Change Details

As recently discovered in T210953, integration of Wikibase into MediaWiki user restriction mechanism has not been tested appropriately. As blocking users is the common way how Wikidata community deal's with misbehaving actors, it is rather critical to ensure this functionality is not broken with code changes to both Wikibase software, and also to MediaWiki itself. Ensuring this does not happen would be possible by creating a set of tests performing edits using the blocked user account, and verifying that the action is not allowed (as expected). Note: this should cover both editing of the entity page using the UI, but also edits performed using Wikibase API. Due to different nature of the APIs, those could probably be tracked as separate tasks. It seems critical to have those tests implemented as integration/edge-to-edge tests, to ensure that the behaviour is correct in the full integration of Wikibase code with MediaWiki (i.e. not using test doubles of some services).

As recently discovered in T210953, integration of Wikibase into MediaWiki user restriction mechanism has not been tested appropriately. As blocking users is the common way how Wikidata community deal's with misbehaving actors, it is rather critical to ensure this functionality is not broken with code changes to both Wikibase software, and also to MediaWiki itself. Ensuring this does not happen would be possible by creating a set of tests performing edits using the blocked user account, and verifying that the action is not allowed (as expected). Note: this should cover both editing of the entity page using the UI, but also edits performed using Wikibase API. Due to different nature of the APIs, those could probably be tracked as separate tasks. It seems critical to have those tests implemented as integration/edge-to-edge tests, to ensure that the behaviour is correct in the full integration of Wikibase code with MediaWiki (i.e. not using test doubles of some services). Acceptance criteria: tests for the following user activities are in place and run as part of the CI job [] Blocked user cannot edit item's label/description/alias using JS-enriched UI [] Blocked user cannot edit item's label/description/alias using SetLabelsDescriptionsAliases special page [] Blocked user cannot edit item's statements using JS-enriched UI [] Blocked user cannot edit item's sitelinks using JS-enriched UI [] Blocked user cannot edit item's sitelinks using SetSiteLinks special page [] Blocked user cannot edit lexeme's lemma/language/lexical category data using JS-enriched UI [] Blocked user cannot edit lexeme's statements using JS-enriched UI [] Blocked user cannot edit form's representations using JS-enriched UI [] Blocked user cannot edit form's grammatical features using JS-enriched UI [] Blocked user cannot edit form's statements using JS-enriched UI [] Blocked user cannot edit sense's glosses using JS-enriched UI [] Blocked user cannot edit sense's statements using JS-enriched UI

As recently discovered in T210953, integration of Wikibase into MediaWiki user restriction mechanism has not been tested appropriately. As blocking users is the common way how Wikidata community deal's with misbehaving actors, it is rather critical to ensure this functionality is not broken with code changes to both Wikibase software, and also to MediaWiki itself. Ensuring this does not happen would be possible by creating a set of tests performing edits using the blocked user account, and verifying that the action is not allowed (as expected). Note: this should cover both editing of the entity page using the UI, but also edits performed using Wikibase API. Due to different nature of the APIs, those could probably be tracked as separate tasks. It seems critical to have those tests implemented as integration/edge-to-edge tests, to ensure that the behaviour is correct in the full integration of Wikibase code with MediaWiki (i.e. not using test doubles of some services). Acceptance criteria: tests for the following user activities are in place and run as part of the CI job [] Blocked user cannot edit item's label/description/alias using JS-enriched UI [] Blocked user cannot edit item's label/description/alias using SetLabelsDescriptionsAliases special page [] Blocked user cannot edit item's statements using JS-enriched UI [] Blocked user cannot edit item's sitelinks using JS-enriched UI [] Blocked user cannot edit item's sitelinks using SetSiteLinks special page [] Blocked user cannot edit lexeme's lemma/language/lexical category data using JS-enriched UI [] Blocked user cannot edit lexeme's statements using JS-enriched UI [] Blocked user cannot edit form's representations using JS-enriched UI [] Blocked user cannot edit form's grammatical features using JS-enriched UI [] Blocked user cannot edit form's statements using JS-enriched UI [] Blocked user cannot edit sense's glosses using JS-enriched UI [] Blocked user cannot edit sense's statements using JS-enriched UI