diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
index 82303fff2b..6e40cdde98 100644
--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
@@ -1,857 +1,856 @@
 <?php
 
 /**
  *
  * @task use      Using Sessions
  * @task new      Creating Sessions
  * @task hisec    High Security
  * @task partial  Partial Sessions
  * @task onetime  One Time Login URIs
  * @task cache    User Cache
  */
 final class PhabricatorAuthSessionEngine extends Phobject {
 
   /**
    * Session issued to normal users after they login through a standard channel.
    * Associates the client with a standard user identity.
    */
   const KIND_USER      = 'U';
 
 
   /**
    * Session issued to users who login with some sort of credentials but do not
    * have full accounts. These are sometimes called "grey users".
    *
    * TODO: We do not currently issue these sessions, see T4310.
    */
   const KIND_EXTERNAL  = 'X';
 
 
   /**
    * Session issued to logged-out users which has no real identity information.
    * Its purpose is to protect logged-out users from CSRF.
    */
   const KIND_ANONYMOUS = 'A';
 
 
   /**
    * Session kind isn't known.
    */
   const KIND_UNKNOWN   = '?';
 
 
   const ONETIME_RECOVER = 'recover';
   const ONETIME_RESET = 'reset';
   const ONETIME_WELCOME = 'welcome';
   const ONETIME_USERNAME = 'rename';
 
 
   /**
    * Get the session kind (e.g., anonymous, user, external account) from a
    * session token. Returns a `KIND_` constant.
    *
    * @param   string  Session token.
    * @return  const   Session kind constant.
    */
   public static function getSessionKindFromToken($session_token) {
     if (strpos($session_token, '/') === false) {
       // Old-style session, these are all user sessions.
       return self::KIND_USER;
     }
 
     list($kind, $key) = explode('/', $session_token, 2);
 
     switch ($kind) {
       case self::KIND_ANONYMOUS:
       case self::KIND_USER:
       case self::KIND_EXTERNAL:
         return $kind;
       default:
         return self::KIND_UNKNOWN;
     }
   }
 
 
   /**
    * Load the user identity associated with a session of a given type,
    * identified by token.
    *
    * When the user presents a session token to an API, this method verifies
    * it is of the correct type and loads the corresponding identity if the
    * session exists and is valid.
    *
    * NOTE: `$session_type` is the type of session that is required by the
    * loading context. This prevents use of a Conduit sesssion as a Web
    * session, for example.
    *
    * @param const The type of session to load.
    * @param string The session token.
    * @return PhabricatorUser|null
    * @task use
    */
   public function loadUserForSession($session_type, $session_token) {
     $session_kind = self::getSessionKindFromToken($session_token);
     switch ($session_kind) {
       case self::KIND_ANONYMOUS:
         // Don't bother trying to load a user for an anonymous session, since
         // neither the session nor the user exist.
         return null;
       case self::KIND_UNKNOWN:
         // If we don't know what kind of session this is, don't go looking for
         // it.
         return null;
       case self::KIND_USER:
         break;
       case self::KIND_EXTERNAL:
         // TODO: Implement these (T4310).
         return null;
     }
 
     $session_table = new PhabricatorAuthSession();
     $user_table = new PhabricatorUser();
     $conn_r = $session_table->establishConnection('r');
     $session_key = PhabricatorHash::weakDigest($session_token);
 
     $cache_parts = $this->getUserCacheQueryParts($conn_r);
     list($cache_selects, $cache_joins, $cache_map, $types_map) = $cache_parts;
 
     $info = queryfx_one(
       $conn_r,
       'SELECT
           s.id AS s_id,
           s.sessionExpires AS s_sessionExpires,
           s.sessionStart AS s_sessionStart,
           s.highSecurityUntil AS s_highSecurityUntil,
           s.isPartial AS s_isPartial,
           s.signedLegalpadDocuments as s_signedLegalpadDocuments,
           u.*
           %Q
         FROM %T u JOIN %T s ON u.phid = s.userPHID
         AND s.type = %s AND s.sessionKey = %s %Q',
       $cache_selects,
       $user_table->getTableName(),
       $session_table->getTableName(),
       $session_type,
       $session_key,
       $cache_joins);
 
     if (!$info) {
       return null;
     }
 
     $session_dict = array(
       'userPHID' => $info['phid'],
       'sessionKey' => $session_key,
       'type' => $session_type,
     );
 
     $cache_raw = array_fill_keys($cache_map, null);
     foreach ($info as $key => $value) {
       if (strncmp($key, 's_', 2) === 0) {
         unset($info[$key]);
         $session_dict[substr($key, 2)] = $value;
         continue;
       }
 
       if (isset($cache_map[$key])) {
         unset($info[$key]);
         $cache_raw[$cache_map[$key]] = $value;
         continue;
       }
     }
 
     $user = $user_table->loadFromArray($info);
 
     $cache_raw = $this->filterRawCacheData($user, $types_map, $cache_raw);
     $user->attachRawCacheData($cache_raw);
 
     switch ($session_type) {
       case PhabricatorAuthSession::TYPE_WEB:
         // Explicitly prevent bots and mailing lists from establishing web
         // sessions. It's normally impossible to attach authentication to these
         // accounts, and likewise impossible to generate sessions, but it's
         // technically possible that a session could exist in the database. If
         // one does somehow, refuse to load it.
         if (!$user->canEstablishWebSessions()) {
           return null;
         }
         break;
     }
 
     $session = id(new PhabricatorAuthSession())->loadFromArray($session_dict);
 
     $ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // If more than 20% of the time on this session has been used, refresh the
     // TTL back up to the full duration. The idea here is that sessions are
     // good forever if used regularly, but get GC'd when they fall out of use.
 
     // NOTE: If we begin rotating session keys when extending sessions, the
     // CSRF code needs to be updated so CSRF tokens survive session rotation.
 
     if (time() + (0.80 * $ttl) > $session->getSessionExpires()) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionExpires = UNIX_TIMESTAMP() + %d WHERE id = %d',
           $session->getTableName(),
           $ttl,
           $session->getID());
       unset($unguarded);
     }
 
     $user->attachSession($session);
     return $user;
   }
 
 
   /**
    * Issue a new session key for a given identity. Phabricator supports
    * different types of sessions (like "web" and "conduit") and each session
    * type may have multiple concurrent sessions (this allows a user to be
    * logged in on multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
    * @param   const     Session type constant (see
    *                    @{class:PhabricatorAuthSession}).
    * @param   phid|null Identity to establish a session for, usually a user
    *                    PHID. With `null`, generates an anonymous session.
    * @param   bool      True to issue a partial session.
    * @return  string    Newly generated session key.
    */
   public function establishSession($session_type, $identity_phid, $partial) {
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
     if ($identity_phid === null) {
       return self::KIND_ANONYMOUS.'/'.$session_key;
     }
 
     $session_table = new PhabricatorAuthSession();
     $conn_w = $session_table->establishConnection('w');
 
     // This has a side effect of validating the session type.
     $session_ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     $digest_key = PhabricatorHash::weakDigest($session_key);
 
     // Logging-in users don't have CSRF stuff yet, so we have to unguard this
     // write.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthSession())
         ->setUserPHID($identity_phid)
         ->setType($session_type)
         ->setSessionKey($digest_key)
         ->setSessionStart(time())
         ->setSessionExpires(time() + $session_ttl)
         ->setIsPartial($partial ? 1 : 0)
         ->setSignedLegalpadDocuments(0)
         ->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         null,
         $identity_phid,
         ($partial
           ? PhabricatorUserLog::ACTION_LOGIN_PARTIAL
           : PhabricatorUserLog::ACTION_LOGIN));
 
       $log->setDetails(
         array(
           'session_type' => $session_type,
         ));
       $log->setSession($digest_key);
       $log->save();
     unset($unguarded);
 
     $info = id(new PhabricatorAuthSessionInfo())
       ->setSessionType($session_type)
       ->setIdentityPHID($identity_phid)
       ->setIsPartial($partial);
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didEstablishSession($info);
     }
 
     return $session_key;
   }
 
 
   /**
    * Terminate all of a user's login sessions.
    *
    * This is used when users change passwords, linked accounts, or add
    * multifactor authentication.
    *
    * @param PhabricatorUser User whose sessions should be terminated.
    * @param string|null Optionally, one session to keep. Normally, the current
    *   login session.
    *
    * @return void
    */
   public function terminateLoginSessions(
     PhabricatorUser $user,
     $except_session = null) {
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($user)
       ->withIdentityPHIDs(array($user->getPHID()))
       ->execute();
 
     if ($except_session !== null) {
       $except_session = PhabricatorHash::weakDigest($except_session);
     }
 
     foreach ($sessions as $key => $session) {
       if ($except_session !== null) {
         $is_except = phutil_hashes_are_identical(
           $session->getSessionKey(),
           $except_session);
         if ($is_except) {
           continue;
         }
       }
 
       $session->delete();
     }
   }
 
   public function logoutSession(
     PhabricatorUser $user,
     PhabricatorAuthSession $session) {
 
     $log = PhabricatorUserLog::initializeNewLog(
       $user,
       $user->getPHID(),
       PhabricatorUserLog::ACTION_LOGOUT);
     $log->save();
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didLogout($user, array($session));
     }
 
     $session->delete();
   }
 
 
 /* -(  High Security  )------------------------------------------------------ */
 
 
   /**
    * Require high security, or prompt the user to enter high security.
    *
    * If the user's session is in high security, this method will return a
    * token. Otherwise, it will throw an exception which will eventually
    * be converted into a multi-factor authentication workflow.
    *
    * @param PhabricatorUser User whose session needs to be in high security.
    * @param AphrontReqeust  Current request.
    * @param string          URI to return the user to if they cancel.
    * @param bool            True to jump partial sessions directly into high
    *                        security instead of just upgrading them to full
    *                        sessions.
    * @return PhabricatorAuthHighSecurityToken Security token.
    * @task hisec
    */
   public function requireHighSecuritySession(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri,
     $jump_into_hisec = false) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Requiring a high-security session from a user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     // Check if the session is already in high security mode.
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     // Load the multi-factor auth sources attached to this account.
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $viewer->getPHID());
 
     // If the account has no associated multi-factor auth, just issue a token
     // without putting the session into high security mode. This is generally
     // easier for users. A minor but desirable side effect is that when a user
     // adds an auth factor, existing sessions won't get a free pass into hisec,
     // since they never actually got marked as hisec.
     if (!$factors) {
       return $this->issueHighSecurityToken($session, true);
     }
 
     // Check for a rate limit without awarding points, so the user doesn't
     // get partway through the workflow only to get blocked.
     PhabricatorSystemActionEngine::willTakeAction(
       array($viewer->getPHID()),
       new PhabricatorAuthTryFactorAction(),
       0);
 
     $validation_results = array();
     if ($request->isHTTPPost()) {
       $request->validateCSRF();
       if ($request->getExists(AphrontRequest::TYPE_HISEC)) {
 
         // Limit factor verification rates to prevent brute force attacks.
         PhabricatorSystemActionEngine::willTakeAction(
           array($viewer->getPHID()),
           new PhabricatorAuthTryFactorAction(),
           1);
 
         $ok = true;
         foreach ($factors as $factor) {
           $id = $factor->getID();
           $impl = $factor->requireImplementation();
 
           $validation_results[$id] = $impl->processValidateFactorForm(
             $factor,
             $viewer,
             $request);
 
           if (!$impl->isFactorValid($factor, $validation_results[$id])) {
             $ok = false;
           }
         }
 
         if ($ok) {
           // Give the user a credit back for a successful factor verification.
           PhabricatorSystemActionEngine::willTakeAction(
             array($viewer->getPHID()),
             new PhabricatorAuthTryFactorAction(),
             -1);
 
           if ($session->getIsPartial() && !$jump_into_hisec) {
             // If we have a partial session and are not jumping directly into
             // hisec, just issue a token without putting it in high security
             // mode.
             return $this->issueHighSecurityToken($session, true);
           }
 
           $until = time() + phutil_units('15 minutes in seconds');
           $session->setHighSecurityUntil($until);
 
           queryfx(
             $session->establishConnection('w'),
             'UPDATE %T SET highSecurityUntil = %d WHERE id = %d',
             $session->getTableName(),
             $until,
             $session->getID());
 
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_ENTER_HISEC);
           $log->save();
         } else {
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_FAIL_HISEC);
           $log->save();
         }
       }
     }
 
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     throw id(new PhabricatorAuthHighSecurityRequiredException())
       ->setCancelURI($cancel_uri)
       ->setFactors($factors)
       ->setFactorValidationResults($validation_results);
   }
 
 
   /**
    * Issue a high security token for a session, if authorized.
    *
    * @param PhabricatorAuthSession Session to issue a token for.
    * @param bool Force token issue.
    * @return PhabricatorAuthHighSecurityToken|null Token, if authorized.
    * @task hisec
    */
   private function issueHighSecurityToken(
     PhabricatorAuthSession $session,
     $force = false) {
 
-    $until = $session->getHighSecurityUntil();
-    if ($until > time() || $force) {
+    if ($session->isHighSecuritySession() || $force) {
       return new PhabricatorAuthHighSecurityToken();
     }
 
     return null;
   }
 
 
   /**
    * Render a form for providing relevant multi-factor credentials.
    *
    * @param PhabricatorUser Viewing user.
    * @param AphrontRequest Current request.
    * @return AphrontFormView Renderable form.
    * @task hisec
    */
   public function renderHighSecurityForm(
     array $factors,
     array $validation_results,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->appendRemarkupInstructions('');
 
     foreach ($factors as $factor) {
       $factor->requireImplementation()->renderValidateFactorForm(
         $factor,
         $form,
         $viewer,
         idx($validation_results, $factor->getID()));
     }
 
     $form->appendRemarkupInstructions('');
 
     return $form;
   }
 
 
   /**
    * Strip the high security flag from a session.
    *
    * Kicks a session out of high security and logs the exit.
    *
    * @param PhabricatorUser Acting user.
    * @param PhabricatorAuthSession Session to return to normal security.
    * @return void
    * @task hisec
    */
   public function exitHighSecurity(
     PhabricatorUser $viewer,
     PhabricatorAuthSession $session) {
 
     if (!$session->getHighSecurityUntil()) {
       return;
     }
 
     queryfx(
       $session->establishConnection('w'),
       'UPDATE %T SET highSecurityUntil = NULL WHERE id = %d',
       $session->getTableName(),
       $session->getID());
 
     $log = PhabricatorUserLog::initializeNewLog(
       $viewer,
       $viewer->getPHID(),
       PhabricatorUserLog::ACTION_EXIT_HISEC);
     $log->save();
   }
 
 
 /* -(  Partial Sessions  )--------------------------------------------------- */
 
 
   /**
    * Upgrade a partial session to a full session.
    *
    * @param PhabricatorAuthSession Session to upgrade.
    * @return void
    * @task partial
    */
   public function upgradePartialSession(PhabricatorUser $viewer) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Upgrading partial session of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if (!$session->getIsPartial()) {
       throw new Exception(pht('Session is not partial!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setIsPartial(0);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET isPartial = %d WHERE id = %d',
         $session->getTableName(),
         0,
         $session->getID());
 
       $log = PhabricatorUserLog::initializeNewLog(
         $viewer,
         $viewer->getPHID(),
         PhabricatorUserLog::ACTION_LOGIN_FULL);
       $log->save();
     unset($unguarded);
   }
 
 
 /* -(  Legalpad Documents )-------------------------------------------------- */
 
 
   /**
    * Upgrade a session to have all legalpad documents signed.
    *
    * @param PhabricatorUser User whose session should upgrade.
    * @param array LegalpadDocument objects
    * @return void
    * @task partial
    */
   public function signLegalpadDocuments(PhabricatorUser $viewer, array $docs) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Signing session legalpad documents of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if ($session->getSignedLegalpadDocuments()) {
       throw new Exception(pht(
         'Session has already signed required legalpad documents!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setSignedLegalpadDocuments(1);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET signedLegalpadDocuments = %d WHERE id = %d',
         $session->getTableName(),
         1,
         $session->getID());
 
       if (!empty($docs)) {
         $log = PhabricatorUserLog::initializeNewLog(
           $viewer,
           $viewer->getPHID(),
           PhabricatorUserLog::ACTION_LOGIN_LEGALPAD);
         $log->save();
       }
     unset($unguarded);
   }
 
 
 /* -(  One Time Login URIs  )------------------------------------------------ */
 
 
   /**
    * Retrieve a temporary, one-time URI which can log in to an account.
    *
    * These URIs are used for password recovery and to regain access to accounts
    * which users have been locked out of.
    *
    * @param PhabricatorUser User to generate a URI for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Optional context string for the URI. This is purely cosmetic
    *  and used only to customize workflow and error messages.
    * @return string Login URI.
    * @task onetime
    */
   public function getOneTimeLoginURI(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $type = self::ONETIME_RESET) {
 
     $key = Filesystem::readRandomCharacters(32);
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthTemporaryToken())
         ->setTokenResource($user->getPHID())
         ->setTokenType($onetime_type)
         ->setTokenExpires(time() + phutil_units('1 day in seconds'))
         ->setTokenCode($key_hash)
         ->save();
     unset($unguarded);
 
     $uri = '/login/once/'.$type.'/'.$user->getID().'/'.$key.'/';
     if ($email) {
       $uri = $uri.$email->getID().'/';
     }
 
     try {
       $uri = PhabricatorEnv::getProductionURI($uri);
     } catch (Exception $ex) {
       // If a user runs `bin/auth recover` before configuring the base URI,
       // just show the path. We don't have any way to figure out the domain.
       // See T4132.
     }
 
     return $uri;
   }
 
 
   /**
    * Load the temporary token associated with a given one-time login key.
    *
    * @param PhabricatorUser User to load the token for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Key user is presenting as a valid one-time login key.
    * @return PhabricatorAuthTemporaryToken|null Token, if one exists.
    * @task onetime
    */
   public function loadOneTimeLoginKey(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     return id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer($user)
       ->withTokenResources(array($user->getPHID()))
       ->withTokenTypes(array($onetime_type))
       ->withTokenCodes(array($key_hash))
       ->withExpired(false)
       ->executeOne();
   }
 
 
   /**
    * Hash a one-time login key for storage as a temporary token.
    *
    * @param PhabricatorUser User this key is for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string The one time login key.
    * @return string Hash of the key.
    * task onetime
    */
   private function getOneTimeLoginKeyHash(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $parts = array(
       $key,
       $user->getAccountSecret(),
     );
 
     if ($email) {
       $parts[] = $email->getVerificationCode();
     }
 
     return PhabricatorHash::weakDigest(implode(':', $parts));
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   private function getUserCacheQueryParts(AphrontDatabaseConnection $conn) {
     $cache_selects = array();
     $cache_joins = array();
     $cache_map = array();
 
     $keys = array();
     $types_map = array();
 
     $cache_types = PhabricatorUserCacheType::getAllCacheTypes();
     foreach ($cache_types as $cache_type) {
       foreach ($cache_type->getAutoloadKeys() as $autoload_key) {
         $keys[] = $autoload_key;
         $types_map[$autoload_key] = $cache_type;
       }
     }
 
     $cache_table = id(new PhabricatorUserCache())->getTableName();
 
     $cache_idx = 1;
     foreach ($keys as $key) {
       $join_as = 'ucache_'.$cache_idx;
       $select_as = 'ucache_'.$cache_idx.'_v';
 
       $cache_selects[] = qsprintf(
         $conn,
         '%T.cacheData %T',
         $join_as,
         $select_as);
 
       $cache_joins[] = qsprintf(
         $conn,
         'LEFT JOIN %T AS %T ON u.phid = %T.userPHID
           AND %T.cacheIndex = %s',
         $cache_table,
         $join_as,
         $join_as,
         $join_as,
         PhabricatorHash::digestForIndex($key));
 
       $cache_map[$select_as] = $key;
 
       $cache_idx++;
     }
 
     if ($cache_selects) {
       $cache_selects = ', '.implode(', ', $cache_selects);
     } else {
       $cache_selects = '';
     }
 
     if ($cache_joins) {
       $cache_joins = implode(' ', $cache_joins);
     } else {
       $cache_joins = '';
     }
 
     return array($cache_selects, $cache_joins, $cache_map, $types_map);
   }
 
   private function filterRawCacheData(
     PhabricatorUser $user,
     array $types_map,
     array $cache_raw) {
 
     foreach ($cache_raw as $cache_key => $cache_data) {
       $type = $types_map[$cache_key];
       if ($type->shouldValidateRawCacheData()) {
         if (!$type->isRawCacheDataValid($user, $cache_key, $cache_data)) {
           unset($cache_raw[$cache_key]);
         }
       }
     }
 
     return $cache_raw;
   }
 
   public function willServeRequestForUser(PhabricatorUser $user) {
     // We allow the login user to generate any missing cache data inline.
     $user->setAllowInlineCacheGeneration(true);
 
     // Switch to the user's translation.
     PhabricatorEnv::setLocaleCode($user->getTranslation());
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->willServeRequestForUser($user);
     }
   }
 
 }
diff --git a/src/applications/auth/storage/PhabricatorAuthSession.php b/src/applications/auth/storage/PhabricatorAuthSession.php
index b0b4996c93..cf707a053d 100644
--- a/src/applications/auth/storage/PhabricatorAuthSession.php
+++ b/src/applications/auth/storage/PhabricatorAuthSession.php
@@ -1,109 +1,125 @@
 <?php
 
 final class PhabricatorAuthSession extends PhabricatorAuthDAO
   implements PhabricatorPolicyInterface {
 
   const TYPE_WEB      = 'web';
   const TYPE_CONDUIT  = 'conduit';
 
   protected $userPHID;
   protected $type;
   protected $sessionKey;
   protected $sessionStart;
   protected $sessionExpires;
   protected $highSecurityUntil;
   protected $isPartial;
   protected $signedLegalpadDocuments;
 
   private $identityObject = self::ATTACHABLE;
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_TIMESTAMPS => false,
       self::CONFIG_COLUMN_SCHEMA => array(
         'type' => 'text32',
         'sessionKey' => 'bytes40',
         'sessionStart' => 'epoch',
         'sessionExpires' => 'epoch',
         'highSecurityUntil' => 'epoch?',
         'isPartial' => 'bool',
         'signedLegalpadDocuments' => 'bool',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'sessionKey' => array(
           'columns' => array('sessionKey'),
           'unique' => true,
         ),
         'key_identity' => array(
           'columns' => array('userPHID', 'type'),
         ),
         'key_expires' => array(
           'columns' => array('sessionExpires'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function getApplicationName() {
     // This table predates the "Auth" application, and really all applications.
     return 'user';
   }
 
   public function getTableName() {
     // This is a very old table with a nonstandard name.
     return PhabricatorUser::SESSION_TABLE;
   }
 
   public function attachIdentityObject($identity_object) {
     $this->identityObject = $identity_object;
     return $this;
   }
 
   public function getIdentityObject() {
     return $this->assertAttached($this->identityObject);
   }
 
   public static function getSessionTypeTTL($session_type) {
     switch ($session_type) {
       case self::TYPE_WEB:
         return phutil_units('30 days in seconds');
       case self::TYPE_CONDUIT:
         return phutil_units('24 hours in seconds');
       default:
         throw new Exception(pht('Unknown session type "%s".', $session_type));
     }
   }
 
+  public function isHighSecuritySession() {
+    $until = $this->getHighSecurityUntil();
+
+    if (!$until) {
+      return false;
+    }
+
+    $now = PhabricatorTime::getNow();
+    if ($until < $now) {
+      return false;
+    }
+
+    return true;
+  }
+
+
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
     );
   }
 
   public function getPolicy($capability) {
     return PhabricatorPolicies::POLICY_NOONE;
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     if (!$viewer->getPHID()) {
       return false;
     }
 
     $object = $this->getIdentityObject();
     if ($object instanceof PhabricatorUser) {
       return ($object->getPHID() == $viewer->getPHID());
     } else if ($object instanceof PhabricatorExternalAccount) {
       return ($object->getUserPHID() == $viewer->getPHID());
     }
 
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return pht('A session is visible only to its owner.');
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index 03da9dee04..cd85800ab1 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,1661 +1,1669 @@
 <?php
 
 /**
  * @task availability Availability
  * @task image-cache Profile Image Cache
  * @task factors Multi-Factor Authentication
  * @task handles Managing Handles
  * @task settings Settings
  * @task cache User Cache
  */
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface,
     PhabricatorDestructibleInterface,
     PhabricatorSSHPublicKeyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorApplicationTransactionInterface,
     PhabricatorFulltextInterface,
     PhabricatorFerretInterface,
     PhabricatorConduitResultInterface,
     PhabricatorAuthPasswordHashInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $profileImagePHID;
   protected $defaultProfileImagePHID;
   protected $defaultProfileImageVersion;
   protected $availabilityCache;
   protected $availabilityCacheTTL;
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isMailingList = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
   protected $isEnrolledInMultiFactor = 0;
 
   protected $accountSecret;
 
   private $profile = null;
   private $availability = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
   private $badgePHIDs = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
   private $session = self::ATTACHABLE;
   private $rawCacheData = array();
   private $usableCacheData = array();
 
   private $authorities = array();
   private $handlePool;
   private $csrfSalt;
 
   private $settingCacheKeys = array();
   private $settingCache = array();
   private $allowInlineCacheGeneration;
   private $conduitClusterToken = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isMailingList':
         return (bool)$this->isMailingList;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if (!$this->isLoggedIn()) {
       return false;
     }
 
     if ($this->isOmnipotent()) {
       return true;
     }
 
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
 
   /**
    * Is this a user who we can reasonably expect to respond to requests?
    *
    * This is used to provide a grey "disabled/unresponsive" dot cue when
    * rendering handles and tags, so it isn't a surprise if you get ignored
    * when you ask things of users who will not receive notifications or could
    * not respond to them (because they are disabled, unapproved, do not have
    * verified email addresses, etc).
    *
    * @return bool True if this user can receive and respond to requests from
    *   other humans.
    */
   public function isResponsive() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if (!$this->getIsEmailVerified()) {
       return false;
     }
 
     return true;
   }
 
 
   public function canEstablishWebSessions() {
     if ($this->getIsMailingList()) {
       return false;
     }
 
     if ($this->getIsSystemAgent()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishAPISessions() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     // Intracluster requests are permitted even if the user is logged out:
     // in particular, public users are allowed to issue intracluster requests
     // when browsing Diffusion.
     if (PhabricatorEnv::isClusterRemoteAddress()) {
       if (!$this->isLoggedIn()) {
         return true;
       }
     }
 
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   public function canEstablishSSHSessions() {
     if (!$this->isUserActivated()) {
       return false;
     }
 
     if ($this->getIsMailingList()) {
       return false;
     }
 
     return true;
   }
 
   /**
    * Returns `true` if this is a standard user who is logged in. Returns `false`
    * for logged out, anonymous, or external users.
    *
    * @return bool `true` if the user is a standard user who is logged in with
    *              a normal session.
    */
   public function getIsStandardUser() {
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     return $this->getPHID() && (phid_get_type($this->getPHID()) == $type_user);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_COLUMN_SCHEMA => array(
         'userName' => 'sort64',
         'realName' => 'text128',
         'profileImagePHID' => 'phid?',
         'conduitCertificate' => 'text255',
         'isSystemAgent' => 'bool',
         'isMailingList' => 'bool',
         'isDisabled' => 'bool',
         'isAdmin' => 'bool',
         'isEmailVerified' => 'uint32',
         'isApproved' => 'uint32',
         'accountSecret' => 'bytes64',
         'isEnrolledInMultiFactor' => 'bool',
         'availabilityCache' => 'text255?',
         'availabilityCacheTTL' => 'uint32?',
         'defaultProfileImagePHID' => 'phid?',
         'defaultProfileImageVersion' => 'text64?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'userName' => array(
           'columns' => array('userName'),
           'unique' => true,
         ),
         'realName' => array(
           'columns' => array('realName'),
         ),
         'key_approved' => array(
           'columns' => array('isApproved'),
         ),
       ),
       self::CONFIG_NO_MUTATE => array(
         'availabilityCache' => true,
         'availabilityCacheTTL' => true,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeopleUserPHIDType::TYPECONST);
   }
 
   public function getMonogram() {
     return '@'.$this->getUsername();
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function saveWithoutIndex() {
     return parent::save();
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
 
     if (!strlen($this->getAccountSecret())) {
       $this->setAccountSecret(Filesystem::readRandomCharacters(64));
     }
 
     $result = $this->saveWithoutIndex();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   public function attachSession(PhabricatorAuthSession $session) {
     $this->session = $session;
     return $this;
   }
 
   public function getSession() {
     return $this->assertAttached($this->session);
   }
 
   public function hasSession() {
     return ($this->session !== self::ATTACHABLE);
   }
 
+  public function hasHighSecuritySession() {
+    if (!$this->hasSession()) {
+      return false;
+    }
+
+    return $this->getSession()->isHighSecuritySession();
+  }
+
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   public function getCSRFToken() {
     if ($this->isOmnipotent()) {
       // We may end up here when called from the daemons. The omnipotent user
       // has no meaningful CSRF token, so just return `null`.
       return null;
     }
 
     if ($this->csrfSalt === null) {
       $this->csrfSalt = Filesystem::readRandomCharacters(
         self::CSRF_SALT_LENGTH);
     }
 
     $salt = $this->csrfSalt;
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
     $hash = PhabricatorHash::weakDigest($token, $salt);
     return self::CSRF_BREACH_PREFIX.$salt.substr(
         $hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
     // We expect a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
     if (strncmp($token, $breach_prefix, $breach_prelen) !== 0) {
       return false;
     }
 
     $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
     $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
 
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYCLE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
 
       $digest = PhabricatorHash::weakDigest($valid, $salt);
       $digest = substr($digest, 0, self::CSRF_TOKEN_LENGTH);
       if (phutil_hashes_are_identical($digest, $token)) {
         return true;
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getAccountSecret();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     if ($this->hasSession()) {
       $vec = $vec.$this->getSession()->getSessionKey();
     }
 
     $time_block = floor($epoch / $frequency);
     $vec = $vec.$key.$time_block;
 
     return substr(PhabricatorHash::weakDigest($vec), 0, $len);
   }
 
   public function getUserProfile() {
     return $this->assertAttached($this->profile);
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $this->profile = PhabricatorUserProfile::initializeNewProfile($this);
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception(pht('User has no primary email address!'));
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
 
 /* -(  Settings  )----------------------------------------------------------- */
 
 
   public function getUserSetting($key) {
     // NOTE: We store available keys and cached values separately to make it
     // faster to check for `null` in the cache, which is common.
     if (isset($this->settingCacheKeys[$key])) {
       return $this->settingCache[$key];
     }
 
     $settings_key = PhabricatorUserPreferencesCacheType::KEY_PREFERENCES;
     if ($this->getPHID()) {
       $settings = $this->requireCacheData($settings_key);
     } else {
       $settings = $this->loadGlobalSettings();
     }
 
     if (array_key_exists($key, $settings)) {
       $value = $settings[$key];
       return $this->writeUserSettingCache($key, $value);
     }
 
     $cache = PhabricatorCaches::getRuntimeCache();
     $cache_key = "settings.defaults({$key})";
     $cache_map = $cache->getKeys(array($cache_key));
 
     if ($cache_map) {
       $value = $cache_map[$cache_key];
     } else {
       $defaults = PhabricatorSetting::getAllSettings();
       if (isset($defaults[$key])) {
         $value = id(clone $defaults[$key])
           ->setViewer($this)
           ->getSettingDefaultValue();
       } else {
         $value = null;
       }
 
       $cache->setKey($cache_key, $value);
     }
 
     return $this->writeUserSettingCache($key, $value);
   }
 
 
   /**
    * Test if a given setting is set to a particular value.
    *
    * @param const Setting key.
    * @param wild Value to compare.
    * @return bool True if the setting has the specified value.
    * @task settings
    */
   public function compareUserSetting($key, $value) {
     $actual = $this->getUserSetting($key);
     return ($actual == $value);
   }
 
   private function writeUserSettingCache($key, $value) {
     $this->settingCacheKeys[$key] = true;
     $this->settingCache[$key] = $value;
     return $value;
   }
 
   public function getTranslation() {
     return $this->getUserSetting(PhabricatorTranslationSetting::SETTINGKEY);
   }
 
   public function getTimezoneIdentifier() {
     return $this->getUserSetting(PhabricatorTimezoneSetting::SETTINGKEY);
   }
 
   public static function getGlobalSettingsCacheKey() {
     return 'user.settings.globals.v1';
   }
 
   private function loadGlobalSettings() {
     $cache_key = self::getGlobalSettingsCacheKey();
     $cache = PhabricatorCaches::getMutableStructureCache();
 
     $settings = $cache->getKey($cache_key);
     if (!$settings) {
       $preferences = PhabricatorUserPreferences::loadGlobalPreferences($this);
       $settings = $preferences->getPreferences();
       $cache->setKey($cache_key, $settings);
     }
 
     return $settings;
   }
 
 
   /**
    * Override the user's timezone identifier.
    *
    * This is primarily useful for unit tests.
    *
    * @param string New timezone identifier.
    * @return this
    * @task settings
    */
   public function overrideTimezoneIdentifier($identifier) {
     $timezone_key = PhabricatorTimezoneSetting::SETTINGKEY;
     $this->settingCacheKeys[$timezone_key] = true;
     $this->settingCache[$timezone_key] = $identifier;
     return $this;
   }
 
   public function getGender() {
     return $this->getUserSetting(PhabricatorPronounSetting::SETTINGKEY);
   }
 
   public function loadEditorLink(
     $path,
     $line,
     PhabricatorRepository $repository = null) {
 
     $editor = $this->getUserSetting(PhabricatorEditorSetting::SETTINGKEY);
 
     if (is_array($path)) {
       $multi_key = PhabricatorEditorMultipleSetting::SETTINGKEY;
       $multiedit = $this->getUserSetting($multi_key);
       switch ($multiedit) {
         case PhabricatorEditorMultipleSetting::VALUE_SPACES:
           $path = implode(' ', $path);
           break;
         case PhabricatorEditorMultipleSetting::VALUE_SINGLE:
         default:
           return null;
       }
     }
 
     if (!strlen($editor)) {
       return null;
     }
 
     if ($repository) {
       $callsign = $repository->getCallsign();
     } else {
       $callsign = null;
     }
 
     $uri = strtr($editor, array(
       '%%' => '%',
       '%f' => phutil_escape_uri($path),
       '%l' => phutil_escape_uri($line),
       '%r' => phutil_escape_uri($callsign),
     ));
 
     // The resulting URI must have an allowed protocol. Otherwise, we'll return
     // a link to an error page explaining the misconfiguration.
 
