Page MenuHomePhabricator

Grant checkuser-temporary-account-no-preference to the steward group
Closed, ResolvedPublic1 Estimated Story Points

Description

Per foundation policy, users with the checkuser and steward groups should be automatically granted access. This means that they should not need to check the preference to view temporary account IPs.

Following T356304: Ensure that checkusers and stewards do not have to check a preference for IP reveal right, a right was granted that allows users to view temporary account IPs without needing to check the preference. This was granted to the checkuser group but has not been granted to the steward group as this is a global group and the rights granted to the group are modified using Special:GlobalGroupPermissions.

Acceptance criteria

Event Timeline

Dreamy_Jazz added a subscriber: Urbanecm_WMF.

@Urbanecm_WMF, is this something that you could do?

@Urbanecm_WMF, is this something that you could do?

Sure, done: https://meta.wikimedia.org/w/index.php?title=Special:Log&logid=55126472. I also added the view logs permission, since it makes no sense to add one but not the other. Do we want to enable the permissions for any other global group? staff and ombuds come to my mind as CU equivalents, at least.

(mid-term, we should do global-rollbacker as well, but that's in discussion in the document, and presumably will be tracked in a different task in the future)

@Urbanecm_WMF, is this something that you could do?

Sure, done: https://meta.wikimedia.org/w/index.php?title=Special:Log&logid=55126472. I also added the view logs permission, since it makes no sense to add one but not the other. Do we want to enable the permissions for any other global group? staff and ombuds come to my mind as CU equivalents, at least.

(mid-term, we should do global-rollbacker as well, but that's in discussion in the document, and presumably will be tracked in a different task in the future)

I'm tempted to ask others before adding to staff and ombuds considering that they are not explicitly listed in the policy. However, my opinion would be to give both the checkuser-temporary-account-no-preference and checkuser-temporary-account-log right to staff and ombuds.

I've asked others and while that is being discussed we can keep this open and expand it to be granting these rights to other global groups.

Ombuds need to have the same access as CUs (checkuser-temporary-account-no-preference, checkuser-temporary-account-log) to perform oversight/review of CU actions.

I've asked others and while that is being discussed we can keep this open and expand it to be granting these rights to other global groups.

Is there any update, please? Also CC @Tchanders.

Ombuds need to have the same access as CUs (checkuser-temporary-account-no-preference, checkuser-temporary-account-log) to perform oversight/review of CU actions.

I agree the right should be granted, but before applying an on-wiki change, waiting for TSP buy-in as well. Either way, this is a preparation for a future release, so it is not particularly urgent.

@Urbanecm_WMF I've added this to the scope of T356294: Restrict which groups have access to Special:GlobalContributions and updated our private questions document with Legal in the same way.

Right now, this conversation is taking place with Legal - no conclusion yet even on the original scope of that task. @Madalina is overseeing this conversation.

Perhaps we could move this task forward, as long as the outstanding questions are captured in T356294. (I've stalled that task to make status clearer.)

Closing this task with the understanding that the rest of the unresolved questions are being sent to legal in T356294 makes sense to me. Therefore, we should be able to close this task as long as @Urbanecm_WMF agrees.