| Urbanecm_WMF | |
| Aug 22 2023, 1:21 PM |
| F41621825: Screen Shot 2023-12-22 at 2.23.00 PM.png | |
| Dec 22 2023, 10:54 PM |
| F37157505: image.png | |
| Aug 22 2023, 1:21 PM |
Temporary accounts are meant to expire after 1 year since their last edit, see T300271 and T344695. To ensure the expiration is not sudden, we should add a notification 10 days before the expiration happens. This notification should look like this:
See implementation notes at T300271#9106396.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | KStoller-WMF | T326877 [Epic] Update Growth Team-owned products that may be affected by IP Masking | |||
| Resolved | • lbowmaker | T262321 IP Masking | |||
| Resolved | Urbanecm_WMF | T300271 [IP Masking] Temporary Account Expiration | |||
| Resolved | Sgs | T344694 [IP Masking] Alert temporary accounts 10 days before expiration |
Change 952396 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[mediawiki/core@master] Add User::getGlobalRegistration
Change 952397 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[mediawiki/extensions/CentralAuth@master] Implement UserGetGlobalRegistrationHook
A couple of questions about the popup behavior:
Reminder popup (10 days) before we know the session is about to expire.
The popup is permanently present with informative text per requirements in T330510. Should we make the default state of the popup open for users who need to be notified?
Once the temporary user dismisses the reminder popup, then it should not display again.
For the same reason than above, does this mean the text needs to change back to the original copy in T330510? Or, in case we decide to default the popup to an open state, then we might want to keep it closed after the user dismisses it.
Change 953988 had a related patch set uploaded (by Sergio Gimeno; author: Sergio Gimeno):
[mediawiki/core@master] [WIP] IP masking: notify users whos account expires soon
Yes please
Once the temporary user dismisses the reminder popup, then it should not display again.
For the same reason than above, does this mean the text needs to change back to the original copy in T330510? Or, in case we decide to default the popup to an open state, then we might want to keep it closed after the user dismisses it.
Once dismissed the expiry popup no longer exists. And the info icon on the temp account status bar if hovered/tapped by the user is whatever is on the original text.
Alright. The current temp account informative popup has the "auto close" flag enabled, meaning the popup will close whenever the widget loses its focus. imo this could lead to some users not seeing the expiration alert because of an unwanted click anywhere in the screen. Should we enforce the closing of the popup via its close button for this case to prevent such situation?
Another situation we might want to handle is when a temp user account will expire within the next 23h 59minutes. Should we show a different copy in that case? eg: less than a day or within 17 hours
In T344694#9139705, @Sgs wrote:
Alright. The current temp account informative popup has the "auto close" flag enabled, meaning the popup will close whenever the widget loses its focus. imo this could lead to some users not seeing the expiration alert because of an unwanted click anywhere in the screen. Should we enforce the closing of the popup via its close button for this case to prevent such situation?
@RHo is out this week, so if you are blocked, I would suggest disabling the "auto close" flag if that's easy. And we can follow up with a change if Rho disagrees.
Another situation we might want to handle is when a temp user account will expire within the next 23h 59minutes. Should we show a different copy in that case? eg: less than a day or within 17 hours
Let's try to keep this simple. I predict that it will be a very small funnel of temp accounts that keep the same temp account for a full year, so I'm honestly not too concerned with this use case. But if it's fairly simple, I suggest something like:
Your temporary account expires in less than a day. for temp accounts that will expire in <24 hours.
I'm not opposed to the making that hourly if that's just as easy to implement:
Your temporary account expires in less than [#] hour(s). But I imagine that's more work for internationalization, and honestly I don't think we want this to feel like a countdown, just a basic warning.
+1 to comment from @KStoller-WMF about both disabling auto-close for the expiry alert, and to keep simple to the "less than a day" message.
Change 957695 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[mediawiki/core@master] Add UserRegistrationLookup
Change 952396 abandoned by Urbanecm:
[mediawiki/core@master] Add User::getGlobalRegistration
Reason:
abandoning in favour of https://gerrit.wikimedia.org/r/c/mediawiki/core/+/957695
Change 957700 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[mediawiki/extensions/CentralAuth@master] Add CentralAuthGlobalRegistrationProvider
Change 952397 abandoned by Urbanecm:
[mediawiki/extensions/CentralAuth@master] Implement UserGetGlobalRegistrationHook
Reason:
in favour of https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/957700
Change 957695 merged by jenkins-bot:
[mediawiki/core@master] Add UserRegistrationLookup
Change 957700 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Add CentralAuthGlobalRegistrationProvider
Change 957963 had a related patch set uploaded (by Mainframe98; author: Mainframe98):
[mediawiki/core@master] Ensure that ExtensionProcessor exports UserRegistrationProviders
Change 957986 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[mediawiki/core@master] ExtensionProcessor: Add UserRegistrationProviders as a global variable
Change 957986 abandoned by Urbanecm:
[mediawiki/core@master] ExtensionProcessor: Add UserRegistrationProviders as a global variable
Reason:
dupe of https://gerrit.wikimedia.org/r/c/mediawiki/core/+/957963
Change 957963 merged by jenkins-bot:
[mediawiki/core@master] Ensure that ExtensionProcessor exports UserRegistrationProviders
Change 953988 merged by jenkins-bot:
[mediawiki/core@master] IP masking: notify users whose account expires soon
@Sgs, @Urbanecm_WMF - to clarify
Change 983755 had a related patch set uploaded (by Sergio Gimeno; author: Sergio Gimeno):
[operations/mediawiki-config@master] Temporary users: set notifyBeforeExpirationDays same as expireAfterDays
Correct
- the popup "Your temporary account expires in x days" - the x will reflect the actual count of days left before expiration? e.g. "expires in 5 days", "expires in 3 days" etc ?
Correct, although currently we have set the expiration after 1 day so it will be not possible to assert the countdown. We can increase it if you want to test that.
- will the popup appear on other wikis (not an original wiki where a temp account was created) if a temp user visits them?
Yes it will, the popup is per wiki and device.
- why test temp users do not see the popup in beta upon creation? I thought that the account expiration on cswiki beta was set to 48 hours?
It is currently set to 24h but we were missing to enable the expiration warning. It should be testable once 983755 is merged.
Change 983755 merged by jenkins-bot:
[operations/mediawiki-config@master] Temporary users: set notifyBeforeExpirationDays to ten days
I deployed the change Sergio quoted, and the expiration warning should be visible in betalabs now.
