In order to enable browser-like clients interacting with Wikidata to register temporary accounts on WMF's central login wiki, responses to edits that resulted in using a "temporary account" should include the relevant data: name of the temporary account used, and the "redirect URL" that could be used to register the temporary account on the "central login wiki".
Successful edit responses (POST, PUT, PATCH, DELETE endpoints) should send the following HTTP headers if the edit involved creating a mediawiki temporary account:
- X-Temporary-User-Created with a value being a temporary account user name
- X-Temporary-User-Redirect, if a redirect URL value was generated by Mediawiki
- the returnTo value expected by TempUserCreatedRedirect should be left empty for now (in production this will mean, redirected request will return to the Main Page)
At the same time, a temporary account should never be returned as the value of X-Authenticated-User (see T323261).
Description of the X-Temporary-User-Redirect header along the lines of: For the client that is a browser working with the WMF wikis: URL that client should redirect their user to ensure that the temporary account would be logged in on the central login wiki
While looking at the REST API code today, I noticed that it just throws away most of the information in the EditEntityStatus returned by EditEntity:
$status = $editEntity->attemptSave( $entity, $this->summaryFormatter->format( $editMetadata->getSummary() ), $newOrUpdateFlag | ( $editMetadata->isBot() ? EDIT_FORCE_BOT : 0 ), false, false, $editMetadata->getTags() ); if ( !$status->isOK() ) { if ( $this->isPreventedEdit( $status ) ) { throw new EntityUpdatePrevented( (string)$status ); } throw new EntityUpdateFailed( (string)$status ); } elseif ( !$status->isGood() ) { $this->logger->warning( (string)$status ); } return $status->getRevision();
The savedTempUser and context from the status are not used by the REST API, as far as I can tell. I assume this means that the REST API never calls the TempUserCreatedRedirect hook, and doesn’t redirect the user to loginwiki; consequently, a temporary user created via the REST API will only exist on the Wikibase repo wiki and be even more temporary than it should be.
Task breakdown
- Add X-Temporary-User-Created and X-Temporary-User-Redirect headers to responses where the request came from a temp user
- Remove X-Authenticated-User header from responses where the request came from an anonymous user