⚓ T349054 Adjust and improve Wikifunctions user rights grants for General Availability

	Subject	Repo	Branch	Lines +/-
	[wikifunctions] Alter site to General Availability	operations/mediawiki-config	master	+13 -32

Status	Subtype	Assigned	Task
Resolved		gengh	T349054 Adjust and improve Wikifunctions user rights grants for General Availability
Resolved	BUG REPORT	gengh	T348997 User rights: Logged in users cannot edit the multilingual information of pre-defined objects (e.g. error types)
Resolved		gengh	T349055 User rights: Users can run functions
Resolved		gengh	T349057 User rights: Users can run unsaved code on the implementation page
Resolved		gengh	T349061 User rights: Logged in users can create functions, implementations, tests and others
Resolved		gengh	T349063 User rights: Logged in users can edit function input labels and key labels
Resolved		gengh	T349080 User rights: Logged in users can edit user-contributed functions that are not-running
Resolved		gengh	T349081 User rights: Edit implementations or tests that are connected to functions
Resolved		gengh	T349082 User rights: Logged in users can edit user-contributed objects of non-restricted types
Resolved		Jdforrester-WMF	T349100 Reach agreed product security and monitoring milestones to grant General Availability
Resolved	Security	Jdforrester-WMF	T343458 Allow logged-out users to run (community-approved) implementations on wikifunctions.org via the `wikilambda-execute` right
Resolved		JMeybohm	T347544 Separate deployment for wikifunctions.org
Resolved		Jdforrester-WMF	T346264 Improve wikifunctions logging
Resolved		cmassaro	T343829 Sandboxing Strategy for Wikifunctions
Resolved		cmassaro	T308250 Should Wikifunctions use a WebAssembly runtime?
Resolved	Security	cmassaro	T343709 Wikifunctions Kubernetes evaluator service exposes some sensitive data/functions within the container
Resolved		Jdforrester-WMF	T343388 Split the monolithic function-evaluator service up in production so we have differently-scalable pods for python vs. node
Resolved		Jdforrester-WMF	T343459 Split the wikifunctions k8s pod up in production so we have differently-scalable pods for the orchestrator vs. the evaluator
Resolved		cmassaro	T343165 Disallow Child Process Spawning within the Executors
Resolved		JMeybohm	T347397 Migrate functions-orchestrator service to mw-api-int
Resolved	PRODUCTION ERROR	Jdforrester-WMF	T344998 Wikifunctions functions that require a lookup on wikifunctions.org timing out in the orchestrator, UX instead showing 'http'
Resolved		cmassaro	T347085 Create Executor Interfaces in Evaluator
Resolved		cmassaro	T325589 Refactor evaluator so that executor subprocess is initialized and then passed to maybeRunZ7

gengh created this task.Oct 17 2023, 6:18 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:23 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:30 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:39 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:45 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:55 AM

gengh updated the task description. (Show Details)Oct 17 2023, 6:59 AM

gengh updated the task description. (Show Details)Oct 17 2023, 7:03 AM

gengh updated the task description. (Show Details)Oct 17 2023, 10:07 AM

gengh updated the task description. (Show Details)Oct 17 2023, 10:27 AM

gengh updated the task description. (Show Details)Oct 17 2023, 10:49 AM

Most of these aren't about GA, but later milestones. T349061 plus T349055 is the GA target; the rest are not expected for months. Should we re-title this task?

T349055: agreed
T349057: any users that can go to the edit page will be able to run unsaved code. Do we wanna allow this? If not, we need to do this task to add some restrictions to this. There are more details in the task
T349060: Understood, will mark this for future
T349061: agreed
T349063: this is implied in Denny's writeup:

Furthermore, we are also considerably opening up editing rights. From now on, all logged in users can propose newedit Wikifunctions objects, i.e. create and maintain functions, tests, implementations and more, and edit unapproved ones, rather than just special users with the Functioneer status. [...] Functioneers will retain the right to connect and disconnect tests and implementations on most functions, which makes the function "live" so that people can use it.

T348997: I totally missed this one but this should be included in "all users can add multilingual data", along with key labels and argument labels
T349080: As detailed in the task, this is also implied in Denny's writeup,
T349081: This is a rights discrepancy that should be fixed
T349082: This is also implied in Denny's writeup.

Summing up:
I believe the only thing in my list that corresponds to pushing type creation and edition to the future is T349060.
We can also consider T348997 and T349081 as bugs, and not too important for GA release, but we should address them soon.
The rest are all necessary to accomplish what we are saying in our writeup, which is what I am understanding as our goal.

gengh updated the task description. (Show Details)Oct 17 2023, 1:53 PM

Jdforrester-WMF renamed this task from Wikifunctions User Rights for General Availability to Adjust and improve Wikifunctions user rights grants for General Availability.Oct 17 2023, 2:03 PM

Jdforrester-WMF updated the task description. (Show Details)

Jdforrester-WMF added subtasks: T348997: User rights: Logged in users cannot edit the multilingual information of pre-defined objects (e.g. error types), T349055: User rights: Users can run functions, T349057: User rights: Users can run unsaved code on the implementation page, T349061: User rights: Logged in users can create functions, implementations, tests and others, T349063: User rights: Logged in users can edit function input labels and key labels, T349080: User rights: Logged in users can edit user-contributed functions that are not-running, T349081: User rights: Edit implementations or tests that are connected to functions, T349082: User rights: Logged in users can edit user-contributed objects of non-restricted types.

