PermissionManager.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Permissions;
 
use InvalidArgumentException;
use LogicException;
use MediaWiki\Actions\ActionFactory;
use MediaWiki\Api\ApiMessage;
use MediaWiki\Auth\AuthManager;
use MediaWiki\Block\AbstractBlock;
use MediaWiki\Block\Block;
use MediaWiki\Block\BlockErrorFormatter;
use MediaWiki\Block\BlockManager;
use MediaWiki\Config\ServiceOptions;
use MediaWiki\Context\IContextSource;
use MediaWiki\Context\RequestContext;
use MediaWiki\Exception\PermissionsError;
use MediaWiki\HookContainer\HookContainer;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Linker\LinkTarget;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use MediaWiki\Message\Message;
use MediaWiki\Page\PageIdentity;
use MediaWiki\Page\PageReference;
use MediaWiki\Page\RedirectLookup;
use MediaWiki\Request\WebRequest;
use MediaWiki\Skin\Components\SkinComponentUtils;
use MediaWiki\SpecialPage\SpecialPage;
use MediaWiki\SpecialPage\SpecialPageFactory;
use MediaWiki\Title\NamespaceInfo;
use MediaWiki\Title\Title;
use MediaWiki\Title\TitleFormatter;
use MediaWiki\User\TempUser\TempUserConfig;
use MediaWiki\User\User;
use MediaWiki\User\UserFactory;
use MediaWiki\User\UserGroupManager;
use MediaWiki\User\UserGroupMembership;
use MediaWiki\User\UserIdentity;
use MediaWiki\User\UserIdentityLookup;
use StatusValue;
use Wikimedia\Message\ListType;
use Wikimedia\Message\MessageSpecifier;
use Wikimedia\Message\MessageValue;
use Wikimedia\Rdbms\IDBAccessObject;
use Wikimedia\ScopedCallback;
 
class PermissionManager {
 
    public const RIGOR_QUICK = 'quick';
 
    public const RIGOR_FULL = 'full';
 
    public const RIGOR_SECURE = 'secure';
 
    public const CONSTRUCTOR_OPTIONS = [
        MainConfigNames::WhitelistRead,
        MainConfigNames::WhitelistReadRegexp,
        MainConfigNames::EmailConfirmToEdit,
        MainConfigNames::BlockDisablesLogin,
        MainConfigNames::GroupPermissions,
        MainConfigNames::RevokePermissions,
        MainConfigNames::AvailableRights,
        MainConfigNames::NamespaceProtection,
        MainConfigNames::RestrictUserPageEditing,
        MainConfigNames::RestrictionLevels,
        MainConfigNames::DeleteRevisionsLimit,
        MainConfigNames::RateLimits,
        MainConfigNames::ImplicitRights,
        MainConfigNames::ReauthenticateForActions,
    ];
 
    private HookRunner $hookRunner;
 
    private $allRights;
 
    private $implicitRights;
 
    private $usersRights = [];
 
    private $temporaryUserRights = [];
 
    private $cachedRights = [];
 
    private const CORE_RIGHTS = [
        'apihighlimits',
        'applychangetags',
        'autoconfirmed',
        'autocreateaccount',
        'autopatrol',
        'bigdelete',
        'block',
        'blockemail',
        'bot',
        'browsearchive',
        'changetags',
        'createaccount',
        'createpreviouslyrenamedaccount',
        'createwithcontentmodel',
        'createpage',
        'createtalk',
        'delete',
        'delete-redirect',
        'deletechangetags',
        'deletedhistory',
        'deletedtext',
        'deletelogentry',
        'deleterevision',
        'edit',
        'editalluserpages',
        'editcontentmodel',
        'editinterface',
        'editprotected',
        'editmyoptions',
        'editmyprivateinfo',
        'editmyusercss',
        'editmyuserjson',
        'editmyuserjs',
        'editmyuserjsredirect',
        'editmywatchlist',
        'editsemiprotected',
        'editsitecss',
        'editsitejson',
        'editsitejs',
        'editusercss',
        'edituserjson',
        'edituserjs',
        'hideuser',
        'ignore-restricted-groups',
        'import',
        'importupload',
        'interwiki',
        'ipblock-exempt',
        'logentryimport',
        'logout',
        'managechangetags',
        'markbotedits',
        'mergehistory',
        'minoredit',
        'move',
        'movefile',
        'move-categorypages',
        'move-rootuserpages',
        'move-subpages',
        'nominornewtalk',
        'noratelimit',
        'override-export-depth',
        'pagelang',
        'patrol',
        'patrolmarks',
        'protect',
        'read',
        'renameuser',
        'renameuser-global',
        'reupload',
        'reupload-own',
        'reupload-shared',
        'rollback',
        'sendemail',
        'siteadmin',
        'suppressionlog',
        'suppressredirect',
        'suppressrevision',
        'unblockself',
        'undelete',
        'unwatchedpages',
        'upload',
        'upload_by_url',
        'userrights',
        'userrights-interwiki',
        'viewmyprivateinfo',
        'viewmywatchlist',
        'viewsuppressed',
    ];
 
    private const CORE_IMPLICIT_RIGHTS = [
        'renderfile',
        'renderfile-nonstandard',
        'stashedit',
        'stashbasehtml',
        'mailpassword',
        'changeemail',
        'confirmemail',
        'linkpurge',
        'purge',
    ];
 
    public function __construct(
        private ServiceOptions $options,
        private SpecialPageFactory $specialPageFactory,
        private NamespaceInfo $nsInfo,
        private GroupPermissionsLookup $groupPermissionsLookup,
        private UserGroupManager $userGroupManager,
        private BlockManager $blockManager,
        private BlockErrorFormatter $blockErrorFormatter,
        HookContainer $hookContainer,
        private UserIdentityLookup $userIdentityLookup,
        private RedirectLookup $redirectLookup,
        private RestrictionStore $restrictionStore,
        private TitleFormatter $titleFormatter,
        private TempUserConfig $tempUserConfig,
        private UserFactory $userFactory,
        private ActionFactory $actionFactory
    ) {
        $this->options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->hookRunner = new HookRunner( $hookContainer );
    }
 
    public function userCan( $action, User $user, LinkTarget $page, $rigor = self::RIGOR_FULL ): bool {
        return $this->getPermissionStatus( $action, $user, $page, $rigor, true )->isGood();
    }
 
    public function quickUserCan( $action, User $user, LinkTarget $page ): bool {
        return $this->userCan( $action, $user, $page, self::RIGOR_QUICK );
    }
 
    private const BLOCK_CODES = [
        'blockedtext' => true,
        'blockedtext-partial' => true,
        'autoblockedtext' => true,
        'systemblockedtext' => true,
        'blockedtext-composite' => true,
        'blockedtext-tempuser' => true,
        'autoblockedtext-tempuser' => true,
    ];
 
    public function getPermissionErrors(
        $action,
        User $user,
        LinkTarget $page,
        $rigor = self::RIGOR_SECURE,
        $ignoreErrors = []
    ): array {
        $status = $this->getPermissionStatus( $action, $user, $page, $rigor );
        $result = [];
 
