No OneTemporary
Actions

Size

64 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/resources/sql/autopatches/20190206.external.03.providerphid.sql b/resources/sql/autopatches/20190206.external.03.providerphid.sql
	new file mode 100644
	index 0000000000..0b2f498e02
	--- /dev/null
	+++ b/resources/sql/autopatches/20190206.external.03.providerphid.sql
	@@ -0,0 +1,2 @@
	+ALTER TABLE {$NAMESPACE}_user.user_externalaccount
	+ ADD providerConfigPHID VARBINARY(64) NOT NULL;
	diff --git a/resources/sql/autopatches/20190206.external.04.providerlink.php b/resources/sql/autopatches/20190206.external.04.providerlink.php
	new file mode 100644
	index 0000000000..e4a2e2d4bf
	--- /dev/null
	+++ b/resources/sql/autopatches/20190206.external.04.providerlink.php
	@@ -0,0 +1,36 @@
	+<?php
	+
	+$account_table = new PhabricatorExternalAccount();
	+$account_conn = $account_table->establishConnection('w');
	+$table_name = $account_table->getTableName();
	+
	+$config_table = new PhabricatorAuthProviderConfig();
	+$config_conn = $config_table->establishConnection('w');
	+
	+foreach (new LiskRawMigrationIterator($account_conn, $table_name) as $row) {
	+ if (strlen($row['providerConfigPHID'])) {
	+ continue;
	+ }
	+
	+ $config_row = queryfx_one(
	+ $config_conn,
	+ 'SELECT phid
	+ FROM %R
	+ WHERE providerType = %s AND providerDomain = %s
	+ LIMIT 1',
	+ $config_table,
	+ $row['accountType'],
	+ $row['accountDomain']);
	+ if (!$config_row) {
	+ continue;
	+ }
	+
	+ queryfx(
	+ $account_conn,
	+ 'UPDATE %R
	+ SET providerConfigPHID = %s
	+ WHERE id = %d',
	+ $account_table,
	+ $config_row['phid'],
	+ $row['id']);
	+}
	diff --git a/src/applications/auth/controller/PhabricatorAuthRegisterController.php b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	index 0562a4242c..b1b2c86dc4 100644
	--- a/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	@@ -1,749 +1,749 @@
	<?php

	final class PhabricatorAuthRegisterController
	extends PhabricatorAuthController {

	public function shouldRequireLogin() {
	return false;
	}

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$account_key = $request->getURIData('akey');

	if ($request->getUser()->isLoggedIn()) {
	return id(new AphrontRedirectResponse())->setURI('/');
	}

	$is_setup = false;
	if (strlen($account_key)) {
	$result = $this->loadAccountForRegistrationOrLinking($account_key);
	list($account, $provider, $response) = $result;
	$is_default = false;
	} else if ($this->isFirstTimeSetup()) {
	$account = null;
	$provider = null;
	$response = null;
	$is_default = true;
	$is_setup = true;
	} else {
	list($account, $provider, $response) = $this->loadDefaultAccount();
	$is_default = true;
	}

	if ($response) {
	return $response;
	}

	$invite = $this->loadInvite();

	if (!$is_setup) {
	if (!$provider->shouldAllowRegistration()) {
	if ($invite) {
	// If the user has an invite, we allow them to register with any
	// provider, even a login-only provider.
	} else {
	// TODO: This is a routine error if you click "Login" on an external
	// auth source which doesn't allow registration. The error should be
	// more tailored.

	return $this->renderError(
	pht(
	'The account you are attempting to register with uses an '.
	'authentication provider ("%s") which does not allow '.
	'registration. An administrator may have recently disabled '.
	'registration with this provider.',
	$provider->getProviderName()));
	}
	}
	}

	$errors = array();

	$user = new PhabricatorUser();

	if ($is_setup) {
	$default_username = null;
	$default_realname = null;
	$default_email = null;
	} else {
	$default_username = $account->getUsername();
	$default_realname = $account->getRealName();
	$default_email = $account->getEmail();
	}

	$account_type = PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT;
	$content_source = PhabricatorContentSource::newFromRequest($request);

	if ($invite) {
	$default_email = $invite->getEmailAddress();
	}

	if ($default_email !== null) {
	if (!PhabricatorUserEmail::isValidAddress($default_email)) {
	$errors[] = pht(
	'The email address associated with this external account ("%s") is '.
	'not a valid email address and can not be used to register a '.
	'Phabricator account. Choose a different, valid address.',
	phutil_tag('strong', array(), $default_email));
	$default_email = null;
	}
	}

	if ($default_email !== null) {
	// We should bypass policy here because e.g. limiting an application use
	// to a subset of users should not allow the others to overwrite
	// configured application emails.
	$application_email = id(new PhabricatorMetaMTAApplicationEmailQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withAddresses(array($default_email))
	->executeOne();
	if ($application_email) {
	$errors[] = pht(
	'The email address associated with this account ("%s") is '.
	'already in use by an application and can not be used to '.
	'register a new Phabricator account. Choose a different, valid '.
	'address.',
	phutil_tag('strong', array(), $default_email));
	$default_email = null;
	}
	}

	$show_existing = null;
	if ($default_email !== null) {
	// If the account source provided an email, but it's not allowed by
	// the configuration, roadblock the user. Previously, we let the user
	// pick a valid email address instead, but this does not align well with
	// user expectation and it's not clear the cases it enables are valuable.
	// See discussion in T3472.
	if (!PhabricatorUserEmail::isAllowedAddress($default_email)) {
	$debug_email = new PHUIInvisibleCharacterView($default_email);
	return $this->renderError(
	array(
	pht(
	'The account you are attempting to register with has an invalid '.
	'email address (%s). This Phabricator install only allows '.
	'registration with specific email addresses:',
	$debug_email),
	phutil_tag('br'),
	phutil_tag('br'),
	PhabricatorUserEmail::describeAllowedAddresses(),
	));
	}

	// If the account source provided an email, but another account already
	// has that email, just pretend we didn't get an email.
	if ($default_email !== null) {
	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$default_email);
	if ($same_email) {
	if ($invite) {
	// We're allowing this to continue. The fact that we loaded the
	// invite means that the address is nonprimary and unverified and
	// we're OK to steal it.
	} else {
	$show_existing = $default_email;
	$default_email = null;
	}
	}
	}
	}

	if ($show_existing !== null) {
	if (!$request->getInt('phase')) {
	return $this->newDialog()
	->setTitle(pht('Email Address Already in Use'))
	->addHiddenInput('phase', 1)
	->appendParagraph(
	pht(
	'You are creating a new Phabricator account linked to an '.
	'existing external account from outside Phabricator.'))
	->appendParagraph(
	pht(
	'The email address ("%s") associated with the external account '.
	'is already in use by an existing Phabricator account. Multiple '.
	'Phabricator accounts may not have the same email address, so '.
	'you can not use this email address to register a new '.
	'Phabricator account.',
	phutil_tag('strong', array(), $show_existing)))
	->appendParagraph(
	pht(
	'If you want to register a new account, continue with this '.
	'registration workflow and choose a new, unique email address '.
	'for the new account.'))
	->appendParagraph(
	pht(
	'If you want to link an existing Phabricator account to this '.
	'external account, do not continue. Instead: log in to your '.
	'existing account, then go to "Settings" and link the account '.
	'in the "External Accounts" panel.'))
	->appendParagraph(
	pht(
	'If you continue, you will create a new account. You will not '.
	'be able to link this external account to an existing account.'))
	->addCancelButton('/auth/login/', pht('Cancel'))
	->addSubmitButton(pht('Create New Account'));
	} else {
	$errors[] = pht(
	'The external account you are registering with has an email address '.
	'that is already in use ("%s") by an existing Phabricator account. '.
	'Choose a new, valid email address to register a new Phabricator '.
	'account.',
	phutil_tag('strong', array(), $show_existing));
	}
	}

