Add a "Lock Permanently" action to Passphrase

Summary: Fixes T4931. Each new credential should come with the ability to lock the credential permanently, so that no one can ever edit again. Each existing credential must allow user to lock existing credential.

Test Plan: Create new credential, verify that you can lock it before saving it. Open existing unlocked credential, verify that option to lock it exists. Once credential is locked, the option to reveal it should be disabled, and editing the credential won't allow username/password updates.

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T4931

Differential Revision: https://secure.phabricator.com/D8947

resources/sql/autopatches/20140501.passphraselockcredential.sql

···
+ALTER TABLE {$NAMESPACE}_passphrase.passphrase_credential
+  ADD COLUMN isLocked BOOL NOT NULL;

src/__phutil_library_map__.php

···
     'PassphraseCredentialDestroyController' => 'applications/passphrase/controller/PassphraseCredentialDestroyController.php',
     'PassphraseCredentialEditController' => 'applications/passphrase/controller/PassphraseCredentialEditController.php',
     'PassphraseCredentialListController' => 'applications/passphrase/controller/PassphraseCredentialListController.php',
+    'PassphraseCredentialLockController' => 'applications/passphrase/controller/PassphraseCredentialLockController.php',
     'PassphraseCredentialPublicController' => 'applications/passphrase/controller/PassphraseCredentialPublicController.php',
     'PassphraseCredentialQuery' => 'applications/passphrase/query/PassphraseCredentialQuery.php',
     'PassphraseCredentialRevealController' => 'applications/passphrase/controller/PassphraseCredentialRevealController.php',
···
       0 => 'PassphraseController',
       1 => 'PhabricatorApplicationSearchResultsControllerInterface',
     ),
+    'PassphraseCredentialLockController' => 'PassphraseController',
     'PassphraseCredentialPublicController' => 'PassphraseController',
     'PassphraseCredentialQuery' => 'PhabricatorCursorPagedPolicyAwareQuery',
     'PassphraseCredentialRevealController' => 'PassphraseController',

src/applications/passphrase/application/PhabricatorApplicationPassphrase.php

···
         'destroy/(?P<id>\d+)/' => 'PassphraseCredentialDestroyController',
         'reveal/(?P<id>\d+)/' => 'PassphraseCredentialRevealController',
         'public/(?P<id>\d+)/' => 'PassphraseCredentialPublicController',
+        'lock/(?P<id>\d+)/' => 'PassphraseCredentialLockController',
       ));
   }
 

src/applications/passphrase/controller/PassphraseCredentialDestroyController.php

···
       return id(new AphrontRedirectResponse())->setURI($view_uri);
     }
 
-    $dialog = id(new AphrontDialogView())
+    return $this->newDialog()
       ->setUser($viewer)
       ->setTitle(pht('Really destroy credential?'))
       ->appendChild(
         pht(
           'This credential will be deactivated and the secret will be '.
-          'unrecoverably destroyed. Anything relying on this credential will '.
-          'cease to function. This operation can not be undone.'))
+          'unrecoverably destroyed. Anything relying on this credential '.
+          'will cease to function. This operation can not be undone.'))
       ->addSubmitButton(pht('Destroy Credential'))
       ->addCancelButton($view_uri);
-
-    return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
 }

src/applications/passphrase/controller/PassphraseCredentialEditController.php

···
       $v_username = $request->getStr('username');
       $v_view_policy = $request->getStr('viewPolicy');
       $v_edit_policy = $request->getStr('editPolicy');
+      $v_is_locked = $request->getStr('lock');
 
       $v_secret = $request->getStr('secret');
       $v_password = $request->getStr('password');
···
         $type_username = PassphraseCredentialTransaction::TYPE_USERNAME;
         $type_destroy = PassphraseCredentialTransaction::TYPE_DESTROY;
         $type_secret_id = PassphraseCredentialTransaction::TYPE_SECRET_ID;
+        $type_is_locked = PassphraseCredentialTransaction::TYPE_LOCK;
         $type_view_policy = PhabricatorTransactions::TYPE_VIEW_POLICY;
         $type_edit_policy = PhabricatorTransactions::TYPE_EDIT_POLICY;
 
