Allow rehashing passwords when possible and needed

nicolas-grekas · nicolas-grekas · commit 2b7c39e75779 · 2019-08-05T17:54:51.000+02:00
diff --git a/.travis.yml b/.travis.yml
@@ -9,6 +9,7 @@ env:
     global:
         - PHPUNIT_FLAGS="-v"
         - SYMFONY_PHPUNIT_DIR="$HOME/symfony-bridge/.phpunit"
+        - SYMFONY_REQUIRE='>=3.4'
 
 matrix:
     fast_finish: true
@@ -30,6 +31,8 @@ matrix:
 #        - env: STABILITY="dev"
 
 before_install:
+    - find ~/.phpenv -name xdebug.ini -delete
+    - composer global require --no-progress --no-scripts --no-plugins symfony/flex dev-master
     - if ! [ -z "$STABILITY" ]; then composer config minimum-stability ${STABILITY}; fi;
     - |
       if [[ $deps = low ]]; then
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
@@ -10,8 +10,6 @@
     <php>
         <ini name="error_reporting" value="-1" />
         <env name="TEST_DATABASE_DSN" value="mysql://root:@127.0.0.1:3306/test_maker" />
-        <!-- See #237 -->
-        <env name="SYMFONY_DEPRECATIONS_HELPER" value="weak_vendors" />
     </php>
 
     <testsuites>
diff --git a/src/Doctrine/EntityClassGenerator.php b/src/Doctrine/EntityClassGenerator.php
@@ -26,7 +26,7 @@ public function __construct(Generator $generator)
         $this->generator = $generator;
     }
 
-    public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $apiResource): string
+    public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $apiResource, bool $securityUser = false): string
     {
         $repoClassDetails = $this->generator->createClassNameDetails(
             $entityClassDetails->getRelativeName(),
@@ -51,6 +51,7 @@ public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $
                 'entity_full_class_name' => $entityClassDetails->getFullName(),
                 'entity_class_name' => $entityClassDetails->getShortName(),
                 'entity_alias' => $entityAlias,
+                'security_user' => $securityUser,
             ]
         );
 
diff --git a/src/Doctrine/EntityRegenerator.php b/src/Doctrine/EntityRegenerator.php
@@ -234,6 +234,7 @@ private function generateRepository(ClassMetadata $metadata)
                 'entity_full_class_name' => $metadata->name,
                 'entity_class_name' => $entityClassName,
                 'entity_alias' => strtolower($entityClassName[0]),
+                'security_user' => false,
             ]
         );
 
diff --git a/src/Maker/MakeUser.php b/src/Maker/MakeUser.php
@@ -33,6 +33,7 @@
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Security\Core\Encoder\Argon2iPasswordEncoder;
 use Symfony\Component\Security\Core\Encoder\NativePasswordEncoder;
+use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
 use Symfony\Component\Yaml\Yaml;
 
 /**
@@ -138,7 +139,8 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
             $entityClassGenerator = new EntityClassGenerator($generator);
             $classPath = $entityClassGenerator->generateEntityClass(
                 $userClassNameDetails,
-                false // api resource
+                false, // api resource
+                interface_exists(PasswordUpgraderInterface::class) // security user
             );
         } else {
             $classPath = $generator->generateClass($userClassNameDetails->getFullName(), 'Class.tpl.php');
diff --git a/src/Resources/skeleton/authenticator/LoginFormAuthenticator.tpl.php b/src/Resources/skeleton/authenticator/LoginFormAuthenticator.tpl.php
@@ -17,9 +17,10 @@
 use Symfony\Component\Security\Csrf\CsrfToken;
 use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator;
+<?= ($password_authenticated = $user_needs_encoder && interface_exists('Symfony\Component\Security\Guard\PasswordAuthenticatedInterface')) ? "use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;\n" : '' ?>
 use Symfony\Component\Security\Http\Util\TargetPathTrait;
 
-class <?= $class_name; ?> extends AbstractFormLoginAuthenticator
+class <?= $class_name; ?> extends AbstractFormLoginAuthenticator<?= $password_authenticated ? " implements PasswordAuthenticatedInterface\n" : "\n" ?>
 {
     use TargetPathTrait;
 
@@ -85,6 +86,13 @@ public function checkCredentials($credentials, UserInterface $user)
         throw new \Exception('TODO: check the credentials inside '.__FILE__);\n" ?>
     }
 
