Add Django OAuth login with Pywikibot integration

[sergyDwhiz]

This pull request integrates Django Social Auth with the MediaWiki OAuth 1.0a backend, enabling users to authenticate using their Wikimedia accounts.

Changes made include:

• Integrated and configured social-auth-app-django with the MediaWiki backend.
• Added a “Login with Wikimedia” button to the top-right navigation bar (visible only when OAuth is enabled).
• Implemented a robust logout flow that fully clears user sessions.
• Introduced a helper function which retrieves OAuth tokens from Django Social Auth and supplies them to Pywikibot for authenticated bot operations.
• Added an OAUTH_ENABLED environment variable for backward compatibility — when disabled, the application retains its previous authentication behavior.
• Updated all relevant settings, URLs, views, and templates to support the new authentication flow.
• Included a comprehensive testing guide to facilitate validation of the integration.

Addresses: #117

[sergyDwhiz]

Hi @zache-fi,

The OAuth implementation is complete and tests pass, but I'm hitting 403 Forbidden errors when testing the full OAuth flow from localhost (even after registering OAuth consumers with proper callback URLs on meta.wikimedia.org).

How do you typically test OAuth locally for this project? Should I use ngrok for a public URL, test on a deployed environment, or is there another approach you recommend?

The code looks correct based on Django Social Auth docs, but I can't verify the end-to-end flow due to this localhost limitation. Everything is documented in the OAUTH_TESTING_GUIDE.md.
Please let me know your advice, Thanks.

[zache-fi]

Hi, try to register it at meta.wikimedia.beta.wmflabs.org/ and use it as endpoint. It doesn't work for superset, but I can approve ouths there so registering and finding correct value can be done trial and error.

[zache-fi]

Just FYI. I can test the correct values.

[zache-fi]

Note https://meta.wikimedia.beta.wmcloud.org doesn't use wikimedias unified login so you need to register separate account there.

Oauth consumer registration
So I used these values when i registered the Oauth consumer in https://meta.wikimedia.beta.wmcloud.org/wiki/Special:OAuthConsumerRegistration/propose

• Application name: PendingChangesBot test 2
• Consumer version: 1.0
• Application description: PendingChangesBot is FlaggedRevs automatic review bot ( https://github.com/Wikimedia- Suomi/PendingChangesBot-ng )
• This consumer is for use only by Zache-test: NOT SELECTED
• OAuth "callback" URL: http://127.0.0.1:8000/
• Allow consumer to specify a callback in requests and use "callback" URL above as a required prefix.: SELECTED
• Contact email address: MY EMAIL ADDRESS
• Applicable project: *
• Types of grants being requested: Request authorization for specific permissions.
• Applicable grants:
  • Edit existing pages
  • Create, edit, and move pages
  • Patrol changes to pages
  • Rollback changes to pages

settings.py

# MediaWiki OAuth 1.0a settings
# For development: use meta.wikimedia.org (beta is often blocked)
# For production: use meta.wikimedia.org
SOCIAL_AUTH_MEDIAWIKI_URL = "https://meta.wikimedia.beta.wmcloud.org/w/index.php"
SOCIAL_AUTH_MEDIAWIKI_KEY = "CONSUMER_TOKEN_FROM_OAUTH_REGISTRATION"
SOCIAL_AUTH_MEDIAWIKI_SECRET = "SECRET_TOKEN_FROM_OAUTH_REGISTRATION"
SOCIAL_AUTH_MEDIAWIKI_CALLBACK = "http://127.0.0.1:8000/oauth/complete/mediawiki/"

[zache-fi]

Btw is beta blocked for you?

[zache-fi]

Yes, the login works now. There could be still couple of changes.

Fix the ruff check

Add to the top of the page navigation bar (similarly than in https://wikikysely-dev.toolforge.org/en/ ) and move the login button to top right of the bar. This just to make it look nicer.

Another change would be that save the actual Wikimedia Commons username . (Reusing Djangos first_name field would be OK as we arent using it anywhere and would not require any user model customization ) This is because Django will "normalize" usernames (ie removes high-bit characters for example) before saving it to username field so it cannot be used for showing the username.

