[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  final class PhabricatorAuthManagementStripWorkflow
   4    extends PhabricatorAuthManagementWorkflow {
   5  
   6    protected function didConstruct() {
   7      $this
   8        ->setName('strip')
   9        ->setExamples('**strip** [--user username] [--type type]')
  10        ->setSynopsis(
  11          pht(
  12            'Remove multi-factor authentication from an account.'))
  13        ->setArguments(
  14          array(
  15            array(
  16              'name' => 'user',
  17              'param' => 'username',
  18              'repeat' => true,
  19              'help' => pht('Strip factors from specified users.'),
  20            ),
  21            array(
  22              'name' => 'all-users',
  23              'help' => pht('Strip factors from all users.'),
  24            ),
  25            array(
  26              'name' => 'type',
  27              'param' => 'factortype',
  28              'repeat' => true,
  29              'help' => pht('Strip a specific factor type.'),
  30            ),
  31            array(
  32              'name' => 'all-types',
  33              'help' => pht('Strip all factors, regardless of type.'),
  34            ),
  35            array(
  36              'name' => 'force',
  37              'help' => pht('Strip factors without prompting.'),
  38            ),
  39            array(
  40              'name' => 'dry-run',
  41              'help' => pht('Show factors, but do not strip them.'),
  42            ),
  43          ));
  44    }
  45  
  46    public function execute(PhutilArgumentParser $args) {
  47      $usernames = $args->getArg('user');
  48      $all_users = $args->getArg('all-users');
  49  
  50      if ($usernames && $all_users) {
  51        throw new PhutilArgumentUsageException(
  52          pht(
  53            'Specify either specific users with --user, or all users with '.
  54            '--all-users, but not both.'));
  55      } else if (!$usernames && !$all_users) {
  56        throw new PhutilArgumentUsageException(
  57          pht(
  58            'Use --user to specify which user to strip factors from, or '.
  59            '--all-users to strip factors from all users.'));
  60      } else if ($usernames) {
  61        $users = id(new PhabricatorPeopleQuery())
  62          ->setViewer($this->getViewer())
  63          ->withUsernames($usernames)
  64          ->execute();
  65  
  66        $users_by_username = mpull($users, null, 'getUsername');
  67        foreach ($usernames as $username) {
  68          if (empty($users_by_username[$username])) {
  69            throw new PhutilArgumentUsageException(
  70              pht(
  71                'No user exists with username "%s".',
  72                $username));
  73          }
  74        }
  75      } else {
  76        $users = null;
  77      }
  78  
  79      $types = $args->getArg('type');
  80      $all_types = $args->getArg('all-types');
  81      if ($types && $all_types) {
  82        throw new PhutilArgumentUsageException(
  83          pht(
  84            'Specify either specific factors with --type, or all factors with '.
  85            '--all-types, but not both.'));
  86      } else if (!$types && !$all_types) {
  87        throw new PhutilArgumentUsageException(
  88          pht(
  89            'Use --type to specify which factor to strip, or --all-types to '.
  90            'strip all factors. Use `auth list-factors` to show the available '.
  91            'factor types.'));
  92      }
  93  
  94      if ($users && $types) {
  95        $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
  96          'userPHID IN (%Ls) AND factorKey IN (%Ls)',
  97          mpull($users, 'getPHID'),
  98          $types);
  99      } else if ($users) {
 100        $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
 101          'userPHID IN (%Ls)',
 102          mpull($users, 'getPHID'));
 103      } else if ($types) {
 104        $factors = id(new PhabricatorAuthFactorConfig())->loadAllWhere(
 105          'factorKey IN (%Ls)',
 106          $types);
 107      } else {
 108        $factors = id(new PhabricatorAuthFactorConfig())->loadAll();
 109      }
 110  
 111      if (!$factors) {
 112        throw new PhutilArgumentUsageException(
 113          pht('There are no matching factors to strip.'));
 114      }
 115  
 116      $handles = id(new PhabricatorHandleQuery())
 117        ->setViewer($this->getViewer())
 118        ->withPHIDs(mpull($factors, 'getUserPHID'))
 119        ->execute();
 120  
 121      $console = PhutilConsole::getConsole();
 122  
 123      $console->writeOut("%s\n\n", pht('These auth factors will be stripped:'));
 124  
 125      foreach ($factors as $factor) {
 126        $impl = $factor->getImplementation();
 127        $console->writeOut(
 128          "    %s\t%s\t%s\n",
 129          $handles[$factor->getUserPHID()]->getName(),
 130          $factor->getFactorKey(),
 131          ($impl
 132            ? $impl->getFactorName()
 133            : '?'));
 134      }
 135  
 136      $is_dry_run = $args->getArg('dry-run');
 137      if ($is_dry_run) {
 138        $console->writeOut(
 139          "\n%s\n",
 140          pht('End of dry run.'));
 141  
 142        return 0;
 143      }
 144  
 145      $force = $args->getArg('force');
 146      if (!$force) {
 147        if (!$console->confirm(pht('Strip these authentication factors?'))) {
 148          throw new PhutilArgumentUsageException(
 149            pht('User aborted the workflow.'));
 150        }
 151      }
 152  
 153      $console->writeOut("%s\n", pht('Stripping authentication factors...'));
 154  
 155      foreach ($factors as $factor) {
 156        $user = id(new PhabricatorPeopleQuery())
 157          ->setViewer($this->getViewer())
 158          ->withPHIDs(array($factor->getUserPHID()))
 159          ->executeOne();
 160  
 161        $factor->delete();
 162  
 163        if ($user) {
 164          $user->updateMultiFactorEnrollment();
 165        }
 166      }
 167  
 168      $console->writeOut("%s\n", pht('Done.'));
 169  
 170      return 0;
 171    }
 172  
 173  }