Page MenuHomePhabricator

Add extension NetworkSession to all wmf wikis
Closed, ResolvedPublic

Description

Feature summary (what you would like to be able to do and where):

Provide a method for internal services to run read-only api requests on private wikis

Use case(s)

As a developer of a supporting application to mediawiki I need to be able to make read-only api calls against private wikis.

The CirrusSearch streaming updater, due to replace the existing job-based search updater, needs to perform a specific api call to collect the information that needs to be indexed into the search engine. For the majority of wikis, such as mediawiki.org, we could query the public api. But that would fail on the private wikis.

See T345185 for initial design planning of the access method.

Needed for deployment of the extensions:

  • A review from the product owner for the affected area, if applicable. General concept reviewed by multiple members of core platform, who own Authentication and Authorization. Code review from Gergő Tisza, documented individual maintainer of same.
  • Application security review – T357353: Application Security Review Request : NetworkSession MediaWiki extension
  • Add to the json make-wmf-branch release tool
  • Wait until wmf.15 and wmf.16 are the branches in prod (or later)
  • Add to extension-list
  • Add loading flag to InitialiseSettings.php, default false, and use flag in CommonSettings.php with other config as appropriate
  • Set live in InitialiseSettings-labs.php to test on Beta Cluster
  • Set live in InitialiseSettings.php

Event Timeline

The code has been deployed (but not loaded) to the beta cluster since Idea47a43d9fb.

Change #1055484 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):

[operations/mediawiki-config@master] beta: Enable NetworkSession extension

https://gerrit.wikimedia.org/r/1055484

Change #1055958 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):

[integration/config@master] zuul: promote NetworkSession to wikimedia prod

https://gerrit.wikimedia.org/r/1055958

The code has been deployed (but not loaded) to the beta cluster since Idea47a43d9fb.

The extension actually also needs to be added to extension-list before beta cluster deployment since that is used to build the CDB database.

See https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment#Deploy_to_Beta_Cluster.

The code has been deployed (but not loaded) to the beta cluster since Idea47a43d9fb.

The extension actually also needs to be added to extension-list before beta cluster deployment since that is used to build the CDB database.

See https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment#Deploy_to_Beta_Cluster.

Thanks for catching that, i had read through it but i guess that detail didn't quite click. Will do.

Change #1058167 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):

[operations/mediawiki-config@master] Add NetworkSession extension

https://gerrit.wikimedia.org/r/1058167

Change #1058167 merged by jenkins-bot:

[operations/mediawiki-config@master] Add NetworkSession extension

https://gerrit.wikimedia.org/r/1058167

Mentioned in SAL (#wikimedia-operations) [2024-07-30T20:03:46Z] <cjming@deploy1003> Started scap sync-world: Backport for [[gerrit:rECNO1058167597c1|Add NetworkSession extension (T355267)]]

Mentioned in SAL (#wikimedia-operations) [2024-07-30T20:38:07Z] <cjming@deploy1003> ebernhardson, cjming: Backport for [[gerrit:rECNO1058167597c1|Add NetworkSession extension (T355267)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-07-30T20:48:55Z] <cjming@deploy1003> Finished scap: Backport for [[gerrit:rECNO1058167597c1|Add NetworkSession extension (T355267)]] (duration: 45m 08s)

Change #1055484 merged by jenkins-bot:

[operations/mediawiki-config@master] beta: Enable NetworkSession extension

https://gerrit.wikimedia.org/r/1055484

Mentioned in SAL (#wikimedia-operations) [2024-07-31T20:37:05Z] <cjming@deploy1003> Started scap sync-world: Backport for [[gerrit:1055484|beta: Enable NetworkSession extension (T355267)]]

Mentioned in SAL (#wikimedia-operations) [2024-07-31T20:39:22Z] <cjming@deploy1003> ebernhardson, cjming: Backport for [[gerrit:1055484|beta: Enable NetworkSession extension (T355267)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-07-31T20:44:52Z] <cjming@deploy1003> Finished scap: Backport for [[gerrit:1055484|beta: Enable NetworkSession extension (T355267)]] (duration: 07m 47s)

Extension is now live on beta cluster, verified that it works as expected. Specifically:

Fails everwhere:

curl -H 'Authorization: NetworkSession wrongtoken' 'https://en.wikipedia.beta.wmflabs.org/w/api.php?action=query&format=json&prop=cirrusbuilddoc&pageids=1&formatversion=2'

Fails from outside cloud, works inside cloud:

curl -H 'Authorization: NetworkSession networksession-testuser-token' 'https://en.wikipedia.beta.wmflabs.org/w/api.php? action=query&format=json&prop=cirrusbuilddoc&pageids=1&formatversion=2'

Current intent is to ship to prod early next week.

Change #1060123 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):

[operations/mediawiki-config@master] Enable NetworkSession extension for most wikis

https://gerrit.wikimedia.org/r/1060123

Change #1060123 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable NetworkSession extension for most wikis

https://gerrit.wikimedia.org/r/1060123

Mentioned in SAL (#wikimedia-operations) [2024-08-06T20:47:48Z] <kindrobot@deploy1003> Started scap sync-world: Backport for [[gerrit:1060152|Promote dark mode for anons on various wikis - take 2 (T371070 T371084)]], [[gerrit:1060123|Enable NetworkSession extension for most wikis (T355267)]], [[gerrit:1060139|fix(i18n): adjust broken mentorship eligibility copy (T371775 T370318)]], [[gerrit:1060136|fix(i18n): adjust broken mentorship eligibility copy (T371775 T370318)]]

Mentioned in SAL (#wikimedia-operations) [2024-08-06T21:21:27Z] <kindrobot@deploy1003> toyofuku, ebernhardson, kindrobot, migr: Backport for [[gerrit:1060152|Promote dark mode for anons on various wikis - take 2 (T371070 T371084)]], [[gerrit:1060123|Enable NetworkSession extension for most wikis (T355267)]], [[gerrit:1060139|fix(i18n): adjust broken mentorship eligibility copy (T371775 T370318)]], [[gerrit:1060136|fix(i18n): adjust broken mentorship eligibility copy (T371775 T37031

Mentioned in SAL (#wikimedia-operations) [2024-08-06T21:34:53Z] <kindrobot@deploy1003> Finished scap: Backport for [[gerrit:1060152|Promote dark mode for anons on various wikis - take 2 (T371070 T371084)]], [[gerrit:1060123|Enable NetworkSession extension for most wikis (T355267)]], [[gerrit:1060139|fix(i18n): adjust broken mentorship eligibility copy (T371775 T370318)]], [[gerrit:1060136|fix(i18n): adjust broken mentorship eligibility copy (T371775 T370318)]] (duration: 47m 05s)

This is mostly complete, but not closing it out since https://gerrit.wikimedia.org/r/c/integration/config/+/1055958 is still open.

Change #1055958 merged by jenkins-bot:

[integration/config@master] zuul: promote NetworkSession to wikimedia prod

https://gerrit.wikimedia.org/r/1055958

Mentioned in SAL (#wikimedia-releng) [2024-08-09T07:43:11Z] <James_F> Zuul: Note that NetworkSession is now in Wikimedia prod, for T355267