diff --git a/src/applications/conduit/storage/PhabricatorConduitToken.php b/src/applications/conduit/storage/PhabricatorConduitToken.php
index f5673fdab3..aa836cf623 100644
--- a/src/applications/conduit/storage/PhabricatorConduitToken.php
+++ b/src/applications/conduit/storage/PhabricatorConduitToken.php
@@ -1,165 +1,174 @@
 <?php
 
 final class PhabricatorConduitToken
   extends PhabricatorConduitDAO
   implements PhabricatorPolicyInterface {
 
   protected $objectPHID;
   protected $tokenType;
   protected $token;
   protected $expires;
 
   private $object = self::ATTACHABLE;
 
   const TYPE_STANDARD = 'api';
   const TYPE_COMMANDLINE = 'cli';
   const TYPE_CLUSTER = 'clr';
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_COLUMN_SCHEMA => array(
         'tokenType' => 'text32',
         'token' => 'text32',
         'expires' => 'epoch?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_object' => array(
           'columns' => array('objectPHID', 'tokenType'),
         ),
         'key_token' => array(
           'columns' => array('token'),
           'unique' => true,
         ),
         'key_expires' => array(
           'columns' => array('expires'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public static function loadClusterTokenForUser(PhabricatorUser $user) {
     if (!$user->isLoggedIn()) {
       return null;
     }
 
+    if ($user->hasConduitClusterToken()) {
+      return $user->getConduitClusterToken();
+    }
+
     $tokens = id(new PhabricatorConduitTokenQuery())
       ->setViewer($user)
       ->withObjectPHIDs(array($user->getPHID()))
       ->withTokenTypes(array(self::TYPE_CLUSTER))
       ->withExpired(false)
       ->execute();
 
     // Only return a token if it has at least 5 minutes left before
     // expiration. Cluster tokens cycle regularly, so we don't want to use
     // one that's going to expire momentarily.
     $now = PhabricatorTime::getNow();
     $must_expire_after = $now + phutil_units('5 minutes in seconds');
 
+    $valid_token = null;
     foreach ($tokens as $token) {
       if ($token->getExpires() > $must_expire_after) {
-        return $token;
+        $valid_token = $token;
+        break;
       }
     }
 
     // We didn't find any existing tokens (or the existing tokens are all about
     // to expire) so generate a new token.
+    if (!$valid_token) {
+      $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
+        $valid_token = self::initializeNewToken(
+          $user->getPHID(),
+          self::TYPE_CLUSTER);
+        $valid_token->save();
+      unset($unguarded);
+    }
 
-    $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
-      $token = self::initializeNewToken(
-        $user->getPHID(),
-        self::TYPE_CLUSTER);
-      $token->save();
-    unset($unguarded);
+    $user->attachConduitClusterToken($valid_token);
 
-    return $token;
+    return $valid_token;
   }
 
   public static function initializeNewToken($object_phid, $token_type) {
     $token = new PhabricatorConduitToken();
     $token->objectPHID = $object_phid;
     $token->tokenType = $token_type;
     $token->expires = $token->getTokenExpires($token_type);
 
     $secret = $token_type.'-'.Filesystem::readRandomCharacters(32);
     $secret = substr($secret, 0, 32);
     $token->token = $secret;
 
     return $token;
   }
 
   public static function getTokenTypeName($type) {
     $map = array(
       self::TYPE_STANDARD => pht('Standard API Token'),
       self::TYPE_COMMANDLINE => pht('Command Line API Token'),
       self::TYPE_CLUSTER => pht('Cluster API Token'),
     );
 
     return idx($map, $type, $type);
   }
 
   public static function getAllTokenTypes() {
     return array(
       self::TYPE_STANDARD,
       self::TYPE_COMMANDLINE,
       self::TYPE_CLUSTER,
     );
   }
 
   private function getTokenExpires($token_type) {
     $now = PhabricatorTime::getNow();
     switch ($token_type) {
       case self::TYPE_STANDARD:
         return null;
       case self::TYPE_COMMANDLINE:
         return $now + phutil_units('1 hour in seconds');
       case self::TYPE_CLUSTER:
         return $now + phutil_units('30 minutes in seconds');
       default:
         throw new Exception(
           pht('Unknown Conduit token type "%s"!', $token_type));
     }
   }
 
   public function getPublicTokenName() {
     switch ($this->getTokenType()) {
       case self::TYPE_CLUSTER:
         return pht('Cluster API Token');
       default:
         return substr($this->getToken(), 0, 8).'...';
     }
   }
 
   public function getObject() {
     return $this->assertAttached($this->object);
   }
 
   public function attachObject(PhabricatorUser $object) {
     $this->object = $object;
     return $this;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     return $this->getObject()->getPolicy($capability);
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getObject()->hasAutomaticCapability($capability, $viewer);
   }
 
   public function describeAutomaticCapability($capability) {
     return pht(
       'Conduit tokens inherit the policies of the user they authenticate.');
   }
 
 }
diff --git a/src/applications/diffusion/controller/DiffusionController.php b/src/applications/diffusion/controller/DiffusionController.php
index 14d4f05789..61c17e0877 100644
--- a/src/applications/diffusion/controller/DiffusionController.php
+++ b/src/applications/diffusion/controller/DiffusionController.php
@@ -1,402 +1,414 @@
 <?php
 
 abstract class DiffusionController extends PhabricatorController {
 
   private $diffusionRequest;
 
   protected function getDiffusionRequest() {
     if (!$this->diffusionRequest) {
       throw new PhutilInvalidStateException('loadDiffusionContext');
     }
     return $this->diffusionRequest;
   }
 
   protected function hasDiffusionRequest() {
     return (bool)$this->diffusionRequest;
   }
 
   public function willBeginExecution() {
     $request = $this->getRequest();
 
     // Check if this is a VCS request, e.g. from "git clone", "hg clone", or
     // "svn checkout". If it is, we jump off into repository serving code to
     // process the request.
 
     $serve_controller = new DiffusionServeController();
     if ($serve_controller->isVCSRequest($request)) {
       return $this->delegateToController($serve_controller);
     }
 
     return parent::willBeginExecution();
   }
 
   protected function loadDiffusionContextForEdit() {
     return $this->loadContext(
       array(
         'edit' => true,
       ));
   }
 
   protected function loadDiffusionContext() {
     return $this->loadContext(array());
   }
 
   private function loadContext(array $options) {
     $request = $this->getRequest();
     $viewer = $this->getViewer();
 
     $identifier = $this->getRepositoryIdentifierFromRequest($request);
 
     $params = $options + array(
       'repository' => $identifier,
       'user' => $viewer,
       'blob' => $this->getDiffusionBlobFromRequest($request),
       'commit' => $request->getURIData('commit'),
       'path' => $request->getURIData('path'),
       'line' => $request->getURIData('line'),
       'branch' => $request->getURIData('branch'),
       'lint' => $request->getStr('lint'),
     );
 
     $drequest = DiffusionRequest::newFromDictionary($params);
 
     if (!$drequest) {
       return new Aphront404Response();
     }
 
     // If the client is making a request like "/diffusion/1/...", but the
     // repository has a different canonical path like "/diffusion/XYZ/...",
     // redirect them to the canonical path.
 
     $request_path = $request->getPath();
     $repository = $drequest->getRepository();
 
     $canonical_path = $repository->getCanonicalPath($request_path);
     if ($canonical_path !== null) {
       if ($canonical_path != $request_path) {
         return id(new AphrontRedirectResponse())->setURI($canonical_path);
       }
     }
 
     $this->diffusionRequest = $drequest;
 
     return null;
   }
 
   protected function getDiffusionBlobFromRequest(AphrontRequest $request) {
     return $request->getURIData('dblob');
   }
 
   protected function getRepositoryIdentifierFromRequest(
     AphrontRequest $request) {
 
     $short_name = $request->getURIData('repositoryShortName');
     if (strlen($short_name)) {
       // If the short name ends in ".git", ignore it.
       $short_name = preg_replace('/\\.git\z/', '', $short_name);
       return $short_name;
     }
 
     $identifier = $request->getURIData('repositoryCallsign');
     if (strlen($identifier)) {
       return $identifier;
     }
 
     $id = $request->getURIData('repositoryID');
     if (strlen($id)) {
       return (int)$id;
     }
 
     return null;
   }
 
   public function buildCrumbs(array $spec = array()) {
     $crumbs = $this->buildApplicationCrumbs();
     $crumb_list = $this->buildCrumbList($spec);
     foreach ($crumb_list as $crumb) {
       $crumbs->addCrumb($crumb);
     }
     return $crumbs;
   }
 
   private function buildCrumbList(array $spec = array()) {
 
     $spec = $spec + array(
       'commit'  => null,
       'tags'    => null,
       'branches'    => null,
       'view'    => null,
     );
 
     $crumb_list = array();
 