Jdforrester-WMF moved this task from To Triage to Backlog on the Abstract Wikipedia team board.Oct 17 2023, 2:24 PM

These is a summary of the changes we need to do in each repo:

wmf-config changes:

T349055 wikilambda-execute, true, *
T349061 wikilambda-create-function, true, user
T349061 wikilambda-create-implementation, true, user
T349061 wikilambda-create-tester, true, user
T349061 wikilambda-create, true, user
T349063 wikilambda-edit-argument-label, true, user
T349063 wikilambda-edit-key, true, user
T349080 wikilambda-edit-user-function, true, user
T349080 remove wikilambda-edit-function
T349082 wikilambda-edit, true, user
T349082 wikilambda-implementation, true, user
T349082 wikilambda-tester, true, user

Wikilambda changes:

T349055 remove restriction in front-end for anonymous users
T349057 figure out how to add particular right for running unsaved code
T348997 add new right: wikilambda-edit-error-type-label, true, user
T349080 set wikilambda-edit-function-definition to [true, user]
T349080 remove wikilambda-edit-function
T349081 add rule for editing active implementation
T349082 wikilambda-implementation, add to authorizationRules.yml
T349082 wikilambda-tester, add to authorizationRules.yml

As discussed today, @Jdforrester-WMF will address the changes on wmf-config, while I will address the Wikilambda patches.

Change 966570 had a related patch set uploaded (by Jforrester; author: Jforrester):

[operations/mediawiki-config@master] [wikifunctions] Alter site to General Availability

https://gerrit.wikimedia.org/r/966570

gerritbot added a project: Patch-For-Review.Oct 17 2023, 4:14 PM

Jdforrester-WMF triaged this task as High priority.Oct 17 2023, 6:38 PM

gengh updated the task description. (Show Details)Oct 17 2023, 8:03 PM

Jdforrester-WMF changed the status of subtask T349080: User rights: Logged in users can edit user-contributed functions that are not-running from Open to In Progress.Oct 19 2023, 4:38 PM

Jdforrester-WMF changed the status of subtask T349081: User rights: Edit implementations or tests that are connected to functions from Open to In Progress.

Jdforrester-WMF changed the status of subtask T349082: User rights: Logged in users can edit user-contributed objects of non-restricted types from Open to In Progress.

Jdforrester-WMF changed the status of subtask T349061: User rights: Logged in users can create functions, implementations, tests and others from Open to In Progress.

Jdforrester-WMF changed the status of subtask T349063: User rights: Logged in users can edit function input labels and key labels from Open to In Progress.

Jdforrester-WMF changed the status of subtask T349055: User rights: Users can run functions from Open to In Progress.

Jdforrester-WMF changed the status of subtask T349057: User rights: Users can run unsaved code on the implementation page from Open to In Progress.

Jdforrester-WMF changed the status of subtask T348997: User rights: Logged in users cannot edit the multilingual information of pre-defined objects (e.g. error types) from Open to In Progress.

LucasWerkmeister mentioned this in T349966: Define grants for Wikifunctions-specific user rights so that people can do things via bots or OAuth.Oct 28 2023, 11:59 PM

Jdforrester-WMF changed the task status from Open to In Progress.Oct 30 2023, 8:19 PM

Jdforrester-WMF assigned this task to gengh.

Jdforrester-WMF updated the task description. (Show Details)

Jdforrester-WMF moved this task from Backlog to To deploy on the Abstract Wikipedia team board.

Etonkovidova closed subtask T349055: User rights: Users can run functions as Resolved.Nov 2 2023, 8:50 PM

Change 966570 merged by jenkins-bot:

[operations/mediawiki-config@master] [wikifunctions] Alter site to General Availability

https://gerrit.wikimedia.org/r/966570

Mentioned in SAL (#wikimedia-operations) [2023-11-07T14:03:16Z] <jforrester@deploy2002> Started scap: Backport for [[gerrit:966570|[wikifunctions] Alter site to General Availability (T349054 T349061 T349063 T349080 T349082)]]

Mentioned in SAL (#wikimedia-operations) [2023-11-07T14:04:43Z] <jforrester@deploy2002> jforrester: Backport for [[gerrit:966570|[wikifunctions] Alter site to General Availability (T349054 T349061 T349063 T349080 T349082)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Maintenance_bot removed a project: Patch-For-Review.Nov 7 2023, 2:10 PM

Mentioned in SAL (#wikimedia-operations) [2023-11-07T14:10:17Z] <jforrester@deploy2002> Finished scap: Backport for [[gerrit:966570|[wikifunctions] Alter site to General Availability (T349054 T349061 T349063 T349080 T349082)]] (duration: 07m 00s)