aklapper wrote on 2014-06-26 16:23:48 (UTC)

In T422#6, @greg wrote:

@mmodell and @csteipp, how hard would this be? Would it be part of the OAuth plugin, or part of Phab core?

ping - input welcome.

mmodell wrote on 2014-06-26 21:49:30 (UTC)

The oauth code definitely does a query to mediawiki to find out your user details. we could store it and display it somewhere. Not a terribly hard thing to implement I guess.

mmodell wrote on 2014-06-30 18:05:22 (UTC)

So do we want to do this? Now would be the best time for me to work on it since the oauth code is fresh in my mind.

csteipp wrote on 2014-06-30 19:39:20 (UTC)

In T422#17, @mmodell wrote:

So do we want to do this? Now would be the best time for me to work on it since the oauth code is fresh in my mind.

I'm pretty sure the answer is yes.

greg wrote on 2014-06-30 20:37:40 (UTC)

In T422#18, @csteipp wrote:

In T422#17, @mmodell wrote:

So do we want to do this? Now would be the best time for me to work on it since the oauth code is fresh in my mind.

I'm pretty sure the answer is yes.

Yep.

mmodell wrote on 2014-07-01 23:09:43 (UTC)

Phabricator extension is ready for review:

https://gerrit.wikimedia.org/r/#/c/143506/

Rush wrote on 2014-07-08 18:02:06 (UTC)

I think there is a bug? noted in gerrit

qgil wrote on 2014-07-09 14:58:20 (UTC)

This makes sense for Trusted User Tool too, since permissions are granted to specific Wikimedia users. Eventually https://legalpad.wikimedia.org/ and the Day 1 instance will be the same, but maybe you want to deploy it to Legalpad first for real testing?

LuisVillaWMF wrote on 2014-07-17 16:39:26 (UTC)

Yeah, we'd be happy to see it on legalpad for testing.

Note that our use case is a little odd - we're going to see a list of users that have signed a document, and it would be good to see the mediawiki.org account *in that list*, because we'll have to search to see if the user name has signed. It'll be a gigantic nightmare if we have to guess user name mappings, search for "close enough", and then click through to confirm the accuracy of the guess.

Rush wrote on 2014-07-17 17:15:10 (UTC)

@LuisVillaWMF

Can you elaborate on the process some more? Or even we could spend a few minutes talking about it over hangout.

I definitely see the gap you are talking about but I don't know which of these scenarios best cover it.

Most -> Least work I think.

1. We make the external account a searchable field so you can find signatures in legalpad _by the users name on mediawiki_ This is done within the phabricator ecosystem.

2. We allow for a basic UI tool to do lookups by mediawiki username for signature verification, like a web page where you type in the username and it links you to their signed docs or something.

3. We make a to more basic tool that runs "reports" straight from the DB, this would be command line? Seems like probably not user friendly enough of an option. There was some mention of this kind of raw DB querying in the past? I don't know what that entailed.

Really, we have the information it's just not linked in a UI in a consumable way so I'm sure we can accommodate, but the verification work flow has to be fleshed out a bit more I think from the tech side to figure out the best short term option.

LuisVillaWMF wrote on 2014-07-17 18:44:16 (UTC)

Might make sense to have a hangout for this one directly with @Jalexander, who has handled this in the past - if I'm involved it is more game-of-telephon-y. He'll probably say #1 is sufficient but I shouldn't put words in his mouth :)

Rush wrote on 2014-07-17 18:59:38 (UTC)

I'm honestly not sure how expensive #1 is to implement. @mmodell would know better.

I'm amendable to any day next week excepting monday

LuisVillaWMF wrote on 2014-07-17 19:14:28 (UTC)

Argh, I meant to say that @Jalexander will probably say #_3_ is sufficient. But it'd be good to have you two (and @mmodell if that makes sense) talk directly.

mmodell_testing wrote on 2014-07-17 19:27:03 (UTC)

#1 probably wouldn't be too difficult, and #2 seems easy enough if there was a problem implementing #1

qgil wrote on 2014-07-18 16:57:24 (UTC)

In T422#28, @LuisVillaWMF wrote:

Yeah, we'd be happy to see it on legalpad for testing.

