Change #1081176 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/extensions/IPInfo@master] Unify IPInfo access levels

https://gerrit.wikimedia.org/r/1081176

Change #1081370 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[operations/mediawiki-config@master] Unify IPInfo access levels

https://gerrit.wikimedia.org/r/1081370

QA Notes

• Verify that an user group with just the ipinfo right assigned has full access to the IP information tool, after accepting the data use agreement.
• Verify that IP info access log entries in this setup are logged as full access, whereas historical entries logged before this change continue to differentiate between full and limited access.

Let me know if this user story can be covered here, of if it needs another feature request.

User story: I've enabled IP Information in my global preferences, and have already agreed to the terms at least once. I don't want to have to go through the identical agreement process on each of our hundreds of projects individually to use this tool on each project.

In T375086#10519312, @Xaosflux wrote:

Let me know if this user story can be covered here, of if it needs another feature request.

User story: I've enabled IP Information in my global preferences, and have already agreed to the terms at least once. I don't want to have to go through the identical agreement process on each of our hundreds of projects individually to use this tool on each project.

@Niharika - could you comment on the scope of this?

In T375086#10519312, @Xaosflux wrote:

User story: I've enabled IP Information in my global preferences, and have already agreed to the terms at least once. I don't want to have to go through the identical agreement process on each of our hundreds of projects individually to use this tool on each project.

+1, I mentioned this in 2023, it's really annoying that we still need to manually check "I agree to use this tool in accordance with the IP Information tool guidelines" in every project instead of offering this option via Special:GlobalPreferences.

T385701, T385698 and T298977 appear to be the tickets related to this request.

@Xaosflux @Johannnes89 that user story makes sense to include and has been OK'd by Legal. Thanks for your patience on this as we were waiting for the dust to settle on the new proposed thresholds requirements.

Change #1143079 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/extensions/WikimediaEvents@master] Grant automatic IPInfo access if temp users are not known

https://gerrit.wikimedia.org/r/1143079

Change #1143079 abandoned by Máté Szabó:

[mediawiki/extensions/WikimediaEvents@master] Grant automatic IPInfo access if temp users are not known

Reason:

We'll be taking a different approach.

https://gerrit.wikimedia.org/r/1143079

I'm removing this as a major pilots blocker, since we're taking a different approach.

I'll conservatively add it as a full rollout blocker, but we can discuss this more later.

Change #1146969 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[operations/mediawiki-config@master] Update IPInfo access levels

https://gerrit.wikimedia.org/r/1146969

Change #1081370 abandoned by Máté Szabó:

[operations/mediawiki-config@master] Unify IPInfo access levels

Reason:

Superseded by Id9d8f5bee40135ae1746652c2c873fe33ce68435.

https://gerrit.wikimedia.org/r/1081370

Change #1081176 abandoned by Máté Szabó:

[mediawiki/extensions/IPInfo@master] Unify IPInfo access levels

Reason:

Superseded by Id9d8f5bee40135ae1746652c2c873fe33ce68435

https://gerrit.wikimedia.org/r/1081176

Change #1146969 merged by jenkins-bot:

[operations/mediawiki-config@master] Update IPInfo access levels

https://gerrit.wikimedia.org/r/1146969

Mentioned in SAL (#wikimedia-operations) [2025-05-27T13:45:53Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1146969|Update IPInfo access levels (T375086)]]

Mentioned in SAL (#wikimedia-operations) [2025-05-27T13:47:59Z] <kharlan@deploy1003> mszabo, kharlan: Backport for [[gerrit:1146969|Update IPInfo access levels (T375086)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-05-27T14:01:10Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1146969|Update IPInfo access levels (T375086)]] (duration: 15m 16s)

Noting that on Meta-Wiki, non-admins, non-checkusers, and users who are not local temporary account IP viewers can no longer view IP Info's basic information (via ipinfo-view-basic). On the other hand, some global groups (such as abuse filter helpers and maintainers, global rollbackers, and U4C members) only have the ipinfo right, which explains the similar situation I just explained.

Now that there is only one access level, why keep two rights, ipinfo and ipinfo-view-full?

One right is enough. The other is redundant. In Special:ListGroupRights and Special:GlobalGroupPermissions, all the user groups with ipinfo have ipinfo-view-full.

In T375086#10934693, @NicoScribe wrote:

Now that there is only one access level, why keep two rights, ipinfo and ipinfo-view-full?

I swear I wrote a pretty long and detailed answer to the same question somewhere, but don't remember where...

Anyway, in short, there are two rights because this is a transition period. On wikis without temp accounts, IP Info is being used by users who wouldn't qualify for access to temp accounts, and we don't want to take IP Info from them. In this update there are two bullet points about this.

In T375086#10861542, @codenamenoreste wrote:

Noting that on Meta-Wiki, non-admins, non-checkusers, and users who are not local temporary account IP viewers can no longer view IP Info's basic information (via ipinfo-view-basic). On the other hand, some global groups (such as abuse filter helpers and maintainers, global rollbackers, and U4C members) only have the ipinfo right, which explains the similar situation I just explained.

The issue for global groups has been resolved in T396774: IPInfo: Assign IPInfo rights to global groups who have IP reveal access. And IP Info's behaviour for local groups on Meta-Wikis is similar to wikis where temporary accounts are deployed (see Szymon's answer above) because temporary accounts are "known" on Meta.

We need to discuss whether this is resolved or if we need to reassign this task.

Bringing into the sprint. Scope of the work in the sprint is to get clarity on the status of this task.

In T375086#11387877, @Tchanders wrote:

Bringing into the sprint. Scope of the work in the sprint is to get clarity on the status of this task.

As of now, the ipinfo-view-basic permissions are assigned to users only on wikis without temporary accounts (i.e. only ruwiki). Over the last two months, the IPInfo tool was used 2100 times on Russian Wikipedia, out of which 65% were basic mode queries.

What has been done:

• On wikis with temporary accounts, nobody has (ipinfo-view-basic) and (ipinfo-view-full) is granted to groups who have access to temp. accounts' IP addresses – TAIV, admin (+a few other "higher" groups, such as CU)
  • Effectively, IP Reveal and IPInfo have the same access levels.

What is still to be done:

• There is a wiki, which uses IPInfo basic mode – ruwiki, which doesn't have temp. accounts deployed yet.
  • (ipinfo-view-basic) is assigned to autoconfirmed users there and we can't probably just give them the full access.
  • It seems the easiest to just wait for TA deployment to ruwiki (unless it's going to take ages).
• Once ruwiki no longer uses the basic mode:
  • We'll be able to drop the permissions and configuration for basic mode.
  • We'll be able to drop the code responsible for mode selection (basic or full).
  • We might consider dropping no-ipinfo user group.
    • Only one user ever had this group, EPICtest@testwiki (for testing).
    • In the new scenario, abuse of IPInfo data is probably not the main vector of abuse, especially that malicious users could try to look this data up in other online service (they will still have access to TAs' IP addresses).

Bringing to review to reflect that it's no longer worked on, but probably it's good to wait for new year to coordinate this with plans for TA deployment, if there are any (potentially adapting what we want to do with this)

It seems the easiest to just wait for TA deployment to ruwiki (unless it's going to take ages).

I agree. My understanding is that it shouldn't take ages.

I've made this task a parent of the ruwiki deployment task so that we remember to do it. We can consider it Done for the purposes of this sprint.