	$profile = id(new PhabricatorRegistrationProfile())
	->setDefaultUsername($default_username)
	->setDefaultEmail($default_email)
	->setDefaultRealName($default_realname)
	->setCanEditUsername(true)
	->setCanEditEmail(($default_email === null))
	->setCanEditRealName(true)
	->setShouldVerifyEmail(false);

	$event_type = PhabricatorEventType::TYPE_AUTH_WILLREGISTERUSER;
	$event_data = array(
	'account' => $account,
	'profile' => $profile,
	);

	$event = id(new PhabricatorEvent($event_type, $event_data))
	->setUser($user);
	PhutilEventEngine::dispatchEvent($event);

	$default_username = $profile->getDefaultUsername();
	$default_email = $profile->getDefaultEmail();
	$default_realname = $profile->getDefaultRealName();

	$can_edit_username = $profile->getCanEditUsername();
	$can_edit_email = $profile->getCanEditEmail();
	$can_edit_realname = $profile->getCanEditRealName();

	if ($is_setup) {
	$must_set_password = false;
	} else {
	$must_set_password = $provider->shouldRequireRegistrationPassword();
	}

	$can_edit_anything = $profile->getCanEditAnything() \|\| $must_set_password;
	$force_verify = $profile->getShouldVerifyEmail();

	// Automatically verify the administrator's email address during first-time
	// setup.
	if ($is_setup) {
	$force_verify = true;
	}

	$value_username = $default_username;
	$value_realname = $default_realname;
	$value_email = $default_email;
	$value_password = null;

	$require_real_name = PhabricatorEnv::getEnvConfig('user.require-real-name');

	$e_username = strlen($value_username) ? null : true;
	$e_realname = $require_real_name ? true : null;
	$e_email = strlen($value_email) ? null : true;
	$e_password = true;
	$e_captcha = true;

	$skip_captcha = false;
	if ($invite) {
	// If the user is accepting an invite, assume they're trustworthy enough
	// that we don't need to CAPTCHA them.
	$skip_captcha = true;
	}

	$min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
	$min_len = (int)$min_len;

	$from_invite = $request->getStr('invite');
	if ($from_invite && $can_edit_username) {
	$value_username = $request->getStr('username');
	$e_username = null;
	}

	$try_register =
	($request->isFormPost() \|\| !$can_edit_anything) &&
	!$from_invite &&
	($request->getInt('phase') != 1);

	if ($try_register) {
	$errors = array();

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	if ($must_set_password && !$skip_captcha) {
	$e_captcha = pht('Again');

	$captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
	if (!$captcha_ok) {
	$errors[] = pht('Captcha response is incorrect, try again.');
	$e_captcha = pht('Invalid');
	}
	}

	if ($can_edit_username) {
	$value_username = $request->getStr('username');
	if (!strlen($value_username)) {
	$e_username = pht('Required');
	$errors[] = pht('Username is required.');
	} else if (!PhabricatorUser::validateUsername($value_username)) {
	$e_username = pht('Invalid');
	$errors[] = PhabricatorUser::describeValidUsername();
	} else {
	$e_username = null;
	}
	}

	if ($must_set_password) {
	$value_password = $request->getStr('password');
	$value_confirm = $request->getStr('confirm');

	$password_envelope = new PhutilOpaqueEnvelope($value_password);
	$confirm_envelope = new PhutilOpaqueEnvelope($value_confirm);

	$engine = id(new PhabricatorAuthPasswordEngine())
	->setViewer($user)
	->setContentSource($content_source)
	->setPasswordType($account_type)
	->setObject($user);

	try {
	$engine->checkNewPassword($password_envelope, $confirm_envelope);
	$e_password = null;
	} catch (PhabricatorAuthPasswordException $ex) {
	$errors[] = $ex->getMessage();
	$e_password = $ex->getPasswordError();
	}
	}

	if ($can_edit_email) {
	$value_email = $request->getStr('email');
	if (!strlen($value_email)) {
	$e_email = pht('Required');
	$errors[] = pht('Email is required.');
	} else if (!PhabricatorUserEmail::isValidAddress($value_email)) {
	$e_email = pht('Invalid');
	$errors[] = PhabricatorUserEmail::describeValidAddresses();
	} else if (!PhabricatorUserEmail::isAllowedAddress($value_email)) {
	$e_email = pht('Disallowed');
	$errors[] = PhabricatorUserEmail::describeAllowedAddresses();
	} else {
	$e_email = null;
	}
	}

	if ($can_edit_realname) {
	$value_realname = $request->getStr('realName');
	if (!strlen($value_realname) && $require_real_name) {
	$e_realname = pht('Required');
	$errors[] = pht('Real name is required.');
	} else {
	$e_realname = null;
	}
	}

	if (!$errors) {
	if (!$is_setup) {
	$image = $this->loadProfilePicture($account);
	if ($image) {
	$user->setProfileImagePHID($image->getPHID());
	}
	}

	try {
	$verify_email = false;

	if ($force_verify) {
	$verify_email = true;
	}

	if (!$is_setup) {
	if ($value_email === $default_email) {
	if ($account->getEmailVerified()) {
	$verify_email = true;
	}

	if ($provider->shouldTrustEmails()) {
	$verify_email = true;
	}

	if ($invite) {
	$verify_email = true;
	}
	}
	}

	$email_obj = null;
	if ($invite) {
	// If we have a valid invite, this email may exist but be
	// nonprimary and unverified, so we'll reassign it.
	$email_obj = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$value_email);
	}
	if (!$email_obj) {
	$email_obj = id(new PhabricatorUserEmail())
	->setAddress($value_email);
	}

	$email_obj->setIsVerified((int)$verify_email);

	$user->setUsername($value_username);
	$user->setRealname($value_realname);

	if ($is_setup) {
	$must_approve = false;
	} else if ($invite) {
	$must_approve = false;
	} else {
	$must_approve = PhabricatorEnv::getEnvConfig(
	'auth.require-approval');
	}

	if ($must_approve) {
	$user->setIsApproved(0);
	} else {
	$user->setIsApproved(1);
	}

	if ($invite) {
	$allow_reassign_email = true;
	} else {
	$allow_reassign_email = false;
	}

