diff --git a/src/applications/auth/controller/PhabricatorAuthController.php b/src/applications/auth/controller/PhabricatorAuthController.php
index 0ed86e3056..4d7644e2d1 100644
--- a/src/applications/auth/controller/PhabricatorAuthController.php
+++ b/src/applications/auth/controller/PhabricatorAuthController.php
@@ -1,295 +1,304 @@
 <?php
 
 abstract class PhabricatorAuthController extends PhabricatorController {
 
   protected function renderErrorPage($title, array $messages) {
     $view = new PHUIInfoView();
     $view->setTitle($title);
     $view->setErrors($messages);
 
     return $this->newPage()
       ->setTitle($title)
       ->appendChild($view);
 
   }
 
   /**
    * Returns true if this install is newly setup (i.e., there are no user
    * accounts yet). In this case, we enter a special mode to permit creation
    * of the first account form the web UI.
    */
   protected function isFirstTimeSetup() {
     // If there are any auth providers, this isn't first time setup, even if
     // we don't have accounts.
     if (PhabricatorAuthProvider::getAllEnabledProviders()) {
       return false;
     }
 
     // Otherwise, check if there are any user accounts. If not, we're in first
     // time setup.
     $any_users = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->setLimit(1)
       ->execute();
 
     return !$any_users;
   }
 
 
   /**
    * Log a user into a web session and return an @{class:AphrontResponse} which
    * corresponds to continuing the login process.
    *
    * Normally, this is a redirect to the validation controller which makes sure
    * the user's cookies are set. However, event listeners can intercept this
    * event and do something else if they prefer.
    *
    * @param   PhabricatorUser   User to log the viewer in as.
+   * @param bool True to issue a full session immediately, bypassing MFA.
    * @return  AphrontResponse   Response which continues the login process.
    */
-  protected function loginUser(PhabricatorUser $user) {
+  protected function loginUser(
+    PhabricatorUser $user,
+    $force_full_session = false) {
 
     $response = $this->buildLoginValidateResponse($user);
     $session_type = PhabricatorAuthSession::TYPE_WEB;
 
     $event_type = PhabricatorEventType::TYPE_AUTH_WILLLOGINUSER;
     $event_data = array(
       'user'        => $user,
       'type'        => $session_type,
       'response'    => $response,
       'shouldLogin' => true,
     );
 
     $event = id(new PhabricatorEvent($event_type, $event_data))
       ->setUser($user);
     PhutilEventEngine::dispatchEvent($event);
 
     $should_login = $event->getValue('shouldLogin');
     if ($should_login) {
+      if ($force_full_session) {
+        $partial_session = false;
+      } else {
+        $partial_session = true;
+      }
+
       $session_key = id(new PhabricatorAuthSessionEngine())
-        ->establishSession($session_type, $user->getPHID(), $partial = true);
+        ->establishSession($session_type, $user->getPHID(), $partial_session);
 
       // NOTE: We allow disabled users to login and roadblock them later, so
       // there's no check for users being disabled here.
 
       $request = $this->getRequest();
       $request->setCookie(
         PhabricatorCookies::COOKIE_USERNAME,
         $user->getUsername());
       $request->setCookie(
         PhabricatorCookies::COOKIE_SESSION,
         $session_key);
 
       $this->clearRegistrationCookies();
     }
 
     return $event->getValue('response');
   }
 
   protected function clearRegistrationCookies() {
     $request = $this->getRequest();
 
     // Clear the registration key.
     $request->clearCookie(PhabricatorCookies::COOKIE_REGISTRATION);
 
     // Clear the client ID / OAuth state key.
     $request->clearCookie(PhabricatorCookies::COOKIE_CLIENTID);
 
     // Clear the invite cookie.
     $request->clearCookie(PhabricatorCookies::COOKIE_INVITE);
   }
 
   private function buildLoginValidateResponse(PhabricatorUser $user) {
     $validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
     $validate_uri->setQueryParam('expect', $user->getUsername());
 
     return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
   }
 
   protected function renderError($message) {
     return $this->renderErrorPage(
       pht('Authentication Error'),
       array(
         $message,
       ));
   }
 
   protected function loadAccountForRegistrationOrLinking($account_key) {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $account = null;
     $provider = null;
     $response = null;
 
     if (!$account_key) {
       $response = $this->renderError(
         pht('Request did not include account key.'));
       return array($account, $provider, $response);
     }
 
     // NOTE: We're using the omnipotent user because the actual user may not
     // be logged in yet, and because we want to tailor an error message to
     // distinguish between "not usable" and "does not exist". We do explicit
     // checks later on to make sure this account is valid for the intended
     // operation. This requires edit permission for completeness and consistency
     // but it won't actually be meaningfully checked because we're using the
     // omnipotent user.
 
     $account = id(new PhabricatorExternalAccountQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withAccountSecrets(array($account_key))
       ->needImages(true)
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->executeOne();
 
     if (!$account) {
       $response = $this->renderError(pht('No valid linkable account.'));
       return array($account, $provider, $response);
     }
 
     if ($account->getUserPHID()) {
       if ($account->getUserPHID() != $viewer->getPHID()) {
         $response = $this->renderError(
           pht(
             'The account you are attempting to register or link is already '.
             'linked to another user.'));
       } else {
         $response = $this->renderError(
           pht(
             'The account you are attempting to link is already linked '.
             'to your account.'));
       }
       return array($account, $provider, $response);
     }
 
     $registration_key = $request->getCookie(
       PhabricatorCookies::COOKIE_REGISTRATION);
 
     // NOTE: This registration key check is not strictly necessary, because
     // we're only creating new accounts, not linking existing accounts. It
     // might be more hassle than it is worth, especially for email.
     //
     // The attack this prevents is getting to the registration screen, then
     // copy/pasting the URL and getting someone else to click it and complete
     // the process. They end up with an account bound to credentials you
     // control. This doesn't really let you do anything meaningful, though,
     // since you could have simply completed the process yourself.
 
     if (!$registration_key) {
       $response = $this->renderError(
         pht(
           'Your browser did not submit a registration key with the request. '.
           'You must use the same browser to begin and complete registration. '.
           'Check that cookies are enabled and try again.'));
       return array($account, $provider, $response);
     }
 
     // We store the digest of the key rather than the key itself to prevent a
     // theoretical attacker with read-only access to the database from
     // hijacking registration sessions.
 
     $actual = $account->getProperty('registrationKey');
     $expect = PhabricatorHash::weakDigest($registration_key);
     if (!phutil_hashes_are_identical($actual, $expect)) {
       $response = $this->renderError(
         pht(
           'Your browser submitted a different registration key than the one '.
           'associated with this account. You may need to clear your cookies.'));
       return array($account, $provider, $response);
     }
 
     $other_account = id(new PhabricatorExternalAccount())->loadAllWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s
         AND id != %d',
       $account->getAccountType(),
       $account->getAccountDomain(),
       $account->getAccountID(),
       $account->getID());
 
     if ($other_account) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with already belongs '.
           'to another user.'));
       return array($account, $provider, $response);
     }
 
     $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
       $account->getProviderKey());
 
     if (!$provider) {
       $response = $this->renderError(
         pht(
           'The account you are attempting to register with uses a nonexistent '.
           'or disabled authentication provider (with key "%s"). An '.
           'administrator may have recently disabled this provider.',
           $account->getProviderKey()));
       return array($account, $provider, $response);
     }
 
     return array($account, $provider, null);
   }
 
   protected function loadInvite() {
     $invite_cookie = PhabricatorCookies::COOKIE_INVITE;
     $invite_code = $this->getRequest()->getCookie($invite_cookie);
     if (!$invite_code) {
       return null;
     }
 
     $engine = id(new PhabricatorAuthInviteEngine())
       ->setViewer($this->getViewer())
       ->setUserHasConfirmedVerify(true);
 
     try {
       return $engine->processInviteCode($invite_code);
     } catch (Exception $ex) {
       // If this fails for any reason, just drop the invite. In normal
       // circumstances, we gave them a detailed explanation of any error
       // before they jumped into this workflow.
       return null;
     }
   }
 
   protected function renderInviteHeader(PhabricatorAuthInvite $invite) {
     $viewer = $this->getViewer();
 
     // Since the user hasn't registered yet, they may not be able to see other
     // user accounts. Load the inviting user with the omnipotent viewer.
     $omnipotent_viewer = PhabricatorUser::getOmnipotentUser();
 
     $invite_author = id(new PhabricatorPeopleQuery())
       ->setViewer($omnipotent_viewer)
       ->withPHIDs(array($invite->getAuthorPHID()))
       ->needProfileImage(true)
       ->executeOne();
 
     // If we can't load the author for some reason, just drop this message.
     // We lose the value of contextualizing things without author details.
     if (!$invite_author) {
       return null;
     }
 
     $invite_item = id(new PHUIObjectItemView())
       ->setHeader(pht('Welcome to Phabricator!'))
       ->setImageURI($invite_author->getProfileImageURI())
       ->addAttribute(
         pht(
           '%s has invited you to join Phabricator.',
           $invite_author->getFullName()));
 
     $invite_list = id(new PHUIObjectItemListView())
       ->addItem($invite_item)
       ->setFlush(true);
 
     return id(new PHUIBoxView())
       ->addMargin(PHUI::MARGIN_LARGE)
       ->appendChild($invite_list);
   }
 
 }
diff --git a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
index 9f74d50765..0cac95f53d 100644
--- a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
+++ b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
@@ -1,204 +1,209 @@
 <?php
 
 final class PhabricatorAuthOneTimeLoginController
   extends PhabricatorAuthController {
 
   public function shouldRequireLogin() {
     return false;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
     $id = $request->getURIData('id');
     $link_type = $request->getURIData('type');
     $key = $request->getURIData('key');
     $email_id = $request->getURIData('emailID');
 
     if ($request->getUser()->isLoggedIn()) {
       return $this->renderError(
         pht('You are already logged in.'));
     }
 
     $target_user = id(new PhabricatorPeopleQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withIDs(array($id))
       ->executeOne();
     if (!$target_user) {
       return new Aphront404Response();
     }
 
     // NOTE: As a convenience to users, these one-time login URIs may also
     // be associated with an email address which will be verified when the
     // URI is used.
 
     // This improves the new user experience for users receiving "Welcome"
     // emails on installs that require verification: if we did not verify the
     // email, they'd immediately get roadblocked with a "Verify Your Email"
     // error and have to go back to their email account, wait for a
     // "Verification" email, and then click that link to actually get access to
     // their account. This is hugely unwieldy, and if the link was only sent
     // to the user's email in the first place we can safely verify it as a
     // side effect of login.
 
     // The email hashed into the URI so users can't verify some email they
     // do not own by doing this:
     //
     //  - Add some address you do not own;
     //  - request a password reset;
     //  - change the URI in the email to the address you don't own;
     //  - login via the email link; and
     //  - get a "verified" address you don't control.
 
     $target_email = null;
     if ($email_id) {
       $target_email = id(new PhabricatorUserEmail())->loadOneWhere(
         'userPHID = %s AND id = %d',
         $target_user->getPHID(),
         $email_id);
       if (!$target_email) {
         return new Aphront404Response();
       }
     }
 
     $engine = new PhabricatorAuthSessionEngine();
     $token = $engine->loadOneTimeLoginKey(
       $target_user,
       $target_email,
       $key);
 
     if (!$token) {
       return $this->newDialog()
         ->setTitle(pht('Unable to Log In'))
         ->setShortTitle(pht('Login Failure'))
         ->appendParagraph(
           pht(
             'The login link you clicked is invalid, out of date, or has '.
             'already been used.'))
         ->appendParagraph(
           pht(
             'Make sure you are copy-and-pasting the entire link into '.
             'your browser. Login links are only valid for 24 hours, and '.
             'can only be used once.'))
         ->appendParagraph(
           pht('You can try again, or request a new link via email.'))
         ->addCancelButton('/login/email/', pht('Send Another Email'));
     }
 
     if (!$target_user->canEstablishWebSessions()) {
       return $this->newDialog()
         ->setTitle(pht('Unable to Establish Web Session'))
         ->setShortTitle(pht('Login Failure'))
         ->appendParagraph(
           pht(
             'You are trying to gain access to an account ("%s") that can not '.
             'establish a web session.',
             $target_user->getUsername()))
         ->appendParagraph(
           pht(
             'Special users like daemons and mailing lists are not permitted '.
             'to log in via the web. Log in as a normal user instead.'))
         ->addCancelButton('/');
     }
 
     if ($request->isFormPost()) {
       // If we have an email bound into this URI, verify email so that clicking
       // the link in the "Welcome" email is good enough, without requiring users
       // to go through a second round of email verification.
 
       $editor = id(new PhabricatorUserEditor())
         ->setActor($target_user);
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         // Nuke the token and all other outstanding password reset tokens.
         // There is no particular security benefit to destroying them all, but
         // it should reduce HackerOne reports of nebulous harm.
         $editor->revokePasswordResetLinks($target_user);
 
         if ($target_email) {
           $editor->verifyEmail($target_user, $target_email);
         }
       unset($unguarded);
 
       $next = '/';
       if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
         $next = '/settings/panel/external/';
       } else {
 
         // We're going to let the user reset their password without knowing
         // the old one. Generate a one-time token for that.
         $key = Filesystem::readRandomCharacters(16);
         $password_type =
           PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE;
 
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
           id(new PhabricatorAuthTemporaryToken())
             ->setTokenResource($target_user->getPHID())
             ->setTokenType($password_type)
             ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
             ->setTokenCode(PhabricatorHash::weakDigest($key))
             ->save();
         unset($unguarded);
 
         $panel_uri = '/auth/password/';
 
         $next = (string)id(new PhutilURI($panel_uri))
           ->setQueryParams(
             array(
               'key' => $key,
             ));
 
         $request->setTemporaryCookie(PhabricatorCookies::COOKIE_HISEC, 'yes');
       }
 
       PhabricatorCookies::setNextURICookie($request, $next, $force = true);
 
-      return $this->loginUser($target_user);
+      $force_full_session = false;
+      if ($link_type === PhabricatorAuthSessionEngine::ONETIME_RECOVER) {
+        $force_full_session = $token->getShouldForceFullSession();
+      }
+
+      return $this->loginUser($target_user, $force_full_session);
     }
 
     // NOTE: We need to CSRF here so attackers can't generate an email link,
     // then log a user in to an account they control via sneaky invisible
     // form submissions.
 
     switch ($link_type) {
       case PhabricatorAuthSessionEngine::ONETIME_WELCOME:
         $title = pht('Welcome to Phabricator');
         break;
       case PhabricatorAuthSessionEngine::ONETIME_RECOVER:
         $title = pht('Account Recovery');
         break;
       case PhabricatorAuthSessionEngine::ONETIME_USERNAME:
       case PhabricatorAuthSessionEngine::ONETIME_RESET:
       default:
         $title = pht('Log in to Phabricator');
         break;
     }
 
     $body = array();
     $body[] = pht(
       'Use the button below to log in as: %s',
       phutil_tag('strong', array(), $target_user->getUsername()));
 
     if ($target_email && !$target_email->getIsVerified()) {
       $body[] = pht(
         'Logging in will verify %s as an email address you own.',
         phutil_tag('strong', array(), $target_email->getAddress()));
 
     }
 
     $body[] = pht(
       'After logging in you should set a password for your account, or '.
       'link your account to an external account that you can use to '.
       'authenticate in the future.');
 
     $dialog = $this->newDialog()
       ->setTitle($title)
       ->addSubmitButton(pht('Log In (%s)', $target_user->getUsername()))
       ->addCancelButton('/');
 
     foreach ($body as $paragraph) {
       $dialog->appendParagraph($paragraph);
     }
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 }
diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
index 8381e01950..cc317c894d 100644
--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
@@ -1,1085 +1,1089 @@
 <?php
 
 /**
  *
  * @task use      Using Sessions
  * @task new      Creating Sessions
  * @task hisec    High Security
  * @task partial  Partial Sessions
  * @task onetime  One Time Login URIs
  * @task cache    User Cache
  */
 final class PhabricatorAuthSessionEngine extends Phobject {
 
   /**
    * Session issued to normal users after they login through a standard channel.
    * Associates the client with a standard user identity.
    */
   const KIND_USER      = 'U';
 
 
   /**
    * Session issued to users who login with some sort of credentials but do not
    * have full accounts. These are sometimes called "grey users".
    *
    * TODO: We do not currently issue these sessions, see T4310.
    */
   const KIND_EXTERNAL  = 'X';
 
 
   /**
    * Session issued to logged-out users which has no real identity information.
    * Its purpose is to protect logged-out users from CSRF.
    */
   const KIND_ANONYMOUS = 'A';
 
 
   /**
    * Session kind isn't known.
    */
   const KIND_UNKNOWN   = '?';
 
 
   const ONETIME_RECOVER = 'recover';
   const ONETIME_RESET = 'reset';
   const ONETIME_WELCOME = 'welcome';
   const ONETIME_USERNAME = 'rename';
 
 
   private $workflowKey;
 
   public function setWorkflowKey($workflow_key) {
     $this->workflowKey = $workflow_key;
     return $this;
   }
 
   public function getWorkflowKey() {
 
     // TODO: A workflow key should become required in order to issue an MFA
     // challenge, but allow things to keep working for now until we can update
     // callsites.
     if ($this->workflowKey === null) {
       return 'legacy';
     }
 
     return $this->workflowKey;
   }
 
 
   /**
    * Get the session kind (e.g., anonymous, user, external account) from a
    * session token. Returns a `KIND_` constant.
    *
    * @param   string  Session token.
    * @return  const   Session kind constant.
    */
   public static function getSessionKindFromToken($session_token) {
     if (strpos($session_token, '/') === false) {
       // Old-style session, these are all user sessions.
       return self::KIND_USER;
     }
 
     list($kind, $key) = explode('/', $session_token, 2);
 
     switch ($kind) {
       case self::KIND_ANONYMOUS:
       case self::KIND_USER:
       case self::KIND_EXTERNAL:
         return $kind;
       default:
         return self::KIND_UNKNOWN;
     }
   }
 
 
   /**
    * Load the user identity associated with a session of a given type,
    * identified by token.
    *
    * When the user presents a session token to an API, this method verifies
    * it is of the correct type and loads the corresponding identity if the
    * session exists and is valid.
    *
    * NOTE: `$session_type` is the type of session that is required by the
    * loading context. This prevents use of a Conduit sesssion as a Web
    * session, for example.
    *
    * @param const The type of session to load.
    * @param string The session token.
    * @return PhabricatorUser|null
    * @task use
    */
   public function loadUserForSession($session_type, $session_token) {
     $session_kind = self::getSessionKindFromToken($session_token);
     switch ($session_kind) {
       case self::KIND_ANONYMOUS:
         // Don't bother trying to load a user for an anonymous session, since
         // neither the session nor the user exist.
         return null;
       case self::KIND_UNKNOWN:
         // If we don't know what kind of session this is, don't go looking for
         // it.
         return null;
       case self::KIND_USER:
         break;
       case self::KIND_EXTERNAL:
         // TODO: Implement these (T4310).
         return null;
     }
 
     $session_table = new PhabricatorAuthSession();
     $user_table = new PhabricatorUser();
     $conn = $session_table->establishConnection('r');
 
     // TODO: See T13225. We're moving sessions to a more modern digest
     // algorithm, but still accept older cookies for compatibility.
     $session_key = PhabricatorAuthSession::newSessionDigest(
       new PhutilOpaqueEnvelope($session_token));
     $weak_key = PhabricatorHash::weakDigest($session_token);
 
     $cache_parts = $this->getUserCacheQueryParts($conn);
     list($cache_selects, $cache_joins, $cache_map, $types_map) = $cache_parts;
 
     $info = queryfx_one(
       $conn,
       'SELECT
           s.id AS s_id,
           s.phid AS s_phid,
           s.sessionExpires AS s_sessionExpires,
           s.sessionStart AS s_sessionStart,
           s.highSecurityUntil AS s_highSecurityUntil,
           s.isPartial AS s_isPartial,
           s.signedLegalpadDocuments as s_signedLegalpadDocuments,
           IF(s.sessionKey = %P, 1, 0) as s_weak,
           u.*
           %Q
         FROM %R u JOIN %R s ON u.phid = s.userPHID
         AND s.type = %s AND s.sessionKey IN (%P, %P) %Q',
       new PhutilOpaqueEnvelope($weak_key),
       $cache_selects,
       $user_table,
       $session_table,
       $session_type,
       new PhutilOpaqueEnvelope($session_key),
       new PhutilOpaqueEnvelope($weak_key),
       $cache_joins);
 
     if (!$info) {
       return null;
     }
 
     // TODO: Remove this, see T13225.
     $is_weak = (bool)$info['s_weak'];
     unset($info['s_weak']);
 
     $session_dict = array(
       'userPHID' => $info['phid'],
       'sessionKey' => $session_key,
       'type' => $session_type,
     );
 
     $cache_raw = array_fill_keys($cache_map, null);
     foreach ($info as $key => $value) {
       if (strncmp($key, 's_', 2) === 0) {
         unset($info[$key]);
         $session_dict[substr($key, 2)] = $value;
         continue;
       }
 
       if (isset($cache_map[$key])) {
         unset($info[$key]);
         $cache_raw[$cache_map[$key]] = $value;
         continue;
       }
     }
 
     $user = $user_table->loadFromArray($info);
 
     $cache_raw = $this->filterRawCacheData($user, $types_map, $cache_raw);
     $user->attachRawCacheData($cache_raw);
 
     switch ($session_type) {
       case PhabricatorAuthSession::TYPE_WEB:
         // Explicitly prevent bots and mailing lists from establishing web
         // sessions. It's normally impossible to attach authentication to these
         // accounts, and likewise impossible to generate sessions, but it's
         // technically possible that a session could exist in the database. If
         // one does somehow, refuse to load it.
         if (!$user->canEstablishWebSessions()) {
           return null;
         }
         break;
     }
 
     $session = id(new PhabricatorAuthSession())->loadFromArray($session_dict);
 
     $ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     // If more than 20% of the time on this session has been used, refresh the
     // TTL back up to the full duration. The idea here is that sessions are
     // good forever if used regularly, but get GC'd when they fall out of use.
 
     // NOTE: If we begin rotating session keys when extending sessions, the
     // CSRF code needs to be updated so CSRF tokens survive session rotation.
 
     if (time() + (0.80 * $ttl) > $session->getSessionExpires()) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionExpires = UNIX_TIMESTAMP() + %d WHERE id = %d',
           $session->getTableName(),
           $ttl,
           $session->getID());
       unset($unguarded);
     }
 
     // TODO: Remove this, see T13225.
     if ($is_weak) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $conn_w = $session_table->establishConnection('w');
         queryfx(
           $conn_w,
           'UPDATE %T SET sessionKey = %P WHERE id = %d',
           $session->getTableName(),
           new PhutilOpaqueEnvelope($session_key),
           $session->getID());
       unset($unguarded);
     }
 
     $user->attachSession($session);
     return $user;
   }
 
 
   /**
    * Issue a new session key for a given identity. Phabricator supports
    * different types of sessions (like "web" and "conduit") and each session
    * type may have multiple concurrent sessions (this allows a user to be
    * logged in on multiple browsers at the same time, for instance).
    *
    * Note that this method is transport-agnostic and does not set cookies or
    * issue other types of tokens, it ONLY generates a new session key.
    *
    * You can configure the maximum number of concurrent sessions for various
    * session types in the Phabricator configuration.
    *
    * @param   const     Session type constant (see
    *                    @{class:PhabricatorAuthSession}).
    * @param   phid|null Identity to establish a session for, usually a user
    *                    PHID. With `null`, generates an anonymous session.
    * @param   bool      True to issue a partial session.
    * @return  string    Newly generated session key.
    */
   public function establishSession($session_type, $identity_phid, $partial) {
     // Consume entropy to generate a new session key, forestalling the eventual
     // heat death of the universe.
     $session_key = Filesystem::readRandomCharacters(40);
 
     if ($identity_phid === null) {
       return self::KIND_ANONYMOUS.'/'.$session_key;
     }
 
     $session_table = new PhabricatorAuthSession();
     $conn_w = $session_table->establishConnection('w');
 
     // This has a side effect of validating the session type.
     $session_ttl = PhabricatorAuthSession::getSessionTypeTTL($session_type);
 
     $digest_key = PhabricatorAuthSession::newSessionDigest(
       new PhutilOpaqueEnvelope($session_key));
 
     // Logging-in users don't have CSRF stuff yet, so we have to unguard this
     // write.
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       id(new PhabricatorAuthSession())
         ->setUserPHID($identity_phid)
         ->setType($session_type)
         ->setSessionKey($digest_key)
         ->setSessionStart(time())
         ->setSessionExpires(time() + $session_ttl)
         ->setIsPartial($partial ? 1 : 0)
         ->setSignedLegalpadDocuments(0)
         ->save();
 
       $log = PhabricatorUserLog::initializeNewLog(
         null,
         $identity_phid,
         ($partial
           ? PhabricatorUserLog::ACTION_LOGIN_PARTIAL
           : PhabricatorUserLog::ACTION_LOGIN));
 
       $log->setDetails(
         array(
           'session_type' => $session_type,
         ));
       $log->setSession($digest_key);
       $log->save();
     unset($unguarded);
 
     $info = id(new PhabricatorAuthSessionInfo())
       ->setSessionType($session_type)
       ->setIdentityPHID($identity_phid)
       ->setIsPartial($partial);
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didEstablishSession($info);
     }
 
     return $session_key;
   }
 
 
   /**
    * Terminate all of a user's login sessions.
    *
    * This is used when users change passwords, linked accounts, or add
    * multifactor authentication.
    *
    * @param PhabricatorUser User whose sessions should be terminated.
    * @param string|null Optionally, one session to keep. Normally, the current
    *   login session.
    *
    * @return void
    */
   public function terminateLoginSessions(
     PhabricatorUser $user,
     PhutilOpaqueEnvelope $except_session = null) {
 
