I think it would be better to use $wgAutopromoteOnce so that access can be revoked like other user groups without needing a revoke group. (See wmgAutopromoteOnceonEditin InitialiseSettings.php for examples of current use.)

@JJMC89 Thanks for the suggestion. If a user is removed from the group by accident, will it be possible to add them back again?

In T334620#8780157, @Tchanders wrote:

@JJMC89 Thanks for the suggestion. If a user is removed from the group by accident, will it be possible to add them back again?

Yes, the group wouldn't be different from any other user group. ($wgAddGroups/$wgRemoveGroups would control who could add/remove the group.)

The extendedconfirmed group on enwiki works this way and can be manually added/removed by admins outside of the configured auto promote once on edit.

Thanks @JJMC89 - task updated

$wgAddGroups/$wgRemoveGroups would control who could add/remove the group.

We can do this in a follow-up task. @Niharika who should we allow to do this?

Change 909005 had a related patch set uploaded (by TsepoThoabala; author: TsepoThoabala):

[mediawiki/extensions/CheckUser@master] Create group for assigning checkuser-temporary-account right

https://gerrit.wikimedia.org/r/909005

Change 909005 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Create group for assigning checkuser-temporary-account right

https://gerrit.wikimedia.org/r/909005

Change 909668 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] Add messages for checkuser-temporary-account-viewer group

https://gerrit.wikimedia.org/r/909668

Change 909668 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add messages for checkuser-temporary-account-viewer group

https://gerrit.wikimedia.org/r/909668

Would it be possible to temporarily deactivate this group / feature / messages for Wikimedia wikis until IP masking is enabled? They're appearing now in Special:ListGroupRights. Thanks.

@TThoabala Is this what you are looking for? Also, what do you think about what MarcoAurelio said above? Thanks!

OS: macOS 13.3
Browser: Chrome 112 & Safari 16.4
Skins: Vector, 2022, 2010, Minvera, Monobook, Timeless

New group, checkuser-temporary-account-viewer

Same rights- viewing IP address 1fo2

Same rights- viewing IP address 2fo2

Change 911790 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] Revert "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/911790

In T334620#8793200, @MarcoAurelio wrote:

Would it be possible to temporarily deactivate this group / feature / messages for Wikimedia wikis until IP masking is enabled? They're appearing now in Special:ListGroupRights. Thanks.

I've created a revert commit.

We can keep the messages (added in the follow-up) and we should revert the revert once we're ready to deploy.

Change 911790 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Revert "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/911790

Note current Wikimedia Access to Temporary Account IP Addresses Policy has a "not blocked in more than one project" requirement, which is copied from board election eligibility, and I consider it not appropriate as a required minimal requirement; in T356294#9504584 I propose the it be amended so this requirement should be removed. Actually modifying the policy requires WMF legal.