	$user->openTransaction();

	$editor = id(new PhabricatorUserEditor())
	->setActor($user);

	$editor->createNewUser($user, $email_obj, $allow_reassign_email);
	if ($must_set_password) {
	$password_object = PhabricatorAuthPassword::initializeNewPassword(
	$user,
	$account_type);

	$password_object
	->setPassword($password_envelope, $user)
	->save();
	}

	if ($is_setup) {
	$xactions = array();
	$xactions[] = id(new PhabricatorUserTransaction())
	->setTransactionType(
	PhabricatorUserEmpowerTransaction::TRANSACTIONTYPE)
	->setNewValue(true);

	$actor = PhabricatorUser::getOmnipotentUser();
	$content_source = PhabricatorContentSource::newFromRequest(
	$request);

	$people_application_phid = id(new PhabricatorPeopleApplication())
	->getPHID();

	$transaction_editor = id(new PhabricatorUserTransactionEditor())
	->setActor($actor)
	->setActingAsPHID($people_application_phid)
	->setContentSource($content_source)
	->setContinueOnMissingFields(true);

	$transaction_editor->applyTransactions($user, $xactions);
	}

	if (!$is_setup) {
	$account->setUserPHID($user->getPHID());
	$provider->willRegisterAccount($account);
	$account->save();
	}

	$user->saveTransaction();

	if (!$email_obj->getIsVerified()) {
	$email_obj->sendVerificationEmail($user);
	}

	if ($must_approve) {
	$this->sendWaitingForApprovalEmail($user);
	}

	if ($invite) {
	$invite->setAcceptedByPHID($user->getPHID())->save();
	}

	return $this->loginUser($user);
	} catch (AphrontDuplicateKeyQueryException $exception) {
	$same_username = id(new PhabricatorUser())->loadOneWhere(
	'userName = %s',
	$user->getUserName());

	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$value_email);

	if ($same_username) {
	$e_username = pht('Duplicate');
	$errors[] = pht('Another user already has that username.');
	}

	if ($same_email) {
	// TODO: See T3340.
	$e_email = pht('Duplicate');
	$errors[] = pht('Another user already has that email.');
	}

	if (!$same_username && !$same_email) {
	throw $exception;
	}
	}
	}

	unset($unguarded);
	}

	$form = id(new AphrontFormView())
	->setUser($request->getUser())
	->addHiddenInput('phase', 2);

	if (!$is_default) {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('External Account'))
	->setValue(
	id(new PhabricatorAuthAccountView())
	->setUser($request->getUser())
	->setExternalAccount($account)
	->setAuthProvider($provider)));
	}

	if ($can_edit_username) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Username'))
	->setName('username')
	->setValue($value_username)
	->setError($e_username));
	} else {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('Username'))
	->setValue($value_username)
	->setError($e_username));
	}

	if ($can_edit_realname) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Real Name'))
	->setName('realName')
	->setValue($value_realname)
	->setError($e_realname));
	}

	if ($must_set_password) {
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Password'))
	->setName('password')
	->setError($e_password));
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Confirm Password'))
	->setName('confirm')
	->setError($e_password)
	->setCaption(
	$min_len
	? pht('Minimum length of %d characters.', $min_len)
	: null));
	}

	if ($can_edit_email) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Email'))
	->setName('email')
	->setValue($value_email)
	->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
	->setError($e_email));
	}

	if ($must_set_password && !$skip_captcha) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setLabel(pht('Captcha'))
	->setError($e_captcha));
	}

	$submit = id(new AphrontFormSubmitControl());

	if ($is_setup) {
	$submit
	->setValue(pht('Create Admin Account'));
	} else {
	$submit
	->addCancelButton($this->getApplicationURI('start/'))
	->setValue(pht('Register Account'));
	}


	$form->appendChild($submit);

	$crumbs = $this->buildApplicationCrumbs();

	if ($is_setup) {
	$crumbs->addTextCrumb(pht('Setup Admin Account'));
	$title = pht('Welcome to Phabricator');
	} else {
	$crumbs->addTextCrumb(pht('Register'));
	$crumbs->addTextCrumb($provider->getProviderName());
	$title = pht('Create a New Account');
	}
	$crumbs->setBorder(true);

	$welcome_view = null;
	if ($is_setup) {
	$welcome_view = id(new PHUIInfoView())
	->setSeverity(PHUIInfoView::SEVERITY_NOTICE)
	->setTitle(pht('Welcome to Phabricator'))
	->appendChild(
	pht(
	'Installation is complete. Register your administrator account '.
	'below to log in. You will be able to configure options and add '.
	'authentication mechanisms later on.'));
	}

	$object_box = id(new PHUIObjectBoxView())
	->setForm($form)
	->setFormErrors($errors);

	$invite_header = null;
	if ($invite) {
	$invite_header = $this->renderInviteHeader($invite);
	}

	$header = id(new PHUIHeaderView())
	->setHeader($title);

	$view = id(new PHUITwoColumnView())
	->setHeader($header)
	->setFooter(
	array(
	$welcome_view,
	$invite_header,
	$object_box,
	));

	return $this->newPage()
	->setTitle($title)
	->setCrumbs($crumbs)
	->appendChild($view);
	}

	private function loadDefaultAccount() {
	$providers = PhabricatorAuthProvider::getAllEnabledProviders();
	$account = null;
	$provider = null;
	$response = null;

	foreach ($providers as $key => $candidate_provider) {
	if (!$candidate_provider->shouldAllowRegistration()) {
	unset($providers[$key]);
	continue;
	}
	if (!$candidate_provider->isDefaultRegistrationProvider()) {
	unset($providers[$key]);
	}
	}

	if (!$providers) {
	$response = $this->renderError(
	pht(
	'There are no configured default registration providers.'));
	return array($account, $provider, $response);
	} else if (count($providers) > 1) {
	$response = $this->renderError(
	pht('There are too many configured default registration providers.'));
	return array($account, $provider, $response);
	}

	$provider = head($providers);
	- $account = $provider->getDefaultExternalAccount();
	+ $account = $provider->newDefaultExternalAccount();

	return array($account, $provider, $response);
	}

	private function loadProfilePicture(PhabricatorExternalAccount $account) {
	$phid = $account->getProfileImagePHID();
	if (!$phid) {
	return null;
	}

	// NOTE: Use of omnipotent user is okay here because the registering user
	// can not control the field value, and we can't use their user object to
	// do meaningful policy checks anyway since they have not registered yet.
	// Reaching this means the user holds the account secret key and the
	// registration secret key, and thus has permission to view the image.

