No OneTemporary
Actions

Size

89 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/applications/conduit/storage/PhabricatorConduitToken.php b/src/applications/conduit/storage/PhabricatorConduitToken.php
	index f5673fdab3..aa836cf623 100644
	--- a/src/applications/conduit/storage/PhabricatorConduitToken.php
	+++ b/src/applications/conduit/storage/PhabricatorConduitToken.php
	@@ -1,165 +1,174 @@
	<?php

	final class PhabricatorConduitToken
	extends PhabricatorConduitDAO
	implements PhabricatorPolicyInterface {

	protected $objectPHID;
	protected $tokenType;
	protected $token;
	protected $expires;

	private $object = self::ATTACHABLE;

	const TYPE_STANDARD = 'api';
	const TYPE_COMMANDLINE = 'cli';
	const TYPE_CLUSTER = 'clr';

	protected function getConfiguration() {
	return array(
	self::CONFIG_COLUMN_SCHEMA => array(
	'tokenType' => 'text32',
	'token' => 'text32',
	'expires' => 'epoch?',
	),
	self::CONFIG_KEY_SCHEMA => array(
	'key_object' => array(
	'columns' => array('objectPHID', 'tokenType'),
	),
	'key_token' => array(
	'columns' => array('token'),
	'unique' => true,
	),
	'key_expires' => array(
	'columns' => array('expires'),
	),
	),
	) + parent::getConfiguration();
	}

	public static function loadClusterTokenForUser(PhabricatorUser $user) {
	if (!$user->isLoggedIn()) {
	return null;
	}

	+ if ($user->hasConduitClusterToken()) {
	+ return $user->getConduitClusterToken();
	+ }
	+
	$tokens = id(new PhabricatorConduitTokenQuery())
	->setViewer($user)
	->withObjectPHIDs(array($user->getPHID()))
	->withTokenTypes(array(self::TYPE_CLUSTER))
	->withExpired(false)
	->execute();

	// Only return a token if it has at least 5 minutes left before
	// expiration. Cluster tokens cycle regularly, so we don't want to use
	// one that's going to expire momentarily.
	$now = PhabricatorTime::getNow();
	$must_expire_after = $now + phutil_units('5 minutes in seconds');

	+ $valid_token = null;
	foreach ($tokens as $token) {
	if ($token->getExpires() > $must_expire_after) {
	- return $token;
	+ $valid_token = $token;
	+ break;
	}
	}

	// We didn't find any existing tokens (or the existing tokens are all about
	// to expire) so generate a new token.
	+ if (!$valid_token) {
	+ $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	+ $valid_token = self::initializeNewToken(
	+ $user->getPHID(),
	+ self::TYPE_CLUSTER);
	+ $valid_token->save();
	+ unset($unguarded);
	+ }

	- $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	- $token = self::initializeNewToken(
	- $user->getPHID(),
	- self::TYPE_CLUSTER);
	- $token->save();
	- unset($unguarded);
	+ $user->attachConduitClusterToken($valid_token);

	- return $token;
	+ return $valid_token;
	}

	public static function initializeNewToken($object_phid, $token_type) {
	$token = new PhabricatorConduitToken();
	$token->objectPHID = $object_phid;
	$token->tokenType = $token_type;
	$token->expires = $token->getTokenExpires($token_type);

	$secret = $token_type.'-'.Filesystem::readRandomCharacters(32);
	$secret = substr($secret, 0, 32);
	$token->token = $secret;

	return $token;
	}

	public static function getTokenTypeName($type) {
	$map = array(
	self::TYPE_STANDARD => pht('Standard API Token'),
	self::TYPE_COMMANDLINE => pht('Command Line API Token'),
	self::TYPE_CLUSTER => pht('Cluster API Token'),
	);

	return idx($map, $type, $type);
	}

	public static function getAllTokenTypes() {
	return array(
	self::TYPE_STANDARD,
	self::TYPE_COMMANDLINE,
	self::TYPE_CLUSTER,
	);
	}

	private function getTokenExpires($token_type) {
	$now = PhabricatorTime::getNow();
	switch ($token_type) {
	case self::TYPE_STANDARD:
	return null;
	case self::TYPE_COMMANDLINE:
	return $now + phutil_units('1 hour in seconds');
	case self::TYPE_CLUSTER:
	return $now + phutil_units('30 minutes in seconds');
	default:
	throw new Exception(
	pht('Unknown Conduit token type "%s"!', $token_type));
	}
	}

	public function getPublicTokenName() {
	switch ($this->getTokenType()) {
	case self::TYPE_CLUSTER:
	return pht('Cluster API Token');
	default:
	return substr($this->getToken(), 0, 8).'...';
	}
	}

	public function getObject() {
	return $this->assertAttached($this->object);
	}

	public function attachObject(PhabricatorUser $object) {
	$this->object = $object;
	return $this;
	}


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	);
	}

	public function getPolicy($capability) {
	return $this->getObject()->getPolicy($capability);
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	return $this->getObject()->hasAutomaticCapability($capability, $viewer);
	}

	public function describeAutomaticCapability($capability) {
	return pht(
	'Conduit tokens inherit the policies of the user they authenticate.');
	}

	}
	diff --git a/src/applications/diffusion/controller/DiffusionController.php b/src/applications/diffusion/controller/DiffusionController.php
	index 14d4f05789..61c17e0877 100644
	--- a/src/applications/diffusion/controller/DiffusionController.php
	+++ b/src/applications/diffusion/controller/DiffusionController.php
	@@ -1,402 +1,414 @@
	<?php

	abstract class DiffusionController extends PhabricatorController {

	private $diffusionRequest;

	protected function getDiffusionRequest() {
	if (!$this->diffusionRequest) {
	throw new PhutilInvalidStateException('loadDiffusionContext');
	}
	return $this->diffusionRequest;
	}

	protected function hasDiffusionRequest() {
	return (bool)$this->diffusionRequest;
	}

	public function willBeginExecution() {
	$request = $this->getRequest();

	// Check if this is a VCS request, e.g. from "git clone", "hg clone", or
	// "svn checkout". If it is, we jump off into repository serving code to
	// process the request.

	$serve_controller = new DiffusionServeController();
	if ($serve_controller->isVCSRequest($request)) {
	return $this->delegateToController($serve_controller);
	}

	return parent::willBeginExecution();
	}

	protected function loadDiffusionContextForEdit() {
	return $this->loadContext(
	array(
	'edit' => true,
	));
	}

	protected function loadDiffusionContext() {
	return $this->loadContext(array());
	}

	private function loadContext(array $options) {
	$request = $this->getRequest();
	$viewer = $this->getViewer();

	$identifier = $this->getRepositoryIdentifierFromRequest($request);

	$params = $options + array(
	'repository' => $identifier,
	'user' => $viewer,
	'blob' => $this->getDiffusionBlobFromRequest($request),
	'commit' => $request->getURIData('commit'),
	'path' => $request->getURIData('path'),
	'line' => $request->getURIData('line'),
	'branch' => $request->getURIData('branch'),
	'lint' => $request->getStr('lint'),
	);

	$drequest = DiffusionRequest::newFromDictionary($params);

	if (!$drequest) {
	return new Aphront404Response();
	}

	// If the client is making a request like "/diffusion/1/...", but the
	// repository has a different canonical path like "/diffusion/XYZ/...",
	// redirect them to the canonical path.

	$request_path = $request->getPath();
	$repository = $drequest->getRepository();

	$canonical_path = $repository->getCanonicalPath($request_path);
	if ($canonical_path !== null) {
	if ($canonical_path != $request_path) {
	return id(new AphrontRedirectResponse())->setURI($canonical_path);
	}
	}

	$this->diffusionRequest = $drequest;

	return null;
	}

	protected function getDiffusionBlobFromRequest(AphrontRequest $request) {
	return $request->getURIData('dblob');
	}

	protected function getRepositoryIdentifierFromRequest(
	AphrontRequest $request) {

	$short_name = $request->getURIData('repositoryShortName');
	if (strlen($short_name)) {
	// If the short name ends in ".git", ignore it.
	$short_name = preg_replace('/\\.git\z/', '', $short_name);
	return $short_name;
	}

	$identifier = $request->getURIData('repositoryCallsign');
	if (strlen($identifier)) {
	return $identifier;
	}

	$id = $request->getURIData('repositoryID');
	if (strlen($id)) {
	return (int)$id;
	}

	return null;
	}

	public function buildCrumbs(array $spec = array()) {
	$crumbs = $this->buildApplicationCrumbs();
	$crumb_list = $this->buildCrumbList($spec);
	foreach ($crumb_list as $crumb) {
	$crumbs->addCrumb($crumb);
	}
	return $crumbs;
	}

	private function buildCrumbList(array $spec = array()) {

	$spec = $spec + array(
	'commit' => null,
	'tags' => null,
	'branches' => null,
	'view' => null,
	);

	$crumb_list = array();

	// On the home page, we don't have a DiffusionRequest.
	if ($this->hasDiffusionRequest()) {
	$drequest = $this->getDiffusionRequest();
	$repository = $drequest->getRepository();
	} else {
	$drequest = null;
	$repository = null;
	}

	if (!$repository) {
	return $crumb_list;
	}

	$repository_name = $repository->getName();

	if (!$spec['commit'] && !$spec['tags'] && !$spec['branches']) {
	$branch_name = $drequest->getBranch();
	if ($branch_name) {
	$repository_name .= ' ('.$branch_name.')';
	}
	}

	$crumb = id(new PHUICrumbView())
	->setName($repository_name);
	if (!$spec['view'] && !$spec['commit'] &&
	!$spec['tags'] && !$spec['branches']) {
	$crumb_list[] = $crumb;
	return $crumb_list;
	}
	$crumb->setHref(
	$drequest->generateURI(
	array(
	'action' => 'branch',
	'path' => '/',
	)));
	$crumb_list[] = $crumb;

	$stable_commit = $drequest->getStableCommit();
	$commit_name = $repository->formatCommitName($stable_commit, $local = true);
	$commit_uri = $repository->getCommitURI($stable_commit);

	if ($spec['tags']) {
	$crumb = new PHUICrumbView();
	if ($spec['commit']) {
	$crumb->setName(pht('Tags for %s', $commit_name));
	$crumb->setHref($commit_uri);
	} else {
	$crumb->setName(pht('Tags'));
	}
	$crumb_list[] = $crumb;
	return $crumb_list;
	}

	if ($spec['branches']) {
	$crumb = id(new PHUICrumbView())
	->setName(pht('Branches'));
	$crumb_list[] = $crumb;
	return $crumb_list;
	}

	if ($spec['commit']) {
	$crumb = id(new PHUICrumbView())
	->setName($commit_name);
	$crumb_list[] = $crumb;
	return $crumb_list;
	}

