Permissions

// LocalSettings.php

// Prevent anonymous users from editing
$wgGroupPermissions['*']['edit'] = false;

// Prevent anonymous users from reading (private wiki)
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['user']['read'] = true;

// Allow autoconfirmed users to patrol edits
$wgGroupPermissions['autoconfirmed']['patrol'] = true;

// Create a custom group
$wgGroupPermissions['trusted']['move'] = true;
$wgGroupPermissions['trusted']['delete'] = false;

// Grant a right to all logged-in users
$wgGroupPermissions['user']['upload'] = true;

// Revoke 'edit' from all users, including those in elevated groups
$wgRevokePermissions['*']['edit'] = true;

// Only sysops can edit the MediaWiki namespace (already the default)
$wgNamespaceProtection[NS_MEDIAWIKI] = [ 'editinterface' ];

// Only trusted users can edit namespace 100 (a custom namespace)
$wgNamespaceProtection[100] = [ 'editcustomns' ];

// Grant the right to the 'editor' group
$wgGroupPermissions['editor']['editcustomns'] = true;

// Default protection levels: '', 'autoconfirmed', 'sysop'
// Add a custom 'reviewer' level
$wgRestrictionLevels[] = 'reviewer';
$wgGroupPermissions['reviewer']['editreviewer'] = true;

// Maximum block duration for non-sysop users to apply
$wgBlockAllowsUTEdit = true;   // Allow blocked users to edit their own talk page

// Allow sysops to issue partial blocks (specific pages/namespaces only)
// (enabled by default since 1.33)

// Prevent blocked users from logging in
$wgBlockDisablesLogin = false; // default; set to true to disable login for blocked users

php maintenance/run.php purgeExpiredBlocks

use MediaWiki\MediaWikiServices;

$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();

// Check if a user can perform an action on a page
if ( $permissionManager->userCan( 'delete', $user, $title ) ) {
    // User is allowed to delete this page
}

// Get all errors preventing an action (returns array of error messages)
$errors = $permissionManager->getPermissionErrors( 'edit', $user, $title );
if ( $errors === [] ) {
    // No permission errors
}

// Check a right without a specific page context
if ( $permissionManager->userHasRight( $user, 'block' ) ) {
    // User is in a group that grants 'block'
}

// Secure check before a write operation
$errors = $permissionManager->getPermissionErrors(
    'delete',
    $user,
    $title,
    PermissionManager::RIGOR_SECURE
);

// Require 4 days old and 10 edits for autoconfirmed
$wgAutoConfirmAge   = 4 * 24 * 3600; // seconds
$wgAutoConfirmCount = 10;