	$file = id(new PhabricatorFileQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withPHIDs(array($phid))
	->executeOne();
	if (!$file) {
	return null;
	}

	$xform = PhabricatorFileTransform::getTransformByKey(
	PhabricatorFileThumbnailTransform::TRANSFORM_PROFILE);
	return $xform->executeTransform($file);
	}

	protected function renderError($message) {
	return $this->renderErrorPage(
	pht('Registration Failed'),
	array($message));
	}

	private function sendWaitingForApprovalEmail(PhabricatorUser $user) {
	$title = '[Phabricator] '.pht(
	'New User "%s" Awaiting Approval',
	$user->getUsername());

	$body = new PhabricatorMetaMTAMailBody();

	$body->addRawSection(
	pht(
	'Newly registered user "%s" is awaiting account approval by an '.
	'administrator.',
	$user->getUsername()));

	$body->addLinkSection(
	pht('APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/people/query/approval/'));

	$body->addLinkSection(
	pht('DISABLE APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/config/edit/auth.require-approval/'));

	$admins = id(new PhabricatorPeopleQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withIsAdmin(true)
	->execute();

	if (!$admins) {
	return;
	}

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(mpull($admins, 'getPHID'))
	->setSubject($title)
	->setBody($body->render())
	->saveAndSend();
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
	index 04548d1f0c..78aeebd810 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
	@@ -1,526 +1,534 @@
	<?php

	abstract class PhabricatorAuthProvider extends Phobject {

	private $providerConfig;

	public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
	$this->providerConfig = $config;
	return $this;
	}

	public function hasProviderConfig() {
	return (bool)$this->providerConfig;
	}

	public function getProviderConfig() {
	if ($this->providerConfig === null) {
	throw new PhutilInvalidStateException('attachProviderConfig');
	}
	return $this->providerConfig;
	}

	public function getConfigurationHelp() {
	return null;
	}

	public function getDefaultProviderConfig() {
	return id(new PhabricatorAuthProviderConfig())
	->setProviderClass(get_class($this))
	->setIsEnabled(1)
	->setShouldAllowLogin(1)
	->setShouldAllowRegistration(1)
	->setShouldAllowLink(1)
	->setShouldAllowUnlink(1);
	}

	public function getNameForCreate() {
	return $this->getProviderName();
	}

	public function getDescriptionForCreate() {
	return null;
	}

	public function getProviderKey() {
	return $this->getAdapter()->getAdapterKey();
	}

	public function getProviderType() {
	return $this->getAdapter()->getAdapterType();
	}

	public function getProviderDomain() {
	return $this->getAdapter()->getAdapterDomain();
	}

	public static function getAllBaseProviders() {
	return id(new PhutilClassMapQuery())
	->setAncestorClass(__CLASS__)
	->execute();
	}

	public static function getAllProviders() {
	static $providers;

	if ($providers === null) {
	$objects = self::getAllBaseProviders();

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->execute();

	$providers = array();
	foreach ($configs as $config) {
	if (!isset($objects[$config->getProviderClass()])) {
	// This configuration is for a provider which is not installed.
	continue;
	}

	$object = clone $objects[$config->getProviderClass()];
	$object->attachProviderConfig($config);

	$key = $object->getProviderKey();
	if (isset($providers[$key])) {
	throw new Exception(
	pht(
	"Two authentication providers use the same provider key ".
	"('%s'). Each provider must be identified by a unique key.",
	$key));
	}
	$providers[$key] = $object;
	}
	}

	return $providers;
	}

	public static function getAllEnabledProviders() {
	$providers = self::getAllProviders();
	foreach ($providers as $key => $provider) {
	if (!$provider->isEnabled()) {
	unset($providers[$key]);
	}
	}
	return $providers;
	}

	public static function getEnabledProviderByKey($provider_key) {
	return idx(self::getAllEnabledProviders(), $provider_key);
	}

	abstract public function getProviderName();
	abstract public function getAdapter();

	public function isEnabled() {
	return $this->getProviderConfig()->getIsEnabled();
	}

	public function shouldAllowLogin() {
	return $this->getProviderConfig()->getShouldAllowLogin();
	}

	public function shouldAllowRegistration() {
	if (!$this->shouldAllowLogin()) {
	return false;
	}

	return $this->getProviderConfig()->getShouldAllowRegistration();
	}

	public function shouldAllowAccountLink() {
	return $this->getProviderConfig()->getShouldAllowLink();
	}

	public function shouldAllowAccountUnlink() {
	return $this->getProviderConfig()->getShouldAllowUnlink();
	}

	public function shouldTrustEmails() {
	return $this->shouldAllowEmailTrustConfiguration() &&
	$this->getProviderConfig()->getShouldTrustEmails();
	}

	/**
	* Should we allow the adapter to be marked as "trusted". This is true for
	* all adapters except those that allow the user to type in emails (see
	* @{class:PhabricatorPasswordAuthProvider}).
	*/
	public function shouldAllowEmailTrustConfiguration() {
	return true;
	}

	public function buildLoginForm(PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
	}

	public function buildInviteForm(PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'invite');
	}

	abstract public function processLoginRequest(
	PhabricatorAuthLoginController $controller);

	public function buildLinkForm(PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
	}

	public function shouldAllowAccountRefresh() {
	return true;
	}

	public function buildRefreshForm(
	PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
	}

	protected function renderLoginForm(AphrontRequest $request, $mode) {
	throw new PhutilMethodNotImplementedException();
	}

	public function createProviders() {
	return array($this);
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	return;
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	return;
	}

	protected function loadOrCreateAccount($account_id) {
	if (!strlen($account_id)) {
	throw new Exception(pht('Empty account ID!'));
	}

	$adapter = $this->getAdapter();
	$adapter_class = get_class($adapter);

	if (!strlen($adapter->getAdapterType())) {
	throw new Exception(
	pht(
	"AuthAdapter (of class '%s') has an invalid implementation: ".
	"no adapter type.",
	$adapter_class));
	}

	if (!strlen($adapter->getAdapterDomain())) {
	throw new Exception(
	pht(
	"AuthAdapter (of class '%s') has an invalid implementation: ".
	"no adapter domain.",
	$adapter_class));
	}

	$account = id(new PhabricatorExternalAccount())->loadOneWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s',
	$adapter->getAdapterType(),
	$adapter->getAdapterDomain(),
	$account_id);
	if (!$account) {
	- $account = id(new PhabricatorExternalAccount())
	- ->setAccountType($adapter->getAdapterType())
	- ->setAccountDomain($adapter->getAdapterDomain())
	+ $account = $this->newExternalAccount()
	->setAccountID($account_id);
	}

	$account->setUsername($adapter->getAccountName());
	$account->setRealName($adapter->getAccountRealName());
	$account->setEmail($adapter->getAccountEmail());
	$account->setAccountURI($adapter->getAccountURI());

	$account->setProfileImagePHID(null);
	$image_uri = $adapter->getAccountImageURI();
	if ($image_uri) {
	try {
	$name = PhabricatorSlug::normalize($this->getProviderName());
	$name = $name.'-profile.jpg';

