For T414913 we'll need a hook that extensions can handle and then perform logging. This hook should be triggered when performer tries to add another user to a restricted group depending on a private condition.

Proposed hook signature:

function onReadPrivateUserRequirementsCondition( UserIdentity $performer, UserIdentity $target, array $conditions ) { }

This hook represents an action of revealing the values of private conditions through failure or success of Special:UserRights (or API).

Acceptance criteria

• UserGroupAssignmentService triggers the hook if any of the changed groups involves a private condition
• SpecialUserRights triggers the hook if validation fails and at least one of the changed groups involve a private condition