Page MenuHomePhabricator

Give Translate Admin group on edit-legal rights on Foundation Governance Wiki (foundation.wikimedia.org)
Closed, ResolvedPublic

Description

It has been noticed by some of the Global Sysops (who are graciously helping with monitoring of Foundation Governance Wiki) that their rights do not provide them with Translate Admin rights on that wiki - which prevents them from being able to delete translated pages.

We should fix this specifically for GovWiki - but perhaps this should be fixed for all future uses of Translate extension on Foundation hosted Wikis?

UPDATE:
Code-level assigning of Translate Admin rights to Global Sysops specifically should not be done via code. There may be some rights related issues to resolve to get Global Sysops access to provide support.

Adding 'edit-legal' rights to Translate Admin group should resolve this issue for Translate Admins (including Global Sysops with those permissions) on GovWiki.

Event Timeline

The permissions global sysops have are controlled on-wiki, and not via Phabricator, and they don't appear to have translation admin rights per https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions. Any steward could fix that, so it should probably be requested at https://meta.wikimedia.org/wiki/Stewards%27_noticeboard or https://meta.wikimedia.org/wiki/Steward_requests/Miscellaneous.

Change 959354 had a related patch set uploaded (by Varnent; author: Varnent):

[operations/mediawiki-config@master] [foundationwiki] Grant translation admin rights to 'sysop' group

https://gerrit.wikimedia.org/r/959354

We have had some luck in the past with patches similar to one submitted for this.

@Nikerabbit - do you by chance have any sense on if this would work or not? Either way - seems prudent addition to setup to make.

The permissions global sysops have are controlled on-wiki, and not via Phabricator, and they don't appear to have translation admin rights per https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions. Any steward could fix that, so it should probably be requested at https://meta.wikimedia.org/wiki/Stewards%27_noticeboard or https://meta.wikimedia.org/wiki/Steward_requests/Miscellaneous.

In the past - global changes to permissions have been done via code (example: T297396). This is not specific to any individual wiki account. So it is about changing the defaults for https://foundation.wikimedia.org/wiki/Special:GlobalGroupPermissions - which in my experience has generally been done via Phabricator. But I am open to other ideas/suggestions if you have any. :)

The distinction is local rights are done via code, and global rights are done on-wiki. Yes, this is bizarre. The patch you wrote will succeed in granting translate admin to local admins on WMF-wiki, and will create a local "global-sysop" group with no members, which is not what you want.

The permissions global sysops have are controlled on-wiki, and not via Phabricator, and they don't appear to have translation admin rights per https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions. Any steward could fix that, so it should probably be requested at https://meta.wikimedia.org/wiki/Stewards%27_noticeboard or https://meta.wikimedia.org/wiki/Steward_requests/Miscellaneous.

In the past - global changes to permissions have been done via code (example: T297396). This is not specific to any individual wiki account. So it is about changing the defaults for https://foundation.wikimedia.org/wiki/Special:GlobalGroupPermissions - which in my experience has generally been done via Phabricator. But I am open to other ideas/suggestions if you have any. :)

Ahh - I think I see what you mean. I have gone ahead and pinged the Stewards on-wiki. Thank you!!

The distinction is local rights are done via code, and global rights are done on-wiki. Yes, this is bizarre. The patch you wrote will succeed in granting translate admin to local admins on WMF-wiki, and will create a local "global-sysop" group with no members, which is not what you want.

Right - given is local to just one wiki - I was hoping there might be a global group we could utilize. Either way - it would be good for admins to have it. I do not imagine that carries over to Global Sysops. Are there any odd groups they inherit membership in we could piggy-back on?

Not that I know of. Either you manually grant local translation rights to global sysops on WMF wiki, or the stewards grant translationadmin rights to global sysops on all GS wikis. There's no other way around it.

Currently declined the stewards onwiki request; forking the wikiset just to add this for one project isn't the best course of action; we are of course open to a community discussion about adding the translation admin permissions to the entire GS opt-in wikiset; please open a discussion on meta-wiki if that is desired.

Right - given is local to just one wiki - I was hoping there might be a global group we could utilize.

This is currently not possible without granting global sysops those rights on all wikis.

Why not just grant translation admin rights manually to those GS who want to help (like you did here and here)?

Well, the premise of translate adminship was always that people need to go through a process to get those rights, such as to confirm and demonstrate that they are familiar with the relevant documentation. In some wikis admins can self-assign the rights, but I do not see why this should extend to global sysops, it is unlikely that a vandal would happen to be a translate admin and thus a translatable page would need to be deleted for CVN reasons.

The distinction is local rights are done via code, and global rights are done on-wiki. Yes, this is bizarre

I do not see what is bizarre. I mean, yes, there should be a special page for local permissions management as well, but this is the way this has been for over a decade and it is a common knowledge that global permission are managed by stewards.

Currently declined the stewards onwiki request; forking the wikiset just to add this for one project isn't the best course of action; we are of course open to a community discussion about adding the translation admin permissions to the entire GS opt-in wikiset; please open a discussion on meta-wiki if that is desired.

I believe this can be closed as wrong venue/invalid.

Currently declined the stewards onwiki request; forking the wikiset just to add this for one project isn't the best course of action; we are of course open to a community discussion about adding the translation admin permissions to the entire GS opt-in wikiset; please open a discussion on meta-wiki if that is desired.

I believe this can be closed as wrong venue/invalid.

I am still talking with at least one Global Sysop on some barriers they are facing. So would like to keep this ticket open to track that and also document what process is determined for Global Sysops in general so there's a record on Phabricator.

Change 959354 abandoned by Varnent:

[operations/mediawiki-config@master] [foundationwiki] Grant translation admin rights to 'sysop' and 'global-sysop' groups

Reason:

Looking to resolve with different rights adjustments and on-wiki process.

https://gerrit.wikimedia.org/r/959354

Varnent renamed this task from Give Global Sysops group rights to Translate Admin group on Foundation Governance Wiki (foundation.wikimedia.org) to Give Translate Admin group on edit-legal rights on Foundation Governance Wiki (foundation.wikimedia.org) for use by Global Sysops.Oct 5 2023, 6:51 PM
Varnent updated the task description. (Show Details)

Adding 'edit-legal' rights to Translate Admin group should resolve this issue for Global Sysops permitted to be Translate Admins on GovWiki.

I have verified with Foundation's Legal dept that this approach is fine given the "edit access" this will provide to "Global Sysops" as a method of making sure Translate Admins have the full access they need.

Varnent renamed this task from Give Translate Admin group on edit-legal rights on Foundation Governance Wiki (foundation.wikimedia.org) for use by Global Sysops to Give Translate Admin group on edit-legal rights on Foundation Governance Wiki (foundation.wikimedia.org).Oct 5 2023, 6:55 PM
Varnent updated the task description. (Show Details)

Change 963801 had a related patch set uploaded (by Varnent; author: Varnent):

[operations/mediawiki-config@master] Provide 'translationadmin' group with 'edit-legal' right.

https://gerrit.wikimedia.org/r/963801

Change 963801 merged by jenkins-bot:

[operations/mediawiki-config@master] [foundationwiki] Provide 'translationadmin' group with 'edit-legal' right

https://gerrit.wikimedia.org/r/963801

Mentioned in SAL (#wikimedia-operations) [2023-10-05T20:53:56Z] <thcipriani@deploy2002> Started scap: Backport for [[gerrit:962082|[foundationwiki] Add Endowment, Agenda, Committee, and Memory namespaces (T347762 T347822 T348268)]], [[gerrit:963801|[foundationwiki] Provide 'translationadmin' group with 'edit-legal' right (T346187)]]

Mentioned in SAL (#wikimedia-operations) [2023-10-05T20:55:13Z] <thcipriani@deploy2002> thcipriani and varnent: Backport for [[gerrit:962082|[foundationwiki] Add Endowment, Agenda, Committee, and Memory namespaces (T347762 T347822 T348268)]], [[gerrit:963801|[foundationwiki] Provide 'translationadmin' group with 'edit-legal' right (T346187)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-10-05T21:03:53Z] <thcipriani@deploy2002> Finished scap: Backport for [[gerrit:962082|[foundationwiki] Add Endowment, Agenda, Committee, and Memory namespaces (T347762 T347822 T348268)]], [[gerrit:963801|[foundationwiki] Provide 'translationadmin' group with 'edit-legal' right (T346187)]] (duration: 09m 56s)

This patch solved the issue for Global Sysops granted Translate Admin rights - and the "process" for Global Sysops to request those rights have been documented on Foundation GovWiki: https://foundation.wikimedia.org/wiki/Wikimedia:Accounts_policy#Translation_administrator_rights