     // On the home page, we don't have a DiffusionRequest.
     if ($this->hasDiffusionRequest()) {
       $drequest = $this->getDiffusionRequest();
       $repository = $drequest->getRepository();
     } else {
       $drequest = null;
       $repository = null;
     }
 
     if (!$repository) {
       return $crumb_list;
     }
 
     $repository_name = $repository->getName();
 
     if (!$spec['commit'] && !$spec['tags'] && !$spec['branches']) {
       $branch_name = $drequest->getBranch();
       if ($branch_name) {
         $repository_name .= ' ('.$branch_name.')';
       }
     }
 
     $crumb = id(new PHUICrumbView())
       ->setName($repository_name);
     if (!$spec['view'] && !$spec['commit'] &&
         !$spec['tags'] && !$spec['branches']) {
       $crumb_list[] = $crumb;
       return $crumb_list;
     }
     $crumb->setHref(
       $drequest->generateURI(
         array(
           'action' => 'branch',
           'path' => '/',
         )));
     $crumb_list[] = $crumb;
 
     $stable_commit = $drequest->getStableCommit();
     $commit_name = $repository->formatCommitName($stable_commit, $local = true);
     $commit_uri = $repository->getCommitURI($stable_commit);
 
     if ($spec['tags']) {
       $crumb = new PHUICrumbView();
       if ($spec['commit']) {
         $crumb->setName(pht('Tags for %s', $commit_name));
         $crumb->setHref($commit_uri);
       } else {
         $crumb->setName(pht('Tags'));
       }
       $crumb_list[] = $crumb;
       return $crumb_list;
     }
 
     if ($spec['branches']) {
       $crumb = id(new PHUICrumbView())
         ->setName(pht('Branches'));
       $crumb_list[] = $crumb;
       return $crumb_list;
     }
 
     if ($spec['commit']) {
       $crumb = id(new PHUICrumbView())
         ->setName($commit_name);
       $crumb_list[] = $crumb;
       return $crumb_list;
     }
 
     $crumb = new PHUICrumbView();
     $view = $spec['view'];
 
     switch ($view) {
       case 'history':
         $view_name = pht('History');
         break;
       case 'browse':
         $view_name = pht('Browse');
         break;
       case 'lint':
         $view_name = pht('Lint');
         break;
       case 'change':
         $view_name = pht('Change');
         break;
       case 'compare':
         $view_name = pht('Compare');
         break;
     }
 
     $crumb = id(new PHUICrumbView())
       ->setName($view_name);
 
     $crumb_list[] = $crumb;
     return $crumb_list;
   }
 
   protected function callConduitWithDiffusionRequest(
     $method,
     array $params = array()) {
 
     $user = $this->getRequest()->getUser();
     $drequest = $this->getDiffusionRequest();
 
     return DiffusionQuery::callConduitWithDiffusionRequest(
       $user,
       $drequest,
       $method,
       $params);
   }
 
+  protected function callConduitMethod($method, array $params = array()) {
+    $user = $this->getViewer();
+    $drequest = $this->getDiffusionRequest();
+
+    return DiffusionQuery::callConduitWithDiffusionRequest(
+      $user,
+      $drequest,
+      $method,
+      $params,
+      true);
+  }
+
   protected function getRepositoryControllerURI(
     PhabricatorRepository $repository,
     $path) {
     return $repository->getPathURI($path);
   }
 
   protected function renderPathLinks(DiffusionRequest $drequest, $action) {
     $path = $drequest->getPath();
     $path_parts = array_filter(explode('/', trim($path, '/')));
 
     $divider = phutil_tag(
       'span',
       array(
         'class' => 'phui-header-divider',
       ),
       '/');
 
     $links = array();
     if ($path_parts) {
       $links[] = phutil_tag(
         'a',
         array(
           'href' => $drequest->generateURI(
             array(
               'action' => $action,
               'path' => '',
             )),
         ),
         $drequest->getRepository()->getDisplayName());
       $links[] = $divider;
       $accum = '';
       $last_key = last_key($path_parts);
       foreach ($path_parts as $key => $part) {
         $accum .= '/'.$part;
         if ($key === $last_key) {
           $links[] = $part;
         } else {
           $links[] = phutil_tag(
             'a',
             array(
               'href' => $drequest->generateURI(
                 array(
                   'action' => $action,
                   'path' => $accum.'/',
                 )),
             ),
             $part);
           $links[] = $divider;
         }
       }
     } else {
       $links[] = $drequest->getRepository()->getDisplayName();
       $links[] = $divider;
     }
 
     return $links;
   }
 
   protected function renderStatusMessage($title, $body) {
     return id(new PHUIInfoView())
       ->setSeverity(PHUIInfoView::SEVERITY_WARNING)
       ->setTitle($title)
       ->setFlush(true)
       ->appendChild($body);
   }
 
   protected function renderTablePagerBox(PHUIPagerView $pager) {
     return id(new PHUIBoxView())
       ->addMargin(PHUI::MARGIN_LARGE)
       ->appendChild($pager);
   }
 
   protected function renderCommitHashTag(DiffusionRequest $drequest) {
     $stable_commit = $drequest->getStableCommit();
     $commit = phutil_tag(
         'a',
         array(
           'href' => $drequest->generateURI(
             array(
               'action' => 'commit',
               'commit' => $stable_commit,
             )),
         ),
       $drequest->getRepository()->formatCommitName($stable_commit, true));
 
     $tag = id(new PHUITagView())
       ->setName($commit)
       ->setShade('indigo')
       ->setType(PHUITagView::TYPE_SHADE);
 
     return $tag;
   }
 
   protected function renderDirectoryReadme(DiffusionBrowseResultSet $browse) {
     $readme_path = $browse->getReadmePath();
     if ($readme_path === null) {
       return null;
     }
 
     $drequest = $this->getDiffusionRequest();
     $viewer = $this->getViewer();
     $repository = $drequest->getRepository();
     $repository_phid = $repository->getPHID();
     $stable_commit = $drequest->getStableCommit();
 
     $stable_commit_hash = PhabricatorHash::digestForIndex($stable_commit);
     $readme_path_hash = PhabricatorHash::digestForindex($readme_path);
 
     $cache = PhabricatorCaches::getMutableStructureCache();
     $cache_key = "diffusion".
       ".repository({$repository_phid})".
       ".commit({$stable_commit_hash})".
       ".readme({$readme_path_hash})";
 
     $readme_cache = $cache->getKey($cache_key);
     if (!$readme_cache) {
       try {
         $result = $this->callConduitWithDiffusionRequest(
           'diffusion.filecontentquery',
           array(
             'path' => $readme_path,
             'commit' => $drequest->getStableCommit(),
           ));
       } catch (Exception $ex) {
         return null;
       }
 
       $file_phid = $result['filePHID'];
       if (!$file_phid) {
         return null;
       }
 
       $file = id(new PhabricatorFileQuery())
         ->setViewer($viewer)
         ->withPHIDs(array($file_phid))
         ->executeOne();
       if (!$file) {
         return null;
       }
 
       $corpus = $file->loadFileData();
 
       $readme_cache = array(
         'corpus' => $corpus,
       );
 
       $cache->setKey($cache_key, $readme_cache);
     }
 
     $readme_corpus = $readme_cache['corpus'];
     if (!strlen($readme_corpus)) {
       return null;
     }
 
     return id(new DiffusionReadmeView())
       ->setUser($this->getViewer())
       ->setPath($readme_path)
       ->setContent($readme_corpus);
   }
 
 }
diff --git a/src/applications/diffusion/controller/DiffusionRepositoryController.php b/src/applications/diffusion/controller/DiffusionRepositoryController.php
index d38ad77787..ae6a656bd2 100644
--- a/src/applications/diffusion/controller/DiffusionRepositoryController.php
+++ b/src/applications/diffusion/controller/DiffusionRepositoryController.php
@@ -1,691 +1,754 @@
 <?php
 
 final class DiffusionRepositoryController extends DiffusionController {
 
+  private $historyFuture;
+  private $browseFuture;
+  private $tagFuture;
+  private $branchFuture;
+
   public function shouldAllowPublic() {
     return true;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $response = $this->loadDiffusionContext();
     if ($response) {
       return $response;
     }
 
     $viewer = $this->getViewer();
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $crumbs = $this->buildCrumbs();
     $crumbs->setBorder(true);
 
     $header = $this->buildHeaderView($repository);
     $curtain = $this->buildCurtain($repository);
     $property_table = $this->buildPropertiesTable($repository);
     $description = $this->buildDescriptionView($repository);
     $locate_file = $this->buildLocateFile();
 
     // Before we do any work, make sure we're looking at a some content: we're
     // on a valid branch, and the repository is not empty.
     $page_has_content = false;
     $empty_title = null;
     $empty_message = null;
 
     // If this VCS supports branches, check that the selected branch actually
     // exists.
     if ($drequest->supportsBranches()) {
       // NOTE: Mercurial may have multiple branch heads with the same name.
       $ref_cursors = id(new PhabricatorRepositoryRefCursorQuery())
         ->setViewer($viewer)
         ->withRepositoryPHIDs(array($repository->getPHID()))
         ->withRefTypes(array(PhabricatorRepositoryRefCursor::TYPE_BRANCH))
         ->withRefNames(array($drequest->getBranch()))
         ->execute();
       if ($ref_cursors) {
         // This is a valid branch, so we necessarily have some content.
         $page_has_content = true;
       } else {
         $empty_title = pht('No Such Branch');
         $empty_message = pht(
           'There is no branch named "%s" in this repository.',
           $drequest->getBranch());
       }
     }
 
