Change 1007408 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/core@master] Add 'temp' flag to ApiQueryUserInfo API

https://gerrit.wikimedia.org/r/1007408

Suggested QA steps (the steps I used to test this change locally):

1. While logged out, load http://localhost:8080/wiki/Special:ApiSandbox#action=query&format=json&meta=userinfo&formatversion=2
2. Run the request and verify that the response includes the anon key with the value as true, but does not include the temp key
3. Create a temporary account
4. Load http://localhost:8080/wiki/Special:ApiSandbox#action=query&format=json&meta=userinfo&formatversion=2 and make the request
5. Verify that the response includes the temp key with the value as true and does not include the anon flag
6. Log into a named account
7. Load http://localhost:8080/wiki/Special:ApiSandbox#action=query&format=json&meta=userinfo&formatversion=2 and make the request
8. Verify that the response does not include either of the temp or anon keys.

Change 1007408 merged by jenkins-bot:

[mediawiki/core@master] Add 'temp' flag to ApiQueryUserInfo API

https://gerrit.wikimedia.org/r/1007408

All looks good.

Test environment: https://de.wikipedia.beta.wmflabs.org MediaWiki 1.42.0-alpha (5c87a85) 10:44, 1 March 2024.

I wonder if we should change name to not include the IP address when querying as a logged-out user:

{
    "batchcomplete": true,
    "query": {
        "userinfo": {
            "id": 0,
            "name": "127.0.0.1",
            "anon": true
        }
    }
}

I'd suggest using a generic placeholder temp name or exclude the property altogether. It's potentially confusing as-is. (Came across this while investigating test breakage in API testing tests for T359043: Enable temp account creation in DevelopmentSettings.php.)

In T358683#9595978, @kostajh wrote:

I wonder if we should change name to not include the IP address when querying as a logged-out user

Are you meaning only when temp accounts is enabled? Otherwise this would be a breaking change to the API results (users might expect to parse the name as an IP address if anon is true), and it does make more sense if temp accounts is disabled, since that would be your name.

For when temp accounts are enabled: as far as MediaWiki is concerned, you are the IP user until you do an action that is in $wgAutoCreateTempUser['actions']. I wrote down some thoughts about changing this in T336195: Don't set an anonymous user's name to their IP address if IP Masking is enabled. Doing that (if indeed it can be done!) should solve this, since ApiQueryUserInfo::getCurrentUserInfo gets the name from User::getName.

In T358683#9600633, @Tchanders wrote:

In T358683#9595978, @kostajh wrote:

I wonder if we should change name to not include the IP address when querying as a logged-out user

Are you meaning only when temp accounts is enabled? Otherwise this would be a breaking change to the API results (users might expect to parse the name as an IP address if anon is true), and it does make more sense if temp accounts is disabled, since that would be your name.

Thanks, yes I meant only when temp accounts are enabled.

For when temp accounts are enabled: as far as MediaWiki is concerned, you are the IP user until you do an action that is in $wgAutoCreateTempUser['actions']. I wrote down some thoughts about changing this in T336195: Don't set an anonymous user's name to their IP address if IP Masking is enabled. Doing that (if indeed it can be done!) should solve this, since ApiQueryUserInfo::getCurrentUserInfo gets the name from User::getName.

T336195: Don't set an anonymous user's name to their IP address if IP Masking is enabled sounds like it would cover the scenario I am discussing. Thanks!