Notes from task breakdown:

• authentication
  • for free? @Jakob_WMDE checks
• authorization2: need to check whether user can edit the particular item
  • prerequisites @Silvan_WMDE creates ticket
    • create a PermissionChecker service interface with a canEdit( itemId $id, User $user ): bool method
    • create a User domain class containing the username
  • implement PermissionChecker using UserFactory and EntityPermissionChecker @Jakob_WMDE creates ticket
  • use PermissionChecker in the use case after calling revisionMetadataRetriever @Ollie.Shotton_WMDE creates ticket
    • return error response if not allowed
    • e2e test with protected item

Questions:
What is the response for protected items?

What is the response for protected items?

code:protected-page
message:`This page is currently protected and can only be edited by certain users.

Per daily discussion: instead of responding with specific errors for different reasons, let's keep it simple for now and respond with the same kind of error in all cases. This error should look like the one MediaWiki responds with when then route handler's needsWriteAccess check fails.

Turns out that the canEdit() check we are performing in the PermissionChecker may not only fail for protected pages, but also for other reasons, such as (partial) user blocks. Since we already had agreed, that the error response should be the same as the MediaWiki framework response, when the route handler's needsWriteAccess check fails, we are now returning a generic "permission denied" error from the use case. However, that never makes it to the surface, because the route handler detects it and turns it into the framework's standard 403 Forbidden response.

Can be tested on https://wikidata.beta.wmflabs.org/wiki/Q111, which I marked as protected for two weeks.

Tested a few scenarios, and looks good. Verified.