     // If we didn't find any branches, check if there are any commits at all.
     // This can tailor the message for empty repositories.
     if (!$page_has_content) {
       $any_commit = id(new DiffusionCommitQuery())
         ->setViewer($viewer)
         ->withRepository($repository)
         ->setLimit(1)
         ->execute();
       if ($any_commit) {
         if (!$drequest->supportsBranches()) {
           $page_has_content = true;
         }
       } else {
         $empty_title = pht('Empty Repository');
         $empty_message = pht('This repository does not have any commits yet.');
       }
     }
 
     if ($page_has_content) {
       $content = $this->buildNormalContent($drequest);
     } else {
       $content = id(new PHUIInfoView())
         ->setTitle($empty_title)
         ->setSeverity(PHUIInfoView::SEVERITY_WARNING)
         ->setErrors(array($empty_message));
     }
 
     $view = id(new PHUITwoColumnView())
       ->setHeader($header)
       ->setCurtain($curtain)
       ->setMainColumn(array(
         $property_table,
         $description,
         $locate_file,
       ))
       ->setFooter($content);
 
     return $this->newPage()
       ->setTitle(
         array(
           $repository->getName(),
           $repository->getDisplayName(),
         ))
       ->setCrumbs($crumbs)
       ->appendChild(array(
         $view,
       ));
   }
 
 
   private function buildNormalContent(DiffusionRequest $drequest) {
     $request = $this->getRequest();
     $repository = $drequest->getRepository();
 
+    $commit = $drequest->getCommit();
+    $path = $drequest->getPath();
+
+    $this->historyFuture = $this->callConduitMethod(
+      'diffusion.historyquery',
+      array(
+        'commit' => $commit,
+        'path' => $path,
+        'offset' => 0,
+        'limit' => 15,
+      ));
+
+    $browse_pager = id(new PHUIPagerView())
+      ->readFromRequest($request);
+
+    $this->browseFuture = $this->callConduitMethod(
+      'diffusion.browsequery',
+      array(
+        'commit' => $commit,
+        'path' => $path,
+        'limit' => $browse_pager->getPageSize() + 1,
+      ));
+
+    if ($this->needTagFuture()) {
+      $tag_limit = $this->getTagLimit();
+      $this->tagFuture = $this->callConduitMethod(
+        'diffusion.tagsquery',
+        array(
+          // On the home page, we want to find tags on any branch.
+          'commit' => null,
+          'limit' => $tag_limit + 1,
+        ));
+    }
+
+    if ($this->needBranchFuture()) {
+      $branch_limit = $this->getBranchLimit();
+      $this->branchFuture = $this->callConduitMethod(
+        'diffusion.branchquery',
+        array(
+          'closed' => false,
+          'limit' => $branch_limit + 1,
+        ));
+    }
+
+    $futures = array(
+      $this->historyFuture,
+      $this->browseFuture,
+      $this->tagFuture,
+      $this->branchFuture,
+    );
+    $futures = array_filter($futures);
+    $futures = new FutureIterator($futures);
+    foreach ($futures as $future) {
+      // Just resolve all the futures before continuing.
+    }
+
     $phids = array();
     $content = array();
 
     try {
-      $history_results = $this->callConduitWithDiffusionRequest(
-        'diffusion.historyquery',
-        array(
-          'commit' => $drequest->getCommit(),
-          'path' => $drequest->getPath(),
-          'offset' => 0,
-          'limit' => 15,
-        ));
+      $history_results = $this->historyFuture->resolve();
       $history = DiffusionPathChange::newFromConduit(
         $history_results['pathChanges']);
 
       foreach ($history as $item) {
         $data = $item->getCommitData();
         if ($data) {
           if ($data->getCommitDetail('authorPHID')) {
             $phids[$data->getCommitDetail('authorPHID')] = true;
           }
           if ($data->getCommitDetail('committerPHID')) {
             $phids[$data->getCommitDetail('committerPHID')] = true;
           }
         }
       }
       $history_exception = null;
     } catch (Exception $ex) {
       $history_results = null;
       $history = null;
       $history_exception = $ex;
     }
 
-    $browse_pager = id(new PHUIPagerView())
-      ->readFromRequest($request);
-
     try {
+      $browse_results = $this->browseFuture->resolve();
       $browse_results = DiffusionBrowseResultSet::newFromConduit(
-        $this->callConduitWithDiffusionRequest(
-          'diffusion.browsequery',
-          array(
-            'path' => $drequest->getPath(),
-            'commit' => $drequest->getCommit(),
-            'limit' => $browse_pager->getPageSize() + 1,
-          )));
+        $browse_results);
+
       $browse_paths = $browse_results->getPaths();
       $browse_paths = $browse_pager->sliceResults($browse_paths);
 
       foreach ($browse_paths as $item) {
         $data = $item->getLastCommitData();
         if ($data) {
           if ($data->getCommitDetail('authorPHID')) {
             $phids[$data->getCommitDetail('authorPHID')] = true;
           }
           if ($data->getCommitDetail('committerPHID')) {
             $phids[$data->getCommitDetail('committerPHID')] = true;
           }
         }
       }
 
       $browse_exception = null;
     } catch (Exception $ex) {
       $browse_results = null;
       $browse_paths = null;
       $browse_exception = $ex;
     }
 
     $phids = array_keys($phids);
     $handles = $this->loadViewerHandles($phids);
 
     if ($browse_results) {
       $readme = $this->renderDirectoryReadme($browse_results);
     } else {
       $readme = null;
     }
 
     $content[] = $this->buildBrowseTable(
       $browse_results,
       $browse_paths,
       $browse_exception,
       $handles,
       $browse_pager);
 
     $content[] = $this->buildHistoryTable(
       $history_results,
       $history,
       $history_exception);
 
     try {
       $content[] = $this->buildTagListTable($drequest);
     } catch (Exception $ex) {
       if (!$repository->isImporting()) {
         $content[] = $this->renderStatusMessage(
           pht('Unable to Load Tags'),
           $ex->getMessage());
       }
     }
 
     try {
       $content[] = $this->buildBranchListTable($drequest);
     } catch (Exception $ex) {
       if (!$repository->isImporting()) {
         $content[] = $this->renderStatusMessage(
           pht('Unable to Load Branches'),
           $ex->getMessage());
       }
     }
 
     if ($readme) {
       $content[] = $readme;
     }
 
     return $content;
   }
 
   private function buildHeaderView(PhabricatorRepository $repository) {
     $viewer = $this->getViewer();
     $header = id(new PHUIHeaderView())
       ->setHeader($repository->getName())
       ->setUser($viewer)
       ->setPolicyObject($repository)
       ->setHeaderIcon('fa-code');
 
     if (!$repository->isTracked()) {
       $header->setStatus('fa-ban', 'dark', pht('Inactive'));
     } else if ($repository->isImporting()) {
       $ratio = $repository->loadImportProgress();
       $percentage = sprintf('%.2f%%', 100 * $ratio);
       $header->setStatus(
         'fa-clock-o',
         'indigo',
         pht('Importing (%s)...', $percentage));
     } else {
       $header->setStatus('fa-check', 'bluegrey', pht('Active'));
     }
 
     return $header;
   }
 
   private function buildCurtain(PhabricatorRepository $repository) {
     $viewer = $this->getViewer();
 
     $edit_uri = $repository->getPathURI('manage/');
     $curtain = $this->newCurtainView($repository);
 
     $curtain->addAction(
       id(new PhabricatorActionView())
         ->setName(pht('Manage Repository'))
         ->setIcon('fa-cogs')
         ->setHref($edit_uri));
 
     if ($repository->isHosted()) {
       $push_uri = $this->getApplicationURI(
         'pushlog/?repositories='.$repository->getMonogram());
 
       $curtain->addAction(
         id(new PhabricatorActionView())
           ->setName(pht('View Push Logs'))
           ->setIcon('fa-list-alt')
           ->setHref($push_uri));
     }
 
     return $curtain;
   }
 
   private function buildDescriptionView(PhabricatorRepository $repository) {
     $viewer = $this->getViewer();
     $view = id(new PHUIPropertyListView())
       ->setUser($viewer);
 
     $description = $repository->getDetail('description');
     if (strlen($description)) {
       $description = new PHUIRemarkupView($viewer, $description);
       $view->addTextContent($description);
       return id(new PHUIObjectBoxView())
         ->setHeaderText(pht('Description'))
         ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
         ->appendChild($view);
     }
     return null;
   }
 
   private function buildPropertiesTable(PhabricatorRepository $repository) {
     $viewer = $this->getViewer();
 
     $view = id(new PHUIPropertyListView())
       ->setUser($viewer);
 
     $display_never = PhabricatorRepositoryURI::DISPLAY_NEVER;
 
     $uris = $repository->getURIs();
     foreach ($uris as $uri) {
       if ($uri->getIsDisabled()) {
         continue;
       }
 
       if ($uri->getEffectiveDisplayType() == $display_never) {
         continue;
       }
 
       if ($repository->isSVN()) {
         $label = pht('Checkout');
       } else {
         $label = pht('Clone');
       }
 
       $view->addProperty(
         $label,
         $this->renderCloneURI($repository, $uri));
     }
 
     $box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Details'))
       ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
       ->appendChild($view);
 
     $info = null;
     $drequest = $this->getDiffusionRequest();
 
     // Try to load alternatives. This may fail for repositories which have not
     // cloned yet. If it does, just ignore it and continue.
     try {
       $alternatives = $drequest->getRefAlternatives();
     } catch (ConduitClientException $ex) {
       $alternatives = array();
     }
 
     if ($alternatives) {
       $message = array(
         pht(
           'The ref "%s" is ambiguous in this repository.',
           $drequest->getBranch()),
         ' ',
         phutil_tag(
           'a',
           array(
             'href' => $drequest->generateURI(
               array(
                 'action' => 'refs',
               )),
           ),
           pht('View Alternatives')),
       );
 
       $messages = array($message);
 
       $info = id(new PHUIInfoView())
         ->setSeverity(PHUIInfoView::SEVERITY_WARNING)
         ->setErrors(array($message));
 
       $box->setInfoView($info);
     }
 
 
     return $box;
   }
 
   private function buildBranchListTable(DiffusionRequest $drequest) {
     $viewer = $this->getViewer();
 
-    if ($drequest->getBranch() === null) {
+    if (!$this->needBranchFuture()) {
       return null;
     }
 
-    $limit = 15;
-
-    $branches = $this->callConduitWithDiffusionRequest(
-      'diffusion.branchquery',
-      array(
-        'closed' => false,
-        'limit' => $limit + 1,
-      ));
+    $branches = $this->branchFuture->resolve();
     if (!$branches) {
       return null;
     }
 
+    $limit = $this->getBranchLimit();
     $more_branches = (count($branches) > $limit);
     $branches = array_slice($branches, 0, $limit);
 
     $branches = DiffusionRepositoryRef::loadAllFromDictionaries($branches);
 
     $commits = id(new DiffusionCommitQuery())
       ->setViewer($viewer)
       ->withIdentifiers(mpull($branches, 'getCommitIdentifier'))
       ->withRepository($drequest->getRepository())
       ->execute();
 
     $table = id(new DiffusionBranchTableView())
       ->setUser($viewer)
       ->setDiffusionRequest($drequest)
       ->setBranches($branches)
       ->setCommits($commits);
 
     $panel = id(new PHUIObjectBoxView())
       ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
     $header = new PHUIHeaderView();
     $header->setHeader(pht('Branches'));
 
     if ($more_branches) {
       $header->setSubHeader(pht('Showing %d branches.', $limit));
     }
 
     $button = new PHUIButtonView();
     $button->setText(pht('Show All'));
     $button->setTag('a');
     $button->setIcon('fa-code-fork');
     $button->setHref($drequest->generateURI(
       array(
         'action' => 'branches',
       )));
 
     $header->addActionLink($button);
     $panel->setHeader($header);
     $panel->setTable($table);
 
     return $panel;
   }
 
   private function buildTagListTable(DiffusionRequest $drequest) {
     $viewer = $this->getViewer();
     $repository = $drequest->getRepository();
 
-    switch ($repository->getVersionControlSystem()) {
-      case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
-        // no tags in SVN
-        return null;
+    if (!$this->needTagFuture()) {
+      return null;
     }
-    $tag_limit = 15;
-    $tags = array();
-    $tags = DiffusionRepositoryTag::newFromConduit(
-      $this->callConduitWithDiffusionRequest(
-        'diffusion.tagsquery',
-        array(
-          // On the home page, we want to find tags on any branch.
-          'commit' => null,
-          'limit' => $tag_limit + 1,
-        )));
 
+    $tags = $this->tagFuture->resolve();
+    $tags = DiffusionRepositoryTag::newFromConduit($tags);
     if (!$tags) {
       return null;
     }
 
+    $tag_limit = $this->getTagLimit();
     $more_tags = (count($tags) > $tag_limit);
     $tags = array_slice($tags, 0, $tag_limit);
 
     $commits = id(new DiffusionCommitQuery())
       ->setViewer($viewer)
       ->withIdentifiers(mpull($tags, 'getCommitIdentifier'))
       ->withRepository($repository)
       ->needCommitData(true)
       ->execute();
 
     $view = id(new DiffusionTagListView())
       ->setUser($viewer)
       ->setDiffusionRequest($drequest)
       ->setTags($tags)
       ->setCommits($commits);
 
     $phids = $view->getRequiredHandlePHIDs();
     $handles = $this->loadViewerHandles($phids);
     $view->setHandles($handles);
 
     $panel = new PHUIObjectBoxView();
     $header = new PHUIHeaderView();
     $header->setHeader(pht('Tags'));
 
     if ($more_tags) {
       $header->setSubHeader(
         pht('Showing the %d most recent tags.', $tag_limit));
     }
 
     $button = new PHUIButtonView();
     $button->setText(pht('Show All Tags'));
     $button->setTag('a');
     $button->setIcon('fa-tag');
     $button->setHref($drequest->generateURI(
       array(
         'action' => 'tags',
       )));
 
     $header->addActionLink($button);
 
     $panel->setHeader($header);
     $panel->setTable($view);
     $panel->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
 
     return $panel;
   }
 
   private function buildHistoryTable(
     $history_results,
     $history,
     $history_exception) {
 
     $request = $this->getRequest();
     $viewer = $request->getUser();
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     if ($history_exception) {
       if ($repository->isImporting()) {
         return $this->renderStatusMessage(
           pht('Still Importing...'),
           pht(
             'This repository is still importing. History is not yet '.
             'available.'));
       } else {
         return $this->renderStatusMessage(
           pht('Unable to Retrieve History'),
           $history_exception->getMessage());
       }
     }
 
     $history_table = id(new DiffusionHistoryTableView())
       ->setUser($viewer)
       ->setDiffusionRequest($drequest)
       ->setHistory($history);
 
     // TODO: Super sketchy.
     $history_table->loadRevisions();
 
     if ($history_results) {
       $history_table->setParents($history_results['parents']);
     }
 
     $history_table->setIsHead(true);
 
     $icon = id(new PHUIIconView())
       ->setIcon('fa-list-alt');
 
     $button = id(new PHUIButtonView())
       ->setText(pht('View History'))
       ->setHref($drequest->generateURI(
         array(
           'action' => 'history',
         )))
       ->setTag('a')
       ->setIcon($icon);
 
     $panel = id(new PHUIObjectBoxView())
       ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
     $header = id(new PHUIHeaderView())
       ->setHeader(pht('Recent Commits'))
       ->addActionLink($button);
     $panel->setHeader($header);
     $panel->setTable($history_table);
 
     return $panel;
   }
 
   private function buildLocateFile() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $locate_panel = null;
     if ($repository->canUsePathTree()) {
       Javelin::initBehavior(
         'diffusion-locate-file',
         array(
           'controlID' => 'locate-control',
           'inputID' => 'locate-input',
           'browseBaseURI' => (string)$drequest->generateURI(
             array(
               'action' => 'browse',
             )),
           'uri' => (string)$drequest->generateURI(
             array(
               'action' => 'pathtree',
             )),
         ));
 
       $form = id(new AphrontFormView())
         ->setUser($viewer)
         ->appendChild(
           id(new AphrontFormTypeaheadControl())
             ->setHardpointID('locate-control')
             ->setID('locate-input')
             ->setLabel(pht('Locate File')));
       $form_box = id(new PHUIBoxView())
         ->appendChild($form->buildLayoutView());
       $locate_panel = id(new PHUIObjectBoxView())
         ->setHeaderText(pht('Locate File'))
         ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
         ->appendChild($form_box);
     }
     return $locate_panel;
   }
 
   private function buildBrowseTable(
     $browse_results,
     $browse_paths,
     $browse_exception,
     array $handles,
     PHUIPagerView $pager) {
 
     require_celerity_resource('diffusion-icons-css');
 
     $request = $this->getRequest();
     $viewer = $request->getUser();
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     if ($browse_exception) {
       if ($repository->isImporting()) {
         // The history table renders a useful message.
         return null;
       } else {
         return $this->renderStatusMessage(
           pht('Unable to Retrieve Paths'),
           $browse_exception->getMessage());
       }
     }
 
     $browse_table = id(new DiffusionBrowseTableView())
       ->setUser($viewer)
       ->setDiffusionRequest($drequest)
       ->setHandles($handles);
     if ($browse_paths) {
       $browse_table->setPaths($browse_paths);
     } else {
       $browse_table->setPaths(array());
     }
 
     $browse_uri = $drequest->generateURI(array('action' => 'browse'));
 
     $browse_panel = id(new PHUIObjectBoxView())
       ->setBackground(PHUIObjectBoxView::BLUE_PROPERTY);
     $header = id(new PHUIHeaderView())
       ->setHeader($repository->getName());
 
     $icon = id(new PHUIIconView())
       ->setIcon('fa-folder-open');
 
     $button = new PHUIButtonView();
     $button->setText(pht('Browse Repository'));
     $button->setTag('a');
     $button->setIcon($icon);
     $button->setHref($browse_uri);
 
     $header->addActionLink($button);
     $browse_panel->setHeader($header);
     $browse_panel->setTable($browse_table);
 
     $pager->setURI($browse_uri, 'offset');
 
     if ($pager->willShowPagingControls()) {
       $pager_box = $this->renderTablePagerBox($pager);
     } else {
       $pager_box = null;
     }
 
     return array(
       $browse_panel,
       $pager_box,
     );
   }
 
   private function renderCloneURI(
     PhabricatorRepository $repository,
     PhabricatorRepositoryURI $uri) {
 
     if ($repository->isSVN()) {
       $display = csprintf(
         'svn checkout %R %R',
         (string)$uri->getDisplayURI(),
         $repository->getCloneName());
     } else {
       $display = csprintf('%R', (string)$uri->getDisplayURI());
     }
 
     $display = (string)$display;
     $viewer = $this->getViewer();
 
     return id(new DiffusionCloneURIView())
       ->setViewer($viewer)
       ->setRepository($repository)
       ->setRepositoryURI($uri)
       ->setDisplayURI($display);
   }
 
+  private function needTagFuture() {
+    $drequest = $this->getDiffusionRequest();
+    $repository = $drequest->getRepository();
+
+    switch ($repository->getVersionControlSystem()) {
+      case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
+        // No tags in SVN.
+        return false;
+    }
+
+    return true;
+  }
+
+  private function getTagLimit() {
+    return 15;
+  }
+
+  private function needBranchFuture() {
+    $drequest = $this->getDiffusionRequest();
+
+    if ($drequest->getBranch() === null) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private function getBranchLimit() {
+    return 15;
+  }
+
 }
diff --git a/src/applications/diffusion/query/DiffusionQuery.php b/src/applications/diffusion/query/DiffusionQuery.php
index 409bf68980..6675197932 100644
--- a/src/applications/diffusion/query/DiffusionQuery.php
+++ b/src/applications/diffusion/query/DiffusionQuery.php
@@ -1,217 +1,225 @@
 <?php
 
 abstract class DiffusionQuery extends PhabricatorQuery {
 
   private $request;
 
   final protected function __construct() {
     // <protected>
   }
 
   protected static function newQueryObject(
     $base_class,
     DiffusionRequest $request) {
 
     $repository = $request->getRepository();
 
     $obj = self::initQueryObject($base_class, $repository);
     $obj->request = $request;
 
     return $obj;
   }
 
   final protected static function initQueryObject(
     $base_class,
     PhabricatorRepository $repository) {
 
     $map = array(
       PhabricatorRepositoryType::REPOSITORY_TYPE_GIT        => 'Git',
       PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL  => 'Mercurial',
       PhabricatorRepositoryType::REPOSITORY_TYPE_SVN        => 'Svn',
     );
 
     $name = idx($map, $repository->getVersionControlSystem());
     if (!$name) {
       throw new Exception(pht('Unsupported VCS!'));
     }
 
     $class = str_replace('Diffusion', 'Diffusion'.$name, $base_class);
     $obj = new $class();
     return $obj;
   }
 
   final protected function getRequest() {
     return $this->request;
   }
 
   final public static function callConduitWithDiffusionRequest(
     PhabricatorUser $user,
     DiffusionRequest $drequest,
     $method,
-    array $params = array()) {
+    array $params = array(),
+    $return_future = false) {
 
     $repository = $drequest->getRepository();
 
     $core_params = array(
       'repository' => $repository->getPHID(),
     );
 
     if ($drequest->getBranch() !== null) {
       $core_params['branch'] = $drequest->getBranch();
     }
 
     // If the method we're calling doesn't actually take some of the implicit
     // parameters we derive from the DiffusionRequest, omit them.
     $method_object = ConduitAPIMethod::getConduitMethod($method);
     $method_params = $method_object->getParamTypes();
     foreach ($core_params as $key => $value) {
       if (empty($method_params[$key])) {
         unset($core_params[$key]);
       }
     }
 
     $params = $params + $core_params;
 
     $client = $repository->newConduitClient(
       $user,
       $drequest->getIsClusterRequest());
     if (!$client) {
-      return id(new ConduitCall($method, $params))
+      $result = id(new ConduitCall($method, $params))
         ->setUser($user)
         ->execute();
+      $future = new ImmediateFuture($result);
     } else {
-      return $client->callMethodSynchronous($method, $params);
+      $future = $client->callMethod($method, $params);
     }
+
+    if (!$return_future) {
+      return $future->resolve();
+    }
+
+    return $future;
   }
 
   public function execute() {
     return $this->executeQuery();
   }
 
   abstract protected function executeQuery();
 
 
 /* -(  Query Utilities  )---------------------------------------------------- */
 
 
   final public static function loadCommitsByIdentifiers(
     array $identifiers,
     DiffusionRequest $drequest) {
     if (!$identifiers) {
       return array();
     }
 
     $commits = array();
     $commit_data = array();
 
     $repository = $drequest->getRepository();
 
     $commits = id(new PhabricatorRepositoryCommit())->loadAllWhere(
       'repositoryID = %d AND commitIdentifier IN (%Ls)',
         $repository->getID(),
       $identifiers);
     $commits = mpull($commits, null, 'getCommitIdentifier');
 
     // Build empty commit objects for every commit, so we can show unparsed
     // commits in history views (as "Importing") instead of not showing them.
     // This makes the process of importing and parsing commits clearer to the
     // user.
 
     $commit_list = array();
     foreach ($identifiers as $identifier) {
       $commit_obj = idx($commits, $identifier);
       if (!$commit_obj) {
         $commit_obj = new PhabricatorRepositoryCommit();
         $commit_obj->setRepositoryID($repository->getID());
         $commit_obj->setCommitIdentifier($identifier);
         $commit_obj->makeEphemeral();
       }
       $commit_list[$identifier] = $commit_obj;
     }
     $commits = $commit_list;
 
     $commit_ids = array_filter(mpull($commits, 'getID'));
     if ($commit_ids) {
       $commit_data = id(new PhabricatorRepositoryCommitData())->loadAllWhere(
         'commitID in (%Ld)',
         $commit_ids);
       $commit_data = mpull($commit_data, null, 'getCommitID');
     }
 
     foreach ($commits as $commit) {
       if (!$commit->getID()) {
         continue;
       }
       if (idx($commit_data, $commit->getID())) {
         $commit->attachCommitData($commit_data[$commit->getID()]);
       }
     }
 
     return $commits;
   }
 
   final public static function loadHistoryForCommitIdentifiers(
     array $identifiers,
     DiffusionRequest $drequest) {
 
     if (!$identifiers) {
       return array();
     }
 
     $repository = $drequest->getRepository();
     $commits = self::loadCommitsByIdentifiers($identifiers, $drequest);
 
     if (!$commits) {
       return array();
     }
 
     $path = $drequest->getPath();
 
     $conn_r = $repository->establishConnection('r');
 
     $path_normal = DiffusionPathIDQuery::normalizePath($path);
     $paths = queryfx_all(
       $conn_r,
       'SELECT id, path FROM %T WHERE pathHash IN (%Ls)',
       PhabricatorRepository::TABLE_PATH,
       array(md5($path_normal)));
     $paths = ipull($paths, 'id', 'path');
     $path_id = idx($paths, $path_normal);
 
     $commit_ids = array_filter(mpull($commits, 'getID'));
 
     $path_changes = array();
     if ($path_id && $commit_ids) {
       $path_changes = queryfx_all(
         $conn_r,
         'SELECT * FROM %T WHERE commitID IN (%Ld) AND pathID = %d',
         PhabricatorRepository::TABLE_PATHCHANGE,
         $commit_ids,
         $path_id);
       $path_changes = ipull($path_changes, null, 'commitID');
     }
 
     $history = array();
     foreach ($identifiers as $identifier) {
       $item = new DiffusionPathChange();
       $item->setCommitIdentifier($identifier);
       $commit = idx($commits, $identifier);
       if ($commit) {
         $item->setCommit($commit);
         try {
           $item->setCommitData($commit->getCommitData());
         } catch (Exception $ex) {
           // Ignore, commit just doesn't have data.
         }
         $change = idx($path_changes, $commit->getID());
         if ($change) {
           $item->setChangeType($change['changeType']);
           $item->setFileType($change['fileType']);
         }
       }
       $history[] = $item;
     }
 
     return $history;
   }
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index b30f3cac13..61b2209c24 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,1543 +1,1557 @@
 <?php
 
 /**
  * @task availability Availability
  * @task image-cache Profile Image Cache
  * @task factors Multi-Factor Authentication
  * @task handles Managing Handles
  * @task settings Settings
  * @task cache User Cache
  */
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface,
     PhabricatorDestructibleInterface,
     PhabricatorSSHPublicKeyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorApplicationTransactionInterface,
     PhabricatorFulltextInterface,
     PhabricatorConduitResultInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $passwordSalt;
   protected $passwordHash;
   protected $profileImagePHID;
   protected $availabilityCache;
   protected $availabilityCacheTTL;
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isMailingList = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
   protected $isEnrolledInMultiFactor = 0;
 
   protected $accountSecret;
 
   private $profile = null;
   private $availability = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
   private $badgePHIDs = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
   private $session = self::ATTACHABLE;
   private $rawCacheData = array();
   private $usableCacheData = array();
 
   private $authorities = array();
   private $handlePool;
   private $csrfSalt;
 
   private $settingCacheKeys = array();
   private $settingCache = array();
   private $allowInlineCacheGeneration;
+  private $conduitClusterToken = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isMailingList':
         return (bool)$this->isMailingList;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if (!$this->isLoggedIn()) {
       return false;
     }
 
     if ($this->isOmnipotent()) {
       return true;
     }
 
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
   public function canEstablishWebSessions() {
     if ($this->getIsMailingList()) {
       return false;
     }
 
     if ($this->getIsSystemAgent()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishAPISessions() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     // Intracluster requests are permitted even if the user is logged out:
     // in particular, public users are allowed to issue intracluster requests
     // when browsing Diffusion.
     if (PhabricatorEnv::isClusterRemoteAddress()) {
       if (!$this->isLoggedIn()) {
         return true;
       }
     }
 
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishSSHSessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   /**
    * Returns `true` if this is a standard user who is logged in. Returns `false`
    * for logged out, anonymous, or external users.
    *
    * @return bool `true` if the user is a standard user who is logged in with
    *              a normal session.
    */
   public function getIsStandardUser() {
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_COLUMN_SCHEMA => array(
         'userName' => 'sort64',
         'realName' => 'text128',
         'passwordSalt' => 'text32?',
         'passwordHash' => 'text128?',
         'profileImagePHID' => 'phid?',
         'conduitCertificate' => 'text255',
         'isSystemAgent' => 'bool',
         'isMailingList' => 'bool',
         'isDisabled' => 'bool',
         'isAdmin' => 'bool',
         'isEmailVerified' => 'uint32',
         'isApproved' => 'uint32',
         'accountSecret' => 'bytes64',
         'isEnrolledInMultiFactor' => 'bool',
         'availabilityCache' => 'text255?',
         'availabilityCacheTTL' => 'uint32?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'userName' => array(
           'columns' => array('userName'),
           'unique' => true,
         ),
         'realName' => array(
           'columns' => array('realName'),
         ),
         'key_approved' => array(
           'columns' => array('isApproved'),
         ),
       ),
       self::CONFIG_NO_MUTATE => array(
         'availabilityCache' => true,
         'availabilityCacheTTL' => true,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeopleUserPHIDType::TYPECONST);
   }
 
   public function setPassword(PhutilOpaqueEnvelope $envelope) {
     if (!$this->getPHID()) {
       throw new Exception(
         pht(
           'You can not set a password for an unsaved user because their PHID '.
           'is a salt component in the password hash.'));
     }
 
     if (!strlen($envelope->openEnvelope())) {
       $this->setPasswordHash('');
     } else {
       $this->setPasswordSalt(md5(Filesystem::readRandomBytes(32)));
       $hash = $this->hashPassword($envelope);
       $this->setPasswordHash($hash->openEnvelope());
     }
     return $this;
   }
 
   public function getMonogram() {
     return '@'.$this->getUsername();
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
 
     if (!strlen($this->getAccountSecret())) {
       $this->setAccountSecret(Filesystem::readRandomCharacters(64));
     }
 
     $result = parent::save();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   public function attachSession(PhabricatorAuthSession $session) {
     $this->session = $session;
     return $this;
   }
 
   public function getSession() {
     return $this->assertAttached($this->session);
   }
 
   public function hasSession() {
     return ($this->session !== self::ATTACHABLE);
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   public function comparePassword(PhutilOpaqueEnvelope $envelope) {
     if (!strlen($envelope->openEnvelope())) {
       return false;
     }
     if (!strlen($this->getPasswordHash())) {
       return false;
     }
 
     return PhabricatorPasswordHasher::comparePassword(
       $this->getPasswordHashInput($envelope),
       new PhutilOpaqueEnvelope($this->getPasswordHash()));
   }
 
   private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
     $input =
       $this->getUsername().
       $password->openEnvelope().
       $this->getPHID().
       $this->getPasswordSalt();
 
     return new PhutilOpaqueEnvelope($input);
   }
 
   private function hashPassword(PhutilOpaqueEnvelope $password) {
     $hasher = PhabricatorPasswordHasher::getBestHasher();
 
     $input_envelope = $this->getPasswordHashInput($password);
     return $hasher->getPasswordHashForStorage($input_envelope);
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   public function getCSRFToken() {
     if ($this->isOmnipotent()) {
       // We may end up here when called from the daemons. The omnipotent user
       // has no meaningful CSRF token, so just return `null`.
       return null;
     }
 
     if ($this->csrfSalt === null) {
       $this->csrfSalt = Filesystem::readRandomCharacters(
         self::CSRF_SALT_LENGTH);
     }
 
     $salt = $this->csrfSalt;
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
     $hash = PhabricatorHash::digest($token, $salt);
     return self::CSRF_BREACH_PREFIX.$salt.substr(
         $hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
     // We expect a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
     if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
       return false;
     }
 
     $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
     $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
 
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
 
       $digest = PhabricatorHash::digest($valid, $salt);
       $digest = substr($digest, 0, self::CSRF_TOKEN_LENGTH);
       if (phutil_hashes_are_identical($digest, $token)) {
         return true;
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getAccountSecret();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     if ($this->hasSession()) {
       $vec = $vec.$this->getSession()->getSessionKey();
     }
 
     $time_block = floor($epoch / $frequency);
     $vec = $vec.$key.$time_block;
 
     return substr(PhabricatorHash::digest($vec), 0, $len);
   }
 
   public function getUserProfile() {
     return $this->assertAttached($this->profile);
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $this->profile = PhabricatorUserProfile::initializeNewProfile($this);
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception(pht('User has no primary email address!'));
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
 
 /* -(  Settings  )----------------------------------------------------------- */
 
 
   public function getUserSetting($key) {
     // NOTE: We store available keys and cached values separately to make it
     // faster to check for `null` in the cache, which is common.
     if (isset($this->settingCacheKeys[$key])) {
       return $this->settingCache[$key];
     }
 
     $settings_key = PhabricatorUserPreferencesCacheType::KEY_PREFERENCES;
     if ($this->getPHID()) {
       $settings = $this->requireCacheData($settings_key);
     } else {
       $settings = $this->loadGlobalSettings();
     }
 
     if (array_key_exists($key, $settings)) {
       $value = $settings[$key];
       return $this->writeUserSettingCache($key, $value);
     }
 
     $cache = PhabricatorCaches::getRuntimeCache();
     $cache_key = "settings.defaults({$key})";
     $cache_map = $cache->getKeys(array($cache_key));
 
     if ($cache_map) {
       $value = $cache_map[$cache_key];
     } else {
       $defaults = PhabricatorSetting::getAllSettings();
       if (isset($defaults[$key])) {
         $value = id(clone $defaults[$key])
           ->setViewer($this)
           ->getSettingDefaultValue();
       } else {
         $value = null;
       }
 
       $cache->setKey($cache_key, $value);
     }
 
     return $this->writeUserSettingCache($key, $value);
   }
 
 
   /**
    * Test if a given setting is set to a particular value.
    *
    * @param const Setting key.
    * @param wild Value to compare.
    * @return bool True if the setting has the specified value.
    * @task settings
    */
   public function compareUserSetting($key, $value) {
     $actual = $this->getUserSetting($key);
     return ($actual == $value);
   }
 
   private function writeUserSettingCache($key, $value) {
     $this->settingCacheKeys[$key] = true;
     $this->settingCache[$key] = $value;
     return $value;
   }
 
   public function getTranslation() {
     return $this->getUserSetting(PhabricatorTranslationSetting::SETTINGKEY);
   }
 
   public function getTimezoneIdentifier() {
     return $this->getUserSetting(PhabricatorTimezoneSetting::SETTINGKEY);
   }
 
   public static function getGlobalSettingsCacheKey() {
     return 'user.settings.globals.v1';
   }
 
   private function loadGlobalSettings() {
     $cache_key = self::getGlobalSettingsCacheKey();
     $cache = PhabricatorCaches::getMutableStructureCache();
 