	$crumb = new PHUICrumbView();
	$view = $spec['view'];

	switch ($view) {
	case 'history':
	$view_name = pht('History');
	break;
	case 'browse':
	$view_name = pht('Browse');
	break;
	case 'lint':
	$view_name = pht('Lint');
	break;
	case 'change':
	$view_name = pht('Change');
	break;
	case 'compare':
	$view_name = pht('Compare');
	break;
	}

	$crumb = id(new PHUICrumbView())
	->setName($view_name);

	$crumb_list[] = $crumb;
	return $crumb_list;
	}

	protected function callConduitWithDiffusionRequest(
	$method,
	array $params = array()) {

	$user = $this->getRequest()->getUser();
	$drequest = $this->getDiffusionRequest();

	return DiffusionQuery::callConduitWithDiffusionRequest(
	$user,
	$drequest,
	$method,
	$params);
	}

	+ protected function callConduitMethod($method, array $params = array()) {
	+ $user = $this->getViewer();
	+ $drequest = $this->getDiffusionRequest();
	+
	+ return DiffusionQuery::callConduitWithDiffusionRequest(
	+ $user,
	+ $drequest,
	+ $method,
	+ $params,
	+ true);
	+ }
	+
	protected function getRepositoryControllerURI(
	PhabricatorRepository $repository,
	$path) {
	return $repository->getPathURI($path);
	}

	protected function renderPathLinks(DiffusionRequest $drequest, $action) {
	$path = $drequest->getPath();
	$path_parts = array_filter(explode('/', trim($path, '/')));

	$divider = phutil_tag(
	'span',
	array(
	'class' => 'phui-header-divider',
	),
	'/');

	$links = array();
	if ($path_parts) {
	$links[] = phutil_tag(
	'a',
	array(
	'href' => $drequest->generateURI(
	array(
	'action' => $action,
	'path' => '',
	)),
	),
	$drequest->getRepository()->getDisplayName());
	$links[] = $divider;
	$accum = '';
	$last_key = last_key($path_parts);
	foreach ($path_parts as $key => $part) {
	$accum .= '/'.$part;
	if ($key === $last_key) {
	$links[] = $part;
	} else {
	$links[] = phutil_tag(
	'a',
	array(
	'href' => $drequest->generateURI(
	array(
	'action' => $action,
	'path' => $accum.'/',
	)),
	),
	$part);
	$links[] = $divider;
	}
	}
	} else {
	$links[] = $drequest->getRepository()->getDisplayName();
	$links[] = $divider;
	}

	return $links;
	}

	protected function renderStatusMessage($title, $body) {
	return id(new PHUIInfoView())
	->setSeverity(PHUIInfoView::SEVERITY_WARNING)
	->setTitle($title)
	->setFlush(true)
	->appendChild($body);
	}

	protected function renderTablePagerBox(PHUIPagerView $pager) {
	return id(new PHUIBoxView())
	->addMargin(PHUI::MARGIN_LARGE)
	->appendChild($pager);
	}

	protected function renderCommitHashTag(DiffusionRequest $drequest) {
	$stable_commit = $drequest->getStableCommit();
	$commit = phutil_tag(
	'a',
	array(
	'href' => $drequest->generateURI(
	array(
	'action' => 'commit',
	'commit' => $stable_commit,
	)),
	),
	$drequest->getRepository()->formatCommitName($stable_commit, true));

	$tag = id(new PHUITagView())
	->setName($commit)
	->setShade('indigo')
	->setType(PHUITagView::TYPE_SHADE);

	return $tag;
	}

	protected function renderDirectoryReadme(DiffusionBrowseResultSet $browse) {
	$readme_path = $browse->getReadmePath();
	if ($readme_path === null) {
	return null;
	}

	$drequest = $this->getDiffusionRequest();
	$viewer = $this->getViewer();
	$repository = $drequest->getRepository();
	$repository_phid = $repository->getPHID();
	$stable_commit = $drequest->getStableCommit();

	$stable_commit_hash = PhabricatorHash::digestForIndex($stable_commit);
	$readme_path_hash = PhabricatorHash::digestForindex($readme_path);

	$cache = PhabricatorCaches::getMutableStructureCache();
	$cache_key = "diffusion".
	".repository({$repository_phid})".
	".commit({$stable_commit_hash})".
	".readme({$readme_path_hash})";

	$readme_cache = $cache->getKey($cache_key);
	if (!$readme_cache) {
	try {
	$result = $this->callConduitWithDiffusionRequest(
	'diffusion.filecontentquery',
	array(
	'path' => $readme_path,
	'commit' => $drequest->getStableCommit(),
	));
	} catch (Exception $ex) {
	return null;
	}

	$file_phid = $result['filePHID'];
	if (!$file_phid) {
	return null;
	}

	$file = id(new PhabricatorFileQuery())
	->setViewer($viewer)
	->withPHIDs(array($file_phid))
	->executeOne();
	if (!$file) {
	return null;
	}

	$corpus = $file->loadFileData();

	$readme_cache = array(
	'corpus' => $corpus,
	);

	$cache->setKey($cache_key, $readme_cache);
	}

	$readme_corpus = $readme_cache['corpus'];
	if (!strlen($readme_corpus)) {
	return null;
	}

	return id(new DiffusionReadmeView())
	->setUser($this->getViewer())
	->setPath($readme_path)
	->setContent($readme_corpus);
	}

	}
	diff --git a/src/applications/diffusion/controller/DiffusionRepositoryController.php b/src/applications/diffusion/controller/DiffusionRepositoryController.php
	index d38ad77787..ae6a656bd2 100644
	--- a/src/applications/diffusion/controller/DiffusionRepositoryController.php
	+++ b/src/applications/diffusion/controller/DiffusionRepositoryController.php
	@@ -1,691 +1,754 @@
	<?php

	final class DiffusionRepositoryController extends DiffusionController {

	+ private $historyFuture;
	+ private $browseFuture;
	+ private $tagFuture;
	+ private $branchFuture;
	+
	public function shouldAllowPublic() {
	return true;
	}

	public function handleRequest(AphrontRequest $request) {
	$response = $this->loadDiffusionContext();
	if ($response) {
	return $response;
	}

	$viewer = $this->getViewer();
	$drequest = $this->getDiffusionRequest();
	$repository = $drequest->getRepository();

	$crumbs = $this->buildCrumbs();
	$crumbs->setBorder(true);

	$header = $this->buildHeaderView($repository);
	$curtain = $this->buildCurtain($repository);
	$property_table = $this->buildPropertiesTable($repository);
	$description = $this->buildDescriptionView($repository);
	$locate_file = $this->buildLocateFile();

	// Before we do any work, make sure we're looking at a some content: we're
	// on a valid branch, and the repository is not empty.
	$page_has_content = false;
	$empty_title = null;
	$empty_message = null;

	// If this VCS supports branches, check that the selected branch actually
	// exists.
	if ($drequest->supportsBranches()) {
	// NOTE: Mercurial may have multiple branch heads with the same name.
	$ref_cursors = id(new PhabricatorRepositoryRefCursorQuery())
	->setViewer($viewer)
	->withRepositoryPHIDs(array($repository->getPHID()))
	->withRefTypes(array(PhabricatorRepositoryRefCursor::TYPE_BRANCH))
	->withRefNames(array($drequest->getBranch()))
	->execute();
	if ($ref_cursors) {
	// This is a valid branch, so we necessarily have some content.
	$page_has_content = true;
	} else {
	$empty_title = pht('No Such Branch');
	$empty_message = pht(
	'There is no branch named "%s" in this repository.',
	$drequest->getBranch());
	}
	}

	// If we didn't find any branches, check if there are any commits at all.
	// This can tailor the message for empty repositories.
	if (!$page_has_content) {
	$any_commit = id(new DiffusionCommitQuery())
	->setViewer($viewer)
	->withRepository($repository)
	->setLimit(1)
	->execute();
	if ($any_commit) {
	if (!$drequest->supportsBranches()) {
	$page_has_content = true;
	}
	} else {
	$empty_title = pht('Empty Repository');
	$empty_message = pht('This repository does not have any commits yet.');
	}
	}

	if ($page_has_content) {
	$content = $this->buildNormalContent($drequest);
	} else {
	$content = id(new PHUIInfoView())
	->setTitle($empty_title)
	->setSeverity(PHUIInfoView::SEVERITY_WARNING)
	->setErrors(array($empty_message));
	}

	$view = id(new PHUITwoColumnView())
	->setHeader($header)
	->setCurtain($curtain)
	->setMainColumn(array(
	$property_table,
	$description,
	$locate_file,
	))
	->setFooter($content);

	return $this->newPage()
	->setTitle(
	array(
	$repository->getName(),
	$repository->getDisplayName(),
	))
	->setCrumbs($crumbs)
	->appendChild(array(
	$view,
	));
	}


	private function buildNormalContent(DiffusionRequest $drequest) {
	$request = $this->getRequest();
	$repository = $drequest->getRepository();

	+ $commit = $drequest->getCommit();
	+ $path = $drequest->getPath();
	+
	+ $this->historyFuture = $this->callConduitMethod(
	+ 'diffusion.historyquery',
	+ array(
	+ 'commit' => $commit,
	+ 'path' => $path,
	+ 'offset' => 0,
	+ 'limit' => 15,
	+ ));
	+
	+ $browse_pager = id(new PHUIPagerView())
	+ ->readFromRequest($request);
	+
	+ $this->browseFuture = $this->callConduitMethod(
	+ 'diffusion.browsequery',
	+ array(
	+ 'commit' => $commit,
	+ 'path' => $path,
	+ 'limit' => $browse_pager->getPageSize() + 1,
	+ ));
	+
	+ if ($this->needTagFuture()) {
	+ $tag_limit = $this->getTagLimit();
	+ $this->tagFuture = $this->callConduitMethod(
	+ 'diffusion.tagsquery',
	+ array(
	+ // On the home page, we want to find tags on any branch.
	+ 'commit' => null,
	+ 'limit' => $tag_limit + 1,
	+ ));
	+ }
	+
	+ if ($this->needBranchFuture()) {
	+ $branch_limit = $this->getBranchLimit();
	+ $this->branchFuture = $this->callConduitMethod(
	+ 'diffusion.branchquery',
	+ array(
	+ 'closed' => false,
	+ 'limit' => $branch_limit + 1,
	+ ));
	+ }
	+
	+ $futures = array(
	+ $this->historyFuture,
	+ $this->browseFuture,
	+ $this->tagFuture,
	+ $this->branchFuture,
	+ );
	+ $futures = array_filter($futures);
	+ $futures = new FutureIterator($futures);
	+ foreach ($futures as $future) {
	+ // Just resolve all the futures before continuing.
	+ }
	+
	$phids = array();
	$content = array();

	try {
	- $history_results = $this->callConduitWithDiffusionRequest(
	- 'diffusion.historyquery',
	- array(
	- 'commit' => $drequest->getCommit(),
	- 'path' => $drequest->getPath(),
	- 'offset' => 0,
	- 'limit' => 15,
	- ));
	+ $history_results = $this->historyFuture->resolve();
	$history = DiffusionPathChange::newFromConduit(
	$history_results['pathChanges']);

	foreach ($history as $item) {
	$data = $item->getCommitData();
	if ($data) {
	if ($data->getCommitDetail('authorPHID')) {
	$phids[$data->getCommitDetail('authorPHID')] = true;
	}
	if ($data->getCommitDetail('committerPHID')) {
	$phids[$data->getCommitDetail('committerPHID')] = true;
	}
	}
	}
	$history_exception = null;
	} catch (Exception $ex) {
	$history_results = null;
	$history = null;
	$history_exception = $ex;
	}

