@PBradley-WMF @MMoss_WMF Here's a proposal for how this could work technically.

The following rights exit:

• checkuser-temporary-account-no-preference: This allows a user to reveal IPs without accepting a preference
• checkuser-temporary-account: This allows a user to reveal IPs, but only if they accept a preference
• checkuser-temporary-account-log: This allows a user to see who viewed IPs for a temporary account, but without revealing the IP

Proposal:

• Stewards, checkusers, staff and ombuds get checkuser-temporary-account-no-preference, meaning that they can reveal IPs on any wiki. These groups also get checkuser-temporary-account-log.
• Members of the groups global-sysop, global-rollbacker, abusefilter-helper and abusefilter-maintainer get checkuser-temporary-account on every wiki. Since they may not have signed an NDA, they must accept the agreement via a single global preference. Once they have done this, they can reveal IPs on any wiki. These groups also get checkuser-temporary-account-log.
• Local admins (sysops) get checkuser-temporary-account on any wiki where they are an admin. Since they may not have signed an NDA, they must accept the agreement via a single global preference. Once they have done this, they can reveal IPs on any wiki where they are an admin.
• All users who meet the requirements to reveal IPs globally, and who also meet the local requirements of some particular wiki, get checkuser-temporary-account on that wiki. Since they may not have signed an NDA, they must accept the agreement via a single global preference. Once they have done this, they can reveal IPs on that wiki.
• Once a user has accepted the global preference, if they gain checkuser-temporary-account on a new wiki, they can reveal IPs on that wiki without accepting the preference again, since they have already accepted it.

Confirming that Legal has seen this and is preparing a response. Current status is blocked pending confirmation of what happens when various groups here have the global permission flag set (automatically or by opt in), but local projects have set enhanced local requirements.

In T356294#9586791, @PBradley-WMF wrote:

Confirming that Legal has seen this and is preparing a response. Current status is blocked pending confirmation of what happens when various groups here have the global permission flag set (automatically or by opt in), but local projects have set enhanced local requirements.

Another issue is currently user requires not to be blocked in more than one wiki in order to have IP reveal access - a criterion copied from board election eligibility criteria which is used there since 2011; and there are potentially users not meeting such criterion. This is one of reasons why I suggest to remove this requirement from Access to temporary account IP addresses policy.

In T356294#10046251, @Tchanders wrote:

@Niharika @Madalina Can we just use the same permissions as Special:IPContributions here? That's also the same permissions as for IP reveal.

(Dumping relevant thoughts that came to me during todays Legal/TSP office hours)

How would that look in practice though? Whether you have access to Special:IPContributions (and IP Reveal) is a question that has an wiki-dependant answer. One might be allowed to access Special:IPContributions at en.wikipedia, but not have the same access at de.wikipedia (or the other way around). However, CheckUser-GlobalContributions allows you to access data from all wikis.

Would we allow Global Contributions access to anyone who has IP Reveal access on any wiki? This would allow you to see the wiki's data through Global Contributions, but not through Special:IPContributions. Would we only allow Global Contributions access to users who have IP reveal access on all wikis? That would be a significant change from what we have now, and that may or may not be OK. Would we filter down the shown data to only include wikis the user has permission at? This is in-between the previous two options, as well as being a change of how GUC usually works.

@STran Does implementation of this need any changes to the permissions of the global groups? If that is needed, it would need to be done by a steward on-wiki. Let me know if any changes like that are needed.

As it stands, anyone with the right to reveal IPs locally can see all the global results. This will need fixing before we deploy beyond the test wikis.

Problem

At the moment, we check if the user has the necessary rights and preferences (code here). This is difficult to do for each wiki; we could do a database lookup for the user's groups and the preferences, but whether a group has a right assigned to it is defined in the wiki's configuration.

Short-term fix

To start with, could we restrict access to users who can reveal IPs everywhere by just checking for membership of the global group global-temporary-account-viewer? (The middle column of the table in the task description.)

As a next step, could we use a DB lookup to check for local group membership and preferences (and number of edits and age of account), as the access policy currently states that the right is assigned predictably on all wikis.

Long term

That's quite inflexible and would mean that access to Special:GlobalContributions wouldn't be affected by changes to the permissions config. A proper, more stable solution would be to figure out cross-wiki permission checks properly.

Change #1081189 had a related patch set uploaded (by STran; author: STran):

[mediawiki/extensions/CheckUser@master] [WIP] Add temporary group check for Special:GlobalContributions

https://gerrit.wikimedia.org/r/1081189

In T356294#10237431, @Tchanders wrote:

Short-term fix

To start with, could we restrict access to users who can reveal IPs everywhere by just checking for membership of the global group global-temporary-account-viewer? (The middle column of the table in the task description.)

This is only a subset of the middle column of the table. global-temporary-account-viewer only includes CU+OS. All of the others with global access are granted it through their respective global groups.

Also, global-temporary-account-viewer is Wikimedia-specific, and, therefore, should not be in CheckUser.

In T356294#10238436, @JJMC89 wrote:

In T356294#10237431, @Tchanders wrote:

Short-term fix

To start with, could we restrict access to users who can reveal IPs everywhere by just checking for membership of the global group global-temporary-account-viewer? (The middle column of the table in the task description.)

This is only a subset of the middle column of the table. global-temporary-account-viewer only includes CU+OS. All of the others with global access are granted it through their respective global groups.

