Last modified: 2012-12-13 11:21:51 UTC
Api - It looks like reading from the api is based on a generic permission, which is what the MW api does currently as well. However, we get lots of requests for the title's permissions to be checked on read, so that reading individual pages/items from the api can be controlled on a page-by-page basis (like you're doing for writes). If this is not desired for wikidata objects, please document that somewhere. Or if that granularity in permissions is desired, then it should be implemented now.
https://gerrit.wikimedia.org/r/#/c/25547/
API modules were already checking the standard "read" permission, added unit tests for that: Idb009c0d Standard checks in core seems to be sufficient to enforce the "read" permission for UI access. I have confirmed this with manual testing for normal page views, history and diffs. We could add selenium tests, but I suggest a separate item with low prio for that.
Verified in Wikidata demo time for sprint 18