	- $browse_pager = id(new PHUIPagerView())
	- ->readFromRequest($request);
	-
	try {
	+ $browse_results = $this->browseFuture->resolve();
	$browse_results = DiffusionBrowseResultSet::newFromConduit(
	- $this->callConduitWithDiffusionRequest(
	- 'diffusion.browsequery',
	- array(
	- 'path' => $drequest->getPath(),
	- 'commit' => $drequest->getCommit(),
	- 'limit' => $browse_pager->getPageSize() + 1,
	- )));
	+ $browse_results);
	+
	$browse_paths = $browse_results->getPaths();
	$browse_paths = $browse_pager->sliceResults($browse_paths);

	foreach ($browse_paths as $item) {
	$data = $item->getLastCommitData();
	if ($data) {
	if ($data->getCommitDetail('authorPHID')) {
	$phids[$data->getCommitDetail('authorPHID')] = true;
	}
	if ($data->getCommitDetail('committerPHID')) {
	$phids[$data->getCommitDetail('committerPHID')] = true;
	}
	}
	}

	$browse_exception = null;
	} catch (Exception $ex) {
	$browse_results = null;
	$browse_paths = null;
	$browse_exception = $ex;
	}

	$phids = array_keys($phids);
	$handles = $this->loadViewerHandles($phids);

	if ($browse_results) {
	$readme = $this->renderDirectoryReadme($browse_results);
	} else {
	$readme = null;
	}

	$content[] = $this->buildBrowseTable(
	$browse_results,
	$browse_paths,
	$browse_exception,
	$handles,
	$browse_pager);

	$content[] = $this->buildHistoryTable(
	$history_results,
	$history,
	$history_exception);

	try {
	$content[] = $this->buildTagListTable($drequest);
	} catch (Exception $ex) {
	if (!$repository->isImporting()) {
	$content[] = $this->renderStatusMessage(
	pht('Unable to Load Tags'),
	$ex->getMessage());
	}
	}

	try {
	$content[] = $this->buildBranchListTable($drequest);
	} catch (Exception $ex) {
	if (!$repository->isImporting()) {
	$content[] = $this->renderStatusMessage(
	pht('Unable to Load Branches'),
	$ex->getMessage());
	}
	}

	if ($readme) {
	$content[] = $readme;
	}

	return $content;
	}

	private function buildHeaderView(PhabricatorRepository $repository) {
	$viewer = $this->getViewer();
	$header = id(new PHUIHeaderView())
	->setHeader($repository->getName())
	->setUser($viewer)
	->setPolicyObject($repository)
	->setHeaderIcon('fa-code');

	if (!$repository->isTracked()) {
	$header->setStatus('fa-ban', 'dark', pht('Inactive'));
	} else if ($repository->isImporting()) {
	$ratio = $repository->loadImportProgress();
	$percentage = sprintf('%.2f%%', 100 * $ratio);
	$header->setStatus(
	'fa-clock-o',
	'indigo',
	pht('Importing (%s)...', $percentage));
	} else {
	$header->setStatus('fa-check', 'bluegrey', pht('Active'));
	}

	return $header;
	}

	private function buildCurtain(PhabricatorRepository $repository) {
	$viewer = $this->getViewer();

	$edit_uri = $repository->getPathURI('manage/');
	$curtain = $this->newCurtainView($repository);

	$curtain->addAction(
	id(new PhabricatorActionView())
	->setName(pht('Manage Repository'))
	->setIcon('fa-cogs')
	->setHref($edit_uri));

	if ($repository->isHosted()) {
	$push_uri = $this->getApplicationURI(
	'pushlog/?repositories='.$repository->getMonogram());

	$curtain->addAction(
	id(new PhabricatorActionView())
	->setName(pht('View Push Logs'))
	->setIcon('fa-list-alt')
	->setHref($push_uri));
	}

	return $curtain;
	}

	private function buildDescriptionView(PhabricatorRepository $repository) {
	$viewer = $this->getViewer();
	$view = id(new PHUIPropertyListView())
	->setUser($viewer);

	$description = $repository->getDetail('description');
	if (strlen($description)) {
	$description = new PHUIRemarkupView($viewer, $description);
	$view->addTextContent($description);
	return id(new PHUIObjectBoxView())
	->setHeaderText(pht('Description'))
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
	->appendChild($view);
	}
	return null;
	}

	private function buildPropertiesTable(PhabricatorRepository $repository) {
	$viewer = $this->getViewer();

	$view = id(new PHUIPropertyListView())
	->setUser($viewer);

	$display_never = PhabricatorRepositoryURI::DISPLAY_NEVER;

	$uris = $repository->getURIs();
	foreach ($uris as $uri) {
	if ($uri->getIsDisabled()) {
	continue;
	}

	if ($uri->getEffectiveDisplayType() == $display_never) {
	continue;
	}

	if ($repository->isSVN()) {
	$label = pht('Checkout');
	} else {
	$label = pht('Clone');
	}

	$view->addProperty(
	$label,
	$this->renderCloneURI($repository, $uri));
	}

	$box = id(new PHUIObjectBoxView())
	->setHeaderText(pht('Details'))
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
	->appendChild($view);

	$info = null;
	$drequest = $this->getDiffusionRequest();

	// Try to load alternatives. This may fail for repositories which have not
	// cloned yet. If it does, just ignore it and continue.
	try {
	$alternatives = $drequest->getRefAlternatives();
	} catch (ConduitClientException $ex) {
	$alternatives = array();
	}

	if ($alternatives) {
	$message = array(
	pht(
	'The ref "%s" is ambiguous in this repository.',
	$drequest->getBranch()),
	' ',
	phutil_tag(
	'a',
	array(
	'href' => $drequest->generateURI(
	array(
	'action' => 'refs',
	)),
	),
	pht('View Alternatives')),
	);

	$messages = array($message);

	$info = id(new PHUIInfoView())
	->setSeverity(PHUIInfoView::SEVERITY_WARNING)
	->setErrors(array($message));

	$box->setInfoView($info);
	}


	return $box;
	}

	private function buildBranchListTable(DiffusionRequest $drequest) {
	$viewer = $this->getViewer();

	- if ($drequest->getBranch() === null) {
	+ if (!$this->needBranchFuture()) {
	return null;
	}

	- $limit = 15;
	-
	- $branches = $this->callConduitWithDiffusionRequest(
	- 'diffusion.branchquery',
	- array(
	- 'closed' => false,
	- 'limit' => $limit + 1,
	- ));
	+ $branches = $this->branchFuture->resolve();
	if (!$branches) {
	return null;
	}

	+ $limit = $this->getBranchLimit();
	$more_branches = (count($branches) > $limit);
	$branches = array_slice($branches, 0, $limit);

	$branches = DiffusionRepositoryRef::loadAllFromDictionaries($branches);

	$commits = id(new DiffusionCommitQuery())
	->setViewer($viewer)
	->withIdentifiers(mpull($branches, 'getCommitIdentifier'))
	->withRepository($drequest->getRepository())
	->execute();

	$table = id(new DiffusionBranchTableView())
	->setUser($viewer)
	->setDiffusionRequest($drequest)
	->setBranches($branches)
	->setCommits($commits);

	$panel = id(new PHUIObjectBoxView())
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
	$header = new PHUIHeaderView();
	$header->setHeader(pht('Branches'));

	if ($more_branches) {
	$header->setSubHeader(pht('Showing %d branches.', $limit));
	}

	$button = new PHUIButtonView();
	$button->setText(pht('Show All'));
	$button->setTag('a');
	$button->setIcon('fa-code-fork');
	$button->setHref($drequest->generateURI(
	array(
	'action' => 'branches',
	)));

	$header->addActionLink($button);
	$panel->setHeader($header);
	$panel->setTable($table);

	return $panel;
	}

	private function buildTagListTable(DiffusionRequest $drequest) {
	$viewer = $this->getViewer();
	$repository = $drequest->getRepository();

	- switch ($repository->getVersionControlSystem()) {
	- case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
	- // no tags in SVN
	- return null;
	+ if (!$this->needTagFuture()) {
	+ return null;
	}
	- $tag_limit = 15;
	- $tags = array();
	- $tags = DiffusionRepositoryTag::newFromConduit(
	- $this->callConduitWithDiffusionRequest(
	- 'diffusion.tagsquery',
	- array(
	- // On the home page, we want to find tags on any branch.
	- 'commit' => null,
	- 'limit' => $tag_limit + 1,
	- )));

	+ $tags = $this->tagFuture->resolve();
	+ $tags = DiffusionRepositoryTag::newFromConduit($tags);
	if (!$tags) {
	return null;
	}

	+ $tag_limit = $this->getTagLimit();
	$more_tags = (count($tags) > $tag_limit);
	$tags = array_slice($tags, 0, $tag_limit);

	$commits = id(new DiffusionCommitQuery())
	->setViewer($viewer)
	->withIdentifiers(mpull($tags, 'getCommitIdentifier'))
	->withRepository($repository)
	->needCommitData(true)
	->execute();

	$view = id(new DiffusionTagListView())
	->setUser($viewer)
	->setDiffusionRequest($drequest)
	->setTags($tags)
	->setCommits($commits);

	$phids = $view->getRequiredHandlePHIDs();
	$handles = $this->loadViewerHandles($phids);
	$view->setHandles($handles);