	// TODO: If the image has not changed, we do not need to make a new
	// file entry for it, but there's no convenient way to do this with
	// PhabricatorFile right now. The storage will get shared, so the impact
	// here is negligible.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$image_file = PhabricatorFile::newFromFileDownload(
	$image_uri,
	array(
	'name' => $name,
	'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
	));
	if ($image_file->isViewableImage()) {
	$image_file
	->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy())
	->setCanCDN(true)
	->save();
	$account->setProfileImagePHID($image_file->getPHID());
	} else {
	$image_file->delete();
	}
	unset($unguarded);

	} catch (Exception $ex) {
	// Log this but proceed, it's not especially important that we
	// be able to pull profile images.
	phlog($ex);
	}
	}

	$this->willSaveAccount($account);

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$account->save();
	unset($unguarded);

	return $account;
	}

	public function getLoginURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
	return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
	}

	public function getSettingsURI() {
	return '/settings/panel/external/';
	}

	public function getStartURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
	$uri = $app->getApplicationURI('/start/');
	return $uri;
	}

	public function isDefaultRegistrationProvider() {
	return false;
	}

	public function shouldRequireRegistrationPassword() {
	return false;
	}

	- public function getDefaultExternalAccount() {
	- throw new PhutilMethodNotImplementedException();
	+ public function newDefaultExternalAccount() {
	+ return $this->newExternalAccount();
	+ }
	+
	+ protected function newExternalAccount() {
	+ $config = $this->getProviderConfig();
	+ $adapter = $this->getAdapter();
	+
	+ return id(new PhabricatorExternalAccount())
	+ ->setAccountType($adapter->getAdapterType())
	+ ->setAccountDomain($adapter->getAdapterDomain())
	+ ->setProviderConfigPHID($config->getPHID());
	}

	public function getLoginOrder() {
	return '500-'.$this->getProviderName();
	}

	protected function getLoginIcon() {
	return 'Generic';
	}

	public function newIconView() {
	return id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
	->setSpriteIcon($this->getLoginIcon());
	}

	public function isLoginFormAButton() {
	return false;
	}

	public function renderConfigPropertyTransactionTitle(
	PhabricatorAuthProviderConfigTransaction $xaction) {

	return null;
	}

	public function readFormValuesFromProvider() {
	return array();
	}

	public function readFormValuesFromRequest(AphrontRequest $request) {
	return array();
	}

	public function processEditForm(
	AphrontRequest $request,
	array $values) {

	$errors = array();
	$issues = array();

	return array($errors, $issues, $values);
	}

	public function extendEditForm(
	AphrontRequest $request,
	AphrontFormView $form,
	array $values,
	array $issues) {

	return;
	}

	public function willRenderLinkedAccount(
	PhabricatorUser $viewer,
	PHUIObjectItemView $item,
	PhabricatorExternalAccount $account) {

	$account_view = id(new PhabricatorAuthAccountView())
	->setExternalAccount($account)
	->setAuthProvider($this);

	$item->appendChild(
	phutil_tag(
	'div',
	array(
	'class' => 'mmr mml mst mmb',
	),
	$account_view));
	}

	/**
	* Return true to use a two-step configuration (setup, configure) instead of
	* the default single-step configuration. In practice, this means that
	* creating a new provider instance will redirect back to the edit page
	* instead of the provider list.
	*
	* @return bool True if this provider uses two-step configuration.
	*/
	public function hasSetupStep() {
	return false;
	}

	/**
	* Render a standard login/register button element.
	*
	* The `$attributes` parameter takes these keys:
	*
	* - `uri`: URI the button should take the user to when clicked.
	* - `method`: Optional HTTP method the button should use, defaults to GET.
	*
	* @param AphrontRequest HTTP request.
	* @param string Request mode string.
	* @param map Additional parameters, see above.
	* @return wild Log in button.
	*/
	protected function renderStandardLoginButton(
	AphrontRequest $request,
	$mode,
	array $attributes = array()) {

	PhutilTypeSpec::checkMap(
	$attributes,
	array(
	'method' => 'optional string',
	'uri' => 'string',
	'sigil' => 'optional string',
	));

	$viewer = $request->getUser();
	$adapter = $this->getAdapter();

	if ($mode == 'link') {
	$button_text = pht('Link External Account');
	} else if ($mode == 'refresh') {
	$button_text = pht('Refresh Account Link');
	} else if ($mode == 'invite') {
	$button_text = pht('Register Account');
	} else if ($this->shouldAllowRegistration()) {
	$button_text = pht('Log In or Register');
	} else {
	$button_text = pht('Log In');
	}

	$icon = id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
	->setSpriteIcon($this->getLoginIcon());

	$button = id(new PHUIButtonView())
	->setSize(PHUIButtonView::BIG)
	->setColor(PHUIButtonView::GREY)
	->setIcon($icon)
	->setText($button_text)
	->setSubtext($this->getProviderName());

	$uri = $attributes['uri'];
	$uri = new PhutilURI($uri);
	$params = $uri->getQueryParamsAsPairList();
	$uri->setQueryParams(array());

	$content = array($button);

	foreach ($params as $pair) {
	list($key, $value) = $pair;
	$content[] = phutil_tag(
	'input',
	array(
	'type' => 'hidden',
	'name' => $key,
	'value' => $value,
	));
	}

	$static_response = CelerityAPI::getStaticResourceResponse();
	$static_response->addContentSecurityPolicyURI('form-action', (string)$uri);

	foreach ($this->getContentSecurityPolicyFormActions() as $csp_uri) {
	$static_response->addContentSecurityPolicyURI('form-action', $csp_uri);
	}

	return phabricator_form(
	$viewer,
	array(
	'method' => idx($attributes, 'method', 'GET'),
	'action' => (string)$uri,
	'sigil' => idx($attributes, 'sigil'),
	),
	$content);
	}

	public function renderConfigurationFooter() {
	return null;
	}

	public function getAuthCSRFCode(AphrontRequest $request) {
	$phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
	if (!strlen($phcid)) {
	throw new AphrontMalformedRequestException(
	pht('Missing Client ID Cookie'),
	pht(
	'Your browser did not submit a "%s" cookie with client state '.
	'information in the request. Check that cookies are enabled. '.
	'If this problem persists, you may need to clear your cookies.',
	PhabricatorCookies::COOKIE_CLIENTID),
	true);
	}

	return PhabricatorHash::weakDigest($phcid);
	}

	protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
	$expect = $this->getAuthCSRFCode($request);

	if (!strlen($actual)) {
	throw new Exception(
	pht(
	'The authentication provider did not return a client state '.
	'parameter in its response, but one was expected. If this '.
	'problem persists, you may need to clear your cookies.'));
	}

	if (!phutil_hashes_are_identical($actual, $expect)) {
	throw new Exception(
	pht(
	'The authentication provider did not return the correct client '.
	'state parameter in its response. If this problem persists, you may '.
	'need to clear your cookies.'));
	}
	}

	public function supportsAutoLogin() {
	return false;
	}

	public function getAutoLoginURI(AphrontRequest $request) {
	throw new PhutilMethodNotImplementedException();
	}

	protected function getContentSecurityPolicyFormActions() {
	return array();
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php b/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
	index ec5720e078..146e41706a 100644
	--- a/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
	+++ b/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
	@@ -1,406 +1,398 @@
	<?php

	final class PhabricatorPasswordAuthProvider extends PhabricatorAuthProvider {

	private $adapter;

	public function getProviderName() {
	return pht('Username/Password');
	}

	public function getConfigurationHelp() {
	return pht(
	"(WARNING) Examine the table below for information on how password ".
	"hashes will be stored in the database.\n\n".
	"(NOTE) You can select a minimum password length by setting ".
	"`%s` in configuration.",
	'account.minimum-password-length');
	}

	public function renderConfigurationFooter() {
	$hashers = PhabricatorPasswordHasher::getAllHashers();
	$hashers = msort($hashers, 'getStrength');
	$hashers = array_reverse($hashers);