        // Produce a result in the weird format used by this function
        foreach ( $status->getErrors() as [ 'message' => $keyOrMsg, 'params' => $params ] ) {
            $key = $keyOrMsg instanceof MessageSpecifier ? $keyOrMsg->getKey() : $keyOrMsg;
            // Remove the errors being ignored.
            if ( !in_array( $key, $ignoreErrors ) ) {
                // Remove modern block info that is not expected by users of this legacy API
                if ( isset( self::BLOCK_CODES[ $key ] ) && $keyOrMsg instanceof MessageSpecifier ) {
                    $params = $keyOrMsg->getParams();
                    $keyOrMsg = $key;
                }
                $result[] = [ $keyOrMsg, ...$params ];
            }
        }
        return $result;
    }
 
    public function throwPermissionErrors(
        $action,
        User $user,
        LinkTarget $page,
        $rigor = self::RIGOR_SECURE,
        $ignoreErrors = []
    ): void {
        $status = $this->getPermissionStatus(
            $action, $user, $page, $rigor );
        if ( $status->hasMessagesExcept( ...$ignoreErrors ) ) {
            throw new PermissionsError( $action, $status );
        }
    }
 
    public function isBlockedFrom( User $user, $page, $fromReplica = false ): bool {
        return (bool)$this->getApplicableBlock(
            'edit',
            $user,
            $fromReplica ? self::RIGOR_FULL : self::RIGOR_SECURE,
            $page,
            $user->getRequest()
        );
    }
 
    public function getPermissionStatus(
        $action,
        User $user,
        LinkTarget $page,
        $rigor = self::RIGOR_SECURE,
        $short = false
    ): PermissionStatus {
        if ( !in_array( $rigor, [ self::RIGOR_QUICK, self::RIGOR_FULL, self::RIGOR_SECURE ] ) ) {
            throw new InvalidArgumentException( "Invalid rigor parameter '$rigor'." );
        }
 
        // With RIGOR_QUICK we can assume automatic account creation will
        // occur. At a higher rigor level, the caller is required to opt
        // in by either passing in a temp placeholder user or by actually
        // creating the account.
        if ( $rigor === self::RIGOR_QUICK
            && !$user->isRegistered()
            && $this->tempUserConfig->isAutoCreateAction( $action )
        ) {
            $user = $this->userFactory->newTempPlaceholder();
        }
 
        # Read has special handling
        if ( $action === 'read' ) {
            $checks = [
                $this->checkPermissionHooks( ... ),
                $this->checkReadPermissions( ... ),
                $this->checkUserBlock( ... ), // for wgBlockDisablesLogin
            ];
        } elseif ( $action === 'create' ) {
            # Don't call checkSpecialsAndNSPermissions, checkSiteConfigPermissions
            # or checkUserConfigPermissions here as it will lead to duplicate
            # error messages. This is okay to do since anywhere that checks for
            # create will also check for edit, and those checks are called for edit.
            $checks = [
                $this->checkQuickPermissions( ... ),
                $this->checkPermissionHooks( ... ),
                $this->checkPageRestrictions( ... ),
                $this->checkCascadingSourcesRestrictions( ... ),
                $this->checkActionPermissions( ... ),
                $this->checkUserBlock( ... ),
            ];
        } else {
            // Exclude checkUserConfigPermissions on actions that cannot change the
            // content of the configuration pages.
            $skipUserConfigActions = [
                // Allow patrolling per T21818
                'patrol',
 
                // Allow (un)watch (T373758)
                'editmywatchlist',
 
                // Allow admins and oversighters to delete. For user pages we want to avoid the
                // situation where an unprivileged user can post abusive content on
                // their subpages and only very highly privileged users could remove it.
                // See T200176.
                'delete',
                'deleterevision',
                'suppressrevision',
 
                // Allow admins and oversighters to view deleted content, even if they
                // cannot restore it. See T202989
                'deletedhistory',
                'deletedtext',
                'viewsuppressed',
            ];
 
            $checks = [
                $this->checkQuickPermissions( ... ),
                $this->checkPermissionHooks( ... ),
                $this->checkSpecialsAndNSPermissions( ... ),
                $this->checkUserPageEditPermissions( ... ),
                $this->checkSiteConfigPermissions( ... ),
            ];
            if ( !in_array( $action, $skipUserConfigActions, true ) ) {
                $checks[] = $this->checkUserConfigPermissions( ... );
            }
            $checks = [
                ...$checks,
                $this->checkPageRestrictions( ... ),
                $this->checkCascadingSourcesRestrictions( ... ),
                $this->checkActionPermissions( ... ),
                $this->checkUserBlock( ... )
            ];
        }
 
        $status = PermissionStatus::newEmpty();
        foreach ( $checks as $callback ) {
            $callback( $action, $user, $status, $rigor, $short, $page );
 
            if ( $short && !$status->isGood() ) {
                break;
            }
        }
 
        // Clone the status to prevent users of this hook from modifying the original
        $this->hookRunner->onPermissionStatusAudit( $page, $user, $action, $rigor, clone $status );
 
        return $status;
    }
 
    private function checkPermissionHooks(
        $action,
        User $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove when LinkTarget usage will expand further
        $title = Title::newFromLinkTarget( $page );
        // Use getUserPermissionsErrors instead
        $result = '';
        if ( !$this->hookRunner->onUserCan( $title, $user, $action, $result ) ) {
            if ( !$result ) {
                $status->fatal( 'badaccess-group0' );
            }
            return;
        }
        // Check getUserPermissionsErrors hook
        if ( !$this->hookRunner->onGetUserPermissionsErrors( $title, $user, $action, $result ) ) {
            $this->resultToStatus( $status, $result );
        }
        // Check getUserPermissionsErrorsExpensive hook
        if (
            $rigor !== self::RIGOR_QUICK
            && !( $short && !$status->isGood() )
            && !$this->hookRunner->onGetUserPermissionsErrorsExpensive(
                $title, $user, $action, $result )
        ) {
            $this->resultToStatus( $status, $result );
        }
    }
 
    private function resultToStatus( PermissionStatus $status, $result ): void {
        if ( is_array( $result ) && count( $result ) && !is_array( $result[0] ) ) {
            // A single array representing an error
            $status->fatal( ...$result );
        } elseif ( is_array( $result ) && count( $result ) && is_array( $result[0] ) ) {
            // A nested array representing multiple errors
            foreach ( $result as $result1 ) {
                $this->resultToStatus( $status, $result1 );
            }
        } elseif ( is_string( $result ) && $result !== '' ) {
            // A string representing a message-id
            $status->fatal( $result );
        } elseif ( $result instanceof MessageSpecifier ) {
            // A message specifier representing an error
            $status->fatal( $result );
        } elseif ( $result === false ) {
            // a generic "We don't want them to do that"
            $status->fatal( 'badaccess-group0' );
        }
        // If we got here, $results is the empty array or empty string, which mean no errors.
    }
 
    private function checkReadPermissions(
        $action,
        User $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove when LinkTarget usage will expand further
        $title = Title::newFromLinkTarget( $page );
 