	$panel = new PHUIObjectBoxView();
	$header = new PHUIHeaderView();
	$header->setHeader(pht('Tags'));

	if ($more_tags) {
	$header->setSubHeader(
	pht('Showing the %d most recent tags.', $tag_limit));
	}

	$button = new PHUIButtonView();
	$button->setText(pht('Show All Tags'));
	$button->setTag('a');
	$button->setIcon('fa-tag');
	$button->setHref($drequest->generateURI(
	array(
	'action' => 'tags',
	)));

	$header->addActionLink($button);

	$panel->setHeader($header);
	$panel->setTable($view);
	$panel->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);

	return $panel;
	}

	private function buildHistoryTable(
	$history_results,
	$history,
	$history_exception) {

	$request = $this->getRequest();
	$viewer = $request->getUser();
	$drequest = $this->getDiffusionRequest();
	$repository = $drequest->getRepository();

	if ($history_exception) {
	if ($repository->isImporting()) {
	return $this->renderStatusMessage(
	pht('Still Importing...'),
	pht(
	'This repository is still importing. History is not yet '.
	'available.'));
	} else {
	return $this->renderStatusMessage(
	pht('Unable to Retrieve History'),
	$history_exception->getMessage());
	}
	}

	$history_table = id(new DiffusionHistoryTableView())
	->setUser($viewer)
	->setDiffusionRequest($drequest)
	->setHistory($history);

	// TODO: Super sketchy.
	$history_table->loadRevisions();

	if ($history_results) {
	$history_table->setParents($history_results['parents']);
	}

	$history_table->setIsHead(true);

	$icon = id(new PHUIIconView())
	->setIcon('fa-list-alt');

	$button = id(new PHUIButtonView())
	->setText(pht('View History'))
	->setHref($drequest->generateURI(
	array(
	'action' => 'history',
	)))
	->setTag('a')
	->setIcon($icon);

	$panel = id(new PHUIObjectBoxView())
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
	$header = id(new PHUIHeaderView())
	->setHeader(pht('Recent Commits'))
	->addActionLink($button);
	$panel->setHeader($header);
	$panel->setTable($history_table);

	return $panel;
	}

	private function buildLocateFile() {
	$request = $this->getRequest();
	$viewer = $request->getUser();
	$drequest = $this->getDiffusionRequest();
	$repository = $drequest->getRepository();

	$locate_panel = null;
	if ($repository->canUsePathTree()) {
	Javelin::initBehavior(
	'diffusion-locate-file',
	array(
	'controlID' => 'locate-control',
	'inputID' => 'locate-input',
	'browseBaseURI' => (string)$drequest->generateURI(
	array(
	'action' => 'browse',
	)),
	'uri' => (string)$drequest->generateURI(
	array(
	'action' => 'pathtree',
	)),
	));

	$form = id(new AphrontFormView())
	->setUser($viewer)
	->appendChild(
	id(new AphrontFormTypeaheadControl())
	->setHardpointID('locate-control')
	->setID('locate-input')
	->setLabel(pht('Locate File')));
	$form_box = id(new PHUIBoxView())
	->appendChild($form->buildLayoutView());
	$locate_panel = id(new PHUIObjectBoxView())
	->setHeaderText(pht('Locate File'))
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
	->appendChild($form_box);
	}
	return $locate_panel;
	}

	private function buildBrowseTable(
	$browse_results,
	$browse_paths,
	$browse_exception,
	array $handles,
	PHUIPagerView $pager) {

	require_celerity_resource('diffusion-icons-css');

	$request = $this->getRequest();
	$viewer = $request->getUser();
	$drequest = $this->getDiffusionRequest();
	$repository = $drequest->getRepository();

	if ($browse_exception) {
	if ($repository->isImporting()) {
	// The history table renders a useful message.
	return null;
	} else {
	return $this->renderStatusMessage(
	pht('Unable to Retrieve Paths'),
	$browse_exception->getMessage());
	}
	}

	$browse_table = id(new DiffusionBrowseTableView())
	->setUser($viewer)
	->setDiffusionRequest($drequest)
	->setHandles($handles);
	if ($browse_paths) {
	$browse_table->setPaths($browse_paths);
	} else {
	$browse_table->setPaths(array());
	}

	$browse_uri = $drequest->generateURI(array('action' => 'browse'));

	$browse_panel = id(new PHUIObjectBoxView())
	->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
	$header = id(new PHUIHeaderView())
	->setHeader($repository->getName());

	$icon = id(new PHUIIconView())
	->setIcon('fa-folder-open');

	$button = new PHUIButtonView();
	$button->setText(pht('Browse Repository'));
	$button->setTag('a');
	$button->setIcon($icon);
	$button->setHref($browse_uri);

	$header->addActionLink($button);
	$browse_panel->setHeader($header);
	$browse_panel->setTable($browse_table);

	$pager->setURI($browse_uri, 'offset');

	if ($pager->willShowPagingControls()) {
	$pager_box = $this->renderTablePagerBox($pager);
	} else {
	$pager_box = null;
	}

	return array(
	$browse_panel,
	$pager_box,
	);
	}

	private function renderCloneURI(
	PhabricatorRepository $repository,
	PhabricatorRepositoryURI $uri) {

	if ($repository->isSVN()) {
	$display = csprintf(
	'svn checkout %R %R',
	(string)$uri->getDisplayURI(),
	$repository->getCloneName());
	} else {
	$display = csprintf('%R', (string)$uri->getDisplayURI());
	}

	$display = (string)$display;
	$viewer = $this->getViewer();

	return id(new DiffusionCloneURIView())
	->setViewer($viewer)
	->setRepository($repository)
	->setRepositoryURI($uri)
	->setDisplayURI($display);
	}

	+ private function needTagFuture() {
	+ $drequest = $this->getDiffusionRequest();
	+ $repository = $drequest->getRepository();
	+
	+ switch ($repository->getVersionControlSystem()) {
	+ case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
	+ // No tags in SVN.
	+ return false;
	+ }
	+
	+ return true;
	+ }
	+
	+ private function getTagLimit() {
	+ return 15;
	+ }
	+
	+ private function needBranchFuture() {
	+ $drequest = $this->getDiffusionRequest();
	+
	+ if ($drequest->getBranch() === null) {
	+ return false;
	+ }
	+
	+ return true;
	+ }
	+
	+ private function getBranchLimit() {
	+ return 15;
	+ }
	+
	}
	diff --git a/src/applications/diffusion/query/DiffusionQuery.php b/src/applications/diffusion/query/DiffusionQuery.php
	index 409bf68980..6675197932 100644
	--- a/src/applications/diffusion/query/DiffusionQuery.php
	+++ b/src/applications/diffusion/query/DiffusionQuery.php
	@@ -1,217 +1,225 @@
	<?php

	abstract class DiffusionQuery extends PhabricatorQuery {

	private $request;

	final protected function __construct() {
	// <protected>
	}

	protected static function newQueryObject(
	$base_class,
	DiffusionRequest $request) {

	$repository = $request->getRepository();

	$obj = self::initQueryObject($base_class, $repository);
	$obj->request = $request;

	return $obj;
	}

	final protected static function initQueryObject(
	$base_class,
	PhabricatorRepository $repository) {

	$map = array(
	PhabricatorRepositoryType::REPOSITORY_TYPE_GIT => 'Git',
	PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL => 'Mercurial',
	PhabricatorRepositoryType::REPOSITORY_TYPE_SVN => 'Svn',
	);

	$name = idx($map, $repository->getVersionControlSystem());
	if (!$name) {
	throw new Exception(pht('Unsupported VCS!'));
	}

	$class = str_replace('Diffusion', 'Diffusion'.$name, $base_class);
	$obj = new $class();
	return $obj;
	}

	final protected function getRequest() {
	return $this->request;
	}

	final public static function callConduitWithDiffusionRequest(
	PhabricatorUser $user,
	DiffusionRequest $drequest,
	$method,
	- array $params = array()) {
	+ array $params = array(),
	+ $return_future = false) {

	$repository = $drequest->getRepository();

	$core_params = array(
	'repository' => $repository->getPHID(),
	);

	if ($drequest->getBranch() !== null) {
	$core_params['branch'] = $drequest->getBranch();
	}

	// If the method we're calling doesn't actually take some of the implicit
	// parameters we derive from the DiffusionRequest, omit them.
	$method_object = ConduitAPIMethod::getConduitMethod($method);
	$method_params = $method_object->getParamTypes();
	foreach ($core_params as $key => $value) {
	if (empty($method_params[$key])) {
	unset($core_params[$key]);
	}
	}

	$params = $params + $core_params;

	$client = $repository->newConduitClient(
	$user,
	$drequest->getIsClusterRequest());
	if (!$client) {
	- return id(new ConduitCall($method, $params))
	+ $result = id(new ConduitCall($method, $params))
	->setUser($user)
	->execute();
	+ $future = new ImmediateFuture($result);
	} else {
	- return $client->callMethodSynchronous($method, $params);
	+ $future = $client->callMethod($method, $params);
	}
	+
	+ if (!$return_future) {
	+ return $future->resolve();
	+ }
	+
	+ return $future;
	}

	public function execute() {
	return $this->executeQuery();
	}

	abstract protected function executeQuery();


	/* -( Query Utilities )---------------------------------------------------- */


	final public static function loadCommitsByIdentifiers(
	array $identifiers,
	DiffusionRequest $drequest) {
	if (!$identifiers) {
	return array();
	}

	$commits = array();
	$commit_data = array();

	$repository = $drequest->getRepository();

	$commits = id(new PhabricatorRepositoryCommit())->loadAllWhere(
	'repositoryID = %d AND commitIdentifier IN (%Ls)',
	$repository->getID(),
	$identifiers);
	$commits = mpull($commits, null, 'getCommitIdentifier');

	// Build empty commit objects for every commit, so we can show unparsed
	// commits in history views (as "Importing") instead of not showing them.
	// This makes the process of importing and parsing commits clearer to the
	// user.

