Current

Variables and urls are hardcoded. It should not.

config.ini

I tried to move to a new Oauth consumer but failed. I think we need a light clean up on the config.ini, Oauth and related hard coded urls. Indeed, I found these hard coded lines :

• /lingualibre/authentication.py#L18 : url = "https://www.mediawiki.org/w/api.php"
• /customauth/views.py#L114: url = "https://meta.wikimedia.org/w/rest.php/oauth2/access_token"
• /lingualibre/settings.py#L155 : WIKIMEDIA_OAUTH_TOKEN_URL = "https://meta.wikimedia.org/w/rest.php/oauth2/access_token" .
• /upload_batches/helpers/upload2commons.py :"auto_refresh_url": "https://meta.wikimedia.org/w/rest.php/oauth2/access_token".
• /config.ini.sample

Is there a reason to have those Oauth related url hard coded and not built upon a config.ini variable ?
@pushkar707 , as for (3) added in June, is there a reason for https://www.mediawiki.org ? It's not Meta, not Commons for which we have proper Oauths. It observably works but the logic to add one more target for our Oauth request is weird. Any reason for that ?
I'm considering centralizing this further in config.ini Oauth consumer variables.
I wont do it now due to the backlog of MRs we already have to retest on toolforge.

EDIT: Oh, doc/AUTHENTICATION.md

markdown

2. User Authentication and Data Retrieval

    At the `/oauth/wikimedia/success` route, the frontend Vue component parses the `code` from the URL query parameter and sends a request to the backend at `POST {{backend-domain-name}}/oauth/verify/wikimedia/` endpoint.

    Request body:

    `json
    { "code": "AUTH_CODE" }
    `

    The backend (`WikimediaOAuthCallbackView`) uses this code to obtain an access token and a refresh token from Wikimedia by calling `POST https://meta.wikimedia.org/w/rest.php/oauth2/access_token`

    Furhter, the backend sends a second request to `GET https://www.mediawiki.org/w/api.php?action=query&meta=userinfo&format=json&formatversion=2` and gets user's wikimedia username and creates a new user in database for that username if it doesn't already there.

    The access token, refresh token, and its expiration time are stored in the UserAuth model.