     $ok = PhabricatorHelpEditorProtocolController::hasAllowedProtocol($uri);
     if (!$ok) {
       return '/help/editorprotocol/';
     }
 
     return (string)$uri;
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $tokens = PhabricatorTypeaheadDatasource::tokenizeString(
       $this->getUserName().' '.$this->getRealName());
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     if (!$this->canEstablishWebSessions()) {
       throw new Exception(
         pht(
           'Can not send welcome mail to users who can not establish '.
           'web sessions!'));
     }
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $engine = new PhabricatorAuthSessionEngine();
     $uri = $engine->getOneTimeLoginURI(
       $this,
       $this->loadPrimaryEmail(),
       PhabricatorAuthSessionEngine::ONETIME_WELCOME);
 
     $body = pht(
       "Welcome to Phabricator!\n\n".
       "%s (%s) has created an account for you.\n\n".
       "  Username: %s\n\n".
       "To login to Phabricator, follow this link and set a password:\n\n".
       "  %s\n\n".
       "After you have set a password, you can login in the future by ".
       "going here:\n\n".
       "  %s\n",
       $admin_username,
       $admin_realname,
       $user_username,
       $uri,
       $base_uri);
 
     if (!$is_serious) {
       $body .= sprintf(
         "\n%s\n",
         pht("Love,\nPhabricator"));
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Welcome to Phabricator'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorPasswordAuthProvider::getPasswordProvider()) {
       $engine = new PhabricatorAuthSessionEngine();
       $uri = $engine->getOneTimeLoginURI(
         $this,
         null,
         PhabricatorAuthSessionEngine::ONETIME_USERNAME);
       $password_instructions = sprintf(
         "%s\n\n  %s\n\n%s\n",
         pht(
           "If you use a password to login, you'll need to reset it ".
           "before you can login again. You can reset your password by ".
           "following this link:"),
         $uri,
         pht(
           "And, of course, you'll need to use your new username to login ".
           "from now on. If you use OAuth to login, nothing should change."));
     }
 
     $body = sprintf(
       "%s\n\n  %s\n  %s\n\n%s",
       pht(
         '%s (%s) has changed your Phabricator username.',
         $admin_username,
         $admin_realname),
       pht(
         'Old Username: %s',
         $old_username),
       pht(
         'New Username: %s',
         $new_username),
       $password_instructions);
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setForceDelivery(true)
       ->setSubject(pht('[Phabricator] Username Changed'))
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
     return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function getProfileImageURI() {
     $uri_key = PhabricatorUserProfileImageCacheType::KEY_URI;
     return $this->requireCacheData($uri_key);
   }
 
   public function getUnreadNotificationCount() {
     $notification_key = PhabricatorUserNotificationCountCacheType::KEY_COUNT;
     return $this->requireCacheData($notification_key);
   }
 
   public function getUnreadMessageCount() {
     $message_key = PhabricatorUserMessageCountCacheType::KEY_COUNT;
     return $this->requireCacheData($message_key);
   }
 
   public function getRecentBadgeAwards() {
     $badges_key = PhabricatorUserBadgesCacheType::KEY_BADGES;
     return $this->requireCacheData($badges_key);
   }
 
   public function getFullName() {
     if (strlen($this->getRealName())) {
       return $this->getUsername().' ('.$this->getRealName().')';
     } else {
       return $this->getUsername();
     }
   }
 
   public function getTimeZone() {
     return new DateTimeZone($this->getTimezoneIdentifier());
   }
 
   public function getTimeZoneOffset() {
     $timezone = $this->getTimeZone();
     $now = new DateTime('@'.PhabricatorTime::getNow());
     $offset = $timezone->getOffset($now);
 
     // Javascript offsets are in minutes and have the opposite sign.
     $offset = -(int)($offset / 60);
 
     return $offset;
   }
 
   public function getTimeZoneOffsetInHours() {
     $offset = $this->getTimeZoneOffset();
     $offset = (int)round($offset / 60);
     $offset = -$offset;
 
     return $offset;
   }
 
   public function formatShortDateTime($when, $now = null) {
     if ($now === null) {
       $now = PhabricatorTime::getNow();
     }
 
     try {
       $when = new DateTime('@'.$when);
       $now = new DateTime('@'.$now);
     } catch (Exception $ex) {
       return null;
     }
 
     $zone = $this->getTimeZone();
 
     $when->setTimeZone($zone);
     $now->setTimeZone($zone);
 
     if ($when->format('Y') !== $now->format('Y')) {
       // Different year, so show "Feb 31 2075".
       $format = 'M j Y';
     } else if ($when->format('Ymd') !== $now->format('Ymd')) {
       // Same year but different month and day, so show "Feb 31".
       $format = 'M j';
     } else {
       // Same year, month and day so show a time of day.
       $pref_time = PhabricatorTimeFormatSetting::SETTINGKEY;
       $format = $this->getUserSetting($pref_time);
     }
 
     return $when->format($format);
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
   public function getDefaultSpacePHID() {
     // TODO: We might let the user switch which space they're "in" later on;
     // for now just use the global space if one exists.
 
     // If the viewer has access to the default space, use that.
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($this);
     foreach ($spaces as $space) {
       if ($space->getIsDefaultNamespace()) {
         return $space->getPHID();
       }
     }
 
     // Otherwise, use the space with the lowest ID that they have access to.
     // This just tends to keep the default stable and predictable over time,
     // so adding a new space won't change behavior for users.
     if ($spaces) {
       $spaces = msort($spaces, 'getID');
       return head($spaces)->getPHID();
     }
 
     return null;
   }
 
 
   /**
    * Grant a user a source of authority, to let them bypass policy checks they
    * could not otherwise.
    */
   public function grantAuthority($authority) {
     $this->authorities[] = $authority;
     return $this;
   }
 
 
   /**
    * Get authorities granted to the user.
    */
   public function getAuthorities() {
     return $this->authorities;
   }
 
   public function hasConduitClusterToken() {
     return ($this->conduitClusterToken !== self::ATTACHABLE);
   }
 
   public function attachConduitClusterToken(PhabricatorConduitToken $token) {
     $this->conduitClusterToken = $token;
     return $this;
   }
 
   public function getConduitClusterToken() {
     return $this->assertAttached($this->conduitClusterToken);
   }
 
 
 /* -(  Availability  )------------------------------------------------------- */
 
 
   /**
    * @task availability
    */
   public function attachAvailability(array $availability) {
     $this->availability = $availability;
     return $this;
   }
 
 
   /**
    * Get the timestamp the user is away until, if they are currently away.
    *
    * @return int|null Epoch timestamp, or `null` if the user is not away.
    * @task availability
    */
   public function getAwayUntil() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'until');
   }
 
 
   public function getDisplayAvailability() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     $busy = PhabricatorCalendarEventInvitee::AVAILABILITY_BUSY;
 
     return idx($availability, 'availability', $busy);
   }
 
 
   public function getAvailabilityEventPHID() {
     $availability = $this->availability;
 
     $this->assertAttached($availability);
     if (!$availability) {
       return null;
     }
 
     return idx($availability, 'eventPHID');
   }
 
 
   /**
    * Get cached availability, if present.
    *
    * @return wild|null Cache data, or null if no cache is available.
    * @task availability
    */
   public function getAvailabilityCache() {
     $now = PhabricatorTime::getNow();
     if ($this->availabilityCacheTTL <= $now) {
       return null;
     }
 
     try {
       return phutil_json_decode($this->availabilityCache);
     } catch (Exception $ex) {
       return null;
     }
   }
 
 
   /**
    * Write to the availability cache.
    *
    * @param wild Availability cache data.
    * @param int|null Cache TTL.
    * @return this
    * @task availability
    */
   public function writeAvailabilityCache(array $availability, $ttl) {
     if (PhabricatorEnv::isReadOnly()) {
       return $this;
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     queryfx(
       $this->establishConnection('w'),
       'UPDATE %T SET availabilityCache = %s, availabilityCacheTTL = %nd
         WHERE id = %d',
       $this->getTableName(),
       phutil_json_encode($availability),
       $ttl,
       $this->getID());
     unset($unguarded);
 
     return $this;
   }
 
 
 /* -(  Multi-Factor Authentication  )---------------------------------------- */
 
 
   /**
    * Update the flag storing this user's enrollment in multi-factor auth.
    *
    * With certain settings, we need to check if a user has MFA on every page,
    * so we cache MFA enrollment on the user object for performance. Calling this
    * method synchronizes the cache by examining enrollment records. After
    * updating the cache, use @{method:getIsEnrolledInMultiFactor} to check if
    * the user is enrolled.
    *
    * This method should be called after any changes are made to a given user's
    * multi-factor configuration.
    *
    * @return void
    * @task factors
    */
   public function updateMultiFactorEnrollment() {
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $this->getPHID());
 
     $enrolled = count($factors) ? 1 : 0;
     if ($enrolled !== $this->isEnrolledInMultiFactor) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         queryfx(
           $this->establishConnection('w'),
           'UPDATE %T SET isEnrolledInMultiFactor = %d WHERE id = %d',
           $this->getTableName(),
           $enrolled,
           $this->getID());
       unset($unguarded);
 
       $this->isEnrolledInMultiFactor = $enrolled;
     }
   }
 
 
   /**
    * Check if the user is enrolled in multi-factor authentication.
    *
    * Enrolled users have one or more multi-factor authentication sources
    * attached to their account. For performance, this value is cached. You
    * can use @{method:updateMultiFactorEnrollment} to update the cache.
    *
    * @return bool True if the user is enrolled.
    * @task factors
    */
   public function getIsEnrolledInMultiFactor() {
     return $this->isEnrolledInMultiFactor;
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
   /**
    * Get a scalar string identifying this user.
    *
    * This is similar to using the PHID, but distinguishes between omnipotent
    * and public users explicitly. This allows safe construction of cache keys
    * or cache buckets which do not conflate public and omnipotent users.
    *
    * @return string Scalar identifier.
    */
   public function getCacheFragment() {
     if ($this->isOmnipotent()) {
       return 'u.omnipotent';
     }
 
     $phid = $this->getPHID();
     if ($phid) {
       return 'u.'.$phid;
     }
 
     return 'u.public';
   }
 
 
 /* -(  Managing Handles  )--------------------------------------------------- */
 
 
   /**
    * Get a @{class:PhabricatorHandleList} which benefits from this viewer's
    * internal handle pool.
    *
    * @param list<phid> List of PHIDs to load.
    * @return PhabricatorHandleList Handle list object.
    * @task handle
    */
   public function loadHandles(array $phids) {
     if ($this->handlePool === null) {
       $this->handlePool = id(new PhabricatorHandlePool())
         ->setViewer($this);
     }
 
     return $this->handlePool->newHandleList($phids);
   }
 
 
   /**
    * Get a @{class:PHUIHandleView} for a single handle.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param phid PHID to render a handle for.
    * @return PHUIHandleView View of the handle.
    * @task handle
    */
   public function renderHandle($phid) {
     return $this->loadHandles(array($phid))->renderHandle($phid);
   }
 
 
   /**
    * Get a @{class:PHUIHandleListView} for a list of handles.
    *
    * This benefits from the viewer's internal handle pool.
    *
    * @param list<phid> List of PHIDs to render.
    * @return PHUIHandleListView View of the handles.
    * @task handle
    */
   public function renderHandleList(array $phids) {
     return $this->loadHandles($phids)->renderList();
   }
 
   public function attachBadgePHIDs(array $phids) {
     $this->badgePHIDs = $phids;
     return $this;
   }
 
   public function getBadgePHIDs() {
     return $this->assertAttached($this->badgePHIDs);
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         if ($this->getIsSystemAgent() || $this->getIsMailingList()) {
           return PhabricatorPolicies::POLICY_ADMIN;
         } else {
           return PhabricatorPolicies::POLICY_NOONE;
         }
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
 
       $externals = id(new PhabricatorExternalAccount())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($externals as $external) {
         $external->delete();
       }
 
       $prefs = id(new PhabricatorUserPreferencesQuery())
         ->setViewer($engine->getViewer())
         ->withUsers(array($this))
         ->execute();
       foreach ($prefs as $pref) {
         $engine->destroyObject($pref);
       }
 
       $profiles = id(new PhabricatorUserProfile())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($profiles as $profile) {
         $profile->delete();
       }
 
       $keys = id(new PhabricatorAuthSSHKeyQuery())
         ->setViewer($engine->getViewer())
         ->withObjectPHIDs(array($this->getPHID()))
         ->execute();
       foreach ($keys as $key) {
         $engine->destroyObject($key);
       }
 
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($emails as $email) {
         $email->delete();
       }
 
       $sessions = id(new PhabricatorAuthSession())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($sessions as $session) {
         $session->delete();
       }
 
       $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
         'userPHID = %s',
         $this->getPHID());
       foreach ($factors as $factor) {
         $factor->delete();
       }
 
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorSSHPublicKeyInterface  )----------------------------------- */
 
 
   public function getSSHPublicKeyManagementURI(PhabricatorUser $viewer) {
     if ($viewer->getPHID() == $this->getPHID()) {
       // If the viewer is managing their own keys, take them to the normal
       // panel.
       return '/settings/panel/ssh/';
     } else {
       // Otherwise, take them to the administrative panel for this user.
       return '/settings/user/'.$this->getUsername().'/page/ssh/';
     }
   }
 
   public function getSSHKeyDefaultName() {
     return 'id_rsa_phabricator';
   }
 
   public function getSSHKeyNotifyPHIDs() {
     return array(
       $this->getPHID(),
     );
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorUserTransactionEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorUserTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
     return $timeline;
   }
 
 
 /* -(  PhabricatorFulltextInterface  )--------------------------------------- */
 
 
   public function newFulltextEngine() {
     return new PhabricatorUserFulltextEngine();
   }
 
 
 /* -(  PhabricatorFerretInterface  )----------------------------------------- */
 
 
   public function newFerretEngine() {
     return new PhabricatorUserFerretEngine();
   }
 
 
 /* -(  PhabricatorConduitResultInterface  )---------------------------------- */
 
 
   public function getFieldSpecificationsForConduit() {
     return array(
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('username')
         ->setType('string')
         ->setDescription(pht("The user's username.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('realName')
         ->setType('string')
         ->setDescription(pht("The user's real name.")),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('roles')
         ->setType('list<string>')
         ->setDescription(pht('List of account roles.')),
     );
   }
 
   public function getFieldValuesForConduit() {
     $roles = array();
 
     if ($this->getIsDisabled()) {
       $roles[] = 'disabled';
     }
 
     if ($this->getIsSystemAgent()) {
       $roles[] = 'bot';
     }
 
     if ($this->getIsMailingList()) {
       $roles[] = 'list';
     }
 
     if ($this->getIsAdmin()) {
       $roles[] = 'admin';
     }
 
     if ($this->getIsEmailVerified()) {
       $roles[] = 'verified';
     }
 
     if ($this->getIsApproved()) {
       $roles[] = 'approved';
     }
 
     if ($this->isUserActivated()) {
       $roles[] = 'activated';
     }
 
     return array(
       'username' => $this->getUsername(),
       'realName' => $this->getRealName(),
       'roles' => $roles,
     );
   }
 
   public function getConduitSearchAttachments() {
     return array();
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   public function attachRawCacheData(array $data) {
     $this->rawCacheData = $data + $this->rawCacheData;
     return $this;
   }
 
   public function setAllowInlineCacheGeneration($allow_cache_generation) {
     $this->allowInlineCacheGeneration = $allow_cache_generation;
     return $this;
   }
 
   /**
    * @task cache
    */
   protected function requireCacheData($key) {
     if (isset($this->usableCacheData[$key])) {
       return $this->usableCacheData[$key];
     }
 
     $type = PhabricatorUserCacheType::requireCacheTypeForKey($key);
 
     if (isset($this->rawCacheData[$key])) {
       $raw_value = $this->rawCacheData[$key];
 
       $usable_value = $type->getValueFromStorage($raw_value);
       $this->usableCacheData[$key] = $usable_value;
 
       return $usable_value;
     }
 
     // By default, we throw if a cache isn't available. This is consistent
     // with the standard `needX()` + `attachX()` + `getX()` interaction.
     if (!$this->allowInlineCacheGeneration) {
       throw new PhabricatorDataNotAttachedException($this);
     }
 
     $user_phid = $this->getPHID();
 
     // Try to read the actual cache before we generate a new value. We can
     // end up here via Conduit, which does not use normal sessions and can
     // not pick up a free cache load during session identification.
     if ($user_phid) {
       $raw_data = PhabricatorUserCache::readCaches(
         $type,
         $key,
         array($user_phid));
       if (array_key_exists($user_phid, $raw_data)) {
         $raw_value = $raw_data[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
         $this->rawCacheData[$key] = $raw_value;
         $this->usableCacheData[$key] = $usable_value;
         return $usable_value;
       }
     }
 
     $usable_value = $type->getDefaultValue();
 
     if ($user_phid) {
       $map = $type->newValueForUsers($key, array($this));
       if (array_key_exists($user_phid, $map)) {
         $raw_value = $map[$user_phid];
         $usable_value = $type->getValueFromStorage($raw_value);
 
         $this->rawCacheData[$key] = $raw_value;
         PhabricatorUserCache::writeCache(
           $type,
           $key,
           $user_phid,
           $raw_value);
       }
     }
 
     $this->usableCacheData[$key] = $usable_value;
 
     return $usable_value;
   }
 
 
   /**
    * @task cache
    */
   public function clearCacheData($key) {
     unset($this->rawCacheData[$key]);
     unset($this->usableCacheData[$key]);
     return $this;
   }
 
 
   public function getCSSValue($variable_key) {
     $preference = PhabricatorAccessibilitySetting::SETTINGKEY;
     $key = $this->getUserSetting($preference);
 
     $postprocessor = CelerityPostprocessor::getPostprocessor($key);
     $variables = $postprocessor->getVariables();
 
     if (!isset($variables[$variable_key])) {
       throw new Exception(
         pht(
           'Unknown CSS variable "%s"!',
           $variable_key));
     }
 
     return $variables[$variable_key];
   }
 
 /* -(  PhabricatorAuthPasswordHashInterface  )------------------------------- */
 
 
   public function newPasswordDigest(
     PhutilOpaqueEnvelope $envelope,
     PhabricatorAuthPassword $password) {
 
     // Before passwords are hashed, they are digested. The goal of digestion
     // is twofold: to reduce the length of very long passwords to something
     // reasonable; and to salt the password in case the best available hasher
     // does not include salt automatically.
 
     // Users may choose arbitrarily long passwords, and attackers may try to
     // attack the system by probing it with very long passwords. When large
     // inputs are passed to hashers -- which are intentionally slow -- it
     // can result in unacceptably long runtimes. The classic attack here is
     // to try to log in with a 64MB password and see if that locks up the
     // machine for the next century. By digesting passwords to a standard
     // length first, the length of the raw input does not impact the runtime
     // of the hashing algorithm.
 
     // Some hashers like bcrypt are self-salting, while other hashers are not.
     // Applying salt while digesting passwords ensures that hashes are salted
     // whether we ultimately select a self-salting hasher or not.
 
     // For legacy compatibility reasons, old VCS and Account password digest
     // algorithms are significantly more complicated than necessary to achieve
     // these goals. This is because they once used a different hashing and
     // salting process. When we upgraded to the modern modular hasher
     // infrastructure, we just bolted it onto the end of the existing pipelines
     // so that upgrading didn't break all users' credentials.
 
     // New implementations can (and, generally, should) safely select the
     // simple HMAC SHA256 digest at the bottom of the function, which does
     // everything that a digest callback should without any needless legacy
     // baggage on top.
 
     if ($password->getLegacyDigestFormat() == 'v1') {
       switch ($password->getPasswordType()) {
         case PhabricatorAuthPassword::PASSWORD_TYPE_VCS:
           // Old VCS passwords use an iterated HMAC SHA1 as a digest algorithm.
           // They originally used this as a hasher, but it became a digest
           // algorithm once hashing was upgraded to include bcrypt.
           $digest = $envelope->openEnvelope();
           $salt = $this->getPHID();
           for ($ii = 0; $ii < 1000; $ii++) {
             $digest = PhabricatorHash::weakDigest($digest, $salt);
           }
           return new PhutilOpaqueEnvelope($digest);
         case PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT:
           // Account passwords previously used this weird mess of salt and did
           // not digest the input to a standard length.
 
           // Beyond this being a weird special case, there are two actual
           // problems with this, although neither are particularly severe:
 
           // First, because we do not normalize the length of passwords, this
           // algorithm may make us vulnerable to DOS attacks where an attacker
           // attempts to use a very long input to slow down hashers.
 
           // Second, because the username is part of the hash algorithm,
           // renaming a user breaks their password. This isn't a huge deal but
           // it's pretty silly. There's no security justification for this
           // behavior, I just didn't think about the implication when I wrote
           // it originally.
 
           $parts = array(
             $this->getUsername(),
             $envelope->openEnvelope(),
             $this->getPHID(),
             $password->getPasswordSalt(),
           );
 
           return new PhutilOpaqueEnvelope(implode('', $parts));
       }
     }
 
     // For passwords which do not have some crazy legacy reason to use some
     // other digest algorithm, HMAC SHA256 is an excellent choice. It satisfies
     // the digest requirements and is simple.
 
     $digest = PhabricatorHash::digestHMACSHA256(
       $envelope->openEnvelope(),
       $password->getPasswordSalt());
 
     return new PhutilOpaqueEnvelope($digest);
   }
 
 
 }
diff --git a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
index 1873fcb6e4..b4dd09ed10 100644
--- a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
+++ b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
@@ -1,4572 +1,4576 @@
 <?php
 
 /**
  *
  * Publishing and Managing State
  * ======
  *
  * After applying changes, the Editor queues a worker to publish mail, feed,
  * and notifications, and to perform other background work like updating search
  * indexes. This allows it to do this work without impacting performance for
  * users.
  *
  * When work is moved to the daemons, the Editor state is serialized by
  * @{method:getWorkerState}, then reloaded in a daemon process by
  * @{method:loadWorkerState}. **This is fragile.**
  *
  * State is not persisted into the daemons by default, because we can not send
  * arbitrary objects into the queue. This means the default behavior of any
  * state properties is to reset to their defaults without warning prior to
  * publishing.
  *
  * The easiest way to avoid this is to keep Editors stateless: the overwhelming
  * majority of Editors can be written statelessly. If you need to maintain
  * state, you can either:
  *
  *   - not require state to exist during publishing; or
  *   - pass state to the daemons by implementing @{method:getCustomWorkerState}
  *     and @{method:loadCustomWorkerState}.
  *
  * This architecture isn't ideal, and we may eventually split this class into
  * "Editor" and "Publisher" parts to make it more robust. See T6367 for some
  * discussion and context.
  *
  * @task mail Sending Mail
  * @task feed Publishing Feed Stories
  * @task search Search Index
  * @task files Integration with Files
  * @task workers Managing Workers
  */
 abstract class PhabricatorApplicationTransactionEditor
   extends PhabricatorEditor {
 
   private $contentSource;
   private $object;
   private $xactions;
 
   private $isNewObject;
   private $mentionedPHIDs;
   private $continueOnNoEffect;
   private $continueOnMissingFields;
   private $raiseWarnings;
   private $parentMessageID;
   private $heraldAdapter;
   private $heraldTranscript;
   private $subscribers;
   private $unmentionablePHIDMap = array();
   private $applicationEmail;
 
   private $isPreview;
   private $isHeraldEditor;
   private $isInverseEdgeEditor;
   private $actingAsPHID;
 
   private $heraldEmailPHIDs = array();
   private $heraldForcedEmailPHIDs = array();
   private $heraldHeader;
   private $mailToPHIDs = array();
   private $mailCCPHIDs = array();
   private $feedNotifyPHIDs = array();
   private $feedRelatedPHIDs = array();
   private $feedShouldPublish = false;
   private $mailShouldSend = false;
   private $modularTypes;
   private $silent;
   private $mustEncrypt;
   private $stampTemplates = array();
   private $mailStamps = array();
   private $oldTo = array();
   private $oldCC = array();
   private $mailRemovedPHIDs = array();
   private $mailUnexpandablePHIDs = array();
   private $mailMutedPHIDs = array();
   private $webhookMap = array();
 
   private $transactionQueue = array();
   private $sendHistory = false;
 
   const STORAGE_ENCODING_BINARY = 'binary';
 
   /**
    * Get the class name for the application this editor is a part of.
    *
    * Uninstalling the application will disable the editor.
    *
    * @return string Editor's application class name.
    */
   abstract public function getEditorApplicationClass();
 
 
   /**
    * Get a description of the objects this editor edits, like "Differential
    * Revisions".
    *
    * @return string Human readable description of edited objects.
    */
   abstract public function getEditorObjectsDescription();
 
 
   public function setActingAsPHID($acting_as_phid) {
     $this->actingAsPHID = $acting_as_phid;
     return $this;
   }
 
   public function getActingAsPHID() {
     if ($this->actingAsPHID) {
       return $this->actingAsPHID;
     }
     return $this->getActor()->getPHID();
   }
 
 
   /**
    * When the editor tries to apply transactions that have no effect, should
    * it raise an exception (default) or drop them and continue?
    *
    * Generally, you will set this flag for edits coming from "Edit" interfaces,
    * and leave it cleared for edits coming from "Comment" interfaces, so the
    * user will get a useful error if they try to submit a comment that does
    * nothing (e.g., empty comment with a status change that has already been
    * performed by another user).
    *
    * @param bool  True to drop transactions without effect and continue.
    * @return this
    */
   public function setContinueOnNoEffect($continue) {
     $this->continueOnNoEffect = $continue;
     return $this;
   }
 
   public function getContinueOnNoEffect() {
     return $this->continueOnNoEffect;
   }
 
 
   /**
    * When the editor tries to apply transactions which don't populate all of
    * an object's required fields, should it raise an exception (default) or
    * drop them and continue?
    *
    * For example, if a user adds a new required custom field (like "Severity")
    * to a task, all existing tasks won't have it populated. When users
    * manually edit existing tasks, it's usually desirable to have them provide
    * a severity. However, other operations (like batch editing just the
    * owner of a task) will fail by default.
    *
    * By setting this flag for edit operations which apply to specific fields
    * (like the priority, batch, and merge editors in Maniphest), these
    * operations can continue to function even if an object is outdated.
    *
    * @param bool  True to continue when transactions don't completely satisfy
    *              all required fields.
    * @return this
    */
   public function setContinueOnMissingFields($continue_on_missing_fields) {
     $this->continueOnMissingFields = $continue_on_missing_fields;
     return $this;
   }
 
   public function getContinueOnMissingFields() {
     return $this->continueOnMissingFields;
   }
 
 
   /**
    * Not strictly necessary, but reply handlers ideally set this value to
    * make email threading work better.
    */
   public function setParentMessageID($parent_message_id) {
     $this->parentMessageID = $parent_message_id;
     return $this;
   }
   public function getParentMessageID() {
     return $this->parentMessageID;
   }
 
   public function getIsNewObject() {
     return $this->isNewObject;
   }
 
   public function getMentionedPHIDs() {
     return $this->mentionedPHIDs;
   }
 
   public function setIsPreview($is_preview) {
     $this->isPreview = $is_preview;
     return $this;
   }
 
   public function getIsPreview() {
     return $this->isPreview;
   }
 
   public function setIsSilent($silent) {
     $this->silent = $silent;
     return $this;
   }
 
   public function getIsSilent() {
     return $this->silent;
   }
 
   public function getMustEncrypt() {
     return $this->mustEncrypt;
   }
 
   public function getHeraldRuleMonograms() {
     // Convert the stored "<123>, <456>" string into a list: "H123", "H456".
     $list = $this->heraldHeader;
     $list = preg_split('/[, ]+/', $list);
 
     foreach ($list as $key => $item) {
       $item = trim($item, '<>');
 
       if (!is_numeric($item)) {
         unset($list[$key]);
         continue;
       }
 
       $list[$key] = 'H'.$item;
     }
 
     return $list;
   }
 
   public function setIsInverseEdgeEditor($is_inverse_edge_editor) {
     $this->isInverseEdgeEditor = $is_inverse_edge_editor;
     return $this;
   }
 
   public function getIsInverseEdgeEditor() {
     return $this->isInverseEdgeEditor;
   }
 
   public function setIsHeraldEditor($is_herald_editor) {
     $this->isHeraldEditor = $is_herald_editor;
     return $this;
   }
 
   public function getIsHeraldEditor() {
     return $this->isHeraldEditor;
   }
 
   public function setUnmentionablePHIDMap(array $map) {
     $this->unmentionablePHIDMap = $map;
     return $this;
   }
 
   public function getUnmentionablePHIDMap() {
     return $this->unmentionablePHIDMap;
   }
 
   protected function shouldEnableMentions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return true;
   }
 
   public function setApplicationEmail(
     PhabricatorMetaMTAApplicationEmail $email) {
     $this->applicationEmail = $email;
     return $this;
   }
 
   public function getApplicationEmail() {
     return $this->applicationEmail;
   }
 
   public function setRaiseWarnings($raise_warnings) {
     $this->raiseWarnings = $raise_warnings;
     return $this;
   }
 
   public function getRaiseWarnings() {
     return $this->raiseWarnings;
   }
 
   public function getTransactionTypesForObject($object) {
     $old = $this->object;
     try {
       $this->object = $object;
       $result = $this->getTransactionTypes();
       $this->object = $old;
     } catch (Exception $ex) {
       $this->object = $old;
       throw $ex;
     }
     return $result;
   }
 
   public function getTransactionTypes() {
     $types = array();
 
     $types[] = PhabricatorTransactions::TYPE_CREATE;
     $types[] = PhabricatorTransactions::TYPE_HISTORY;
 
     if ($this->object instanceof PhabricatorEditEngineSubtypeInterface) {
       $types[] = PhabricatorTransactions::TYPE_SUBTYPE;
     }
 
     if ($this->object instanceof PhabricatorSubscribableInterface) {
       $types[] = PhabricatorTransactions::TYPE_SUBSCRIBERS;
     }
 
     if ($this->object instanceof PhabricatorCustomFieldInterface) {
       $types[] = PhabricatorTransactions::TYPE_CUSTOMFIELD;
     }
 
     if ($this->object instanceof PhabricatorTokenReceiverInterface) {
       $types[] = PhabricatorTransactions::TYPE_TOKEN;
     }
 
     if ($this->object instanceof PhabricatorProjectInterface ||
         $this->object instanceof PhabricatorMentionableInterface) {
       $types[] = PhabricatorTransactions::TYPE_EDGE;
     }
 
     if ($this->object instanceof PhabricatorSpacesInterface) {
       $types[] = PhabricatorTransactions::TYPE_SPACE;
     }
 
     $template = $this->object->getApplicationTransactionTemplate();
     if ($template instanceof PhabricatorModularTransaction) {
       $xtypes = $template->newModularTransactionTypes();
       foreach ($xtypes as $xtype) {
         $types[] = $xtype->getTransactionTypeConstant();
       }
     }
 
     if ($template) {
       try {
         $comment = $template->getApplicationTransactionCommentObject();
       } catch (PhutilMethodNotImplementedException $ex) {
         $comment = null;
       }
 
       if ($comment) {
         $types[] = PhabricatorTransactions::TYPE_COMMENT;
       }
     }
 
     return $types;
   }
 
   private function adjustTransactionValues(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     if ($xaction->shouldGenerateOldValue()) {
       $old = $this->getTransactionOldValue($object, $xaction);
       $xaction->setOldValue($old);
     }
 
     $new = $this->getTransactionNewValue($object, $xaction);
     $xaction->setNewValue($new);
   }
 
   private function getTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->generateOldValue($object);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_HISTORY:
         return null;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         return $object->getEditEngineSubtype();
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return array_values($this->subscribers);
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getViewPolicy();
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getEditPolicy();
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         if ($this->getIsNewObject()) {
           return null;
         }
         return $object->getJoinPolicy();
       case PhabricatorTransactions::TYPE_SPACE:
         if ($this->getIsNewObject()) {
           return null;
         }
 
         $space_phid = $object->getSpacePHID();
         if ($space_phid === null) {
           $default_space = PhabricatorSpacesNamespaceQuery::getDefaultSpace();
           if ($default_space) {
             $space_phid = $default_space->getPHID();
           }
         }
 
         return $space_phid;
       case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $xaction->getMetadataValue('edge:type');
         if (!$edge_type) {
           throw new Exception(
             pht(
               "Edge transaction has no '%s'!",
               'edge:type'));
         }
 
         $old_edges = array();
         if ($object->getPHID()) {
           $edge_src = $object->getPHID();
 
           $old_edges = id(new PhabricatorEdgeQuery())
             ->withSourcePHIDs(array($edge_src))
             ->withEdgeTypes(array($edge_type))
             ->needEdgeData(true)
             ->execute();
 
           $old_edges = $old_edges[$edge_src][$edge_type];
         }
         return $old_edges;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         // NOTE: Custom fields have their old value pre-populated when they are
         // built by PhabricatorCustomFieldList.
         return $xaction->getOldValue();
       case PhabricatorTransactions::TYPE_COMMENT:
         return null;
       default:
         return $this->getCustomTransactionOldValue($object, $xaction);
     }
   }
 
   private function getTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->generateNewValue($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CREATE:
         return null;
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return $this->getPHIDTransactionNewValue($xaction);
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_SUBTYPE:
       case PhabricatorTransactions::TYPE_HISTORY:
         return $xaction->getNewValue();
       case PhabricatorTransactions::TYPE_SPACE:
         $space_phid = $xaction->getNewValue();
         if (!strlen($space_phid)) {
           // If an install has no Spaces or the Spaces controls are not visible
           // to the viewer, we might end up with the empty string here instead
           // of a strict `null`, because some controller just used `getStr()`
           // to read the space PHID from the request.
           // Just make this work like callers might reasonably expect so we
           // don't need to handle this specially in every EditController.
           return $this->getActor()->getDefaultSpacePHID();
         } else {
           return $space_phid;
         }
       case PhabricatorTransactions::TYPE_EDGE:
         $new_value = $this->getEdgeTransactionNewValue($xaction);
 
         $edge_type = $xaction->getMetadataValue('edge:type');
         $type_project = PhabricatorProjectObjectHasProjectEdgeType::EDGECONST;
         if ($edge_type == $type_project) {
           $new_value = $this->applyProjectConflictRules($new_value);
         }
 
         return $new_value;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->getNewValueFromApplicationTransactions($xaction);
       case PhabricatorTransactions::TYPE_COMMENT:
         return null;
       default:
         return $this->getCustomTransactionNewValue($object, $xaction);
     }
   }
 
   protected function getCustomTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     throw new Exception(pht('Capability not supported!'));
   }
 
   protected function getCustomTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     throw new Exception(pht('Capability not supported!'));
   }
 
   protected function transactionHasEffect(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_HISTORY:
         return true;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->getApplicationTransactionHasEffect($xaction);
       case PhabricatorTransactions::TYPE_EDGE:
         // A straight value comparison here doesn't always get the right
         // result, because newly added edges aren't fully populated. Instead,
         // compare the changes in a more granular way.
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
 
         $old_dst = array_keys($old);
         $new_dst = array_keys($new);
 
         // NOTE: For now, we don't consider edge reordering to be a change.
         // We have very few order-dependent edges and effectively no order
         // oriented UI. This might change in the future.
         sort($old_dst);
         sort($new_dst);
 
         if ($old_dst !== $new_dst) {
           // We've added or removed edges, so this transaction definitely
           // has an effect.
           return true;
         }
 
         // We haven't added or removed edges, but we might have changed
         // edge data.
         foreach ($old as $key => $old_value) {
           $new_value = $new[$key];
           if ($old_value['data'] !== $new_value['data']) {
             return true;
           }
         }
 
         return false;
     }
 
     $type = $xaction->getTransactionType();
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       return $xtype->getTransactionHasEffect(
         $object,
         $xaction->getOldValue(),
         $xaction->getNewValue());
     }
 
     if ($xaction->hasComment()) {
       return true;
     }
 
     return ($xaction->getOldValue() !== $xaction->getNewValue());
   }
 
   protected function shouldApplyInitialEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
   protected function applyInitialEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     throw new PhutilMethodNotImplementedException();
   }
 
   private function applyInternalEffects(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->applyInternalEffects($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->applyApplicationTransactionInternalEffects($xaction);
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_HISTORY:
       case PhabricatorTransactions::TYPE_SUBTYPE:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_EDGE:
       case PhabricatorTransactions::TYPE_SPACE:
       case PhabricatorTransactions::TYPE_COMMENT:
         return $this->applyBuiltinInternalTransaction($object, $xaction);
     }
 
     return $this->applyCustomInternalTransaction($object, $xaction);
   }
 
   private function applyExternalEffects(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $xtype = clone $xtype;
       $xtype->setStorage($xaction);
       return $xtype->applyExternalEffects($object, $xaction->getNewValue());
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         $subeditor = id(new PhabricatorSubscriptionsEditor())
           ->setObject($object)
           ->setActor($this->requireActor());
 
         $old_map = array_fuse($xaction->getOldValue());
         $new_map = array_fuse($xaction->getNewValue());
 
         $subeditor->unsubscribe(
           array_keys(
             array_diff_key($old_map, $new_map)));
 
         $subeditor->subscribeExplicit(
           array_keys(
             array_diff_key($new_map, $old_map)));
 
         $subeditor->save();
 
         // for the rest of these edits, subscribers should include those just
         // added as well as those just removed.
         $subscribers = array_unique(array_merge(
           $this->subscribers,
           $xaction->getOldValue(),
           $xaction->getNewValue()));
         $this->subscribers = $subscribers;
         return $this->applyBuiltinExternalTransaction($object, $xaction);
 
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getCustomFieldForTransaction($object, $xaction);
         return $field->applyApplicationTransactionExternalEffects($xaction);
       case PhabricatorTransactions::TYPE_CREATE:
       case PhabricatorTransactions::TYPE_HISTORY:
       case PhabricatorTransactions::TYPE_SUBTYPE:
       case PhabricatorTransactions::TYPE_EDGE:
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_INLINESTATE:
       case PhabricatorTransactions::TYPE_SPACE:
       case PhabricatorTransactions::TYPE_COMMENT:
         return $this->applyBuiltinExternalTransaction($object, $xaction);
     }
 
     return $this->applyCustomExternalTransaction($object, $xaction);
   }
 
   protected function applyCustomInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     $type = $xaction->getTransactionType();
     throw new Exception(
       pht(
         "Transaction type '%s' is missing an internal apply implementation!",
         $type));
   }
 
   protected function applyCustomExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     $type = $xaction->getTransactionType();
     throw new Exception(
       pht(
         "Transaction type '%s' is missing an external apply implementation!",
         $type));
   }
 
   /**
    * @{class:PhabricatorTransactions} provides many built-in transactions
    * which should not require much - if any - code in specific applications.
    *
    * This method is a hook for the exceedingly-rare cases where you may need
    * to do **additional** work for built-in transactions. Developers should
    * extend this method, making sure to return the parent implementation
    * regardless of handling any transactions.
    *
    * See also @{method:applyBuiltinExternalTransaction}.
    */
   protected function applyBuiltinInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         $object->setViewPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         $object->setEditPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         $object->setJoinPolicy($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_SPACE:
         $object->setSpacePHID($xaction->getNewValue());
         break;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         $object->setEditEngineSubtype($xaction->getNewValue());
         break;
     }
   }
 
   /**
    * See @{method::applyBuiltinInternalTransaction}.
    */
   protected function applyBuiltinExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_EDGE:
         if ($this->getIsInverseEdgeEditor()) {
           // If we're writing an inverse edge transaction, don't actually
           // do anything. The initiating editor on the other side of the
           // transaction will take care of the edge writes.
           break;
         }
 
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
         $src = $object->getPHID();
         $const = $xaction->getMetadataValue('edge:type');
 
         $type = PhabricatorEdgeType::getByConstant($const);
         if ($type->shouldWriteInverseTransactions()) {
           $this->applyInverseEdgeTransactions(
             $object,
             $xaction,
             $type->getInverseEdgeConstant());
         }
 
         foreach ($new as $dst_phid => $edge) {
           $new[$dst_phid]['src'] = $src;
         }
 
         $editor = new PhabricatorEdgeEditor();
 
         foreach ($old as $dst_phid => $edge) {
           if (!empty($new[$dst_phid])) {
             if ($old[$dst_phid]['data'] === $new[$dst_phid]['data']) {
               continue;
             }
           }
           $editor->removeEdge($src, $const, $dst_phid);
         }
 
         foreach ($new as $dst_phid => $edge) {
           if (!empty($old[$dst_phid])) {
             if ($old[$dst_phid]['data'] === $new[$dst_phid]['data']) {
               continue;
             }
           }
 
           $data = array(
             'data' => $edge['data'],
           );
 
           $editor->addEdge($src, $const, $dst_phid, $data);
         }
 
         $editor->save();
 
         $this->updateWorkboardColumns($object, $const, $old, $new);
         break;
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_SPACE:
         $this->scrambleFileSecrets($object);
         break;
       case PhabricatorTransactions::TYPE_HISTORY:
         $this->sendHistory = true;
         break;
     }
   }
 
   /**
    * Fill in a transaction's common values, like author and content source.
    */
   protected function populateTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $actor = $this->getActor();
 
     // TODO: This needs to be more sophisticated once we have meta-policies.
     $xaction->setViewPolicy(PhabricatorPolicies::POLICY_PUBLIC);
 
     if ($actor->isOmnipotent()) {
       $xaction->setEditPolicy(PhabricatorPolicies::POLICY_NOONE);
     } else {
       $xaction->setEditPolicy($this->getActingAsPHID());
     }
 
     // If the transaction already has an explicit author PHID, allow it to
     // stand. This is used by applications like Owners that hook into the
     // post-apply change pipeline.
     if (!$xaction->getAuthorPHID()) {
       $xaction->setAuthorPHID($this->getActingAsPHID());
     }
 
     $xaction->setContentSource($this->getContentSource());
     $xaction->attachViewer($actor);
     $xaction->attachObject($object);
 
     if ($object->getPHID()) {
       $xaction->setObjectPHID($object->getPHID());
     }
 
     if ($this->getIsSilent()) {
       $xaction->setIsSilentTransaction(true);
     }
 
+    if ($actor->hasHighSecuritySession()) {
+      $xaction->setIsMFATransaction(true);
+    }
+
     return $xaction;
   }
 
   protected function didApplyInternalEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   protected function applyFinalEffects(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   public function setContentSource(PhabricatorContentSource $content_source) {
     $this->contentSource = $content_source;
     return $this;
   }
 
   public function setContentSourceFromRequest(AphrontRequest $request) {
     return $this->setContentSource(
       PhabricatorContentSource::newFromRequest($request));
   }
 
   public function getContentSource() {
     return $this->contentSource;
   }
 
   final public function applyTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $this->object = $object;
     $this->xactions = $xactions;
     $this->isNewObject = ($object->getPHID() === null);
 
     $this->validateEditParameters($object, $xactions);
 
     $actor = $this->requireActor();
 
     // NOTE: Some transaction expansion requires that the edited object be
     // attached.
     foreach ($xactions as $xaction) {
       $xaction->attachObject($object);
       $xaction->attachViewer($actor);
     }
 
     $xactions = $this->expandTransactions($object, $xactions);
     $xactions = $this->expandSupportTransactions($object, $xactions);
     $xactions = $this->combineTransactions($xactions);
 
     foreach ($xactions as $xaction) {
       $xaction = $this->populateTransaction($object, $xaction);
     }
 
     $is_preview = $this->getIsPreview();
     $read_locking = false;
     $transaction_open = false;
 
     if (!$is_preview) {
       $errors = array();
       $type_map = mgroup($xactions, 'getTransactionType');
       foreach ($this->getTransactionTypes() as $type) {
         $type_xactions = idx($type_map, $type, array());
         $errors[] = $this->validateTransaction($object, $type, $type_xactions);
       }
 
       $errors[] = $this->validateAllTransactions($object, $xactions);
       $errors = array_mergev($errors);
 
       $continue_on_missing = $this->getContinueOnMissingFields();
       foreach ($errors as $key => $error) {
         if ($continue_on_missing && $error->getIsMissingFieldError()) {
           unset($errors[$key]);
         }
       }
 
       if ($errors) {
         throw new PhabricatorApplicationTransactionValidationException($errors);
       }
 
       if ($this->raiseWarnings) {
         $warnings = array();
         foreach ($xactions as $xaction) {
           if ($this->hasWarnings($object, $xaction)) {
             $warnings[] = $xaction;
           }
         }
         if ($warnings) {
           throw new PhabricatorApplicationTransactionWarningException(
             $warnings);
         }
       }
 
       $this->willApplyTransactions($object, $xactions);
 
       if ($object->getID()) {
         $this->buildOldRecipientLists($object, $xactions);
 
         $object->openTransaction();
         $transaction_open = true;
 
         $object->beginReadLocking();
         $read_locking = true;
 
         $object->reload();
       }
 
       if ($this->shouldApplyInitialEffects($object, $xactions)) {
         if (!$transaction_open) {
           $object->openTransaction();
           $transaction_open = true;
         }
       }
     }
 
     try {
       if ($this->shouldApplyInitialEffects($object, $xactions)) {
         $this->applyInitialEffects($object, $xactions);
       }
 
       foreach ($xactions as $xaction) {
         $this->adjustTransactionValues($object, $xaction);
       }
 
       // Now that we've merged and combined transactions, check for required
       // capabilities. Note that we're doing this before filtering
       // transactions: if you try to apply an edit which you do not have
       // permission to apply, we want to give you a permissions error even
       // if the edit would have no effect.
       $this->applyCapabilityChecks($object, $xactions);
 
       // See T13186. Fatal hard if this object has an older
       // "requireCapabilities()" method. The code may rely on this method being
       // called to apply policy checks, so err on the side of safety and fatal.
       // TODO: Remove this check after some time has passed.
       if (method_exists($this, 'requireCapabilities')) {
         throw new Exception(
           pht(
             'Editor (of class "%s") implements obsolete policy method '.
             'requireCapabilities(). The implementation for this Editor '.
             'MUST be updated. See <%s> for discussion.',
             get_class($this),
             'https://secure.phabricator.com/T13186'));
       }
 
       $xactions = $this->filterTransactions($object, $xactions);
 
       // TODO: Once everything is on EditEngine, just use getIsNewObject() to
       // figure this out instead.
       $mark_as_create = false;
       $create_type = PhabricatorTransactions::TYPE_CREATE;
       foreach ($xactions as $xaction) {
         if ($xaction->getTransactionType() == $create_type) {
           $mark_as_create = true;
         }
       }
 
       if ($mark_as_create) {
         foreach ($xactions as $xaction) {
           $xaction->setIsCreateTransaction(true);
         }
       }
 
       $xactions = $this->sortTransactions($xactions);
       $file_phids = $this->extractFilePHIDs($object, $xactions);
 
       if ($is_preview) {
         $this->loadHandles($xactions);
         return $xactions;
       }
 
       $comment_editor = id(new PhabricatorApplicationTransactionCommentEditor())
         ->setActor($actor)
         ->setActingAsPHID($this->getActingAsPHID())
         ->setContentSource($this->getContentSource());
 
       if (!$transaction_open) {
         $object->openTransaction();
         $transaction_open = true;
       }
 
       foreach ($xactions as $xaction) {
         $this->applyInternalEffects($object, $xaction);
       }
 
       $xactions = $this->didApplyInternalEffects($object, $xactions);
 
       try {
         $object->save();
       } catch (AphrontDuplicateKeyQueryException $ex) {
         // This callback has an opportunity to throw a better exception,
         // so execution may end here.
         $this->didCatchDuplicateKeyException($object, $xactions, $ex);
 
         throw $ex;
       }
 
       foreach ($xactions as $xaction) {
         $xaction->setObjectPHID($object->getPHID());
         if ($xaction->getComment()) {
           $xaction->setPHID($xaction->generatePHID());
           $comment_editor->applyEdit($xaction, $xaction->getComment());
         } else {
 
           // TODO: This is a transitional hack to let us migrate edge
           // transactions to a more efficient storage format. For now, we're
           // going to write a new slim format to the database but keep the old
           // bulky format on the objects so we don't have to upgrade all the
           // edit logic to the new format yet. See T13051.
 
           $edge_type = PhabricatorTransactions::TYPE_EDGE;
           if ($xaction->getTransactionType() == $edge_type) {
             $bulky_old = $xaction->getOldValue();
             $bulky_new = $xaction->getNewValue();
 
             $record = PhabricatorEdgeChangeRecord::newFromTransaction($xaction);
             $slim_old = $record->getModernOldEdgeTransactionData();
             $slim_new = $record->getModernNewEdgeTransactionData();
 
             $xaction->setOldValue($slim_old);
             $xaction->setNewValue($slim_new);
             $xaction->save();
 
             $xaction->setOldValue($bulky_old);
             $xaction->setNewValue($bulky_new);
           } else {
             $xaction->save();
           }
         }
       }
 
       if ($file_phids) {
         $this->attachFiles($object, $file_phids);
       }
 
       foreach ($xactions as $xaction) {
         $this->applyExternalEffects($object, $xaction);
       }
 
       $xactions = $this->applyFinalEffects($object, $xactions);
 
       if ($read_locking) {
         $object->endReadLocking();
         $read_locking = false;
       }
 
       if ($transaction_open) {
         $object->saveTransaction();
         $transaction_open = false;
       }
     } catch (Exception $ex) {
       if ($read_locking) {
         $object->endReadLocking();
         $read_locking = false;
       }
 
       if ($transaction_open) {
         $object->killTransaction();
         $transaction_open = false;
       }
 
       throw $ex;
     }
 
     // If we need to perform cache engine updates, execute them now.
     id(new PhabricatorCacheEngine())
       ->updateObject($object);
 
     // Now that we've completely applied the core transaction set, try to apply
     // Herald rules. Herald rules are allowed to either take direct actions on
     // the database (like writing flags), or take indirect actions (like saving
     // some targets for CC when we generate mail a little later), or return
     // transactions which we'll apply normally using another Editor.
 
     // First, check if *this* is a sub-editor which is itself applying Herald
     // rules: if it is, stop working and return so we don't descend into
     // madness.
 
     // Otherwise, we're not a Herald editor, so process Herald rules (possibly
     // using a Herald editor to apply resulting transactions) and then send out
     // mail, notifications, and feed updates about everything.
 
     if ($this->getIsHeraldEditor()) {
       // We are the Herald editor, so stop work here and return the updated
       // transactions.
       return $xactions;
     } else if ($this->getIsInverseEdgeEditor()) {
       // Do not run Herald if we're just recording that this object was
       // mentioned elsewhere. This tends to create Herald side effects which
       // feel arbitrary, and can really slow down edits which mention a large
       // number of other objects. See T13114.
     } else if ($this->shouldApplyHeraldRules($object, $xactions)) {
       // We are not the Herald editor, so try to apply Herald rules.
       $herald_xactions = $this->applyHeraldRules($object, $xactions);
 
       if ($herald_xactions) {
         $xscript_id = $this->getHeraldTranscript()->getID();
         foreach ($herald_xactions as $herald_xaction) {
           // Don't set a transcript ID if this is a transaction from another
           // application or source, like Owners.
           if ($herald_xaction->getAuthorPHID()) {
             continue;
           }
 
           $herald_xaction->setMetadataValue('herald:transcriptID', $xscript_id);
         }
 
         // NOTE: We're acting as the omnipotent user because rules deal with
         // their own policy issues. We use a synthetic author PHID (the
         // Herald application) as the author of record, so that transactions
         // will render in a reasonable way ("Herald assigned this task ...").
         $herald_actor = PhabricatorUser::getOmnipotentUser();
         $herald_phid = id(new PhabricatorHeraldApplication())->getPHID();
 
         // TODO: It would be nice to give transactions a more specific source
         // which points at the rule which generated them. You can figure this
         // out from transcripts, but it would be cleaner if you didn't have to.
 
         $herald_source = PhabricatorContentSource::newForSource(
           PhabricatorHeraldContentSource::SOURCECONST);
 
         $herald_editor = newv(get_class($this), array())
           ->setContinueOnNoEffect(true)
           ->setContinueOnMissingFields(true)
           ->setParentMessageID($this->getParentMessageID())
           ->setIsHeraldEditor(true)
           ->setActor($herald_actor)
           ->setActingAsPHID($herald_phid)
           ->setContentSource($herald_source);
 
         $herald_xactions = $herald_editor->applyTransactions(
           $object,
           $herald_xactions);
 
         // Merge the new transactions into the transaction list: we want to
         // send email and publish feed stories about them, too.
         $xactions = array_merge($xactions, $herald_xactions);
       }
 
       // If Herald did not generate transactions, we may still need to handle
       // "Send an Email" rules.
       $adapter = $this->getHeraldAdapter();
       $this->heraldEmailPHIDs = $adapter->getEmailPHIDs();
       $this->heraldForcedEmailPHIDs = $adapter->getForcedEmailPHIDs();
       $this->webhookMap = $adapter->getWebhookMap();
     }
 
     $xactions = $this->didApplyTransactions($object, $xactions);
 
     if ($object instanceof PhabricatorCustomFieldInterface) {
       // Maybe this makes more sense to move into the search index itself? For
       // now I'm putting it here since I think we might end up with things that
       // need it to be up to date once the next page loads, but if we don't go
       // there we could move it into search once search moves to the daemons.
 
       // It now happens in the search indexer as well, but the search indexer is
       // always daemonized, so the logic above still potentially holds. We could
       // possibly get rid of this. The major motivation for putting it in the
       // indexer was to enable reindexing to work.
 
       $fields = PhabricatorCustomField::getObjectFields(
         $object,
         PhabricatorCustomField::ROLE_APPLICATIONSEARCH);
       $fields->readFieldsFromStorage($object);
       $fields->rebuildIndexes($object);
     }
 
     $herald_xscript = $this->getHeraldTranscript();
     if ($herald_xscript) {
       $herald_header = $herald_xscript->getXHeraldRulesHeader();
       $herald_header = HeraldTranscript::saveXHeraldRulesHeader(
         $object->getPHID(),
         $herald_header);
     } else {
       $herald_header = HeraldTranscript::loadXHeraldRulesHeader(
         $object->getPHID());
     }
     $this->heraldHeader = $herald_header;
 
     // We're going to compute some of the data we'll use to publish these
     // transactions here, before queueing a worker.
     //
     // Primarily, this is more correct: we want to publish the object as it
     // exists right now. The worker may not execute for some time, and we want
     // to use the current To/CC list, not respect any changes which may occur
     // between now and when the worker executes.
     //
     // As a secondary benefit, this tends to reduce the amount of state that
     // Editors need to pass into workers.
     $object = $this->willPublish($object, $xactions);
 
     if (!$this->getIsSilent()) {
       if ($this->shouldSendMail($object, $xactions)) {
         $this->mailShouldSend = true;
         $this->mailToPHIDs = $this->getMailTo($object);
         $this->mailCCPHIDs = $this->getMailCC($object);
         $this->mailUnexpandablePHIDs = $this->newMailUnexpandablePHIDs($object);
 
         // Add any recipients who were previously on the notification list
         // but were removed by this change.
         $this->applyOldRecipientLists();
 
         if ($object instanceof PhabricatorSubscribableInterface) {
           $this->mailMutedPHIDs = PhabricatorEdgeQuery::loadDestinationPHIDs(
             $object->getPHID(),
             PhabricatorMutedByEdgeType::EDGECONST);
         } else {
           $this->mailMutedPHIDs = array();
         }
 
         $mail_xactions = $this->getTransactionsForMail($object, $xactions);
         $stamps = $this->newMailStamps($object, $xactions);
         foreach ($stamps as $stamp) {
           $this->mailStamps[] = $stamp->toDictionary();
         }
       }
 
       if ($this->shouldPublishFeedStory($object, $xactions)) {
         $this->feedShouldPublish = true;
         $this->feedRelatedPHIDs = $this->getFeedRelatedPHIDs(
           $object,
           $xactions);
         $this->feedNotifyPHIDs = $this->getFeedNotifyPHIDs(
           $object,
           $xactions);
       }
     }
 
     PhabricatorWorker::scheduleTask(
       'PhabricatorApplicationTransactionPublishWorker',
       array(
         'objectPHID' => $object->getPHID(),
         'actorPHID' => $this->getActingAsPHID(),
         'xactionPHIDs' => mpull($xactions, 'getPHID'),
         'state' => $this->getWorkerState(),
       ),
       array(
         'objectPHID' => $object->getPHID(),
         'priority' => PhabricatorWorker::PRIORITY_ALERTS,
       ));
 
     $this->flushTransactionQueue($object);
 
     return $xactions;
   }
 
   protected function didCatchDuplicateKeyException(
     PhabricatorLiskDAO $object,
     array $xactions,
     Exception $ex) {
     return;
   }
 
   public function publishTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $this->object = $object;
     $this->xactions = $xactions;
 
     // Hook for edges or other properties that may need (re-)loading
     $object = $this->willPublish($object, $xactions);
 
     // The object might have changed, so reassign it.
     $this->object = $object;
 
     $messages = array();
     if ($this->mailShouldSend) {
       $messages = $this->buildMail($object, $xactions);
     }
 
     if ($this->supportsSearch()) {
       PhabricatorSearchWorker::queueDocumentForIndexing(
         $object->getPHID(),
         array(
           'transactionPHIDs' => mpull($xactions, 'getPHID'),
         ));
     }
 
     if ($this->feedShouldPublish) {
       $mailed = array();
       foreach ($messages as $mail) {
         foreach ($mail->buildRecipientList() as $phid) {
           $mailed[$phid] = $phid;
         }
       }
 
       $this->publishFeedStory($object, $xactions, $mailed);
     }
 
     if ($this->sendHistory) {
       $history_mail = $this->buildHistoryMail($object);
       if ($history_mail) {
         $messages[] = $history_mail;
       }
     }
 
     // NOTE: This actually sends the mail. We do this last to reduce the chance
     // that we send some mail, hit an exception, then send the mail again when
     // retrying.
     foreach ($messages as $mail) {
       $mail->save();
     }
 
     $this->queueWebhooks($object, $xactions);
 
     return $xactions;
   }
 
   protected function didApplyTransactions($object, array $xactions) {
     // Hook for subclasses.
     return $xactions;
   }
 
   private function loadHandles(array $xactions) {
     $phids = array();
     foreach ($xactions as $key => $xaction) {
       $phids[$key] = $xaction->getRequiredHandlePHIDs();
     }
     $handles = array();
     $merged = array_mergev($phids);
     if ($merged) {
       $handles = id(new PhabricatorHandleQuery())
         ->setViewer($this->requireActor())
         ->withPHIDs($merged)
         ->execute();
     }
     foreach ($xactions as $key => $xaction) {
       $xaction->setHandles(array_select_keys($handles, $phids[$key]));
     }
   }
 
   private function loadSubscribers(PhabricatorLiskDAO $object) {
     if ($object->getPHID() &&
         ($object instanceof PhabricatorSubscribableInterface)) {
       $subs = PhabricatorSubscribersQuery::loadSubscribersForPHID(
         $object->getPHID());
       $this->subscribers = array_fuse($subs);
     } else {
       $this->subscribers = array();
     }
   }
 
   private function validateEditParameters(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if (!$this->getContentSource()) {
       throw new PhutilInvalidStateException('setContentSource');
     }
 
     // Do a bunch of sanity checks that the incoming transactions are fresh.
     // They should be unsaved and have only "transactionType" and "newValue"
     // set.
 
     $types = array_fill_keys($this->getTransactionTypes(), true);
 
     assert_instances_of($xactions, 'PhabricatorApplicationTransaction');
     foreach ($xactions as $xaction) {
       if ($xaction->getPHID() || $xaction->getID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht('You can not apply transactions which already have IDs/PHIDs!'));
       }
 
       if ($xaction->getObjectPHID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have %s!',
             'objectPHIDs'));
       }
 
       if ($xaction->getCommentPHID()) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have %s!',
             'commentPHIDs'));
       }
 
       if ($xaction->getCommentVersion() !== 0) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'You can not apply transactions which already have '.
             'commentVersions!'));
       }
 
       $expect_value = !$xaction->shouldGenerateOldValue();
       $has_value = $xaction->hasOldValue();
 
       if ($expect_value && !$has_value) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'This transaction is supposed to have an %s set, but it does not!',
             'oldValue'));
       }
 
       if ($has_value && !$expect_value) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'This transaction should generate its %s automatically, '.
             'but has already had one set!',
             'oldValue'));
       }
 
       $type = $xaction->getTransactionType();
       if (empty($types[$type])) {
         throw new PhabricatorApplicationTransactionStructureException(
           $xaction,
           pht(
             'Transaction has type "%s", but that transaction type is not '.
             'supported by this editor (%s).',
             $type,
             get_class($this)));
       }
     }
   }
 
   private function applyCapabilityChecks(
     PhabricatorLiskDAO $object,
     array $xactions) {
     assert_instances_of($xactions, 'PhabricatorApplicationTransaction');
 
     $can_edit = PhabricatorPolicyCapability::CAN_EDIT;
 
     if ($this->getIsNewObject()) {
       // If we're creating a new object, we don't need any special capabilities
       // on the object. The actor has already made it through creation checks,
       // and objects which haven't been created yet often can not be
       // meaningfully tested for capabilities anyway.
       $required_capabilities = array();
     } else {
       if (!$xactions && !$this->xactions) {
         // If we aren't doing anything, require CAN_EDIT to improve consistency.
         $required_capabilities = array($can_edit);
       } else {
         $required_capabilities = array();
 
         foreach ($xactions as $xaction) {
           $type = $xaction->getTransactionType();
 
           $xtype = $this->getModularTransactionType($type);
           if (!$xtype) {
             $capabilities = $this->getLegacyRequiredCapabilities($xaction);
           } else {
             $capabilities = $xtype->getRequiredCapabilities($object, $xaction);
           }
 
           // For convenience, we allow flexibility in the return types because
           // it's very unusual that a transaction actually requires multiple
           // capability checks.
           if ($capabilities === null) {
             $capabilities = array();
           } else {
             $capabilities = (array)$capabilities;
           }
 
           foreach ($capabilities as $capability) {
             $required_capabilities[$capability] = $capability;
           }
         }
       }
     }
 
     $required_capabilities = array_fuse($required_capabilities);
     $actor = $this->getActor();
 
     if ($required_capabilities) {
       id(new PhabricatorPolicyFilter())
         ->setViewer($actor)
         ->requireCapabilities($required_capabilities)
         ->raisePolicyExceptions(true)
         ->apply(array($object));
     }
   }
 
   private function getLegacyRequiredCapabilities(
     PhabricatorApplicationTransaction $xaction) {
 
     $type = $xaction->getTransactionType();
     switch ($type) {
       case PhabricatorTransactions::TYPE_COMMENT:
         // TODO: Comments technically require CAN_INTERACT, but this is
         // currently somewhat special and handled through EditEngine. For now,
         // don't enforce it here.
         return null;
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         // TODO: Removing subscribers other than yourself should probably
         // require CAN_EDIT permission. You can do this via the API but
         // generally can not via the web interface.
         return null;
       case PhabricatorTransactions::TYPE_TOKEN:
         // TODO: This technically requires CAN_INTERACT, like comments.
         return null;
       case PhabricatorTransactions::TYPE_HISTORY:
         // This is a special magic transaction which sends you history via
         // email and is only partially supported in the upstream. You don't
         // need any capabilities to apply it.
         return null;
       case PhabricatorTransactions::TYPE_EDGE:
         return $this->getLegacyRequiredEdgeCapabilities($xaction);
       default:
         // For other older (non-modular) transactions, always require exactly
         // CAN_EDIT. Transactions which do not need CAN_EDIT or need additional
         // capabilities must move to ModularTransactions.
         return PhabricatorPolicyCapability::CAN_EDIT;
     }
   }
 
   private function getLegacyRequiredEdgeCapabilities(
     PhabricatorApplicationTransaction $xaction) {
 
     // You don't need to have edit permission on an object to mention it or
     // otherwise add a relationship pointing toward it.
     if ($this->getIsInverseEdgeEditor()) {
       return null;
     }
 
     $edge_type = $xaction->getMetadataValue('edge:type');
     switch ($edge_type) {
       case PhabricatorMutedByEdgeType::EDGECONST:
         // At time of writing, you can only write this edge for yourself, so
         // you don't need permissions. If you can eventually mute an object
         // for other users, this would need to be revisited.
         return null;
       case PhabricatorObjectMentionsObjectEdgeType::EDGECONST:
         return null;
       case PhabricatorProjectProjectHasMemberEdgeType::EDGECONST:
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
 
         $add = array_keys(array_diff_key($new, $old));
         $rem = array_keys(array_diff_key($old, $new));
 
         $actor_phid = $this->requireActor()->getPHID();
 
         $is_join = (($add === array($actor_phid)) && !$rem);
         $is_leave = (($rem === array($actor_phid)) && !$add);
 
         if ($is_join) {
           // You need CAN_JOIN to join a project.
           return PhabricatorPolicyCapability::CAN_JOIN;
         }
 
         if ($is_leave) {
           $object = $this->object;
           // You usually don't need any capabilities to leave a project...
           if ($object->getIsMembershipLocked()) {
             // ...you must be able to edit to leave locked projects, though.
             return PhabricatorPolicyCapability::CAN_EDIT;
           } else {
             return null;
           }
         }
 
         // You need CAN_EDIT to change members other than yourself.
         return PhabricatorPolicyCapability::CAN_EDIT;
       default:
         return PhabricatorPolicyCapability::CAN_EDIT;
     }
   }
 
 
   private function buildSubscribeTransaction(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes) {
 
     if (!($object instanceof PhabricatorSubscribableInterface)) {
       return null;
     }
 
     if ($this->shouldEnableMentions($object, $xactions)) {
       // Identify newly mentioned users. We ignore users who were previously
       // mentioned so that we don't re-subscribe users after an edit of text
       // which mentions them.
       $old_texts = mpull($changes, 'getOldValue');
       $new_texts = mpull($changes, 'getNewValue');
 
       $old_phids = PhabricatorMarkupEngine::extractPHIDsFromMentions(
         $this->getActor(),
         $old_texts);
 
       $new_phids = PhabricatorMarkupEngine::extractPHIDsFromMentions(
         $this->getActor(),
         $new_texts);
 
       $phids = array_diff($new_phids, $old_phids);
     } else {
       $phids = array();
     }
 
     $this->mentionedPHIDs = $phids;
 
     if ($object->getPHID()) {
       // Don't try to subscribe already-subscribed mentions: we want to generate
       // a dialog about an action having no effect if the user explicitly adds
       // existing CCs, but not if they merely mention existing subscribers.
       $phids = array_diff($phids, $this->subscribers);
     }
 
     if ($phids) {
       $users = id(new PhabricatorPeopleQuery())
         ->setViewer($this->getActor())
         ->withPHIDs($phids)
         ->execute();
       $users = mpull($users, null, 'getPHID');
 
       foreach ($phids as $key => $phid) {
         // Do not subscribe mentioned users
         // who do not have VIEW Permissions
         if ($object instanceof PhabricatorPolicyInterface
           && !PhabricatorPolicyFilter::hasCapability(
           $users[$phid],
           $object,
           PhabricatorPolicyCapability::CAN_VIEW)
         ) {
           unset($phids[$key]);
         } else {
           if ($object->isAutomaticallySubscribed($phid)) {
             unset($phids[$key]);
           }
         }
       }
       $phids = array_values($phids);
     }
     // No else here to properly return null should we unset all subscriber
     if (!$phids) {
       return null;
     }
 
     $xaction = newv(get_class(head($xactions)), array());
     $xaction->setTransactionType(PhabricatorTransactions::TYPE_SUBSCRIBERS);
     $xaction->setNewValue(array('+' => $phids));
 
     return $xaction;
   }
 
   protected function mergeTransactions(
     PhabricatorApplicationTransaction $u,
     PhabricatorApplicationTransaction $v) {
 
     $type = $u->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $object = $this->object;
       return $xtype->mergeTransactions($object, $u, $v);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return $this->mergePHIDOrEdgeTransactions($u, $v);
       case PhabricatorTransactions::TYPE_EDGE:
         $u_type = $u->getMetadataValue('edge:type');
         $v_type = $v->getMetadataValue('edge:type');
         if ($u_type == $v_type) {
           return $this->mergePHIDOrEdgeTransactions($u, $v);
         }
         return null;
     }
 
     // By default, do not merge the transactions.
     return null;
   }
 
   /**
    * Optionally expand transactions which imply other effects. For example,
    * resigning from a revision in Differential implies removing yourself as
    * a reviewer.
    */
   protected function expandTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $results = array();
     foreach ($xactions as $xaction) {
       foreach ($this->expandTransaction($object, $xaction) as $expanded) {
         $results[] = $expanded;
       }
     }
 
     return $results;
   }
 
   protected function expandTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return array($xaction);
   }
 
 
   public function getExpandedSupportTransactions(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $xactions = array($xaction);
     $xactions = $this->expandSupportTransactions(
       $object,
       $xactions);
 
     if (count($xactions) == 1) {
       return array();
     }
 
     foreach ($xactions as $index => $cxaction) {
       if ($cxaction === $xaction) {
         unset($xactions[$index]);
         break;
       }
     }
 
     return $xactions;
   }
 
   private function expandSupportTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     $this->loadSubscribers($object);
 
     $xactions = $this->applyImplicitCC($object, $xactions);
 
     $changes = $this->getRemarkupChanges($xactions);
 
     $subscribe_xaction = $this->buildSubscribeTransaction(
       $object,
       $xactions,
       $changes);
     if ($subscribe_xaction) {
       $xactions[] = $subscribe_xaction;
     }
 
     // TODO: For now, this is just a placeholder.
     $engine = PhabricatorMarkupEngine::getEngine('extract');
     $engine->setConfig('viewer', $this->requireActor());
 
     $block_xactions = $this->expandRemarkupBlockTransactions(
       $object,
       $xactions,
       $changes,
       $engine);
 
     foreach ($block_xactions as $xaction) {
       $xactions[] = $xaction;
     }
 
     return $xactions;
   }
 
   private function getRemarkupChanges(array $xactions) {
     $changes = array();
 
     foreach ($xactions as $key => $xaction) {
       foreach ($this->getRemarkupChangesFromTransaction($xaction) as $change) {
         $changes[] = $change;
       }
     }
 
     return $changes;
   }
 
   private function getRemarkupChangesFromTransaction(
     PhabricatorApplicationTransaction $transaction) {
     return $transaction->getRemarkupChanges();
   }
 
   private function expandRemarkupBlockTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes,
     PhutilMarkupEngine $engine) {
 
     $block_xactions = $this->expandCustomRemarkupBlockTransactions(
       $object,
       $xactions,
       $changes,
       $engine);
 
     $mentioned_phids = array();
     if ($this->shouldEnableMentions($object, $xactions)) {
       foreach ($changes as $change) {
         // Here, we don't care about processing only new mentions after an edit
         // because there is no way for an object to ever "unmention" itself on
         // another object, so we can ignore the old value.
         $engine->markupText($change->getNewValue());
 
         $mentioned_phids += $engine->getTextMetadata(
           PhabricatorObjectRemarkupRule::KEY_MENTIONED_OBJECTS,
           array());
       }
     }
 
     if (!$mentioned_phids) {
       return $block_xactions;
     }
 
     $mentioned_objects = id(new PhabricatorObjectQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($mentioned_phids)
       ->execute();
 
     $mentionable_phids = array();
     if ($this->shouldEnableMentions($object, $xactions)) {
       foreach ($mentioned_objects as $mentioned_object) {
         if ($mentioned_object instanceof PhabricatorMentionableInterface) {
           $mentioned_phid = $mentioned_object->getPHID();
           if (idx($this->getUnmentionablePHIDMap(), $mentioned_phid)) {
             continue;
           }
           // don't let objects mention themselves
           if ($object->getPHID() && $mentioned_phid == $object->getPHID()) {
             continue;
           }
           $mentionable_phids[$mentioned_phid] = $mentioned_phid;
         }
       }
     }
 
     if ($mentionable_phids) {
       $edge_type = PhabricatorObjectMentionsObjectEdgeType::EDGECONST;
       $block_xactions[] = newv(get_class(head($xactions)), array())
         ->setIgnoreOnNoEffect(true)
         ->setTransactionType(PhabricatorTransactions::TYPE_EDGE)
         ->setMetadataValue('edge:type', $edge_type)
         ->setNewValue(array('+' => $mentionable_phids));
     }
 
     return $block_xactions;
   }
 
   protected function expandCustomRemarkupBlockTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $changes,
     PhutilMarkupEngine $engine) {
     return array();
   }
 
 
   /**
    * Attempt to combine similar transactions into a smaller number of total
    * transactions. For example, two transactions which edit the title of an
    * object can be merged into a single edit.
    */
   private function combineTransactions(array $xactions) {
     $stray_comments = array();
 
     $result = array();
     $types = array();
     foreach ($xactions as $key => $xaction) {
       $type = $xaction->getTransactionType();
       if (isset($types[$type])) {
         foreach ($types[$type] as $other_key) {
           $other_xaction = $result[$other_key];
 
           // Don't merge transactions with different authors. For example,
           // don't merge Herald transactions and owners transactions.
           if ($other_xaction->getAuthorPHID() != $xaction->getAuthorPHID()) {
             continue;
           }
 
           $merged = $this->mergeTransactions($result[$other_key], $xaction);
           if ($merged) {
             $result[$other_key] = $merged;
 
             if ($xaction->getComment() &&
                 ($xaction->getComment() !== $merged->getComment())) {
               $stray_comments[] = $xaction->getComment();
             }
 
             if ($result[$other_key]->getComment() &&
                 ($result[$other_key]->getComment() !== $merged->getComment())) {
               $stray_comments[] = $result[$other_key]->getComment();
             }
 
             // Move on to the next transaction.
             continue 2;
           }
         }
       }
       $result[$key] = $xaction;
       $types[$type][] = $key;
     }
 
     // If we merged any comments away, restore them.
     foreach ($stray_comments as $comment) {
       $xaction = newv(get_class(head($result)), array());
       $xaction->setTransactionType(PhabricatorTransactions::TYPE_COMMENT);
       $xaction->setComment($comment);
       $result[] = $xaction;
     }
 
     return array_values($result);
   }
 
   public function mergePHIDOrEdgeTransactions(
     PhabricatorApplicationTransaction $u,
     PhabricatorApplicationTransaction $v) {
 
     $result = $u->getNewValue();
     foreach ($v->getNewValue() as $key => $value) {
       if ($u->getTransactionType() == PhabricatorTransactions::TYPE_EDGE) {
         if (empty($result[$key])) {
           $result[$key] = $value;
         } else {
           // We're merging two lists of edge adds, sets, or removes. Merge
           // them by merging individual PHIDs within them.
           $merged = $result[$key];
 
           foreach ($value as $dst => $v_spec) {
             if (empty($merged[$dst])) {
               $merged[$dst] = $v_spec;
             } else {
               // Two transactions are trying to perform the same operation on
               // the same edge. Normalize the edge data and then merge it. This
               // allows transactions to specify how data merges execute in a
               // precise way.
 
               $u_spec = $merged[$dst];
 
               if (!is_array($u_spec)) {
                 $u_spec = array('dst' => $u_spec);
               }
               if (!is_array($v_spec)) {
                 $v_spec = array('dst' => $v_spec);
               }
 
               $ux_data = idx($u_spec, 'data', array());
               $vx_data = idx($v_spec, 'data', array());
 
               $merged_data = $this->mergeEdgeData(
                 $u->getMetadataValue('edge:type'),
                 $ux_data,
                 $vx_data);
 
               $u_spec['data'] = $merged_data;
               $merged[$dst] = $u_spec;
             }
           }
 
           $result[$key] = $merged;
         }
       } else {
         $result[$key] = array_merge($value, idx($result, $key, array()));
       }
     }
     $u->setNewValue($result);
 
     // When combining an "ignore" transaction with a normal transaction, make
     // sure we don't propagate the "ignore" flag.
     if (!$v->getIgnoreOnNoEffect()) {
       $u->setIgnoreOnNoEffect(false);
     }
 
     return $u;
   }
 
   protected function mergeEdgeData($type, array $u, array $v) {
     return $v + $u;
   }
 
   protected function getPHIDTransactionNewValue(
     PhabricatorApplicationTransaction $xaction,
     $old = null) {
 
     if ($old !== null) {
       $old = array_fuse($old);
     } else {
       $old = array_fuse($xaction->getOldValue());
     }
 
     return $this->getPHIDList($old, $xaction->getNewValue());
   }
 
   public function getPHIDList(array $old, array $new) {
     $new_add = idx($new, '+', array());
     unset($new['+']);
     $new_rem = idx($new, '-', array());
     unset($new['-']);
     $new_set = idx($new, '=', null);
     if ($new_set !== null) {
       $new_set = array_fuse($new_set);
     }
     unset($new['=']);
 
     if ($new) {
       throw new Exception(
         pht(
           "Invalid '%s' value for PHID transaction. Value should contain only ".
           "keys '%s' (add PHIDs), '%s' (remove PHIDs) and '%s' (set PHIDS).",
           'new',
           '+',
           '-',
           '='));
     }
 
     $result = array();
 
     foreach ($old as $phid) {
       if ($new_set !== null && empty($new_set[$phid])) {
         continue;
       }
       $result[$phid] = $phid;
     }
 
     if ($new_set !== null) {
       foreach ($new_set as $phid) {
         $result[$phid] = $phid;
       }
     }
 
     foreach ($new_add as $phid) {
       $result[$phid] = $phid;
     }
 
     foreach ($new_rem as $phid) {
       unset($result[$phid]);
     }
 
     return array_values($result);
   }
 
   protected function getEdgeTransactionNewValue(
     PhabricatorApplicationTransaction $xaction) {
 
     $new = $xaction->getNewValue();
     $new_add = idx($new, '+', array());
     unset($new['+']);
     $new_rem = idx($new, '-', array());
     unset($new['-']);
     $new_set = idx($new, '=', null);
     unset($new['=']);
 
     if ($new) {
       throw new Exception(
         pht(
           "Invalid '%s' value for Edge transaction. Value should contain only ".
           "keys '%s' (add edges), '%s' (remove edges) and '%s' (set edges).",
           'new',
           '+',
           '-',
           '='));
     }
 
     $old = $xaction->getOldValue();
 
     $lists = array($new_set, $new_add, $new_rem);
     foreach ($lists as $list) {
       $this->checkEdgeList($list, $xaction->getMetadataValue('edge:type'));
     }
 
     $result = array();
     foreach ($old as $dst_phid => $edge) {
       if ($new_set !== null && empty($new_set[$dst_phid])) {
         continue;
       }
       $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
         $xaction,
         $edge,
         $dst_phid);
     }
 
     if ($new_set !== null) {
       foreach ($new_set as $dst_phid => $edge) {
         $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
           $xaction,
           $edge,
           $dst_phid);
       }
     }
 
     foreach ($new_add as $dst_phid => $edge) {
       $result[$dst_phid] = $this->normalizeEdgeTransactionValue(
         $xaction,
         $edge,
         $dst_phid);
     }
 
     foreach ($new_rem as $dst_phid => $edge) {
       unset($result[$dst_phid]);
     }
 
     return $result;
   }
 
   private function checkEdgeList($list, $edge_type) {
     if (!$list) {
       return;
     }
     foreach ($list as $key => $item) {
       if (phid_get_type($key) === PhabricatorPHIDConstants::PHID_TYPE_UNKNOWN) {
         throw new Exception(
           pht(
             'Edge transactions must have destination PHIDs as in edge '.
             'lists (found key "%s" on transaction of type "%s").',
             $key,
             $edge_type));
       }
       if (!is_array($item) && $item !== $key) {
         throw new Exception(
           pht(
             'Edge transactions must have PHIDs or edge specs as values '.
             '(found value "%s" on transaction of type "%s").',
             $item,
             $edge_type));
       }
     }
   }
 
   private function normalizeEdgeTransactionValue(
     PhabricatorApplicationTransaction $xaction,
     $edge,
     $dst_phid) {
 
     if (!is_array($edge)) {
       if ($edge != $dst_phid) {
         throw new Exception(
           pht(
             'Transaction edge data must either be the edge PHID or an edge '.
             'specification dictionary.'));
       }
       $edge = array();
     } else {
       foreach ($edge as $key => $value) {
         switch ($key) {
           case 'src':
           case 'dst':
           case 'type':
           case 'data':
           case 'dateCreated':
           case 'dateModified':
           case 'seq':
           case 'dataID':
             break;
           default:
             throw new Exception(
               pht(
                 'Transaction edge specification contains unexpected key "%s".',
                 $key));
         }
       }
     }
 
     $edge['dst'] = $dst_phid;
 
     $edge_type = $xaction->getMetadataValue('edge:type');
     if (empty($edge['type'])) {
       $edge['type'] = $edge_type;
     } else {
       if ($edge['type'] != $edge_type) {
         $this_type = $edge['type'];
         throw new Exception(
           pht(
             "Edge transaction includes edge of type '%s', but ".
             "transaction is of type '%s'. Each edge transaction ".
             "must alter edges of only one type.",
             $this_type,
             $edge_type));
       }
     }
 
     if (!isset($edge['data'])) {
       $edge['data'] = array();
     }
 
     return $edge;
   }
 
   protected function sortTransactions(array $xactions) {
     $head = array();
     $tail = array();
 
     // Move bare comments to the end, so the actions precede them.
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
       if ($type == PhabricatorTransactions::TYPE_COMMENT) {
         $tail[] = $xaction;
       } else {
         $head[] = $xaction;
       }
     }
 
     return array_values(array_merge($head, $tail));
   }
 
 
   protected function filterTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $type_comment = PhabricatorTransactions::TYPE_COMMENT;
 
     $no_effect = array();
     $has_comment = false;
     $any_effect = false;
     foreach ($xactions as $key => $xaction) {
       if ($this->transactionHasEffect($object, $xaction)) {
         if ($xaction->getTransactionType() != $type_comment) {
           $any_effect = true;
         }
       } else if ($xaction->getIgnoreOnNoEffect()) {
         unset($xactions[$key]);
       } else {
         $no_effect[$key] = $xaction;
       }
       if ($xaction->hasComment()) {
         $has_comment = true;
       }
     }
 
     if (!$no_effect) {
       return $xactions;
     }
 
     if (!$this->getContinueOnNoEffect() && !$this->getIsPreview()) {
       throw new PhabricatorApplicationTransactionNoEffectException(
         $no_effect,
         $any_effect,
         $has_comment);
     }
 
     if (!$any_effect && !$has_comment) {
       // If we only have empty comment transactions, just drop them all.
       return array();
     }
 
     foreach ($no_effect as $key => $xaction) {
       if ($xaction->hasComment()) {
         $xaction->setTransactionType($type_comment);
         $xaction->setOldValue(null);
         $xaction->setNewValue(null);
       } else {
         unset($xactions[$key]);
       }
     }
 
     return $xactions;
   }
 
 
   /**
    * Hook for validating transactions. This callback will be invoked for each
    * available transaction type, even if an edit does not apply any transactions
    * of that type. This allows you to raise exceptions when required fields are
    * missing, by detecting that the object has no field value and there is no
    * transaction which sets one.
    *
    * @param PhabricatorLiskDAO Object being edited.
    * @param string Transaction type to validate.
    * @param list<PhabricatorApplicationTransaction> Transactions of given type,
    *   which may be empty if the edit does not apply any transactions of the
    *   given type.
    * @return list<PhabricatorApplicationTransactionValidationError> List of
    *   validation errors.
    */
   protected function validateTransaction(
     PhabricatorLiskDAO $object,
     $type,
     array $xactions) {
 
     $errors = array();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       $errors[] = $xtype->validateTransactions($object, $xactions);
     }
 
     switch ($type) {
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         $errors[] = $this->validatePolicyTransaction(
           $object,
           $xactions,
           $type,
           PhabricatorPolicyCapability::CAN_VIEW);
         break;
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         $errors[] = $this->validatePolicyTransaction(
           $object,
           $xactions,
           $type,
           PhabricatorPolicyCapability::CAN_EDIT);
         break;
       case PhabricatorTransactions::TYPE_SPACE:
         $errors[] = $this->validateSpaceTransactions(
           $object,
           $xactions,
           $type);
         break;
       case PhabricatorTransactions::TYPE_SUBTYPE:
         $errors[] = $this->validateSubtypeTransactions(
           $object,
           $xactions,
           $type);
         break;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $groups = array();
         foreach ($xactions as $xaction) {
           $groups[$xaction->getMetadataValue('customfield:key')][] = $xaction;
         }
 
         $field_list = PhabricatorCustomField::getObjectFields(
           $object,
           PhabricatorCustomField::ROLE_EDIT);
         $field_list->setViewer($this->getActor());
 
         $role_xactions = PhabricatorCustomField::ROLE_APPLICATIONTRANSACTIONS;
         foreach ($field_list->getFields() as $field) {
           if (!$field->shouldEnableForRole($role_xactions)) {
             continue;
           }
           $errors[] = $field->validateApplicationTransactions(
             $this,
             $type,
             idx($groups, $field->getFieldKey(), array()));
         }
         break;
     }
 
     return array_mergev($errors);
   }
 
   public function validatePolicyTransaction(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type,
     $capability) {
 
     $actor = $this->requireActor();
     $errors = array();
     // Note $this->xactions is necessary; $xactions is $this->xactions of
     // $transaction_type
     $policy_object = $this->adjustObjectForPolicyChecks(
       $object,
       $this->xactions);
 
     // Make sure the user isn't editing away their ability to $capability this
     // object.
     foreach ($xactions as $xaction) {
       try {
         PhabricatorPolicyFilter::requireCapabilityWithForcedPolicy(
           $actor,
           $policy_object,
           $capability,
           $xaction->getNewValue());
       } catch (PhabricatorPolicyException $ex) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'You can not select this %s policy, because you would no longer '.
             'be able to %s the object.',
             $capability,
             $capability),
           $xaction);
       }
     }
 
     if ($this->getIsNewObject()) {
       if (!$xactions) {
         $has_capability = PhabricatorPolicyFilter::hasCapability(
           $actor,
           $policy_object,
           $capability);
         if (!$has_capability) {
           $errors[] = new PhabricatorApplicationTransactionValidationError(
             $transaction_type,
             pht('Invalid'),
             pht(
               'The selected %s policy excludes you. Choose a %s policy '.
               'which allows you to %s the object.',
               $capability,
               $capability,
               $capability));
         }
       }
     }
 
     return $errors;
   }
 
 
   private function validateSpaceTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type) {
     $errors = array();
 
     $actor = $this->getActor();
 
     $has_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpacesExist($actor);
     $actor_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($actor);
     $active_spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces(
       $actor);
     foreach ($xactions as $xaction) {
       $space_phid = $xaction->getNewValue();
 
       if ($space_phid === null) {
         if (!$has_spaces) {
           // The install doesn't have any spaces, so this is fine.
           continue;
         }
 
         // The install has some spaces, so every object needs to be put
         // in a valid space.
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht('You must choose a space for this object.'),
           $xaction);
         continue;
       }
 
       // If the PHID isn't `null`, it needs to be a valid space that the
       // viewer can see.
       if (empty($actor_spaces[$space_phid])) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'You can not shift this object in the selected space, because '.
             'the space does not exist or you do not have access to it.'),
           $xaction);
       } else if (empty($active_spaces[$space_phid])) {
 
         // It's OK to edit objects in an archived space, so just move on if
         // we aren't adjusting the value.
         $old_space_phid = $this->getTransactionOldValue($object, $xaction);
         if ($space_phid == $old_space_phid) {
           continue;
         }
 
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Archived'),
           pht(
             'You can not shift this object into the selected space, because '.
             'the space is archived. Objects can not be created inside (or '.
             'moved into) archived spaces.'),
           $xaction);
       }
     }
 
     return $errors;
   }
 
   private function validateSubtypeTransactions(
     PhabricatorLiskDAO $object,
     array $xactions,
     $transaction_type) {
     $errors = array();
 
     $map = $object->newEditEngineSubtypeMap();
     $old = $object->getEditEngineSubtype();
     foreach ($xactions as $xaction) {
       $new = $xaction->getNewValue();
 
       if ($old == $new) {
         continue;
       }
 
       if (!isset($map[$new])) {
         $errors[] = new PhabricatorApplicationTransactionValidationError(
           $transaction_type,
           pht('Invalid'),
           pht(
             'The subtype "%s" is not a valid subtype.',
             $new),
           $xaction);
         continue;
       }
     }
 
     return $errors;
   }
 
   protected function adjustObjectForPolicyChecks(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $copy = clone $object;
 
     foreach ($xactions as $xaction) {
       switch ($xaction->getTransactionType()) {
         case PhabricatorTransactions::TYPE_SUBSCRIBERS:
           $clone_xaction = clone $xaction;
           $clone_xaction->setOldValue(array_values($this->subscribers));
           $clone_xaction->setNewValue(
             $this->getPHIDTransactionNewValue(
               $clone_xaction));
 
           PhabricatorPolicyRule::passTransactionHintToRule(
             $copy,
             new PhabricatorSubscriptionsSubscribersPolicyRule(),
             array_fuse($clone_xaction->getNewValue()));
 
           break;
         case PhabricatorTransactions::TYPE_SPACE:
           $space_phid = $this->getTransactionNewValue($object, $xaction);
           $copy->setSpacePHID($space_phid);
           break;
       }
     }
 
     return $copy;
   }
 
   protected function validateAllTransactions(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return array();
   }
 
   /**
    * Check for a missing text field.
    *
    * A text field is missing if the object has no value and there are no
    * transactions which set a value, or if the transactions remove the value.
    * This method is intended to make implementing @{method:validateTransaction}
    * more convenient:
    *
    *   $missing = $this->validateIsEmptyTextField(
    *     $object->getName(),
    *     $xactions);
    *
    * This will return `true` if the net effect of the object and transactions
    * is an empty field.
    *
    * @param wild Current field value.
    * @param list<PhabricatorApplicationTransaction> Transactions editing the
    *          field.
    * @return bool True if the field will be an empty text field after edits.
    */
   protected function validateIsEmptyTextField($field_value, array $xactions) {
     if (strlen($field_value) && empty($xactions)) {
       return false;
     }
 
     if ($xactions && strlen(last($xactions)->getNewValue())) {
       return false;
     }
 
     return true;
   }
 
 
 /* -(  Implicit CCs  )------------------------------------------------------- */
 
 
   /**
    * When a user interacts with an object, we might want to add them to CC.
    */
   final public function applyImplicitCC(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if (!($object instanceof PhabricatorSubscribableInterface)) {
       // If the object isn't subscribable, we can't CC them.
       return $xactions;
     }
 
     $actor_phid = $this->getActingAsPHID();
 
     $type_user = PhabricatorPeopleUserPHIDType::TYPECONST;
     if (phid_get_type($actor_phid) != $type_user) {
       // Transactions by application actors like Herald, Harbormaster and
       // Diffusion should not CC the applications.
       return $xactions;
     }
 
     if ($object->isAutomaticallySubscribed($actor_phid)) {
       // If they're auto-subscribed, don't CC them.
       return $xactions;
     }
 
     $should_cc = false;
     foreach ($xactions as $xaction) {
       if ($this->shouldImplyCC($object, $xaction)) {
         $should_cc = true;
         break;
       }
     }
 
     if (!$should_cc) {
       // Only some types of actions imply a CC (like adding a comment).
       return $xactions;
     }
 
     if ($object->getPHID()) {
       if (isset($this->subscribers[$actor_phid])) {
         // If the user is already subscribed, don't implicitly CC them.
         return $xactions;
       }
 
       $unsub = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorObjectHasUnsubscriberEdgeType::EDGECONST);
       $unsub = array_fuse($unsub);
       if (isset($unsub[$actor_phid])) {
         // If the user has previously unsubscribed from this object explicitly,
         // don't implicitly CC them.
         return $xactions;
       }
     }
 
     $xaction = newv(get_class(head($xactions)), array());
     $xaction->setTransactionType(PhabricatorTransactions::TYPE_SUBSCRIBERS);
     $xaction->setNewValue(array('+' => array($actor_phid)));
 
     array_unshift($xactions, $xaction);
 
     return $xactions;
   }
 
   protected function shouldImplyCC(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     return $xaction->isCommentTransaction();
   }
 
 
 /* -(  Sending Mail  )------------------------------------------------------- */
 
 
   /**
    * @task mail
    */
   protected function shouldSendMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
 
   /**
    * @task mail
    */
   private function buildMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $email_to = $this->mailToPHIDs;
     $email_cc = $this->mailCCPHIDs;
     $email_cc = array_merge($email_cc, $this->heraldEmailPHIDs);
 
     $unexpandable = $this->mailUnexpandablePHIDs;
     if (!is_array($unexpandable)) {
       $unexpandable = array();
     }
 
     $messages = $this->buildMailWithRecipients(
       $object,
       $xactions,
       $email_to,
       $email_cc,
       $unexpandable);
 
     $this->runHeraldMailRules($messages);
 
     return $messages;
   }
 
   private function buildMailWithRecipients(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $email_to,
     array $email_cc,
     array $unexpandable) {
 
     $targets = $this->buildReplyHandler($object)
       ->setUnexpandablePHIDs($unexpandable)
       ->getMailTargets($email_to, $email_cc);
 
     // Set this explicitly before we start swapping out the effective actor.
     $this->setActingAsPHID($this->getActingAsPHID());
 
     $messages = array();
     foreach ($targets as $target) {
       $original_actor = $this->getActor();
 
       $viewer = $target->getViewer();
       $this->setActor($viewer);
       $locale = PhabricatorEnv::beginScopedLocale($viewer->getTranslation());
 
       $caught = null;
       $mail = null;
       try {
         // Reload handles for the new viewer.
         $this->loadHandles($xactions);
 
         $mail = $this->buildMailForTarget($object, $xactions, $target);
 
         if ($mail) {
           if ($this->mustEncrypt) {
             $mail
               ->setMustEncrypt(true)
               ->setMustEncryptReasons($this->mustEncrypt);
           }
         }
       } catch (Exception $ex) {
         $caught = $ex;
       }
 
       $this->setActor($original_actor);
       unset($locale);
 
       if ($caught) {
         throw $ex;
       }
 
       if ($mail) {
         $messages[] = $mail;
       }
     }
 
     return $messages;
   }
 
   protected function getTransactionsForMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $xactions;
   }
 
   private function buildMailForTarget(
     PhabricatorLiskDAO $object,
     array $xactions,
     PhabricatorMailTarget $target) {
 
     // Check if any of the transactions are visible for this viewer. If we
     // don't have any visible transactions, don't send the mail.
 
     $any_visible = false;
     foreach ($xactions as $xaction) {
       if (!$xaction->shouldHideForMail($xactions)) {
         $any_visible = true;
         break;
       }
     }
 
     if (!$any_visible) {
       return null;
     }
 
     $mail_xactions = $this->getTransactionsForMail($object, $xactions);
 
     $mail = $this->buildMailTemplate($object);
     $body = $this->buildMailBody($object, $mail_xactions);
 
     $mail_tags = $this->getMailTags($object, $mail_xactions);
     $action = $this->getMailAction($object, $mail_xactions);
     $stamps = $this->generateMailStamps($object, $this->mailStamps);
 
     if (PhabricatorEnv::getEnvConfig('metamta.email-preferences')) {
       $this->addEmailPreferenceSectionToMailBody(
         $body,
         $object,
         $mail_xactions);
     }
 
     $muted_phids = $this->mailMutedPHIDs;
     if (!is_array($muted_phids)) {
       $muted_phids = array();
     }
 
     $mail
       ->setSensitiveContent(false)
       ->setFrom($this->getActingAsPHID())
       ->setSubjectPrefix($this->getMailSubjectPrefix())
       ->setVarySubjectPrefix('['.$action.']')
       ->setThreadID($this->getMailThreadID($object), $this->getIsNewObject())
       ->setRelatedPHID($object->getPHID())
       ->setExcludeMailRecipientPHIDs($this->getExcludeMailRecipientPHIDs())
       ->setMutedPHIDs($muted_phids)
       ->setForceHeraldMailRecipientPHIDs($this->heraldForcedEmailPHIDs)
       ->setMailTags($mail_tags)
       ->setIsBulk(true)
       ->setBody($body->render())
       ->setHTMLBody($body->renderHTML());
 
     foreach ($body->getAttachments() as $attachment) {
       $mail->addAttachment($attachment);
     }
 
     if ($this->heraldHeader) {
       $mail->addHeader('X-Herald-Rules', $this->heraldHeader);
     }
 
     if ($object instanceof PhabricatorProjectInterface) {
       $this->addMailProjectMetadata($object, $mail);
     }
 
     if ($this->getParentMessageID()) {
       $mail->setParentMessageID($this->getParentMessageID());
     }
 
     // If we have stamps, attach the raw dictionary version (not the actual
     // objects) to the mail so that debugging tools can see what we used to
     // render the final list.
     if ($this->mailStamps) {
       $mail->setMailStampMetadata($this->mailStamps);
     }
 
     // If we have rendered stamps, attach them to the mail.
     if ($stamps) {
       $mail->setMailStamps($stamps);
     }
 
     return $target->willSendMail($mail);
   }
 
   private function addMailProjectMetadata(
     PhabricatorLiskDAO $object,
     PhabricatorMetaMTAMail $template) {
 
     $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $object->getPHID(),
       PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
 
     if (!$project_phids) {
       return;
     }
 
     // TODO: This viewer isn't quite right. It would be slightly better to use
     // the mail recipient, but that's not very easy given the way rendering
     // works today.
 
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($this->requireActor())
       ->withPHIDs($project_phids)
       ->execute();
 
     $project_tags = array();
     foreach ($handles as $handle) {
       if (!$handle->isComplete()) {
         continue;
       }
       $project_tags[] = '<'.$handle->getObjectName().'>';
     }
 
     if (!$project_tags) {
       return;
     }
 
     $project_tags = implode(', ', $project_tags);
     $template->addHeader('X-Phabricator-Projects', $project_tags);
   }
 
 
   protected function getMailThreadID(PhabricatorLiskDAO $object) {
     return $object->getPHID();
   }
 
 
   /**
    * @task mail
    */
   protected function getStrongestAction(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return last(msort($xactions, 'getActionStrength'));
   }
 
 
   /**
    * @task mail
    */
   protected function buildReplyHandler(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
   /**
    * @task mail
    */
   protected function getMailSubjectPrefix() {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   /**
    * @task mail
    */
   protected function getMailTags(
     PhabricatorLiskDAO $object,
     array $xactions) {
     $tags = array();
 
     foreach ($xactions as $xaction) {
       $tags[] = $xaction->getMailTags();
     }
 
     return array_mergev($tags);
   }
 
   /**
    * @task mail
    */
   public function getMailTagsMap() {
     // TODO: We should move shared mail tags, like "comment", here.
     return array();
   }
 
 
   /**
    * @task mail
    */
   protected function getMailAction(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return $this->getStrongestAction($object, $xactions)->getActionName();
   }
 
 
   /**
    * @task mail
    */
   protected function buildMailTemplate(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   /**
    * @task mail
    */
   protected function getMailTo(PhabricatorLiskDAO $object) {
     throw new Exception(pht('Capability not supported.'));
   }
 
 
   protected function newMailUnexpandablePHIDs(PhabricatorLiskDAO $object) {
     return array();
   }
 
 
   /**
    * @task mail
    */
   protected function getMailCC(PhabricatorLiskDAO $object) {
     $phids = array();
     $has_support = false;
 
     if ($object instanceof PhabricatorSubscribableInterface) {
       $phid = $object->getPHID();
       $phids[] = PhabricatorSubscribersQuery::loadSubscribersForPHID($phid);
       $has_support = true;
     }
 
     if ($object instanceof PhabricatorProjectInterface) {
       $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
 
       if ($project_phids) {
         $projects = id(new PhabricatorProjectQuery())
           ->setViewer(PhabricatorUser::getOmnipotentUser())
           ->withPHIDs($project_phids)
           ->needWatchers(true)
           ->execute();
 
         $watcher_phids = array();
         foreach ($projects as $project) {
           foreach ($project->getAllAncestorWatcherPHIDs() as $phid) {
             $watcher_phids[$phid] = $phid;
           }
         }
 
         if ($watcher_phids) {
           // We need to do a visibility check for all the watchers, as
           // watching a project is not a guarantee that you can see objects
           // associated with it.
           $users = id(new PhabricatorPeopleQuery())
             ->setViewer($this->requireActor())
             ->withPHIDs($watcher_phids)
             ->execute();
 
           $watchers = array();
           foreach ($users as $user) {
             $can_see = PhabricatorPolicyFilter::hasCapability(
               $user,
               $object,
               PhabricatorPolicyCapability::CAN_VIEW);
             if ($can_see) {
               $watchers[] = $user->getPHID();
             }
           }
           $phids[] = $watchers;
         }
       }
 
       $has_support = true;
     }
 
     if (!$has_support) {
       throw new Exception(
         pht('The object being edited does not implement any standard '.
           'interfaces (like PhabricatorSubscribableInterface) which allow '.
           'CCs to be generated automatically. Override the "getMailCC()" '.
           'method and generate CCs explicitly.'));
     }
 
     return array_mergev($phids);
   }
 
 
   /**
    * @task mail
    */
   protected function buildMailBody(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $body = id(new PhabricatorMetaMTAMailBody())
       ->setViewer($this->requireActor())
       ->setContextObject($object);
 
     $this->addHeadersAndCommentsToMailBody($body, $xactions);
     $this->addCustomFieldsToMailBody($body, $object, $xactions);
 
     return $body;
   }
 
 
   /**
    * @task mail
    */
   protected function addEmailPreferenceSectionToMailBody(
     PhabricatorMetaMTAMailBody $body,
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $href = PhabricatorEnv::getProductionURI(
       '/settings/panel/emailpreferences/');
     $body->addLinkSection(pht('EMAIL PREFERENCES'), $href);
   }
 
 
   /**
    * @task mail
    */
   protected function addHeadersAndCommentsToMailBody(
     PhabricatorMetaMTAMailBody $body,
     array $xactions,
     $object_label = null,
     $object_href = null) {
 
     // First, remove transactions which shouldn't be rendered in mail.
     foreach ($xactions as $key => $xaction) {
       if ($xaction->shouldHideForMail($xactions)) {
         unset($xactions[$key]);
       }
     }
 
     $headers = array();
     $headers_html = array();
     $comments = array();
     $details = array();
 
     $seen_comment = false;
     foreach ($xactions as $xaction) {
 
       // Most mail has zero or one comments. In these cases, we render the
       // "alice added a comment." transaction in the header, like a normal
       // transaction.
 
       // Some mail, like Differential undraft mail or "!history" mail, may
       // have two or more comments. In these cases, we'll put the first
       // "alice added a comment." transaction in the header normally, but
       // move the other transactions down so they provide context above the
       // actual comment.
 
       $comment = $xaction->getBodyForMail();
       if ($comment !== null) {
         $is_comment = true;
         $comments[] = array(
           'xaction' => $xaction,
           'comment' => $comment,
           'initial' => !$seen_comment,
         );
       } else {
         $is_comment = false;
       }
 
       if (!$is_comment || !$seen_comment) {
         $header = $xaction->getTitleForMail();
         if ($header !== null) {
           $headers[] = $header;
         }
 
         $header_html = $xaction->getTitleForHTMLMail();
         if ($header_html !== null) {
           $headers_html[] = $header_html;
         }
       }
 
       if ($xaction->hasChangeDetailsForMail()) {
         $details[] = $xaction;
       }
 
       if ($is_comment) {
         $seen_comment = true;
       }
     }
 
     $headers_text = implode("\n", $headers);
     $body->addRawPlaintextSection($headers_text);
 
     $headers_html = phutil_implode_html(phutil_tag('br'), $headers_html);
 
     $header_button = null;
     if ($object_label !== null) {
       $button_style = array(
         'text-decoration: none;',
         'padding: 4px 8px;',
         'margin: 0 8px 8px;',
         'float: right;',
         'color: #464C5C;',
         'font-weight: bold;',
         'border-radius: 3px;',
         'background-color: #F7F7F9;',
         'background-image: linear-gradient(to bottom,#fff,#f1f0f1);',
         'display: inline-block;',
         'border: 1px solid rgba(71,87,120,.2);',
       );
 
       $header_button = phutil_tag(
         'a',
         array(
           'style' => implode(' ', $button_style),
           'href' => $object_href,
         ),
         $object_label);
     }
 
     $xactions_style = array();
 
     $header_action = phutil_tag(
       'td',
       array(),
       $header_button);
 
     $header_action = phutil_tag(
       'td',
       array(
         'style' => implode(' ', $xactions_style),
       ),
       array(
         $headers_html,
         // Add an extra newline to prevent the "View Object" button from
         // running into the transaction text in Mail.app text snippet
         // previews.
         "\n",
       ));
 
     $headers_html = phutil_tag(
       'table',
       array(),
       phutil_tag('tr', array(), array($header_action, $header_button)));
 
     $body->addRawHTMLSection($headers_html);
 
     foreach ($comments as $spec) {
       $xaction = $spec['xaction'];
       $comment = $spec['comment'];
       $is_initial = $spec['initial'];
 
       // If this is not the first comment in the mail, add the header showing
       // who wrote the comment immediately above the comment.
       if (!$is_initial) {
         $header = $xaction->getTitleForMail();
         if ($header !== null) {
           $body->addRawPlaintextSection($header);
         }
 
         $header_html = $xaction->getTitleForHTMLMail();
         if ($header_html !== null) {
           $body->addRawHTMLSection($header_html);
         }
       }
 
       $body->addRemarkupSection(null, $comment);
     }
 
     foreach ($details as $xaction) {
       $details = $xaction->renderChangeDetailsForMail($body->getViewer());
       if ($details !== null) {
         $label = $this->getMailDiffSectionHeader($xaction);
         $body->addHTMLSection($label, $details);
       }
     }
 
   }
 
   private function getMailDiffSectionHeader($xaction) {
     $type = $xaction->getTransactionType();
 
     $xtype = $this->getModularTransactionType($type);
     if ($xtype) {
       return $xtype->getMailDiffSectionHeader();
     }
 
     return pht('EDIT DETAILS');
   }
 
   /**
    * @task mail
    */
   protected function addCustomFieldsToMailBody(
     PhabricatorMetaMTAMailBody $body,
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     if ($object instanceof PhabricatorCustomFieldInterface) {
       $field_list = PhabricatorCustomField::getObjectFields(
         $object,
         PhabricatorCustomField::ROLE_TRANSACTIONMAIL);
       $field_list->setViewer($this->getActor());
       $field_list->readFieldsFromStorage($object);
 
       foreach ($field_list->getFields() as $field) {
         $field->updateTransactionMailBody(
           $body,
           $this,
           $xactions);
       }
     }
   }
 
 
   /**
    * @task mail
    */
   private function runHeraldMailRules(array $messages) {
     foreach ($messages as $message) {
       $engine = new HeraldEngine();
       $adapter = id(new PhabricatorMailOutboundMailHeraldAdapter())
         ->setObject($message);
 
       $rules = $engine->loadRulesForAdapter($adapter);
       $effects = $engine->applyRules($rules, $adapter);
       $engine->applyEffects($effects, $adapter, $rules);
     }
   }
 
 
 /* -(  Publishing Feed Stories  )-------------------------------------------- */
 
 
   /**
    * @task feed
    */
   protected function shouldPublishFeedStory(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedStoryType() {
     return 'PhabricatorApplicationTransactionFeedStory';
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedRelatedPHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $phids = array(
       $object->getPHID(),
       $this->getActingAsPHID(),
     );
 
     if ($object instanceof PhabricatorProjectInterface) {
       $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
         $object->getPHID(),
         PhabricatorProjectObjectHasProjectEdgeType::EDGECONST);
       foreach ($project_phids as $project_phid) {
         $phids[] = $project_phid;
       }
     }
 
     return $phids;
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedNotifyPHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     return array_unique(array_merge(
       $this->getMailTo($object),
       $this->getMailCC($object)));
   }
 
 
   /**
    * @task feed
    */
   protected function getFeedStoryData(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $xactions = msort($xactions, 'getActionStrength');
     $xactions = array_reverse($xactions);
 
     return array(
       'objectPHID'        => $object->getPHID(),
       'transactionPHIDs'  => mpull($xactions, 'getPHID'),
     );
   }
 
 
   /**
    * @task feed
    */
   protected function publishFeedStory(
     PhabricatorLiskDAO $object,
     array $xactions,
     array $mailed_phids) {
 
     $xactions = mfilter($xactions, 'shouldHideForFeed', true);
 
     if (!$xactions) {
       return;
     }
 
     $related_phids = $this->feedRelatedPHIDs;
     $subscribed_phids = $this->feedNotifyPHIDs;
 
     // Remove muted users from the subscription list so they don't get
     // notifications, either.
     $muted_phids = $this->mailMutedPHIDs;
     if (!is_array($muted_phids)) {
       $muted_phids = array();
     }
     $subscribed_phids = array_fuse($subscribed_phids);
     foreach ($muted_phids as $muted_phid) {
       unset($subscribed_phids[$muted_phid]);
     }
     $subscribed_phids = array_values($subscribed_phids);
 
     $story_type = $this->getFeedStoryType();
     $story_data = $this->getFeedStoryData($object, $xactions);
 
     $unexpandable_phids = $this->mailUnexpandablePHIDs;
     if (!is_array($unexpandable_phids)) {
       $unexpandable_phids = array();
     }
 
     id(new PhabricatorFeedStoryPublisher())
       ->setStoryType($story_type)
       ->setStoryData($story_data)
       ->setStoryTime(time())
       ->setStoryAuthorPHID($this->getActingAsPHID())
       ->setRelatedPHIDs($related_phids)
       ->setPrimaryObjectPHID($object->getPHID())
       ->setSubscribedPHIDs($subscribed_phids)
       ->setUnexpandablePHIDs($unexpandable_phids)
       ->setMailRecipientPHIDs($mailed_phids)
       ->setMailTags($this->getMailTags($object, $xactions))
       ->publish();
   }
 
 
 /* -(  Search Index  )------------------------------------------------------- */
 
 
   /**
    * @task search
    */
   protected function supportsSearch() {
     return false;
   }
 
 
 /* -(  Herald Integration )-------------------------------------------------- */
 
 
   protected function shouldApplyHeraldRules(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return false;
   }
 
   protected function buildHeraldAdapter(
     PhabricatorLiskDAO $object,
     array $xactions) {
     throw new Exception(pht('No herald adapter specified.'));
   }
 
   private function setHeraldAdapter(HeraldAdapter $adapter) {
     $this->heraldAdapter = $adapter;
     return $this;
   }
 
   protected function getHeraldAdapter() {
     return $this->heraldAdapter;
   }
 
   private function setHeraldTranscript(HeraldTranscript $transcript) {
     $this->heraldTranscript = $transcript;
     return $this;
   }
 
   protected function getHeraldTranscript() {
     return $this->heraldTranscript;
   }
 
   private function applyHeraldRules(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $adapter = $this->buildHeraldAdapter($object, $xactions)
       ->setContentSource($this->getContentSource())
       ->setIsNewObject($this->getIsNewObject())
       ->setActingAsPHID($this->getActingAsPHID())
       ->setAppliedTransactions($xactions);
 
     if ($this->getApplicationEmail()) {
       $adapter->setApplicationEmail($this->getApplicationEmail());
     }
 
     // If this editor is operating in silent mode, tell Herald that we aren't
     // going to send any mail. This allows it to skip "the first time this
     // rule matches, send me an email" rules which would otherwise match even
     // though we aren't going to send any mail.
     if ($this->getIsSilent()) {
       $adapter->setForbiddenAction(
         HeraldMailableState::STATECONST,
         HeraldCoreStateReasons::REASON_SILENT);
     }
 
     $xscript = HeraldEngine::loadAndApplyRules($adapter);
 
     $this->setHeraldAdapter($adapter);
     $this->setHeraldTranscript($xscript);
 
     if ($adapter instanceof HarbormasterBuildableAdapterInterface) {
       $buildable_phid = $adapter->getHarbormasterBuildablePHID();
 
       HarbormasterBuildable::applyBuildPlans(
         $buildable_phid,
         $adapter->getHarbormasterContainerPHID(),
         $adapter->getQueuedHarbormasterBuildRequests());
 
       // Whether we queued any builds or not, any automatic buildable for this
       // object is now done preparing builds and can transition into a
       // completed status.
       $buildables = id(new HarbormasterBuildableQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withManualBuildables(false)
         ->withBuildablePHIDs(array($buildable_phid))
         ->execute();
       foreach ($buildables as $buildable) {
         // If this buildable has already moved beyond preparation, we don't
         // need to nudge it again.
         if (!$buildable->isPreparing()) {
           continue;
         }
         $buildable->sendMessage(
           $this->getActor(),
           HarbormasterMessageType::BUILDABLE_BUILD,
           true);
       }
     }
 
     $this->mustEncrypt = $adapter->getMustEncryptReasons();
 
     return array_merge(
       $this->didApplyHeraldRules($object, $adapter, $xscript),
       $adapter->getQueuedTransactions());
   }
 
   protected function didApplyHeraldRules(
     PhabricatorLiskDAO $object,
     HeraldAdapter $adapter,
     HeraldTranscript $transcript) {
     return array();
   }
 
 
 /* -(  Custom Fields  )------------------------------------------------------ */
 
 
   /**
    * @task customfield
    */
   private function getCustomFieldForTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $field_key = $xaction->getMetadataValue('customfield:key');
     if (!$field_key) {
       throw new Exception(
         pht(
         "Custom field transaction has no '%s'!",
         'customfield:key'));
     }
 
     $field = PhabricatorCustomField::getObjectField(
       $object,
       PhabricatorCustomField::ROLE_APPLICATIONTRANSACTIONS,
       $field_key);
 
     if (!$field) {
       throw new Exception(
         pht(
           "Custom field transaction has invalid '%s'; field '%s' ".
           "is disabled or does not exist.",
           'customfield:key',
           $field_key));
     }
 
     if (!$field->shouldAppearInApplicationTransactions()) {
       throw new Exception(
         pht(
           "Custom field transaction '%s' does not implement ".
           "integration for %s.",
           $field_key,
           'ApplicationTransactions'));
     }
 
     $field->setViewer($this->getActor());
 
     return $field;
   }
 
 
 /* -(  Files  )-------------------------------------------------------------- */
 
 
   /**
    * Extract the PHIDs of any files which these transactions attach.
    *
    * @task files
    */
   private function extractFilePHIDs(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $changes = $this->getRemarkupChanges($xactions);
     $blocks = mpull($changes, 'getNewValue');
 
     $phids = array();
     if ($blocks) {
       $phids[] = PhabricatorMarkupEngine::extractFilePHIDsFromEmbeddedFiles(
         $this->getActor(),
         $blocks);
     }
 
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
 
       $xtype = $this->getModularTransactionType($type);
       if ($xtype) {
         $phids[] = $xtype->extractFilePHIDs($object, $xaction->getNewValue());
       } else {
         $phids[] = $this->extractFilePHIDsFromCustomTransaction(
           $object,
           $xaction);
       }
     }
 
     $phids = array_unique(array_filter(array_mergev($phids)));
     if (!$phids) {
       return array();
     }
 
     // Only let a user attach files they can actually see, since this would
     // otherwise let you access any file by attaching it to an object you have
     // view permission on.
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($phids)
       ->execute();
 
     return mpull($files, 'getPHID');
   }
 
   /**
    * @task files
    */
   protected function extractFilePHIDsFromCustomTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
     return array();
   }
 
 
   /**
    * @task files
    */
   private function attachFiles(
     PhabricatorLiskDAO $object,
     array $file_phids) {
 
     if (!$file_phids) {
       return;
     }
 
     $editor = new PhabricatorEdgeEditor();
 
     $src = $object->getPHID();
     $type = PhabricatorObjectHasFileEdgeType::EDGECONST;
     foreach ($file_phids as $dst) {
       $editor->addEdge($src, $type, $dst);
     }
 
     $editor->save();
   }
 
   private function applyInverseEdgeTransactions(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction,
     $inverse_type) {
 
     $old = $xaction->getOldValue();
     $new = $xaction->getNewValue();
 
     $add = array_keys(array_diff_key($new, $old));
     $rem = array_keys(array_diff_key($old, $new));
 
     $add = array_fuse($add);
     $rem = array_fuse($rem);
     $all = $add + $rem;
 
     $nodes = id(new PhabricatorObjectQuery())
       ->setViewer($this->requireActor())
       ->withPHIDs($all)
       ->execute();
 
     foreach ($nodes as $node) {
       if (!($node instanceof PhabricatorApplicationTransactionInterface)) {
         continue;
       }
 
       if ($node instanceof PhabricatorUser) {
         // TODO: At least for now, don't record inverse edge transactions
         // for users (for example, "alincoln joined project X"): Feed fills
         // this role instead.
         continue;
       }
 
       $editor = $node->getApplicationTransactionEditor();
       $template = $node->getApplicationTransactionTemplate();
       $target = $node->getApplicationTransactionObject();
 
       if (isset($add[$node->getPHID()])) {
         $edge_edit_type = '+';
       } else {
         $edge_edit_type = '-';
       }
 
       $template
         ->setTransactionType($xaction->getTransactionType())
         ->setMetadataValue('edge:type', $inverse_type)
         ->setNewValue(
           array(
             $edge_edit_type => array($object->getPHID() => $object->getPHID()),
           ));
 
       $editor
         ->setContinueOnNoEffect(true)
         ->setContinueOnMissingFields(true)
         ->setParentMessageID($this->getParentMessageID())
         ->setIsInverseEdgeEditor(true)
         ->setIsSilent($this->getIsSilent())
         ->setActor($this->requireActor())
         ->setActingAsPHID($this->getActingAsPHID())
         ->setContentSource($this->getContentSource());
 
       $editor->applyTransactions($target, array($template));
     }
   }
 
 
 /* -(  Workers  )------------------------------------------------------------ */
 
 
   /**
    * Load any object state which is required to publish transactions.
    *
    * This hook is invoked in the main process before we compute data related
    * to publishing transactions (like email "To" and "CC" lists), and again in
    * the worker before publishing occurs.
    *
    * @return object Publishable object.
    * @task workers
    */
   protected function willPublish(PhabricatorLiskDAO $object, array $xactions) {
     return $object;
   }
 
 
   /**
    * Convert the editor state to a serializable dictionary which can be passed
    * to a worker.
    *
    * This data will be loaded with @{method:loadWorkerState} in the worker.
    *
    * @return dict<string, wild> Serializable editor state.
    * @task workers
    */
   final private function getWorkerState() {
     $state = array();
     foreach ($this->getAutomaticStateProperties() as $property) {
       $state[$property] = $this->$property;
     }
 
     $custom_state = $this->getCustomWorkerState();
     $custom_encoding = $this->getCustomWorkerStateEncoding();
 
     $state += array(
       'excludeMailRecipientPHIDs' => $this->getExcludeMailRecipientPHIDs(),
       'custom' => $this->encodeStateForStorage($custom_state, $custom_encoding),
       'custom.encoding' => $custom_encoding,
     );
 
     return $state;
   }
 
 
   /**
    * Hook; return custom properties which need to be passed to workers.
    *
    * @return dict<string, wild> Custom properties.
    * @task workers
    */
   protected function getCustomWorkerState() {
     return array();
   }
 
 
   /**
    * Hook; return storage encoding for custom properties which need to be
    * passed to workers.
    *
    * This primarily allows binary data to be passed to workers and survive
    * JSON encoding.
    *
    * @return dict<string, string> Property encodings.
    * @task workers
    */
   protected function getCustomWorkerStateEncoding() {
     return array();
   }
 
 
   /**
    * Load editor state using a dictionary emitted by @{method:getWorkerState}.
    *
    * This method is used to load state when running worker operations.
    *
    * @param dict<string, wild> Editor state, from @{method:getWorkerState}.
    * @return this
    * @task workers
    */
   final public function loadWorkerState(array $state) {
     foreach ($this->getAutomaticStateProperties() as $property) {
       $this->$property = idx($state, $property);
     }
 
     $exclude = idx($state, 'excludeMailRecipientPHIDs', array());
     $this->setExcludeMailRecipientPHIDs($exclude);
 
     $custom_state = idx($state, 'custom', array());
     $custom_encodings = idx($state, 'custom.encoding', array());
     $custom = $this->decodeStateFromStorage($custom_state, $custom_encodings);
 
     $this->loadCustomWorkerState($custom);
 
     return $this;
   }
 
 
   /**
    * Hook; set custom properties on the editor from data emitted by
    * @{method:getCustomWorkerState}.
    *
    * @param dict<string, wild> Custom state,
    *   from @{method:getCustomWorkerState}.
    * @return this
    * @task workers
    */
   protected function loadCustomWorkerState(array $state) {
     return $this;
   }
 
 
   /**
    * Get a list of object properties which should be automatically sent to
    * workers in the state data.
    *
    * These properties will be automatically stored and loaded by the editor in
    * the worker.
    *
    * @return list<string> List of properties.
    * @task workers
    */
   private function getAutomaticStateProperties() {
     return array(
       'parentMessageID',
       'isNewObject',
       'heraldEmailPHIDs',
       'heraldForcedEmailPHIDs',
       'heraldHeader',
       'mailToPHIDs',
       'mailCCPHIDs',
       'feedNotifyPHIDs',
       'feedRelatedPHIDs',
       'feedShouldPublish',
       'mailShouldSend',
       'mustEncrypt',
       'mailStamps',
       'mailUnexpandablePHIDs',
       'mailMutedPHIDs',
       'webhookMap',
       'silent',
       'sendHistory',
     );
   }
 
   /**
    * Apply encodings prior to storage.
    *
    * See @{method:getCustomWorkerStateEncoding}.
    *
    * @param map<string, wild> Map of values to encode.
    * @param map<string, string> Map of encodings to apply.
    * @return map<string, wild> Map of encoded values.
    * @task workers
    */
   final private function encodeStateForStorage(
     array $state,
     array $encodings) {
 
     foreach ($state as $key => $value) {
       $encoding = idx($encodings, $key);
       switch ($encoding) {
         case self::STORAGE_ENCODING_BINARY:
           // The mechanics of this encoding (serialize + base64) are a little
           // awkward, but it allows us encode arrays and still be JSON-safe
           // with binary data.
 
           $value = @serialize($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to serialize() value for key "%s".',
                 $key));
           }
 
           $value = base64_encode($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to base64 encode value for key "%s".',
                 $key));
           }
           break;
       }
       $state[$key] = $value;
     }
 
     return $state;
   }
 
 
   /**
    * Undo storage encoding applied when storing state.
    *
    * See @{method:getCustomWorkerStateEncoding}.
    *
    * @param map<string, wild> Map of encoded values.
    * @param map<string, string> Map of encodings.
    * @return map<string, wild> Map of decoded values.
    * @task workers
    */
   final private function decodeStateFromStorage(
     array $state,
     array $encodings) {
 
     foreach ($state as $key => $value) {
       $encoding = idx($encodings, $key);
       switch ($encoding) {
         case self::STORAGE_ENCODING_BINARY:
           $value = base64_decode($value);
           if ($value === false) {
             throw new Exception(
               pht(
                 'Failed to base64_decode() value for key "%s".',
                 $key));
           }
 
           $value = unserialize($value);
           break;
       }
       $state[$key] = $value;
     }
 
     return $state;
   }
 
 
   /**
    * Remove conflicts from a list of projects.
    *
    * Objects aren't allowed to be tagged with multiple milestones in the same
    * group, nor projects such that one tag is the ancestor of any other tag.
    * If the list of PHIDs include mutually exclusive projects, remove the
    * conflicting projects.
    *
    * @param list<phid> List of project PHIDs.
    * @return list<phid> List with conflicts removed.
    */
   private function applyProjectConflictRules(array $phids) {
     if (!$phids) {
       return array();
     }
 
     // Overall, the last project in the list wins in cases of conflict (so when
     // you add something, the thing you just added sticks and removes older
     // values).
 
     // Beyond that, there are two basic cases:
 
     // Milestones: An object can't be in "A > Sprint 3" and "A > Sprint 4".
     // If multiple projects are milestones of the same parent, we only keep the
     // last one.
 
     // Ancestor: You can't be in "A" and "A > B". If "A > B" comes later
     // in the list, we remove "A" and keep "A > B". If "A" comes later, we
     // remove "A > B" and keep "A".
 
     // Note that it's OK to be in "A > B" and "A > C". There's only a conflict
     // if one project is an ancestor of another. It's OK to have something
     // tagged with multiple projects which share a common ancestor, so long as
     // they are not mutual ancestors.
 
     $viewer = PhabricatorUser::getOmnipotentUser();
 
     $projects = id(new PhabricatorProjectQuery())
       ->setViewer($viewer)
       ->withPHIDs(array_keys($phids))
       ->execute();
     $projects = mpull($projects, null, 'getPHID');
 
     // We're going to build a map from each project with milestones to the last
     // milestone in the list. This last milestone is the milestone we'll keep.
     $milestone_map = array();
 
     // We're going to build a set of the projects which have no descendants
     // later in the list. This allows us to apply both ancestor rules.
     $ancestor_map = array();
 
     foreach ($phids as $phid => $ignored) {
       $project = idx($projects, $phid);
       if (!$project) {
         continue;
       }
 
       // This is the last milestone we've seen, so set it as the selection for
       // the project's parent. This might be setting a new value or overwriting
       // an earlier value.
       if ($project->isMilestone()) {
         $parent_phid = $project->getParentProjectPHID();
         $milestone_map[$parent_phid] = $phid;
       }
 
       // Since this is the last item in the list we've examined so far, add it
       // to the set of projects with no later descendants.
       $ancestor_map[$phid] = $phid;
 
       // Remove any ancestors from the set, since this is a later descendant.
       foreach ($project->getAncestorProjects() as $ancestor) {
         $ancestor_phid = $ancestor->getPHID();
         unset($ancestor_map[$ancestor_phid]);
       }
     }
 
     // Now that we've built the maps, we can throw away all the projects which
     // have conflicts.
     foreach ($phids as $phid => $ignored) {
       $project = idx($projects, $phid);
 
       if (!$project) {
         // If a PHID is invalid, we just leave it as-is. We could clean it up,
         // but leaving it untouched is less likely to cause collateral damage.
         continue;
       }
 
       // If this was a milestone, check if it was the last milestone from its
       // group in the list. If not, remove it from the list.
       if ($project->isMilestone()) {
         $parent_phid = $project->getParentProjectPHID();
         if ($milestone_map[$parent_phid] !== $phid) {
           unset($phids[$phid]);
           continue;
         }
       }
 
       // If a later project in the list is a subproject of this one, it will
       // have removed ancestors from the map. If this project does not point
       // at itself in the ancestor map, it should be discarded in favor of a
       // subproject that comes later.
       if (idx($ancestor_map, $phid) !== $phid) {
         unset($phids[$phid]);
         continue;
       }
 
       // If a later project in the list is an ancestor of this one, it will
       // have added itself to the map. If any ancestor of this project points
       // at itself in the map, this project should be discarded in favor of
       // that later ancestor.
       foreach ($project->getAncestorProjects() as $ancestor) {
         $ancestor_phid = $ancestor->getPHID();
         if (isset($ancestor_map[$ancestor_phid])) {
           unset($phids[$phid]);
           continue 2;
         }
       }
     }
 
     return $phids;
   }
 
   /**
    * When the view policy for an object is changed, scramble the secret keys
    * for attached files to invalidate existing URIs.
    */
   private function scrambleFileSecrets($object) {
     // If this is a newly created object, we don't need to scramble anything
     // since it couldn't have been previously published.
     if ($this->getIsNewObject()) {
       return;
     }
 
     // If the object is a file itself, scramble it.
     if ($object instanceof PhabricatorFile) {
       if ($this->shouldScramblePolicy($object->getViewPolicy())) {
         $object->scrambleSecret();
         $object->save();
       }
     }
 
     $phid = $object->getPHID();
 
     $attached_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $phid,
       PhabricatorObjectHasFileEdgeType::EDGECONST);
     if (!$attached_phids) {
       return;
     }
 
     $omnipotent_viewer = PhabricatorUser::getOmnipotentUser();
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer($omnipotent_viewer)
       ->withPHIDs($attached_phids)
       ->execute();
     foreach ($files as $file) {
       $view_policy = $file->getViewPolicy();
       if ($this->shouldScramblePolicy($view_policy)) {
         $file->scrambleSecret();
         $file->save();
       }
     }
   }
 
 
   /**
    * Check if a policy is strong enough to justify scrambling. Objects which
    * are set to very open policies don't need to scramble their files, and
    * files with very open policies don't need to be scrambled when associated
    * objects change.
    */
   private function shouldScramblePolicy($policy) {
     switch ($policy) {
       case PhabricatorPolicies::POLICY_PUBLIC:
       case PhabricatorPolicies::POLICY_USER:
         return false;
     }
 
     return true;
   }
 
   private function updateWorkboardColumns($object, $const, $old, $new) {
     // If an object is removed from a project, remove it from any proxy
     // columns for that project. This allows a task which is moved up from a
     // milestone to the parent to move back into the "Backlog" column on the
     // parent workboard.
 
     if ($const != PhabricatorProjectObjectHasProjectEdgeType::EDGECONST) {
       return;
     }
 
     // TODO: This should likely be some future WorkboardInterface.
     $appears_on_workboards = ($object instanceof ManiphestTask);
     if (!$appears_on_workboards) {
       return;
     }
 
     $removed_phids = array_keys(array_diff_key($old, $new));
     if (!$removed_phids) {
       return;
     }
 
     // Find any proxy columns for the removed projects.
     $proxy_columns = id(new PhabricatorProjectColumnQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withProxyPHIDs($removed_phids)
       ->execute();
     if (!$proxy_columns) {
       return array();
     }
 
     $proxy_phids = mpull($proxy_columns, 'getPHID');
 
     $position_table = new PhabricatorProjectColumnPosition();
     $conn_w = $position_table->establishConnection('w');
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE objectPHID = %s AND columnPHID IN (%Ls)',
       $position_table->getTableName(),
       $object->getPHID(),
       $proxy_phids);
   }
 
   private function getModularTransactionTypes() {
     if ($this->modularTypes === null) {
       $template = $this->object->getApplicationTransactionTemplate();
       if ($template instanceof PhabricatorModularTransaction) {
         $xtypes = $template->newModularTransactionTypes();
         foreach ($xtypes as $key => $xtype) {
           $xtype = clone $xtype;
           $xtype->setEditor($this);
           $xtypes[$key] = $xtype;
         }
       } else {
         $xtypes = array();
       }
 
       $this->modularTypes = $xtypes;
     }
 
     return $this->modularTypes;
   }
 
   private function getModularTransactionType($type) {
     $types = $this->getModularTransactionTypes();
     return idx($types, $type);
   }
 
   private function willApplyTransactions($object, array $xactions) {
     foreach ($xactions as $xaction) {
       $type = $xaction->getTransactionType();
 
       $xtype = $this->getModularTransactionType($type);
       if (!$xtype) {
         continue;
       }
 
       $xtype->willApplyTransactions($object, $xactions);
     }
   }
 
   public function getCreateObjectTitle($author, $object) {
     return pht('%s created this object.', $author);
   }
 
   public function getCreateObjectTitleForFeed($author, $object) {
     return pht('%s created an object: %s.', $author, $object);
   }
 
 /* -(  Queue  )-------------------------------------------------------------- */
 
   protected function queueTransaction(
     PhabricatorApplicationTransaction $xaction) {
     $this->transactionQueue[] = $xaction;
     return $this;
   }
 
   private function flushTransactionQueue($object) {
     if (!$this->transactionQueue) {
       return;
     }
 
     $xactions = $this->transactionQueue;
     $this->transactionQueue = array();
 
     $editor = $this->newQueueEditor();
 
     return $editor->applyTransactions($object, $xactions);
   }
 
   private function newQueueEditor() {
     $editor = id(newv(get_class($this), array()))
       ->setActor($this->getActor())
       ->setContentSource($this->getContentSource())
       ->setContinueOnNoEffect($this->getContinueOnNoEffect())
       ->setContinueOnMissingFields($this->getContinueOnMissingFields())
       ->setIsSilent($this->getIsSilent());
 
     if ($this->actingAsPHID !== null) {
       $editor->setActingAsPHID($this->actingAsPHID);
     }
 
     return $editor;
   }
 
 
 /* -(  Stamps  )------------------------------------------------------------- */
 
 
   public function newMailStampTemplates($object) {
     $actor = $this->getActor();
 
     $templates = array();
 
     $extensions = $this->newMailExtensions($object);
     foreach ($extensions as $extension) {
       $stamps = $extension->newMailStampTemplates($object);
       foreach ($stamps as $stamp) {
         $key = $stamp->getKey();
         if (isset($templates[$key])) {
           throw new Exception(
             pht(
               'Mail extension ("%s") defines a stamp template with the '.
               'same key ("%s") as another template. Each stamp template '.
               'must have a unique key.',
               get_class($extension),
               $key));
         }
 
         $stamp->setViewer($actor);
 
         $templates[$key] = $stamp;
       }
     }
 
     return $templates;
   }
 
   final public function getMailStamp($key) {
     if (!isset($this->stampTemplates)) {
       throw new PhutilInvalidStateException('newMailStampTemplates');
     }
 
     if (!isset($this->stampTemplates[$key])) {
       throw new Exception(
         pht(
           'Editor ("%s") has no mail stamp template with provided key ("%s").',
           get_class($this),
           $key));
     }
 
     return $this->stampTemplates[$key];
   }
 
   private function newMailStamps($object, array $xactions) {
     $actor = $this->getActor();
 
     $this->stampTemplates = $this->newMailStampTemplates($object);
 
     $extensions = $this->newMailExtensions($object);
     $stamps = array();
     foreach ($extensions as $extension) {
       $extension->newMailStamps($object, $xactions);
     }
 
     return $this->stampTemplates;
   }
 
   private function newMailExtensions($object) {
     $actor = $this->getActor();
 
     $all_extensions = PhabricatorMailEngineExtension::getAllExtensions();
 
     $extensions = array();
     foreach ($all_extensions as $key => $template) {
       $extension = id(clone $template)
         ->setViewer($actor)
         ->setEditor($this);
 
       if ($extension->supportsObject($object)) {
         $extensions[$key] = $extension;
       }
     }
 
     return $extensions;
   }
 
   private function generateMailStamps($object, $data) {
     if (!$data || !is_array($data)) {
       return null;
     }
 
     $templates = $this->newMailStampTemplates($object);
     foreach ($data as $spec) {
       if (!is_array($spec)) {
         continue;
       }
 
       $key = idx($spec, 'key');
       if (!isset($templates[$key])) {
         continue;
       }
 
       $type = idx($spec, 'type');
       if ($templates[$key]->getStampType() !== $type) {
         continue;
       }
 
       $value = idx($spec, 'value');
       $templates[$key]->setValueFromDictionary($value);
     }
 
     $results = array();
     foreach ($templates as $template) {
       $value = $template->getValueForRendering();
 
       $rendered = $template->renderStamps($value);
       if ($rendered === null) {
         continue;
       }
 
       $rendered = (array)$rendered;
       foreach ($rendered as $stamp) {
         $results[] = $stamp;
       }
     }
 
     natcasesort($results);
 
     return $results;
   }
 
   public function getRemovedRecipientPHIDs() {
     return $this->mailRemovedPHIDs;
   }
 
   private function buildOldRecipientLists($object, $xactions) {
     // See T4776. Before we start making any changes, build a list of the old
     // recipients. If a change removes a user from the recipient list for an
     // object we still want to notify the user about that change. This allows
     // them to respond if they didn't want to be removed.
 
     if (!$this->shouldSendMail($object, $xactions)) {
       return;
     }
 
     $this->oldTo = $this->getMailTo($object);
     $this->oldCC = $this->getMailCC($object);
 
     return $this;
   }
 
   private function applyOldRecipientLists() {
     $actor_phid = $this->getActingAsPHID();
 
     // If you took yourself off the recipient list (for example, by
     // unsubscribing or resigning) assume that you know what you did and
     // don't need to be notified.
 
     // If you just moved from "To" to "Cc" (or vice versa), you're still a
     // recipient so we don't need to add you back in.
 
     $map = array_fuse($this->mailToPHIDs) + array_fuse($this->mailCCPHIDs);
 
     foreach ($this->oldTo as $phid) {
       if ($phid === $actor_phid) {
         continue;
       }
 
       if (isset($map[$phid])) {
         continue;
       }
 
       $this->mailToPHIDs[] = $phid;
       $this->mailRemovedPHIDs[] = $phid;
     }
 
     foreach ($this->oldCC as $phid) {
       if ($phid === $actor_phid) {
         continue;
       }
 
       if (isset($map[$phid])) {
         continue;
       }
 
       $this->mailCCPHIDs[] = $phid;
       $this->mailRemovedPHIDs[] = $phid;
     }
 
     return $this;
   }
 
   private function queueWebhooks($object, array $xactions) {
     $hook_viewer = PhabricatorUser::getOmnipotentUser();
 
     $webhook_map = $this->webhookMap;
     if (!is_array($webhook_map)) {
       $webhook_map = array();
     }
 
     // Add any "Firehose" hooks to the list of hooks we're going to call.
     $firehose_hooks = id(new HeraldWebhookQuery())
       ->setViewer($hook_viewer)
       ->withStatuses(
         array(
           HeraldWebhook::HOOKSTATUS_FIREHOSE,
         ))
       ->execute();
     foreach ($firehose_hooks as $firehose_hook) {
       // This is "the hook itself is the reason this hook is being called",
       // since we're including it because it's configured as a firehose
       // hook.
       $hook_phid = $firehose_hook->getPHID();
       $webhook_map[$hook_phid][] = $hook_phid;
     }
 
     if (!$webhook_map) {
       return;
     }
 
     // NOTE: We're going to queue calls to disabled webhooks, they'll just
     // immediately fail in the worker queue. This makes the behavior more
     // visible.
 
     $call_hooks = id(new HeraldWebhookQuery())
       ->setViewer($hook_viewer)
       ->withPHIDs(array_keys($webhook_map))
       ->execute();
 
     foreach ($call_hooks as $call_hook) {
       $trigger_phids = idx($webhook_map, $call_hook->getPHID());
 
       $request = HeraldWebhookRequest::initializeNewWebhookRequest($call_hook)
         ->setObjectPHID($object->getPHID())
         ->setTransactionPHIDs(mpull($xactions, 'getPHID'))
         ->setTriggerPHIDs($trigger_phids)
         ->setRetryMode(HeraldWebhookRequest::RETRY_FOREVER)
         ->setIsSilentAction((bool)$this->getIsSilent())
         ->setIsSecureAction((bool)$this->getMustEncrypt())
         ->save();
 
       $request->queueCall();
     }
   }
 
   private function hasWarnings($object, $xaction) {
     // TODO: For the moment, this is a very un-modular hack to support
     // exactly one type of warning (mentioning users on a draft revision)
     // that we want to show. See PHI433.
 
     if (!($object instanceof DifferentialRevision)) {
       return false;
     }
 
     if (!$object->isDraft()) {
       return false;
     }
 
     $type = $xaction->getTransactionType();
     if ($type != PhabricatorTransactions::TYPE_SUBSCRIBERS) {
       return false;
     }
 
     // NOTE: This will currently warn even if you're only removing
     // subscribers.
 
     return true;
   }
 
   private function buildHistoryMail(PhabricatorLiskDAO $object) {
     $viewer = $this->requireActor();
     $recipient_phid = $this->getActingAsPHID();
 
     // Load every transaction so we can build a mail message with a complete
     // history for the object.
     $query = PhabricatorApplicationTransactionQuery::newQueryForObject($object);
     $xactions = $query
       ->setViewer($viewer)
       ->withObjectPHIDs(array($object->getPHID()))
       ->execute();
     $xactions = array_reverse($xactions);
 
     $mail_messages = $this->buildMailWithRecipients(
       $object,
       $xactions,
       array($recipient_phid),
       array(),
       array());
     $mail = head($mail_messages);
 
     // Since the user explicitly requested "!history", force delivery of this
     // message regardless of their other mail settings.
     $mail->setForceDelivery(true);
 
     return $mail;
   }
 
 }
diff --git a/src/applications/transactions/storage/PhabricatorApplicationTransaction.php b/src/applications/transactions/storage/PhabricatorApplicationTransaction.php
index ed88ac98db..c65adcac6b 100644
--- a/src/applications/transactions/storage/PhabricatorApplicationTransaction.php
+++ b/src/applications/transactions/storage/PhabricatorApplicationTransaction.php
@@ -1,1635 +1,1649 @@
 <?php
 
 abstract class PhabricatorApplicationTransaction
   extends PhabricatorLiskDAO
   implements
     PhabricatorPolicyInterface,
     PhabricatorDestructibleInterface {
 
   const TARGET_TEXT = 'text';
   const TARGET_HTML = 'html';
 
   protected $phid;
   protected $objectPHID;
   protected $authorPHID;
   protected $viewPolicy;
   protected $editPolicy;
 
   protected $commentPHID;
   protected $commentVersion = 0;
   protected $transactionType;
   protected $oldValue;
   protected $newValue;
   protected $metadata = array();
 
   protected $contentSource;
 
   private $comment;
   private $commentNotLoaded;
 
   private $handles;
   private $renderingTarget = self::TARGET_HTML;
   private $transactionGroup = array();
   private $viewer = self::ATTACHABLE;
   private $object = self::ATTACHABLE;
   private $oldValueHasBeenSet = false;
 
   private $ignoreOnNoEffect;
 
 
   /**
    * Flag this transaction as a pure side-effect which should be ignored when
    * applying transactions if it has no effect, even if transaction application
    * would normally fail. This both provides users with better error messages
    * and allows transactions to perform optional side effects.
    */
   public function setIgnoreOnNoEffect($ignore) {
     $this->ignoreOnNoEffect = $ignore;
     return $this;
   }
 
   public function getIgnoreOnNoEffect() {
     return $this->ignoreOnNoEffect;
   }
 
   public function shouldGenerateOldValue() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_TOKEN:
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
       case PhabricatorTransactions::TYPE_INLINESTATE:
         return false;
     }
     return true;
   }
 
   abstract public function getApplicationTransactionType();
 
   private function getApplicationObjectTypeName() {
     $types = PhabricatorPHIDType::getAllTypes();
 
     $type = idx($types, $this->getApplicationTransactionType());
     if ($type) {
       return $type->getTypeName();
     }
 
     return pht('Object');
   }
 
   public function getApplicationTransactionCommentObject() {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function getApplicationTransactionViewObject() {
     return new PhabricatorApplicationTransactionView();
   }
 
   public function getMetadataValue($key, $default = null) {
     return idx($this->metadata, $key, $default);
   }
 
   public function setMetadataValue($key, $value) {
     $this->metadata[$key] = $value;
     return $this;
   }
 
   public function generatePHID() {
     $type = PhabricatorApplicationTransactionTransactionPHIDType::TYPECONST;
     $subtype = $this->getApplicationTransactionType();
 
     return PhabricatorPHID::generateNewPHID($type, $subtype);
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'oldValue' => self::SERIALIZATION_JSON,
         'newValue' => self::SERIALIZATION_JSON,
         'metadata' => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_COLUMN_SCHEMA => array(
         'commentPHID' => 'phid?',
         'commentVersion' => 'uint32',
         'contentSource' => 'text',
         'transactionType' => 'text32',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_object' => array(
           'columns' => array('objectPHID'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function setContentSource(PhabricatorContentSource $content_source) {
     $this->contentSource = $content_source->serialize();
     return $this;
   }
 
   public function getContentSource() {
     return PhabricatorContentSource::newFromSerialized($this->contentSource);
   }
 
   public function hasComment() {
     return $this->getComment() && strlen($this->getComment()->getContent());
   }
 
   public function getComment() {
     if ($this->commentNotLoaded) {
       throw new Exception(pht('Comment for this transaction was not loaded.'));
     }
     return $this->comment;
   }
 
   public function setIsCreateTransaction($create) {
     return $this->setMetadataValue('core.create', $create);
   }
 
   public function getIsCreateTransaction() {
     return (bool)$this->getMetadataValue('core.create', false);
   }
 
   public function setIsDefaultTransaction($default) {
     return $this->setMetadataValue('core.default', $default);
   }
 
   public function getIsDefaultTransaction() {
     return (bool)$this->getMetadataValue('core.default', false);
   }
 
   public function setIsSilentTransaction($silent) {
     return $this->setMetadataValue('core.silent', $silent);
   }
 
   public function getIsSilentTransaction() {
     return (bool)$this->getMetadataValue('core.silent', false);
   }
 
+  public function setIsMFATransaction($mfa) {
+    return $this->setMetadataValue('core.mfa', $mfa);
+  }
+
+  public function getIsMFATransaction() {
+    return (bool)$this->getMetadataValue('core.mfa', false);
+  }
+
   public function attachComment(
     PhabricatorApplicationTransactionComment $comment) {
     $this->comment = $comment;
     $this->commentNotLoaded = false;
     return $this;
   }
 
   public function setCommentNotLoaded($not_loaded) {
     $this->commentNotLoaded = $not_loaded;
     return $this;
   }
 
   public function attachObject($object) {
     $this->object = $object;
     return $this;
   }
 
   public function getObject() {
     return $this->assertAttached($this->object);
   }
 
   public function getRemarkupChanges() {
     $changes = $this->newRemarkupChanges();
     assert_instances_of($changes, 'PhabricatorTransactionRemarkupChange');
 
     // Convert older-style remarkup blocks into newer-style remarkup changes.
     // This builds changes that do not have the correct "old value", so rules
     // that operate differently against edits (like @user mentions) won't work
     // properly.
     foreach ($this->getRemarkupBlocks() as $block) {
       $changes[] = $this->newRemarkupChange()
         ->setOldValue(null)
         ->setNewValue($block);
     }
 
     $comment = $this->getComment();
     if ($comment) {
       if ($comment->hasOldComment()) {
         $old_value = $comment->getOldComment()->getContent();
       } else {
         $old_value = null;
       }
 
       $new_value = $comment->getContent();
 
       $changes[] = $this->newRemarkupChange()
         ->setOldValue($old_value)
         ->setNewValue($new_value);
     }
 
     return $changes;
   }
 
   protected function newRemarkupChanges() {
     return array();
   }
 
   protected function newRemarkupChange() {
     return id(new PhabricatorTransactionRemarkupChange())
       ->setTransaction($this);
   }
 
   /**
    * @deprecated
    */
   public function getRemarkupBlocks() {
     $blocks = array();
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           $custom_blocks = $field->getApplicationTransactionRemarkupBlocks(
             $this);
           foreach ($custom_blocks as $custom_block) {
             $blocks[] = $custom_block;
           }
         }
         break;
     }
 
     return $blocks;
   }
 
   public function setOldValue($value) {
     $this->oldValueHasBeenSet = true;
     $this->writeField('oldValue', $value);
     return $this;
   }
 
   public function hasOldValue() {
     return $this->oldValueHasBeenSet;
   }
 
   public function newChronologicalSortVector() {
     return id(new PhutilSortVector())
       ->addInt((int)$this->getDateCreated())
       ->addInt((int)$this->getID());
   }
 
 /* -(  Rendering  )---------------------------------------------------------- */
 
   public function setRenderingTarget($rendering_target) {
     $this->renderingTarget = $rendering_target;
     return $this;
   }
 
   public function getRenderingTarget() {
     return $this->renderingTarget;
   }
 
   public function attachViewer(PhabricatorUser $viewer) {
     $this->viewer = $viewer;
     return $this;
   }
 
   public function getViewer() {
     return $this->assertAttached($this->viewer);
   }
 
   public function getRequiredHandlePHIDs() {
     $phids = array();
 
     $old = $this->getOldValue();
     $new = $this->getNewValue();
 
     $phids[] = array($this->getAuthorPHID());
     $phids[] = array($this->getObjectPHID());
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           $phids[] = $field->getApplicationTransactionRequiredHandlePHIDs(
             $this);
         }
         break;
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         $phids[] = $old;
         $phids[] = $new;
         break;
       case PhabricatorTransactions::TYPE_EDGE:
         $record = PhabricatorEdgeChangeRecord::newFromTransaction($this);
         $phids[] = $record->getChangedPHIDs();
         break;
       case PhabricatorTransactions::TYPE_COLUMNS:
         foreach ($new as $move) {
           $phids[] = array(
             $move['columnPHID'],
             $move['boardPHID'],
           );
           $phids[] = $move['fromColumnPHIDs'];
         }
         break;
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         if (!PhabricatorPolicyQuery::isSpecialPolicy($old)) {
           $phids[] = array($old);
         }
         if (!PhabricatorPolicyQuery::isSpecialPolicy($new)) {
           $phids[] = array($new);
         }
         break;
       case PhabricatorTransactions::TYPE_SPACE:
         if ($old) {
           $phids[] = array($old);
         }
         if ($new) {
           $phids[] = array($new);
         }
         break;
       case PhabricatorTransactions::TYPE_TOKEN:
         break;
     }
 
     if ($this->getComment()) {
       $phids[] = array($this->getComment()->getAuthorPHID());
     }
 
     return array_mergev($phids);
   }
 
   public function setHandles(array $handles) {
     $this->handles = $handles;
     return $this;
   }
 
   public function getHandle($phid) {
     if (empty($this->handles[$phid])) {
       throw new Exception(
         pht(
           'Transaction ("%s", of type "%s") requires a handle ("%s") that it '.
           'did not load.',
           $this->getPHID(),
           $this->getTransactionType(),
           $phid));
     }
     return $this->handles[$phid];
   }
 
   public function getHandleIfExists($phid) {
     return idx($this->handles, $phid);
   }
 
   public function getHandles() {
     if ($this->handles === null) {
       throw new Exception(
         pht('Transaction requires handles and it did not load them.'));
     }
     return $this->handles;
   }
 
   public function renderHandleLink($phid) {
     if ($this->renderingTarget == self::TARGET_HTML) {
       return $this->getHandle($phid)->renderLink();
     } else {
       return $this->getHandle($phid)->getLinkName();
     }
   }
 
   public function renderHandleList(array $phids) {
     $links = array();
     foreach ($phids as $phid) {
       $links[] = $this->renderHandleLink($phid);
     }
     if ($this->renderingTarget == self::TARGET_HTML) {
       return phutil_implode_html(', ', $links);
     } else {
       return implode(', ', $links);
     }
   }
 
   private function renderSubscriberList(array $phids, $change_type) {
     if ($this->getRenderingTarget() == self::TARGET_TEXT) {
       return $this->renderHandleList($phids);
     } else {
       $handles = array_select_keys($this->getHandles(), $phids);
       return id(new SubscriptionListStringBuilder())
         ->setHandles($handles)
         ->setObjectPHID($this->getPHID())
         ->buildTransactionString($change_type);
     }
   }
 
   protected function renderPolicyName($phid, $state = 'old') {
     $policy = PhabricatorPolicy::newFromPolicyAndHandle(
       $phid,
       $this->getHandleIfExists($phid));
     if ($this->renderingTarget == self::TARGET_HTML) {
       switch ($policy->getType()) {
         case PhabricatorPolicyType::TYPE_CUSTOM:
           $policy->setHref('/transactions/'.$state.'/'.$this->getPHID().'/');
           $policy->setWorkflow(true);
           break;
         default:
           break;
       }
       $output = $policy->renderDescription();
     } else {
       $output = hsprintf('%s', $policy->getFullName());
     }
     return $output;
   }
 
   public function getIcon() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         $comment = $this->getComment();
         if ($comment && $comment->getIsRemoved()) {
           return 'fa-trash';
         }
         return 'fa-comment';
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         $old = $this->getOldValue();
         $new = $this->getNewValue();
         $add = array_diff($new, $old);
         $rem = array_diff($old, $new);
         if ($add && $rem) {
           return 'fa-user';
         } else if ($add) {
           return 'fa-user-plus';
         } else if ($rem) {
           return 'fa-user-times';
         } else {
           return 'fa-user';
         }
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         return 'fa-lock';
       case PhabricatorTransactions::TYPE_EDGE:
         switch ($this->getMetadataValue('edge:type')) {
           case DiffusionCommitRevertedByCommitEdgeType::EDGECONST:
             return 'fa-undo';
           case DiffusionCommitRevertsCommitEdgeType::EDGECONST:
             return 'fa-ambulance';
         }
         return 'fa-link';
       case PhabricatorTransactions::TYPE_TOKEN:
         return 'fa-trophy';
       case PhabricatorTransactions::TYPE_SPACE:
         return 'fa-th-large';
       case PhabricatorTransactions::TYPE_COLUMNS:
         return 'fa-columns';
     }
 
     return 'fa-pencil';
   }
 
   public function getToken() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_TOKEN:
         $old = $this->getOldValue();
         $new = $this->getNewValue();
         if ($new) {
           $icon = substr($new, 10);
         } else {
           $icon = substr($old, 10);
         }
         return array($icon, !$this->getNewValue());
     }
 
     return array(null, null);
   }
 
   public function getColor() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT;
         $comment = $this->getComment();
         if ($comment && $comment->getIsRemoved()) {
           return 'black';
         }
         break;
       case PhabricatorTransactions::TYPE_EDGE:
         switch ($this->getMetadataValue('edge:type')) {
           case DiffusionCommitRevertedByCommitEdgeType::EDGECONST:
             return 'pink';
           case DiffusionCommitRevertsCommitEdgeType::EDGECONST:
             return 'sky';
         }
         break;
     }
     return null;
   }
 
   protected function getTransactionCustomField() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $key = $this->getMetadataValue('customfield:key');
         if (!$key) {
           return null;
         }
 
         $object = $this->getObject();
 
         if (!($object instanceof PhabricatorCustomFieldInterface)) {
           return null;
         }
 
         $field = PhabricatorCustomField::getObjectField(
           $object,
           PhabricatorCustomField::ROLE_APPLICATIONTRANSACTIONS,
           $key);
         if (!$field) {
           return null;
         }
 
         $field->setViewer($this->getViewer());
         return $field;
     }
 
     return null;
   }
 
   public function shouldHide() {
     // Never hide comments.
     if ($this->hasComment()) {
       return false;
     }
 
     $xaction_type = $this->getTransactionType();
 
     // Always hide requests for object history.
     if ($xaction_type === PhabricatorTransactions::TYPE_HISTORY) {
       return true;
     }
 
     // Hide creation transactions if the old value is empty. These are
     // transactions like "alice set the task title to: ...", which are
     // essentially never interesting.
     if ($this->getIsCreateTransaction()) {
       switch ($xaction_type) {
         case PhabricatorTransactions::TYPE_CREATE:
         case PhabricatorTransactions::TYPE_VIEW_POLICY:
         case PhabricatorTransactions::TYPE_EDIT_POLICY:
         case PhabricatorTransactions::TYPE_JOIN_POLICY:
         case PhabricatorTransactions::TYPE_SPACE:
           break;
         case PhabricatorTransactions::TYPE_SUBTYPE:
           return true;
         default:
           $old = $this->getOldValue();
 
           if (is_array($old) && !$old) {
             return true;
           }
 
           if (!is_array($old)) {
             if (!strlen($old)) {
               return true;
             }
 
             // The integer 0 is also uninteresting by default; this is often
             // an "off" flag for something like "All Day Event".
             if ($old === 0) {
               return true;
             }
           }
 
           break;
       }
     }
 
     // Hide creation transactions setting values to defaults, even if
     // the old value is not empty. For example, tasks may have a global
     // default view policy of "All Users", but a particular form sets the
     // policy to "Administrators". The transaction corresponding to this
     // change is not interesting, since it is the default behavior of the
     // form.
 
     if ($this->getIsCreateTransaction()) {
       if ($this->getIsDefaultTransaction()) {
         return true;
       }
     }
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
       case PhabricatorTransactions::TYPE_SPACE:
         if ($this->getIsCreateTransaction()) {
           break;
         }
 
         // TODO: Remove this eventually, this is handling old changes during
         // object creation prior to the introduction of "create" and "default"
         // transaction display flags.
 
         // NOTE: We can also hit this case with Space transactions that later
         // update a default space (`null`) to an explicit space, so handling
         // the Space case may require some finesse.
 
         if ($this->getOldValue() === null) {
           return true;
         } else {
           return false;
         }
         break;
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           return $field->shouldHideInApplicationTransactions($this);
         }
         break;
       case PhabricatorTransactions::TYPE_COLUMNS:
         return !$this->getInterestingMoves($this->getNewValue());
       case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $this->getMetadataValue('edge:type');
         switch ($edge_type) {
           case PhabricatorObjectMentionsObjectEdgeType::EDGECONST:
           case ManiphestTaskHasDuplicateTaskEdgeType::EDGECONST:
           case ManiphestTaskIsDuplicateOfTaskEdgeType::EDGECONST:
           case PhabricatorMutedEdgeType::EDGECONST:
           case PhabricatorMutedByEdgeType::EDGECONST:
             return true;
             break;
           case PhabricatorObjectMentionedByObjectEdgeType::EDGECONST:
             $record = PhabricatorEdgeChangeRecord::newFromTransaction($this);
             $add = $record->getAddedPHIDs();
             $add_value = reset($add);
             $add_handle = $this->getHandle($add_value);
             if ($add_handle->getPolicyFiltered()) {
               return true;
             }
             return false;
             break;
           default:
             break;
         }
         break;
     }
 
     return false;
   }
 
   public function shouldHideForMail(array $xactions) {
     if ($this->isSelfSubscription()) {
       return true;
     }
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_TOKEN:
         return true;
      case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $this->getMetadataValue('edge:type');
         switch ($edge_type) {
           case PhabricatorObjectMentionsObjectEdgeType::EDGECONST:
           case PhabricatorObjectMentionedByObjectEdgeType::EDGECONST:
             return true;
           case PhabricatorProjectObjectHasProjectEdgeType::EDGECONST:
             // When an object is first created, we hide any corresponding
             // project transactions in the web UI because you can just look at
             // the UI element elsewhere on screen to see which projects it
             // is tagged with. However, in mail there's no other way to get
             // this information, and it has some amount of value to users, so
             // we keep the transaction. See T10493.
             return false;
           default:
             break;
         }
         break;
     }
 
     if ($this->isInlineCommentTransaction()) {
       $inlines = array();
 
       // If there's a normal comment, we don't need to publish the inline
       // transaction, since the normal comment covers things.
       foreach ($xactions as $xaction) {
         if ($xaction->isInlineCommentTransaction()) {
           $inlines[] = $xaction;
           continue;
         }
 
         // We found a normal comment, so hide this inline transaction.
         if ($xaction->hasComment()) {
           return true;
         }
       }
 
       // If there are several inline comments, only publish the first one.
       if ($this !== head($inlines)) {
         return true;
       }
     }
 
     return $this->shouldHide();
   }
 
   public function shouldHideForFeed() {
     if ($this->isSelfSubscription()) {
       return true;
     }
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_TOKEN:
         return true;
      case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $this->getMetadataValue('edge:type');
         switch ($edge_type) {
           case PhabricatorObjectMentionsObjectEdgeType::EDGECONST:
           case PhabricatorObjectMentionedByObjectEdgeType::EDGECONST:
             return true;
             break;
           default:
             break;
         }
         break;
      case PhabricatorTransactions::TYPE_INLINESTATE:
        return true;
     }
 
     return $this->shouldHide();
   }
 
   public function getTitleForMail() {
     return id(clone $this)->setRenderingTarget('text')->getTitle();
   }
 
   public function getTitleForHTMLMail() {
     $title = $this->getTitleForMail();
     if ($title === null) {
       return null;
     }
 
     if ($this->hasChangeDetails()) {
       $details_uri = $this->getChangeDetailsURI();
       $details_uri = PhabricatorEnv::getProductionURI($details_uri);
 
       $show_details = phutil_tag(
         'a',
         array(
           'href' => $details_uri,
         ),
         pht('(Show Details)'));
 
       $title = array($title, ' ', $show_details);
     }
 
     return $title;
   }
 
   public function getChangeDetailsURI() {
     return '/transactions/detail/'.$this->getPHID().'/';
   }
 
   public function getBodyForMail() {
     if ($this->isInlineCommentTransaction()) {
       // We don't return inline comment content as mail body content, because
       // applications need to contextualize it (by adding line numbers, for
       // example) in order for it to make sense.
       return null;
     }
 
     $comment = $this->getComment();
     if ($comment && strlen($comment->getContent())) {
       return $comment->getContent();
     }
 
     return null;
   }
 
   public function getNoEffectDescription() {
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         return pht('You can not post an empty comment.');
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         return pht(
           'This %s already has that view policy.',
           $this->getApplicationObjectTypeName());
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         return pht(
           'This %s already has that edit policy.',
           $this->getApplicationObjectTypeName());
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         return pht(
           'This %s already has that join policy.',
           $this->getApplicationObjectTypeName());
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return pht(
           'All users are already subscribed to this %s.',
           $this->getApplicationObjectTypeName());
       case PhabricatorTransactions::TYPE_SPACE:
         return pht('This object is already in that space.');
       case PhabricatorTransactions::TYPE_EDGE:
         return pht('Edges already exist; transaction has no effect.');
       case PhabricatorTransactions::TYPE_COLUMNS:
         return pht(
           'You have not moved this object to any columns it is not '.
           'already in.');
     }
 
     return pht(
       'Transaction (of type "%s") has no effect.',
       $this->getTransactionType());
   }
 
   public function getTitle() {
     $author_phid = $this->getAuthorPHID();
 
     $old = $this->getOldValue();
     $new = $this->getNewValue();
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CREATE:
         return pht(
           '%s created this object.',
           $this->renderHandleLink($author_phid));
       case PhabricatorTransactions::TYPE_COMMENT:
         return pht(
           '%s added a comment.',
           $this->renderHandleLink($author_phid));
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         if ($this->getIsCreateTransaction()) {
           return pht(
             '%s created this object with visibility "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($new, 'new'));
         } else {
           return pht(
             '%s changed the visibility from "%s" to "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($old, 'old'),
             $this->renderPolicyName($new, 'new'));
         }
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         if ($this->getIsCreateTransaction()) {
           return pht(
             '%s created this object with edit policy "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($new, 'new'));
         } else {
           return pht(
             '%s changed the edit policy from "%s" to "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($old, 'old'),
             $this->renderPolicyName($new, 'new'));
         }
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         if ($this->getIsCreateTransaction()) {
           return pht(
             '%s created this object with join policy "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($new, 'new'));
         } else {
           return pht(
             '%s changed the join policy from "%s" to "%s".',
             $this->renderHandleLink($author_phid),
             $this->renderPolicyName($old, 'old'),
             $this->renderPolicyName($new, 'new'));
         }
       case PhabricatorTransactions::TYPE_SPACE:
         if ($this->getIsCreateTransaction()) {
           return pht(
             '%s created this object in space %s.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($new));
         } else {
           return pht(
             '%s shifted this object from the %s space to the %s space.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($old),
             $this->renderHandleLink($new));
         }
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         $add = array_diff($new, $old);
         $rem = array_diff($old, $new);
 
         if ($add && $rem) {
           return pht(
             '%s edited subscriber(s), added %d: %s; removed %d: %s.',
             $this->renderHandleLink($author_phid),
             count($add),
             $this->renderSubscriberList($add, 'add'),
             count($rem),
             $this->renderSubscriberList($rem, 'rem'));
         } else if ($add) {
           return pht(
             '%s added %d subscriber(s): %s.',
             $this->renderHandleLink($author_phid),
             count($add),
             $this->renderSubscriberList($add, 'add'));
         } else if ($rem) {
           return pht(
             '%s removed %d subscriber(s): %s.',
             $this->renderHandleLink($author_phid),
             count($rem),
             $this->renderSubscriberList($rem, 'rem'));
         } else {
           // This is used when rendering previews, before the user actually
           // selects any CCs.
           return pht(
             '%s updated subscribers...',
             $this->renderHandleLink($author_phid));
         }
         break;
       case PhabricatorTransactions::TYPE_EDGE:
         $record = PhabricatorEdgeChangeRecord::newFromTransaction($this);
         $add = $record->getAddedPHIDs();
         $rem = $record->getRemovedPHIDs();
 
         $type = $this->getMetadata('edge:type');
         $type = head($type);
 
         try {
           $type_obj = PhabricatorEdgeType::getByConstant($type);
         } catch (Exception $ex) {
           // Recover somewhat gracefully from edge transactions which
           // we don't have the classes for.
           return pht(
             '%s edited an edge.',
             $this->renderHandleLink($author_phid));
         }
 
         if ($add && $rem) {
           return $type_obj->getTransactionEditString(
             $this->renderHandleLink($author_phid),
             new PhutilNumber(count($add) + count($rem)),
             phutil_count($add),
             $this->renderHandleList($add),
             phutil_count($rem),
             $this->renderHandleList($rem));
         } else if ($add) {
           return $type_obj->getTransactionAddString(
             $this->renderHandleLink($author_phid),
             phutil_count($add),
             $this->renderHandleList($add));
         } else if ($rem) {
           return $type_obj->getTransactionRemoveString(
             $this->renderHandleLink($author_phid),
             phutil_count($rem),
             $this->renderHandleList($rem));
         } else {
           return $type_obj->getTransactionPreviewString(
             $this->renderHandleLink($author_phid));
         }
 
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           return $field->getApplicationTransactionTitle($this);
         } else {
           $developer_mode = 'phabricator.developer-mode';
           $is_developer = PhabricatorEnv::getEnvConfig($developer_mode);
           if ($is_developer) {
             return pht(
               '%s edited a custom field (with key "%s").',
               $this->renderHandleLink($author_phid),
               $this->getMetadata('customfield:key'));
           } else {
             return pht(
               '%s edited a custom field.',
               $this->renderHandleLink($author_phid));
           }
         }
 
       case PhabricatorTransactions::TYPE_TOKEN:
         if ($old && $new) {
           return pht(
             '%s updated a token.',
             $this->renderHandleLink($author_phid));
         } else if ($old) {
           return pht(
             '%s rescinded a token.',
             $this->renderHandleLink($author_phid));
         } else {
           return pht(
             '%s awarded a token.',
             $this->renderHandleLink($author_phid));
         }
 
       case PhabricatorTransactions::TYPE_INLINESTATE:
         $done = 0;
         $undone = 0;
         foreach ($new as $phid => $state) {
           if ($state == PhabricatorInlineCommentInterface::STATE_DONE) {
             $done++;
           } else {
             $undone++;
           }
         }
         if ($done && $undone) {
           return pht(
             '%s marked %s inline comment(s) as done and %s inline comment(s) '.
             'as not done.',
             $this->renderHandleLink($author_phid),
             new PhutilNumber($done),
             new PhutilNumber($undone));
         } else if ($done) {
           return pht(
             '%s marked %s inline comment(s) as done.',
             $this->renderHandleLink($author_phid),
             new PhutilNumber($done));
         } else {
           return pht(
             '%s marked %s inline comment(s) as not done.',
             $this->renderHandleLink($author_phid),
             new PhutilNumber($undone));
         }
         break;
 
       case PhabricatorTransactions::TYPE_COLUMNS:
         $moves = $this->getInterestingMoves($new);
         if (count($moves) == 1) {
           $move = head($moves);
           $from_columns = $move['fromColumnPHIDs'];
           $to_column = $move['columnPHID'];
           $board_phid = $move['boardPHID'];
           if (count($from_columns) == 1) {
             return pht(
               '%s moved this task from %s to %s on the %s board.',
               $this->renderHandleLink($author_phid),
               $this->renderHandleLink(head($from_columns)),
               $this->renderHandleLink($to_column),
               $this->renderHandleLink($board_phid));
           } else {
             return pht(
               '%s moved this task to %s on the %s board.',
               $this->renderHandleLink($author_phid),
               $this->renderHandleLink($to_column),
               $this->renderHandleLink($board_phid));
           }
         } else {
           $fragments = array();
           foreach ($moves as $move) {
             $fragments[] = pht(
               '%s (%s)',
               $this->renderHandleLink($board_phid),
               $this->renderHandleLink($to_column));
           }
 
           return pht(
             '%s moved this task on %s board(s): %s.',
             $this->renderHandleLink($author_phid),
             phutil_count($moves),
             phutil_implode_html(', ', $fragments));
         }
         break;
 
       default:
         // In developer mode, provide a better hint here about which string
         // we're missing.
         $developer_mode = 'phabricator.developer-mode';
         $is_developer = PhabricatorEnv::getEnvConfig($developer_mode);
         if ($is_developer) {
           return pht(
             '%s edited this object (transaction type "%s").',
             $this->renderHandleLink($author_phid),
             $this->getTransactionType());
         } else {
           return pht(
             '%s edited this %s.',
             $this->renderHandleLink($author_phid),
             $this->getApplicationObjectTypeName());
         }
     }
   }
 
   public function getTitleForFeed() {
     $author_phid = $this->getAuthorPHID();
     $object_phid = $this->getObjectPHID();
 
     $old = $this->getOldValue();
     $new = $this->getNewValue();
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CREATE:
         return pht(
           '%s created %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_COMMENT:
         return pht(
           '%s added a comment to %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
         return pht(
           '%s changed the visibility for %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         return pht(
           '%s changed the edit policy for %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         return pht(
           '%s changed the join policy for %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return pht(
           '%s updated subscribers of %s.',
           $this->renderHandleLink($author_phid),
           $this->renderHandleLink($object_phid));
       case PhabricatorTransactions::TYPE_SPACE:
         if ($this->getIsCreateTransaction()) {
           return pht(
             '%s created %s in the %s space.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             $this->renderHandleLink($new));
         } else {
           return pht(
             '%s shifted %s from the %s space to the %s space.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             $this->renderHandleLink($old),
             $this->renderHandleLink($new));
         }
       case PhabricatorTransactions::TYPE_EDGE:
         $record = PhabricatorEdgeChangeRecord::newFromTransaction($this);
         $add = $record->getAddedPHIDs();
         $rem = $record->getRemovedPHIDs();
 
         $type = $this->getMetadata('edge:type');
         $type = head($type);
 
         $type_obj = PhabricatorEdgeType::getByConstant($type);
 
         if ($add && $rem) {
           return $type_obj->getFeedEditString(
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             new PhutilNumber(count($add) + count($rem)),
             phutil_count($add),
             $this->renderHandleList($add),
             phutil_count($rem),
             $this->renderHandleList($rem));
         } else if ($add) {
           return $type_obj->getFeedAddString(
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             phutil_count($add),
             $this->renderHandleList($add));
         } else if ($rem) {
           return $type_obj->getFeedRemoveString(
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             phutil_count($rem),
             $this->renderHandleList($rem));
         } else {
           return pht(
             '%s edited edge metadata for %s.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid));
         }
 
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           return $field->getApplicationTransactionTitleForFeed($this);
         } else {
           return pht(
             '%s edited a custom field on %s.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid));
         }
 
       case PhabricatorTransactions::TYPE_COLUMNS:
         $moves = $this->getInterestingMoves($new);
         if (count($moves) == 1) {
           $move = head($moves);
           $from_columns = $move['fromColumnPHIDs'];
           $to_column = $move['columnPHID'];
           $board_phid = $move['boardPHID'];
           if (count($from_columns) == 1) {
             return pht(
               '%s moved %s from %s to %s on the %s board.',
               $this->renderHandleLink($author_phid),
               $this->renderHandleLink($object_phid),
               $this->renderHandleLink(head($from_columns)),
               $this->renderHandleLink($to_column),
               $this->renderHandleLink($board_phid));
           } else {
             return pht(
               '%s moved %s to %s on the %s board.',
               $this->renderHandleLink($author_phid),
               $this->renderHandleLink($object_phid),
               $this->renderHandleLink($to_column),
               $this->renderHandleLink($board_phid));
           }
         } else {
           $fragments = array();
           foreach ($moves as $move) {
             $fragments[] = pht(
               '%s (%s)',
               $this->renderHandleLink($board_phid),
               $this->renderHandleLink($to_column));
           }
 
           return pht(
             '%s moved %s on %s board(s): %s.',
             $this->renderHandleLink($author_phid),
             $this->renderHandleLink($object_phid),
             phutil_count($moves),
             phutil_implode_html(', ', $fragments));
         }
         break;
 
     }
 
     return $this->getTitle();
   }
 
   public function getMarkupFieldsForFeed(PhabricatorFeedStory $story) {
     $fields = array();
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         $text = $this->getComment()->getContent();
         if (strlen($text)) {
           $fields[] = 'comment/'.$this->getID();
         }
         break;
     }
 
     return $fields;
   }
 
   public function getMarkupTextForFeed(PhabricatorFeedStory $story, $field) {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         $text = $this->getComment()->getContent();
         return PhabricatorMarkupEngine::summarize($text);
     }
 
     return null;
   }
 
   public function getBodyForFeed(PhabricatorFeedStory $story) {
     $remarkup = $this->getRemarkupBodyForFeed($story);
     if ($remarkup !== null) {
       $remarkup = PhabricatorMarkupEngine::summarize($remarkup);
       return new PHUIRemarkupView($this->viewer, $remarkup);
     }
 
     $old = $this->getOldValue();
     $new = $this->getNewValue();
 
     $body = null;
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         $text = $this->getComment()->getContent();
         if (strlen($text)) {
           $body = $story->getMarkupFieldOutput('comment/'.$this->getID());
         }
         break;
     }
 
     return $body;
   }
 
   public function getRemarkupBodyForFeed(PhabricatorFeedStory $story) {
     return null;
   }
 
   public function getActionStrength() {
     if ($this->isInlineCommentTransaction()) {
       return 0.25;
     }
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         return 0.5;
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         if ($this->isSelfSubscription()) {
           // Make this weaker than TYPE_COMMENT.
           return 0.25;
         }
 
         if ($this->isApplicationAuthor()) {
           // When applications (most often: Herald) change subscriptions it
           // is very uninteresting.
           return 0.000000001;
         }
 
         // In other cases, subscriptions are more interesting than comments
         // (which are shown anyway) but less interesting than any other type of
         // transaction.
         return 0.75;
     }
 
     return 1.0;
   }
 
   public function isCommentTransaction() {
     if ($this->hasComment()) {
       return true;
     }
 
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         return true;
     }
 
     return false;
   }
 
   public function isInlineCommentTransaction() {
     return false;
   }
 
   public function getActionName() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_COMMENT:
         return pht('Commented On');
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
       case PhabricatorTransactions::TYPE_JOIN_POLICY:
         return pht('Changed Policy');
       case PhabricatorTransactions::TYPE_SUBSCRIBERS:
         return pht('Changed Subscribers');
       default:
         return pht('Updated');
     }
   }
 
   public function getMailTags() {
     return array();
   }
 
   public function hasChangeDetails() {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           return $field->getApplicationTransactionHasChangeDetails($this);
         }
         break;
     }
     return false;
   }
 
   public function hasChangeDetailsForMail() {
     return $this->hasChangeDetails();
   }
 
   public function renderChangeDetailsForMail(PhabricatorUser $viewer) {
     $view = $this->renderChangeDetails($viewer);
     if ($view instanceof PhabricatorApplicationTransactionTextDiffDetailView) {
       return $view->renderForMail();
     }
     return null;
   }
 
   public function renderChangeDetails(PhabricatorUser $viewer) {
     switch ($this->getTransactionType()) {
       case PhabricatorTransactions::TYPE_CUSTOMFIELD:
         $field = $this->getTransactionCustomField();
         if ($field) {
           return $field->getApplicationTransactionChangeDetails($this, $viewer);
         }
         break;
     }
 
     return $this->renderTextCorpusChangeDetails(
       $viewer,
       $this->getOldValue(),
       $this->getNewValue());
   }
 
   public function renderTextCorpusChangeDetails(
     PhabricatorUser $viewer,
     $old,
     $new) {
     return id(new PhabricatorApplicationTransactionTextDiffDetailView())
       ->setUser($viewer)
       ->setOldText($old)
       ->setNewText($new);
   }
 
   public function attachTransactionGroup(array $group) {
     assert_instances_of($group, __CLASS__);
     $this->transactionGroup = $group;
     return $this;
   }
 
   public function getTransactionGroup() {
     return $this->transactionGroup;
   }
 
   /**
    * Should this transaction be visually grouped with an existing transaction
    * group?
    *
    * @param list<PhabricatorApplicationTransaction> List of transactions.
    * @return bool True to display in a group with the other transactions.
    */
   public function shouldDisplayGroupWith(array $group) {
     $this_source = null;
     if ($this->getContentSource()) {
       $this_source = $this->getContentSource()->getSource();
     }
 
     foreach ($group as $xaction) {
       // Don't group transactions by different authors.
       if ($xaction->getAuthorPHID() != $this->getAuthorPHID()) {
         return false;
       }
 
       // Don't group transactions for different objects.
       if ($xaction->getObjectPHID() != $this->getObjectPHID()) {
         return false;
       }
 
       // Don't group anything into a group which already has a comment.
       if ($xaction->isCommentTransaction()) {
         return false;
       }
 
       // Don't group transactions from different content sources.
       $other_source = null;
       if ($xaction->getContentSource()) {
         $other_source = $xaction->getContentSource()->getSource();
       }
 
       if ($other_source != $this_source) {
         return false;
       }
 
       // Don't group transactions which happened more than 2 minutes apart.
       $apart = abs($xaction->getDateCreated() - $this->getDateCreated());
       if ($apart > (60 * 2)) {
         return false;
       }
 
       // Don't group silent and nonsilent transactions together.
       $is_silent = $this->getIsSilentTransaction();
       if ($is_silent != $xaction->getIsSilentTransaction()) {
         return false;
       }
+
+      // Don't group MFA and non-MFA transactions together.
+      $is_mfa = $this->getIsMFATransaction();
+      if ($is_mfa != $xaction->getIsMFATransaction()) {
+        return false;
+      }
     }
 
     return true;
   }
 
   public function renderExtraInformationLink() {
     $herald_xscript_id = $this->getMetadataValue('herald:transcriptID');
 
     if ($herald_xscript_id) {
       return phutil_tag(
         'a',
         array(
           'href' => '/herald/transcript/'.$herald_xscript_id.'/',
         ),
         pht('View Herald Transcript'));
     }
 
     return null;
   }
 
   public function renderAsTextForDoorkeeper(
     DoorkeeperFeedStoryPublisher $publisher,
     PhabricatorFeedStory $story,
     array $xactions) {
 
     $text = array();
     $body = array();
 
     foreach ($xactions as $xaction) {
       $xaction_body = $xaction->getBodyForMail();
       if ($xaction_body !== null) {
         $body[] = $xaction_body;
       }
 
       if ($xaction->shouldHideForMail($xactions)) {
         continue;
       }
 
       $old_target = $xaction->getRenderingTarget();
       $new_target = self::TARGET_TEXT;
       $xaction->setRenderingTarget($new_target);
 
       if ($publisher->getRenderWithImpliedContext()) {
         $text[] = $xaction->getTitle();
       } else {
         $text[] = $xaction->getTitleForFeed();
       }
 
       $xaction->setRenderingTarget($old_target);
     }
 
     $text = implode("\n", $text);
     $body = implode("\n\n", $body);
 
     return rtrim($text."\n\n".$body);
   }
 
   /**
    * Test if this transaction is just a user subscribing or unsubscribing
    * themselves.
    */
   private function isSelfSubscription() {
     $type = $this->getTransactionType();
     if ($type != PhabricatorTransactions::TYPE_SUBSCRIBERS) {
       return false;
     }
 
     $old = $this->getOldValue();
     $new = $this->getNewValue();
 
     $add = array_diff($old, $new);
     $rem = array_diff($new, $old);
 
     if ((count($add) + count($rem)) != 1) {
       // More than one user affected.
       return false;
     }
 
     $affected_phid = head(array_merge($add, $rem));
     if ($affected_phid != $this->getAuthorPHID()) {
       // Affected user is someone else.
       return false;
     }
 
     return true;
   }
 
   private function isApplicationAuthor() {
     $author_phid = $this->getAuthorPHID();
     $author_type = phid_get_type($author_phid);
     $application_type = PhabricatorApplicationApplicationPHIDType::TYPECONST;
     return ($author_type == $application_type);
   }
 
 
   private function getInterestingMoves(array $moves) {
     // Remove moves which only shift the position of a task within a column.
     foreach ($moves as $key => $move) {
       $from_phids = array_fuse($move['fromColumnPHIDs']);
       if (isset($from_phids[$move['columnPHID']])) {
         unset($moves[$key]);
       }
     }
 
     return $moves;
   }
 
 
 /* -(  PhabricatorPolicyInterface Implementation  )-------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return $this->getViewPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return $this->getEditPolicy();
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return ($viewer->getPHID() == $this->getAuthorPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     return pht(
       'Transactions are visible to users that can see the object which was '.
       'acted upon. Some transactions - in particular, comments - are '.
       'editable by the transaction author.');
   }
 
   public function getModularType() {
     return null;
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $comment_template = null;
       try {
         $comment_template = $this->getApplicationTransactionCommentObject();
       } catch (Exception $ex) {
         // Continue; no comments for these transactions.
       }
 
       if ($comment_template) {
         $comments = $comment_template->loadAllWhere(
           'transactionPHID = %s',
           $this->getPHID());
         foreach ($comments as $comment) {
           $engine->destroyObject($comment);
         }
       }
 
       $this->delete();
     $this->saveTransaction();
   }
 
 
 }
diff --git a/src/applications/transactions/view/PhabricatorApplicationTransactionView.php b/src/applications/transactions/view/PhabricatorApplicationTransactionView.php
index e10f5c008e..9916628edf 100644
--- a/src/applications/transactions/view/PhabricatorApplicationTransactionView.php
+++ b/src/applications/transactions/view/PhabricatorApplicationTransactionView.php
@@ -1,549 +1,550 @@
 <?php
 
 /**
  * @concrete-extensible
  */
 class PhabricatorApplicationTransactionView extends AphrontView {
 
   private $transactions;
   private $engine;
   private $showEditActions = true;
   private $isPreview;
   private $objectPHID;
   private $shouldTerminate = false;
   private $quoteTargetID;
   private $quoteRef;
   private $pager;
   private $renderAsFeed;
   private $renderData = array();
   private $hideCommentOptions = false;
 
   public function setRenderAsFeed($feed) {
     $this->renderAsFeed = $feed;
     return $this;
   }
 
   public function setQuoteRef($quote_ref) {
     $this->quoteRef = $quote_ref;
     return $this;
   }
 
   public function getQuoteRef() {
     return $this->quoteRef;
   }
 
   public function setQuoteTargetID($quote_target_id) {
     $this->quoteTargetID = $quote_target_id;
     return $this;
   }
 
   public function getQuoteTargetID() {
     return $this->quoteTargetID;
   }
 
   public function setObjectPHID($object_phid) {
     $this->objectPHID = $object_phid;
     return $this;
   }
 
   public function getObjectPHID() {
     return $this->objectPHID;
   }
 
   public function setIsPreview($is_preview) {
     $this->isPreview = $is_preview;
     return $this;
   }
 
   public function getIsPreview() {
     return $this->isPreview;
   }
 
   public function setShowEditActions($show_edit_actions) {
     $this->showEditActions = $show_edit_actions;
     return $this;
   }
 
   public function getShowEditActions() {
     return $this->showEditActions;
   }
 
   public function setMarkupEngine(PhabricatorMarkupEngine $engine) {
     $this->engine = $engine;
     return $this;
   }
 
   public function setTransactions(array $transactions) {
     assert_instances_of($transactions, 'PhabricatorApplicationTransaction');
     $this->transactions = $transactions;
     return $this;
   }
 
   public function getTransactions() {
     return $this->transactions;
   }
 
   public function setShouldTerminate($term) {
     $this->shouldTerminate = $term;
     return $this;
   }
 
   public function setPager(AphrontCursorPagerView $pager) {
     $this->pager = $pager;
     return $this;
   }
 
   public function getPager() {
     return $this->pager;
   }
 
   /**
    * This is additional data that may be necessary to render the next set
    * of transactions. Objects that implement
    * PhabricatorApplicationTransactionInterface use this data in
    * willRenderTimeline.
    */
   public function setRenderData(array $data) {
     $this->renderData = $data;
     return $this;
   }
 
   public function getRenderData() {
     return $this->renderData;
   }
 
   public function setHideCommentOptions($hide_comment_options) {
     $this->hideCommentOptions = $hide_comment_options;
     return $this;
   }
 
   public function getHideCommentOptions() {
     return $this->hideCommentOptions;
   }
 
   public function buildEvents($with_hiding = false) {
     $user = $this->getUser();
 
     $xactions = $this->transactions;
 
     $xactions = $this->filterHiddenTransactions($xactions);
     $xactions = $this->groupRelatedTransactions($xactions);
     $groups = $this->groupDisplayTransactions($xactions);
 
     // If the viewer has interacted with this object, we hide things from
     // before their most recent interaction by default. This tends to make
     // very long threads much more manageable, because you don't have to
     // scroll through a lot of history and can focus on just new stuff.
 