        $whiteListRead = $this->options->get( MainConfigNames::WhitelistRead );
        $allowed = false;
        if ( $this->isEveryoneAllowed( 'read' ) ) {
            // Shortcut for public wikis, allows skipping quite a bit of code
            $allowed = true;
        } elseif ( $this->userHasRight( $user, 'read' ) ) {
            // If the user is allowed to read pages, they are allowed to read all pages
            $allowed = true;
        } elseif ( $this->isSameSpecialPage( 'Userlogin', $page )
            || $this->isSameSpecialPage( 'PasswordReset', $page )
            || $this->isSameSpecialPage( 'Userlogout', $page )
        ) {
            // Always grant access to the login page.
            // Even anons need to be able to log in.
            $allowed = true;
        } elseif ( $this->isSameSpecialPage( 'RunJobs', $page ) ) {
            // relies on HMAC key signature alone
            $allowed = true;
        } elseif ( is_array( $whiteListRead ) && count( $whiteListRead ) ) {
            // Time to check the whitelist
            // Only do these checks if there's something to check against
            $name = $title->getPrefixedText();
            $dbName = $title->getPrefixedDBkey();
 
            // Check for explicit whitelisting with and without underscores
            if ( in_array( $name, $whiteListRead, true )
                || in_array( $dbName, $whiteListRead, true )
            ) {
                $allowed = true;
            } elseif ( $page->getNamespace() === NS_MAIN ) {
                // Old settings might have the title prefixed with
                // a colon for main-namespace pages
                if ( in_array( ':' . $name, $whiteListRead ) ) {
                    $allowed = true;
                }
            } elseif ( $title->isSpecialPage() ) {
                // If it's a special page, ditch the subpage bit and check again
                $name = $title->getDBkey();
                [ $name, /* $subpage */ ] =
                    $this->specialPageFactory->resolveAlias( $name );
                if ( $name ) {
                    $pure = SpecialPage::getTitleFor( $name )->getPrefixedText();
                    if ( in_array( $pure, $whiteListRead, true ) ) {
                        $allowed = true;
                    }
                }
            }
        }
 
        $whitelistReadRegexp = $this->options->get( MainConfigNames::WhitelistReadRegexp );
        if ( !$allowed && is_array( $whitelistReadRegexp )
            && $whitelistReadRegexp
        ) {
            $name = $title->getPrefixedText();
            // Check for regex whitelisting
            foreach ( $whitelistReadRegexp as $listItem ) {
                if ( preg_match( $listItem, $name ) ) {
                    $allowed = true;
                    break;
                }
            }
        }
 
        if ( !$allowed ) {
            // If the title is not allowed, give extensions a chance to do so
            $this->hookRunner->onTitleReadWhitelist( $title, $user, $allowed );
            if ( !$allowed ) {
                $this->missingPermissionError( $action, $short, $status );
            }
        }
    }
 
    private function missingPermissionError( string $action, bool $short, PermissionStatus $status ): void {
        // We avoid expensive display logic for quickUserCan's and such
        if ( $short ) {
            $status->fatal( 'badaccess-group0' );
            return;
        }
 
        // TODO: it would be a good idea to replace the method below with something else like
        // maybe callback injection
        $context = RequestContext::getMain();
        $fatalStatus = $this->newFatalPermissionDeniedStatus( $action, $context );
        $status->merge( $fatalStatus );
    }
 
    public function newFatalPermissionDeniedStatus( $permission, IContextSource $context ): StatusValue {
        $groupsWithPermission = $this->groupPermissionsLookup->getGroupsWithPermission( $permission );
        if ( !$groupsWithPermission ) {
            // Nobody has the right
            $status = PermissionStatus::newFatal( 'badaccess-group0' );
            $status->setPermission( $permission );
            return $status;
        }
 
        $groupLinks = array_map(
            static fn ( $group ) => UserGroupMembership::getLinkWiki( $group, $context ),
            $groupsWithPermission
        );
 
        $userDisabledGroups = $this->userGroupManager->getUserDisabledGroups( $context->getUser() );
        $disabledGroupsWithPermission = array_intersect( $groupsWithPermission, $userDisabledGroups );
        if ( $disabledGroupsWithPermission !== [] ) {
            // One of the groups you are in has the right, however you don't
            // meet the restrictions to be in that group
            $disabledGroupsWithPermissionNames = array_map(
                static fn ( $group ) => $context->getLanguage()->getGroupName( $group ),
                $disabledGroupsWithPermission
            );
            $status = PermissionStatus::newFatal(
                'badaccess-groups-disabled',
                Message::listParam( $groupLinks, ListType::COMMA ),
                count( $groupLinks ),
                Message::listParam( $disabledGroupsWithPermissionNames, ListType::COMMA ),
                count( $disabledGroupsWithPermissionNames )
            );
            $status->setPermission( $permission );
            return $status;
        }
 
        $user = $context->getUser();
        $userGroups = $this->userGroupManager->getUserEffectiveGroups( $user );
        if ( array_intersect( $userGroups, $groupsWithPermission ) ) {
            // You are in a group that should have this right, but don't for some reason
            // and we don't know why.
            // (Possible causes of this include $wgRevokePermissions or an extension hook
            // that modiied the permission structure)
            $status = PermissionStatus::newFatal( 'badaccess-group0' );
            $status->setPermission( $permission );
            return $status;
        }
        // You aren't in any groups that have this right (this is the most commn case)
        $status = PermissionStatus::newFatal(
            'badaccess-groups',
            Message::listParam( $groupLinks, ListType::COMMA ),
            count( $groupLinks )
        );
        $status->setPermission( $permission );
        return $status;
    }
 
    private function isSameSpecialPage( $name, LinkTarget $page ): bool {
        if ( $page->getNamespace() === NS_SPECIAL ) {
            [ $pageName ] = $this->specialPageFactory->resolveAlias( $page->getDBkey() );
            if ( $name === $pageName ) {
                return true;
            }
        }
        return false;
    }
 
    private function checkUserBlock(
        $action,
        User $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        $block = $this->getApplicableBlock(
            $action,
            $user,
            $rigor,
            $page,
            $user->getRequest()
        );
 
        if ( $block ) {
            $status->setBlock( $block );
 
            // @todo FIXME: Pass the relevant context into this function.
            $context = RequestContext::getMain();
            $messages = $this->blockErrorFormatter->getMessages(
                $block,
                $user,
                $context->getRequest()->getIP()
            );
 
            foreach ( $messages as $message ) {
                $status->fatal( $message );
            }
        }
    }
 
    public function getApplicableBlock(
        string $action,
        User $user,
        string $rigor,
        $page,
        ?WebRequest $request
    ): ?Block {
        // Unblocking handled in SpecialUnblock
        if ( $rigor === self::RIGOR_QUICK || in_array( $action, [ 'unblock' ] ) ) {
            return null;
        }
 
        // Optimize for a very common case
        if ( $action === 'read' && !$this->options->get( MainConfigNames::BlockDisablesLogin ) ) {
            return null;
        }
 
        // Implicit rights aren't blockable (T350117, T350202).
        if ( in_array( $action, $this->getImplicitRights(), true ) ) {
            return null;
        }
 
        $useReplica = $rigor !== self::RIGOR_SECURE;
        $isExempt = $this->userHasRight( $user, 'ipblock-exempt' );
        $requestIfNotExempt = $isExempt ? null : $request;
 