     $settings = $cache->getKey($cache_key);
     if (!$settings) {
       $preferences = PhabricatorUserPreferences::loadGlobalPreferences($this);
       $settings = $preferences->getPreferences();
       $cache->setKey($cache_key, $settings);
     }
 
     return $settings;
   }
 
 
   /**
    * Override the user's timezone identifier.
    *
    * This is primarily useful for unit tests.
    *
    * @param string New timezone identifier.
    * @return this
    * @task settings
    */
   public function overrideTimezoneIdentifier($identifier) {
     $timezone_key = PhabricatorTimezoneSetting::SETTINGKEY;
     $this->settingCacheKeys[$timezone_key] = true;
     $this->settingCache[$timezone_key] = $identifier;
     return $this;
   }
 
   public function getGender() {
     return $this->getUserSetting(PhabricatorPronounSetting::SETTINGKEY);
   }
 
   public function loadEditorLink(
     $path,
     $line,
     PhabricatorRepository $repository = null) {
 
     $editor = $this->getUserSetting(PhabricatorEditorSetting::SETTINGKEY);
 
     if (is_array($path)) {
       $multi_key = PhabricatorEditorMultipleSetting::SETTINGKEY;
       $multiedit = $this->getUserSetting($multi_key);
       switch ($multiedit) {
         case PhabricatorEditorMultipleSetting::VALUE_SPACES:
           $path = implode(' ', $path);
           break;
         case PhabricatorEditorMultipleSetting::VALUE_SINGLE:
         default:
           return null;
       }
     }
 
     if (!strlen($editor)) {
       return null;
     }
 
     if ($repository) {
       $callsign = $repository->getCallsign();
     } else {
       $callsign = null;
     }
 
     $uri = strtr($editor, array(
       '%%' => '%',
       '%f' => phutil_escape_uri($path),
       '%l' => phutil_escape_uri($line),
       '%r' => phutil_escape_uri($callsign),
     ));
 
     // The resulting URI must have an allowed protocol. Otherwise, we'll return
     // a link to an error page explaining the misconfiguration.
 
     $ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
     if (!$ok) {
       return '/help/editorprotocol/';
     }
 
     return (string)$uri;
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $tokens = PhabricatorTypeaheadDatasource::tokenizeString(
       $this->getUserName().' '.$this->getRealName());
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     if (!$this->canEstablishWebSessions()) {
       throw new Exception(
         pht(
           'Can not send welcome mail to users who can not establish '.
           'web sessions!'));
     }
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $engine = new PhabricatorAuthSessionEngine();
     $uri = $engine->getOneTimeLoginURI(
       $this,
       $this->loadPrimaryEmail(),
       PhabricatorAuthSessionEngine::ONETIME_WELCOME);
 
     $body = pht(
       "Welcome to Phabricator!\n\n".
       "%s (%s) has created an account for you.\n\n".
       "  Username: %s\n\n".
       "To login to Phabricator, follow this link and set a password:\n\n".
       "  %s\n\n".
       "After you have set a password, you can login in the future by ".
       "going here:\n\n".
       "  %s\n",
       $admin_username,
       $admin_realname,
       $user_username,
       $uri,
       $base_uri);
 
     if (!$is_serious) {
       $body .= sprintf(
         "\n%s\n",
         pht("Love,\nPhabricator"));
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Welcome to Phabricator'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorPasswordAuthProvider::getPasswordProvider()) {
       $engine = new PhabricatorAuthSessionEngine();
       $uri = $engine->getOneTimeLoginURI(
         $this,
         null,
         PhabricatorAuthSessionEngine::ONETIME_USERNAME);
       $password_instructions = sprintf(
         "%s\n\n  %s\n\n%s\n",
         pht(
           "If you use a password to login, you'll need to reset it ".
           "before you can login again. You can reset your password by ".
           "following this link:"),
         $uri,
         pht(
           "And, of course, you'll need to use your new username to login ".
           "from now on. If you use OAuth to login, nothing should change."));
     }
 
     $body = sprintf(
       "%s\n\n  %s\n  %s\n\n%s",
       pht(
         '%s (%s) has changed your Phabricator username.',
         $admin_username,
         $admin_realname),
       pht(
         'Old Username: %s',
         $old_username),
       pht(
         'New Username: %s',
         $new_username),
       $password_instructions);
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Username Changed'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function getProfileImageURI() {
     $uri_key = PhabricatorUserProfileImageCacheType::KEY_URI;
     return $this->requireCacheData($uri_key);
   }
 
   public function getUnreadNotificationCount() {
     $notification_key = PhabricatorUserNotificationCountCacheType::KEY_COUNT;
     return $this->requireCacheData($notification_key);
   }
 
   public function getUnreadMessageCount() {
     $message_key = PhabricatorUserMessageCountCacheType::KEY_COUNT;
     return $this->requireCacheData($message_key);
   }
 
   public function getFullName() {
     if (strlen($this->getRealName())) {
       return $this->getUsername().' ('.$this->getRealName().')';
     } else {
       return $this->getUsername();
     }
   }
 
   public function getTimeZone() {
     return new DateTimeZone($this->getTimezoneIdentifier());
   }
 
   public function getTimeZoneOffset() {
     $timezone = $this->getTimeZone();
     $now = new DateTime('@'.PhabricatorTime::getNow());
     $offset = $timezone->getOffset($now);
 
     // Javascript offsets are in minutes and have the opposite sign.
     $offset = -(int)($offset / 60);
 
     return $offset;
   }
 
   public function getTimeZoneOffsetInHours() {
     $offset = $this->getTimeZoneOffset();
     $offset = (int)round($offset / 60);
     $offset = -$offset;
 
     return $offset;
   }
 
   public function formatShortDateTime($when, $now = null) {
     if ($now === null) {
       $now = PhabricatorTime::getNow();
     }
 
     try {
       $when = new DateTime('@'.$when);
       $now = new DateTime('@'.$now);
     } catch (Exception $ex) {
       return null;
     }
 
     $zone = $this->getTimeZone();
 
     $when->setTimeZone($zone);
     $now->setTimeZone($zone);
 
     if ($when->format('Y') !== $now->format('Y')) {
       // Different year, so show "Feb 31 2075".
       $format = 'M j Y';
     } else if ($when->format('Ymd') !== $now->format('Ymd')) {
       // Same year but different month and day, so show "Feb 31".
       $format = 'M j';
     } else {
       // Same year, month and day so show a time of day.
       $pref_time = PhabricatorTimeFormatSetting::SETTINGKEY;
       $format = $this->getUserSetting($pref_time);
     }
 
     return $when->format($format);
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
   public function getDefaultSpacePHID() {
     // TODO: We might let the user switch which space they're "in" later on;
     // for now just use the global space if one exists.
 
     // If the viewer has access to the default space, use that.
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
     foreach ($spaces as $space) {
       if ($space->getIsDefaultNamespace()) {
         return $space->getPHID();
       }
     }
 
     // Otherwise, use the space with the lowest ID that they have access to.
     // This just tends to keep the default stable and predictable over time,
     // so adding a new space won't change behavior for users.
     if ($spaces) {
       $spaces = msort($spaces, 'getID');
       return head($spaces)->getPHID();
     }
 
     return null;
   }
 
 
   /**
    * Grant a user a source of authority, to let them bypass policy checks they
    * could not otherwise.
    */
   public function grantAuthority($authority) {
     $this->authorities[] = $authority;
     return $this;
   }
 
 
   /**
    * Get authorities granted to the user.
    */
   public function getAuthorities() {
     return $this->authorities;
   }
 
+  public function hasConduitClusterToken() {
+    return ($this->conduitClusterToken !== self::ATTACHABLE);
+  }
+
+  public function attachConduitClusterToken(PhabricatorConduitToken $token) {
+    $this->conduitClusterToken = $token;
+    return $this;
+  }
+
+  public function getConduitClusterToken() {
+    return $this->assertAttached($this->conduitClusterToken);
+  }
+
 
 /* -(  Availability  )------------------------------------------------------- */
 
 
   /**
    * @task availability
    */
   public function attachAvailability(array $availability) {
     $this->availability = $availability;
     return $this;
   }
 
 
   /**
    * Get the timestamp the user is away until, if they are currently away.
    *
    * @return int|null Epoch timestamp, or `null` if the user is not away.
    * @task availability
    */
   public function getAwayUntil() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'until');
   }
 
 
   public function getDisplayAvailability() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     $busy = PhabricatorCalendarEventInvitee::AVAILABILITY_BUSY;
 
     return idx($availability, 'availability', $busy);
   }
 
 
   public function getAvailabilityEventPHID() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'eventPHID');
   }
 
 
   /**
    * Get cached availability, if present.
    *
    * @return wild|null Cache data, or null if no cache is available.
    * @task availability
    */
   public function getAvailabilityCache() {
     $now = PhabricatorTime::getNow();
     if ($this->availabilityCacheTTL <= $now) {
       return null;
     }
 
     try {
       return phutil_json_decode($this->availabilityCache);
     } catch (Exception $ex) {
       return null;
     }
   }
 
