Page MenuHomePhabricator

Update UserRequirementsConditionChecker to handle target users for UserGroupAssignmentService
Closed, ResolvedPublic

Description

Background

For T406547: Create service for checking conditions used by autopromote, the new service will need to be able to check conditions for a target user, who may be from an external wiki and may not be the performing user.

It should be able to make use of the UserRequirementsConditionChecker, but this service is currently only used for autopromotion, so it assumes the checks are all being done on a local user who is also performing the request.

Details

How the conditions in ::checkCondition should be handled:

  • APCOND_EMAILCONFIRMED, APCOND_EDITCOUNT, APCOND_AGE, APCOND_AGE_FROM_EDIT, APCOND_INGROUPS, APCOND_BLOCKED and APCOND_ISBOT should be checked on the user's wiki
  • APCOND_ISIP and APCOND_IPINRANGE should only be checked if the user is performing the request
  • AutopromoteConditionHook should document that the hook should handle users from external wikis

Specific challenges:

  • Existing handlers of AutopromoteConditionHook should be updated to handle users from external wikis (at first they can just fail the condition if the user is external, and be updated later if necessary)
  • ::recursivelyCheckCondition takes a User object, which can only be associated with the local wiki
  • APCOND_EMAILCONFIRMED, APCOND_INGROUPS, APCOND_BLOCKED and APCOND_ISBOT probably can't be updated to give reliable answers for external users without using API calls to the external wiki, because they rely on hooks or site configuration

Related Objects

Event Timeline

APCOND_EMAILCONFIRMED, APCOND_INGROUPS, APCOND_BLOCKED and APCOND_ISBOT probably can't be updated to give reliable answers for external users without using API calls to the external wiki, because they rely on hooks or site configuration

We could choose not to support these for now, or we could add the API calls and they won't actually be used until a group gets configured to be restricted dependent on these conditions.

AutopromoteConditionHook should document that the hook should handle users from external wikis

Or we could try to separate out general condition checking to autopromote condition checking. Not sure if that would be too complicated to be worth it.

mszwarc changed the task status from Open to In Progress.Oct 23 2025, 9:16 AM
mszwarc claimed this task.

Change #1198303 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] Add param whether user is performing the request to condition checker

https://gerrit.wikimedia.org/r/1198303

Change #1198496 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] UserRequirementsConditionChecker: Use UserIdentity instead of User

https://gerrit.wikimedia.org/r/1198496

From task description

Specific challenges:

  • Existing handlers of AutopromoteConditionHook should be updated to handle users from external wikis (at first they can just fail the condition if the user is external, and be updated later if necessary)
  • ::recursivelyCheckCondition takes a User object, which can only be associated with the local wiki
  • APCOND_EMAILCONFIRMED, APCOND_INGROUPS, APCOND_BLOCKED and APCOND_ISBOT probably can't be updated to give reliable answers for external users without using API calls to the external wiki, because they rely on hooks or site configuration
  • I have created a task to implement a new hook, which will first coexist with AutopromoteConditionHook and eventually replace it: T408184
  • The ::recursivelyCheckCondition and ::checkCondition methods have been updated in the above patch to accept a UserIdentity, which can represent users from remote wikis as well. The full User object is still created for some conditions, which can't be evaluated in the context of remote wikis – e.g., due to reliance on hooks or site config; these are APCOND_EMAILCONFIRMED, APCOND_INGROUPS, APCOND_BLOCKED and APCOND_ISBOT
    • These conditions are now fixed to return false if the tested user is from remote wiki
    • Some other conditions are also temporarily restricted to the current wiki only, because the services used don't support remote wiki checks, these will be fixed in T408181 and T408182

Change #1198303 merged by jenkins-bot:

[mediawiki/core@master] Add param whether user is performing the request to condition checker

https://gerrit.wikimedia.org/r/1198303

Change #1198496 merged by jenkins-bot:

[mediawiki/core@master] UserRequirementsConditionChecker: Use UserIdentity instead of User

https://gerrit.wikimedia.org/r/1198496