···
           ->setNewValue($v_desc);
 
         $xactions[] = id(new PassphraseCredentialTransaction())
-          ->setTransactionType($type_username)
-          ->setNewValue($v_username);
-
-        $xactions[] = id(new PassphraseCredentialTransaction())
           ->setTransactionType($type_view_policy)
           ->setNewValue($v_view_policy);
 
···
         // the amount of code which handles secret plaintexts.
         $credential->openTransaction();
 
-        $min_secret = str_replace($bullet, '', trim($v_decrypt));
-        if (strlen($min_secret)) {
-          // If the credential was previously destroyed, restore it when it is
-          // edited if a secret is provided.
+        if (!$credential->getIsLocked()) {
           $xactions[] = id(new PassphraseCredentialTransaction())
-            ->setTransactionType($type_destroy)
-            ->setNewValue(0);
+            ->setTransactionType($type_username)
+            ->setNewValue($v_username);
+
+          $min_secret = str_replace($bullet, '', trim($v_decrypt));
+          if (strlen($min_secret)) {
+            // If the credential was previously destroyed, restore it when it is
+            // edited if a secret is provided.
+            $xactions[] = id(new PassphraseCredentialTransaction())
+              ->setTransactionType($type_destroy)
+              ->setNewValue(0);
 
-          $new_secret = id(new PassphraseSecret())
-            ->setSecretData($v_decrypt)
-            ->save();
+            $new_secret = id(new PassphraseSecret())
+              ->setSecretData($v_decrypt)
+              ->save();
+            $xactions[] = id(new PassphraseCredentialTransaction())
+              ->setTransactionType($type_secret_id)
+              ->setNewValue($new_secret->getID());
+          }
+
           $xactions[] = id(new PassphraseCredentialTransaction())
-            ->setTransactionType($type_secret_id)
-            ->setNewValue($new_secret->getID());
+            ->setTransactionType($type_is_locked)
+            ->setNewValue($v_is_locked);
         }
 
         try {
···
       ->execute();
 
     $secret_control = $type->newSecretControl();
+    $credential_is_locked = $credential->getIsLocked();
 
     $form = id(new AphrontFormView())
       ->setUser($viewer)
···
           ->setCapability(PhabricatorPolicyCapability::CAN_EDIT)
           ->setPolicies($policies))
       ->appendChild(
-        id(new AphrontFormDividerControl()))
+        id(new AphrontFormDividerControl()));
+
+    if ($credential_is_locked) {
+      $form->appendRemarkupInstructions(
+        pht('This credential is permanently locked and can not be edited.'));
+    }
+
+    $form
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setName('username')
           ->setLabel(pht('Login/Username'))
           ->setValue($v_username)
+          ->setDisabled($credential_is_locked)
           ->setError($e_username))
       ->appendChild(
         $secret_control
           ->setName('secret')
           ->setLabel($type->getSecretLabel())
+          ->setDisabled($credential_is_locked)
           ->setValue($v_secret));
 
     if ($type->shouldShowPasswordField()) {
···
         id(new AphrontFormPasswordControl())
           ->setName('password')
           ->setLabel($type->getPasswordLabel())
+          ->setDisabled($credential_is_locked)
           ->setError($e_password));
+    }
+
+    if ($is_new) {
+      $form->appendChild(
+        id(new AphrontFormCheckboxControl())
+          ->addCheckbox(
+            'lock',
+            1,
+            pht('Lock Permanently'),
+            $v_is_locked)
+          ->setDisabled($credential_is_locked));
     }
 