+<?php if ($password_authenticated): ?>
+    public function getPassword($credentials)
+    {
+        return $credentials['password'];
+    }
+
+<?php endif ?>
     public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
     {
         if ($targetPath = $this->getTargetPath($request->getSession(), $providerKey)) {
diff --git a/src/Resources/skeleton/doctrine/Repository.tpl.php b/src/Resources/skeleton/doctrine/Repository.tpl.php
@@ -5,20 +5,36 @@
 use <?= $entity_full_class_name; ?>;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Symfony\Bridge\Doctrine\RegistryInterface;
+<?= $security_user ? "use Symfony\Component\Security\Core\Exception\UnsupportedUserException;\n" : '' ?>
+<?= $security_user ? "use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;\n" : '' ?>
+<?= $security_user ? "use Symfony\Component\Security\Core\User\UserInterface;\n" : '' ?>
 
 /**
  * @method <?= $entity_class_name; ?>|null find($id, $lockMode = null, $lockVersion = null)
  * @method <?= $entity_class_name; ?>|null findOneBy(array $criteria, array $orderBy = null)
  * @method <?= $entity_class_name; ?>[]    findAll()
  * @method <?= $entity_class_name; ?>[]    findBy(array $criteria, array $orderBy = null, $limit = null, $offset = null)
  */
-class <?= $class_name; ?> extends ServiceEntityRepository
+class <?= $class_name; ?> extends ServiceEntityRepository<?= $security_user ? " implements PasswordUpgraderInterface\n" : "\n" ?>
 {
     public function __construct(RegistryInterface $registry)
     {
         parent::__construct($registry, <?= $entity_class_name; ?>::class);
     }
 
+<?php if ($security_user): ?>
+    public function upgradePassword(UserInterface $user, string $newEncodedPassword): void
+    {
+        if (!$user instanceof User) {
+            throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', \get_class($user)));
+        }
+
+        $user->setPassword($newEncodedPassword);
+        $this->_em->persist($user);
+        $this->_em->flush();
+    }
+
+<?php endif ?>
     // /**
     //  * @return <?= $entity_class_name ?>[] Returns an array of <?= $entity_class_name ?> objects
     //  */
diff --git a/src/Resources/skeleton/security/UserProvider.tpl.php b/src/Resources/skeleton/security/UserProvider.tpl.php
@@ -4,10 +4,11 @@
 
 use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
 use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+<?= ($password_upgrader = interface_exists('Symfony\Component\Security\Core\User\PasswordUpgraderInterface')) ? "use Symfony\Component\Security\Core\User\PasswordUpgraderInterface\n" : '' ?>
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Core\User\UserProviderInterface;
 
-class <?= $class_name ?> implements UserProviderInterface
+class <?= $class_name ?> implements UserProviderInterface<?= $password_upgrader ? ", PasswordUpgraderInterface\n" : "\n" ?>
 {
     /**
      * Symfony calls this method if you use features like switch_user
@@ -60,4 +61,16 @@ public function supportsClass($class)
     {
         return <?= $user_short_name ?>::class === $class;
     }
+<?php if ($password_upgrader): ?>
+
+    /**
+     * Upgrades the encoded password of a user, typically for using a better hash algorithm.
+     */
+    public function upgradePassword(UserInterface $user, string $newEncodedPassword): void
+    {
+        // TODO: when encoded passwords are in use, this method should:
+        // 1. persist the new password in the user storage
+        // 2. update the $user object with $user->setPassword($newEncodedPassword);
+    }
+<?php endif ?>
 }

Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ public function __construct(Generator $generator)`
`26`	`26`	`$this->generator = $generator;`
`27`	`27`	`}`
`28`	`28`
`29`		`- public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $apiResource): string`
	`29`	`+ public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $apiResource, bool $securityUser = false): string`
`30`	`30`	`{`
`31`	`31`	`$repoClassDetails = $this->generator->createClassNameDetails(`
`32`	`32`	`$entityClassDetails->getRelativeName(),`
`@@ -51,6 +51,7 @@ public function generateEntityClass(ClassNameDetails $entityClassDetails, bool $`
`51`	`51`	`'entity_full_class_name' => $entityClassDetails->getFullName(),`
`52`	`52`	`'entity_class_name' => $entityClassDetails->getShortName(),`
`53`	`53`	`'entity_alias' => $entityAlias,`
	`54`	`+ 'security_user' => $securityUser,`
`54`	`55`	`]`
`55`	`56`	`);`
`56`	`57`
Original file line number	Diff line number	Diff line change
`@@ -234,6 +234,7 @@ private function generateRepository(ClassMetadata $metadata)`
`234`	`234`	`'entity_full_class_name' => $metadata->name,`
`235`	`235`	`'entity_class_name' => $entityClassName,`
`236`	`236`	`'entity_alias' => strtolower($entityClassName[0]),`
	`237`	`+ 'security_user' => false,`
`237`	`238`	`]`
`238`	`239`	`);`
`239`	`240`