Page MenuHomePhabricator

Support custom permissions for a subset of translatable pages
Open, Needs TriagePublic

Description

Long ago, we wrote a ghastly extension FundraisingTranslateWorkflow in order to support special, additional permissions for publishing translations of any page with a title beginning with "Fundraising". Let's generalize this mechanism and move support into Extension:Translate.

Event Timeline

awight created this task.Jan 16 2019, 4:48 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 16 2019, 4:48 PM
awight renamed this task from Replace and deprecate FundraisingTranslateWorkflow hack to Add per-namespace rights restrictions to publish translations.Jan 16 2019, 8:19 PM
awight updated the task description. (Show Details)

My lazy update: I think we can do this without implementing anything new. All we have to do is rely on a namespace-based message group, and configure the group with:

$states['published']['right'] = 'translate-manage';

All we have to do is rely on a namespace-based message group, and configure the group with:

Just to clarify, you have a code that gets run when the state of a language of message group's translations is changed to published?

I am not also sure what do you mean with namespace-based group? Translate does not handle very well (as in, you don't know if you cannot translate those until you actually try it and get an error) if the translatable messages have additional restrictions (e.g. the workflow states group which uses messages in MediaWiki namespaces that require additional rights).

YAML configuration

I'm not sure whether WMF production has a good yaml parser. HHVM bundled libyaml. PHP needs yaml extension but I am not sure whether it is installed in WMF production. In any case if you want to use it, a quick security review of that part of the code may be in order. But then again, YAML is mainly useful for FileBasedMessageGroups. It is not very for dynamic groups (e.g. something defined in the wiki), where you likely want to just create the MessageGroup objects directly.

All we have to do is rely on a namespace-based message group, and configure the group with:

Just to clarify, you have a code that gets run when the state of a language of message group's translations is changed to published?

No, but I think there's already Extension:Translate code which checks that the user has rights to publish? I'm hoping that all we have to do is set up the permissions.

I am not also sure what do you mean with namespace-based group?

Very good question. I think I was wrong about how this works, previously I had imagined that I could configure a message group to automatically match anything in a given namespace but that seems to not be how it works. What I want is to take a few pages (e.g. https://meta.wikimedia.org/wiki/Fundraising/Translation/Thank_you_email_2018-10-01/zh ) and protect them with special rights to restrict publishing. Is there a way to define a message group based on page title prefix matching, or namespace, or any other mechanism?

Translate does not handle very well (as in, you don't know if you cannot translate those until you actually try it and get an error) if the translatable messages have additional restrictions (e.g. the workflow states group which uses messages in MediaWiki namespaces that require additional rights).

Okay, this sounds slightly awkward but it will be the same situation we're in with the custom FundraisingTranslateWorkfow extension, so not a blocker.

YAML configuration

I'm not sure whether WMF production has a good yaml parser. HHVM bundled libyaml. PHP needs yaml extension but I am not sure whether it is installed in WMF production. In any case if you want to use it, a quick security review of that part of the code may be in order. But then again, YAML is mainly useful for FileBasedMessageGroups. It is not very for dynamic groups (e.g. something defined in the wiki), where you likely want to just create the MessageGroup objects directly.

Ah no problem, thanks for the heads-up. We can skip YAML and define the message group through PHP configuration.

Change 485891 had a related patch set uploaded (by Awight; owner: Awight):
[mediawiki/extensions/Translate@master] Allow hooks to set custom workflow configuration

https://gerrit.wikimedia.org/r/485891

awight renamed this task from Add per-namespace rights restrictions to publish translations to Support custom permissions for a subset of translatable pages.Jan 22 2019, 8:43 PM

Change 485891 merged by jenkins-bot:
[mediawiki/extensions/Translate@master] Allow hooks to set custom workflow configuration

https://gerrit.wikimedia.org/r/485891

Change 486345 had a related patch set uploaded (by Awight; owner: Awight):
[mediawiki/extensions/FundraisingTranslateWorkflow@master] [WIP] New Translate hook cleans up our act

https://gerrit.wikimedia.org/r/486345

Change 486374 had a related patch set uploaded (by Awight; owner: Awight):
[mediawiki/extensions/Translate@master] Use new permissions hook in MessageGroupsOld

https://gerrit.wikimedia.org/r/486374

awight updated the task description. (Show Details)Jan 24 2019, 9:42 PM

Change 486374 merged by jenkins-bot:
[mediawiki/extensions/Translate@master] Use new permissions hook in MessageGroupsOld

https://gerrit.wikimedia.org/r/486374

@Nikerabbit Do you know of any mechanism to enable Extension:Translate when unit testing other extensions? ExtensionRegistry#isLoaded tells me that Translate isn't available from WMF CI tests for FundraisingTranslateWorkflow.

I am not familiar with that part of Jenkins/Continuous Integration. I believe it needs some configuration there.

Just discovered some good documentation about this exact problem, here: https://www.mediawiki.org/wiki/Manual:Extension_registration#Requirements_(dependencies)

Change 486501 had a related patch set uploaded (by Awight; owner: Awight):
[integration/config@master] FundraisingTranslateWorkflow dependency

https://gerrit.wikimedia.org/r/486501

Change 486501 merged by jenkins-bot:
[integration/config@master] FundraisingTranslateWorkflow dependency

https://gerrit.wikimedia.org/r/486501

@fr-tech: Okay, just the main patch left and it's in your court! Let me know if I can do anything more.

Change 486345 had a related patch set uploaded (by Ejegg; owner: Awight):
[mediawiki/extensions/FundraisingTranslateWorkflow@master] New Translate hook cleans up our act

https://gerrit.wikimedia.org/r/486345

Change 486345 merged by jenkins-bot:
[mediawiki/extensions/FundraisingTranslateWorkflow@master] New Translate hook cleans up our act

https://gerrit.wikimedia.org/r/486345

Change 497956 had a related patch set uploaded (by Ejegg; owner: Ejegg):
[operations/mediawiki-config@master] Load FundraisingTranslateWorkflow after Translate

https://gerrit.wikimedia.org/r/497956

Change 497956 merged by jenkins-bot:
[operations/mediawiki-config@master] Load FundraisingTranslateWorkflow after Translate

https://gerrit.wikimedia.org/r/497956

awight removed a subscriber: awight.Mar 21 2019, 4:05 PM