Page MenuHomePhabricator

Batch the requests to reveal temp account IP addresses
Closed, ResolvedPublic

Description

If you reveal IP addresses for temp accounts on e.g. a history page or RecentChanges/Watchlist, we remember which accounts you've already clicked "Show IP" for, and the next time you visit the history/RecentChanges/Watchlist page, we automatically re-reveal the IP address after making a POST request to fetch the data.

We use browser localStorage to keep track of which temp account IDs someone has clicked "Show IP" for. (We can't cache the IP itself in localStorage to avoid storing sensitive data in the user's browser.)

If you've clicked "reveal" for a bunch of accounts on a page, we make one request per account when loading the page. This can be inefficient if there are dozens or hundreds of accounts on a given page.

To improve on this, we could obtain a list of all the accounts that we should fetch IP information for, and batch them in a single request, generating any access logs as necessary.

Event Timeline

To improve on this, we could obtain a list of all the accounts that we should fetch IP information for, and batch them in a single request, generating any access logs as necessary.

Is the suggestion here to add a new API endpoint that can:

  • take a map of user names to revision/log IDs as input
  • return a map of user names to maps of rev/log IDs to IPs
  • perhaps include the latest IP for each user too?
Amdrel changed the task status from Open to In Progress.Aug 22 2024, 6:46 PM

Change #1071250 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/CheckUser@master] [WIP] Batch the requests to reveal temporary account IP addresses

https://gerrit.wikimedia.org/r/1071250

Change #1112721 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] Separate out traits from temporary account REST handlers

https://gerrit.wikimedia.org/r/1112721

Change #1112721 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Separate out traits from temporary account REST handlers

https://gerrit.wikimedia.org/r/1112721

Change #1071250 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Batch the requests to reveal temporary account IP addresses

https://gerrit.wikimedia.org/r/1071250

Djackson-ctr subscribed.

QA is completed, I have verified the new code has been implemented and is functioning as expected (On a page with more than one "Show IP" button for the same temporary account: when the user selects one of those Show IP buttons, it will only produce one API request instead of multiple API requests for the same temporary account, also on a page refresh the new endpoint checkuser/v0/batch-temporary will be produced).