Change Details

A banned user on Wikidata is able to use external tools (here mixnmatch) that use OAuth. This has an impact for other people who contribute to Wikidata, because the user is removing correct suggestions and marking as non-applicable to Wikidata entries which are applicable to Wikidata. apart of having a way to deal with vandalism on mixnmatch, OAuth should have an option to forbid access to tools related to a project for users blocked on those projets.

The OAuth code uses `$user->isLocked() || $wgBlockDisablesLogin && $user->isBlocked()` half the time (`/identify`, API) and just `$user->isBlocked()` the other half (authorization) which does not really make sense. We should ensure that blocked status is handled consistently (probably via the first version of the logic as there is no good reason to take local blocks into account if the wiki still allows login - `/identify` tells the app the user has been blocked so it can decide what to do about it).

A banned user on Wikidata is able to use external tools (here mixnmatch) that use OAuth. This has an impact for other people who contribute to WikidataThe OAuth code uses `$user->isLocked() || $wgBlockDisablesLogin && $user->isBlocked()` half the time (`/identify`, because the user is removing correct suggestions and marking as non-applicable to Wikidata entries which are applicable to Wikidata. apart of having a way to deal with vandalism on mixnmatch,API) and just `$user->isBlocked()` the other half (authorization) which does not really make sense. OAuth should have an option to forbid access to tools related to a project for users blocked on those projetsWe should ensure that blocked status is handled consistently (probably via the first version of the logic as there is no good reason to take local blocks into account if the wiki still allows login - `/identify` tells the app the user has been blocked so it can decide what to do about it).