Page MenuHomePhabricator

OAuth consumers registered locally at Wikitech are no longer configured to be used
Closed, ResolvedPublicBUG REPORT

Description

Removing Wikitech's override of $wgMWOAuthCentralWiki has orphaned the local consumers in the labswiki.oauth_registered_consumer table. Bots that were using these consumers need to have new grants created in the central metawiki consumer repository to start working again.

wikiadmin2023@10.192.21.14(labswiki)> select user_name, oarc_name, oarc_owner_only from oauth_registered_consumer join user on oarc_user_id=user_id where oarc_stage = 1;
+------------------------------+----------------------------------------+-----------------+
| user_name                    | oarc_name                              | oarc_owner_only |
+------------------------------+----------------------------------------+-----------------+
| Stashbot                     | stashbot                               |               1 |
| Strainu                      | ROSEdu challenge                       |               0 |
| StrikerBot                   | Striker                                |               1 |
| MarcoAurelio                 | marcoaurelio-adminbot                  |               1 |
| BryanDavis                   | BryanDavis                             |               1 |
| Labslogbot                   | wmfkeystonehooks                       |               1 |
| MABot                        | MABot                                  |               1 |
| DeploymentCalendarTool       | DeploymentCalendarTool                 |               1 |
| DeploymentCalendarTool       | DeploymentCalendar                     |               1 |
| MABot                        | MABot                                  |               1 |
| Toolforge Image Bot          | tf-image-bot                           |               1 |
| Toolforge Image Bot          | tf-image-bot-self                      |               1 |
| Samtar                       | make-deployments-calendar (Samtar)     |               1 |
| Phabbanbot                   | Phabbanbot                             |               1 |
| Wikitech double redirect bot | Wikitech double redirect bot Pywikibot |               1 |
| Gitlabaccountapprovalbot     | Gitlabaccountapprovalbot               |               1 |
| David Caro                   | dcaro-pywikibot                        |               1 |
| ScheduleDeploymentBot        | ScheduleDeploymentBot                  |               1 |
| Gergő Tisza                  | schedule-deployment personal test      |               1 |
| Gergő Tisza                  | schedule-deployment personal test      |               1 |
+------------------------------+----------------------------------------+-----------------+
20 rows in set (0.001 sec)

Related Objects

Event Timeline

The general fix is to:

I made subtasks for the accounts that seemed mostly likely to still be in use. I also have tried to subscribe all of the humans behind these grants to this task so they at least know about what has happened. New subtasks with the basic checklist can be created with this template link if desired.

Could just copy the relevant database rows, there isn't anything wiki-specific in them (other than the user ID). Although if there are only twenty-ish of them, might not be worth the effort.

Could just copy the relevant database rows, there isn't anything wiki-specific in them (other than the user ID). Although if there are only twenty-ish of them, might not be worth the effort.

I thought about that briefly yesterday, but I think we would have had to map the user id to a SUL user to do that copy. Since there was no guarantee that these accounts had a SUL equivalent it seemed easiest to let the grant owners handle things manually. If there had been a lot more grants to fix up it probably would be worth some deeper backend help.

Maybe empty the local oauth tables when no longer used to avoid orphaned rows (maybe as part of T376129: Database clean ups after migration of wikitech to production)

Maybe empty the local oauth tables when no longer used to avoid orphaned rows (maybe as part of T376129: Database clean ups after migration of wikitech to production)

I'm actually planning to drop them once people here are comfortable they are not needed anymore.

I just dropped the whole table.

bd808 assigned this task to Ladsgroup.