Also, global-temporary-account-viewer is Wikimedia-specific, and, therefore, should not be in CheckUser.

We could perhaps run a hook during the permission checks, so Wikimedia can check for these global groups instead of the right/preference - at least in the short term - to allow us to fully do the middle column.

Change #1081189 abandoned by STran:

[mediawiki/extensions/CheckUser@master] [WIP] Add temporary group check for Special:GlobalContributions

Reason:

Abandoned in favor of I5fd09249507b24f303f85b7e620fcf8ecd49f1e1

https://gerrit.wikimedia.org/r/1081189

Change #1082480 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] WIP GlobalContributionsPager: Sketch of checking permissions at external wikis

https://gerrit.wikimedia.org/r/1082480

Change #1083382 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] WIP Add service for performing API requests to external wikis

https://gerrit.wikimedia.org/r/1083382

Summarising the latest thinking on how to do cross-wiki permission checks, and synthesizing some conversations we've been having elsewhere.

The permissions problems

Primary problem: IP reveal permissions

For users who have IP reveal rights on some wikis but not others, they should only see results for the wikis where they have IP reveal rights. What is the best way to check whether a user has IP reveal rights on an external wiki?

Relevant rights: checkuser-temporary-account-no-preference, checkuser-temporary-account.

Secondary problem: permission to see hidden things

Even if a user has the right to reveal IPs, they may not have permission to see a particular revision (if its author was hidden) or certain things about a revision. What is the best way to check whether a user has some particular right on an external wiki?

Relevant rights: deletedhistory, suppressrevision, viewsuppressed.

Possible solutions

API call

Approach: To get the actual permissions on an external wiki, make an API call for the needed permissions

Pros:

• Allows us to know all the permissions listed above
• Allows us to show/hide contributions based on author visibility, remove/format links to suppressed revisions exactly the same as the local contribution lines

Cons:

• Time taken to make the query increases page load time
• We need to handle failed API calls
• Maintenance burden of testing and debugging

Direct lookups

Approach:

• To work out whether a user has a right, we need to know two things: (1) what groups the user is in, and (2) whether the right is assigned to any of those groups in the wiki's config.
• For (1), we can look up a user's group membership on an external wiki via the user_groups table. We can also look up their number of edits and the age of their account (so we can determine membership of any autopromote groups that use these criteria).
• For (2), it's less clear how to do this.

Pros:

• If we can figure out a good way to do (2), this is probably fine
• It wouldn't increase page load time as badly as an API call

Cons:

• If we can't figure out (2), then:
  • We wouldn't really know the user's rights; we would be guessing them from their groups.
  • We couldn't make assumptions about the deletedhistory, suppressrevision, viewsuppressed rights because there are no guarantees about which groups they are assigned to. E.g. there are currently differently-named groups on different wikis that have the deletedhistory right. This means that we would need to assume that users can't see deleted revisions, to avoid leaking information to users without permissions, so we would be over-hiding things from users who should in fact be able to see them. Similarly, deleted revision link formatting wouldn't be accurate.
  • Perhaps we could argue that the IP reveal permissions are rigidly encoded in the access policy, so we can assume they won't change and will be the same on every wiki. But if the access policy did ever change, we would need to make a code change to Special:GlobalContributions to account for this change. The access policy would not be able to allow for any differences between wikis (including different thresholds for the autopromote group).

Thanks for writing out this summary. Going the API route makes sense to me, everything considered.

Testing steps

Setup:

• Make an edit as a temporary user in a wiki. Make a note of their IP address.
  • If the IP address is unknown, disable temporary accounts, make an edit, and see what IP address the edit is assigned to
• Do the same for a temporary account using the same IP address at anther wiki.
• Login as a user who has an account at both wikis

Incomplete rights:

• Give this user IP reveal rights at one wiki, but not at the other
• At the wiki where you have IP reveal rights, visit Special:GlobalContributions
• You should see the edit made at this wiki, but not the edit made at the other wiki

Global rights:

• Give this user IP reveal rights at both wikis
• At one of the wikis, visit Special:GlobalContributions
• You should see the edits made from both wikis

Change #1083382 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add service for performing API requests to external wikis

https://gerrit.wikimedia.org/r/1083382

Change #1082480 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] GlobalContributionsPager: Check IP reveal permissions at external wikis

https://gerrit.wikimedia.org/r/1082480

Change #1087584 had a related patch set uploaded (by Tchanders; author: Tchanders):

[operations/mediawiki-config@master] temp accounts: Enable IP reveal rights for local groups on meta

https://gerrit.wikimedia.org/r/1087584

The main patches to fix the functionality were merged.

There is some clean-up work captured in separate tasks:

• T379106: Remove API call for CentralAuth token from CheckUserApiRequestAggregator
• T379107: Show a warning in Special:GlobalContributions if a permissions lookup at an external wiki fails
• T379105: Make it clear that cross-wiki permission checking in Special:GlobalContributions is not ideal

The only thing left for this task is the config patch above to undo T377584: Temporarily restrict local access to Special:GlobalContributions, so that users who have rights at only some wikis can have access (the left hand column from the table in the task description).

The only thing left for this task is the config patch above to undo T377584: Temporarily restrict local access to Special:GlobalContributions, so that users who have rights at only some wikis can have access (the left hand column from the table in the task description).

Awaiting the messaging patch making it onto production: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1094514