Change Details

Now that there is an UI for querying OATH status (T209749), we should allow prviileged users to do the API as well. My patch adds logging to that API module and allows holders of `oathauth-verify-user` to execute it. However, the original purpose of this API module was for Striker and similar software to be able to use Wikitech-powered 2FA. We probably don't want to log that. Question is...how to do this? Maybe we should add a "suppresslog" parameter and allow holders of `oathauth-api-all` to do that?

Now that there is an UI for querying OATH status (T209749), we should allow privileged users to do that via the API as well. My patch adds logging to that API module and allows holders of `oathauth-verify-user` to execute it. However, the original purpose of this API module was for Striker and similar software to be able to use Wikitech-powered 2FA. We probably don't want to log that. Question is...how to do this? Maybe we should add a "suppresslog" parameter and allow holders of `oathauth-api-all` to do that?

Now that there is an UI for querying OATH status (T209749), we should allow prviivileged users to do that via the API as well. My patch adds logging to that API module and allows holders of `oathauth-verify-user` to execute it. However, the original purpose of this API module was for Striker and similar software to be able to use Wikitech-powered 2FA. We probably don't want to log that. Question is...how to do this? Maybe we should add a "suppresslog" parameter and allow holders of `oathauth-api-all` to do that?