        // Create account blocks are implemented separately due to weird IP exemption rules
        if ( in_array( $action, [ 'createaccount', 'autocreateaccount' ], true ) ) {
            return $this->blockManager->getCreateAccountBlock(
                $user,
                $requestIfNotExempt,
                $useReplica
            );
        }
 
        $block = $this->blockManager->getBlock( $user, $requestIfNotExempt, $useReplica );
        if ( !$block ) {
            return null;
        }
        $userIsHidden = $block->getHideName();
 
        // Remove elements from the block that explicitly allow the action
        // (like "read" or "upload").
        $block = $this->blockManager->filter(
            $block,
            static function ( AbstractBlock $originalBlock ) use ( $action ) {
                // Remove the block if it explicitly allows the action
                return $originalBlock->appliesToRight( $action ) !== false;
            }
        );
        if ( !$block ) {
            return null;
        }
 
        // Convert the input page to a Title
        $targetTitle = null;
        if ( $page ) {
            $targetTitle = $page instanceof PageReference ?
                Title::castFromPageReference( $page ) :
                Title::castFromLinkTarget( $page );
 
            if ( !$targetTitle->canExist() ) {
                $targetTitle = null;
            }
        }
 
        // What gets passed into this method is a user right, not an action name.
        // There is no way to instantiate an action by restriction. However, this
        // will get the action where the restriction is the same. This may result
        // in actions being blocked that shouldn't be.
        $actionInfo = $this->actionFactory->getActionInfo( $action, $targetTitle );
 
        // Ensure that the retrieved action matches the restriction.
        if ( $actionInfo && $actionInfo->getRestriction() !== $action ) {
            $actionInfo = null;
        }
 
        // Return null if the action does not require an unblocked user.
        // If no ActionInfo is returned, assume that the action requires unblock
        // which is the default.
        // NOTE: We may get null here even for known actions, if a wiki's main page
        // is set to a special page, e.g. Special:MyLanguage/Main_Page (T348451, T346036).
        if ( $actionInfo && !$actionInfo->requiresUnblock() ) {
            return null;
        }
 
        // Remove elements from the block that do not apply to the specific page
        if ( $targetTitle ) {
            $targetIsUserTalk = !$userIsHidden && $targetTitle->equals( $user->getTalkPage() );
            $block = $this->blockManager->filter(
                $block,
                static function ( AbstractBlock $originalBlock )
                use ( $action, $targetTitle, $targetIsUserTalk ) {
                    if ( $originalBlock->appliesToRight( $action ) ) {
                        // An action block takes precedence over appliesToTitle().
                        // Block::appliesToRight('edit') always returns null,
                        // allowing title-based exemptions to take effect.
                        return true;
                    } elseif ( $targetIsUserTalk ) {
                        // Special handling for a user's own talk page. The block is not aware
                        // of the user, so this must be done here.
                        return $originalBlock->appliesToUsertalk( $targetTitle );
                    } else {
                        return $originalBlock->appliesToTitle( $targetTitle );
                    }
                }
            );
        }
 
        if ( $targetTitle && $block instanceof AbstractBlock ) {
            // Allow extensions to let a blocked user access a particular page
            $allowUsertalk = $block->isUsertalkEditAllowed();
            $blocked = true;
            $this->hookRunner->onUserIsBlockedFrom( $user, $targetTitle, $blocked, $allowUsertalk );
            if ( !$blocked ) {
                $block = null;
            }
        }
        return $block;
    }
 
    private function checkQuickPermissions(
        $action,
        User $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove when LinkTarget usage will expand further
        $title = Title::newFromLinkTarget( $page );
 
        // This method is always called first, so $status is guaranteed to be empty, so we can
        // just pass an empty $errors array, instead of converting it to the legacy format and back.
        $errors = [];
        if ( !$this->hookRunner->onTitleQuickPermissions( $title, $user, $action,
            $errors, $rigor !== self::RIGOR_QUICK, $short )
        ) {
            // $errors is an array of results, not a result, but resultToStatus() handles
            // arrays of arrays with recursion so this will work
            $this->resultToStatus( $status, $errors );
            return;
        }
 
        $isSubPage =
            $this->nsInfo->hasSubpages( $title->getNamespace() ) &&
            str_contains( $title->getText(), '/' );
 
        if ( $action === 'create' ) {
            $right = $this->nsInfo->isTalk( $title->getNamespace() ) ? 'createtalk' : 'createpage';
            $errorMsgKey = $user->isNamed() ? 'nocreate-loggedin' : 'nocreatetext';
            $this->mergeUserRightStatus( $status, $user, $right, $rigor, !$short, $errorMsgKey );
        } elseif ( $action === 'move' ) {
            if ( $title->getNamespace() === NS_USER && !$isSubPage ) {
                $this->mergeUserRightStatus( $status, $user, 'move-rootuserpages', $rigor, !$short,
                    'cant-move-user-page' );
            }
 
            // Check if user is allowed to move files if it's a file
            if ( $title->getNamespace() === NS_FILE ) {
                $this->mergeUserRightStatus( $status, $user, 'movefile', $rigor, !$short, 'movenotallowedfile' );
            }
 
            // Check if user is allowed to move category pages if it's a category page
            if ( $title->getNamespace() === NS_CATEGORY ) {
                $this->mergeUserRightStatus( $status, $user, 'move-categorypages', $rigor, !$short,
                    'cant-move-category-page' );
            }
 
            $moveStatus = $this->getUserRightStatus( $user, 'move', $rigor, !$short );
            if ( !$moveStatus->isOK() ) {
                // User can't move anything
                $userCanMove = $this->groupPermissionsLookup
                    ->groupHasPermission( 'user', 'move' );
                $autoconfirmedCanMove = $this->groupPermissionsLookup
                    ->groupHasPermission( 'autoconfirmed', 'move' );
                if ( $user->isAnon()
                    && ( $userCanMove || $autoconfirmedCanMove )
                ) {
                    // custom message if logged-in users without any special rights can move
                    $status->fatal( 'movenologintext' );
                } elseif ( $user->isTemp() && $autoconfirmedCanMove ) {
                    // Temp user may be able to move if they log in as a proper account
                    $status->fatal( 'movenologintext' );
                } else {
                    $status->fatal( 'movenotallowed' );
                }
                if ( !$short ) {
                    $status->merge( $moveStatus );
                }
            }
        } elseif ( $action === 'move-target' ) {
            if ( !$this->mergeUserRightStatus( $status, $user, 'move', $rigor, !$short, 'movenotallowed' ) ) {
                // User can't move anything, don't check the conditions below
            } elseif ( $title->getNamespace() === NS_USER && !$isSubPage ) {
                // Show user page-specific message only if the user can move other pages
                $this->mergeUserRightStatus( $status, $user, 'move-rootuserpages', $rigor, !$short,
                    'cant-move-to-user-page' );
            } elseif ( $title->getNamespace() === NS_CATEGORY ) {
                // Show category page-specific message only if the user can move other pages
                $this->mergeUserRightStatus( $status, $user, 'move-categorypages', $rigor, !$short,
                    'cant-move-to-category-page' );
            }
        } elseif ( $action === 'autocreateaccount' ) {
            // createaccount implies autocreateaccount
            $this->mergeUserRightStatus( $status, $user, [ 'autocreateaccount', 'createaccount' ], $rigor, !$short );
        } else {
            $this->mergeUserRightStatus( $status, $user, $action, $rigor, !$short );
        }
    }
 
    private function checkPageRestrictions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
        foreach ( $this->restrictionStore->getRestrictions( $title, $action ) as $level ) {
            // Messages: restriction-level-sysop, restriction-level-autoconfirmed
            $levelMsg = MessageValue::new( "restriction-level-$level" );
 
