Move privileged details and actions out of user profile header

[1ec5]

When an administrator or moderator views a user profile, some privileged information and actions appear in the header under the usual user statistics. As an OHM administrator, I’ve been wanting this information to go in a separate page, or at least it could only appear in a partial or popup after the administrator/moderator asks for it. It sounds like this might align with some needs on the OSM side too.

Most of OSM’s administrators and moderators also contribute to OSM as ordinary mappers, so sometimes they view user profiles for mapping reasons that have nothing to do with their DWG/OWG/sysop/sysadmin responsibilities. Destructive actions like deleting a user could be a little more out of the way, just in case. Sensitive information like the e-mail address and IP address should come from a separate page load so that we can audit viewing of this information, again just in case. A separate page would give us more room to elaborate on some of the information, such as (hypothetically) the factors that contribute to the spam score, or add more shortcuts for resetting the password etc.

[pnorman]

For a UI idea, this is how Discourse manages it

The profile page adds an email to the info line hidden behind a show button

The admin view on the user hides emails but not IP. There are additional lookup buttons to compare the IP against others that have been seen.

[1ec5]

As another data point, on Wikimedia wikis, a privileged user clicks a ℹ️ button next to a temporary account name to reveal IP info tied to that account. (A click on the ℹ️ adds an entry to the IP reveal log.)

[tomhughes]

The downside of making the action buttons harder to reach is that it make spam cleanup, where you may be needing to go through dozens of accounts and take action on them, slower.

[1ec5]

Does spam cleanup usually go through the /users page? It could provide direct access to the user management page, similar to that Discourse example.

[tomhughes]

No dealing with reports (what I'm really talking about here) is an incredibly painful process where you bring up the list of pending reports, middle click a bunch of them into new tabs, then from each of those middle click the user to view their profile and investigate the complaint before potentially clicking one of the action buttons and then going back to the report to close it.

The discourse/stackexchange style report review flow was exactly what I had in mind when we added reporting but it's not what we wound up with...