The Flickr importing in UploadWizard is a quick and dirty hack that I did a couple years ago. The API key is actually from an account that I created personally, rather than an official WMF account.

This code should definitely be cleaned up by the Multimedia Team. I was originally thinking we would have to proxy all the requests (which is a pain), but I hadn't considered your OAuth idea. That sounds like a promising solution to try out.

Also, we should set this up under some sort of official WMF Flickr account rather than a personal account (for Commons I mean).

We could use a non-secret API key for vagrant and for unit tests, though. If you do not object, I might appropriate the old one for that purpose.

Note to self: un-skip tests in https://gerrit.wikimedia.org/r/#/c/65109/ once this is solved (and there is a private API key for commons and a public one for the tests).

As Gilles pointed out in the gerrit comments, the API key is not really sensitive as Flickr gives us another secret key which is required for operations that need authorization.

(In reply to comment #2)

We could use a non-secret API key for vagrant and for unit tests, though. If
you do not object, I might appropriate the old one for that purpose.

If the code is actually connecting to Flickr's servers, it's an integration test, not a unit test.

A lot of the mileage (if not all) could probably be achieved by mocking the Flickr server's response in order to test the client-side code. After all, it's not supposed to test Flickr's code.

I don't think UploadWizard should include a key. However, at least the current one is not the same one used in production.