Try if you can pass the Oauth credidentials to pywikibot instance after you have logged in. If Oauth endpoint used for login is https://meta.wikimedia.beta.wmcloud.org then use commons beta also in code.

  pywikibot.config.usernames['commons']['beta']= user.username
  site = pywikibot.Site('beta', 'commons')

If you have logged in using https://meta.wikimedia.org then both values are "commons"

pywikibot.config.usernames['commons']['commons']= user.username
site = pywikibot.Site('commons', 'commons')

Here is example code

• https://wikitech.wikimedia.org/wiki/Help:Toolforge/My_first_Django_OAuth_tool#Howto_use_Pywikibot_with_Django_Oauth_credentials

Note you need login commons once so it will create a user to target wiki before this work.

[sergyDwhiz]

Hi @zache-fi! Thanks for the feedback!
I've implemented all four changes you requested: ruff checks, a top navigation bar with login in the top-right and configured Pywikibot OAuth to auto-detect beta vs production environments based on the OAuth URL.

Please let me know next steps.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[zache-fi]

check why the test is failing and fix it

[sergyDwhiz]

Thanks for catching that. I think it's a template syntax issue with Vue. Let me take a more keen look. Thanks

[xenacode-art]

Hi @sergyDwhiz! 👋

Excellent work on the OAuth integration! I've reviewed the code and tested it locally. This is a crucial
piece of infrastructure for the internship roadmap. Here's my detailed feedback:

✅ What Works Well

Architecture:

• Clean separation of OAuth logic using Django Social Auth
• Smart handling of beta vs production endpoints
• Backwards compatibility with OAUTH_ENABLED flag is great for gradual rollout

Pywikibot Integration:

• The get_pywikibot_site_with_oauth() helper function is elegant
• Automatically configuring Pywikibot from Django session tokens avoids credential duplication
• Good error handling when OAuth tokens aren't available

UI/UX:

• Login button placement in navigation makes sense
• Preserving original Wikimedia usernames in first_name is clever workaround for Django's normalization

Testing & Observations

I tested this locally with the following scenarios:

Scenario 1: OAuth Login Flow

• Login button appears when not authenticated
• Redirects to Wikimedia OAuth authorization
• Successfully returns and creates Django session
• Username displays correctly in navbar

Scenario 2: OAuth Disabled Mode

• Application works with OAUTH_ENABLED=False
• Previous authentication methods still function
• No errors in logs

Scenario 3: Pywikibot Integration

• OAuth tokens passed correctly to Pywikibot
• Bot operations work with OAuth credentials
• ⚠️ Need to verify with actual flaggedrevs operations (requires wiki with FlaggedRevs enabled)

Minor Suggestions

1. Error Messaging:
When OAuth login fails, users see a generic error. Consider adding user-friendly error messages:

# In views or middleware
except SocialAuthException as e:
    messages.error(request, "OAuth login failed. Please try again or contact support.")

2. Session Timeout:
Consider documenting the session timeout behavior. Users should know how long they stay logged in.

3. Testing Documentation:
It would be helpful to add a section in the README about:
- How to set up beta OAuth consumer for testing
- Environment variables needed
- Common troubleshooting steps


Great foundational work! 🚀




## If you need assistance with:
- Writing additional tests for edge cases
- Resolving any test failures
- Adding documentation
- Testing with production-like scenarios

I'm happy to collaborate! We could pair on this to get it across the finish line.

[sergyDwhiz]

Hi @xenacode-art, sorry for my late reply. I've been through a lot.

Thanks so much for the thorough review and testing. I appreciate you taking the time to verify everything works! Your suggestions about error messaging, session timeout documentation and testing are true. I've been working on a fix for the template syntax conflicts that came back after the merge. Pushing it soon.
Thanks.

[xenacode-art]

@sergyDwhiz glad to have you back hope you're doing okay.

[sergyDwhiz]

Thanks bro, and I'm good. Hope same?

[sergyDwhiz]

We need to do everything to close this PR sooner bro. It's a crucial feature.