	$yes = phutil_tag(
	'strong',
	array(
	'style' => 'color: #009900',
	),
	pht('Yes'));

	$no = phutil_tag(
	'strong',
	array(
	'style' => 'color: #990000',
	),
	pht('Not Installed'));

	$best_hasher_name = null;
	try {
	$best_hasher = PhabricatorPasswordHasher::getBestHasher();
	$best_hasher_name = $best_hasher->getHashName();
	} catch (PhabricatorPasswordHasherUnavailableException $ex) {
	// There are no suitable hashers. The user might be able to enable some,
	// so we don't want to fatal here. We'll fatal when users try to actually
	// use this stuff if it isn't fixed before then. Until then, we just
	// don't highlight a row. In practice, at least one hasher should always
	// be available.
	}

	$rows = array();
	$rowc = array();
	foreach ($hashers as $hasher) {
	$is_installed = $hasher->canHashPasswords();

	$rows[] = array(
	$hasher->getHumanReadableName(),
	$hasher->getHashName(),
	$hasher->getHumanReadableStrength(),
	($is_installed ? $yes : $no),
	($is_installed ? null : $hasher->getInstallInstructions()),
	);
	$rowc[] = ($best_hasher_name == $hasher->getHashName())
	? 'highlighted'
	: null;
	}

	$table = new AphrontTableView($rows);
	$table->setRowClasses($rowc);
	$table->setHeaders(
	array(
	pht('Algorithm'),
	pht('Name'),
	pht('Strength'),
	pht('Installed'),
	pht('Install Instructions'),
	));

	$table->setColumnClasses(
	array(
	'',
	'',
	'',
	'',
	'wide',
	));

	$header = id(new PHUIHeaderView())
	->setHeader(pht('Password Hash Algorithms'))
	->setSubheader(
	pht(
	'Stronger algorithms are listed first. The highlighted algorithm '.
	'will be used when storing new hashes. Older hashes will be '.
	'upgraded to the best algorithm over time.'));

	return id(new PHUIObjectBoxView())
	->setHeader($header)
	->setTable($table);
	}

	public function getDescriptionForCreate() {
	return pht(
	'Allow users to log in or register using a username and password.');
	}

	public function getAdapter() {
	if (!$this->adapter) {
	$adapter = new PhutilEmptyAuthAdapter();
	$adapter->setAdapterType('password');
	$adapter->setAdapterDomain('self');
	$this->adapter = $adapter;
	}
	return $this->adapter;
	}

	public function getLoginOrder() {
	// Make sure username/password appears first if it is enabled.
	return '100-'.$this->getProviderName();
	}

	public function shouldAllowAccountLink() {
	return false;
	}

	public function shouldAllowAccountUnlink() {
	return false;
	}

	public function isDefaultRegistrationProvider() {
	return true;
	}

	public function buildLoginForm(
	PhabricatorAuthStartController $controller) {
	$request = $controller->getRequest();
	return $this->renderPasswordLoginForm($request);
	}

	public function buildInviteForm(
	PhabricatorAuthStartController $controller) {
	$request = $controller->getRequest();
	$viewer = $request->getViewer();

	$form = id(new AphrontFormView())
	->setUser($viewer)
	->addHiddenInput('invite', true)
	->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Username'))
	->setName('username'));

	$dialog = id(new AphrontDialogView())
	->setUser($viewer)
	->setTitle(pht('Register an Account'))
	->appendForm($form)
	->setSubmitURI('/auth/register/')
	->addSubmitButton(pht('Continue'));

	return $dialog;
	}

	public function buildLinkForm(
	PhabricatorAuthLinkController $controller) {
	throw new Exception(pht("Password providers can't be linked."));
	}

	private function renderPasswordLoginForm(
	AphrontRequest $request,
	$require_captcha = false,
	$captcha_valid = false) {

	$viewer = $request->getUser();

	$dialog = id(new AphrontDialogView())
	->setSubmitURI($this->getLoginURI())
	->setUser($viewer)
	->setTitle(pht('Log In'))
	->addSubmitButton(pht('Log In'));

	if ($this->shouldAllowRegistration()) {
	$dialog->addCancelButton(
	'/auth/register/',
	pht('Register New Account'));
	}

	$dialog->addFooter(
	phutil_tag(
	'a',
	array(
	'href' => '/login/email/',
	),
	pht('Forgot your password?')));

	$v_user = nonempty(
	$request->getStr('username'),
	$request->getCookie(PhabricatorCookies::COOKIE_USERNAME));

	$e_user = null;
	$e_pass = null;
	$e_captcha = null;

	$errors = array();
	if ($require_captcha && !$captcha_valid) {
	if (AphrontFormRecaptchaControl::hasCaptchaResponse($request)) {
	$e_captcha = pht('Invalid');
	$errors[] = pht('CAPTCHA was not entered correctly.');
	} else {
	$e_captcha = pht('Required');
	$errors[] = pht(
	'Too many login failures recently. You must '.
	'submit a CAPTCHA with your login request.');
	}
	} else if ($request->isHTTPPost()) {
	// NOTE: This is intentionally vague so as not to disclose whether a
	// given username or email is registered.
	$e_user = pht('Invalid');
	$e_pass = pht('Invalid');
	$errors[] = pht('Username or password are incorrect.');
	}

	if ($errors) {
	$errors = id(new PHUIInfoView())->setErrors($errors);
	}

	$form = id(new PHUIFormLayoutView())
	->setFullWidth(true)
	->appendChild($errors)
	->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Username or Email'))
	->setName('username')
	->setAutofocus(true)
	->setValue($v_user)
	->setError($e_user))
	->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Password'))
	->setName('password')
	->setError($e_pass));

	if ($require_captcha) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setError($e_captcha));
	}

	$dialog->appendChild($form);

	return $dialog;
	}

	public function processLoginRequest(
	PhabricatorAuthLoginController $controller) {

	$request = $controller->getRequest();
	$viewer = $request->getUser();
	$content_source = PhabricatorContentSource::newFromRequest($request);

