Differential D20031 Diff 47837 src/applications/auth/xaction/PhabricatorAuthFactorProviderStatusTransaction.php

Changeset View

Standalone View

src/applications/auth/xaction/PhabricatorAuthFactorProviderStatusTransaction.php

This file was added.

				<?php

				final class PhabricatorAuthFactorProviderStatusTransaction
				extends PhabricatorAuthFactorProviderTransactionType {

				const TRANSACTIONTYPE = 'status';

				public function generateOldValue($object) {
				return $object->getStatus();
				}

				public function applyInternalEffects($object, $value) {
				$object->setStatus($value);
				}

				public function getTitle() {
				$old = $this->getOldValue();
				$new = $this->getNewValue();

				$old_display = PhabricatorAuthFactorProviderStatus::newForStatus($old)
				->getName();
				$new_display = PhabricatorAuthFactorProviderStatus::newForStatus($new)
				->getName();

				return pht(
				'%s changed the status of this provider from %s to %s.',
				$this->renderAuthor(),
				$this->renderValue($old_display),
				$this->renderValue($new_display));
				}

				public function validateTransactions($object, array $xactions) {
				$errors = array();
				$actor = $this->getActor();

				$map = PhabricatorAuthFactorProviderStatus::getMap();
				foreach ($xactions as $xaction) {
				$new_value = $xaction->getNewValue();

				if (!isset($map[$new_value])) {
				$errors[] = $this->newInvalidError(
				pht(
				'Status "%s" is invalid. Valid statuses are: %s.',
				$new_value,
				implode(', ', array_keys($map))),
				$xaction);
				continue;
				}

				$require_key = 'security.require-multi-factor-auth';
				$require_mfa = PhabricatorEnv::getEnvConfig($require_key);

				if ($require_mfa) {
				$status_active = PhabricatorAuthFactorProviderStatus::STATUS_ACTIVE;
				if ($new_value !== $status_active) {
				$active_providers = id(new PhabricatorAuthFactorProviderQuery())
				->setViewer($actor)
				->withStatuses(
				array(
				$status_active,
				))
				->execute();
				$active_providers = mpull($active_providers, null, 'getID');
				unset($active_providers[$object->getID()]);

				if (!$active_providers) {
				$errors[] = $this->newInvalidError(
				pht(
				'You can not deprecate or disable the last active MFA '.
				'provider while "%s" is enabled, because new users would '.
				'be unable to enroll in MFA. Disable the MFA requirement '.
				'in Config, or create or enable another MFA provider first.',
				$require_key));
				continue;
				}
				}
				}
				}

				return $errors;
				}

				public function didCommitTransaction($object, $value) {
				$status = PhabricatorAuthFactorProviderStatus::newForStatus($value);

				// If a provider has undergone a status change, reset the MFA enrollment
				// cache for all users. This may immediately force a lot of users to redo
				// MFA enrollment.

				// We could be more surgical about this: we only really need to affect
				// users who had a factor under the provider, and only really need to
				// do anything if a provider was disabled. This is just a little simpler.

				$table = new PhabricatorUser();
				$conn = $table->establishConnection('w');

				queryfx(
				$conn,
				'UPDATE %R SET isEnrolledInMultiFactor = 0',
				$table);
				}
				epriestleyAuthorUnsubmitted Done Inline Actions This causes all users accounts to immediately hit the "MFA Setup Gate" on their next request if they need it. (If they don't need to hit the setup gate, we'll update the cache back to "1" and continue normally on their next request.) The way this cache works is that "1" is a fast path to skip the checks, and "0" puts us on the slow path where we do all the checks correctly and actually read the full application state. So this is really "dirty a cache", not "mark all users as having no MFA in some meaningful way". In this case, a more precise name for the column might be something like `canUserDefinitelySkipMFASetupGateBecauseWeKnowTheyHaveMFA`. epriestley: This causes all users accounts to immediately hit the "MFA Setup Gate" on their next request if…

				}