There are two ways to get the total number of notifications: [notwikis=*](https://meta.wikimedia.org/w/api.php?action=query&meta=notifications¬prop=count¬wikis=*) and [notcrosswikisummary=1](https://meta.wikimedia.org/w/api.php?action=query&meta=notifications¬prop=count¬crosswikisummary=1). However, for some reason, only notcrosswikisummary=1 seems to work via OAuth – notwikis=1 shows the total number of notifications in a browser but only counts notifications on the target wiki when the same URL is requested in a request authenticated with OAuth. I can only assume that this is a bug.
Description
Description
Event Timeline
Comment Actions
Probably some permission check somewhere, that's not included in the grant? Can't find it at a glance, though.
Comment Actions
Not just OAuth, it also doesn't work with BotPasswords.
The culprit seems to be https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/Echo/+/d1eac9bf068e98a5245cc237eb3832a0e0429842/includes/ForeignWikiRequest.php#73 where it specifically only works with CentralAuth's sessions.
The simplest fix might be to at least acknowledge that (with a warning or error) if someone tries to use notwikis with another kind of session, as for example ApiLogin does at lines 96–107.