Note that our use case is a little odd - we're going to see a list of users that have signed a document, and it would be good to see the mediawiki.org account *in that list*

How difficult and sensible would be just to make the Wikimedia username show up *in that list* (LegalPad)?

Rush wrote on 2014-07-18 20:47:35 (UTC)

Thought of that but my inkling is that falls down when the list reaches visual overload and it has to be searchable / filterable either way you cut it to scale

Jalexander wrote on 2014-07-18 21:34:45 (UTC)

In T422#38, @Rush wrote:

Thought of that but my inkling is that falls down when the list reaches visual overload and it has to be searchable / filterable either way you cut it to scale

Hmm, that seems like a pretty crappy database if it can show what it does now but not add the WM user name... to be honest we don't really care about what the local Phabricator user name is for our user case (just what the WM username is) and by far the best scenario would be able to see this in the list of signatures (at https://legalpad.wikimedia.org/legalpad/signatures/ etc).

The idea of seeing it in the signatures list would actually be SIGNIFICANTLY better then any of the other options and was, to be honest, what I've always been assuming was a given. Barring that the order of desire would be 1, 2, 3 with 3 being significantly less useful then all of the rest. As I said above essentially the entire thing we want to see is what WM usernames signed (emails or other data is only needed in certain circumstances) and every time we look at the list (whether to see if someone signed it earlier or to look at a new signature) we are going to have to look up the username. A list of usernames is also incredibly useful because we may not necessarily have available the exact username we're looking (yes we can almost always get it but that's an extra step) when someone just signed it we just want to see who just signed it, we at the foundation will not necessarily know in advance they were going to sign it since that process goes through the stewards and other rights granting users. Having to do a manual look up by username is significantly less useful and would be incredibly painful for the first couple months (and annoying after that).

I'm happy to do a hangout or a chat with anyone about the process, I apologize for not responding to this earlier I was sick yesterday and to be honest have always assumed it was a given the WM account name would be in the signature list, without it there the tool becomes significantly less useful (not necessarily completely useless but it immediately adds more work that adds up).

While not necessarily needed for us that may not be the case for all use cases of Phabricator I imagine this is something that the vast majority of users would want to easily see (on profile etc) given how closely linked Phabricator here will be with WM in general.

mmodell wrote on 2014-07-19 06:01:41 (UTC)

We can add the wikimedia username to legalpad signature search results, however, the data is stored in a separate database so the lookup will not be terribly efficient.

Jalexander wrote on 2014-07-19 06:24:45 (UTC)

In T422#40, @mmodell wrote:

We can add the wikimedia username to legalpad signature search results, however, the data is stored in a separate database so the lookup will not be terribly efficient.

I'm pulling this out of my ass so feel free to tell me it's not doable but to make the lookup better (assuming the legal pad data is in it's own table) is it possible to extend the legalpad table and add the WM username to it on save (when they sign)? That would likely give a bit more time to save/sign point but I imagine make the search much faster.

mmodell wrote on 2014-07-19 06:32:37 (UTC)

Ok I just hammered out the code to make it show wiki account on the signatures list. It's actually a lot easier than I thought, however, it requires patching on upstream code so this won't be terribly maintainable should upstream make any major changes to the files I've touched.

Here's the patch: https://gerrit.wikimedia.org/r/#/c/147723/

mmodell wrote on 2014-07-31 18:35:12 (UTC)

I can has review?

aklapper wrote on 2014-08-11 14:01:51 (UTC)

In T422#43, @mmodell wrote:

I can has review?

@mmodell: Chad and csteipp commented on the patch - needs rebase?

aklapper wrote on 2014-08-25 13:35:07 (UTC)

@mmodell: Replying to the comments on https://gerrit.wikimedia.org/r/#/c/147723/ welcome

aklapper wrote on 2014-08-27 21:32:03 (UTC)

So there is no clean way to do this, but Mukunda's custom hack is nine lines of code.

We likely need Legal to clarify better what they want to use it for and their usecases.