 
   /**
    * Write to the availability cache.
    *
    * @param wild Availability cache data.
    * @param int|null Cache TTL.
    * @return this
    * @task availability
    */
   public function writeAvailabilityCache(array $availability, $ttl) {
     if (PhabricatorEnv::isReadOnly()) {
       return $this;
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
         WHERE id = %d',
       $this->getTableName(),
       json_encode($availability),
       $ttl,
       $this->getID());
     unset($unguarded);
 
     return $this;
   }
 
 
 /* -(  Multi-Factor Authentication  )---------------------------------------- */
 
 
   /**
    * Update the flag storing this user's enrollment in multi-factor auth.
    *
    * With certain settings, we need to check if a user has MFA on every page,
    * so we cache MFA enrollment on the user object for performance. Calling this
    * method synchronizes the cache by examining enrollment records. After
    * updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
    * the user is enrolled.
    *
    * This method should be called after any changes are made to a given user's
    * multi-factor configuration.
    *
    * @return void
    * @task factors
    */
   public function updateMultiFactorEnrollment() {
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $this->getPHID());
 
     $enrolled = count($factors) ? 1 : 0;
     if ($enrolled !== $this->isEnrolledInMultiFactor) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         queryfx(
           $this->establishConnection('w'),
           'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
           $this->getTableName(),
           $enrolled,
           $this->getID());
       unset($unguarded);
 
       $this->isEnrolledInMultiFactor = $enrolled;
     }
   }
 
 
   /**
    * Check if the user is enrolled in multi-factor authentication.
    *
    * Enrolled users have one or more multi-factor authentication sources
    * attached to their account. For performance, this value is cached. You
    * can use @{method:updateMultiFactorEnrollment} to update the cache.
    *
    * @return bool True if the user is enrolled.
    * @task factors
    */
   public function getIsEnrolledInMultiFactor() {
     return $this->isEnrolledInMultiFactor;
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
   /**
    * Get a scalar string identifying this user.
    *
    * This is similar to using the PHID, but distinguishes between ominpotent
    * and public users explicitly. This allows safe construction of cache keys
    * or cache buckets which do not conflate public and omnipotent users.
    *
    * @return string Scalar identifier.
    */
   public function getCacheFragment() {
     if ($this->isOmnipotent()) {
       return 'u.omnipotent';
     }
 
     $phid = $this->getPHID();
     if ($phid) {
       return 'u.'.$phid;
     }
 
     return 'u.public';
   }
 
 
 /* -(  Managing Handles  )--------------------------------------------------- */
 
 
   /**
    * Get a @{class:PhabricatorHandleList} which benefits from this viewer's
    * internal handle pool.
    *
    * @param list<phid> List of PHIDs to load.
    * @return PhabricatorHandleList Handle list object.
    * @task handle
    */
   public function loadHandles(array $phids) {
     if ($this->handlePool === null) {
       $this->handlePool = id(new PhabricatorHandlePool())
         ->setViewer($this);
     }
 
     return $this->handlePool->newHandleList($phids);
   }
 
 
   /**
    * Get a @{class:PHUIHandleView} for a single handle.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param phid PHID to render a handle for.
    * @return PHUIHandleView View of the handle.
    * @task handle
    */
   public function renderHandle($phid) {
     return $this->loadHandles(array($phid))->renderHandle($phid);
   }
 
 
   /**
    * Get a @{class:PHUIHandleListView} for a list of handles.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param list<phid> List of PHIDs to render.
    * @return PHUIHandleListView View of the handles.
    * @task handle
    */
   public function renderHandleList(array $phids) {
     return $this->loadHandles($phids)->renderList();
   }
 
   public function attachBadgePHIDs(array $phids) {
     $this->badgePHIDs = $phids;
     return $this;
   }
 
   public function getBadgePHIDs() {
     return $this->assertAttached($this->badgePHIDs);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         if ($this->getIsSystemAgent() || $this->getIsMailingList()) {
           return PhabricatorPolicies::POLICY_ADMIN;
         } else {
           return PhabricatorPolicies::POLICY_NOONE;
         }
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
 
       $externals = id(new PhabricatorExternalAccount())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($externals as $external) {
         $external->delete();
       }
 
       $prefs = id(new PhabricatorUserPreferencesQuery())
         ->setViewer($engine->getViewer())
         ->withUsers(array($this))
         ->execute();
       foreach ($prefs as $pref) {
         $engine->destroyObject($pref);
       }
 
       $profiles = id(new PhabricatorUserProfile())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($profiles as $profile) {
         $profile->delete();
       }
 
       $keys = id(new PhabricatorAuthSSHKeyQuery())
         ->setViewer($engine->getViewer())
         ->withObjectPHIDs(array($this->getPHID()))
         ->execute();
       foreach ($keys as $key) {
         $engine->destroyObject($key);
       }
 
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($emails as $email) {
         $email->delete();
       }
 
       $sessions = id(new PhabricatorAuthSession())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($factors as $factor) {
         $factor->delete();
       }
 
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorSSHPublicKeyInterface  )----------------------------------- */
 
 
   public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
     if ($viewer->getPHID() == $this->getPHID()) {
       // If the viewer is managing their own keys, take them to the normal
       // panel.
       return '/settings/panel/ssh/';
     } else {
       // Otherwise, take them to the administrative panel for this user.
       return '/settings/'.$this->getID().'/panel/ssh/';
     }
   }
 
   public function getSSHKeyDefaultName() {
     return 'id_rsa_phabricator';
   }
 
   public function getSSHKeyNotifyPHIDs() {
     return array(
       $this->getPHID(),
     );
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorUserProfileEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorUserTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
     return $timeline;
   }
 
 
 /* -(  PhabricatorFulltextInterface  )--------------------------------------- */
 
 
   public function newFulltextEngine() {
     return new PhabricatorUserFulltextEngine();
   }
 
 
 /* -(  PhabricatorConduitResultInterface  )---------------------------------- */
 
 
   public function getFieldSpecificationsForConduit() {
     return array(
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('username')
         ->setType('string')
         ->setDescription(pht("The user's username.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('realName')
         ->setType('string')
         ->setDescription(pht("The user's real name.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('roles')
         ->setType('list<string>')
         ->setDescription(pht('List of acccount roles.')),
     );
   }
 
   public function getFieldValuesForConduit() {
     $roles = array();
 
     if ($this->getIsDisabled()) {
       $roles[] = 'disabled';
     }
 
     if ($this->getIsSystemAgent()) {
       $roles[] = 'bot';
     }
 
     if ($this->getIsMailingList()) {
       $roles[] = 'list';
     }
 
     if ($this->getIsAdmin()) {
       $roles[] = 'admin';
     }
 
     if ($this->getIsEmailVerified()) {
       $roles[] = 'verified';
     }
 
     if ($this->getIsApproved()) {
       $roles[] = 'approved';
     }
 
     if ($this->isUserActivated()) {
       $roles[] = 'activated';
     }
 
     return array(
       'username' => $this->getUsername(),
       'realName' => $this->getRealName(),
       'roles' => $roles,
     );
   }
 
   public function getConduitSearchAttachments() {
     return array();
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   public function attachRawCacheData(array $data) {
     $this->rawCacheData = $data + $this->rawCacheData;
     return $this;
   }
 
   public function setAllowInlineCacheGeneration($allow_cache_generation) {
     $this->allowInlineCacheGeneration = $allow_cache_generation;
     return $this;
   }
 
   /**
    * @task cache
    */
   protected function requireCacheData($key) {
     if (isset($this->usableCacheData[$key])) {
       return $this->usableCacheData[$key];
     }
 
     $type = PhabricatorUserCacheType::requireCacheTypeForKey($key);
 
     if (isset($this->rawCacheData[$key])) {
       $raw_value = $this->rawCacheData[$key];
 
       $usable_value = $type->getValueFromStorage($raw_value);
       $this->usableCacheData[$key] = $usable_value;
 
       return $usable_value;
     }
 
     // By default, we throw if a cache isn't available. This is consistent
     // with the standard `needX()` + `attachX()` + `getX()` interaction.
     if (!$this->allowInlineCacheGeneration) {
       throw new PhabricatorDataNotAttachedException($this);
     }
 
     $user_phid = $this->getPHID();
 
     // Try to read the actual cache before we generate a new value. We can
     // end up here via Conduit, which does not use normal sessions and can
     // not pick up a free cache load during session identification.
     if ($user_phid) {
       $raw_data = PhabricatorUserCache::readCaches(
         $type,
         $key,
         array($user_phid));
       if (array_key_exists($user_phid, $raw_data)) {
         $raw_value = $raw_data[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
         $this->rawCacheData[$key] = $raw_value;
         $this->usableCacheData[$key] = $usable_value;
         return $usable_value;
       }
     }
 
     $usable_value = $type->getDefaultValue();
 
     if ($user_phid) {
       $map = $type->newValueForUsers($key, array($this));
       if (array_key_exists($user_phid, $map)) {
         $raw_value = $map[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
 
         $this->rawCacheData[$key] = $raw_value;
         PhabricatorUserCache::writeCache(
           $type,
           $key,
           $user_phid,
           $raw_value);
       }
     }
 
     $this->usableCacheData[$key] = $usable_value;
 
     return $usable_value;
   }
 
 
   /**
    * @task cache
    */
   public function clearCacheData($key) {
     unset($this->rawCacheData[$key]);
     unset($this->usableCacheData[$key]);
     return $this;
   }
 
 }