	$commit_list = array();
	foreach ($identifiers as $identifier) {
	$commit_obj = idx($commits, $identifier);
	if (!$commit_obj) {
	$commit_obj = new PhabricatorRepositoryCommit();
	$commit_obj->setRepositoryID($repository->getID());
	$commit_obj->setCommitIdentifier($identifier);
	$commit_obj->makeEphemeral();
	}
	$commit_list[$identifier] = $commit_obj;
	}
	$commits = $commit_list;

	$commit_ids = array_filter(mpull($commits, 'getID'));
	if ($commit_ids) {
	$commit_data = id(new PhabricatorRepositoryCommitData())->loadAllWhere(
	'commitID in (%Ld)',
	$commit_ids);
	$commit_data = mpull($commit_data, null, 'getCommitID');
	}

	foreach ($commits as $commit) {
	if (!$commit->getID()) {
	continue;
	}
	if (idx($commit_data, $commit->getID())) {
	$commit->attachCommitData($commit_data[$commit->getID()]);
	}
	}

	return $commits;
	}

	final public static function loadHistoryForCommitIdentifiers(
	array $identifiers,
	DiffusionRequest $drequest) {

	if (!$identifiers) {
	return array();
	}

	$repository = $drequest->getRepository();
	$commits = self::loadCommitsByIdentifiers($identifiers, $drequest);

	if (!$commits) {
	return array();
	}

	$path = $drequest->getPath();

	$conn_r = $repository->establishConnection('r');

	$path_normal = DiffusionPathIDQuery::normalizePath($path);
	$paths = queryfx_all(
	$conn_r,
	'SELECT id, path FROM %T WHERE pathHash IN (%Ls)',
	PhabricatorRepository::TABLE_PATH,
	array(md5($path_normal)));
	$paths = ipull($paths, 'id', 'path');
	$path_id = idx($paths, $path_normal);

	$commit_ids = array_filter(mpull($commits, 'getID'));

	$path_changes = array();
	if ($path_id && $commit_ids) {
	$path_changes = queryfx_all(
	$conn_r,
	'SELECT * FROM %T WHERE commitID IN (%Ld) AND pathID = %d',
	PhabricatorRepository::TABLE_PATHCHANGE,
	$commit_ids,
	$path_id);
	$path_changes = ipull($path_changes, null, 'commitID');
	}

	$history = array();
	foreach ($identifiers as $identifier) {
	$item = new DiffusionPathChange();
	$item->setCommitIdentifier($identifier);
	$commit = idx($commits, $identifier);
	if ($commit) {
	$item->setCommit($commit);
	try {
	$item->setCommitData($commit->getCommitData());
	} catch (Exception $ex) {
	// Ignore, commit just doesn't have data.
	}
	$change = idx($path_changes, $commit->getID());
	if ($change) {
	$item->setChangeType($change['changeType']);
	$item->setFileType($change['fileType']);
	}
	}
	$history[] = $item;
	}

	return $history;
	}
	}
	diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
	index b30f3cac13..61b2209c24 100644
	--- a/src/applications/people/storage/PhabricatorUser.php
	+++ b/src/applications/people/storage/PhabricatorUser.php
	@@ -1,1543 +1,1557 @@
	<?php

	/**
	* @task availability Availability
	* @task image-cache Profile Image Cache
	* @task factors Multi-Factor Authentication
	* @task handles Managing Handles
	* @task settings Settings
	* @task cache User Cache
	*/
	final class PhabricatorUser
	extends PhabricatorUserDAO
	implements
	PhutilPerson,
	PhabricatorPolicyInterface,
	PhabricatorCustomFieldInterface,
	PhabricatorDestructibleInterface,
	PhabricatorSSHPublicKeyInterface,
	PhabricatorFlaggableInterface,
	PhabricatorApplicationTransactionInterface,
	PhabricatorFulltextInterface,
	PhabricatorConduitResultInterface {

	const SESSION_TABLE = 'phabricator_session';
	const NAMETOKEN_TABLE = 'user_nametoken';
	const MAXIMUM_USERNAME_LENGTH = 64;

	protected $userName;
	protected $realName;
	protected $passwordSalt;
	protected $passwordHash;
	protected $profileImagePHID;
	protected $availabilityCache;
	protected $availabilityCacheTTL;

	protected $conduitCertificate;

	protected $isSystemAgent = 0;
	protected $isMailingList = 0;
	protected $isAdmin = 0;
	protected $isDisabled = 0;
	protected $isEmailVerified = 0;
	protected $isApproved = 0;
	protected $isEnrolledInMultiFactor = 0;

	protected $accountSecret;

	private $profile = null;
	private $availability = self::ATTACHABLE;
	private $preferences = null;
	private $omnipotent = false;
	private $customFields = self::ATTACHABLE;
	private $badgePHIDs = self::ATTACHABLE;

	private $alternateCSRFString = self::ATTACHABLE;
	private $session = self::ATTACHABLE;
	private $rawCacheData = array();
	private $usableCacheData = array();

	private $authorities = array();
	private $handlePool;
	private $csrfSalt;

	private $settingCacheKeys = array();
	private $settingCache = array();
	private $allowInlineCacheGeneration;
	+ private $conduitClusterToken = self::ATTACHABLE;

	protected function readField($field) {
	switch ($field) {
	// Make sure these return booleans.
	case 'isAdmin':
	return (bool)$this->isAdmin;
	case 'isDisabled':
	return (bool)$this->isDisabled;
	case 'isSystemAgent':
	return (bool)$this->isSystemAgent;
	case 'isMailingList':
	return (bool)$this->isMailingList;
	case 'isEmailVerified':
	return (bool)$this->isEmailVerified;
	case 'isApproved':
	return (bool)$this->isApproved;
	default:
	return parent::readField($field);
	}
	}


	/**
	* Is this a live account which has passed required approvals? Returns true
	* if this is an enabled, verified (if required), approved (if required)
	* account, and false otherwise.
	*
	* @return bool True if this is a standard, usable account.
	*/
	public function isUserActivated() {
	if (!$this->isLoggedIn()) {
	return false;
	}

	if ($this->isOmnipotent()) {
	return true;
	}

	if ($this->getIsDisabled()) {
	return false;
	}

	if (!$this->getIsApproved()) {
	return false;
	}

	if (PhabricatorUserEmail::isEmailVerificationRequired()) {
	if (!$this->getIsEmailVerified()) {
	return false;
	}
	}

	return true;
	}

	public function canEstablishWebSessions() {
	if ($this->getIsMailingList()) {
	return false;
	}

	if ($this->getIsSystemAgent()) {
	return false;
	}

	return true;
	}

	public function canEstablishAPISessions() {
	if ($this->getIsDisabled()) {
	return false;
	}

	// Intracluster requests are permitted even if the user is logged out:
	// in particular, public users are allowed to issue intracluster requests
	// when browsing Diffusion.
	if (PhabricatorEnv::isClusterRemoteAddress()) {
	if (!$this->isLoggedIn()) {
	return true;
	}
	}

	if (!$this->isUserActivated()) {
	return false;
	}

	if ($this->getIsMailingList()) {
	return false;
	}

	return true;
	}

	public function canEstablishSSHSessions() {
	if (!$this->isUserActivated()) {
	return false;
	}

	if ($this->getIsMailingList()) {
	return false;
	}

	return true;
	}

	/**
	* Returns `true` if this is a standard user who is logged in. Returns `false`
	* for logged out, anonymous, or external users.
	*
	* @return bool `true` if the user is a standard user who is logged in with
	* a normal session.
	*/
	public function getIsStandardUser() {
	$type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
	return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
	}

	protected function getConfiguration() {
	return array(
	self::CONFIG_AUX_PHID => true,
	self::CONFIG_COLUMN_SCHEMA => array(
	'userName' => 'sort64',
	'realName' => 'text128',
	'passwordSalt' => 'text32?',
	'passwordHash' => 'text128?',
	'profileImagePHID' => 'phid?',
	'conduitCertificate' => 'text255',
	'isSystemAgent' => 'bool',
	'isMailingList' => 'bool',
	'isDisabled' => 'bool',
	'isAdmin' => 'bool',
	'isEmailVerified' => 'uint32',
	'isApproved' => 'uint32',
	'accountSecret' => 'bytes64',
	'isEnrolledInMultiFactor' => 'bool',
	'availabilityCache' => 'text255?',
	'availabilityCacheTTL' => 'uint32?',
	),
	self::CONFIG_KEY_SCHEMA => array(
	'key_phid' => null,
	'phid' => array(
	'columns' => array('phid'),
	'unique' => true,
	),
	'userName' => array(
	'columns' => array('userName'),
	'unique' => true,
	),
	'realName' => array(
	'columns' => array('realName'),
	),
	'key_approved' => array(
	'columns' => array('isApproved'),
	),
	),
	self::CONFIG_NO_MUTATE => array(
	'availabilityCache' => true,
	'availabilityCacheTTL' => true,
	),
	) + parent::getConfiguration();
	}

	public function generatePHID() {
	return PhabricatorPHID::generateNewPHID(
	PhabricatorPeopleUserPHIDType::TYPECONST);
	}

	public function setPassword(PhutilOpaqueEnvelope $envelope) {
	if (!$this->getPHID()) {
	throw new Exception(
	pht(
	'You can not set a password for an unsaved user because their PHID '.
	'is a salt component in the password hash.'));
	}

	if (!strlen($envelope->openEnvelope())) {
	$this->setPasswordHash('');
	} else {
	$this->setPasswordSalt(md5(Filesystem::readRandomBytes(32)));
	$hash = $this->hashPassword($envelope);
	$this->setPasswordHash($hash->openEnvelope());
	}
	return $this;
	}

	public function getMonogram() {
	return '@'.$this->getUsername();
	}

	public function isLoggedIn() {
	return !($this->getPHID() === null);
	}

	public function save() {
	if (!$this->getConduitCertificate()) {
	$this->setConduitCertificate($this->generateConduitCertificate());
	}

	if (!strlen($this->getAccountSecret())) {
	$this->setAccountSecret(Filesystem::readRandomCharacters(64));
	}

	$result = parent::save();

	if ($this->profile) {
	$this->profile->save();
	}

	$this->updateNameTokens();

	PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());

	return $result;
	}

	public function attachSession(PhabricatorAuthSession $session) {
	$this->session = $session;
	return $this;
	}

	public function getSession() {
	return $this->assertAttached($this->session);
	}

	public function hasSession() {
	return ($this->session !== self::ATTACHABLE);
	}

	private function generateConduitCertificate() {
	return Filesystem::readRandomCharacters(255);
	}

	public function comparePassword(PhutilOpaqueEnvelope $envelope) {
	if (!strlen($envelope->openEnvelope())) {
	return false;
	}
	if (!strlen($this->getPasswordHash())) {
	return false;
	}

	return PhabricatorPasswordHasher::comparePassword(
	$this->getPasswordHashInput($envelope),
	new PhutilOpaqueEnvelope($this->getPasswordHash()));
	}

	private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
	$input =
	$this->getUsername().
	$password->openEnvelope().
	$this->getPHID().
	$this->getPasswordSalt();

	return new PhutilOpaqueEnvelope($input);
	}

	private function hashPassword(PhutilOpaqueEnvelope $password) {
	$hasher = PhabricatorPasswordHasher::getBestHasher();