            $right = $level;
            // Backwards compatibility, rewrite sysop -> editprotected
            if ( $right === 'sysop' ) {
                $right = 'editprotected';
            }
            // Backwards compatibility, rewrite autoconfirmed -> editsemiprotected
            if ( $right === 'autoconfirmed' ) {
                $right = 'editsemiprotected';
            }
            if ( $right == '' ) {
                continue;
            }
            if ( !$this->userHasRight( $user, $right ) ) {
                // The parameters are not used by the default message text,
                // but they're available to be used in on-wiki overrides
                $status->fatal( 'protectedpagetext', $right, $action, $levelMsg );
            } elseif ( $this->restrictionStore->areRestrictionsCascading( $title ) &&
                !$this->userHasRight( $user, 'protect' )
            ) {
                // The parameters are not used by the default message text,
                // but they're available to be used in on-wiki overrides
                $status->fatal( 'protectedpagetext', 'protect', $action, $levelMsg );
            }
        }
    }
 
    private function checkCascadingSourcesRestrictions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        if ( $rigor !== self::RIGOR_QUICK && !$title->isUserConfigPage() ) {
            [ $sources, $restrictions, $tlSources, $ilSources ] = $this->restrictionStore
                ->getCascadeProtectionSources( $title );
 
            // If the file Wikitext isn't transcluded then we
            // don't care about edit cascade restrictions for edit action
            if ( $action === 'edit' && $page->getNamespace() === NS_FILE && !$tlSources ) {
                return;
            }
 
            // For the purposes of cascading protection, edit restrictions should apply to uploads or moves
            // Thus remap upload and move to edit
            // Unless the file content itself is not transcluded
            if ( $ilSources && ( $action === 'upload' || $action === 'move' ) ) {
                $restrictedAction = 'edit';
            } else {
                $restrictedAction = $action;
            }
 
            // Cascading protection depends on more than this page...
            // Several cascading protected pages may include this page...
            // Check each cascading level
            // This is only for protection restrictions, not for all actions
            if ( isset( $restrictions[$restrictedAction] ) ) {
                foreach ( $restrictions[$restrictedAction] as $right ) {
                    // Backwards compatibility, rewrite sysop -> editprotected
                    if ( $right === 'sysop' ) {
                        $right = 'editprotected';
                    }
                    // Backwards compatibility, rewrite autoconfirmed -> editsemiprotected
                    if ( $right === 'autoconfirmed' ) {
                        $right = 'editsemiprotected';
                    }
                    if ( $right != '' && !$this->userHasAllRights( $user, 'protect', $right ) ) {
                        $wikiPages = '';
                        foreach ( $sources as $pageIdentity ) {
                            $wikiPages .= '* [[:' . $this->titleFormatter->getPrefixedText( $pageIdentity ) . "]]\n";
                        }
                        $status->fatal( 'cascadeprotected', count( $sources ), $wikiPages, $action );
                    }
                }
            }
        }
    }
 
    private function checkActionPermissions(
        $action,
        User $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        if ( $rigor !== self::RIGOR_QUICK && !defined( 'MW_NO_SESSION' ) ) {
            $sessionRestrictions = $user->getRequest()->getSession()->getRestrictions();
            if ( $sessionRestrictions ) {
                $userCan = $sessionRestrictions->userCan( $title );
                if ( !$userCan->isOK() ) {
                    $status->merge( $userCan );
                }
            }
        }
 
        if ( $action === 'protect' ) {
            if ( !$this->getPermissionStatus( 'edit', $user, $title, $rigor, true )->isGood() ) {
                // If they can't edit, they shouldn't protect.
                $status->fatal( 'protect-cantedit' );
            }
        } elseif ( $action === 'create' ) {
            $createProtection = $this->restrictionStore->getCreateProtection( $title );
            if ( $createProtection ) {
                if ( $createProtection['permission'] == ''
                    || !$this->userHasRight( $user, $createProtection['permission'] )
                ) {
                    $protectUserIdentity = $this->userIdentityLookup
                        ->getUserIdentityByUserId( $createProtection['user'] );
                    $status->fatal(
                        'titleprotected',
                        $protectUserIdentity ? $protectUserIdentity->getName() : '',
                        $createProtection['reason']
                    );
                }
            }
        } elseif ( $action === 'move' ) {
            // Check for immobile pages
            if ( !$this->nsInfo->isMovable( $title->getNamespace() ) ) {
                // Specific message for this case
                $nsText = $title->getNsText();
                if ( $nsText === '' ) {
                    $nsText = wfMessage( 'blanknamespace' )->text();
                }
                $status->fatal( 'immobile-source-namespace', $nsText );
            } elseif ( !$title->isMovable() ) {
                // Less specific message for rarer cases
                $status->fatal( 'immobile-source-page' );
            }
        } elseif ( $action === 'move-target' ) {
            if ( !$this->nsInfo->isMovable( $title->getNamespace() ) ) {
                $nsText = $title->getNsText();
                if ( $nsText === '' ) {
                    $nsText = wfMessage( 'blanknamespace' )->text();
                }
                $status->fatal( 'immobile-target-namespace', $nsText );
            } elseif ( !$title->isMovable() ) {
                $status->fatal( 'immobile-target-page' );
            }
        } elseif ( $action === 'delete' || $action === 'delete-redirect' ) {
            $tempStatus = PermissionStatus::newEmpty();
            $this->checkPageRestrictions( 'edit', $user, $tempStatus, $rigor, true, $title );
            if ( $tempStatus->isGood() ) {
                $this->checkCascadingSourcesRestrictions( 'edit',
                    $user, $tempStatus, $rigor, true, $title );
            }
            if ( !$tempStatus->isGood() ) {
                // If protection keeps them from editing, they shouldn't be able to delete.
                $status->fatal( 'deleteprotected' );
            }
            if ( $rigor !== self::RIGOR_QUICK
                && $action === 'delete'
                && $this->options->get( MainConfigNames::DeleteRevisionsLimit )
                && !$this->userCan( 'bigdelete', $user, $title )
                && $title->isBigDeletion()
            ) {
                // NOTE: This check is deprecated since 1.37, see T288759
                $status->fatal(
                    'delete-toobig',
                    Message::numParam( $this->options->get( MainConfigNames::DeleteRevisionsLimit ) )
                );
            }
        } elseif ( $action === 'undelete' ) {
            if ( !$this->getPermissionStatus( 'edit', $user, $title, $rigor, true )->isGood() ) {
                // Undeleting implies editing
                $status->fatal( 'undelete-cantedit' );
            }
            if ( !$title->exists()
                && !$this->getPermissionStatus( 'create', $user, $title, $rigor, true )->isGood()
            ) {
                // Undeleting where nothing currently exists implies creating
                $status->fatal( 'undelete-cantcreate' );
            }
        } elseif ( $action === 'edit' ) {
            if ( $this->options->get( MainConfigNames::EmailConfirmToEdit )
                && !$user->isEmailConfirmed()
            ) {
                $status->fatal( 'confirmedittext' );
            }
 
            if ( !$title->exists() ) {
                $status->merge(
                    $this->getPermissionStatus( 'create', $user, $title, $rigor, $short )
                );
            }
        }
    }
 
    private function checkSpecialsAndNSPermissions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        // Only 'createaccount' can be performed on special pages,
        // which don't actually exist in the DB.
        if ( $title->getNamespace() === NS_SPECIAL
            && !in_array( $action, [ 'createaccount', 'autocreateaccount' ], true )
        ) {
            $status->fatal( 'ns-specialprotected' );
        }
 
        // Check $wgNamespaceProtection for restricted namespaces
        if ( $this->isNamespaceProtected( $title->getNamespace(), $user )
            // Allow admins and oversighters to view deleted content, even if they
            // cannot restore it. See T362536. Allow (un)watch too (T373758)
            && !in_array( $action, [ 'deletedhistory', 'deletedtext', 'viewsuppressed', 'editmywatchlist' ], true )
        ) {
            $ns = $title->getNamespace() === NS_MAIN ?
                wfMessage( 'nstab-main' )->text() : $title->getNsText();
            if ( $title->getNamespace() === NS_MEDIAWIKI ) {
                $status->fatal( 'protectedinterface', $action );
            } else {
                $status->fatal( 'namespaceprotected', $ns, $action );
            }
        }
    }
 
    private function checkSiteConfigPermissions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        if ( $action === 'patrol' || $action === 'editmywatchlist' ) {
            return;
        }
 
        if ( in_array( $action, [ 'deletedhistory', 'deletedtext', 'viewsuppressed' ], true ) ) {
            // Allow admins and oversighters to view deleted content, even if they
            // cannot restore it. See T202989
            // Not using the same handling in `getPermissionStatus` as the checks
            // for skipping `checkUserConfigPermissions` since normal admins can delete
            // user scripts, but not sitewide scripts
            return;
        }
 
        // Sitewide CSS/JSON/JS/RawHTML changes, like all NS_MEDIAWIKI changes, also require the
        // editinterface right. That's implemented as a restriction so no check needed here.
        if ( $title->isSiteCssConfigPage() ) {
            $this->mergeUserRightStatus( $status, $user, 'editsitecss', $rigor, !$short,
                'sitecssprotected', $action );
        } elseif ( $title->isSiteJsonConfigPage() ) {
            $this->mergeUserRightStatus( $status, $user, 'editsitejson', $rigor, !$short,
                'sitejsonprotected', $action );
        } elseif ( $title->isSiteJsConfigPage() ) {
            $this->mergeUserRightStatus( $status, $user, 'editsitejs', $rigor, !$short,
                'sitejsprotected', $action );
        } elseif ( $title->isRawHtmlMessage() ) {
            // Editing raw HTML messages requires both editsitejs AND editsitecss
            if (
                $this->mergeUserRightStatus( $status, $user, 'editsitejs', $rigor, !$short,
                    'siterawhtmlprotected', $action )
            ) {
                $this->mergeUserRightStatus( $status, $user, 'editsitecss', $rigor, !$short,
                    'siterawhtmlprotected', $action );
            }
        }
    }
 
    private function checkUserPageEditPermissions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        if ( !$this->options->get( MainConfigNames::RestrictUserPageEditing ) ) {
            return;
        }
 
        if ( !in_array( $action, [ 'edit', 'move', 'move-target' ], true ) ) {
            return;
        }
 
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        if (
            $title->getNamespace() === NS_USER
            && $title->getRootText() !== $user->getName()
            && !$this->userHasRight( $user, 'editalluserpages' )
        ) {
            $this->missingPermissionError( 'editalluserpages', $short, $status );
        }
    }
 
    private function checkUserConfigPermissions(
        $action,
        UserIdentity $user,
        PermissionStatus $status,
        $rigor,
        $short,
        LinkTarget $page
    ): void {
        // TODO: remove & rework upon further use of LinkTarget
        $title = Title::newFromLinkTarget( $page );
 
        // Protect css/json/js subpages of user pages
        // XXX: this might be better using restrictions
        if ( preg_match( '/^' . preg_quote( $user->getName(), '/' ) . '\//', $title->getText() ) ) {
            // Users need editmyuser* to edit their own CSS/JSON/JS subpages.
            if ( $title->isUserCssConfigPage() ) {
                $this->mergeUserRightStatus( $status, $user, [ 'editmyusercss', 'editusercss' ], $rigor, !$short,
                    'mycustomcssprotected', $action );
            } elseif ( $title->isUserJsonConfigPage() ) {
                $this->mergeUserRightStatus( $status, $user, [ 'editmyuserjson', 'edituserjson' ], $rigor, !$short,
                    'mycustomjsonprotected', $action );
            } elseif ( $title->isUserJsConfigPage() ) {
                if (
                    $this->mergeUserRightStatus( $status, $user, [ 'editmyuserjs', 'edituserjs' ], $rigor, !$short,
                        'mycustomjsprotected', $action )
                ) {
                    // T207750 - do not allow users to edit a redirect if they couldn't edit the target
                    $target = $this->redirectLookup->getRedirectTarget( $title );
                    if ( $target && (
                            !$target->inNamespace( NS_USER )
                            || !preg_match( '/^' . preg_quote( $user->getName(), '/' ) . '\//', $target->getText() )
                    ) ) {
                        // The target is not a user JS page belonging to the same user
                        // Only allow editing if the user has either editmyuserjsredirect or edituserjs
                        $this->mergeUserRightStatus( $status, $user, [ 'editmyuserjsredirect', 'edituserjs' ],
                            $rigor, !$short, 'mycustomjsredirectprotected', $action );
                    }
                }
            }
        } else {
            // Users need edituser* to edit others' CSS/JSON/JS subpages.
            // The checks to exclude deletion/suppression, which cannot be used for
            // attacks and should be excluded to avoid the situation where an
            // unprivileged user can post abusive content on their subpages
            // and only very highly privileged users could remove it,
            // are now a part of `getPermissionStatus` and this method isn't called.
            if ( $title->isUserCssConfigPage() ) {
                $this->mergeUserRightStatus( $status, $user, 'editusercss', $rigor, !$short,
                    'customcssprotected', $action );
            } elseif ( $title->isUserJsonConfigPage() ) {
                $this->mergeUserRightStatus( $status, $user, 'edituserjson', $rigor, !$short,
                    'customjsonprotected', $action );
            } elseif ( $title->isUserJsConfigPage() ) {
                $this->mergeUserRightStatus( $status, $user, 'edituserjs', $rigor, !$short,
                    'customjsprotected', $action );
            }
        }
    }
 
    public function getUserRightStatus(
        UserIdentity $user,
        string $right,
        string $rigor = self::RIGOR_SECURE,
        bool $detailedPermissionErrors = true,
    ): PermissionStatus {
        $status = PermissionStatus::newEmpty();
 
