In my system we have users accounts and user devices. Rules:
- A user can have only one user account.
- Each user can have many devices.
- A device can be bound to only one user account.
Upon initial installation, when adding new device, or after a "master reset", the user must provide the login and password to his/her account to bind this particular device to the account. After that, the device sends a unique token with each request and is recognized by that token.
So the normal situation is that Device A is bound to User A and time goes on. This question pertains to the situation later on, when a request from Device A is made using the credentials for User B.
What should happen in this situation? How should the API / server respond when it detects that a device already bound to one user account is trying to rebind itself to another account?
Let's use Dropbox as an example. What would happen when someone uninstalls the Dropbox client on one of their computers previously used with account A, then reinstalls it with credentials for account B? The local client would be pointing to a Dropbox folder containing some files but trying to sync it with an account that has a completely different set of files. Note that I haven't tested such a situation. I'm not willing to and I'm not interested in learning how Dropbox handles this; I'm only using this as an example to help describe my situation.
What I have come up with so far:
Treat this as a normal situation and automatically rebind the device to the account as requested. But wouldn't this make a mess in the database in terms of what user sees or has access to (stats, data, history etc.)?
Treat this as an error situation. Assume that to rebind a device to another account, it must first be unbound from its previous account. If user can't access their "old" (previous) account due to lost password etc., he/she should use the password reset form or contact support.
Something different. Not mentioned above.
After doing some thinking and a little research I'm pretty convinced that option two is the best solution for me, but I'd like to know anyone foresees any major problems with this approach. Is there any reason I shouldn't follow option 2?
Edit: This system deals with non-computer devices; Dropbox is just an example. In my scenario 95% of devices are always used by the same user and are not shared among others. My assumption is that this situation can only occur as an result of error or intentional, but unsupported actions (hacking, checking what will happen if, etc.).