     $show_group = null;
 
     if ($with_hiding) {
       // Find the most recent comment by the viewer.
       $group_keys = array_keys($groups);
       $group_keys = array_reverse($group_keys);
 
       // If we would only hide a small number of transactions, don't hide
       // anything. Just don't examine the last few keys. Also, we always
       // want to show the most recent pieces of activity, so don't examine
       // the first few keys either.
       $group_keys = array_slice($group_keys, 2, -2);
 
       $type_comment = PhabricatorTransactions::TYPE_COMMENT;
       foreach ($group_keys as $group_key) {
         $group = $groups[$group_key];
         foreach ($group as $xaction) {
           if ($xaction->getAuthorPHID() == $user->getPHID() &&
               $xaction->getTransactionType() == $type_comment) {
             // This is the most recent group where the user commented.
             $show_group = $group_key;
             break 2;
           }
         }
       }
     }
 
     $events = array();
     $hide_by_default = ($show_group !== null);
     $set_next_page_id = false;
 
     foreach ($groups as $group_key => $group) {
       if ($hide_by_default && ($show_group === $group_key)) {
         $hide_by_default = false;
         $set_next_page_id = true;
       }
 
       $group_event = null;
       foreach ($group as $xaction) {
         $event = $this->renderEvent($xaction, $group);
         $event->setHideByDefault($hide_by_default);
         if (!$group_event) {
           $group_event = $event;
         } else {
           $group_event->addEventToGroup($event);
         }
         if ($set_next_page_id) {
           $set_next_page_id = false;
           $pager = $this->getPager();
           if ($pager) {
             $pager->setNextPageID($xaction->getID());
           }
         }
       }
       $events[] = $group_event;
 
     }
 
     return $events;
   }
 
   public function render() {
     if (!$this->getObjectPHID()) {
       throw new PhutilInvalidStateException('setObjectPHID');
     }
 
     $view = $this->buildPHUITimelineView();
 
     if ($this->getShowEditActions()) {
       Javelin::initBehavior('phabricator-transaction-list');
     }
 
     return $view->render();
   }
 
   public function buildPHUITimelineView($with_hiding = true) {
     if (!$this->getObjectPHID()) {
       throw new PhutilInvalidStateException('setObjectPHID');
     }
 
     $view = id(new PHUITimelineView())
       ->setUser($this->getUser())
       ->setShouldTerminate($this->shouldTerminate)
       ->setQuoteTargetID($this->getQuoteTargetID())
       ->setQuoteRef($this->getQuoteRef());
 
     $events = $this->buildEvents($with_hiding);
     foreach ($events as $event) {
       $view->addEvent($event);
     }
 
     if ($this->getPager()) {
       $view->setPager($this->getPager());
     }
 
     if ($this->getRenderData()) {
       $view->setRenderData($this->getRenderData());
     }
 
     return $view;
   }
 
   public function isTimelineEmpty() {
     return !count($this->buildEvents(true));
   }
 
   protected function getOrBuildEngine() {
     if (!$this->engine) {
       $field = PhabricatorApplicationTransactionComment::MARKUP_FIELD_COMMENT;
 
       $engine = id(new PhabricatorMarkupEngine())
         ->setViewer($this->getUser());
       foreach ($this->transactions as $xaction) {
         if (!$xaction->hasComment()) {
           continue;
         }
         $engine->addObject($xaction->getComment(), $field);
       }
       $engine->process();
 
       $this->engine = $engine;
     }
 
     return $this->engine;
   }
 
   private function buildChangeDetailsLink(
     PhabricatorApplicationTransaction $xaction) {
 
     return javelin_tag(
       'a',
       array(
         'href' => $xaction->getChangeDetailsURI(),
         'sigil' => 'workflow',
       ),
       pht('(Show Details)'));
   }
 
   private function buildExtraInformationLink(
     PhabricatorApplicationTransaction $xaction) {
 
     $link = $xaction->renderExtraInformationLink();
     if (!$link) {
       return null;
     }
 
     return phutil_tag(
       'span',
       array(
         'class' => 'phui-timeline-extra-information',
       ),
       array(" \xC2\xB7  ", $link));
   }
 
   protected function shouldGroupTransactions(
     PhabricatorApplicationTransaction $u,
     PhabricatorApplicationTransaction $v) {
     return false;
   }
 
   protected function renderTransactionContent(
     PhabricatorApplicationTransaction $xaction) {
 
     $field = PhabricatorApplicationTransactionComment::MARKUP_FIELD_COMMENT;
     $engine = $this->getOrBuildEngine();
     $comment = $xaction->getComment();
 
     if ($comment) {
       if ($comment->getIsRemoved()) {
         return javelin_tag(
           'span',
           array(
             'class' => 'comment-deleted',
             'sigil' => 'transaction-comment',
             'meta'  => array('phid' => $comment->getTransactionPHID()),
           ),
           pht(
             'This comment was removed by %s.',
             $xaction->getHandle($comment->getAuthorPHID())->renderLink()));
       } else if ($comment->getIsDeleted()) {
         return javelin_tag(
           'span',
           array(
             'class' => 'comment-deleted',
             'sigil' => 'transaction-comment',
             'meta'  => array('phid' => $comment->getTransactionPHID()),
           ),
           pht('This comment has been deleted.'));
       } else if ($xaction->hasComment()) {
         return javelin_tag(
           'span',
           array(
             'class' => 'transaction-comment',
             'sigil' => 'transaction-comment',
             'meta'  => array('phid' => $comment->getTransactionPHID()),
           ),
           $engine->getOutput($comment, $field));
       } else {
         // This is an empty, non-deleted comment. Usually this happens when
         // rendering previews.
         return null;
       }
     }
 
     return null;
   }
 
   private function filterHiddenTransactions(array $xactions) {
     foreach ($xactions as $key => $xaction) {
       if ($xaction->shouldHide()) {
         unset($xactions[$key]);
       }
     }
     return $xactions;
   }
 
   private function groupRelatedTransactions(array $xactions) {
     $last = null;
     $last_key = null;
     $groups = array();
     foreach ($xactions as $key => $xaction) {
       if ($last && $this->shouldGroupTransactions($last, $xaction)) {
         $groups[$last_key][] = $xaction;
         unset($xactions[$key]);
       } else {
         $last = $xaction;
         $last_key = $key;
       }
     }
 
     foreach ($xactions as $key => $xaction) {
       $xaction->attachTransactionGroup(idx($groups, $key, array()));
     }
 
     return $xactions;
   }
 
   private function groupDisplayTransactions(array $xactions) {
     $groups = array();
     $group = array();
     foreach ($xactions as $xaction) {
       if ($xaction->shouldDisplayGroupWith($group)) {
         $group[] = $xaction;
       } else {
         if ($group) {
           $groups[] = $group;
         }
         $group = array($xaction);
       }
     }
 
     if ($group) {
       $groups[] = $group;
     }
 
     foreach ($groups as $key => $group) {
       $results = array();
 
       // Sort transactions within the group by action strength, then by
       // chronological order. This makes sure that multiple actions of the
       // same type (like a close, then a reopen) render in the order they
       // were performed.
       $strength_groups = mgroup($group, 'getActionStrength');
       krsort($strength_groups);
       foreach ($strength_groups as $strength_group) {
         foreach (msort($strength_group, 'getID') as $xaction) {
           $results[] = $xaction;
         }
       }
 
       $groups[$key] = $results;
     }
 
     return $groups;
   }
 
   private function renderEvent(
     PhabricatorApplicationTransaction $xaction,
     array $group) {
     $viewer = $this->getUser();
 
     $event = id(new PHUITimelineEventView())
       ->setUser($viewer)
       ->setAuthorPHID($xaction->getAuthorPHID())
       ->setTransactionPHID($xaction->getPHID())
       ->setUserHandle($xaction->getHandle($xaction->getAuthorPHID()))
       ->setIcon($xaction->getIcon())
       ->setColor($xaction->getColor())
       ->setHideCommentOptions($this->getHideCommentOptions())
-      ->setIsSilent($xaction->getIsSilentTransaction());
+      ->setIsSilent($xaction->getIsSilentTransaction())
+      ->setIsMFA($xaction->getIsMFATransaction());
 
     list($token, $token_removed) = $xaction->getToken();
     if ($token) {
       $event->setToken($token, $token_removed);
     }
 
     if (!$this->shouldSuppressTitle($xaction, $group)) {
       if ($this->renderAsFeed) {
         $title = $xaction->getTitleForFeed();
       } else {
         $title = $xaction->getTitle();
       }
       if ($xaction->hasChangeDetails()) {
         if (!$this->isPreview) {
           $details = $this->buildChangeDetailsLink($xaction);
           $title = array(
             $title,
             ' ',
             $details,
           );
         }
       }
 
       if (!$this->isPreview) {
         $more = $this->buildExtraInformationLink($xaction);
         if ($more) {
           $title = array($title, ' ', $more);
         }
       }
 
       $event->setTitle($title);
     }
 
     if ($this->isPreview) {
       $event->setIsPreview(true);
     } else {
       $event
         ->setDateCreated($xaction->getDateCreated())
         ->setContentSource($xaction->getContentSource())
         ->setAnchor($xaction->getID());
     }
 
     $transaction_type = $xaction->getTransactionType();
     $comment_type = PhabricatorTransactions::TYPE_COMMENT;
     $is_normal_comment = ($transaction_type == $comment_type);
 
     if ($this->getShowEditActions() &&
         !$this->isPreview &&
         $is_normal_comment) {
 
       $has_deleted_comment =
         $xaction->getComment() &&
         $xaction->getComment()->getIsDeleted();
 
       $has_removed_comment =
         $xaction->getComment() &&
         $xaction->getComment()->getIsRemoved();
 
       if ($xaction->getCommentVersion() > 1 && !$has_removed_comment) {
         $event->setIsEdited(true);
       }
 
       if (!$has_removed_comment) {
         $event->setIsNormalComment(true);
       }
 
       // If we have a place for quoted text to go and this is a quotable
       // comment, pass the quote target ID to the event view.
       if ($this->getQuoteTargetID()) {
         if ($xaction->hasComment()) {
           if (!$has_removed_comment && !$has_deleted_comment) {
             $event->setQuoteTargetID($this->getQuoteTargetID());
             $event->setQuoteRef($this->getQuoteRef());
           }
         }
       }
 
       $can_edit = PhabricatorPolicyCapability::CAN_EDIT;
 
       if ($xaction->hasComment() || $has_deleted_comment) {
         $has_edit_capability = PhabricatorPolicyFilter::hasCapability(
           $viewer,
           $xaction,
           $can_edit);
         if ($has_edit_capability && !$has_removed_comment) {
           $event->setIsEditable(true);
         }
         if ($has_edit_capability || $viewer->getIsAdmin()) {
           if (!$has_removed_comment) {
             $event->setIsRemovable(true);
           }
         }
       }
     }
 
     $comment = $this->renderTransactionContent($xaction);
     if ($comment) {
       $event->appendChild($comment);
     }
 
     return $event;
   }
 
   private function shouldSuppressTitle(
     PhabricatorApplicationTransaction $xaction,
     array $group) {
 
     // This is a little hard-coded, but we don't have any other reasonable
     // cases for now. Suppress "commented on" if there are other actions in
     // the display group.
 
     if (count($group) > 1) {
       $type_comment = PhabricatorTransactions::TYPE_COMMENT;
       if ($xaction->getTransactionType() == $type_comment) {
         return true;
       }
     }
 
     return false;
   }
 
 }
diff --git a/src/view/phui/PHUITimelineEventView.php b/src/view/phui/PHUITimelineEventView.php
index e44332c1b5..79aeb454b6 100644
--- a/src/view/phui/PHUITimelineEventView.php
+++ b/src/view/phui/PHUITimelineEventView.php
@@ -1,708 +1,726 @@
 <?php
 
 final class PHUITimelineEventView extends AphrontView {
 
   const DELIMITER = " \xC2\xB7 ";
 
   private $userHandle;
   private $title;
   private $icon;
   private $color;
   private $classes = array();
   private $contentSource;
   private $dateCreated;
   private $anchor;
   private $isEditable;
   private $isEdited;
   private $isRemovable;
   private $transactionPHID;
   private $isPreview;
   private $eventGroup = array();
   private $hideByDefault;
   private $token;
   private $tokenRemoved;
   private $quoteTargetID;
   private $isNormalComment;
   private $quoteRef;
   private $reallyMajorEvent;
   private $hideCommentOptions = false;
   private $authorPHID;
   private $badges = array();
   private $pinboardItems = array();
   private $isSilent;
+  private $isMFA;
 
   public function setAuthorPHID($author_phid) {
     $this->authorPHID = $author_phid;
     return $this;
   }
 
   public function getAuthorPHID() {
     return $this->authorPHID;
   }
 
   public function setQuoteRef($quote_ref) {
     $this->quoteRef = $quote_ref;
     return $this;
   }
 
   public function getQuoteRef() {
     return $this->quoteRef;
   }
 
   public function setQuoteTargetID($quote_target_id) {
     $this->quoteTargetID = $quote_target_id;
     return $this;
   }
 
   public function getQuoteTargetID() {
     return $this->quoteTargetID;
   }
 
   public function setIsNormalComment($is_normal_comment) {
     $this->isNormalComment = $is_normal_comment;
     return $this;
   }
 
   public function getIsNormalComment() {
     return $this->isNormalComment;
   }
 
   public function setHideByDefault($hide_by_default) {
     $this->hideByDefault = $hide_by_default;
     return $this;
   }
 
   public function getHideByDefault() {
     return $this->hideByDefault;
   }
 
   public function setTransactionPHID($transaction_phid) {
     $this->transactionPHID = $transaction_phid;
     return $this;
   }
 
   public function getTransactionPHID() {
     return $this->transactionPHID;
   }
 
   public function setIsEdited($is_edited) {
     $this->isEdited = $is_edited;
     return $this;
   }
 
   public function getIsEdited() {
     return $this->isEdited;
   }
 
   public function setIsPreview($is_preview) {
     $this->isPreview = $is_preview;
     return $this;
   }
 
   public function getIsPreview() {
     return $this->isPreview;
   }
 
   public function setIsEditable($is_editable) {
     $this->isEditable = $is_editable;
     return $this;
   }
 
   public function getIsEditable() {
     return $this->isEditable;
   }
 
   public function setIsRemovable($is_removable) {
     $this->isRemovable = $is_removable;
     return $this;
   }
 
   public function getIsRemovable() {
     return $this->isRemovable;
   }
 
   public function setDateCreated($date_created) {
     $this->dateCreated = $date_created;
     return $this;
   }
 
   public function getDateCreated() {
     return $this->dateCreated;
   }
 
   public function setContentSource(PhabricatorContentSource $content_source) {
     $this->contentSource = $content_source;
     return $this;
   }
 
   public function getContentSource() {
     return $this->contentSource;
   }
 
   public function setUserHandle(PhabricatorObjectHandle $handle) {
     $this->userHandle = $handle;
     return $this;
   }
 
   public function setAnchor($anchor) {
     $this->anchor = $anchor;
     return $this;
   }
 
   public function getAnchor() {
     return $this->anchor;
   }
 
   public function setTitle($title) {
     $this->title = $title;
     return $this;
   }
 
   public function addClass($class) {
     $this->classes[] = $class;
     return $this;
   }
 
   public function addBadge(PHUIBadgeMiniView $badge) {
     $this->badges[] = $badge;
     return $this;
   }
 
   public function setIcon($icon) {
     $this->icon = $icon;
     return $this;
   }
 
   public function setColor($color) {
     $this->color = $color;
     return $this;
   }
 
   public function setIsSilent($is_silent) {
     $this->isSilent = $is_silent;
     return $this;
   }
 
   public function getIsSilent() {
     return $this->isSilent;
   }
 
+  public function setIsMFA($is_mfa) {
+    $this->isMFA = $is_mfa;
+    return $this;
+  }
+
+  public function getIsMFA() {
+    return $this->isMFA;
+  }
+
   public function setReallyMajorEvent($me) {
     $this->reallyMajorEvent = $me;
     return $this;
   }
 
   public function setHideCommentOptions($hide_comment_options) {
     $this->hideCommentOptions = $hide_comment_options;
     return $this;
   }
 
   public function getHideCommentOptions() {
     return $this->hideCommentOptions;
   }
 
   public function addPinboardItem(PHUIPinboardItemView $item) {
     $this->pinboardItems[] = $item;
     return $this;
   }
 
   public function setToken($token, $removed = false) {
     $this->token = $token;
     $this->tokenRemoved = $removed;
     return $this;
   }
 
   public function getEventGroup() {
     return array_merge(array($this), $this->eventGroup);
   }
 
   public function addEventToGroup(PHUITimelineEventView $event) {
     $this->eventGroup[] = $event;
     return $this;
   }
 
   protected function shouldRenderEventTitle() {
     if ($this->title === null) {
       return false;
     }
 
     return true;
   }
 
   protected function renderEventTitle($force_icon, $has_menu, $extra) {
     $title = $this->title;
 
     $title_classes = array();
     $title_classes[] = 'phui-timeline-title';
 
     $icon = null;
     if ($this->icon || $force_icon) {
       $title_classes[] = 'phui-timeline-title-with-icon';
     }
 
     if ($has_menu) {
       $title_classes[] = 'phui-timeline-title-with-menu';
     }
 
     if ($this->icon) {
       $fill_classes = array();
       $fill_classes[] = 'phui-timeline-icon-fill';
       if ($this->color) {
         $fill_classes[] = 'fill-has-color';
         $fill_classes[] = 'phui-timeline-icon-fill-'.$this->color;
       }
 
       $icon = id(new PHUIIconView())
         ->setIcon($this->icon)
         ->addClass('phui-timeline-icon');
 
       $icon = phutil_tag(
         'span',
         array(
           'class' => implode(' ', $fill_classes),
         ),
         $icon);
     }
 
     $token = null;
     if ($this->token) {
       $token = id(new PHUIIconView())
         ->addClass('phui-timeline-token')
         ->setSpriteSheet(PHUIIconView::SPRITE_TOKENS)
         ->setSpriteIcon($this->token);
       if ($this->tokenRemoved) {
         $token->addClass('strikethrough');
       }
     }
 
     $title = phutil_tag(
       'div',
       array(
         'class' => implode(' ', $title_classes),
       ),
       array($icon, $token, $title, $extra));
 
     return $title;
   }
 
   public function render() {
 
     $events = $this->getEventGroup();
 
     // Move events with icons first.
     $icon_keys = array();
     foreach ($this->getEventGroup() as $key => $event) {
       if ($event->icon) {
         $icon_keys[] = $key;
       }
     }
     $events = array_select_keys($events, $icon_keys) + $events;
     $force_icon = (bool)$icon_keys;
 
     $menu = null;
     $items = array();
     if (!$this->getIsPreview() && !$this->getHideCommentOptions()) {
       foreach ($this->getEventGroup() as $event) {
         $items[] = $event->getMenuItems($this->anchor);
       }
       $items = array_mergev($items);
     }
 
     if ($items) {
       $icon = id(new PHUIIconView())
         ->setIcon('fa-caret-down');
       $aural = javelin_tag(
         'span',
         array(
           'aural' => true,
         ),
         pht('Comment Actions'));
 
       if ($items) {
         $sigil = 'phui-dropdown-menu';
         Javelin::initBehavior('phui-dropdown-menu');
       } else {
         $sigil = null;
       }
 
       $action_list = id(new PhabricatorActionListView())
         ->setUser($this->getUser());
       foreach ($items as $item) {
         $action_list->addAction($item);
       }
 
       $menu = javelin_tag(
         $items ? 'a' : 'span',
         array(
           'href' => '#',
           'class' => 'phui-timeline-menu',
           'sigil' => $sigil,
           'aria-haspopup' => 'true',
           'aria-expanded' => 'false',
           'meta' => $action_list->getDropdownMenuMetadata(),
         ),
         array(
           $aural,
           $icon,
         ));
 
       $has_menu = true;
     } else {
       $has_menu = false;
     }
 
     // Render "extra" information (timestamp, etc).
     $extra = $this->renderExtra($events);
 
     $show_badges = false;
 
     $group_titles = array();
     $group_items = array();
     $group_children = array();
     foreach ($events as $event) {
       if ($event->shouldRenderEventTitle()) {
 
         // Render the group anchor here, outside the title box. If we render
         // it inside the title box it ends up completely hidden and Chrome 55
         // refuses to jump to it. See T11997 for discussion.
 
         if ($extra && $this->anchor) {
           $group_titles[] = id(new PhabricatorAnchorView())
             ->setAnchorName($this->anchor)
             ->render();
         }
 
         $group_titles[] = $event->renderEventTitle(
           $force_icon,
           $has_menu,
           $extra);
 
         // Don't render this information more than once.
         $extra = null;
       }
 
       if ($event->hasChildren()) {
         $group_children[] = $event->renderChildren();
         $show_badges = true;
       }
     }
 
     $image_uri = $this->userHandle->getImageURI();
 
     $wedge = phutil_tag(
       'div',
       array(
         'class' => 'phui-timeline-wedge phui-timeline-border',
         'style' => (nonempty($image_uri)) ? '' : 'display: none;',
       ),
       '');
 
     $image = null;
     $badges = null;
     if ($image_uri) {
       $image = phutil_tag(
         ($this->userHandle->getURI()) ? 'a' : 'div',
         array(
           'style' => 'background-image: url('.$image_uri.')',
           'class' => 'phui-timeline-image visual-only',
           'href' => $this->userHandle->getURI(),
         ),
         '');
       if ($this->badges && $show_badges) {
         $flex = new PHUIBadgeBoxView();
         $flex->addItems($this->badges);
         $flex->setCollapsed(true);
         $badges = phutil_tag(
           'div',
           array(
             'class' => 'phui-timeline-badges',
           ),
           $flex);
       }
     }
 
     $content_classes = array();
     $content_classes[] = 'phui-timeline-content';
 
     $classes = array();
     $classes[] = 'phui-timeline-event-view';
     if ($group_children) {
       $classes[] = 'phui-timeline-major-event';
       $content = phutil_tag(
         'div',
         array(
           'class' => 'phui-timeline-inner-content',
         ),
         array(
           $group_titles,
           $menu,
           phutil_tag(
             'div',
             array(
               'class' => 'phui-timeline-core-content',
             ),
             $group_children),
         ));
     } else {
       $classes[] = 'phui-timeline-minor-event';
       $content = $group_titles;
     }
 
     $content = phutil_tag(
       'div',
       array(
         'class' => 'phui-timeline-group phui-timeline-border',
       ),
       $content);
 
     // Image Events
     $pinboard = null;
     if ($this->pinboardItems) {
       $pinboard = new PHUIPinboardView();
       foreach ($this->pinboardItems as $item) {
         $pinboard->addItem($item);
       }
     }
 
     $content = phutil_tag(
       'div',
       array(
         'class' => implode(' ', $content_classes),
       ),
       array($image, $badges, $wedge, $content, $pinboard));
 
     $outer_classes = $this->classes;
     $outer_classes[] = 'phui-timeline-shell';
     $color = null;
     foreach ($this->getEventGroup() as $event) {
       if ($event->color) {
         $color = $event->color;
         break;
       }
     }
 
     if ($color) {
       $outer_classes[] = 'phui-timeline-'.$color;
     }
 
     $sigil = null;
     $meta = null;
     if ($this->getTransactionPHID()) {
       $sigil = 'transaction';
       $meta = array(
         'phid' => $this->getTransactionPHID(),
         'anchor' => $this->anchor,
       );
     }
 
     $major_event = null;
     if ($this->reallyMajorEvent) {
       $major_event = phutil_tag(
         'div',
         array(
           'class' => 'phui-timeline-event-view '.
                      'phui-timeline-spacer '.
                      'phui-timeline-spacer-bold',
           '',
         ));
     }
 
     return array(
       javelin_tag(
         'div',
         array(
           'class' => implode(' ', $outer_classes),
           'id' => $this->anchor ? 'anchor-'.$this->anchor : null,
           'sigil' => $sigil,
           'meta' => $meta,
         ),
         phutil_tag(
           'div',
           array(
             'class' => implode(' ', $classes),
           ),
           $content)),
       $major_event,
     );
   }
 
   private function renderExtra(array $events) {
     $extra = array();
 
     if ($this->getIsPreview()) {
       $extra[] = pht('PREVIEW');
     } else {
       foreach ($events as $event) {
         if ($event->getIsEdited()) {
           $extra[] = pht('Edited');
           break;
         }
       }
 
       $source = $this->getContentSource();
       $content_source = null;
       if ($source) {
         $content_source = id(new PhabricatorContentSourceView())
           ->setContentSource($source)
           ->setUser($this->getUser());
         $content_source = pht('Via %s', $content_source->getSourceName());
       }
 
       $date_created = null;
       foreach ($events as $event) {
         if ($event->getDateCreated()) {
           if ($date_created === null) {
             $date_created = $event->getDateCreated();
           } else {
             $date_created = min($event->getDateCreated(), $date_created);
           }
         }
       }
 
       if ($date_created) {
         $date = phabricator_datetime(
           $date_created,
           $this->getUser());
         if ($this->anchor) {
           Javelin::initBehavior('phabricator-watch-anchor');
           Javelin::initBehavior('phabricator-tooltips');
 
           $date = array(
             javelin_tag(
               'a',
               array(
                 'href' => '#'.$this->anchor,
                 'sigil' => 'has-tooltip',
                 'meta' => array(
                   'tip' => $content_source,
                 ),
               ),
               $date),
           );
         }
         $extra[] = $date;
       }
 
       // If this edit was applied silently, give user a hint that they should
       // not expect to have received any mail or notifications.
       if ($this->getIsSilent()) {
         $extra[] = id(new PHUIIconView())
           ->setIcon('fa-bell-slash', 'red')
           ->setTooltip(pht('Silent Edit'));
       }
+
+      // If this edit was applied while the actor was in high-security mode,
+      // provide a hint that it was extra authentic.
+      if ($this->getIsMFA()) {
+        $extra[] = id(new PHUIIconView())
+          ->setIcon('fa-vcard', 'green')
+          ->setTooltip(pht('MFA Authenticated'));
+      }
     }
 
     $extra = javelin_tag(
       'span',
       array(
         'class' => 'phui-timeline-extra',
       ),
       phutil_implode_html(
         javelin_tag(
           'span',
           array(
             'aural' => false,
           ),
           self::DELIMITER),
         $extra));
 
     return $extra;
   }
 
   private function getMenuItems($anchor) {
     $xaction_phid = $this->getTransactionPHID();
 
     $items = array();
 
     if ($this->getIsEditable()) {
       $items[] = id(new PhabricatorActionView())
         ->setIcon('fa-pencil')
         ->setHref('/transactions/edit/'.$xaction_phid.'/')
         ->setName(pht('Edit Comment'))
         ->addSigil('transaction-edit')
         ->setMetadata(
           array(
             'anchor' => $anchor,
           ));
     }
 
     if ($this->getQuoteTargetID()) {
       $ref = null;
       if ($this->getQuoteRef()) {
         $ref = $this->getQuoteRef();
         if ($anchor) {
           $ref = $ref.'#'.$anchor;
         }
       }
 
       $items[] = id(new PhabricatorActionView())
         ->setIcon('fa-quote-left')
         ->setName(pht('Quote Comment'))
         ->setHref('#')
         ->addSigil('transaction-quote')
         ->setMetadata(
           array(
             'targetID' => $this->getQuoteTargetID(),
             'uri' => '/transactions/quote/'.$xaction_phid.'/',
             'ref' => $ref,
           ));
     }
 
     if ($this->getIsNormalComment()) {
       $items[] = id(new PhabricatorActionView())
         ->setIcon('fa-code')
         ->setHref('/transactions/raw/'.$xaction_phid.'/')
         ->setName(pht('View Remarkup'))
         ->addSigil('transaction-raw')
         ->setMetadata(
           array(
             'anchor' => $anchor,
           ));
 
       $content_source = $this->getContentSource();
       $source_email = PhabricatorEmailContentSource::SOURCECONST;
       if ($content_source->getSource() == $source_email) {
         $source_id = $content_source->getContentSourceParameter('id');
         if ($source_id) {
           $items[] = id(new PhabricatorActionView())
             ->setIcon('fa-envelope-o')
             ->setHref('/transactions/raw/'.$xaction_phid.'/?email')
             ->setName(pht('View Email Body'))
             ->addSigil('transaction-raw')
             ->setMetadata(
               array(
                 'anchor' => $anchor,
               ));
         }
       }
     }
 
     if ($this->getIsEdited()) {
       $items[] = id(new PhabricatorActionView())
         ->setIcon('fa-list')
         ->setHref('/transactions/history/'.$xaction_phid.'/')
         ->setName(pht('View Edit History'))
         ->setWorkflow(true);
     }
 
     if ($this->getIsRemovable()) {
       $items[] = id(new PhabricatorActionView())
         ->setType(PhabricatorActionView::TYPE_DIVIDER);
 
       $items[] = id(new PhabricatorActionView())
         ->setIcon('fa-trash-o')
         ->setHref('/transactions/remove/'.$xaction_phid.'/')
         ->setName(pht('Remove Comment'))
         ->setColor(PhabricatorActionView::RED)
         ->addSigil('transaction-remove')
         ->setMetadata(
           array(
             'anchor' => $anchor,
           ));
 
     }
 
     return $items;
   }
 
 }