        // For compatibility with userHasRight(), allow the empty action
        if ( $right === '' ) {
            return $status;
        }
 
        // Use strict parameter to avoid matching numeric 0 accidentally inserted
        // by misconfiguration: 0 == 'foo'
        if (
            !in_array( $right, $this->getImplicitRights(), true )
            && !in_array( $right, $this->getUserPermissions( $user ), true )
        ) {
            $this->missingPermissionError( $right, !$detailedPermissionErrors, $status );
            return $status;
        }
 
        // Deny actions that require reauthentication if the user hasn't recently reauthenticated
        $operation = $this->options->get( MainConfigNames::ReauthenticateForActions )[ $right ] ?? false;
        if ( $operation !== false ) {
            // securitySensitiveOperationStatus() can only check for the currently logged-in user
            // If $user is not that user, we can't check whether they've reauthenticated, so behave
            // as if they haven't.
            // FIXME move securitySensitiveOperationStatus to Session or SessionBackend, so that we
            // can use it here. We can't dependency-inject AuthManager because of a circular dependency.
            $authManager = MediaWikiServices::getInstance()->getAuthManager();
            $reauth = $authManager->getRequest()->getSession()->getUser()->equals( $user ) ?
                $authManager->securitySensitiveOperationStatus( $operation ) :
                AuthManager::SEC_FAIL;
 
            if ( $reauth === AuthManager::SEC_REAUTH ) {
                $status->setReauthOperation( $operation );
                if ( $rigor === self::RIGOR_SECURE ) {
                    $context = RequestContext::getMain();
                    $title = $context->getTitle();
                    $returnToParams = $title !== null
                        ? SkinComponentUtils::getReturnToParam(
                            $title,
                            $context->getRequest(),
                            $context->getAuthority()
                        )
                        : [];
                    $loginUrl = SpecialPage::getSafeTitleFor( 'Userlogin' )
                        ?->getFullURL( [ 'force' => $operation ] + $returnToParams );
                    // The operation is passed as $1 for compatibility with older translations
                    // that still use it inside a {{fullurl:...}} to build the login link. New
                    // translations should use $2 (the full URL) directly.
                    $status->fatal( ApiMessage::create(
                        [ 'badaccess-reauthenticate', $operation, $loginUrl ],
                        'reauthenticate',
                        [ 'operation' => $operation ]
                    ) );
                }
            } elseif ( $reauth === AuthManager::SEC_FAIL ) {
                $status->setReauthOperation( $operation );
                // If the user cannot reauthenticate, that is fatal regardless of $rigor
                $status->fatal( 'badaccess-cannotreauthenticate', $operation );
            }
        }
 
        return $status;
    }
 
    private function mergeUserRightStatus(
        PermissionStatus $status,
        UserIdentity $user,
        string|array $right,
        string $rigor = self::RIGOR_SECURE,
        bool $detailedPermissionErrors = true,
        ?string $extraError = null,
        ...$extraParams
    ): bool {
        $rightStatus = null;
        foreach ( (array)$right as $r ) {
            $rightStatus = $this->getUserRightStatus( $user, $r, $rigor, $detailedPermissionErrors );
            if ( $rightStatus->isOK() ) {
                // Success, stop here
                $status->merge( $rightStatus );
                return true;
            }
        }
 
        // If we got here, the user doesn't have any of the requested rights
        // First add $extraError, if it exists...
        if ( $extraError !== null ) {
            $status->fatal( $extraError, ...$extraParams );
        }
        // ...then merge in the last permission error. But don't combine an $extraError with a
        // non-detailed "permission denied" error
        if ( $rightStatus && ( $extraError === null || $detailedPermissionErrors ) ) {
            $status->merge( $rightStatus );
        }
        return false;
    }
 
    public function userHasRight( UserIdentity $user, $action = '' ): bool {
        if ( $action === '' ) {
            // In the spirit of DWIM
            return true;
        }
 
        return $this->getUserRightStatus( $user, $action, self::RIGOR_SECURE, false )->isOK();
    }
 
    public function userHasAnyRight( UserIdentity $user, ...$actions ): bool {
        foreach ( $actions as $action ) {
            if ( $this->userHasRight( $user, $action ) ) {
                return true;
            }
        }
        return false;
    }
 
    public function userHasAllRights( UserIdentity $user, ...$actions ): bool {
        foreach ( $actions as $action ) {
            if ( !$this->userHasRight( $user, $action ) ) {
                return false;
            }
        }
        return true;
    }
 
    public function getUserPermissions( UserIdentity $user, bool $includePrivateInfo = true ): array {
        $rightsCacheKey = $this->getRightsCacheKey( $user, $includePrivateInfo );
        if ( !isset( $this->usersRights[ $rightsCacheKey ] ) ) {
            $userObj = $this->userFactory->newFromUserIdentity( $user );
            $effectiveGroups = $this->userGroupManager->getUserEffectiveGroups(
                $user, IDBAccessObject::READ_NORMAL, false, $includePrivateInfo );
            $rights = $this->groupPermissionsLookup->getGroupPermissions( $effectiveGroups );
            // Hook requires a full User object
            $this->hookRunner->onUserGetRights( $userObj, $rights );
 
            // Deny any rights denied by the user's session, unless this
            // endpoint has no sessions.
            if ( !defined( 'MW_NO_SESSION' ) ) {
                // FIXME: $userObj->getRequest().. need to be replaced with something else
                $allowedRights = $userObj->getRequest()->getSession()->getAllowedUserRights();
                if ( $allowedRights !== null ) {
                    $rights = array_intersect( $rights, $allowedRights );
                }
            }
 
            // Hook requires a full User object
            $this->hookRunner->onUserGetRightsRemove( $userObj, $rights );
            // Force reindexation of rights when a hook has unset one of them
            $rights = array_values( array_unique( $rights ) );
 
            // If BlockDisablesLogin is true, remove rights that anonymous
            // users don't have. This has to be done after the hooks so that
            // we know whether the user is exempt. (T129738)
            if (
                $userObj->isRegistered()
                && $this->options->get( MainConfigNames::BlockDisablesLogin )
            ) {
                // Stash the permissions as they are before triggering any block checks for BlockDisablesLogin
                // to avoid a potential infinite loop, since GetUserBlock handlers may themselves check
                // permissions on this user. (T384197)
                $this->usersRights[ $rightsCacheKey ] = $rights;
 
                $isExempt = in_array( 'ipblock-exempt', $rights, true );
                if ( $this->blockManager->getBlock(
                    $userObj,
                    $isExempt ? null : $userObj->getRequest()
                ) ) {
                    $anon = $this->userFactory->newAnonymous();
                    $rights = array_intersect( $rights, $this->getUserPermissions( $anon ) );
                }
            }
 
