Expiring global groups would be tremendously useful as well. For example, all IPBE's we grant, or nearly all of them, are temporary but don't list them afterwards at SRAT but in our internal wiki for privacy reasons. Other global groups such as editinterface are temporary by default. It'd really help us to have this function avalaible for global rights as well. Thanks!

Just to get an idea, are all of the 252 current global IP-block exemptions temporary? If not, how many are temporary?

Excluding a handful of them, we usually grant that until the global block that caused their issues expires, or for one year and so on. Some users are given GIPBE permanently, but there ain't that much of them. Thanks.

Now that local user group expiration is a reality and seems to be working just fine, can we get an estimate on how much effort or complication this would be? Maybe also adding subtasks of pending things to do would be a good idea? Regards.

I was hoping to work on it this month, but various IRL things happened so that I wasn't able to. I do plan to get to it eventually, but note that this task is not assigned to me, so anyone else may of course claim it if they wish.

I think it is best worked on as a single unit of work; the main meat of it will be a patch to CentralAuth, and I don't think there will be too much beyond that (fingers crossed).

@TTO I think we'll wait for you since you have done most of the temporary userrights feature and know what exactly needs to be done.

Due to recent issues with governments blocking accesses to Wikimedia sites, the number of temporary IP block exemptions have been growing, and so keeping track of all of them is getting harder. We also grant other kind of temporary global rights which would benefit from this, as explained above. Can I suggest, if possible, to have a look at this request again please? Thank you!

Hi there. Any updates? Feature still required for most global ipblock exemptions and (soon) all global interface administrator permissions. Thanks!

Change 475930 had a related patch set uploaded (by Melos; owner: Melos):
[mediawiki/extensions/CentralAuth@master] Allow global groups to be assigned temporarily

https://gerrit.wikimedia.org/r/475930

Thanks @Melos !!!

AFAICS your change does some DB changes so I'm adding the Schema-change so our DBA can take a look as well.

Notes to consider that just came to my mind: when we implemented expiring local rights there was a problem with said permissions when expiring not being moved to user_former_groups and being in the database indefinitely until someone did "touched" the wiki. This was: T177404: Expired user groups not added to user_former_groups table, T176754: Regularly purge expired temporary userrights from DB tables and T163691: Expired user groups are still shown in Special:Preferences/Special:UserRights after expiring, due to User cache among others. Taking a look at https://phabricator.wikimedia.org/project/board/2414/query/all/ can also be helpful.

Regards.

Tag DBA for patch review.

The schema change looks good to me. The table is pretty small (around 1500 rows) and 8M in disk, so it can probably be altered on the master once the schema change is ready.
Please, remember to submit a schema change when the change is merged, using the schema change template: https://wikitech.wikimedia.org/wiki/Schema_changes#Workflow_of_a_schema_change

Removing the DBA tag but I will remain subscribed here in case I am needed :)

@Marostegui So, do we get 475930 merged first and then file a new task? I'd love to get this new feature live but I'm a bit lost on how to proceed. Thanks.

Yes, once that patchset is reviewd and merged, you can follow: https://wikitech.wikimedia.org/wiki/Schema_changes#Workflow_of_a_schema_change

+CPT for codereview.

Is this task ready for code review by the Core Platform Team? The only patch I see is 475930, and it is marked as WIP. I'm untagging us for now, but please retag when there is a patch ready for code review.

@CCicalese_WMF I have asked @Melos to confirm whether the patch is still WIP or can proceed to code review. I'll let you know once I have a reply.

Change 475930 had a related patch set uploaded (by Melos; owner: Melos):
[mediawiki/extensions/CentralAuth@master] Allow global groups to be assigned temporarily

https://gerrit.wikimedia.org/r/475930

Change 743561 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/CentralAuth@master] Enforce gug_expiry

https://gerrit.wikimedia.org/r/743561

Change 743561 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Enforce gug_expiry

https://gerrit.wikimedia.org/r/743561

Change 752300 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/CentralAuth@master] Add a script to clean expired global_user_groups rows

https://gerrit.wikimedia.org/r/752300

Change 752301 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/CentralAuth@master] Update SpecialGlobalGroupMembership for global groups

https://gerrit.wikimedia.org/r/752301

Change 752302 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/CentralAuth@master] SpecialCentralAuth: Display global group expiry

https://gerrit.wikimedia.org/r/752302

Change 752302 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] SpecialCentralAuth: Display global group expiry

https://gerrit.wikimedia.org/r/752302

Change 752300 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Add a script to clean expired global_user_groups rows

https://gerrit.wikimedia.org/r/752300

Change 752341 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:mw::maintenance: add centralauth group purge job

https://gerrit.wikimedia.org/r/752341

Change 752301 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Update SpecialGlobalGroupMembership for global groups

https://gerrit.wikimedia.org/r/752301

Change 475930 abandoned by Zabe:

[mediawiki/extensions/CentralAuth@master] Allow global groups to be assigned temporarily

Reason:

Sadly this never went in, temporary global groups were now implemented in different patches, so this one is no longer necessary. Still thanks for your work. :)

https://gerrit.wikimedia.org/r/475930

Change 752343 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] beta: Enable temporary global user groups

https://gerrit.wikimedia.org/r/752343

Change 752344 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Enable temporary global user groups on production

https://gerrit.wikimedia.org/r/752344

CentralAuth code changes are shipping next week with the train but disabled with a config value. I'll enable it on production once the train is 100% stable and deployed on all wikis, so most likely the week starting January 17th.

Change 752343 merged by jenkins-bot:

[operations/mediawiki-config@master] beta: Enable temporary global user groups

https://gerrit.wikimedia.org/r/752343

Change 752344 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable temporary global user groups on production

https://gerrit.wikimedia.org/r/752344

Mentioned in SAL (#wikimedia-operations) [2022-01-18T09:41:03Z] <taavi@deploy1002> Synchronized wmf-config/CommonSettings.php: Config: [[gerrit:752344|Enable temporary global user groups on production (T153815)]] (duration: 00m 51s)

Change 752341 merged by Legoktm:

[operations/puppet@production] P:mw::maintenance: add centralauth group purge job

https://gerrit.wikimedia.org/r/752341