     $crumbs = $this->buildApplicationCrumbs();

src/applications/passphrase/controller/PassphraseCredentialLockController.php

···
+<?php
+
+final class PassphraseCredentialLockController
+  extends PassphraseController {
+
+  private $id;
+
+  public function willProcessRequest(array $data) {
+    $this->id = $data['id'];
+  }
+
+  public function processRequest() {
+    $request = $this->getRequest();
+    $viewer = $request->getUser();
+
+    $credential = id(new PassphraseCredentialQuery())
+      ->setViewer($viewer)
+      ->withIDs(array($this->id))
+      ->requireCapabilities(
+        array(
+          PhabricatorPolicyCapability::CAN_VIEW,
+          PhabricatorPolicyCapability::CAN_EDIT,
+        ))
+      ->executeOne();
+    if (!$credential) {
+      return new Aphront404Response();
+    }
+
+    $type = PassphraseCredentialType::getTypeByConstant(
+      $credential->getCredentialType());
+    if (!$type) {
+      throw new Exception(pht('Credential has invalid type "%s"!', $type));
+    }
+
+    $view_uri = '/K'.$credential->getID();
+
+    if ($credential->getIsLocked()) {
+      return $this->newDialog()
+        ->setTitle(pht('Credential Already Locked'))
+        ->appendChild(
+          pht(
+            'This credential has been locked and the secret is '.
+            'hidden forever. Anything relying on this credential will '.
+            'still function. This operation can not be undone.'))
+        ->addCancelButton($view_uri, pht('Close'));
+    }
+
+    if ($request->isFormPost()) {
+      $xactions = array();
+      $xactions[] = id(new PassphraseCredentialTransaction())
+        ->setTransactionType(PassphraseCredentialTransaction::TYPE_LOCK)
+        ->setNewValue(1);
+
+      $editor = id(new PassphraseCredentialTransactionEditor())
+        ->setActor($viewer)
+        ->setContinueOnMissingFields(true)
+        ->setContentSourceFromRequest($request)
+        ->applyTransactions($credential, $xactions);
+
+      return id(new AphrontRedirectResponse())->setURI($view_uri);
+    }
+
+    return $this->newDialog()
+      ->setTitle(pht('Really lock credential?'))
+      ->appendChild(
+        pht(
+          'This credential will be locked and the secret will be '.
+          'hidden forever. Anything relying on this credential will '.
+          'still function. This operation can not be undone.'))
+      ->addSubmitButton(pht('Lock Credential'))
+      ->addCancelButton($view_uri);
+  }
+
+}

src/applications/passphrase/controller/PassphraseCredentialRevealController.php

···
       $viewer,
       $request,
       $view_uri);
+    $is_locked = $credential->getIsLocked();
+
+    if ($is_locked) {
+      return $this->newDialog()
+        ->setUser($viewer)
+        ->setTitle(pht('Credential is locked'))
+        ->appendChild(
+          pht(
+            'This credential can not be shown, because it is locked.'))
+        ->addCancelButton($view_uri);
+    }
 
     if ($request->isFormPost()) {
       if ($credential->getSecret()) {
···
     }
 
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
+
     if ($is_serious) {
       $body = pht(
         'The secret associated with this credential will be shown in plain '.
···
     } else {
       $body = pht(
         'The secret associated with this credential will be shown in plain '.
-        'text on your screen. Before continuing, wrap your arms around your '.
-        'monitor to create a human shield, keeping it safe from prying eyes. '.
-        'Protect company secrets!');
+        'text on your screen. Before continuing, wrap your arms around '.
+        'your monitor to create a human shield, keeping it safe from '.
+        'prying eyes. Protect company secrets!');
     }
-
-    $dialog = id(new AphrontDialogView())
+    return $this->newDialog()
       ->setUser($viewer)
       ->setTitle(pht('Really show secret?'))
       ->appendChild($body)
       ->addSubmitButton(pht('Show Secret'))
       ->addCancelButton($view_uri);
-
-    return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
 }

src/applications/passphrase/controller/PassphraseCredentialViewController.php

···
 
     $id = $credential->getID();
 
+    $is_locked = $credential->getIsLocked();
+    if ($is_locked) {
+      $credential_lock_text = pht('Locked Permanently');
+      $credential_lock_icon = 'lock';
+    } else {
+      $credential_lock_text = pht('Lock Permanently');
+      $credential_lock_icon = 'unlock';
+    }
+
     $actions = id(new PhabricatorActionListView())
       ->setObjectURI('/K'.$id)
       ->setUser($viewer);
···
           ->setName(pht('Show Secret'))
           ->setIcon('preview')
           ->setHref($this->getApplicationURI("reveal/{$id}/"))
-          ->setDisabled(!$can_edit)
+          ->setDisabled(!$can_edit || $is_locked)
           ->setWorkflow(true));
 
