where accounts appear to be validated is `accountBalances.js`. This file exposes a clean API for balances (which has nothing to do with accounts being disabled), so I created a new file (`disabledAccounts.js`) for the logic.\r\n2. The JSON returned from PUT/GET account includes a `disabled` key *only* when the user is an admin. Ordinary users should not see the disabled flag, but admin users need visibility into which accounts are enabled/disabled. Having the structure of the response change based on which type of user makes the request is not ideal.\r\n\r\nFinally, we need a corresponding PR to five-bells-shared to modify the JSON schema for accounts to allow the `disabled` flag. If the above concerns are addressed, and we decide to merge this PR, I'll make the PR to update the schema."},"comment":{"url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/comments/172121834","html_url":"https://github.com/interledger/five-bells-ledger/pull/90#issuecomment-172121834","issue_url":"https://api.github.com/repos/interledger/five-bells-ledger/issues/90","id":172121834,"user":{"login":"MatthewPhinney","id":4961057,"avatar_url":"https://avatars.githubusercontent.com/u/4961057?v=3","gravatar_id":"","url":"https://api.github.com/users/MatthewPhinney","html_url":"https://github.com/MatthewPhinney","followers_url":"https://api.github.com/users/MatthewPhinney/followers","following_url":"https://api.github.com/users/MatthewPhinney/following{/other_user}","gists_url":"https://api.github.com/users/MatthewPhinney/gists{/gist_id}","starred_url":"https://api.github.com/users/MatthewPhinney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MatthewPhinney/subscriptions","organizations_url":"https://api.github.com/users/MatthewPhinney/orgs","repos_url":"https://api.github.com/users/MatthewPhinney/repos","events_url":"https://api.github.com/users/MatthewPhinney/events{/privacy}","received_events_url":"https://api.github.com/users/MatthewPhinney/received_events","type":"User","site_admin":false},"created_at":"2016-01-15T23:04:40Z","updated_at":"2016-01-15T23:04:40Z","body":"@justmoon can you clarify the execution flow for me? Does the account that authorized the transfer have to be responsible for making the request to execute that transfer? I'm concerned about the following case for a transfer Alice -> Bob:\r\n1. Funds are put into escrow (Alice authorizes transfer to Bob).\r\n2. Alice's account is disabled.\r\n3. Alice cannot execute the transfer, since her credentials no longer work.\r\n\r\nI agree that credentials for disabled accounts should not work. What is the workaround for this case?"}}