	$captcha_limit = 5;
	$hard_limit = 32;
	$limit_window = phutil_units('15 minutes in seconds');

	$failed_attempts = PhabricatorUserLog::loadRecentEventsFromThisIP(
	PhabricatorUserLog::ACTION_LOGIN_FAILURE,
	$limit_window);

	// If the same remote address has submitted several failed login attempts
	// recently, require they provide a CAPTCHA response for new attempts.
	$require_captcha = false;
	$captcha_valid = false;
	if (AphrontFormRecaptchaControl::isRecaptchaEnabled()) {
	if (count($failed_attempts) > $captcha_limit) {
	$require_captcha = true;
	$captcha_valid = AphrontFormRecaptchaControl::processCaptcha($request);
	}
	}

	// If the user has submitted quite a few failed login attempts recently,
	// give them a hard limit.
	if (count($failed_attempts) > $hard_limit) {
	$guidance = array();

	$guidance[] = pht(
	'Your remote address has failed too many login attempts recently. '.
	'Wait a few minutes before trying again.');

	$guidance[] = pht(
	'If you are unable to log in to your account, you can '.
	'[[ /login/email \| send a reset link to your email address ]].');

	$guidance = implode("\n\n", $guidance);

	$dialog = $controller->newDialog()
	->setTitle(pht('Too Many Login Attempts'))
	->appendChild(new PHUIRemarkupView($viewer, $guidance))
	->addCancelButton('/auth/start/', pht('Wait Patiently'));

	return array(null, $dialog);
	}

	$response = null;
	$account = null;
	$log_user = null;

	if ($request->isFormPost()) {
	if (!$require_captcha \|\| $captcha_valid) {
	$username_or_email = $request->getStr('username');
	if (strlen($username_or_email)) {
	$user = id(new PhabricatorUser())->loadOneWhere(
	'username = %s',
	$username_or_email);

	if (!$user) {
	$user = PhabricatorUser::loadOneWithEmailAddress(
	$username_or_email);
	}

	if ($user) {
	$envelope = new PhutilOpaqueEnvelope($request->getStr('password'));

	$engine = id(new PhabricatorAuthPasswordEngine())
	->setViewer($user)
	->setContentSource($content_source)
	->setPasswordType(PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT)
	->setObject($user);

	if ($engine->isValidPassword($envelope)) {
	$account = $this->loadOrCreateAccount($user->getPHID());
	$log_user = $user;
	}
	}
	}
	}
	}

	if (!$account) {
	if ($request->isFormPost()) {
	$log = PhabricatorUserLog::initializeNewLog(
	null,
	$log_user ? $log_user->getPHID() : null,
	PhabricatorUserLog::ACTION_LOGIN_FAILURE);
	$log->save();
	}

	$request->clearCookie(PhabricatorCookies::COOKIE_USERNAME);

	$response = $controller->buildProviderPageResponse(
	$this,
	$this->renderPasswordLoginForm(
	$request,
	$require_captcha,
	$captcha_valid));
	}

	return array($account, $response);
	}

	public function shouldRequireRegistrationPassword() {
	return true;
	}

	- public function getDefaultExternalAccount() {
	- $adapter = $this->getAdapter();
	-
	- return id(new PhabricatorExternalAccount())
	- ->setAccountType($adapter->getAdapterType())
	- ->setAccountDomain($adapter->getAdapterDomain());
	- }
	-
	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	parent::willSaveAccount($account);
	$account->setUserPHID($account->getAccountID());
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	parent::willRegisterAccount($account);
	$account->setAccountID($account->getUserPHID());
	}

	public static function getPasswordProvider() {
	$providers = self::getAllEnabledProviders();

	foreach ($providers as $provider) {
	if ($provider instanceof PhabricatorPasswordAuthProvider) {
	return $provider;
	}
	}

	return null;
	}

	public function willRenderLinkedAccount(
	PhabricatorUser $viewer,
	PHUIObjectItemView $item,
	PhabricatorExternalAccount $account) {
	return;
	}

	public function shouldAllowAccountRefresh() {
	return false;
	}

	public function shouldAllowEmailTrustConfiguration() {
	return false;
	}
	}
	diff --git a/src/applications/auth/query/PhabricatorExternalAccountQuery.php b/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	index c4a53c12f8..f67fb4b581 100644
	--- a/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	+++ b/src/applications/auth/query/PhabricatorExternalAccountQuery.php
	@@ -1,171 +1,191 @@
	<?php

	/**
	* NOTE: When loading ExternalAccounts for use in an authentication context
	* (that is, you're going to act as the account or link identities or anything
	* like that) you should require CAN_EDIT capability even if you aren't actually
	* editing the ExternalAccount.
	*
	* ExternalAccounts have a permissive CAN_VIEW policy (like users) because they
	* interact directly with objects and can leave comments, sign documents, etc.
	* However, CAN_EDIT is restricted to users who own the accounts.
	*/
	final class PhabricatorExternalAccountQuery
	extends PhabricatorCursorPagedPolicyAwareQuery {

	private $ids;
	private $phids;
	private $accountTypes;
	private $accountDomains;
	private $accountIDs;
	private $userPHIDs;
	private $needImages;
	private $accountSecrets;

	public function withUserPHIDs(array $user_phids) {
	$this->userPHIDs = $user_phids;
	return $this;
	}

	public function withAccountIDs(array $account_ids) {
	$this->accountIDs = $account_ids;
	return $this;
	}

	public function withAccountDomains(array $account_domains) {
	$this->accountDomains = $account_domains;
	return $this;
	}

	public function withAccountTypes(array $account_types) {
	$this->accountTypes = $account_types;
	return $this;
	}

	public function withPHIDs(array $phids) {
	$this->phids = $phids;
	return $this;
	}

	public function withIDs($ids) {
	$this->ids = $ids;
	return $this;
	}

	public function withAccountSecrets(array $secrets) {
	$this->accountSecrets = $secrets;
	return $this;
	}

	public function needImages($need) {
	$this->needImages = $need;
	return $this;
	}

	public function newResultObject() {
	return new PhabricatorExternalAccount();
	}

	protected function loadPage() {
	return $this->loadStandardPage($this->newResultObject());
	}

	protected function willFilterPage(array $accounts) {
	+ $viewer = $this->getViewer();
	+
	+ $configs = id(new PhabricatorAuthProviderConfigQuery())
	+ ->setViewer($viewer)
	+ ->withPHIDs(mpull($accounts, 'getProviderConfigPHID'))
	+ ->execute();
	+ $configs = mpull($configs, null, 'getPHID');
	+
	+ foreach ($accounts as $key => $account) {
	+ $config_phid = $account->getProviderConfigPHID();
	+ $config = idx($configs, $config_phid);
	+
	+ if (!$config) {
	+ unset($accounts[$key]);
	+ continue;
	+ }
	+
	+ $account->attachProviderConfig($config);
	+ }
	+
	if ($this->needImages) {
	$file_phids = mpull($accounts, 'getProfileImagePHID');
	$file_phids = array_filter($file_phids);

	if ($file_phids) {
	// NOTE: We use the omnipotent viewer here because these files are
	// usually created during registration and can't be associated with
	// the correct policies, since the relevant user account does not exist
	// yet. In effect, if you can see an ExternalAccount, you can see its
	// profile image.
	$files = id(new PhabricatorFileQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withPHIDs($file_phids)
	->execute();
	$files = mpull($files, null, 'getPHID');
	} else {
	$files = array();
	}