     $sessions = id(new PhabricatorAuthSessionQuery())
       ->setViewer($user)
       ->withIdentityPHIDs(array($user->getPHID()))
       ->execute();
 
     if ($except_session !== null) {
       $except_session = PhabricatorAuthSession::newSessionDigest(
         $except_session);
     }
 
     foreach ($sessions as $key => $session) {
       if ($except_session !== null) {
         $is_except = phutil_hashes_are_identical(
           $session->getSessionKey(),
           $except_session);
         if ($is_except) {
           continue;
         }
       }
 
       $session->delete();
     }
   }
 
   public function logoutSession(
     PhabricatorUser $user,
     PhabricatorAuthSession $session) {
 
     $log = PhabricatorUserLog::initializeNewLog(
       $user,
       $user->getPHID(),
       PhabricatorUserLog::ACTION_LOGOUT);
     $log->save();
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->didLogout($user, array($session));
     }
 
     $session->delete();
   }
 
 
 /* -(  High Security  )------------------------------------------------------ */
 
 
   /**
    * Require the user respond to a high security (MFA) check.
    *
    * This method differs from @{method:requireHighSecuritySession} in that it
    * does not upgrade the user's session as a side effect. This method is
    * appropriate for one-time checks.
    *
    * @param PhabricatorUser User whose session needs to be in high security.
    * @param AphrontReqeust  Current request.
    * @param string          URI to return the user to if they cancel.
    * @return PhabricatorAuthHighSecurityToken Security token.
    * @task hisec
    */
   public function requireHighSecurityToken(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri) {
 
     return $this->newHighSecurityToken(
       $viewer,
       $request,
       $cancel_uri,
       false,
       false);
   }
 
 
   /**
    * Require high security, or prompt the user to enter high security.
    *
    * If the user's session is in high security, this method will return a
    * token. Otherwise, it will throw an exception which will eventually
    * be converted into a multi-factor authentication workflow.
    *
    * This method upgrades the user's session to high security for a short
    * period of time, and is appropriate if you anticipate they may need to
    * take multiple high security actions. To perform a one-time check instead,
    * use @{method:requireHighSecurityToken}.
    *
    * @param PhabricatorUser User whose session needs to be in high security.
    * @param AphrontReqeust  Current request.
    * @param string          URI to return the user to if they cancel.
    * @param bool            True to jump partial sessions directly into high
    *                        security instead of just upgrading them to full
    *                        sessions.
    * @return PhabricatorAuthHighSecurityToken Security token.
    * @task hisec
    */
   public function requireHighSecuritySession(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri,
     $jump_into_hisec = false) {
 
     return $this->newHighSecurityToken(
       $viewer,
       $request,
       $cancel_uri,
       false,
       true);
   }
 
   private function newHighSecurityToken(
     PhabricatorUser $viewer,
     AphrontRequest $request,
     $cancel_uri,
     $jump_into_hisec,
     $upgrade_session) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Requiring a high-security session from a user with no session!'));
     }
 
     // TODO: If a user answers a "requireHighSecurityToken()" prompt and hits
     // a "requireHighSecuritySession()" prompt a short time later, the one-shot
     // token should be good enough to upgrade the session.
 
     $session = $viewer->getSession();
 
     // Check if the session is already in high security mode.
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     // Load the multi-factor auth sources attached to this account.
     $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
       'userPHID = %s',
       $viewer->getPHID());
 
     // If the account has no associated multi-factor auth, just issue a token
     // without putting the session into high security mode. This is generally
     // easier for users. A minor but desirable side effect is that when a user
     // adds an auth factor, existing sessions won't get a free pass into hisec,
     // since they never actually got marked as hisec.
     if (!$factors) {
       return $this->issueHighSecurityToken($session, true);
     }
 
     foreach ($factors as $factor) {
       $factor->setSessionEngine($this);
     }
 
     // Check for a rate limit without awarding points, so the user doesn't
     // get partway through the workflow only to get blocked.
     PhabricatorSystemActionEngine::willTakeAction(
       array($viewer->getPHID()),
       new PhabricatorAuthTryFactorAction(),
       0);
 
     $now = PhabricatorTime::getNow();
 
     // We need to do challenge validation first, since this happens whether you
     // submitted responses or not. You can't get a "bad response" error before
     // you actually submit a response, but you can get a "wait, we can't
     // issue a challenge yet" response. Load all issued challenges which are
     // currently valid.
     $challenges = id(new PhabricatorAuthChallengeQuery())
       ->setViewer($viewer)
       ->withFactorPHIDs(mpull($factors, 'getPHID'))
       ->withUserPHIDs(array($viewer->getPHID()))
       ->withChallengeTTLBetween($now, null)
       ->execute();
 
     PhabricatorAuthChallenge::newChallengeResponsesFromRequest(
       $challenges,
       $request);
 
     $challenge_map = mgroup($challenges, 'getFactorPHID');
 
     $validation_results = array();
     $ok = true;
 
     // Validate each factor against issued challenges. For example, this
     // prevents you from receiving or responding to a TOTP challenge if another
     // challenge was recently issued to a different session.
     foreach ($factors as $factor) {
       $factor_phid = $factor->getPHID();
       $issued_challenges = idx($challenge_map, $factor_phid, array());
       $impl = $factor->requireImplementation();
 
       $new_challenges = $impl->getNewIssuedChallenges(
         $factor,
         $viewer,
         $issued_challenges);
 
       foreach ($new_challenges as $new_challenge) {
         $issued_challenges[] = $new_challenge;
       }
       $challenge_map[$factor_phid] = $issued_challenges;
 
       if (!$issued_challenges) {
         continue;
       }
 
       $result = $impl->getResultFromIssuedChallenges(
         $factor,
         $viewer,
         $issued_challenges);
 
       if (!$result) {
         continue;
       }
 
       $ok = false;
       $validation_results[$factor_phid] = $result;
     }
 
     if ($request->isHTTPPost()) {
       $request->validateCSRF();
       if ($request->getExists(AphrontRequest::TYPE_HISEC)) {
 
         // Limit factor verification rates to prevent brute force attacks.
         $any_attempt = false;
         foreach ($factors as $factor) {
           $impl = $factor->requireImplementation();
           if ($impl->getRequestHasChallengeResponse($factor, $request)) {
             $any_attempt = true;
             break;
           }
         }
 
         if ($any_attempt) {
           PhabricatorSystemActionEngine::willTakeAction(
             array($viewer->getPHID()),
             new PhabricatorAuthTryFactorAction(),
             1);
         }
 
         foreach ($factors as $factor) {
           $factor_phid = $factor->getPHID();
 
