Tentatively, perhaps we should only give this right to the sysop group at the moment? We had a discussion at our last check-in meeting and as far as any of us knows, there's no other standard group cross-wikis that meet the minimum reqs and should also presumptively have this right.

In T369610#9965104, @STran wrote:

Tentatively, perhaps we should only give this right to the sysop group at the moment? We had a discussion at our last check-in meeting and as far as any of us knows, there's no other standard group cross-wikis that meet the minimum reqs and should also presumptively have this right.

If we do give this to sysop, we will need to ensure that they have checked the preference to view temporary account IPs for at least just the user_unnamed_ip variable.

Remaining work here is a config change to assign the right to sysop on wikis in pilot wiki deployment list.

Change #1080244 had a related patch set uploaded (by STran; author: STran):

[mediawiki/extensions/AbuseFilter@master] Give the sysop group protected vars access rights

https://gerrit.wikimedia.org/r/1080244

Per Legal:

Discussed on Oct 8 check-in call that this is data they already have, and is covered by the current policy, so if this raises no new risks, it's fine from a legal perspective to give global abuse filter maintainers access to IPs as protected vars for abusefilter purposes.

So we should also give this right to abusefilter-maintainer

Change #1080250 had a related patch set uploaded (by STran; author: STran):

[operations/mediawiki-config@master] Give the `abusefilter-maintainer` group protected vars access

https://gerrit.wikimedia.org/r/1080250

@Urbanecm I saw your comment on another task about manually adding a global permission. Does this apply to giving abusefilter-maintainer the abusefilter-access-protected-vars right? I did it in a config but can obviously easily not if that's not the correct practice.

Thanks for the ping @STran! Sort of :). It does, but after we cleared adding abusefilter-access-protected-vars to AbuseFilter maintainers in the check-in, I immediately applied the change. You can see the right is already assigned at https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions.

We still need to properly assign (global) access to logs, at least to stewards and ombuds, presumably also staff (the same as for checkuser-log). I can do that on-wiki, but it requires https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1080244 to be deployed (to be more precise: it requires AvailableRights to contain the right one wants to assign).

Does this clarify?

So we should also give this right to abusefilter-maintainer

Could this mean that Edit filter managers and Edit filter helpers on enwiki might also get access to this?

In T369610#10228321, @gerritbot wrote:

Change #1080250 had a related patch set uploaded (by STran; author: STran):

[operations/mediawiki-config@master] Give the `abusefilter-maintainer` group protected vars access

https://gerrit.wikimedia.org/r/1080250

I'm a bit confused by this MR. In the task description it is mentioned that sysops should have access to the variables, but this removes the right from sysops and assigns it to checkuser. What's the final list of local users who will have access to these variables?

Does this clarify?

Yes thank you!

Could this mean that Edit filter managers and Edit filter helpers on enwiki might also get access to this?

I don't have an answer but could get one. Is this something that's needed/wanted sooner rather than later? So far we want to enable it to the most limited group we can (sysops and global maintainers) to help with the needed filter migrations in preparation for the minor pilots deploy but I assume that we'll have to expand access as temporary accounts continues to deploy. At this point, I'm not sure enwiki is affected as temporary accounts won't be enabled there for some time and iirc, global filters don't apply to enwiki (sorry if I've misremembered this)?

I'm a bit confused by this MR. In the task description it is mentioned that sysops should have access to the variables, but this removes the right from sysops and assigns it to checkuser.

There are 2 rights associated with protected variables, abusefilter-access-protected-vars which allows using and viewing protected variables in filters and logs generated by filters, and abusefilter-protected-vars-log which gates access to the audit/usage logs of when someone views information around protected variables. The latter is the right being re-assigned to checkuser as it's matching the permissions around checkuser-temporary-account-log. The right to use the variables is still being assigned to sysop here: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1080244.

What's the final list of local users who will have access to these variables?

sysop and abusefilter-maintainer should be able to use the variables in filters and see hits on the filters that have protected variables. checkuser should be able to see the audit/usage logs.

Per Martin, stewards, ombuds, and possibly staff will end up with this right as well (I was not part of this Legal discussion).

Is this something that's needed/wanted sooner rather than later?

Probably not, but it's something to keep in mind for when temporary accounts come to enwiki.

global filters don't apply to enwiki

True, but there's some overlap, as some local filters target the same LTAs.

Change #1080250 merged by jenkins-bot:

[operations/mediawiki-config@master] Apply wmf-specific protected vars rights access

https://gerrit.wikimedia.org/r/1080250

Mentioned in SAL (#wikimedia-operations) [2024-10-21T13:41:21Z] <stran@deploy2002> Started scap sync-world: Backport for [[gerrit:1080250|Apply wmf-specific protected vars rights access (T369610)]]

Mentioned in SAL (#wikimedia-operations) [2024-10-21T13:43:28Z] <stran@deploy2002> stran: Backport for [[gerrit:1080250|Apply wmf-specific protected vars rights access (T369610)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-10-21T13:50:15Z] <stran@deploy2002> Finished scap sync-world: Backport for [[gerrit:1080250|Apply wmf-specific protected vars rights access (T369610)]] (duration: 08m 53s)

Change #1080244 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Give the sysop group protected vars access rights

https://gerrit.wikimedia.org/r/1080244

(Not sure if this is ready for QA, so moving back to Ready as there are no longer any patches to review).

sysop on meta now has the right as of the .28 rollout and global groups also have the right already. I think this can now be moved to QA.

Probably not, but it's something to keep in mind for when temporary accounts come to enwiki.

Yes I think we'll have this discussion as we deploy to wikis which have larger moderation teams.

On testwiki:

• sysop has abusefilter-access-protected-vars but does not have abusefilter-protected-vars-log
• checkuser has abusefilter-protected-vars-log but does not have abusefilter-access-protected-vars

@STran WP:EFN#Protected filters might be of interest to you.