	$input_envelope = $this->getPasswordHashInput($password);
	return $hasher->getPasswordHashForStorage($input_envelope);
	}

	const CSRF_CYCLE_FREQUENCY = 3600;
	const CSRF_SALT_LENGTH = 8;
	const CSRF_TOKEN_LENGTH = 16;
	const CSRF_BREACH_PREFIX = 'B@';

	const EMAIL_CYCLE_FREQUENCY = 86400;
	const EMAIL_TOKEN_LENGTH = 24;

	private function getRawCSRFToken($offset = 0) {
	return $this->generateToken(
	time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
	self::CSRF_CYCLE_FREQUENCY,
	PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
	self::CSRF_TOKEN_LENGTH);
	}

	public function getCSRFToken() {
	if ($this->isOmnipotent()) {
	// We may end up here when called from the daemons. The omnipotent user
	// has no meaningful CSRF token, so just return `null`.
	return null;
	}

	if ($this->csrfSalt === null) {
	$this->csrfSalt = Filesystem::readRandomCharacters(
	self::CSRF_SALT_LENGTH);
	}

	$salt = $this->csrfSalt;

	// Generate a token hash to mitigate BREACH attacks against SSL. See
	// discussion in T3684.
	$token = $this->getRawCSRFToken();
	$hash = PhabricatorHash::digest($token, $salt);
	return self::CSRF_BREACH_PREFIX.$salt.substr(
	$hash, 0, self::CSRF_TOKEN_LENGTH);
	}

	public function validateCSRFToken($token) {
	// We expect a BREACH-mitigating token. See T3684.
	$breach_prefix = self::CSRF_BREACH_PREFIX;
	$breach_prelen = strlen($breach_prefix);
	if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
	return false;
	}

	$salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
	$token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);

	// When the user posts a form, we check that it contains a valid CSRF token.
	// Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
	// either the current token, the next token (users can submit a "future"
	// token if you have two web frontends that have some clock skew) or any of
	// the last 6 tokens. This means that pages are valid for up to 7 hours.
	// There is also some Javascript which periodically refreshes the CSRF
	// tokens on each page, so theoretically pages should be valid indefinitely.
	// However, this code may fail to run (if the user loses their internet
	// connection, or there's a JS problem, or they don't have JS enabled).
	// Choosing the size of the window in which we accept old CSRF tokens is
	// an issue of balancing concerns between security and usability. We could
	// choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
	// attacks using captured CSRF tokens, but it's also more likely that real
	// users will be affected by this, e.g. if they close their laptop for an
	// hour, open it back up, and try to submit a form before the CSRF refresh
	// can kick in. Since the user experience of submitting a form with expired
	// CSRF is often quite bad (you basically lose data, or it's a big pain to
	// recover at least) and I believe we gain little additional protection
	// by keeping the window very short (the overwhelming value here is in
	// preventing blind attacks, and most attacks which can capture CSRF tokens
	// can also just capture authentication information [sniffing networks]
	// or act as the user [xss]) the 7 hour default seems like a reasonable
	// balance. Other major platforms have much longer CSRF token lifetimes,
	// like Rails (session duration) and Django (forever), which suggests this
	// is a reasonable analysis.
	$csrf_window = 6;

	for ($ii = -$csrf_window; $ii <= 1; $ii++) {
	$valid = $this->getRawCSRFToken($ii);

	$digest = PhabricatorHash::digest($valid, $salt);
	$digest = substr($digest, 0, self::CSRF_TOKEN_LENGTH);
	if (phutil_hashes_are_identical($digest, $token)) {
	return true;
	}
	}

	return false;
	}

	private function generateToken($epoch, $frequency, $key, $len) {
	if ($this->getPHID()) {
	$vec = $this->getPHID().$this->getAccountSecret();
	} else {
	$vec = $this->getAlternateCSRFString();
	}

	if ($this->hasSession()) {
	$vec = $vec.$this->getSession()->getSessionKey();
	}

	$time_block = floor($epoch / $frequency);
	$vec = $vec.$key.$time_block;

	return substr(PhabricatorHash::digest($vec), 0, $len);
	}

	public function getUserProfile() {
	return $this->assertAttached($this->profile);
	}

	public function attachUserProfile(PhabricatorUserProfile $profile) {
	$this->profile = $profile;
	return $this;
	}

	public function loadUserProfile() {
	if ($this->profile) {
	return $this->profile;
	}

	$profile_dao = new PhabricatorUserProfile();
	$this->profile = $profile_dao->loadOneWhere('userPHID = %s',
	$this->getPHID());

	if (!$this->profile) {
	$this->profile = PhabricatorUserProfile::initializeNewProfile($this);
	}

	return $this->profile;
	}

	public function loadPrimaryEmailAddress() {
	$email = $this->loadPrimaryEmail();
	if (!$email) {
	throw new Exception(pht('User has no primary email address!'));
	}
	return $email->getAddress();
	}

	public function loadPrimaryEmail() {
	return $this->loadOneRelative(
	new PhabricatorUserEmail(),
	'userPHID',
	'getPHID',
	'(isPrimary = 1)');
	}


	/* -( Settings )----------------------------------------------------------- */


	public function getUserSetting($key) {
	// NOTE: We store available keys and cached values separately to make it
	// faster to check for `null` in the cache, which is common.
	if (isset($this->settingCacheKeys[$key])) {
	return $this->settingCache[$key];
	}

	$settings_key = PhabricatorUserPreferencesCacheType::KEY_PREFERENCES;
	if ($this->getPHID()) {
	$settings = $this->requireCacheData($settings_key);
	} else {
	$settings = $this->loadGlobalSettings();
	}

	if (array_key_exists($key, $settings)) {
	$value = $settings[$key];
	return $this->writeUserSettingCache($key, $value);
	}

	$cache = PhabricatorCaches::getRuntimeCache();
	$cache_key = "settings.defaults({$key})";
	$cache_map = $cache->getKeys(array($cache_key));

	if ($cache_map) {
	$value = $cache_map[$cache_key];
	} else {
	$defaults = PhabricatorSetting::getAllSettings();
	if (isset($defaults[$key])) {
	$value = id(clone $defaults[$key])
	->setViewer($this)
	->getSettingDefaultValue();
	} else {
	$value = null;
	}

	$cache->setKey($cache_key, $value);
	}

	return $this->writeUserSettingCache($key, $value);
	}


	/**
	* Test if a given setting is set to a particular value.
	*
	* @param const Setting key.
	* @param wild Value to compare.
	* @return bool True if the setting has the specified value.
	* @task settings
	*/
	public function compareUserSetting($key, $value) {
	$actual = $this->getUserSetting($key);
	return ($actual == $value);
	}

	private function writeUserSettingCache($key, $value) {
	$this->settingCacheKeys[$key] = true;
	$this->settingCache[$key] = $value;
	return $value;
	}

	public function getTranslation() {
	return $this->getUserSetting(PhabricatorTranslationSetting::SETTINGKEY);
	}

	public function getTimezoneIdentifier() {
	return $this->getUserSetting(PhabricatorTimezoneSetting::SETTINGKEY);
	}

	public static function getGlobalSettingsCacheKey() {
	return 'user.settings.globals.v1';
	}

	private function loadGlobalSettings() {
	$cache_key = self::getGlobalSettingsCacheKey();
	$cache = PhabricatorCaches::getMutableStructureCache();

	$settings = $cache->getKey($cache_key);
	if (!$settings) {
	$preferences = PhabricatorUserPreferences::loadGlobalPreferences($this);
	$settings = $preferences->getPreferences();
	$cache->setKey($cache_key, $settings);
	}

	return $settings;
	}


	/**
	* Override the user's timezone identifier.
	*
	* This is primarily useful for unit tests.
	*
	* @param string New timezone identifier.
	* @return this
	* @task settings
	*/
	public function overrideTimezoneIdentifier($identifier) {
	$timezone_key = PhabricatorTimezoneSetting::SETTINGKEY;
	$this->settingCacheKeys[$timezone_key] = true;
	$this->settingCache[$timezone_key] = $identifier;
	return $this;
	}

	public function getGender() {
	return $this->getUserSetting(PhabricatorPronounSetting::SETTINGKEY);
	}

	public function loadEditorLink(
	$path,
	$line,
	PhabricatorRepository $repository = null) {

	$editor = $this->getUserSetting(PhabricatorEditorSetting::SETTINGKEY);

	if (is_array($path)) {
	$multi_key = PhabricatorEditorMultipleSetting::SETTINGKEY;
	$multiedit = $this->getUserSetting($multi_key);
	switch ($multiedit) {
	case PhabricatorEditorMultipleSetting::VALUE_SPACES:
	$path = implode(' ', $path);
	break;
	case PhabricatorEditorMultipleSetting::VALUE_SINGLE:
	default:
	return null;
	}
	}

	if (!strlen($editor)) {
	return null;
	}

	if ($repository) {
	$callsign = $repository->getCallsign();
	} else {
	$callsign = null;
	}

	$uri = strtr($editor, array(
	'%%' => '%',
	'%f' => phutil_escape_uri($path),
	'%l' => phutil_escape_uri($line),
	'%r' => phutil_escape_uri($callsign),
	));

	// The resulting URI must have an allowed protocol. Otherwise, we'll return
	// a link to an error page explaining the misconfiguration.

