We want to be able to allow higher rate limits for accounts that are in a local bot group on any wiki, even when accessing a different wiki. (@daniel or @JTweed-WMF may be able to add some context here).
In order to do so efficiently, without having to query local groups on every wiki, we need to sync this to a central place. There are two reasonable ways to do it:
a) $wgCentralAuthAutomaticGlobalGroups
(recently added for T376315)
- Configure here: CommonSettings.php so that adding user to a local bot group anywhere also adds them to the local-bot global group (removing groups and expiry are also handled)
- In the rate limit class code: WikimediaEventsHooks.php add something like:
elseif ( in_array( 'local-bot', $centralUser->getGlobalGroups() ) ) { $jwtData['rlc'] = 'local-bot'; }
The local-bot group needs to be created as a normal user group first. It will be visible on pages like Special:GlobalGroupPermissions, Special:Log/gblrights and Special:GlobalUserRights, and it needs a localisable label.
We may need to write and run a maintenance script to initially fill the new group (it seems this was not needed for T376315, as all the groups there were new and initially empty?), afterwards it will be updated automatically.
b) Rely on caching in getLocalGroups()
(recently added for T410878)
Simply add something like:
elseif ( in_array( 'bot', $centralUser->getLocalGroups() ) ) { $jwtData['rlc'] = 'local-bot'; }
In many ways this is simpler to do, however, the case when the cached data is not available is very pessimistic (worst case requires querying hundreds of wikis and takes several seconds, and it would happen in the middle of generating a JWT token).