Page MenuHomePhabricator

Allow users to be autopromoted into checkuser-temporary-account-viewer group based on local criteria
Closed, ResolvedPublic

Description

Background

The IP reveal access policy allows users to automatically gain the right to reveal IP addresses for temporary accounts if:

  1. User account is a minimum of 6 months old, and
  2. User account has made a minimum of 300 edits to the local project.

As discussed in the parent task (T327913), we will use the AutoPromoteOnce mechanism for this. An alternative would be to use AutoPromote but it wouldn't be possible to revoke access.

It is worth reading the following documentation pages:

Technical background

Useful reading:

AutopromoteOnce groups are added to a user's groups in UserGroupManager::getUserAutopromoteOnceGroups.

This checks the user against the AutoPromoteOnce config, which defines which user groups a user can be automatically added to, and what the criteria are for adding a user to each group. This config also defines what type of event should trigger such a check (e.g. when a user edits, when a user views the page).

MediaWiki defines some autopromote conditions, including APCOND_EDITCOUNT and APCOND_AGE which we will use here.

What needs doing here
  • Create the checkuser-temporary-account-viewer group on wikis with temporary accounts enabled
  • Add an entry to AutoPromoteOnce in operations/mediawiki-config to auto-promote users into the above group when they meet the requirements listed in the background section

Related Objects

Event Timeline

Tchanders renamed this task from Allow users to be autopromoted into checkuser-temporary-account-viewer group based on global criteria to Allow users to be autopromoted into checkuser-temporary-account-viewer group based on local criteria.Aug 1 2024, 11:20 AM
Tchanders updated the task description. (Show Details)

This appears to be somehow duplicate to T334620: Create group for assigning checkuser-temporary-account right. @Dreamy_Jazz @kostajh, should those two tasks be merged?

Additionally, the third requirement (regarding blocks) isn't in the policy anymore. Instead, it says that blocks impact access only on projects where the block is in force. This appears to be already implemented (for both local and global blocks).

The new policy also allows checkusers/oversighters from any project to opt in globally via Special:GlobalPreferences. I'm not sure if their access would be implemented within this task, or whether there is/should be a separate one. Do you know?

Thanks @Urbanecm. I've updated the third requirement re blocks now.

This appears to be somehow duplicate to T334620: Create group for assigning checkuser-temporary-account right. @Dreamy_Jazz @kostajh, should those two tasks be merged?

Additionally, the third requirement (regarding blocks) isn't in the policy anymore. Instead, it says that blocks impact access only on projects where the block is in force. This appears to be already implemented (for both local and global blocks).

The new policy also allows checkusers/oversighters from any project to opt in globally via Special:GlobalPreferences. I'm not sure if their access would be implemented within this task, or whether there is/should be a separate one. Do you know?

I've merged that other task into this one.

Change #1073781 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Revert^2 "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/1073781

Change #1073790 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[operations/mediawiki-config@master] Hide temp account IP address viewing right from non-temp account wikis

https://gerrit.wikimedia.org/r/1073790

Change #1073790 merged by jenkins-bot:

[operations/mediawiki-config@master] Hide temp account IP address viewing right from non-temp account wikis

https://gerrit.wikimedia.org/r/1073790

Mentioned in SAL (#wikimedia-operations) [2024-09-18T13:09:24Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1073739|GrowthExperiments: enable Community Updates module in testwiki (T374577)]], [[gerrit:1073487|Check that throttling exceptions use valid public IP addresses (T374980)]], [[gerrit:1073790|Hide temp account IP address viewing right from non-temp account wikis (T369187)]], [[gerrit:1073586|Lift IP cap on 2024-10-07/08 for edit-a-thon (T374964)]]

Mentioned in SAL (#wikimedia-operations) [2024-09-18T13:11:53Z] <dreamyjazz@deploy1003> sgimeno, anzx, lucaswerkmeister-wmde, cscott, hnowlan, dreamyjazz: Backport for [[gerrit:1073739|GrowthExperiments: enable Community Updates module in testwiki (T374577)]], [[gerrit:1073487|Check that throttling exceptions use valid public IP addresses (T374980)]], [[gerrit:1073790|Hide temp account IP address viewing right from non-temp account wikis (T369187)]], [[gerrit:1073586|Lift IP cap on

Mentioned in SAL (#wikimedia-operations) [2024-09-18T13:20:33Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1073739|GrowthExperiments: enable Community Updates module in testwiki (T374577)]], [[gerrit:1073487|Check that throttling exceptions use valid public IP addresses (T374980)]], [[gerrit:1073790|Hide temp account IP address viewing right from non-temp account wikis (T369187)]], [[gerrit:1073586|Lift IP cap on 2024-10-07/08 for edit-a-thon (T374964)]

Change #1073781 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Revert^2 "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/1073781

Change #1073844 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[operations/mediawiki-config@master] Autopromote users into checkuser-temporary-account-viewer

https://gerrit.wikimedia.org/r/1073844

Change #1073844 merged by jenkins-bot:

[operations/mediawiki-config@master] Autopromote users into checkuser-temporary-account-viewer

https://gerrit.wikimedia.org/r/1073844

Mentioned in SAL (#wikimedia-operations) [2024-09-18T16:26:17Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1073844|Autopromote users into checkuser-temporary-account-viewer (T369187 T327913)]]

Mentioned in SAL (#wikimedia-operations) [2024-09-18T16:28:31Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1073844|Autopromote users into checkuser-temporary-account-viewer (T369187 T327913)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-09-18T16:40:20Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1073844|Autopromote users into checkuser-temporary-account-viewer (T369187 T327913)]] (duration: 14m 06s)

Change #1073853 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@wmf/1.43.0-wmf.23] Revert^2 "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/1073853

Change #1073853 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@wmf/1.43.0-wmf.23] Revert^2 "Create group for assigning checkuser-temporary-account right"

https://gerrit.wikimedia.org/r/1073853

Mentioned in SAL (#wikimedia-operations) [2024-09-18T17:47:31Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1073853|Revert^2 "Create group for assigning checkuser-temporary-account right" (T369187)]]

Mentioned in SAL (#wikimedia-operations) [2024-09-18T17:49:41Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1073853|Revert^2 "Create group for assigning checkuser-temporary-account right" (T369187)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-09-18T17:55:49Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1073853|Revert^2 "Create group for assigning checkuser-temporary-account right" (T369187)]] (duration: 08m 18s)