Auth systems/OAuth/IRC log 2013-04-18

Apr 19 11:06:16 <csteipp> Can we cherry pick in Aaron's change on top of anomie's work?
Apr 19 11:06:38 <anomie> I don't see why not
Apr 19 11:07:14 <csteipp> Cool. Do one of you have time to do that tomorrow?
Apr 19 11:08:19 <anomie> I should be able to find time
Apr 19 11:08:32 <csteipp> Cool, thanks!
Apr 19 11:09:20 <csteipp> Alright, I also added some testing scenarios at https://www.mediawiki.org/wiki/Auth_systems/SUL2/Testing
Apr 19 11:09:27 <csteipp> (very basic)
Apr 19 11:10:03 <csteipp> If there are any particular cases we should make sure work in all browsers, please add them
Apr 19 11:10:19 <anomie> Is it possible anymore to create a local-only account?
Apr 19 11:10:51 <csteipp> You can't create them, but you can create an account that is global, and then detach it
Apr 19 11:10:58 <Aaron|home> right
Apr 19 11:12:10 <csteipp> *hopefully* after the "SUL finalization" we won't even allow that... but I'm guessing there is always going to be an edge case where someone could end up with a detached account. So I wanted to make sure nothing unexpected happens.
Apr 19 11:12:49 <James_F> Hopefully. :-)
Apr 19 11:13:14 <csteipp> anomie / Aaron|home, anything you guys are waiting on or need on the CentralAuth rework? Otherwise I wanted to move on to some oauth stuff..
Apr 19 11:13:51 <anomie> Just review
Apr 19 11:14:11 <Aaron|home> nothing here
Apr 19 11:14:42 <csteipp> I'll try and take a look at both soon, again.
Apr 19 11:15:24 <csteipp> Alright, so while as we're finishing out the CentralAuth stuff, we do need to start coding the OAuth side too
Apr 19 11:15:30 <csteipp> I made a few updates to https://www.mediawiki.org/wiki/Auth_systems/OAuth
Apr 19 11:15:44 <csteipp> (and drew a picture, since I'm a visual person)
Apr 19 11:16:13 <csteipp> Can we talk about the permissions open question?
Apr 19 11:17:24 <csteipp> http://www.mediawiki.org/wiki/Auth_systems/OAuth#granularity-question
Apr 19 11:17:46 <csteipp> Brad added some thoughts on modules vs. rights
Apr 19 11:18:37 <csteipp> I was wondering if we wanted to add a separate permission-ish something for anything making changes to MediaWiki namespace
Apr 19 11:19:03 <csteipp> But did anyone else have thoughts on what the right approach might be?
Apr 19 11:19:21 <anomie> I think the way to go is to just add a method to ApiBase for the API module to just say what rights it needs, rather than trying to fit things to user rights or API module names. Then we can divide up namespaces however makes sense for each module.
Apr 19 11:20:33 <csteipp> So that would be the third bullet?
Apr 19 11:20:37 <anomie> Yeah.
Apr 19 11:20:38 <anomie> The default can be the module name, so we won't have to update every API-using extension right away.
Apr 19 11:21:49 <csteipp> So it would be module-ish, but modules could override the default and require more specific (or the name of another module) for specific actions, right?
Apr 19 11:22:07 <csteipp> And the user rights of the user would still apply
Apr 19 11:22:17 <Aaron|home> that might be reasonable
Apr 19 11:22:32 <anomie> Yes. So most of the public query modules could just say "query", while something like ApiEditPage could list "edit", "editinterface", "editmycssjs", etc
Apr 19 11:22:46 <anomie> Yes, this wouldn't affect the existing user rights checks at all.
Apr 19 11:22:54 <anomie> This would be another check on top of them.
Apr 19 11:23:05 <TimStarling> presumably the method would need access to the request parameters if it is going to conditionally return editinterface etc.
Apr 19 11:25:19 <anomie> Which is easy enough, just call ->extractRequestParams(). Or maybe it could check as needed inside execute, too.
Apr 19 11:29:00 <csteipp> So anomie, were you thinking ApiBase would call into the module with a list of oauth permission, and the the module would do the logic to decide if the call was appropriate for the permissions, right?
Apr 19 11:29:12 <csteipp> (if I understand what you're thinking)
Apr 19 11:31:05 <anomie> Actually, I hadn't thought about it. I had been sort of thinking the module would say what permissions it needs, but your way seems more amenable to giving partial results with warnings about unavailable bits rather than hard errors.
Apr 19 11:33:15 <csteipp> Well, doing it like that would mean that some api modules would have to basically become oauth aware, which seems a little wrong. But I'm not sure a better way to do it.
Apr 19 11:34:27 <csteipp> s/like that/my way above/
Apr 19 11:34:31 <anomie> No matter what they'll have to be auth aware, unless they want the basic "module name" deal. But I think we can do it generically enough that it's not oauth-specific.
Apr 19 11:35:46 <anomie> e.g. ApiEditPage would know it needs "edit" or "editinterface" or whatever, but it wouldn't have to know how it was determined that the user has those grants.
Apr 19 11:36:01 <csteipp> So basically make them "authorization aware", and let the module decide based on the user's authn's
Apr 19 11:37:12 <csteipp> Hmm... that would actually solve some of our issues with the api returning deleted data to unauthorized users, if we did it right...
Apr 19 11:37:30 <anomie> We have issues with that?
Apr 19 11:38:14 <csteipp> We definitely have
Apr 19 11:38:58 <anomie> I should probably look at those at some point.
Apr 19 11:40:24 <anomie> A little brainstorming: ApiMain calls $wgAuth->checkGrantsForApiModule( $module ), which might do nothing (if the auth module grants everything) or might look up what grants are granted and call $module->checkApiGrants( $grants ). Return a Status object, I suppose.
Apr 19 11:42:22 <csteipp> Off the top of my head, that sounds reasonable
Apr 19 11:42:39 <csteipp> Tim / Aaron, any thoughts on it ^?
Apr 19 11:44:58 <TimStarling> maybe it could be implemented analogously to isReadMode()/isWriteMode()
Apr 19 11:45:19 <TimStarling> i.e. in ApiMain::executeAction() or ApiMain::checkExecutePermissions()
Apr 19 11:45:52 <anomie> Yeah, checkExecutePermissions is a good place to have it make the call.
Apr 19 11:46:10 <TimStarling> the rest is all fine, I think
Apr 19 11:47:02 <csteipp> Cool. Thanks. Alright, I'll keep writing this up
Apr 19 11:47:37 <csteipp> I think we're almost to the point of looking at db schema and basic class design
Apr 19 11:48:04 <csteipp> I'll try and take a stab at that tomorrow, and maybe we can talk more on Monday
Apr 19 11:48:18 <csteipp> Than actually start some code next week
Apr 19 11:49:32 <csteipp> Alright, that's all I have
Apr 19 12:06:47 * Aaron|home backscrolls
Apr 19 12:06:55 <Aaron|home> csteipp: yes, checkExecutePermissions seems sanish