The goal of this task is to support defining conditions for members of global groups, so that policies about granting them can be enforced by software.
Approach
Global groups (unlike local ones) are defined in the database and are editable from an on-wiki interface. Therefore, we have two potential options of how group conditions are defined:
- Stewards can define conditions somewhere on wiki, and they will be stored in global_group_restrictions DB table (in a new column).
- The conditions are defined in PHP config, in a similar way to $wgRestrictedGroups.
Approach 1 would be more consistent with the general flow around global groups, but at the same time would also require to define a new syntax and editor for conditions. Given that they are currently PHP values (primitives and arrays), there's no straightforward way to define them in the user interface. Instead, a custom validator and parser would need to be written. On the other hand, Approach 2 would reuse as much of the existing services as possible, by having the condition formatted the same as for local groups.
Given that I expect that conditions for a given group will be changed extremely rarely, I think it's acceptable to introduce global group conditions using Approach 2, which is simpler from the developer perspective. If it turns out in future that an on-wiki interface is needed, this assumption might be revisited.
As for the configuration variable, we could reuse $wgRestrictedGroups. CentralAuth already reuses local-group-specific patterns in MediaWiki, such as rendering group names from MediaWiki:Group-<name> etc.
Acceptance criteria
- CentralAuth reads conditions for global groups from $wgRestrictedGroups (from the central wiki).