Jalexander wrote on 2014-08-27 21:38:10 (UTC)

In T422#48, @Aklapper wrote:

So there is no clean way to do this, but Mukunda's custom hack is nine lines of code.

We likely need Legal to clarify better what they want to use it for and their usecases.

I think I've explained our use case in a couple other areas (including possibly this bug) before but am happy to again. Essentially the main piece of data we need to know is what WM accounts have signed the document(s). Emails are also necessary but we can get away with them being a bit harder to find. Knowing what phabricator account signed the document is essentially useless especially given the large difference between phabricator user name requirements and WM user name requirements (no spaces, no utf8 (ar/he/ja/zh etc user names, no parens etc). It is essentially guaranteed that there will be user names in phabricator that we have no easy way to tell who they are in WM terms and even if we can guess that Philippe-WMF is the same as Philippe (WMF) we need to 'know' that which means we still need to find a quick easy way to verify that connection/

qgil wrote on 2014-08-27 21:43:57 (UTC)

@mmodell, even if it's only 9 lines of code I'm not qualified to review them. Could you please upload one screenshot or more showing your change in action? This will help us understand and provide proper feedback.

Rush wrote on 2014-09-06 14:39:45 (UTC)

This extension seems to work.

https://git.wikimedia.org/blob/phabricator%2Fextensions.git/1f7363a72897499ba0d9c551e362cd4123abfd03/MediaWikiUserpageCustomField.php

qgil wrote on 2014-09-06 17:13:15 (UTC)

Yay! Could it be deployed in https://legalpad.wikimedia.org/ to test it, please?

importing issue status

Alright, now we can test this feature: https://phabricator.wikimedia.org/p/Qgil/

It works. I have some minor suggestions, but nothing that would block this task or Day 1.

Closed Resolved?

Good enough for me...

It appears through the end of this task what I thought we were doing completely changed and it got lost in my email... I thought (and said multiple times throughout this bug) that we were going to get the wiki username on the list of signatures for legalpad? It appears (at least on phab01 and legalpad.wikimedia) that it is only on the user page now? Do we have any expectation of getting that? I can open a new task if necessary but I'm incredibly disheartened given the multiple long discussions about this. We have no need at all for the Phabricator username on the legalpad list and an absolute need for the wiki username :( When we roll this out (which at this point was meant to be any day now, I am just waiting on Michelle who is over loaded to approve the final text) we are going to start getting 100s of signatures (almost 900 will have to do it early on) and opening up every single user profile to check who they are is going to be incredibly time consuming and error prone.

Please open a new task specific to Legalpad.

About launching right now... can we talk? We had a first implementation of
Legalpad months ago, but then you were busy and we didn't have much
progress. Now we are in the very middle of RT and Bugzilla migrations, and
we cannot commit to anything else in the next weeks.

I'll organize a meeting to understand where we are, what needs to be done,
and when can we do it.

Yup,

I'll open a new task in the morning when I'm in the office. I will be happy
to have the meeting because I want to figure out where we are as well. To
be honest I'm now very glad we didn't start earlier, I was waiting for this
patch to be merged because I was under the impression it dealt with my
issue and apparently it didn't. I feel like I set aside all of my
requirements because they were too hard or problematic with the software
and this was the one thing I was getting and I was content with that and so
it's incredibly sad to not even have that yet. I feel like we're basically
back where we started.

James Alexander
Legal and Community Advocacy
Wikimedia Foundation
(415) 839-6885 x6716 @jamesofur

In T258#9843, @Jalexander wrote:

It appears through the end of this task what I thought we were doing completely changed and it got lost in my email... I thought (and said multiple times throughout this bug) that we were going to get the wiki username on the list of signatures for legalpad?

I filed this bug and that is not the original purpose. The original purpose was simply to allow you to click a person's Phabricator user name then see what their MW user name is (which as many Wikimedia Bugzilla users could tell you will be very useful).

I did notice Luis pivoted the card in T258#3273 ; I assumed that was a feature request in addition to what the description of this bug says.

In retrospect, we should have asked that a separate enhancement request be filed for that earlier, since it's really an entirely different feature and should be tracked separately.