Change 741972 had a related patch set uploaded (by 4nn1l2; author: 4nn1l2):

[operations/mediawiki-config@master] Add templateeditor group and protection level at viwiki

https://gerrit.wikimedia.org/r/741972

In Description, @NguoiDungKhongDinhDanh wrote:

Eliminators must also be template editors to edit template protected pages and protect pages at this level.

This has been written a little tricky. It does NOT mean that eliminators should have the right templateeditor by default.

Google Translate does a good job in transferring the true intention of this sentence. According to the consensus onwiki,

Nếu điều phối viên đồng thời có quyền kỹ thuật viên bản mẫu, họ sẽ có thể khoá trang ở mức templateeditor.
If the moderator also has template technician permissions, they will be able to lock the site at templateeditor.

It means if some user is both an eliminator and a template editor, then he can edit protected pages (because he is a template editor) and protect pages (because he is an eliminator). Eliminators had already the protect right. If viwiki wants eliminators who are not template editors not to be able to protect pages at the templateeditor level, they should do that by other means such as AbuseFilter.

GT gets better day by day it seems. Yes, that was my intention. I even had a small chat with P.T.Đ at the very end of the page about what to do if the third condition comes out technically impossible. In that case, please make eliminators able to protect pages at templateeditor level. We'll take care of the rest then. Thanks in advance.

As it can be seen here, eliminators at viwiki have already the protect right, i.e., they can (or will be able to) protect pages at any level ('autoconfirmed', 'extendedconfirmed', 'templateeditor', and 'sysop').

If you want to limit them, you should do that by other means. For example, fawiki runs a bot to report possible mistakes by eliminators. Here you can see that an eliminator has wrongfully fully-protected a page (has protected it at the 'sysop' level).

@4nn1l2 We never had to complaint about eliminators fully protecting pages because vi.wiki eliminators can't protect/edit pages at sysop level. However, they can unprotect sysop move/upload protected pages (but not create), as long as those pages are not sysop/editinterface edit protected. This "logic" first appeared when vi.wiki adapted eliminator group seven years ago (can't find where that task is yet, archives say T68612 but apparently not). Another bug I found recently is that eliminators can't view deleted MediaWiki pages. See T296159.

Addendum: T70612.

There is only one protect right at the MediaWiki software according to Manual:User rights, so if someone has the protect right, he can protect at any level. Viwiki eliminators can protect pages at the sysop level right now, from a technical viewpoint. If they can't do that in practice, some other tricks have been applied.

Editing protected pages is another story. According to the current configuration, only viwiki sysops have the editprotected right.

@Zabe, could you please confirm this comment of mine?

In short, can change 741972 be deployed now? Whether non-template-editor eliminators can or cannot protect pages at templateeditor doesn't really matter. If they can, we will have a short chat about using a filter, if not, then that's fine too. protect right and its problem is a different story and should be discussed in another phab task.

In T296154#7531629, @4nn1l2 wrote:

so if someone has the protect right, he can protect at any level

No, you can only protect pages to levels which you have rights to regardless of the protect right.

Tagging T&S as they handle 2FA resets to see if they are happy with this

Hey - As Joe noted here T180648#4039087, we want to see this expanded but at the same time, the resetting sometimes require off-wiki verification which is often difficult the way the system was set up, so if someone losses access to their account and we can't prove that they are the real owner of the account, the account won't be restored. Also, there are only a handful of staff members from T&S who manage this workflow so there is also a capacity issue in case we are to receive a large-scale request.

2FA is not an issue here. All users in the templateeditor group at all wikis can enable 2FA by default. See wmgPrivilegedGroups.

In T296154#7533506, @4nn1l2 wrote:

2FA is not an issue here. All users in the templateeditor group at all wikis can enable 2FA by default. See wmgPrivilegedGroups.

In that case, I'm not sure why T&S was mentioned.

In T296154#7533515, @Nahid wrote:

In T296154#7533506, @4nn1l2 wrote:

2FA is not an issue here. All users in the templateeditor group at all wikis can enable 2FA by default. See wmgPrivilegedGroups.

In that case, I'm not sure why T&S was mentioned.

The point was that a new group with 2FA will be added (since the templateeditor group does not yet exist on viwiki) and thus the number of users with 2FA will increase. Thus, the number of reset requests will also increase.

We've been waiting for more than a week. Any progress yet?

What’s the rush?
This is a voluntary activity. We can't make people do voluntary work.
I added one reviewer yesterday, but no responses yet.
See here, please.

Change 741972 merged by jenkins-bot:

[operations/mediawiki-config@master] Add templateeditor group and protection level at viwiki

https://gerrit.wikimedia.org/r/741972

Mentioned in SAL (#wikimedia-operations) [2021-12-01T12:05:51Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: 2bd14e8968c90b2562f045457d61b252728e6250: Add templateeditor group and protection level at viwiki (T296154) (duration: 00m 56s)

Thanks!