Change 941964 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] clienthints REST API: Perform matching user check with RAW audience

https://gerrit.wikimedia.org/r/941964

@STran This would be a nice first review to help onboard you to the project (concepts to understand, but not much code)

Change 941964 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] clienthints REST API: Perform matching user check with RAW audience

https://gerrit.wikimedia.org/r/941964

@Dreamy_Jazz I cannot set client hints for revisions of deleted pages. It returns:

{'errorKey': 'rest-nonexistent-revision', 'messageTranslations': {'en': 'The specified revision (10377) does not exist'}, 'httpCode': 404, 'httpReason': 'Not Found'}

For revisions with restricted visibility, if the user does not have permission to see the username or IP which created the revision should they be allowed to set the client hints? The risk I see is that you can infer from the response of /rest.php/checkuser/v0/useragent-clienthints/revision/$revid whether or not you created the revision. Perhaps this is not a problem for a logged in user, but might be for an IP which could be shared by multiple people.

They could perhaps always be shown the 'User $id is not the author of revision $id' so as not to reveal any information.

In T342790#9073220, @dom_walden wrote:

@Dreamy_Jazz I cannot set client hints for revisions of deleted pages. It returns:

{'errorKey': 'rest-nonexistent-revision', 'messageTranslations': {'en': 'The specified revision (10377) does not exist'}, 'httpCode': 404, 'httpReason': 'Not Found'}

I will investigate this. Thanks for spotting.

For revisions with restricted visibility, if the user does not have permission to see the username or IP which created the revision should they be allowed to set the client hints? The risk I see is that you can infer from the response of /rest.php/checkuser/v0/useragent-clienthints/revision/$revid whether or not you created the revision. Perhaps this is not a problem for a logged in user, but might be for an IP which could be shared by multiple people.

They could perhaps always be shown the 'User $id is not the author of revision $id' so as not to reveal any information.

This was motivated to avoid race conditions where the performer is restricted before the API request is performed. This could happen for a user on a slow network and if some kind of restriction of the username is performed before the API request finishes.

I think they should be allowed to set Client Hints assuming that the other checks are fine.

To combat the time that a user has to investigate whether a deleted revision was made by them, the check that ensures the API call was made within the last 30 minutes (T342134) could be placed before the check if the performer of the action is deleted.

To combat the time that a user has to investigate whether a deleted revision was made by them, the check that ensures the API call was made within the last 30 minutes (T342134) could be placed before the check if the performer of the action is deleted.

This makes sense to me.

In T342790#9073220, @dom_walden wrote:

@Dreamy_Jazz I cannot set client hints for revisions of deleted pages. It returns:

Raised as T345157.

! In T342790#9073530, @Dreamy_Jazz wrote:
To combat the time that a user has to investigate whether a deleted revision was made by them, the check that ensures the API call was made within the last 30 minutes (T342134) could be placed before the check if the performer of the action is deleted.

Raised as T345165.

Thanks for the in-depth testing!