[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  final class PassphraseCredentialControl extends AphrontFormControl {
   4  
   5    private $options = array();
   6    private $credentialType;
   7    private $defaultUsername;
   8    private $allowNull;
   9  
  10    public function setAllowNull($allow_null) {
  11      $this->allowNull = $allow_null;
  12      return $this;
  13    }
  14  
  15    public function setDefaultUsername($default_username) {
  16      $this->defaultUsername = $default_username;
  17      return $this;
  18    }
  19  
  20    public function setCredentialType($credential_type) {
  21      $this->credentialType = $credential_type;
  22      return $this;
  23    }
  24  
  25    public function getCredentialType() {
  26      return $this->credentialType;
  27    }
  28  
  29    public function setOptions(array $options) {
  30      assert_instances_of($options, 'PassphraseCredential');
  31      $this->options = $options;
  32      return $this;
  33    }
  34  
  35    protected function getCustomControlClass() {
  36      return 'passphrase-credential-control';
  37    }
  38  
  39    protected function renderInput() {
  40  
  41      $options_map = array();
  42      foreach ($this->options as $option) {
  43        $options_map[$option->getPHID()] = pht(
  44          '%s %s',
  45          'K'.$option->getID(),
  46          $option->getName());
  47      }
  48  
  49      $disabled = $this->getDisabled();
  50      if ($this->allowNull) {
  51        $options_map = array('' => pht('(No Credentials)')) + $options_map;
  52      } else {
  53        if (!$options_map) {
  54          $options_map[''] = pht('(No Existing Credentials)');
  55          $disabled = true;
  56        }
  57      }
  58  
  59      Javelin::initBehavior('passphrase-credential-control');
  60  
  61      $options = AphrontFormSelectControl::renderSelectTag(
  62        $this->getValue(),
  63        $options_map,
  64        array(
  65          'id' => $this->getControlID(),
  66          'name' => $this->getName(),
  67          'disabled' => $disabled ? 'disabled' : null,
  68          'sigil' => 'passphrase-credential-select',
  69        ));
  70  
  71      if ($this->credentialType) {
  72        $button = javelin_tag(
  73          'a',
  74          array(
  75            'href' => '#',
  76            'class' => 'button grey',
  77            'sigil' => 'passphrase-credential-add',
  78            'mustcapture' => true,
  79          ),
  80          pht('Add Credential'));
  81      } else {
  82        $button = null;
  83      }
  84  
  85      return javelin_tag(
  86        'div',
  87        array(
  88          'sigil' => 'passphrase-credential-control',
  89          'meta' => array(
  90            'type' => $this->getCredentialType(),
  91            'username' => $this->defaultUsername,
  92            'allowNull' => $this->allowNull,
  93          ),
  94        ),
  95        array(
  96          $options,
  97          $button,
  98        ));
  99    }
 100  
 101    /**
 102     * Verify that a given actor has permission to use all of the credentials
 103     * in a list of credential transactions.
 104     *
 105     * In general, the rule here is:
 106     *
 107     *   - If you're editing an object and it uses a credential you can't use,
 108     *     that's fine as long as you don't change the credential.
 109     *   - If you do change the credential, the new credential must be one you
 110     *     can use.
 111     *
 112     * @param PhabricatorUser The acting user.
 113     * @param list<PhabricatorApplicationTransaction> List of credential altering
 114     *        transactions.
 115     * @return bool True if the transactions are valid.
 116     */
 117    public static function validateTransactions(
 118      PhabricatorUser $actor,
 119      array $xactions) {
 120  
 121      $new_phids = array();
 122      foreach ($xactions as $xaction) {
 123        $new = $xaction->getNewValue();
 124        if (!$new) {
 125          // Removing a credential, so this is OK.
 126          continue;
 127        }
 128  
 129        $old = $xaction->getOldValue();
 130        if ($old == $new) {
 131          // This is a no-op transaction, so this is also OK.
 132          continue;
 133        }
 134  
 135        // Otherwise, we need to check this credential.
 136        $new_phids[] = $new;
 137      }
 138  
 139      if (!$new_phids) {
 140        // No new credentials being set, so this is fine.
 141        return true;
 142      }
 143  
 144      $usable_credentials = id(new PassphraseCredentialQuery())
 145        ->setViewer($actor)
 146        ->withPHIDs($new_phids)
 147        ->execute();
 148      $usable_credentials = mpull($usable_credentials, null, 'getPHID');
 149  
 150      foreach ($new_phids as $phid) {
 151        if (empty($usable_credentials[$phid])) {
 152          return false;
 153        }
 154      }
 155  
 156      return true;
 157    }
 158  
 159  
 160  }