            $this->usersRights[ $rightsCacheKey ] = $rights;
        } else {
            $rights = $this->usersRights[ $rightsCacheKey ];
        }
        foreach ( $this->temporaryUserRights[ $user->getId() ] ?? [] as $overrides ) {
            $rights = array_values( array_unique( array_merge( $rights, $overrides ) ) );
        }
        return $rights;
    }
 
    public function invalidateUsersRightsCache( $user = null ): void {
        if ( $user !== null ) {
            $rightsCacheKey = $this->getRightsCacheKey( $user, false );
            unset( $this->usersRights[ $rightsCacheKey ] );
            $rightsCacheKey = $this->getRightsCacheKey( $user, true );
            unset( $this->usersRights[ $rightsCacheKey ] );
        } else {
            $this->usersRights = [];
        }
    }
 
    private function getRightsCacheKey( UserIdentity $user, bool $includePrivateInfo ): string {
        $key = $user->isRegistered() ? "u:{$user->getId()}" : "anon:{$user->getName()}";
        if ( $includePrivateInfo ) {
            $key .= ':private';
        }
        return $key;
    }
 
    public function isEveryoneAllowed( $right ): bool {
        // Use the cached results, except in unit tests which rely on
        // being able change the permission mid-request
        if ( isset( $this->cachedRights[$right] ) ) {
            return $this->cachedRights[$right];
        }
 
        if ( !isset( $this->options->get( MainConfigNames::GroupPermissions )['*'][$right] )
            || !$this->options->get( MainConfigNames::GroupPermissions )['*'][$right]
        ) {
            $this->cachedRights[$right] = false;
            return false;
        }
 
        // If it's revoked anywhere, then everyone doesn't have it
        foreach ( $this->options->get( MainConfigNames::RevokePermissions ) as $rights ) {
            if ( isset( $rights[$right] ) && $rights[$right] ) {
                $this->cachedRights[$right] = false;
                return false;
            }
        }
 
        // Remove any rights that aren't allowed to the global-session user,
        // unless there are no sessions for this endpoint.
        if ( !defined( 'MW_NO_SESSION' ) ) {
            // XXX: think what could be done with the below
            $allowedRights = RequestContext::getMain()->getRequest()->getSession()->getAllowedUserRights();
            if ( $allowedRights !== null && !in_array( $right, $allowedRights, true ) ) {
                $this->cachedRights[$right] = false;
                return false;
            }
        }
 
        // Allow extensions to say false
        if ( !$this->hookRunner->onUserIsEveryoneAllowed( $right ) ) {
            $this->cachedRights[$right] = false;
            return false;
        }
 
        $this->cachedRights[$right] = true;
        return true;
    }
 
    public function getAllPermissions(): array {
        if ( $this->allRights === null ) {
            if ( count( $this->options->get( MainConfigNames::AvailableRights ) ) ) {
                $this->allRights = array_unique( array_merge(
                    self::CORE_RIGHTS,
                    $this->options->get( MainConfigNames::AvailableRights )
                ) );
            } else {
                $this->allRights = self::CORE_RIGHTS;
            }
            $this->hookRunner->onUserGetAllRights( $this->allRights );
        }
        return $this->allRights;
    }
 
    public function getImplicitRights(): array {
        if ( $this->implicitRights === null ) {
            $rights = array_unique( array_merge(
                self::CORE_IMPLICIT_RIGHTS,
                $this->options->get( MainConfigNames::ImplicitRights )
            ) );
 
            $this->implicitRights = array_diff( $rights, $this->getAllPermissions() );
        }
        return $this->implicitRights;
    }
 
    private function isNamespaceProtected( $index, UserIdentity $user ): bool {
        $namespaceProtection = $this->options->get( MainConfigNames::NamespaceProtection );
        if ( isset( $namespaceProtection[$index] ) ) {
            return !$this->userHasAllRights( $user, ...(array)$namespaceProtection[$index] );
        }
        return false;
    }
 
    public function getNamespaceRestrictionLevels( $index, ?UserIdentity $user = null ): array {
        if ( !isset( $this->options->get( MainConfigNames::NamespaceProtection )[$index] ) ) {
            // All levels are valid if there's no namespace restriction.
            // But still filter by user, if necessary
            $levels = $this->options->get( MainConfigNames::RestrictionLevels );
            if ( $user ) {
                $levels = array_values( array_filter( $levels, function ( $level ) use ( $user ) {
                    $right = $level;
                    if ( $right === 'sysop' ) {
                        $right = 'editprotected'; // BC
                    }
                    if ( $right === 'autoconfirmed' ) {
                        $right = 'editsemiprotected'; // BC
                    }
                    return $this->userHasRight( $user, $right );
                } ) );
            }
            return $levels;
        }
 
        // $wgNamespaceProtection can require one or more rights to edit the namespace, which
        // may be satisfied by membership in multiple groups each giving a subset of those rights.
        // A restriction level is redundant if, for any one of the namespace rights, all groups
        // giving that right also give the restriction level's right. Or, conversely, a
        // restriction level is not redundant if, for every namespace right, there's at least one
        // group giving that right without the restriction level's right.
        //
        // First, for each right, get a list of groups with that right.
        $namespaceRightGroups = [];
        foreach ( (array)$this->options->get( MainConfigNames::NamespaceProtection )[$index] as $right ) {
            if ( $right === 'sysop' ) {
                $right = 'editprotected'; // BC
            }
            if ( $right === 'autoconfirmed' ) {
                $right = 'editsemiprotected'; // BC
            }
            if ( $right != '' ) {
                $namespaceRightGroups[$right] = $this->groupPermissionsLookup->getGroupsWithPermission( $right );
            }
        }
 
        // Now, go through the protection levels one by one.
        $usableLevels = [ '' ];
        foreach ( $this->options->get( MainConfigNames::RestrictionLevels ) as $level ) {
            $right = $level;
            if ( $right === 'sysop' ) {
                $right = 'editprotected'; // BC
            }
            if ( $right === 'autoconfirmed' ) {
                $right = 'editsemiprotected'; // BC
            }
 
            if ( $right != '' &&
                !isset( $namespaceRightGroups[$right] ) &&
                ( !$user || $this->userHasRight( $user, $right ) )
            ) {
                // Do any of the namespace rights imply the restriction right? (see explanation above)
                foreach ( $namespaceRightGroups as $groups ) {
                    if ( !array_diff( $groups, $this->groupPermissionsLookup->getGroupsWithPermission( $right ) ) ) {
                        // Yes, this one does.
                        continue 2;
                    }
                }
                // No, keep the restriction level
                $usableLevels[] = $level;
            }
        }
 
        return $usableLevels;
    }
 
    #[\NoDiscard]
    public function addTemporaryUserRights( UserIdentity $user, $rights ): ScopedCallback {
        $userId = $user->getId();
        $nextKey = count( $this->temporaryUserRights[$userId] ?? [] );
        $this->temporaryUserRights[$userId][$nextKey] = (array)$rights;
        return new ScopedCallback( function () use ( $userId, $nextKey ) {
            unset( $this->temporaryUserRights[$userId][$nextKey] );
        } );
    }
 
    public function overrideUserRightsForTesting( $user, $rights = [] ) {
        if ( !defined( 'MW_PHPUNIT_TEST' ) ) {
            throw new LogicException( __METHOD__ . ' can not be called outside of tests' );
        }
        $this->usersRights[ $this->getRightsCacheKey( $user, false ) ] =
            is_array( $rights ) ? $rights : [ $rights ];
        $this->usersRights[ $this->getRightsCacheKey( $user, true ) ] =
            is_array( $rights ) ? $rights : [ $rights ];
    }
 
}