Page MenuHomePhabricator

wikitech hook to disable Gerrit user uses partial matches to identify account
Open, Needs TriagePublic

Description

From T307287#7902526 , we blocked on wikitech a user epic which has lead Gerrit to block the unrelated account EpicPupper

The reason is we issued a block for Wikitech user epic at https://wikitech.wikimedia.org/wiki/Special:BlockList/epic . We have a hook in https://gerrit.wikimedia.org/g/operations/mediawiki-config/+/master/wmf-config/wikitech.php which triggers an API request to Gerrit:

DELETE /accounts/epic/active

The delete account end point is described at https://gerrit.wikimedia.org/r/Documentation/rest-api-accounts.html#delete-active and the account-id is described at https://gerrit.wikimedia.org/r/Documentation/rest-api-accounts.html#account-id. It triggers a resolution of the given name which can match a mail, full name, a user name and even does partial match. As long as only one account is found, it will match. Thus when we blocked epic Gerrit resolved that to a single account EpicPupper which turned out to be the wrong one.

We need the hook to be adjusted to resolve the name first using https://gerrit.wikimedia.org/r/Documentation/rest-api-accounts.html#query-account probably using the search operator username:'USERNAME' (https://gerrit.wikimedia.org/r/Documentation/user-search-accounts.html#username). Should file a task with that.