	$ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
	if (!$ok) {
	return '/help/editorprotocol/';
	}

	return (string)$uri;
	}

	public function getAlternateCSRFString() {
	return $this->assertAttached($this->alternateCSRFString);
	}

	public function attachAlternateCSRFString($string) {
	$this->alternateCSRFString = $string;
	return $this;
	}

	/**
	* Populate the nametoken table, which used to fetch typeahead results. When
	* a user types "linc", we want to match "Abraham Lincoln" from on-demand
	* typeahead sources. To do this, we need a separate table of name fragments.
	*/
	public function updateNameTokens() {
	$table = self::NAMETOKEN_TABLE;
	$conn_w = $this->establishConnection('w');

	$tokens = PhabricatorTypeaheadDatasource::tokenizeString(
	$this->getUserName().' '.$this->getRealName());

	$sql = array();
	foreach ($tokens as $token) {
	$sql[] = qsprintf(
	$conn_w,
	'(%d, %s)',
	$this->getID(),
	$token);
	}

	queryfx(
	$conn_w,
	'DELETE FROM %T WHERE userID = %d',
	$table,
	$this->getID());
	if ($sql) {
	queryfx(
	$conn_w,
	'INSERT INTO %T (userID, token) VALUES %Q',
	$table,
	implode(', ', $sql));
	}
	}

	public function sendWelcomeEmail(PhabricatorUser $admin) {
	if (!$this->canEstablishWebSessions()) {
	throw new Exception(
	pht(
	'Can not send welcome mail to users who can not establish '.
	'web sessions!'));
	}

	$admin_username = $admin->getUserName();
	$admin_realname = $admin->getRealName();
	$user_username = $this->getUserName();
	$is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');

	$base_uri = PhabricatorEnv::getProductionURI('/');

	$engine = new PhabricatorAuthSessionEngine();
	$uri = $engine->getOneTimeLoginURI(
	$this,
	$this->loadPrimaryEmail(),
	PhabricatorAuthSessionEngine::ONETIME_WELCOME);

	$body = pht(
	"Welcome to Phabricator!\n\n".
	"%s (%s) has created an account for you.\n\n".
	" Username: %s\n\n".
	"To login to Phabricator, follow this link and set a password:\n\n".
	" %s\n\n".
	"After you have set a password, you can login in the future by ".
	"going here:\n\n".
	" %s\n",
	$admin_username,
	$admin_realname,
	$user_username,
	$uri,
	$base_uri);

	if (!$is_serious) {
	$body .= sprintf(
	"\n%s\n",
	pht("Love,\nPhabricator"));
	}

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(array($this->getPHID()))
	->setForceDelivery(true)
	->setSubject(pht('[Phabricator] Welcome to Phabricator'))
	->setBody($body)
	->saveAndSend();
	}

	public function sendUsernameChangeEmail(
	PhabricatorUser $admin,
	$old_username) {

	$admin_username = $admin->getUserName();
	$admin_realname = $admin->getRealName();
	$new_username = $this->getUserName();

	$password_instructions = null;
	if (PhabricatorPasswordAuthProvider::getPasswordProvider()) {
	$engine = new PhabricatorAuthSessionEngine();
	$uri = $engine->getOneTimeLoginURI(
	$this,
	null,
	PhabricatorAuthSessionEngine::ONETIME_USERNAME);
	$password_instructions = sprintf(
	"%s\n\n %s\n\n%s\n",
	pht(
	"If you use a password to login, you'll need to reset it ".
	"before you can login again. You can reset your password by ".
	"following this link:"),
	$uri,
	pht(
	"And, of course, you'll need to use your new username to login ".
	"from now on. If you use OAuth to login, nothing should change."));
	}

	$body = sprintf(
	"%s\n\n %s\n %s\n\n%s",
	pht(
	'%s (%s) has changed your Phabricator username.',
	$admin_username,
	$admin_realname),
	pht(
	'Old Username: %s',
	$old_username),
	pht(
	'New Username: %s',
	$new_username),
	$password_instructions);

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(array($this->getPHID()))
	->setForceDelivery(true)
	->setSubject(pht('[Phabricator] Username Changed'))
	->setBody($body)
	->saveAndSend();
	}

	public static function describeValidUsername() {
	return pht(
	'Usernames must contain only numbers, letters, period, underscore and '.
	'hyphen, and can not end with a period. They must have no more than %d '.
	'characters.',
	new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
	}

	public static function validateUsername($username) {
	// NOTE: If you update this, make sure to update:
	//
	// - Remarkup rule for @mentions.
	// - Routing rule for "/p/username/".
	// - Unit tests, obviously.
	// - describeValidUsername() method, above.

	if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
	return false;
	}

	return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
	}

	public static function getDefaultProfileImageURI() {
	return celerity_get_resource_uri('/rsrc/image/avatar.png');
	}

	public function getProfileImageURI() {
	$uri_key = PhabricatorUserProfileImageCacheType::KEY_URI;
	return $this->requireCacheData($uri_key);
	}

	public function getUnreadNotificationCount() {
	$notification_key = PhabricatorUserNotificationCountCacheType::KEY_COUNT;
	return $this->requireCacheData($notification_key);
	}

	public function getUnreadMessageCount() {
	$message_key = PhabricatorUserMessageCountCacheType::KEY_COUNT;
	return $this->requireCacheData($message_key);
	}

	public function getFullName() {
	if (strlen($this->getRealName())) {
	return $this->getUsername().' ('.$this->getRealName().')';
	} else {
	return $this->getUsername();
	}
	}

	public function getTimeZone() {
	return new DateTimeZone($this->getTimezoneIdentifier());
	}

	public function getTimeZoneOffset() {
	$timezone = $this->getTimeZone();
	$now = new DateTime('@'.PhabricatorTime::getNow());
	$offset = $timezone->getOffset($now);

	// Javascript offsets are in minutes and have the opposite sign.
	$offset = -(int)($offset / 60);

	return $offset;
	}

	public function getTimeZoneOffsetInHours() {
	$offset = $this->getTimeZoneOffset();
	$offset = (int)round($offset / 60);
	$offset = -$offset;

	return $offset;
	}

	public function formatShortDateTime($when, $now = null) {
	if ($now === null) {
	$now = PhabricatorTime::getNow();
	}

	try {
	$when = new DateTime('@'.$when);
	$now = new DateTime('@'.$now);
	} catch (Exception $ex) {
	return null;
	}

	$zone = $this->getTimeZone();

	$when->setTimeZone($zone);
	$now->setTimeZone($zone);

	if ($when->format('Y') !== $now->format('Y')) {
	// Different year, so show "Feb 31 2075".
	$format = 'M j Y';
	} else if ($when->format('Ymd') !== $now->format('Ymd')) {
	// Same year but different month and day, so show "Feb 31".
	$format = 'M j';
	} else {
	// Same year, month and day so show a time of day.
	$pref_time = PhabricatorTimeFormatSetting::SETTINGKEY;
	$format = $this->getUserSetting($pref_time);
	}

	return $when->format($format);
	}

	public function __toString() {
	return $this->getUsername();
	}

	public static function loadOneWithEmailAddress($address) {
	$email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$address);
	if (!$email) {
	return null;
	}
	return id(new PhabricatorUser())->loadOneWhere(
	'phid = %s',
	$email->getUserPHID());
	}

	public function getDefaultSpacePHID() {
	// TODO: We might let the user switch which space they're "in" later on;
	// for now just use the global space if one exists.

	// If the viewer has access to the default space, use that.
	$spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
	foreach ($spaces as $space) {
	if ($space->getIsDefaultNamespace()) {
	return $space->getPHID();
	}
	}

	// Otherwise, use the space with the lowest ID that they have access to.
	// This just tends to keep the default stable and predictable over time,
	// so adding a new space won't change behavior for users.
	if ($spaces) {
	$spaces = msort($spaces, 'getID');
	return head($spaces)->getPHID();
	}

	return null;
	}


	/**
	* Grant a user a source of authority, to let them bypass policy checks they
	* could not otherwise.
	*/
	public function grantAuthority($authority) {
	$this->authorities[] = $authority;
	return $this;
	}


	/**
	* Get authorities granted to the user.
	*/
	public function getAuthorities() {
	return $this->authorities;
	}

	+ public function hasConduitClusterToken() {
	+ return ($this->conduitClusterToken !== self::ATTACHABLE);
	+ }
	+
	+ public function attachConduitClusterToken(PhabricatorConduitToken $token) {
	+ $this->conduitClusterToken = $token;
	+ return $this;
	+ }
	+
	+ public function getConduitClusterToken() {
	+ return $this->assertAttached($this->conduitClusterToken);
	+ }
	+

	/* -( Availability )------------------------------------------------------- */


	/**
	* @task availability
	*/
	public function attachAvailability(array $availability) {
	$this->availability = $availability;
	return $this;
	}


	/**
	* Get the timestamp the user is away until, if they are currently away.
	*
	* @return int\|null Epoch timestamp, or `null` if the user is not away.
	* @task availability
	*/
	public function getAwayUntil() {
	$availability = $this->availability;

	$this->assertAttached($availability);
	if (!$availability) {
	return null;
	}

	return idx($availability, 'until');
	}


	public function getDisplayAvailability() {
	$availability = $this->availability;

	$this->assertAttached($availability);
	if (!$availability) {
	return null;
	}

	$busy = PhabricatorCalendarEventInvitee::AVAILABILITY_BUSY;

	return idx($availability, 'availability', $busy);
	}


	public function getAvailabilityEventPHID() {
	$availability = $this->availability;

	$this->assertAttached($availability);
	if (!$availability) {
	return null;
	}

	return idx($availability, 'eventPHID');
	}


	/**
	* Get cached availability, if present.
	*
	* @return wild\|null Cache data, or null if no cache is available.
	* @task availability
	*/
	public function getAvailabilityCache() {
	$now = PhabricatorTime::getNow();
	if ($this->availabilityCacheTTL <= $now) {
	return null;
	}

	try {
	return phutil_json_decode($this->availabilityCache);
	} catch (Exception $ex) {
	return null;
	}
	}


	/**
	* Write to the availability cache.
	*
	* @param wild Availability cache data.
	* @param int\|null Cache TTL.
	* @return this
	* @task availability
	*/
	public function writeAvailabilityCache(array $availability, $ttl) {
	if (PhabricatorEnv::isReadOnly()) {
	return $this;
	}

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	queryfx(
	$this->establishConnection('w'),
	'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
	WHERE id = %d',
	$this->getTableName(),
	json_encode($availability),
	$ttl,
	$this->getID());
	unset($unguarded);

	return $this;
	}


	/* -( Multi-Factor Authentication )---------------------------------------- */


	/**
	* Update the flag storing this user's enrollment in multi-factor auth.
	*
	* With certain settings, we need to check if a user has MFA on every page,
	* so we cache MFA enrollment on the user object for performance. Calling this
	* method synchronizes the cache by examining enrollment records. After
	* updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
	* the user is enrolled.
	*
	* This method should be called after any changes are made to a given user's
	* multi-factor configuration.
	*
	* @return void
	* @task factors
	*/
	public function updateMultiFactorEnrollment() {
	$factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());

	$enrolled = count($factors) ? 1 : 0;
	if ($enrolled !== $this->isEnrolledInMultiFactor) {
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	queryfx(
	$this->establishConnection('w'),
	'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
	$this->getTableName(),
	$enrolled,
	$this->getID());
	unset($unguarded);

	$this->isEnrolledInMultiFactor = $enrolled;
	}
	}


	/**
	* Check if the user is enrolled in multi-factor authentication.
	*
	* Enrolled users have one or more multi-factor authentication sources
	* attached to their account. For performance, this value is cached. You
	* can use @{method:updateMultiFactorEnrollment} to update the cache.
	*
	* @return bool True if the user is enrolled.
	* @task factors
	*/
	public function getIsEnrolledInMultiFactor() {
	return $this->isEnrolledInMultiFactor;
	}


