Page MenuHomePhabricator

SUL3: Transaction profiler warnings when logging in
Closed, ResolvedPublic

Description

Summary

When users log in to an account on WMF wikis, the CheckUser extension logs this. On a wiki with SUL3 enabled this code is called when the transaction profiler expects no writes.

Background

  • CheckUser creates a private CheckUser event when a user logs in, logs out, or creates an account
  • SUL3 causes the login flow to be changed, and as part of this it appears that login on the local wiki is performed using a GET request
  • CheckUser currently assumes that logins can only occur on POST requests, so does not handle a case when logging is performed via a GET request for the purposes of the transaction profiler

Technical notes

  • To solve, this the code could do one of the following ideas:
    • If the login is performed via a method which expects no writes, then either insert the private event post send or in a job
    • Make SUL3 perform the request to the local wiki use a POST request
    • Mark the inserts to the CheckUser tables as ignored by the transaction profiler

Acceptance criteria

  • TransactionProfiler warnings are no longer created when a user logs in on a SUL3 enabled wiki

Event Timeline

This is not particularly specific to SUL3, any time when the wiki uses a remote identity provider (ie. a primary authentication provider that returns a REDIRECT response) and no provider requests subsequent forms to be shown, login will happen on a GET request. There's a hack in AuthManagerSpecialPage::handleReturnBeforeExecute() to kinda pretend it's a POST internally, but that doesn't affect TransactionProfiler.

It's not really specific to CheckUser either, all kinds of DB operations could happen on a login (autocreation etc).

I think it's fine to just quiet the warnings in this case.

rOPUP014a838899e3: Update CentralAuth multi-DC rules for SUL3 has some notes about the infra side of this - in theory we could force Special:UserLogin/return to the primary DC, but we'd have to make sure that the special page name does not get localized. I'll check if that's manageable, but I think it's not the end of the world if we don't fix that.

Change #1118239 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@master] auth: Silence GET trxProfiler expectations during return/reuth

https://gerrit.wikimedia.org/r/1118239

Change #1118239 merged by jenkins-bot:

[mediawiki/core@master] auth: Use POST trxProfiler expectations during return/reauth

https://gerrit.wikimedia.org/r/1118239

Change #1119516 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@wmf/1.44.0-wmf.16] auth: Use POST trxProfiler expectations during return/reauth

https://gerrit.wikimedia.org/r/1119516

Change #1119516 merged by jenkins-bot:

[mediawiki/core@wmf/1.44.0-wmf.16] auth: Use POST trxProfiler expectations during return/reauth

https://gerrit.wikimedia.org/r/1119516

Mentioned in SAL (#wikimedia-operations) [2025-02-13T21:50:52Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1119516|auth: Use POST trxProfiler expectations during return/reauth (T385566)]], [[gerrit:1119530|Track the number of started / finished SUL3 flows (T377261)]], [[gerrit:1119531|Do not preserve 'sul3-action' when restarting authentication (T364866)]]

Mentioned in SAL (#wikimedia-operations) [2025-02-13T21:53:33Z] <tgr@deploy2002> tgr: Backport for [[gerrit:1119516|auth: Use POST trxProfiler expectations during return/reauth (T385566)]], [[gerrit:1119530|Track the number of started / finished SUL3 flows (T377261)]], [[gerrit:1119531|Do not preserve 'sul3-action' when restarting authentication (T364866)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2025-02-13T22:05:56Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1119516|auth: Use POST trxProfiler expectations during return/reauth (T385566)]], [[gerrit:1119530|Track the number of started / finished SUL3 flows (T377261)]], [[gerrit:1119531|Do not preserve 'sul3-action' when restarting authentication (T364866)]] (duration: 15m 03s)