HotCat task is inaccessible to non-admins: read-only checks require admin rights and the install step gives no guidance
Open, HighPublic1 Estimated Story PointsBUG REPORT
Actions

Assigned To

Authored By

	ngkountas
	Jul 14 2026, 9:22 PM

Project Tags

Referenced Files

None

Subscribers

Description

All four /api/gadgets/hotcat/* endpoints are gated by the requireAuth middleware, which on production wikis requires admin rights (sysop/bureaucrat/editinterface). However, only installation actually needs that: checking whether the gadget is installed reads two public MediaWiki: pages unauthenticated, the uncategorized-articles list is a public query, and the preference check reads the user's own options with their own OAuth token. As a result, a non-admin on a production wiki gets 403s on the whole task — even though the categorization steps themselves only edit articles.

Additionally, a non-admin who reaches the install step and clicks Install just gets a raw "Failed to install" error with no explanation.

Proposed fix: - Move the three read endpoints (/status, /preference, /uncategorized) to a logged-in-only check; keep the admin gate (with its test-wiki bypass) on POST /install, which MediaWiki enforces server-side anyway.

In the install step, when the gadget isn't installed and the user can't install it, show a warning banner ("Administrator rights needed", suggesting they ask a wiki admin) and disable the Install button, mirroring the server's gate including the test-wiki bypass.
(Same patch also replaces the step's 🧩/⚡ emoji with Codex icons — cdxIconPuzzle, cdxIconDownload — per the design-token adoption.)

Details

Other Assignee: ToluAyo

Related Changes in GitLab:

	Title	Reference	Author	Source Branch	Dest Branch
	Fix: Clarify HotCat install warning for non-admin users	repos/lpl/starterkit-v1!158	toluayo	fix/hotcat-non-admin-access-message	main
	Fix: Let any logged-in user check HotCat status	repos/lpl/starterkit-v1!119	ngkountas	feat/hotcat-non-admin-access	main

Customize query in GitLab

Related Objects
Search...

Status	Subtype	Assigned	Task
Open		srishakatux	T410699 Explore the concept of a semi-automated starter kit for new and small wikis
Open		None	T430055 Starter Kit PILOT: Implementation, Roll out & Evaluation
Open	BUG REPORT	ngkountas	T432179 HotCat task is inaccessible to non-admins: read-only checks require admin rights and the install step gives no guidance

Event Timeline

ngkountas created this task.Jul 14 2026, 9:22 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 14 2026, 9:22 PM

ngkountas claimed this task.Jul 14 2026, 9:22 PM

ngkountas triaged this task as High priority.

ngkountas moved this task from Incoming Requests to In Progress on the LPL Onboarding and Development board.

ngkountas set the point value for this task to 1.

ngkountas opened https://gitlab.wikimedia.org/repos/lpl/starterkit-v1/-/merge_requests/119

Fix: Let any logged-in user check HotCat status

ngkountas updated https://gitlab.wikimedia.org/repos/lpl/starterkit-v1/-/merge_requests/119

Fix: Let any logged-in user check HotCat status

Maintenance_bot removed a project: Patch-For-Review.Jul 14 2026, 9:30 PM

MaryMunyoki added projects: Starter Kit, LPL Projects (Starter kit PILOT).Jul 15 2026, 5:22 PM

MaryMunyoki moved this task from Backlog to Enhancements on the Starter Kit board.

ngkountas moved this task from In Progress to Needs Review on the LPL Onboarding and Development board.Jul 15 2026, 5:26 PM

MaryMunyoki added a parent task: T430055: Starter Kit PILOT: Implementation, Roll out & Evaluation.Jul 16 2026, 3:59 PM

toluayo merged https://gitlab.wikimedia.org/repos/lpl/starterkit-v1/-/merge_requests/119

Fix: Let any logged-in user check HotCat status

ngkountas moved this task from Needs Review to Waiting for Deployment on the LPL Onboarding and Development board.Jul 17 2026, 9:36 AM

ngkountas moved this task from Waiting for Deployment to Done on the LPL Onboarding and Development board.Jul 23 2026, 4:21 PM

I can see the warning message now: "Administrator rights needed. Installing a gadget edits sitewide MediaWiki pages, which only administrators can do on mag.wikipedia.org. Ask one of your wiki's administrators to install HotCat, then return here to continue."

Minor thing I am wondering here is if the last sentence should be tweaked to say "Installing a gadget edits sitewide MediaWiki pages, which only administrators can do on mag.wikipedia.org. To proceed, either obtain Administrator and Interface Administrator rights on your wiki, or ask one of your wiki's administrators to install HotCat - then return here to enable it from your preferences and continue." Because right below this error message one sees an Install HotCat button, so it might not be apparent to a user what they need to do next if an administrator needs to install it first and they themselves might be the only administrator on their wiki.