           // If we already have a validation result from previously issued
           // challenges, skip validating this factor.
           if (isset($validation_results[$factor_phid])) {
             continue;
           }
 
           $issued_challenges = idx($challenge_map, $factor_phid, array());
 
           $impl = $factor->requireImplementation();
 
           $validation_result = $impl->getResultFromChallengeResponse(
             $factor,
             $viewer,
             $request,
             $issued_challenges);
 
           if (!$validation_result->getIsValid()) {
             $ok = false;
           }
 
           $validation_results[$factor_phid] = $validation_result;
         }
 
         if ($ok) {
           // We're letting you through, so mark all the challenges you
           // responded to as completed. These challenges can never be used
           // again, even by the same session and workflow: you can't use the
           // same response to take two different actions, even if those actions
           // are of the same type.
           foreach ($validation_results as $validation_result) {
             $challenge = $validation_result->getAnsweredChallenge()
               ->markChallengeAsCompleted();
           }
 
           // Give the user a credit back for a successful factor verification.
           if ($any_attempt) {
             PhabricatorSystemActionEngine::willTakeAction(
               array($viewer->getPHID()),
               new PhabricatorAuthTryFactorAction(),
               -1);
           }
 
           if ($session->getIsPartial() && !$jump_into_hisec) {
             // If we have a partial session and are not jumping directly into
             // hisec, just issue a token without putting it in high security
             // mode.
             return $this->issueHighSecurityToken($session, true);
           }
 
           // If we aren't upgrading the session itself, just issue a token.
           if (!$upgrade_session) {
             return $this->issueHighSecurityToken($session, true);
           }
 
           $until = time() + phutil_units('15 minutes in seconds');
           $session->setHighSecurityUntil($until);
 
           queryfx(
             $session->establishConnection('w'),
             'UPDATE %T SET highSecurityUntil = %d WHERE id = %d',
             $session->getTableName(),
             $until,
             $session->getID());
 
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_ENTER_HISEC);
           $log->save();
         } else {
           $log = PhabricatorUserLog::initializeNewLog(
             $viewer,
             $viewer->getPHID(),
             PhabricatorUserLog::ACTION_FAIL_HISEC);
           $log->save();
         }
       }
     }
 
     $token = $this->issueHighSecurityToken($session);
     if ($token) {
       return $token;
     }
 
     // If we don't have a validation result for some factors yet, fill them
     // in with an empty result so form rendering doesn't have to care if the
     // results exist or not. This happens when you first load the form and have
     // not submitted any responses yet.
     foreach ($factors as $factor) {
       $factor_phid = $factor->getPHID();
       if (isset($validation_results[$factor_phid])) {
         continue;
       }
       $validation_results[$factor_phid] = new PhabricatorAuthFactorResult();
     }
 
     throw id(new PhabricatorAuthHighSecurityRequiredException())
       ->setCancelURI($cancel_uri)
       ->setIsSessionUpgrade($upgrade_session)
       ->setFactors($factors)
       ->setFactorValidationResults($validation_results);
   }
 
 
   /**
    * Issue a high security token for a session, if authorized.
    *
    * @param PhabricatorAuthSession Session to issue a token for.
    * @param bool Force token issue.
    * @return PhabricatorAuthHighSecurityToken|null Token, if authorized.
    * @task hisec
    */
   private function issueHighSecurityToken(
     PhabricatorAuthSession $session,
     $force = false) {
 
     if ($session->isHighSecuritySession() || $force) {
       return new PhabricatorAuthHighSecurityToken();
     }
 
     return null;
   }
 
 
   /**
    * Render a form for providing relevant multi-factor credentials.
    *
    * @param PhabricatorUser Viewing user.
    * @param AphrontRequest Current request.
    * @return AphrontFormView Renderable form.
    * @task hisec
    */
   public function renderHighSecurityForm(
     array $factors,
     array $validation_results,
     PhabricatorUser $viewer,
     AphrontRequest $request) {
     assert_instances_of($validation_results, 'PhabricatorAuthFactorResult');
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
       ->appendRemarkupInstructions('');
 
     $answered = array();
     foreach ($factors as $factor) {
       $result = $validation_results[$factor->getPHID()];
 
       $factor->requireImplementation()->renderValidateFactorForm(
         $factor,
         $form,
         $viewer,
         $result);
 
       $answered_challenge = $result->getAnsweredChallenge();
       if ($answered_challenge) {
         $answered[] = $answered_challenge;
       }
     }
 
     $form->appendRemarkupInstructions('');
 
     if ($answered) {
       $http_params = PhabricatorAuthChallenge::newHTTPParametersFromChallenges(
         $answered);
       foreach ($http_params as $key => $value) {
         $form->addHiddenInput($key, $value);
       }
     }
 
     return $form;
   }
 
 
   /**
    * Strip the high security flag from a session.
    *
    * Kicks a session out of high security and logs the exit.
    *
    * @param PhabricatorUser Acting user.
    * @param PhabricatorAuthSession Session to return to normal security.
    * @return void
    * @task hisec
    */
   public function exitHighSecurity(
     PhabricatorUser $viewer,
     PhabricatorAuthSession $session) {
 
     if (!$session->getHighSecurityUntil()) {
       return;
     }
 
     queryfx(
       $session->establishConnection('w'),
       'UPDATE %T SET highSecurityUntil = NULL WHERE id = %d',
       $session->getTableName(),
       $session->getID());
 
     $log = PhabricatorUserLog::initializeNewLog(
       $viewer,
       $viewer->getPHID(),
       PhabricatorUserLog::ACTION_EXIT_HISEC);
     $log->save();
   }
 
 
 /* -(  Partial Sessions  )--------------------------------------------------- */
 
 
   /**
    * Upgrade a partial session to a full session.
    *
    * @param PhabricatorAuthSession Session to upgrade.
    * @return void
    * @task partial
    */
   public function upgradePartialSession(PhabricatorUser $viewer) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Upgrading partial session of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if (!$session->getIsPartial()) {
       throw new Exception(pht('Session is not partial!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setIsPartial(0);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET isPartial = %d WHERE id = %d',
         $session->getTableName(),
         0,
         $session->getID());
 
       $log = PhabricatorUserLog::initializeNewLog(
         $viewer,
         $viewer->getPHID(),
         PhabricatorUserLog::ACTION_LOGIN_FULL);
       $log->save();
     unset($unguarded);
   }
 
