Thank you for filing this task, we are going to escalate it to the team that would be able to fix it

@Asartea , could you provide a link to the protected user script page? This page, for example, is not protected and can be editable by any user both from the mobile app and a desktop.

https://en.wikipedia.org/wiki/User:Cscott/TogetherJS.js is a user script on my page, it should be protected? And I think that https://en.wikipedia.org/wiki/User:GhostInTheMachine/SDsummary.js is the link to the protected page from @vadim-kovalenko's example.

@cscott , I've tried to open the page with .js at the end of URL on the local mobileapss instance (http://localhost:8888/en.wikipedia.org/v1/page/mobile-html/User%3ACscott%2FTogetherJS.js), but got Dummy output. Parsoid does not support content model javascript. See T324711. error message. Any chances to get this page locally?

The content on the app doesn't seem to be generated by the mobile html service, as the mobile html service shows the output that @vadim-kovalenko shows above and returns 400 for these pages (T324711). So this is probably not a mobile html service bug but instead a bug in the app itself, specifically whatever fallback path the app is using to generate content for these pages after the mobile html service returns 400. (I note that it is rendering the javascript "as if it were wikitext" as well, so there are bigger problems here than "just" the presence of the edit button.)

@vadim-kovalenko points out that https://en.wikipedia.org/api/rest_v1/page/mobile-html/User%3Acscott%2FTogetherJS.js "works" in production -- which apparently is just because production is still pointed to RESTBase while the development instance is pointed to the core APIs which are expected to replace RESTBase. So once that switchover is complete, apps will start displaying the "dummy content" message instead of any output, which is a bug in itself likely. Generally apps should be using the same mechanism for "non wikitext content" pages as it does for (eg) Special pages. The question is how apps should know that a given Title corresponds to a non-wikitext content type.

Filed T330772: Mobile-html switchover to REST API (from RESTBase) should account for http 400 response for non-wikitext content models.

This might get fixed implicitly by RESTBase deprecation.