Skip to content

Consider a designated reader for canonical parses #1378

Description

@alistair3149

A suggestion; priority unconfirmed. #1346 is unmerged as of filing, so the question to deployments is whether they
will be affected, not whether they are.

#1346 makes parse-time reads run as the user the page is parsed for. For the canonical parse, meaning the save-time
parse, jobs, the projection's own parse and Parsoid renders, that user is anonymous. On a wiki where anonymous users
cannot read, a value read through {{#neowiki_value}} or the nw accessors in such a parse is empty:

  • a category, page property or link derived from it is never recorded;
  • the Page node's categories in graph projections omit it;
  • VisualEditor, which loads Parsoid HTML, shows it blank while editing.

Pages that read Subjects only through {{#view}} are unaffected. Before #1346 those parses read as the saver; the
blank is the accepted cost, recorded in ADR 27's consequences. No
opt-out exists: the per-wiki switch to disable the parse-time functions was deferred in #1346.

Suggestion: a designated reader for canonical parses, substituted for the anonymous user when the parse is canonical.
One constraint decides its shape: the parser cache files canonical output under the parsing user's access class
(#1347), so a reader who can read more than that class leaks through the cache. Two options respect it. The reader is
the wiki's least-privileged reader class, anonymous where it may read and otherwise the user group's rights, so its
output is safe for every viewer; this reuses the access-class machinery and is the smaller change. Or substitution
also changes the class the entry is keyed under, which touches the cache keying and the projection parse.

Before scheduling, ask deployments with login-only wikis whether any template derives a category or page property
from a Subject value (an insource:"#neowiki_value" search over the Template namespace finds the candidates), and
whether editors use VisualEditor on pages that read Subjects. If neither, this can wait.

AI-authored — Claude Code, Fable 5.1; one-line ask from @alistair3149 to file this as a suggestion after an in-session permissions gap analysis, no redirects; text not yet human-reviewed; claims checked against the #1346 branch (ParserAuthority, UserAccessClass) and core's Parsoid render helper, one blind-judge pass applied, nothing executed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    productDetermine what needs to happen

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions