The only problem I have is, how should we signal a mismatch? Adding it to the API response before it's passed back through the promise seems really nasty. A second parameter to mw.Api deferred resolutions might work. A pagewide event might work.

getToken() could simply reject the promise it returns.

There doesn't seem to be anything for the action API itself to do here. You can already include assert=user in all your requests to avoid the logged-out issue, and include meta=userinfo in all your action=query requests and verify the user returned is still the user you think it is for the logged-in-as-someone-else issue.

I suppose if someone really wanted they could add assertuser=Example that would work like assert=user and additionally assert you're logged in as User:Example to cover the possibility that someone might somehow log in as a different user between making a query and submitting an edit.

This problem could and should be resolved by maintaining server side sessions.

I'm new to mediawiki so I can't say how exactly the user sessions are
already handled, but we need to bank upon that and make the necessary
changes to the API.

In T146770#2678325, @rohitt wrote:

I'm new to mediawiki

Welcome to MediaWiki! I suggest you get acquainted with MediaWiki and try things out so you can make better-informed suggestions in the future. (:

@Anomie TIL about assert=user, and yes, assertuser=Whomever might be a nice addition. The mw.Api constructor could then just be passed that parameter, and the code wouldn't have to worry about it later.

I'll edit the task to reflect (what I think is) the best solution.

I'd probably have created that as a subtask of this task, instead of trying to turn this task into that. As it stands now, once the assertuser parameter is added this bug will be closed without it necessarily being added to the mw.Api JS module.

Change 314271 had a related patch set uploaded (by Anomie):
API: Add assertuser parameter

https://gerrit.wikimedia.org/r/314271

Change 314271 merged by jenkins-bot:
API: Add assertuser parameter

https://gerrit.wikimedia.org/r/314271

Note that no special support for this is needed in the JS mediawiki.api module, you can conveniently add this parameter to all of your requests by constructing the mw.Api object like this:

new mw.Api( { parameters: { assertuser: mw.config.get( 'wgUserName' ) } } )

Maybe it would make sense to use this by default for all mw.Api instances… it could prevent some stupid mistakes, but then it's usually not needed for most queries (only for POST, and GET for data only visible to some users).