Page MenuHomePhabricator

Investigate bug where user receives Wikipedia Library notification before reaching 500 edit threshold
Open, Needs TriagePublic

Description

User HotMess received the Wikipedia Library notification telling them they were eligible to access The Wikipedia Library, but they don't actually have enough edits. At the time of writing (they contacted us 10 hours ago), CentralAuth reports a global edit count of 475.

We shouldn't be sending notifications to users unless we can be confident that when they log in to the platform they'll be able to do so successfully.

Event Timeline

I wondered if deleted contributions might be related, but the user only has 4 deleted contributions as far as I can see.

I think that it might be related to the fact that, back in April, I submitted a (successful) change of username request. Under my prior username, I had ~50-60-ish total contributions (with a couple of deleted contributions from back then because past me was an idiot), so, judging from the timing of the invite, I guess that the notification thing might have counted the contributions under the former username twice.

Might be worth poking that and seeing what breaks or something along those lines.

Our code for checking edit count is super straightforward.

  1. We get the required minimum from config

$twlEditCount = $config->get( 'TwlEditCount' );

  1. We get the global editcount from centralauth

$globalEditCount = $centralAuthUser->getGlobalEditCount();

  1. We return the true/false result of a greater than or equal to comparison

return $globalEditCount >= $twlEditCount;
Link to the code
https://github.com/wikimedia/mediawiki-extensions-TheWikipediaLibrary/blob/1551581b3e7d50c131708399173e736c623987e4/includes/Hooks.php#L168-L171

So, there are only two pieces of data that could be wrong here, either:

  1. the global editcount was incorrect when HotMess made a "qualifying" edit, which is what is being suggested here, or
  2. the configured minimum was not 500.

If it's the first issue, I'm not really sure what we can do about it in terms of code. Central Auth is the system of record for global edits, so we kind of need to either trust it 100% or 0%. So far as I know, we can't go back and look at historical editcounts. If the problem is here, then we need to get in touch with the folks who handle username changes to look at that process and maybe offer mitigation strategies. There might be some heuristic we could use to wait on sending invites for accounts with a recent name change. That's total speculation, though.

The second issue might come into play if the user was doing work in beta. While the user accounts wouldn't match up, I could see a user getting a notification in a beta account, clicking the link, and then being prompted for oauth against their non-eligible production meta account. I haven't tested this yet, it's just me spitballing. Our notification is enabled on beta projects with a minimum editcount of 100. @HotMess, were you doing any work on any beta projects?

So, there are only two pieces of data that could be wrong here, either:

  1. the global editcount was incorrect when HotMess made a "qualifying" edit, which is what is being suggested here, or
  2. the configured minimum was not 500.

If it's the first issue, I'm not really sure what we can do about it in terms of code. Central Auth is the system of record for global edits, so we kind of need to either trust it 100% or 0%. So far as I know, we can't go back and look at historical editcounts. If the problem is here, then we need to get in touch with the folks who handle username changes to look at that process and maybe offer mitigation strategies. There might be some heuristic we could use to wait on sending invites for accounts with a recent name change. That's total speculation, though.

Well, if it helps, I just stumbled upon the xtools contributions counter thing, and it looks like I made ~64 total contributions under the former username (± roughly 4 in the old username in early April, and a few deleted edits), which would have feasibly lead to me getting the invite at ~436 edits if those ones were counted twice. I made 20 global edits since I noticed the notification, so the upper bound for 'when I got the notification' was 455 edits. I have manually reverted 29 of my own edits (all on Wikidata), which would lower the effective upper bound of 'actual contributions' I had made prior to that notification to ~426.

The second issue might come into play if the user was doing work in beta. While the user accounts wouldn't match up, I could see a user getting a notification in a beta account, clicking the link, and then being prompted for oauth against their non-eligible production meta account. I haven't tested this yet, it's just me spitballing. Our notification is enabled on beta projects with a minimum editcount of 100. @HotMess, were you doing any work on any beta projects?

The only projects I've contributed to are Wikipedia, Wikidata, and Wikimedia.

I recieved the notification whilst I was on Wikidata, during my ongoing attempts at properly documenting heights/lengths of hypercoasters (the old fashioned manual way), and I'm not aware of myself being in any beta projects. The closest things to 'beta projects' I'm participating in are the Special:Preferences#mw-prefsection-betafeatures beta preferences, but, on Wikidata, I made well over 100 edits with those enabled before I got the notification, and on Wikipedia I don't think I reached 100 edits with the beta features enabled before I got that notification (I was making a few edits early on this morning, after I got that notification, due to the wording on a few articles bugging me a bit).