	/* -( Omnipotence )-------------------------------------------------------- */


	/**
	* Returns true if this user is omnipotent. Omnipotent users bypass all policy
	* checks.
	*
	* @return bool True if the user bypasses policy checks.
	*/
	public function isOmnipotent() {
	return $this->omnipotent;
	}


	/**
	* Get an omnipotent user object for use in contexts where there is no acting
	* user, notably daemons.
	*
	* @return PhabricatorUser An omnipotent user.
	*/
	public static function getOmnipotentUser() {
	static $user = null;
	if (!$user) {
	$user = new PhabricatorUser();
	$user->omnipotent = true;
	$user->makeEphemeral();
	}
	return $user;
	}


	/**
	* Get a scalar string identifying this user.
	*
	* This is similar to using the PHID, but distinguishes between ominpotent
	* and public users explicitly. This allows safe construction of cache keys
	* or cache buckets which do not conflate public and omnipotent users.
	*
	* @return string Scalar identifier.
	*/
	public function getCacheFragment() {
	if ($this->isOmnipotent()) {
	return 'u.omnipotent';
	}

	$phid = $this->getPHID();
	if ($phid) {
	return 'u.'.$phid;
	}

	return 'u.public';
	}


	/* -( Managing Handles )--------------------------------------------------- */


	/**
	* Get a @{class:PhabricatorHandleList} which benefits from this viewer's
	* internal handle pool.
	*
	* @param list<phid> List of PHIDs to load.
	* @return PhabricatorHandleList Handle list object.
	* @task handle
	*/
	public function loadHandles(array $phids) {
	if ($this->handlePool === null) {
	$this->handlePool = id(new PhabricatorHandlePool())
	->setViewer($this);
	}

	return $this->handlePool->newHandleList($phids);
	}


	/**
	* Get a @{class:PHUIHandleView} for a single handle.
	*
	* This benefits from the viewer's internal handle pool.
	*
	* @param phid PHID to render a handle for.
	* @return PHUIHandleView View of the handle.
	* @task handle
	*/
	public function renderHandle($phid) {
	return $this->loadHandles(array($phid))->renderHandle($phid);
	}


	/**
	* Get a @{class:PHUIHandleListView} for a list of handles.
	*
	* This benefits from the viewer's internal handle pool.
	*
	* @param list<phid> List of PHIDs to render.
	* @return PHUIHandleListView View of the handles.
	* @task handle
	*/
	public function renderHandleList(array $phids) {
	return $this->loadHandles($phids)->renderList();
	}

	public function attachBadgePHIDs(array $phids) {
	$this->badgePHIDs = $phids;
	return $this;
	}

	public function getBadgePHIDs() {
	return $this->assertAttached($this->badgePHIDs);
	}


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	);
	}

	public function getPolicy($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return PhabricatorPolicies::POLICY_PUBLIC;
	case PhabricatorPolicyCapability::CAN_EDIT:
	if ($this->getIsSystemAgent() \|\| $this->getIsMailingList()) {
	return PhabricatorPolicies::POLICY_ADMIN;
	} else {
	return PhabricatorPolicies::POLICY_NOONE;
	}
	}
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
	}

	public function describeAutomaticCapability($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_EDIT:
	return pht('Only you can edit your information.');
	default:
	return null;
	}
	}


	/* -( PhabricatorCustomFieldInterface )------------------------------------ */


	public function getCustomFieldSpecificationForRole($role) {
	return PhabricatorEnv::getEnvConfig('user.fields');
	}

	public function getCustomFieldBaseClass() {
	return 'PhabricatorUserCustomField';
	}

	public function getCustomFields() {
	return $this->assertAttached($this->customFields);
	}

	public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
	$this->customFields = $fields;
	return $this;
	}


	/* -( PhabricatorDestructibleInterface )----------------------------------- */


	public function destroyObjectPermanently(
	PhabricatorDestructionEngine $engine) {

	$this->openTransaction();
	$this->delete();

	$externals = id(new PhabricatorExternalAccount())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());
	foreach ($externals as $external) {
	$external->delete();
	}

	$prefs = id(new PhabricatorUserPreferencesQuery())
	->setViewer($engine->getViewer())
	->withUsers(array($this))
	->execute();
	foreach ($prefs as $pref) {
	$engine->destroyObject($pref);
	}

	$profiles = id(new PhabricatorUserProfile())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());
	foreach ($profiles as $profile) {
	$profile->delete();
	}

	$keys = id(new PhabricatorAuthSSHKeyQuery())
	->setViewer($engine->getViewer())
	->withObjectPHIDs(array($this->getPHID()))
	->execute();
	foreach ($keys as $key) {
	$engine->destroyObject($key);
	}

	$emails = id(new PhabricatorUserEmail())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());
	foreach ($emails as $email) {
	$email->delete();
	}

	$sessions = id(new PhabricatorAuthSession())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());
	foreach ($sessions as $session) {
	$session->delete();
	}

	$factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
	'userPHID = %s',
	$this->getPHID());
	foreach ($factors as $factor) {
	$factor->delete();
	}

	$this->saveTransaction();
	}


	/* -( PhabricatorSSHPublicKeyInterface )----------------------------------- */


	public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
	if ($viewer->getPHID() == $this->getPHID()) {
	// If the viewer is managing their own keys, take them to the normal
	// panel.
	return '/settings/panel/ssh/';
	} else {
	// Otherwise, take them to the administrative panel for this user.
	return '/settings/'.$this->getID().'/panel/ssh/';
	}
	}

	public function getSSHKeyDefaultName() {
	return 'id_rsa_phabricator';
	}

	public function getSSHKeyNotifyPHIDs() {
	return array(
	$this->getPHID(),
	);
	}


	/* -( PhabricatorApplicationTransactionInterface )------------------------- */


	public function getApplicationTransactionEditor() {
	return new PhabricatorUserProfileEditor();
	}

	public function getApplicationTransactionObject() {
	return $this;
	}

	public function getApplicationTransactionTemplate() {
	return new PhabricatorUserTransaction();
	}

	public function willRenderTimeline(
	PhabricatorApplicationTransactionView $timeline,
	AphrontRequest $request) {
	return $timeline;
	}


	/* -( PhabricatorFulltextInterface )--------------------------------------- */


	public function newFulltextEngine() {
	return new PhabricatorUserFulltextEngine();
	}


	/* -( PhabricatorConduitResultInterface )---------------------------------- */


	public function getFieldSpecificationsForConduit() {
	return array(
	id(new PhabricatorConduitSearchFieldSpecification())
	->setKey('username')
	->setType('string')
	->setDescription(pht("The user's username.")),
	id(new PhabricatorConduitSearchFieldSpecification())
	->setKey('realName')
	->setType('string')
	->setDescription(pht("The user's real name.")),
	id(new PhabricatorConduitSearchFieldSpecification())
	->setKey('roles')
	->setType('list<string>')
	->setDescription(pht('List of acccount roles.')),
	);
	}

	public function getFieldValuesForConduit() {
	$roles = array();

	if ($this->getIsDisabled()) {
	$roles[] = 'disabled';
	}

	if ($this->getIsSystemAgent()) {
	$roles[] = 'bot';
	}

	if ($this->getIsMailingList()) {
	$roles[] = 'list';
	}

	if ($this->getIsAdmin()) {
	$roles[] = 'admin';
	}

	if ($this->getIsEmailVerified()) {
	$roles[] = 'verified';
	}

	if ($this->getIsApproved()) {
	$roles[] = 'approved';
	}

	if ($this->isUserActivated()) {
	$roles[] = 'activated';
	}

	return array(
	'username' => $this->getUsername(),
	'realName' => $this->getRealName(),
	'roles' => $roles,
	);
	}

	public function getConduitSearchAttachments() {
	return array();
	}


	/* -( User Cache )--------------------------------------------------------- */


	/**
	* @task cache
	*/
	public function attachRawCacheData(array $data) {
	$this->rawCacheData = $data + $this->rawCacheData;
	return $this;
	}

	public function setAllowInlineCacheGeneration($allow_cache_generation) {
	$this->allowInlineCacheGeneration = $allow_cache_generation;
	return $this;
	}

	/**
	* @task cache
	*/
	protected function requireCacheData($key) {
	if (isset($this->usableCacheData[$key])) {
	return $this->usableCacheData[$key];
	}

	$type = PhabricatorUserCacheType::requireCacheTypeForKey($key);

	if (isset($this->rawCacheData[$key])) {
	$raw_value = $this->rawCacheData[$key];

	$usable_value = $type->getValueFromStorage($raw_value);
	$this->usableCacheData[$key] = $usable_value;

	return $usable_value;
	}

	// By default, we throw if a cache isn't available. This is consistent
	// with the standard `needX()` + `attachX()` + `getX()` interaction.
	if (!$this->allowInlineCacheGeneration) {
	throw new PhabricatorDataNotAttachedException($this);
	}

	$user_phid = $this->getPHID();

	// Try to read the actual cache before we generate a new value. We can
	// end up here via Conduit, which does not use normal sessions and can
	// not pick up a free cache load during session identification.
	if ($user_phid) {
	$raw_data = PhabricatorUserCache::readCaches(
	$type,
	$key,
	array($user_phid));
	if (array_key_exists($user_phid, $raw_data)) {
	$raw_value = $raw_data[$user_phid];
	$usable_value = $type->getValueFromStorage($raw_value);
	$this->rawCacheData[$key] = $raw_value;
	$this->usableCacheData[$key] = $usable_value;
	return $usable_value;
	}
	}

	$usable_value = $type->getDefaultValue();

	if ($user_phid) {
	$map = $type->newValueForUsers($key, array($this));
	if (array_key_exists($user_phid, $map)) {
	$raw_value = $map[$user_phid];
	$usable_value = $type->getValueFromStorage($raw_value);

	$this->rawCacheData[$key] = $raw_value;
	PhabricatorUserCache::writeCache(
	$type,
	$key,
	$user_phid,
	$raw_value);
	}
	}

	$this->usableCacheData[$key] = $usable_value;

	return $usable_value;
	}


	/**
	* @task cache
	*/
	public function clearCacheData($key) {
	unset($this->rawCacheData[$key]);
	unset($this->usableCacheData[$key]);
	return $this;
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Jan 19 2025, 20:55 (6 w, 1 d ago)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1128659
Default Alt Text: (89 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions