Page MenuHomePhabricator

Echo oneself using API
Open, Needs TriagePublicFeature

Description

Feature summary:
I want to send an echo notification to myself. The most obvious and versatile way would be to make this possible using the API, but JS would work for me as well.

Use case(s):
My userscript cooks things in the background. If/when it has found something, it has to notify the user somehow. mw.notify is just a fleeting notification that can be missed while taking a sip of one's tea. Other solutions generally don't carry over to other sessions/devices/browsers. And, errr, there already is a perfectly good notification system and area in place, I just can't use it!

Benefits:
Allow userscripts/gadgets/anything that's not an extension to take advantage of echo notifications.

This feature request is different from T58362 as I am requesting only notifications to self (which takes away a whole lot of potential abuse factors) and no special page or user interface, just API.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
mewoph added a subscriber: mewoph.

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

kostajh added a subscriber: kostajh.

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

We usually discuss tasks in our internal team chat, then write the conclusion here. The most likely outcome is that we won't have time to work on this, as this isn't something related to our team's roadmap. I'm tagging the Security-Team in case they have thoughts about the idea. Basically this would mean that any userscript/gadget could issue a notification type with arbitrary text/action links, right? That is a departure from what we currently have, with notification types defined in code and going through code review, so I imagine the security team would want to be consulted about this proposal.

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

We usually discuss tasks in our internal team chat, then write the conclusion here. The most likely outcome is that we won't have time to work on this, as this isn't something related to our team's roadmap. I'm tagging the Security-Team in case they have thoughts about the idea. Basically this would mean that any userscript/gadget could issue a notification type with arbitrary text/action links, right? That is a departure from what we currently have, with notification types defined in code and going through code review, so I imagine the security team would want to be consulted about this proposal.

That would have been my idea. You can't put that in the "extra" array of EchoEvent::create?

sbassett added subscribers: Reedy, sbassett.

Assigning to @Reedy for review.

This is a subset of T58362: Allow users to create custom notifications onwiki, but I don't really think the proposed limitation of just sending one notification to oneself ends up making a significant difference in the engineering work required, nor potential attack scenarios that it makes to evaluate separately.

Change 802877 had a related patch set uploaded (by Samtar; author: Samtar):

[mediawiki/extensions/Echo@master] API: Add `echocreatenotification` action

https://gerrit.wikimedia.org/r/802877

802877 has my quick draft idea on how this could be done — looking past the mountain of TODOs, do y'all see any significant oversights i.r.t. security?

image.png (436×515 px, 21 KB)

This is a subset of T58362: Allow users to create custom notifications onwiki, but I don't really think the proposed limitation of just sending one notification to oneself ends up making a significant difference in the engineering work required, nor potential attack scenarios that it makes to evaluate separately.

I'd agree it probably makes no difference in engineering, but for abuse scenarios I think it does. We already see some "thanks" spammers so if you allow anyone to echo anyone you'd probably have to think about limits/permissions.

802877 has my quick draft idea on how this could be done — looking past the mountain of TODOs, do y'all see any significant oversights i.r.t. security?

image.png (436×515 px, 21 KB)

Looks awesome! I can't comment on security. I see "todo: Better icon!" in the source. I made some recently, what do you have in mind? It would be interesting if the icon would be configurable as well, for reminders I'd use a clock for example. There's a clock on https://doc.wikimedia.org/oojs-ui/master/demos/?page=icons&theme=wikimediaui&direction=ltr&platform=desktop.