Component: CentralAuth

This will come with some rights-management stuff I'm working on currently.

Reassigning to me.

cometstyles wrote:

I made this > http://meta.wikimedia.org/wiki/User:Cometstyles/Global_group_rights . Could be useful :)

Marking dependency on the committing of that patch.

Done in r47507, with a different patch, of course.

happy_melon wrote:

This doesn't work for me, either on meta or en.wiki; I get "You are not allowed to execute the action you have requested".

I think that the more original method suggested is superior anyway; 'overloading' this interface to provide information as well as control is both complicated (need loads of new security checks) and confusing given that it has a different layout to that for local groups. We want to be working towards greater integration between local and global rights, not less.

Fixed *on subversion*. It will be deployed next time there is a general code update.

happy_melon wrote:

<facepalm/> Sorry, I misread the diff number. A test wiki that always runs SVN head would be invaluable for checking these things; although there are obviously security considerations (couldn't be directly linked to the Wikimedia CentralAuth network, for instance, which would admittedly make patches like this harder to check).

What are your thoughts on a [[Special:ListGlobalGroupRights]] page in an identical format to [[Special:ListGroupRights]], however? I maintain that this is a preferable system, encouraging closer integration between local and global groups which is AFAIK the way we're heading.

Sounds redundant to what was just implemented -- it makes sense to repurpose the same interface to change and view the same thing -- we don't use a separate interface for editing and for viewing the source of a page.

The patch that I wrote last year seemed to work okay for the integration you suggested, but is too big for the features it provides, and therefore hasn't been, and is unlikely to be reviewed and merged into HEAD.

I would prefer that we changed ListGroupRights to be a change *and* view interface for local group rights, rather than add an additional read-only interface for global rights.

happy_melon wrote:

I agree it's redundant; my question is which is the preferable solution. I like the principle of your epic patch in bug15252 but, as you say, it's probably too big to ever be properly reviewed. However, regardless of when/whether that is likely to be implemented, the two systems are *still* not synchronised. I'm more interested in a consistent interface for viewing and/or editing group permissions, than on what precisely that interface is. There are currently a number of inconsistencies:

1. Name: [[Special:ListGroupRights]] vs [[Special:GlobalGroupPermissions]]. I'd argue that the name of the former is actually disingenuous: by our usual convention, "rights"<=>"groups" rather than "rights"<=>"permissions", IMO. Would a rename to [[Special:GroupPermissions]] be sensible? It *shouldn't* be a breaking change, since all potentially-breakable bots/scripts should certainly be using the API functionality (which is actually older). Naturally we make a special page redirect from ListGroupRights.

2. UI layout: I can't really visualise how the interface will look without being able to compare the source to a running version, but I can tell that it's not the same as ListGroupRights. It would be a Good Thing for the display to be consistent.