Page MenuHomePhabricator

Deploy Extension:EmailAuth
Closed, ResolvedPublic

Description

This task proposes to enable Extension:EmailAuth, which will provide an email login link as second factor authentication for users with confirmed email.

  • Start branching (patch)
  • Add to extension-list (patch)
  • Enable config in operations/mediawiki-config (patch)

Example UX:

emailauth.gif (829×997 px, 440 KB)

Details

SubjectRepoBranchLines +/-
mediawiki/extensions/WikimediaEventsmaster+133 -0
mediawiki/extensions/WikimediaEventswmf/1.44.0-wmf.23+386 -19
mediawiki/extensions/WikimediaEventswmf/1.44.0-wmf.22+386 -19
mediawiki/extensions/WikimediaEventswmf/1.44.0-wmf.22+7 -6
integration/configmaster+8 -0
mediawiki/extensions/WikimediaEventsmaster+386 -19
mediawiki/extensions/WikimediaEventsmaster+7 -6
mediawiki/extensions/CentralAuthwmf/1.44.0-wmf.22+1 -0
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+14 -0
mediawiki/extensions/WikimediaEventswmf/1.44.0-wmf.22+133 -0
operations/mediawiki-configmaster+1 -0
mediawiki/corewmf/1.44.0-wmf.22+5 -0
operations/mediawiki-configmaster+1 -0
integration/configmaster+6 -5
mediawiki/extensions/CentralAuthmaster+1 -0
Show related patches Customize query in gerrit
TitleReferenceAuthorSource BranchDest Branch
settings.yaml: Add EmailAuth to wmf deployed extensionsrepos/releng/release!157reedyemailauth-deploymain
Customize query in GitLab

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Previous Beta Cluster deployment was T151015: Deploy EmailAuth extension to the beta cluster (has been undeployed since).

Change #1132182 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] Add EmailAuth provider to local domain exclusion list

https://gerrit.wikimedia.org/r/1132182

Change #1132182 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Add EmailAuth provider to local domain exclusion list

https://gerrit.wikimedia.org/r/1132182

Change #1132302 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/mediawiki-config@master] extension-list: Add EmailAuth

https://gerrit.wikimedia.org/r/1132302

Change #1132408 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/mediawiki-config@master] EmailAuth: Prepare config for enabling

https://gerrit.wikimedia.org/r/1132408

kostajh updated the task description. (Show Details)

Previous Beta Cluster deployment was T151015: Deploy EmailAuth extension to the beta cluster (has been undeployed since).

@Tgr why was it undeployed? Should we re-enable there? In https://gerrit.wikimedia.org/r/c/1132408 I've currently got it disabled.

Change #1132631 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] Zuul: [mediawiki/extensions/EmailAuth] Mark as in Wikimedia production, move up

https://gerrit.wikimedia.org/r/1132631

@Tgr why was it undeployed?

It never got into production, and so was cleaned up from Beta at some point.

Should we re-enable there?

Usually it's the first step of deploying a new extension.

Change #1132631 merged by jenkins-bot:

[integration/config@master] Zuul: [mediawiki/extensions/EmailAuth] Mark as in Wikimedia production, move up

https://gerrit.wikimedia.org/r/1132631

Mentioned in SAL (#wikimedia-releng) [2025-03-31T15:20:36Z] <James_F> Zuul: [mediawiki/extensions/EmailAuth] Mark as in Wikimedia production, move up, for T390437

Change #1132685 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Add EmailAuthRequireToken hook implementation

https://gerrit.wikimedia.org/r/1132685

Change #1132688 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[integration/config@master] zuul: Update WikimediaEvents dependencies

https://gerrit.wikimedia.org/r/1132688

Change #1132688 merged by jenkins-bot:

[integration/config@master] zuul: Update WikimediaEvents dependencies

https://gerrit.wikimedia.org/r/1132688

Change #1132727 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[mediawiki/core@wmf/1.44.0-wmf.22] .gitmodules: Add extensions/EmailAuth

https://gerrit.wikimedia.org/r/1132727

Change #1132729 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/mediawiki-config@master] extension-list: Add EmailAuth

https://gerrit.wikimedia.org/r/1132729

Mentioned in SAL (#wikimedia-operations) [2025-03-31T19:01:34Z] <dancy> Deploying EmailAuth extension to wmf.22 for T390437

Change #1132729 merged by jenkins-bot:

[operations/mediawiki-config@master] extension-list: Add EmailAuth

https://gerrit.wikimedia.org/r/1132729

Change #1132727 merged by jenkins-bot:

[mediawiki/core@wmf/1.44.0-wmf.22] .gitmodules: Add extensions/EmailAuth

https://gerrit.wikimedia.org/r/1132727

Mentioned in SAL (#wikimedia-operations) [2025-03-31T19:06:42Z] <dancy@deploy1003> Started scap sync-world: Backport for [[gerrit:1132727|.gitmodules: Add extensions/EmailAuth (T390437)]], [[gerrit:1132729|extension-list: Add EmailAuth (T390437)]]

Change #1132302 abandoned by Kosta Harlan:

[operations/mediawiki-config@master] extension-list: Add EmailAuth

Reason:

Done via I4bbb72869b7d728bb0b4c542f7073a1826555afc

https://gerrit.wikimedia.org/r/1132302

Mentioned in SAL (#wikimedia-operations) [2025-03-31T19:45:07Z] <dancy@deploy1003> Started scap sync-world: Backport for [[gerrit:1132727|.gitmodules: Add extensions/EmailAuth (T390437)]], [[gerrit:1132729|extension-list: Add EmailAuth (T390437)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-31T19:53:11Z] <dancy@deploy1003> dancy: Backport for [[gerrit:1132727|.gitmodules: Add extensions/EmailAuth (T390437)]], [[gerrit:1132729|extension-list: Add EmailAuth (T390437)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Change #1132745 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Add EmailAuthRequireToken hook implementation

https://gerrit.wikimedia.org/r/1132745

Change #1132685 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Add EmailAuthRequireToken hook implementation

https://gerrit.wikimedia.org/r/1132685

Change #1132747 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Allow forceEmailAuth test check without extension dependencies

https://gerrit.wikimedia.org/r/1132747

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:06:00Z] <dancy@deploy1003> Finished scap sync-world: Backport for [[gerrit:1132727|.gitmodules: Add extensions/EmailAuth (T390437)]], [[gerrit:1132729|extension-list: Add EmailAuth (T390437)]] (duration: 20m 53s)

Change #1132745 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Add EmailAuthRequireToken hook implementation

https://gerrit.wikimedia.org/r/1132745

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:13:43Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1132645|REST: enable Specs module on certain wikis, adjust Sandbox modules (T389407)]], [[gerrit:1132197|Throttle exemption for Editathon at Universidad Nacional de La Plata - 9 April 2025 (T390290)]], [[gerrit:1132745|EmailAuth: Add EmailAuthRequireToken hook implementation (T390437)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:18:23Z] <tgr@deploy1003> superpes, bpirkle, tgr, kharlan: Backport for [[gerrit:1132645|REST: enable Specs module on certain wikis, adjust Sandbox modules (T389407)]], [[gerrit:1132197|Throttle exemption for Editathon at Universidad Nacional de La Plata - 9 April 2025 (T390290)]], [[gerrit:1132745|EmailAuth: Add EmailAuthRequireToken hook implementation (T390437)]] synced to the testservers (https://wikitech.wikimedia.org/wiki

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:26:43Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1132645|REST: enable Specs module on certain wikis, adjust Sandbox modules (T389407)]], [[gerrit:1132197|Throttle exemption for Editathon at Universidad Nacional de La Plata - 9 April 2025 (T390290)]], [[gerrit:1132745|EmailAuth: Add EmailAuthRequireToken hook implementation (T390437)]] (duration: 12m 59s)

Change #1132408 merged by jenkins-bot:

[operations/mediawiki-config@master] EmailAuth: Prepare config for enabling in log-only mode

https://gerrit.wikimedia.org/r/1132408

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:48:28Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1132408|EmailAuth: Prepare config for enabling in log-only mode (T390437)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-31T20:53:10Z] <tgr@deploy1003> tgr, kharlan: Backport for [[gerrit:1132408|EmailAuth: Prepare config for enabling in log-only mode (T390437)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Change #1132755 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/mediawiki-config@master] EmailAuth: Enable info level logging

https://gerrit.wikimedia.org/r/1132755

Change #1132755 merged by jenkins-bot:

[operations/mediawiki-config@master] EmailAuth: Enable info level logging

https://gerrit.wikimedia.org/r/1132755

Mentioned in SAL (#wikimedia-operations) [2025-03-31T21:03:35Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1132408|EmailAuth: Prepare config for enabling in log-only mode (T390437)]], [[gerrit:1132755|EmailAuth: Enable info level logging (T390437)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-31T21:08:51Z] <tgr@deploy1003> kharlan, tgr: Backport for [[gerrit:1132408|EmailAuth: Prepare config for enabling in log-only mode (T390437)]], [[gerrit:1132755|EmailAuth: Enable info level logging (T390437)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Change #1132763 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.22] Add EmailAuth provider to local domain exclusion list

https://gerrit.wikimedia.org/r/1132763

Mentioned in SAL (#wikimedia-operations) [2025-03-31T21:29:43Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1132408|EmailAuth: Prepare config for enabling in log-only mode (T390437)]], [[gerrit:1132755|EmailAuth: Enable info level logging (T390437)]] (duration: 26m 08s)

Change #1132763 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.22] Add EmailAuth provider to local domain exclusion list

https://gerrit.wikimedia.org/r/1132763

Change #1132767 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1132767

Mentioned in SAL (#wikimedia-operations) [2025-03-31T21:45:55Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1132763|Add EmailAuth provider to local domain exclusion list (T390437)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-31T21:51:14Z] <tgr@deploy1003> tgr: Backport for [[gerrit:1132763|Add EmailAuth provider to local domain exclusion list (T390437)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Tgr assigned this task to kostajh.

Mentioned in SAL (#wikimedia-operations) [2025-03-31T22:01:33Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1132763|Add EmailAuth provider to local domain exclusion list (T390437)]] (duration: 15m 37s)

Change #1132747 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Allow forceEmailAuth test check without extension dependencies

https://gerrit.wikimedia.org/r/1132747

Change #1132767 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@master] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1132767

I have a minor privacy concern with the login flow, filed it as T390780

Change #1133468 had a related patch set uploaded (by Reedy; author: Kosta Harlan):

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Allow forceEmailAuth test check without extension dependencies

https://gerrit.wikimedia.org/r/1133468

Change #1133469 had a related patch set uploaded (by Reedy; author: Máté Szabó):

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.23] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1133469

Change #1133470 had a related patch set uploaded (by Reedy; author: Máté Szabó):

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1133470

Change #1133468 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Allow forceEmailAuth test check without extension dependencies

https://gerrit.wikimedia.org/r/1133468

Change #1133470 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.22] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1133470

Change #1133469 merged by jenkins-bot:

[mediawiki/extensions/WikimediaEvents@wmf/1.44.0-wmf.23] EmailAuth: Add tests for EmailAuthRequireToken handler

https://gerrit.wikimedia.org/r/1133469

Mentioned in SAL (#wikimedia-operations) [2025-04-02T16:52:07Z] <reedy@deploy1003> Started scap sync-world: Backport for [[gerrit:1133468|EmailAuth: Allow forceEmailAuth test check without extension dependencies (T390437)]], [[gerrit:1133470|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[gerrit:1133472|EmailAuthHooks: Exclude bot users from email auth check (T390662)]], [[gerrit:1133469|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[ger

Mentioned in SAL (#wikimedia-operations) [2025-04-02T17:47:32Z] <reedy@deploy1003> Started scap sync-world: Backport for [[gerrit:1133468|EmailAuth: Allow forceEmailAuth test check without extension dependencies (T390437)]], [[gerrit:1133470|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[gerrit:1133472|EmailAuthHooks: Exclude bot users from email auth check (T390662)]], [[gerrit:1133469|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[ger

Mentioned in SAL (#wikimedia-operations) [2025-04-02T18:00:08Z] <reedy@deploy1003> reedy: Backport for [[gerrit:1133468|EmailAuth: Allow forceEmailAuth test check without extension dependencies (T390437)]], [[gerrit:1133470|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[gerrit:1133472|EmailAuthHooks: Exclude bot users from email auth check (T390662)]], [[gerrit:1133469|EmailAuth: Add tests for EmailAuthRequireToken handler (T390437)]], [[gerrit:1133471|EmailA

Change #1133532 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[operations/mediawiki-config@master] Enable EmailAuth enforcement on group 0/1

https://gerrit.wikimedia.org/r/1133532

Change #1133928 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[operations/mediawiki-config@master] Enable EmailAuth enforcement on group 2 for short test

https://gerrit.wikimedia.org/r/1133928