 
 /* -(  Legalpad Documents )-------------------------------------------------- */
 
 
   /**
    * Upgrade a session to have all legalpad documents signed.
    *
    * @param PhabricatorUser User whose session should upgrade.
    * @param array LegalpadDocument objects
    * @return void
    * @task partial
    */
   public function signLegalpadDocuments(PhabricatorUser $viewer, array $docs) {
 
     if (!$viewer->hasSession()) {
       throw new Exception(
         pht('Signing session legalpad documents of user with no session!'));
     }
 
     $session = $viewer->getSession();
 
     if ($session->getSignedLegalpadDocuments()) {
       throw new Exception(pht(
         'Session has already signed required legalpad documents!'));
     }
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $session->setSignedLegalpadDocuments(1);
 
       queryfx(
         $session->establishConnection('w'),
         'UPDATE %T SET signedLegalpadDocuments = %d WHERE id = %d',
         $session->getTableName(),
         1,
         $session->getID());
 
       if (!empty($docs)) {
         $log = PhabricatorUserLog::initializeNewLog(
           $viewer,
           $viewer->getPHID(),
           PhabricatorUserLog::ACTION_LOGIN_LEGALPAD);
         $log->save();
       }
     unset($unguarded);
   }
 
 
 /* -(  One Time Login URIs  )------------------------------------------------ */
 
 
   /**
    * Retrieve a temporary, one-time URI which can log in to an account.
    *
    * These URIs are used for password recovery and to regain access to accounts
    * which users have been locked out of.
    *
    * @param PhabricatorUser User to generate a URI for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Optional context string for the URI. This is purely cosmetic
    *  and used only to customize workflow and error messages.
+   * @param bool True to generate a URI which forces an immediate upgrade to
+   *  a full session, bypassing MFA and other login checks.
    * @return string Login URI.
    * @task onetime
    */
   public function getOneTimeLoginURI(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
-    $type = self::ONETIME_RESET) {
+    $type = self::ONETIME_RESET,
+    $force_full_session = false) {
 
     $key = Filesystem::readRandomCharacters(32);
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
-      id(new PhabricatorAuthTemporaryToken())
+      $token = id(new PhabricatorAuthTemporaryToken())
         ->setTokenResource($user->getPHID())
         ->setTokenType($onetime_type)
         ->setTokenExpires(time() + phutil_units('1 day in seconds'))
         ->setTokenCode($key_hash)
+        ->setShouldForceFullSession($force_full_session)
         ->save();
     unset($unguarded);
 
     $uri = '/login/once/'.$type.'/'.$user->getID().'/'.$key.'/';
     if ($email) {
       $uri = $uri.$email->getID().'/';
     }
 
     try {
       $uri = PhabricatorEnv::getProductionURI($uri);
     } catch (Exception $ex) {
       // If a user runs `bin/auth recover` before configuring the base URI,
       // just show the path. We don't have any way to figure out the domain.
       // See T4132.
     }
 
     return $uri;
   }
 
 
   /**
    * Load the temporary token associated with a given one-time login key.
    *
    * @param PhabricatorUser User to load the token for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string Key user is presenting as a valid one-time login key.
    * @return PhabricatorAuthTemporaryToken|null Token, if one exists.
    * @task onetime
    */
   public function loadOneTimeLoginKey(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $key_hash = $this->getOneTimeLoginKeyHash($user, $email, $key);
     $onetime_type = PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE;
 
     return id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer($user)
       ->withTokenResources(array($user->getPHID()))
       ->withTokenTypes(array($onetime_type))
       ->withTokenCodes(array($key_hash))
       ->withExpired(false)
       ->executeOne();
   }
 
 
   /**
    * Hash a one-time login key for storage as a temporary token.
    *
    * @param PhabricatorUser User this key is for.
    * @param PhabricatorUserEmail Optionally, email to verify when
    *  link is used.
    * @param string The one time login key.
    * @return string Hash of the key.
    * task onetime
    */
   private function getOneTimeLoginKeyHash(
     PhabricatorUser $user,
     PhabricatorUserEmail $email = null,
     $key = null) {
 
     $parts = array(
       $key,
       $user->getAccountSecret(),
     );
 
     if ($email) {
       $parts[] = $email->getVerificationCode();
     }
 
     return PhabricatorHash::weakDigest(implode(':', $parts));
   }
 
 
 /* -(  User Cache  )--------------------------------------------------------- */
 
 
   /**
    * @task cache
    */
   private function getUserCacheQueryParts(AphrontDatabaseConnection $conn) {
     $cache_selects = array();
     $cache_joins = array();
     $cache_map = array();
 
     $keys = array();
     $types_map = array();
 
     $cache_types = PhabricatorUserCacheType::getAllCacheTypes();
     foreach ($cache_types as $cache_type) {
       foreach ($cache_type->getAutoloadKeys() as $autoload_key) {
         $keys[] = $autoload_key;
         $types_map[$autoload_key] = $cache_type;
       }
     }
 
     $cache_table = id(new PhabricatorUserCache())->getTableName();
 
     $cache_idx = 1;
     foreach ($keys as $key) {
       $join_as = 'ucache_'.$cache_idx;
       $select_as = 'ucache_'.$cache_idx.'_v';
 
       $cache_selects[] = qsprintf(
         $conn,
         '%T.cacheData %T',
         $join_as,
         $select_as);
 
       $cache_joins[] = qsprintf(
         $conn,
         'LEFT JOIN %T AS %T ON u.phid = %T.userPHID
           AND %T.cacheIndex = %s',
         $cache_table,
         $join_as,
         $join_as,
         $join_as,
         PhabricatorHash::digestForIndex($key));
 
       $cache_map[$select_as] = $key;
 
       $cache_idx++;
     }
 
     if ($cache_selects) {
       $cache_selects = qsprintf($conn, ', %LQ', $cache_selects);
     } else {
       $cache_selects = qsprintf($conn, '');
     }
 
     if ($cache_joins) {
       $cache_joins = qsprintf($conn, '%LJ', $cache_joins);
     } else {
       $cache_joins = qsprintf($conn, '');
     }
 
     return array($cache_selects, $cache_joins, $cache_map, $types_map);
   }
 
   private function filterRawCacheData(
     PhabricatorUser $user,
     array $types_map,
     array $cache_raw) {
 
     foreach ($cache_raw as $cache_key => $cache_data) {
       $type = $types_map[$cache_key];
       if ($type->shouldValidateRawCacheData()) {
         if (!$type->isRawCacheDataValid($user, $cache_key, $cache_data)) {
           unset($cache_raw[$cache_key]);
         }
       }
     }
 
     return $cache_raw;
   }
 
   public function willServeRequestForUser(PhabricatorUser $user) {
     // We allow the login user to generate any missing cache data inline.
     $user->setAllowInlineCacheGeneration(true);
 
     // Switch to the user's translation.
     PhabricatorEnv::setLocaleCode($user->getTranslation());
 
     $extensions = PhabricatorAuthSessionEngineExtension::getAllExtensions();
     foreach ($extensions as $extension) {
       $extension->willServeRequestForUser($user);
     }
   }
 
 }
diff --git a/src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php b/src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php
index 9efd07571a..3190a842f7 100644
--- a/src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php
+++ b/src/applications/auth/management/PhabricatorAuthManagementRecoverWorkflow.php
@@ -1,82 +1,91 @@
 <?php
 
 final class PhabricatorAuthManagementRecoverWorkflow
   extends PhabricatorAuthManagementWorkflow {
 
   protected function didConstruct() {
     $this
       ->setName('recover')
       ->setExamples('**recover** __username__')
       ->setSynopsis(
         pht(
           'Recover access to an account if you have locked yourself out '.
           'of Phabricator.'))
       ->setArguments(
         array(
-          'username' => array(
+          array(
+            'name' => 'force-full-session',
+            'help' => pht(
+              'Recover directly into a full session without requiring MFA '.
+              'or other login checks.'),
+          ),
+          array(
             'name' => 'username',
             'wildcard' => true,
           ),
         ));
   }
 
   public function execute(PhutilArgumentParser $args) {
     $usernames = $args->getArg('username');
     if (!$usernames) {
       throw new PhutilArgumentUsageException(
         pht('You must specify the username of the account to recover.'));
     } else if (count($usernames) > 1) {
       throw new PhutilArgumentUsageException(
         pht('You can only recover the username for one account.'));
     }
 
     $username = head($usernames);
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer($this->getViewer())
       ->withUsernames(array($username))
       ->executeOne();
 
     if (!$user) {
       throw new PhutilArgumentUsageException(
         pht(
           'No such user "%s" to recover.',
           $username));
     }
 
     if (!$user->canEstablishWebSessions()) {
       throw new PhutilArgumentUsageException(
         pht(
           'This account ("%s") can not establish web sessions, so it is '.
           'not possible to generate a functional recovery link. Special '.
           'accounts like daemons and mailing lists can not log in via the '.
           'web UI.',
           $username));
     }
 
+    $force_full_session = $args->getArg('force-full-session');
+
     $engine = new PhabricatorAuthSessionEngine();
     $onetime_uri = $engine->getOneTimeLoginURI(
       $user,
       null,
-      PhabricatorAuthSessionEngine::ONETIME_RECOVER);
+      PhabricatorAuthSessionEngine::ONETIME_RECOVER,
+      $force_full_session);
 
     $console = PhutilConsole::getConsole();
     $console->writeOut(
       pht(
         'Use this link to recover access to the "%s" account from the web '.
         'interface:',
         $username));
     $console->writeOut("\n\n");
     $console->writeOut('    %s', $onetime_uri);
     $console->writeOut("\n\n");
     $console->writeOut(
       "%s\n",
       pht(
         'After logging in, you can use the "Auth" application to add or '.
         'restore authentication providers and allow normal logins to '.
         'succeed.'));
 
     return 0;
   }
 
 }
diff --git a/src/applications/auth/storage/PhabricatorAuthTemporaryToken.php b/src/applications/auth/storage/PhabricatorAuthTemporaryToken.php
index 76e9358831..8ffd603a47 100644
--- a/src/applications/auth/storage/PhabricatorAuthTemporaryToken.php
+++ b/src/applications/auth/storage/PhabricatorAuthTemporaryToken.php
@@ -1,128 +1,138 @@
 <?php
 
 final class PhabricatorAuthTemporaryToken extends PhabricatorAuthDAO
   implements PhabricatorPolicyInterface {
 
   // NOTE: This is usually a PHID, but may be some other kind of resource
   // identifier for some token types.
   protected $tokenResource;
   protected $tokenType;
   protected $tokenExpires;
   protected $tokenCode;
   protected $userPHID;
   protected $properties;
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_TIMESTAMPS => false,
       self::CONFIG_SERIALIZATION => array(
         'properties' => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_COLUMN_SCHEMA => array(
         'tokenResource' => 'phid',
         'tokenType' => 'text64',
         'tokenExpires' => 'epoch',
         'tokenCode' => 'text64',
         'userPHID' => 'phid?',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_token' => array(
           'columns' => array('tokenResource', 'tokenType', 'tokenCode'),
           'unique' => true,
         ),
         'key_expires' => array(
           'columns' => array('tokenExpires'),
         ),
         'key_user' => array(
           'columns' => array('userPHID'),
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   private function newTokenTypeImplementation() {
     $types = PhabricatorAuthTemporaryTokenType::getAllTypes();
 
     $type = idx($types, $this->tokenType);
     if ($type) {
       return clone $type;
     }
 
     return null;
   }
 
   public function getTokenReadableTypeName() {
     $type = $this->newTokenTypeImplementation();
     if ($type) {
       return $type->getTokenReadableTypeName($this);
     }
 
     return $this->tokenType;
   }
 
   public function isRevocable() {
     if ($this->tokenExpires < time()) {
       return false;
     }
 
     $type = $this->newTokenTypeImplementation();
     if ($type) {
       return $type->isTokenRevocable($this);
     }
 
     return false;
   }
 
   public function revokeToken() {
     if ($this->isRevocable()) {
       $this->setTokenExpires(PhabricatorTime::getNow() - 1)->save();
     }
     return $this;
   }
 
   public static function revokeTokens(
     PhabricatorUser $viewer,
     array $token_resources,
     array $token_types) {
 
     $tokens = id(new PhabricatorAuthTemporaryTokenQuery())
       ->setViewer($viewer)
       ->withTokenResources($token_resources)
       ->withTokenTypes($token_types)
       ->withExpired(false)
       ->execute();
 
     foreach ($tokens as $token) {
       $token->revokeToken();
     }
   }
 
   public function getTemporaryTokenProperty($key, $default = null) {
     return idx($this->properties, $key, $default);
   }
 
   public function setTemporaryTokenProperty($key, $value) {
     $this->properties[$key] = $value;
     return $this;
   }
 
+  public function setShouldForceFullSession($force_full) {
+    return $this->setTemporaryTokenProperty('force-full-session', $force_full);
+  }
+
+  public function getShouldForceFullSession() {
+    return $this->getTemporaryTokenProperty('force-full-session', false);
+  }
+
+
+
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
     );
   }
 
   public function getPolicy($capability) {
     // We're just implement this interface to get access to the standard
     // query infrastructure.
     return PhabricatorPolicies::getMostOpenPolicy();
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return false;
   }
 
 }