       if ($type->hasPublicKey()) {
···
             ->setName(pht('Show Public Key'))
             ->setIcon('download-alt')
             ->setHref($this->getApplicationURI("public/{$id}/"))
-            ->setWorkflow(true));
+            ->setWorkflow(true)
+            ->setDisabled($is_locked));
       }
+
+      $actions->addAction(
+        id(new PhabricatorActionView())
+          ->setName($credential_lock_text)
+          ->setIcon($credential_lock_icon)
+          ->setHref($this->getApplicationURI("lock/{$id}/"))
+          ->setDisabled($is_locked)
+          ->setWorkflow(true));
     }
 
 

src/applications/passphrase/editor/PassphraseCredentialTransactionEditor.php

···
     $types[] = PassphraseCredentialTransaction::TYPE_SECRET_ID;
     $types[] = PassphraseCredentialTransaction::TYPE_DESTROY;
     $types[] = PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET;
+    $types[] = PassphraseCredentialTransaction::TYPE_LOCK;
 
     return $types;
   }
···
       case PassphraseCredentialTransaction::TYPE_SECRET_ID:
         return $object->getSecretID();
       case PassphraseCredentialTransaction::TYPE_DESTROY:
-        return $object->getIsDestroyed();
+        return (int)$object->getIsDestroyed();
+      case PassphraseCredentialTransaction::TYPE_LOCK:
+        return (int)$object->getIsLocked();
       case PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET:
         return null;
     }
···
       case PassphraseCredentialTransaction::TYPE_DESCRIPTION:
       case PassphraseCredentialTransaction::TYPE_USERNAME:
       case PassphraseCredentialTransaction::TYPE_SECRET_ID:
-      case PassphraseCredentialTransaction::TYPE_DESTROY:
       case PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET:
         return $xaction->getNewValue();
+      case PassphraseCredentialTransaction::TYPE_DESTROY:
+      case PassphraseCredentialTransaction::TYPE_LOCK:
+        return (int)$xaction->getNewValue();
     }
     return parent::getCustomTransactionNewValue($object, $xaction);
   }
···
         return;
       case PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET:
         return;
+      case PassphraseCredentialTransaction::TYPE_LOCK:
+        $object->setIsLocked((int)$xaction->getNewValue());
+        return;
     }
 
     return parent::applyCustomInternalTransaction($object, $xaction);
···
       case PassphraseCredentialTransaction::TYPE_SECRET_ID:
       case PassphraseCredentialTransaction::TYPE_DESTROY:
       case PassphraseCredentialTransaction::TYPE_LOOKEDATSECRET:
+      case PassphraseCredentialTransaction::TYPE_LOCK:
       case PhabricatorTransactions::TYPE_VIEW_POLICY:
       case PhabricatorTransactions::TYPE_EDIT_POLICY:
         return;

src/applications/passphrase/storage/PassphraseCredential.php

···
   protected $username;
   protected $secretID;
   protected $isDestroyed;
+  protected $isLocked = 0;
 
   private $secret = self::ATTACHABLE;
 

src/applications/passphrase/storage/PassphraseCredentialTransaction.php

···
   const TYPE_SECRET_ID = 'passphrase:secretID';
   const TYPE_DESTROY = 'passphrase:destroy';
   const TYPE_LOOKEDATSECRET = 'passphrase:lookedAtSecret';
+  const TYPE_LOCK = 'passphrase:lock';
 
   public function getApplicationName() {
     return 'passphrase';
···
     $old = $this->getOldValue();
     switch ($this->getTransactionType()) {
       case self::TYPE_DESCRIPTION:
+        return ($old === null);
+      case self::TYPE_LOCK:
         return ($old === null);
       case self::TYPE_USERNAME:
         return !strlen($old);
···
       case self::TYPE_LOOKEDATSECRET:
         return pht(
           '%s examined the secret plaintext for this credential.',
+          $this->renderHandleLink($author_phid));
+      case self::TYPE_LOCK:
+        return pht(
+          '%s locked this credential.',
           $this->renderHandleLink($author_phid));
     }