Page MenuHomePhabricator

Blocks should be an implementation detail of an abstract authorization system
Open, Needs TriagePublic

Description

Blocks currently exist as an integral part of the authorization system of MediaWiki. Unfortunately, code (core, extensions, etc.) must be aware of what blocks are and how they work. This has forced code to ask questions like

  • Is the user blocked?
  • Does the user have more than one block?
  • Are they sitewide blocked?
  • Are they blocked from this page?
  • Are they blocked from this namespace?
  • Is the account locked? (i.e. cannot login)

The question code should be asking is:

  • Can the user perform X action?
  • If not, why not?

In this way, Blocks are an implementation detail in an authorization system.

An extension should always be able to hook into the authorization system and make it's own assessment, or change the assessment of other systems.

Event Timeline

See T212341#4841566 on why this is not that easy without major changes to the authorization system.
The lack of support for "why not?" questions in many places is T180888: All permission checks should be able to return a custom error message.

See T212341#4841566 on why this is not that easy without major changes to the authorization system.

Yes. I assumed as much when looking at the code.