	$default_file = null;
	foreach ($accounts as $account) {
	$image_phid = $account->getProfileImagePHID();
	if ($image_phid && isset($files[$image_phid])) {
	$account->attachProfileImageFile($files[$image_phid]);
	} else {
	if ($default_file === null) {
	$default_file = PhabricatorFile::loadBuiltin(
	$this->getViewer(),
	'profile.png');
	}
	$account->attachProfileImageFile($default_file);
	}
	}
	}

	return $accounts;
	}

	protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
	$where = parent::buildWhereClauseParts($conn);

	if ($this->ids !== null) {
	$where[] = qsprintf(
	$conn,
	'id IN (%Ld)',
	$this->ids);
	}

	if ($this->phids !== null) {
	$where[] = qsprintf(
	$conn,
	'phid IN (%Ls)',
	$this->phids);
	}

	if ($this->accountTypes !== null) {
	$where[] = qsprintf(
	$conn,
	'accountType IN (%Ls)',
	$this->accountTypes);
	}

	if ($this->accountDomains !== null) {
	$where[] = qsprintf(
	$conn,
	'accountDomain IN (%Ls)',
	$this->accountDomains);
	}

	if ($this->accountIDs !== null) {
	$where[] = qsprintf(
	$conn,
	'accountID IN (%Ls)',
	$this->accountIDs);
	}

	if ($this->userPHIDs !== null) {
	$where[] = qsprintf(
	$conn,
	'userPHID IN (%Ls)',
	$this->userPHIDs);
	}

	if ($this->accountSecrets !== null) {
	$where[] = qsprintf(
	$conn,
	'accountSecret IN (%Ls)',
	$this->accountSecrets);
	}

	return $where;
	}

	public function getQueryApplicationClass() {
	return 'PhabricatorPeopleApplication';
	}

	}
	diff --git a/src/applications/people/storage/PhabricatorExternalAccount.php b/src/applications/people/storage/PhabricatorExternalAccount.php
	index 4bc0fcae98..bde9588339 100644
	--- a/src/applications/people/storage/PhabricatorExternalAccount.php
	+++ b/src/applications/people/storage/PhabricatorExternalAccount.php
	@@ -1,163 +1,165 @@
	<?php

	final class PhabricatorExternalAccount extends PhabricatorUserDAO
	implements PhabricatorPolicyInterface {

	protected $userPHID;
	protected $accountType;
	protected $accountDomain;
	protected $accountSecret;
	protected $accountID;
	protected $displayName;
	protected $username;
	protected $realName;
	protected $email;
	protected $emailVerified = 0;
	protected $accountURI;
	protected $profileImagePHID;
	protected $properties = array();
	+ protected $providerConfigPHID;

	private $profileImageFile = self::ATTACHABLE;
	+ private $providerConfig = self::ATTACHABLE;

	public function getProfileImageFile() {
	return $this->assertAttached($this->profileImageFile);
	}

	public function attachProfileImageFile(PhabricatorFile $file) {
	$this->profileImageFile = $file;
	return $this;
	}

	public function generatePHID() {
	return PhabricatorPHID::generateNewPHID(
	PhabricatorPeopleExternalPHIDType::TYPECONST);
	}

	protected function getConfiguration() {
	return array(
	self::CONFIG_AUX_PHID => true,
	self::CONFIG_SERIALIZATION => array(
	'properties' => self::SERIALIZATION_JSON,
	),
	self::CONFIG_COLUMN_SCHEMA => array(
	'userPHID' => 'phid?',
	'accountType' => 'text16',
	'accountDomain' => 'text64',
	'accountSecret' => 'text?',
	'accountID' => 'text64',
	'displayName' => 'text255?',
	'username' => 'text255?',
	'realName' => 'text255?',
	'email' => 'text255?',
	'emailVerified' => 'bool',
	'profileImagePHID' => 'phid?',
	'accountURI' => 'text255?',
	),
	self::CONFIG_KEY_SCHEMA => array(
	'account_details' => array(
	'columns' => array('accountType', 'accountDomain', 'accountID'),
	'unique' => true,
	),
	'key_user' => array(
	'columns' => array('userPHID'),
	),
	),
	) + parent::getConfiguration();
	}

	- public function getPhabricatorUser() {
	- $tmp_usr = id(new PhabricatorUser())
	- ->makeEphemeral()
	- ->setPHID($this->getPHID());
	- return $tmp_usr;
	- }
	-
	public function getProviderKey() {
	return $this->getAccountType().':'.$this->getAccountDomain();
	}

	public function save() {
	if (!$this->getAccountSecret()) {
	$this->setAccountSecret(Filesystem::readRandomCharacters(32));
	}
	return parent::save();
	}

	public function setProperty($key, $value) {
	$this->properties[$key] = $value;
	return $this;
	}

	public function getProperty($key, $default = null) {
	return idx($this->properties, $key, $default);
	}

	public function isUsableForLogin() {
	- $key = $this->getProviderKey();
	- $provider = PhabricatorAuthProvider::getEnabledProviderByKey($key);
	-
	- if (!$provider) {
	+ $config = $this->getProviderConfig();
	+ if (!$config->getIsEnabled()) {
	return false;
	}

	+ $provider = $config->getProvider();
	if (!$provider->shouldAllowLogin()) {
	return false;
	}

	return true;
	}

	public function getDisplayName() {
	if (strlen($this->displayName)) {
	return $this->displayName;
	}

	// TODO: Figure out how much identifying information we're going to show
	// to users about external accounts. For now, just show a string which is
	// clearly not an error, but don't disclose any identifying information.

	$map = array(
	'email' => pht('Email User'),
	);

	$type = $this->getAccountType();

	return idx($map, $type, pht('"%s" User', $type));
	}

	+ public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
	+ $this->providerConfig = $config;
	+ return $this;
	+ }
	+
	+ public function getProviderConfig() {
	+ return $this->assertAttached($this->providerConfig);
	+ }


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	);
	}

	public function getPolicy($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return PhabricatorPolicies::getMostOpenPolicy();
	case PhabricatorPolicyCapability::CAN_EDIT:
	return PhabricatorPolicies::POLICY_NOONE;
	}
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	return ($viewer->getPHID() == $this->getUserPHID());
	}

	public function describeAutomaticCapability($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return null;
	case PhabricatorPolicyCapability::CAN_EDIT:
	return pht(
	'External accounts can only be edited by the account owner.');
	}
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Tue, Dec 2, 6:24 PM (10 h, 16 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 432483
Default Alt Text: (64 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions