CentralAuthUser.php
No OneTemporary
Actions

Size

92 KB

Referenced Files

None

Subscribers

None

CentralAuthUser.php
View Options

	<?php
	/**
	* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 2 of the License, or
	* (at your option) any later version.
	*
	* This program is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License along
	* with this program; if not, write to the Free Software Foundation, Inc.,
	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	* http://www.gnu.org/copyleft/gpl.html
	*
	* @file
	*/

	namespace MediaWiki\Extension\CentralAuth\User;

	use BadMethodCallException;
	use CentralAuthSessionProvider;
	use Exception;
	use InvalidArgumentException;
	use LogicException;
	use ManualLogEntry;
	use MapCacheLRU;
	use MediaWiki\Block\DatabaseBlock;
	use MediaWiki\Context\IContextSource;
	use MediaWiki\Context\RequestContext;
	use MediaWiki\DAO\WikiAwareEntity;
	use MediaWiki\Deferred\DeferredUpdates;
	use MediaWiki\Extension\CentralAuth\CentralAuthReadOnlyError;
	use MediaWiki\Extension\CentralAuth\CentralAuthServices;
	use MediaWiki\Extension\CentralAuth\LocalUserNotFoundException;
	use MediaWiki\Extension\CentralAuth\RCFeed\CARCFeedFormatter;
	use MediaWiki\Extension\CentralAuth\WikiSet;
	use MediaWiki\Logger\LoggerFactory;
	use MediaWiki\MainConfigNames;
	use MediaWiki\MediaWikiServices;
	use MediaWiki\Password\AbstractPbkdf2Password;
	use MediaWiki\Password\Password;
	use MediaWiki\Password\PasswordError;
	use MediaWiki\Password\PasswordFactory;
	use MediaWiki\RCFeed\FormattedRCFeed;
	use MediaWiki\RCFeed\RCFeed;
	use MediaWiki\Session\SessionManager;
	use MediaWiki\Status\Status;
	use MediaWiki\Title\Title;
	use MediaWiki\User\ExternalUserNames;
	use MediaWiki\User\User;
	use MediaWiki\User\UserIdentity;
	use MediaWiki\User\UserIdentityValue;
	use MediaWiki\WikiMap\WikiMap;
	use MWCryptHash;
	use MWCryptRand;
	use RevisionDeleteUser;
	use RuntimeException;
	use stdClass;
	use Wikimedia\AtEase\AtEase;
	use Wikimedia\IPUtils;
	use Wikimedia\ObjectCache\WANObjectCache;
	use Wikimedia\Rdbms\Database;
	use Wikimedia\Rdbms\DBAccessObjectUtils;
	use Wikimedia\Rdbms\IDBAccessObject;
	use Wikimedia\Rdbms\IReadableDatabase;

	class CentralAuthUser implements IDBAccessObject {

	/** @var MapCacheLRU Cache of loaded CentralAuthUsers */
	private static $loadedUsers = null;

	/**
	* The username of the current user.
	* @var string
	*/
	private $mName;
	/** @var bool */
	public $mStateDirty = false;
	/** @var int\|false */
	private $mDelayInvalidation = 0;

	/** @var string[]\|null */
	private $mAttachedArray;
	/** @var string */
	private $mEmail;
	/** @var bool */
	private $mEmailAuthenticated;
	/**
	* @var string\|null
	* @internal
	*/
	public $mHomeWiki;
	/** @var int\|null */
	private $mHiddenLevel;
	/** @var bool */
	private $mLocked;
	/**
	* @var string\|null As string, it is "\n"-imploded
	*/
	private $mAttachedList;
	/** @var string */
	private $mAuthenticationTimestamp;
	/**
	* @var array\|null
	* @phan-var ?list<array{group:string,expiry:?string}>
	*/
	private $mGroups;
	/**
	* @var array\|null
	* @phan-var ?list<array{right:string,set:?int}>
	*/
	private $mRights;
	/** @var string */
	private $mPassword;
	/** @var string */
	private $mAuthToken;
	/** @var int\|null */
	private $mGlobalId;
	/** @var bool */
	private $mFromPrimary;
	/** @var bool */
	private $mIsAttached;
	/** @var string */
	private $mRegistration;
	/** @var int */
	private $mGlobalEditCount;
	/** @var string */
	private $mBeingRenamed;
	/** @var string[] */
	private $mBeingRenamedArray;
	/** @var array[]\|null */
	protected $mAttachedInfo;
	/** @var int */
	protected $mCasToken = 0;
	/** @var \Psr\Log\LoggerInterface */
	private $logger;

	/** @var string[] */
	private static $mCacheVars = [
	'mGlobalId',
	'mPassword',
	'mAuthToken',
	'mLocked',
	'mHiddenLevel',
	'mRegistration',
	'mEmail',
	'mAuthenticationTimestamp',
	'mGroups',
	'mRights',
	'mHomeWiki',
	'mBeingRenamed',

	# Store the string list instead of the array, to save memory, and
	# avoid unserialize() overhead
	'mAttachedList',

	'mCasToken'
	];

	private const VERSION = 13;

	public const HIDDEN_LEVEL_NONE = 0;
	public const HIDDEN_LEVEL_LISTS = 1;
	public const HIDDEN_LEVEL_SUPPRESSED = 2;

	/**
	* The maximum number of edits a user can have and still be hidden
	*/
	private const HIDE_CONTRIBLIMIT = 1000;

	/**
	* The possible responses from self::authenticate(),
	* self::canAuthenticate() and self::authenticateWithToken().
	*
	* Constants are defined as lowercase strings for
	* backwards compatibility.
	*/
	public const AUTHENTICATE_OK = "ok";
	public const AUTHENTICATE_NO_USER = "no user";
	public const AUTHENTICATE_LOCKED = "locked";
	public const AUTHENTICATE_BAD_PASSWORD = "bad password";
	public const AUTHENTICATE_BAD_TOKEN = "bad token";
	public const AUTHENTICATE_GOOD_PASSWORD = "good password";

	/**
	* @note Don't call this directly. Use self::getInstanceByName() or
	* self::getPrimaryInstanceByName() instead.
	* @param string $username
	* @param int $flags Supports IDBAccessObject::READ_LATEST to use the primary DB
	*/
	public function __construct( $username, $flags = 0 ) {
	$this->mName = $username;
	$this->resetState();
	if ( DBAccessObjectUtils::hasFlags( $flags, IDBAccessObject::READ_LATEST ) ) {
	$this->mFromPrimary = true;
	}
	$this->logger = LoggerFactory::getInstance( 'CentralAuth' );
	}

	/**
	* Fetch the cache
	* @return MapCacheLRU
	*/
	private static function getUserCache() {
	if ( self::$loadedUsers === null ) {
	// Limit of 20 is arbitrary
	self::$loadedUsers = new MapCacheLRU( 20 );
	}
	return self::$loadedUsers;
	}

	/**
	* Explicitly set the (cached) CentralAuthUser object corresponding to the supplied User.
	* @param UserIdentity $user
	* @param CentralAuthUser $caUser
	*/
	public static function setInstance( UserIdentity $user, CentralAuthUser $caUser ) {
	self::getUserCache()->set( $user->getName(), $caUser );
	}

	/**
	* Create a (cached) CentralAuthUser object corresponding to the supplied User.
	* @param UserIdentity $user
	* @return CentralAuthUser
	*/
	public static function getInstance( UserIdentity $user ): self {
	return self::getInstanceByName( $user->getName() );
	}

	/**
	* Create a (cached) CentralAuthUser object corresponding to the supplied user.
	*
	* @param string $username A valid username. (Since 1.42 it does not have to be in the
	* canonical form anymore). IP addresses/ranges and external usernames are also accepted
	* for B/C but discouraged; they will be handled like a non-registered username.
	* @return CentralAuthUser
	* @throws InvalidArgumentException on invalid usernames.
	*/
	public static function getInstanceByName( $username ): self {
	if ( IPUtils::isValid( $username ) ) {
	$canonUsername = IPUtils::sanitizeIP( $username );
	} elseif ( IPUtils::isValidRange( $username ) ) {
	$canonUsername = IPUtils::sanitizeRange( $username );
	} elseif ( ExternalUserNames::isExternal( $username ) ) {
	$canonUsername = $username;
	} else {
	$canonUsername = MediaWikiServices::getInstance()->getUserNameUtils()
	->getCanonical( $username );
	}

	if ( $canonUsername === false \|\| $canonUsername === null ) {
	throw new InvalidArgumentException( "Invalid username: $username" );
	}

	$cache = self::getUserCache();
	$ret = $cache->get( $canonUsername );
	if ( !$ret ) {
	$ret = new self( $canonUsername );
	$cache->set( $canonUsername, $ret );
	}
	return $ret;
	}

	/**
	* Create a (cached) CentralAuthUser object corresponding to the supplied User.
	* This object will use DB_PRIMARY.
	* @param UserIdentity $user
	* @return CentralAuthUser
	* @since 1.37
	*/
	public static function getPrimaryInstance( UserIdentity $user ): self {
	return self::getPrimaryInstanceByName( $user->getName() );
	}

	/**
	* Create a (cached) CentralAuthUser object corresponding to the supplied User.
	* This object will use DB_PRIMARY.
	* @param string $username Must be validated and canonicalized by the caller
	* @return CentralAuthUser
	* @since 1.37
	*/
	public static function getPrimaryInstanceByName( $username ): self {
	$cache = self::getUserCache();
	$ret = $cache->get( $username );
	if ( !$ret \|\| !$ret->mFromPrimary ) {
	$ret = new self( $username, IDBAccessObject::READ_LATEST );
	$cache->set( $username, $ret );
	}
	return $ret;
	}

	/**
	* Test if this is a write-mode instance, and log if not.
	*/
	private function checkWriteMode() {
	if ( !$this->mFromPrimary ) {
	$this->logger->warning(
	'Write mode called on replica-loaded object',
	[ 'exception' => new RuntimeException() ]
	);
	}
	}

	/**
	* @return IReadableDatabase Primary database or replica based on shouldUsePrimaryDB()
	* @throws CentralAuthReadOnlyError
	*/
	protected function getSafeReadDB() {
	if ( $this->shouldUsePrimaryDB() ) {
	return CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	} else {
	return CentralAuthServices::getDatabaseManager()->getCentralReplicaDB();
	}
	}

	/**
	* Get (and init if needed) the value of mFromPrimary
	*
	* @return bool
	*/
	protected function shouldUsePrimaryDB() {
	$dbManager = CentralAuthServices::getDatabaseManager();
	if ( $dbManager->isReadOnly() ) {
	return false;
	}
	if ( $this->mFromPrimary === null ) {
	$this->mFromPrimary = $dbManager->centralLBHasRecentPrimaryChanges();
	}

	return $this->mFromPrimary;
	}

	/**
	* Return query data needed to properly use self::newFromRow
	* @return array (
	* 'tables' => array,
	* 'fields' => array,
	* 'conds' => array,
	* 'options' => array,
	* 'join_conds' => array,
	* )
	*/
	public static function selectQueryInfo() {
	return [
	'tables' => [ 'globaluser', 'localuser' ],
	'fields' => [
	'gu_id', 'gu_name', 'lu_wiki', 'gu_password', 'gu_auth_token',
	'gu_locked', 'gu_hidden_level', 'gu_registration', 'gu_email',
	'gu_email_authenticated', 'gu_home_db', 'gu_cas_token'
	],
	'conds' => [],
	'options' => [],
	'join_conds' => [
	'localuser' => [ 'LEFT OUTER JOIN', [ 'gu_name=lu_name', 'lu_wiki' => WikiMap::getCurrentWikiId() ] ]
	],
	];
	}

	/**
	* Get a CentralAuthUser object from a user's id
	*
	* @param int $id
	* @return CentralAuthUser\|bool false if no user exists with that id
	*/
	public static function newFromId( $id ) {
	$name = CentralAuthServices::getDatabaseManager()
	->getCentralReplicaDB()
	->newSelectQueryBuilder()
	->select( 'gu_name' )
	->from( 'globaluser' )
	->where( [ 'gu_id' => $id ] )
	->caller( __METHOD__ )
	->fetchField();

	return $name === false ? false : self::getInstanceByName( $name );
	}

	/**
	* Get a primary CentralAuthUser object from a user's id
	*
	* @param int $id
	* @return CentralAuthUser\|bool false if no user exists with that id
	* @since 1.37
	*/
	public static function newPrimaryInstanceFromId( $id ) {
	$name = CentralAuthServices::getDatabaseManager()
	->getCentralPrimaryDB()
	->newSelectQueryBuilder()
	->select( 'gu_name' )
	->from( 'globaluser' )
	->where( [ 'gu_id' => $id ] )
	->caller( __METHOD__ )
	->fetchField();

	return $name === false ? false : self::getPrimaryInstanceByName( $name );
	}

	/**
	* Create a CentralAuthUser object from a joined globaluser/localuser row
	*
	* @param stdClass $row
	* @param array $renameUser Empty if no rename is going on, else (oldname, newname)
	* @param bool $fromPrimary
	* @return CentralAuthUser
	*/
	public static function newFromRow( $row, $renameUser, $fromPrimary = false ): self {
	$caUser = new self( $row->gu_name );
	$caUser->loadFromRow( $row, $renameUser, $fromPrimary );
	return $caUser;
	}

	/**
	* Create a CentralAuthUser object for a user who is known to be unattached.
	* @param string $name The user name
	* @param bool $fromPrimary
	* @return CentralAuthUser
	*/
	public static function newUnattached( $name, $fromPrimary = false ): self {
	$caUser = new self( $name );
	$caUser->loadFromRow( false, [], $fromPrimary );
	return $caUser;
	}

	/**
	* Clear state information cache
	* Does not clear $this->mName, so the state information can be reloaded with loadState()
	*/
	protected function resetState() {
	$this->mGlobalId = null;
	$this->mGroups = null;
	$this->mAttachedArray = null;
	$this->mAttachedList = null;
	$this->mHomeWiki = null;
	}

	/**
	* Load up state information, but don't use the cache
	*/
	public function loadStateNoCache() {
	$this->loadState( true );
	}

	/**
	* Lazy-load up the most commonly required state information
	* @param bool $recache Force a load from the database then save back to the cache
	*/
	protected function loadState( $recache = false ) {
	if ( $recache ) {
	$this->resetState();
	} elseif ( isset( $this->mGlobalId ) ) {
	// Already loaded
	return;
	}

	// Check the cache (unless the primary database was requested via READ_LATEST)
	if ( !$recache && $this->mFromPrimary !== true ) {
	$this->loadFromCache();
	} else {
	$this->loadFromDatabase();
	}
	}

	/**
	* Load user groups and rights from the database.
	*
	* @param bool $force Set to true to load even when already loaded.
	*/
	protected function loadGroups( bool $force = false ) {
	if ( isset( $this->mGroups ) && !$force ) {
	// Already loaded
	return;
	}
	$this->logger->debug(
	'Loading groups for global user {user}',
	[ 'user' => $this->mName ]
	);

	// We need the user id from the database, but this should be checked by the getId accessor.
	$db = $this->getSafeReadDB();

	// Grab the user's rights/groups.
	$userAndExpiryConds = [
	'gug_user' => $this->getId(),
	$db->expr( 'gug_expiry', '=', null )->or( 'gug_expiry', '>=', $db->timestamp() ),
	];

	$resGroups = $db->newSelectQueryBuilder()
	->select( [ 'gug_group', 'gug_expiry', 'ggr_set' ] )
	->from( 'global_user_groups' )
	->leftJoin( 'global_group_restrictions', null, 'ggr_group=gug_group' )
	->where( $userAndExpiryConds )
	->caller( __METHOD__ )
	->fetchResultSet();
	$this->mGroups = [];
	foreach ( $resGroups as $row ) {
	$this->mGroups[] = [ 'group' => $row->gug_group, 'expiry' => $row->gug_expiry, 'set' => $row->ggr_set ];
	}

	$resRights = $db->newSelectQueryBuilder()
	->select( [ 'ggp_permission', 'ggr_set' ] )
	->from( 'global_group_permissions' )
	->join( 'global_user_groups', null, 'ggp_group=gug_group' )
	->leftJoin( 'global_group_restrictions', null, 'ggr_group=gug_group' )
	->where( $userAndExpiryConds )
	->caller( __METHOD__ )
	->fetchResultSet();
	$this->mRights = [];
	foreach ( $resRights as $row ) {
	// Only store the set id here, and don't compute effective rights, because
	// this is stored in a shared cache for all wikis (see loadFromCache()),
	// which also isn't invalidated if the set is changed.
	$this->mRights[] = [ 'right' => $row->ggp_permission, 'set' => $row->ggr_set ];
	}
	}

	/**
	* @return int\|null Time when a global user group membership for this user will expire
	* the next time in UNIX time, or null if this user has no temporary global group memberships.
	*/
	private function getClosestGlobalUserGroupExpiry(): ?int {
	$this->loadGroups();

	$closestExpiry = null;

	foreach ( $this->mGroups as [ 'expiry' => $expiration ] ) {
	if ( !$expiration ) {
	continue;
	}

	$expiration = wfTimestamp( TS_UNIX, $expiration );

	if ( $closestExpiry ) {
	$closestExpiry = min( $closestExpiry, $expiration );
	} else {
	$closestExpiry = $expiration;
	}
	}

	return $closestExpiry;
	}

	protected function loadFromDatabase() {
	$this->logger->debug(
	'Loading state for global user {user} from DB',
	[ 'user' => $this->mName ]
	);

	$fromPrimary = $this->shouldUsePrimaryDB();
	// matches $fromPrimary above
	$db = $this->getSafeReadDB();

	$row = $db->newSelectQueryBuilder()
	->queryInfo( self::selectQueryInfo() )
	->where( [ 'gu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchRow();

	$renameUser = CentralAuthServices::getGlobalRenameFactory()
	->newGlobalRenameUserStatus( $this->mName )
	->getNames(
	null,
	$fromPrimary ? IDBAccessObject::READ_LATEST : IDBAccessObject::READ_NORMAL
	);

	$this->loadFromRow( $row, $renameUser, $fromPrimary );
	}

	/**
	* Load user state from a joined globaluser/localuser row
	*
	* @param stdClass\|bool $row
	* @param array $renameUser Empty if no rename is going on, else (oldname, newname)
	* @param bool $fromPrimary
	*/
	protected function loadFromRow( $row, $renameUser, $fromPrimary = false ) {
	if ( $row ) {
	$this->mGlobalId = intval( $row->gu_id );
	$this->mIsAttached = ( $row->lu_wiki !== null );
	$this->mPassword = $row->gu_password;
	$this->mAuthToken = $row->gu_auth_token;
	$this->mLocked = $row->gu_locked;
	$this->mHiddenLevel = (int)$row->gu_hidden_level;
	$this->mRegistration = wfTimestamp( TS_MW, $row->gu_registration );
	$this->mEmail = $row->gu_email;
	$this->mAuthenticationTimestamp =
	wfTimestampOrNull( TS_MW, $row->gu_email_authenticated );
	$this->mHomeWiki = $row->gu_home_db;
	$this->mCasToken = $row->gu_cas_token;
	} else {
	$this->mGlobalId = 0;
	$this->mIsAttached = false;
	$this->mLocked = false;
	$this->mHiddenLevel = self::HIDDEN_LEVEL_NONE;
	$this->mCasToken = 0;
	}

	$this->mFromPrimary = $fromPrimary;

	$this->mBeingRenamedArray = $renameUser ?? [];
	$this->mBeingRenamed = implode( '\|', $this->mBeingRenamedArray );
	}

	/**
	* Load data from memcached
	*
	* @return bool
	*/
	protected function loadFromCache() {
	$cache = MediaWikiServices::getInstance()->getMainWANObjectCache();
	$data = $cache->getWithSetCallback(
	$this->getCacheKey( $cache ),
	$cache::TTL_DAY,
	function ( $oldValue, &$ttl, array &$setOpts ) {
	$dbr = CentralAuthServices::getDatabaseManager()->getCentralReplicaDB();
	$setOpts += Database::getCacheSetOptions( $dbr );

	$this->loadFromDatabase();
	$this->loadAttached();
	$this->loadGroups();

	// if this user has global user groups expiring in less than the default TTL (1 day),
	// max out the TTL so that then-expired user groups will not be loaded from cache
	$closestGugExpiry = $this->getClosestGlobalUserGroupExpiry();
	if ( $closestGugExpiry ) {
	$ttl = min( $closestGugExpiry - time(), $ttl );
	}

	$data = [];
	foreach ( self::$mCacheVars as $var ) {
	$data[$var] = $this->$var;
	}

	return $data;
	},
	[ 'pcTTL' => $cache::TTL_PROC_LONG, 'version' => self::VERSION ]
	);

	$this->loadFromCacheObject( $data );

	return true;
	}

	/**
	* Load user state from a cached array.
	*
	* @param array $object
	*/
	protected function loadFromCacheObject( array $object ) {
	$this->logger->debug(
	'Loading CentralAuthUser for user {user} from cache object',
	[ 'user' => $this->mName ]
	);

	foreach ( self::$mCacheVars as $var ) {
	$this->$var = $object[$var];
	}

	$this->loadAttached();

	$this->mIsAttached = $this->exists() && in_array( WikiMap::getCurrentWikiId(), $this->mAttachedArray );
	$this->mFromPrimary = false;

	$closestUserGroupExpiration = $this->getClosestGlobalUserGroupExpiry();
	if ( $closestUserGroupExpiration !== null && $closestUserGroupExpiration < time() ) {
	$this->logger->warning(
	'Cached user {user} had a global group expiration in the past '
	. '({unixTimestamp}), this should not be possible',
	[
	'user' => $this->getName(),
	'unixTimestamp' => $closestUserGroupExpiration,
	]
	);

	// load accurate data for this request from the database
	$this->loadGroups( true );

	// kill the current cache entry so that next request can use the cached value
	$this->quickInvalidateCache();
	}
	}

	/**
	* Return the global account ID number for this account, if it exists.
	* @return int
	*/
	public function getId() {
	$this->loadState();
	return $this->mGlobalId;
	}

	/**
	* Return the local user account ID of the user with the same name on given wiki,
	* irrespective of whether it is attached or not
	* @param string $wikiId ID for the local database to connect to
	* @return int\|null Local user ID for given $wikiID. Null if $wikiID is invalid or local user
	* doesn't exist
	*/
	public function getLocalId( $wikiId ) {
	// Make sure the wiki ID is valid. (This prevents DBConnectionError in unit tests)
	$wikiList = CentralAuthServices::getWikiListService()->getWikiList();
	if ( !in_array( $wikiId, $wikiList ) ) {
	return null;
	}
	// Retrieve the local user ID from the specified database.
	$db = CentralAuthServices::getDatabaseManager()->getLocalDB( DB_PRIMARY, $wikiId );
	$id = $db->newSelectQueryBuilder()
	->select( 'user_id' )
	->from( 'user' )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchField();
	return $id ? (int)$id : null;
	}

	/**
	* Generate a valid memcached key for caching the object's data.
	* @param WANObjectCache $cache
	* @return string
	*/
	protected function getCacheKey( WANObjectCache $cache ) {
	return $cache->makeGlobalKey( 'centralauth-user', md5( $this->mName ) );
	}

	/**
	* Return the global account's name, whether it exists or not.
	* @return string
	*/
	public function getName() {
	return $this->mName;
	}

	/**
	* @return bool True if the account is attached on the local wiki
	*/
	public function isAttached() {
	$this->loadState();
	return $this->mIsAttached;
	}

	/**
	* Return the password.
	*
	* @return Password
	*/
	public function getPasswordObject() {
	$this->loadState();
	return $this->getPasswordFromString( $this->mPassword, '' );
	}

	/**
	* Return the global-login token for this account.
	* @return string
	*/
	public function getAuthToken() {
	global $wgAuthenticationTokenVersion;

	$this->loadState();

	if ( !isset( $this->mAuthToken ) \|\| !$this->mAuthToken ) {
	$this->resetAuthToken();
	}

	if ( $wgAuthenticationTokenVersion === null ) {
	return $this->mAuthToken;
	} else {
	$ret = MWCryptHash::hmac( $wgAuthenticationTokenVersion, $this->mAuthToken, false );

	// The raw hash can be overly long. Shorten it up.
	if ( strlen( $ret ) < 32 ) {
	// Should never happen, even md5 is 128 bits
	throw new \UnexpectedValueException( 'Hmac returned less than 128 bits' );
	}
	return substr( $ret, -32 );
	}
	}

	/**
	* Check whether a global user account for this name exists yet.
	* If migration state is set for pass 1, this may trigger lazy
	* evaluation of automatic migration for the account.
	*
	* @return bool
	*/
	public function exists() {
	return (bool)$this->getId();
	}

	/**
	* Returns whether the account is
	* locked.
	* @return bool
	*/
	public function isLocked() {
	$this->loadState();
	return (bool)$this->mLocked;
	}

	/**
	* Returns whether user name should not
	* be shown in public lists.
	* @return bool
	*/
	public function isHidden() {
	$this->loadState();
	return $this->mHiddenLevel !== self::HIDDEN_LEVEL_NONE;
	}

	/**
	* Returns whether user's name should
	* be hidden from all public views because
	* of privacy issues.
	* @return bool
	*/
	public function isSuppressed() {
	$this->loadState();
	return $this->mHiddenLevel == self::HIDDEN_LEVEL_SUPPRESSED;
	}

	/**
	* Returns an array of blocks per wiki the user is attached to.
	* @throws LocalUserNotFoundException
	* @return array
	*/
	public function getBlocks(): array {
	$blocksByWikiId = [];

	$mwServices = MediaWikiServices::getInstance();
	$dbm = CentralAuthServices::getDatabaseManager();

	$wikis = $this->queryAttachedBasic();
	foreach ( $wikis as $wikiId => $_ ) {
	$db = $dbm->getLocalDB( DB_REPLICA, $wikiId );
	$fields = [ 'user_id' ];
	$conds = [ 'user_name' => $this->mName ];

	$row = $db->newSelectQueryBuilder()
	->select( $fields )
	->from( 'user' )
	->where( $conds )
	->caller( __METHOD__ )
	->fetchRow();
	if ( !$row ) {
	# Row missing from replica, try the primary database instead
	$db = $dbm->getLocalDB( DB_PRIMARY, $wikiId );
	$row = $db->newSelectQueryBuilder()
	->select( $fields )
	->from( 'user' )
	->where( $conds )
	->caller( __METHOD__ )
	->fetchRow();
	}
	if ( !$row ) {
	$ex = new LocalUserNotFoundException(
	"Could not find local user data for {$this->mName}@{$wikiId}"
	);
	$this->logger->warning(
	'Could not find local user data for {username}@{wikiId}',
	[
	'username' => $this->mName,
	'wikiId' => $wikiId,
	'exception' => $ex,
	]
	);
	throw $ex;
	}
	// if the current wiki is the local wiki, then the BlockStore expect "WikiAwareEntity::LOCAL" as value;
	if ( $wikiId === WikiMap::getCurrentWikiId() ) {
	$wikiId = WikiAwareEntity::LOCAL;
	}

	$blockStore = $mwServices
	->getDatabaseBlockStoreFactory()
	->getDatabaseBlockStore( $wikiId );
	$blocksByWikiId[$wikiId] = $blockStore->newListFromConds(
	[ 'bt_user' => $row->user_id ]
	);
	}

	return $blocksByWikiId;
	}

	/**
	* Returns true if the account has any blocks on any wikis.
	* @throws LocalUserNotFoundException
	* @return bool
	*/
	public function isBlocked(): bool {
	$blocksByWikiId = $this->getBlocks();

	foreach ( $blocksByWikiId as $wikiId => $blocks ) {
	if ( count( $blocks ) > 0 ) {
	return true;
	}
	}

	return false;
	}

	/**
	* Returns true if the account has any public logs.
	*
	* By default this method ignores 'newusers' logs as almost all users will
	* have a log record of that type.
	*
	* @param array $excludeTypes is an array of log types to ignore
	* @return bool
	*/
	public function hasPublicLogs( $excludeTypes = [ 'newusers' ] ): bool {
	$services = MediaWikiServices::getInstance();
	$dbm = CentralAuthServices::getDatabaseManager();

	$wikis = $this->queryAttachedBasic();
	foreach ( $wikis as $wikiId => $_ ) {
	$dbr = $dbm->getLocalDB( DB_REPLICA, $wikiId );

	$actorStore = $services->getActorStoreFactory()->getActorStore( $wikiId );
	$user = $actorStore->getUserIdentityByName( $this->getName() );
	if ( !$user ) {
	continue;
	}
	$actorId = $actorStore->acquireActorId( $user, $dbr );

	$conds = [
	'log_actor' => $actorId,
	$dbr->expr( 'log_type', '!=', $excludeTypes ),
	];
	$row = $dbr->newSelectQueryBuilder()
	->select( [ 'log_id' ] )
	->from( 'logging' )
	->where( $conds )
	->caller( __METHOD__ )
	->fetchRow();
	if ( $row ) {
	return true;
	}
	}

	return false;
	}

	/**
	* Returns the hidden level of the account.
	* @throws Exception for now
	* @return never
	* @deprecated use getHiddenLevelInt() instead
	*/
	public function getHiddenLevel(): int {
	// Have it like this for one train, then rename getHiddenLevelInt to this
	throw new BadMethodCallException( 'Nothing should call this!' );
	}

	/**
	* Temporary name, will be getHiddenLevel() when migration is complete
	* @return int one of self::HIDDEN_LEVEL_* constants
	*/
	public function getHiddenLevelInt(): int {
	$this->loadState();
	return $this->mHiddenLevel;
	}

	/**
	* @return string timestamp
	*/
	public function getRegistration() {
	$this->loadState();
	return wfTimestamp( TS_MW, $this->mRegistration );
	}

	/**
	* Return the id of the user's home wiki.
	*
	* @return string\|null Null if the account has no attached wikis
	*/
	public function getHomeWiki() {
	$this->loadState();

	if ( $this->mHomeWiki !== null && $this->mHomeWiki !== '' ) {
	return $this->mHomeWiki;
	}

	$attached = $this->queryAttachedBasic();

	if ( !count( $attached ) ) {
	return null;
	}

	foreach ( $attached as $wiki => $acc ) {
	if ( $acc['attachedMethod'] == 'primary' \|\| $acc['attachedMethod'] == 'new' ) {
	$this->mHomeWiki = $wiki;
	break;
	}
	}

	if ( $this->mHomeWiki === null \|\| $this->mHomeWiki === '' ) {
	// Still null... try harder.
	$attached = $this->queryAttached();
	// Make sure we always have some value
	$this->mHomeWiki = key( $attached );
	$maxEdits = -1;
	foreach ( $attached as $wiki => $acc ) {
	if ( isset( $acc['editCount'] ) && $acc['editCount'] > $maxEdits ) {
	$this->mHomeWiki = $wiki;
	$maxEdits = $acc['editCount'];
	}
	}
	}

	return $this->mHomeWiki;
	}

	/**
	* @return int total number of edits for all wikis
	*/
	public function getGlobalEditCount() {
	if ( $this->mGlobalEditCount === null ) {
	$this->mGlobalEditCount = CentralAuthServices::getEditCounter()
	->getCount( $this );
	}
	return $this->mGlobalEditCount;
	}

	/**
	* Register a new, not previously existing, central user account
	* Remaining fields are expected to be filled out shortly...
	* eeeyuck
	*
	* @param string\|null $password
	* @param string $email
	* @return bool
	*/
	public function register( $password, $email ) {
	$this->checkWriteMode();
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$hash = $this->saltedPassword( $password );
	if ( !$this->mAuthToken ) {
	$this->mAuthToken = MWCryptRand::generateHex( 32 );
	}

	$data = [
	'gu_name' => $this->mName,

	'gu_email' => $email,
	'gu_email_authenticated' => null,

	'gu_password' => $hash,

	'gu_auth_token' => $this->mAuthToken,

	'gu_locked' => 0,
	'gu_hidden_level' => self::HIDDEN_LEVEL_NONE,

	'gu_registration' => $dbw->timestamp(),
	];

	$dbw->newInsertQueryBuilder()
	->insertInto( 'globaluser' )
	->ignore()
	->row( $data )
	->caller( __METHOD__ )
	->execute();

	$ok = $dbw->affectedRows() === 1;
	$this->logger->info(
	$ok
	? 'registered global account "{user}"'
	: 'registration failed for global account "{user}"',
	[ 'user' => $this->mName ]
	);

	if ( $ok ) {
	// Avoid lazy initialisation of edit count
	$dbw->newInsertQueryBuilder()
	->insertInto( 'global_edit_count' )
	->row( [
	'gec_user' => $dbw->insertId(),
	'gec_count' => 0
	] )
	->caller( __METHOD__ )
	->execute();
	}

	// Kill any cache entries saying we don't exist
	$this->invalidateCache();
	return $ok;
	}

	/**
	* For use in migration pass zero.
	* Store local user data into the auth server's migration table.
	* @param string $wiki Source wiki ID
	* @param array $users Associative array of ids => names
	*/
	public static function storeMigrationData( $wiki, $users ) {
	if ( !$users ) {
	return;
	}

	$globalTuples = [];
	$tuples = [];
	foreach ( $users as $name ) {
	$globalTuples[] = [ 'gn_name' => $name ];
	$tuples[] = [
	'ln_wiki' => $wiki,
	'ln_name' => $name
	];
	}

	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newInsertQueryBuilder()
	->insertInto( 'globalnames' )
	->ignore()
	->rows( $globalTuples )
	->caller( __METHOD__ )
	->execute();
	$dbw->newInsertQueryBuilder()
	->insertInto( 'localnames' )
	->ignore()
	->rows( $tuples )
	->caller( __METHOD__ )
	->execute();
	}

	/**
	* Store global user data in the auth server's main table.
	*
	* @param string $salt
	* @param string $hash
	* @param string $email
	* @param string $emailAuth timestamp
	* @return bool Whether we were successful or not.
	*/
	protected function storeGlobalData( $salt, $hash, $email, $emailAuth ) {
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$data = [
	'gu_name' => $this->mName,
	'gu_password' => $hash,
	// So it doesn't have to be done later
	'gu_auth_token' => MWCryptRand::generateHex( 32 ),
	'gu_email' => $email,
	'gu_email_authenticated' => $dbw->timestampOrNull( $emailAuth ),
	'gu_registration' => $dbw->timestamp(),
	'gu_locked' => 0,
	'gu_hidden_level' => self::HIDDEN_LEVEL_NONE,
	];

	$dbw->newInsertQueryBuilder()
	->insertInto( 'globaluser' )
	->ignore()
	->row( $data )
	->caller( __METHOD__ )
	->execute();

	$this->resetState();
	return $dbw->affectedRows() != 0;
	}

	/**
	* @param string[] $passwords
	* @param bool $sendToRC
	* @param bool $safe Only allow migration if all users can be migrated
	* @param bool $checkHome Re-check the user's ownership of the home wiki
	* @return bool
	*/
	public function storeAndMigrate(
	$passwords = [], $sendToRC = true, $safe = false, $checkHome = false
	) {
	$ret = $this->attemptAutoMigration( $passwords, $sendToRC, $safe, $checkHome );
	if ( $ret === true ) {
	$this->recordAntiSpoof();
	}

	return $ret;
	}

	/**
	* Record the current username in the AntiSpoof system
	*/
	protected function recordAntiSpoof() {
	$spoof = CentralAuthServices::getAntiSpoofManager()->getSpoofUser( $this->mName );
	$spoof->record();
	}

	/**
	* Remove the current username from the AntiSpoof system
	*/
	public function removeAntiSpoof() {
	$spoof = CentralAuthServices::getAntiSpoofManager()->getSpoofUser( $this->mName );
	$spoof->remove();
	}

	/**
	* Out of the given set of local account data, pick which will be the
	* initially-assigned home wiki.
	*
	* This will be the account with the highest edit count, either out of
	* all privileged accounts or all accounts if none are privileged.
	*
	* @param array $migrationSet
	* @throws Exception
	* @return string\|null
	*/
	public function chooseHomeWiki( $migrationSet ) {
	if ( !$migrationSet ) {
	throw new LogicException( 'Logic error -- empty migration set in chooseHomeWiki' );
	}

	// Sysops get priority
	$found = [];
	$priorityGroups = [ 'checkuser', 'suppress', 'bureaucrat', 'sysop' ];
	foreach ( $priorityGroups as $group ) {
	foreach ( $migrationSet as $wiki => $local ) {
	if ( isset( $local['groupMemberships'][$group] ) ) {
	$found[] = $wiki;
	}
	}
	if ( count( $found ) === 1 ) {
	// Easy!
	return $found[0];
	} elseif ( $found ) {
	// We'll check edit counts now...
	break;
	}
	}

	if ( !$found ) {
	// No privileged accounts; look among the plebes...
	$found = array_keys( $migrationSet );
	}

	$maxEdits = -1;
	$homeWiki = null;
	foreach ( $found as $wiki ) {
	$count = $migrationSet[$wiki]['editCount'];
	if ( $count > $maxEdits ) {
	$homeWiki = $wiki;
	$maxEdits = $count;
	} elseif ( $count === $maxEdits ) {
	// Tie, check earlier registration
	// Note that registration might be "null", which means they're a super old account.
	if ( !$homeWiki \|\| $migrationSet[$wiki]['registration'] <
	$migrationSet[$homeWiki]['registration']
	) {
	$homeWiki = $wiki;
	} elseif ( $migrationSet[$wiki]['registration'] ===
	$migrationSet[$homeWiki]['registration']
	) {
	// Another tie? Screw it, pick one randomly.
	$wikis = [ $wiki, $homeWiki ];
	$homeWiki = $wikis[mt_rand( 0, 1 )];
	}
	}
	}

	return $homeWiki;
	}

	/**
	* Go through a list of migration data looking for those which
	* can be automatically migrated based on the available criteria.
	*
	* @param array[] $migrationSet
	* @param string[] $passwords Optional, pre-authenticated passwords.
	* Should match an account which is known to be attached.
	* @return string[] Array of <wiki> => <authentication method>
	*/
	public function prepareMigration( $migrationSet, $passwords = [] ) {
	// If the primary account has an email address set,
	// we can use it to match other accounts. If it doesn't,
	// we can't be sure that the other accounts with no mail
	// are the same person, so err on the side of caution.
	// For additional safety, we'll only let the mail check
	// propagate from a confirmed account
	$passingMail = [];
	if ( $this->mEmail != '' && $this->mEmailAuthenticated ) {
	$passingMail[$this->mEmail] = true;
	}

	$passwordConfirmed = [];
	// If we've got an authenticated password to work with, we can
	// also assume their email addresses are useful for this purpose...
	if ( $passwords ) {
	foreach ( $migrationSet as $wiki => $local ) {
	if ( $local['email'] && $local['emailAuthenticated'] &&
	!isset( $passingMail[$local['email']] )
	) {
	// Test passwords only once here as comparing hashes is very expensive
	$passwordConfirmed[$wiki] = $this->matchHashes(
	$passwords,
	$this->getPasswordFromString( $local['password'], $local['id'] )
	);

	if ( $passwordConfirmed[$wiki] ) {
	$passingMail[$local['email']] = true;
	}
	}
	}
	}

	$attach = [];
	foreach ( $migrationSet as $wiki => $local ) {
	$localName = "$this->mName@$wiki";
	if ( $wiki == $this->mHomeWiki ) {
	// Primary account holder... duh
	$method = 'primary';
	} elseif ( $local['emailAuthenticated'] && isset( $passingMail[$local['email']] ) ) {
	// Same email address as the primary account, or the same email address as another
	// password confirmed account, means we know they could reset their password, so we
	// give them the account.
	// Authenticated email addresses only to prevent merges with malicious users
	$method = 'mail';
	} elseif (
	( isset( $passwordConfirmed[$wiki] ) && $passwordConfirmed[$wiki] ) \|\|
	( !isset( $passwordConfirmed[$wiki] ) &&
	$this->matchHashes(
	$passwords,
	$this->getPasswordFromString( $local['password'], $local['id'] )
	) )
	) {
	// Matches the pre-authenticated password, yay!
	$method = 'password';
	} else {
	// Can't automatically resolve this account.
	// If the password matches, it will be automigrated
	// at next login. If no match, user will have to input
	// the conflicting password or deal with the conflict.
	$this->logger->info( 'unresolvable {user}', [ 'user' => $localName ] );
	continue;
	}
	$this->logger->info( '$method {user}', [ 'user' => $localName ] );
	$attach[$wiki] = $method;
	}

	return $attach;
	}

	/**
	* Do a dry run -- pick a winning primary account and try to auto-merge
	* as many as possible, but don't perform any actions yet.
	*
	* @param string[] $passwords
	* @param string\|false &$home set to false if no permission to do checks
	* @param array &$attached on success, list of wikis which will be auto-attached
	* @param array &$unattached on success, list of wikis which won't be auto-attached
	* @param array &$methods on success, associative array of each wiki's attachment method
	* @return Status
	*/
	public function migrationDryRun( $passwords, &$home, &$attached, &$unattached, &$methods ) {
	// Because it messes with $this->mEmail and so on
	$this->checkWriteMode();

	$home = false;
	$attached = [];
	$unattached = [];

	// First, make sure we were given the current wiki's password.
	$self = $this->localUserData( WikiMap::getCurrentWikiId() );
	$selfPassword = $this->getPasswordFromString( $self['password'], $self['id'] );
	if ( !$this->matchHashes( $passwords, $selfPassword ) ) {
	$this->logger->info( 'dry run: failed self-password check' );
	return Status::newFatal( 'wrongpassword' );
	}

	$migrationSet = $this->queryUnattached();
	if ( !$migrationSet ) {
	$this->logger->info( 'dry run: no accounts to merge, failed migration' );
	return Status::newFatal( 'centralauth-merge-no-accounts' );
	}
	$home = $this->chooseHomeWiki( $migrationSet );
	$local = $migrationSet[$home];

	// And we need to match the home wiki before proceeding...
	$localPassword = $this->getPasswordFromString( $local['password'], $local['id'] );
	if ( $this->matchHashes( $passwords, $localPassword ) ) {
	$this->logger->info(
	'dry run: passed password match to home {home}',
	[ 'home' => $home ]
	);
	} else {
	$this->logger->info(
	'dry run: failed password match to home {home}',
	[ 'home' => $home ]
	);
	return Status::newFatal( 'centralauth-merge-home-password' );
	}

	$this->mHomeWiki = $home;
	$this->mEmail = $local['email'];
	$this->mEmailAuthenticated = $local['emailAuthenticated'];
	$attach = $this->prepareMigration( $migrationSet, $passwords );

	$all = array_keys( $migrationSet );
	$attached = array_keys( $attach );
	$unattached = array_diff( $all, $attached );
	$methods = $attach;

	sort( $attached );
	sort( $unattached );
	ksort( $methods );

	return Status::newGood();
	}

	/**
	* Promote an unattached account to a
	* global one, using the provided homewiki
	*
	* @param string $wiki
	* @return Status
	*/
	public function promoteToGlobal( $wiki ) {
	$unattached = $this->queryUnattached();
	if ( !isset( $unattached[$wiki] ) ) {
	return Status::newFatal( 'promote-not-on-wiki' );
	}

	$info = $unattached[$wiki];

	if ( $this->exists() ) {
	return Status::newFatal( 'promote-already-exists' );
	}

	$ok = $this->storeGlobalData(
	$info['id'],
	$info['password'],
	$info['email'],
	$info['emailAuthenticated']
	);
	if ( !$ok ) {
	// Race condition?
	return Status::newFatal( 'promote-already-exists' );
	}

	$this->attach( $wiki, 'primary' );

	$this->recordAntiSpoof();

	return Status::newGood();
	}

	/**
	* Choose an email address to use from an array as obtained via self::queryUnattached.
	*
	* @param array[] $wikisToAttach
	*/
	private function chooseEmail( array $wikisToAttach ) {
	$this->checkWriteMode();

	if ( $this->mEmail ) {
	return;
	}

	foreach ( $wikisToAttach as $attachWiki ) {
	if ( $attachWiki['email'] ) {
	$this->mEmail = $attachWiki['email'];
	$this->mEmailAuthenticated = $attachWiki['emailAuthenticated'];
	if ( $attachWiki['emailAuthenticated'] ) {
	// If the email is authenticated, stop searching
	return;
	}
	}
	}
	}

	/**
	* Pick a winning primary account and try to auto-merge as many as possible.
	* @fixme add some locking or something
	*
	* @param string[] $passwords
	* @param bool $sendToRC
	* @param bool $safe Only migrate if all accounts can be merged
	* @param bool $checkHome Re-check the user's ownership of the home wiki
	* @return bool Whether full automatic migration completed successfully.
	*/
	protected function attemptAutoMigration(
	$passwords = [], $sendToRC = true, $safe = false, $checkHome = false
	) {
	$this->checkWriteMode();
	$migrationSet = $this->queryUnattached();
	$logger = $this->logger;
	if ( !$migrationSet ) {
	$logger->info( 'no accounts to merge, failed migration' );
	return false;
	}

	if ( isset( $this->mHomeWiki ) ) {
	if ( !array_key_exists( $this->mHomeWiki, $migrationSet ) ) {
	$logger->info(
	'Invalid home wiki specification \'{user}@{home}\'',
	[ 'user' => $this->mName, 'home' => $this->mHomeWiki ]
	);
	return false;
	}
	} else {
	$this->mHomeWiki = $this->chooseHomeWiki( $migrationSet );
	}

	$home = $migrationSet[$this->mHomeWiki];

	// Check home wiki when the user is initiating this merge, just
	// like we did in migrationDryRun
	$homePassword = $this->getPasswordFromString( $home['password'], $home['id'] );
	if ( $checkHome && !$this->matchHashes( $passwords, $homePassword ) ) {
	$logger->info(
	'auto migrate: failed password match to home {home}',
	[ 'home' => $this->mHomeWiki ]
	);
	return false;
	}

	$this->mEmail = $home['email'];
	$this->mEmailAuthenticated = $home['emailAuthenticated'];

	// Pick all the local accounts matching the "primary" home account
	$attach = $this->prepareMigration( $migrationSet, $passwords );

	if ( $safe && count( $attach ) !== count( $migrationSet ) ) {
	$logger->info(
	'Safe auto-migration for \'{user}\' failed',
	[ 'user' => $this->mName ]
	);
	return false;
	}

	$wikisToAttach = array_intersect_key( $migrationSet, $attach );

	// The home wiki might not have an email set, but maybe an other account has one?
	$this->chooseEmail( $wikisToAttach );

	// storeGlobalData clears $this->mHomeWiki
	$homeWiki = $this->mHomeWiki;
	// Actually do the migration
	$ok = $this->storeGlobalData(
	$home['id'],
	$home['password'],
	$this->mEmail,
	$this->mEmailAuthenticated
	);

	if ( !$ok ) {
	$logger->info(
	'attemptedAutoMigration for existing entry \'{user}\'',
	[ 'user' => $this->mName ]
	);
	return false;
	}

	if ( count( $attach ) < count( $migrationSet ) ) {
	$logger->info(
	'Incomplete migration for \'{user}\'',
	[ 'user' => $this->mName ]
	);
	} else {
	if ( count( $migrationSet ) == 1 ) {
	$logger->info(
	'Singleton migration for \'{user}\' on {home}',
	[ 'user' => $this->mName, 'home' => $homeWiki ]
	);
	} else {
	$logger->info(
	'Full automatic migration for \'{user}\'',
	[ 'user' => $this->mName ]
	);
	}
	}

	// Don't purge the cache 50 times.
	$this->startTransaction();

	foreach ( $attach as $wiki => $method ) {
	$this->attach( $wiki, $method, $sendToRC );
	}

	$this->endTransaction();

	return count( $attach ) == count( $migrationSet );
	}

	/**
	* Attempt to migrate any remaining unattached accounts by virtue of
	* the password check.
	*
	* @param string $password plaintext password to try matching
	* @param string[] &$migrated Array of wiki IDs for records which were
	* successfully migrated by this operation
	* @param string[] &$remaining Array of wiki IDs for records which are still
	* unattached after the operation
	* @return bool true if all accounts are migrated at the end
	*/
	public function attemptPasswordMigration( $password, &$migrated = [], &$remaining = [] ) {
	$rows = $this->queryUnattached();
	$logger = $this->logger;

	if ( count( $rows ) == 0 ) {
	$logger->info(
	'Already fully migrated user \'{user}\'',
	[ 'user' => $this->mName ]
	);
	return true;
	}

	$migrated = [];
	$remaining = [];

	// Don't invalidate the cache 50 times
	$this->startTransaction();

	// Look for accounts we can match by password
	foreach ( $rows as $row ) {
	$wiki = $row['wiki'];
	if ( $this->matchHash( $password,
	$this->getPasswordFromString( $row['password'], $row['id'] ) )->isGood()
	) {
	$logger->info(
	'Attaching \'{user}\' on {wiki} by password',
	[
	'user' => $this->mName,
	'wiki' => $wiki
	]
	);
	$this->attach( $wiki, 'password' );
	$migrated[] = $wiki;
	} else {
	$logger->info(
	'No password match for \'{user}\' on {wiki}',
	[
	'user' => $this->mName,
	'wiki' => $wiki
	]
	);
	$remaining[] = $wiki;
	}
	}

	$this->endTransaction();

	if ( count( $remaining ) == 0 ) {
	$logger->info(
	'Successful auto migration for \'{user}\'',
	[ 'user' => $this->mName ]
	);
	return true;
	}

	$logger->info(
	'Incomplete migration for \'{user}\'',
	[ 'user' => $this->mName ]
	);
	return false;
	}

	/**
	* @throws Exception
	* @param string[] $list
	* @return string[]
	*/
	protected static function validateList( $list ) {
	$unique = array_unique( $list );
	$wikiList = CentralAuthServices::getWikiListService()->getWikiList();
	$valid = array_intersect( $unique, $wikiList );

	if ( count( $valid ) != count( $list ) ) {
	// fixme: handle this gracefully
	throw new RuntimeException( "Invalid input" );
	}

	return $valid;
	}

	/**
	* Unattach a list of local accounts from the global account
	* @param array $list List of wiki names
	* @return Status
	*/
	public function adminUnattach( $list ) {
	$this->checkWriteMode();

	if ( !count( $list ) ) {
	return Status::newFatal( 'centralauth-admin-none-selected' );
	}
	$status = new Status;
	$valid = $this->validateList( $list );
	$invalid = array_diff( $list, $valid );
	foreach ( $invalid as $wikiName ) {
	$status->error( 'centralauth-invalid-wiki', $wikiName );
	$status->failCount++;
	}

	$databaseManager = CentralAuthServices::getDatabaseManager();
	$dbcw = $databaseManager->getCentralPrimaryDB();
	$password = $this->getPassword();

	foreach ( $valid as $wikiName ) {
	# Delete the user from the central localuser table
	$dbcw->newDeleteQueryBuilder()
	->deleteFrom( 'localuser' )
	->where( [
	'lu_name' => $this->mName,
	'lu_wiki' => $wikiName
	] )
	->caller( __METHOD__ )
	->execute();
	if ( !$dbcw->affectedRows() ) {
	$wiki = WikiMap::getWiki( $wikiName );
	$status->error( 'centralauth-admin-already-unmerged', $wiki->getDisplayName() );
	$status->failCount++;
	continue;
	}

	# Touch the local user row, update the password
	$dblw = $databaseManager->getLocalDB( DB_PRIMARY, $wikiName );
	$dblw->newUpdateQueryBuilder()
	->update( 'user' )
	->set( [
	'user_touched' => $dblw->timestamp(),
	'user_password' => $password
	] )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();

	$userRow = $dblw->newSelectQueryBuilder()
	->select( [ 'user_id', 'user_editcount' ] )
	->from( 'user' )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchRow();

	# Remove the edits from the global edit count
	$counter = CentralAuthServices::getEditCounter();
	$counter->increment( $this, -(int)$userRow->user_editcount );

	$this->clearLocalUserCache( $wikiName, $userRow->user_id );

	$status->successCount++;
	}

	if ( in_array( WikiMap::getCurrentWikiId(), $valid ) ) {
	$this->resetState();
	}

	$this->invalidateCache();

	return $status;
	}

	/**
	* Queue a job to unattach this user from a named wiki.
	*
	* @param string $wikiId
	*/
	protected function queueAdminUnattachJob( $wikiId ) {
	$services = MediaWikiServices::getInstance();

	$job = $services->getJobFactory()->newJob(
	'CentralAuthUnattachUserJob',
	[
	'username' => $this->getName(),
	'wiki' => $wikiId,
	]
	);

	$services->getJobQueueGroupFactory()->makeJobQueueGroup( $wikiId )->lazyPush( $job );
	}

	/**
	* Delete a global account and log what happened
	*
	* @param string $reason Reason for the deletion
	* @param UserIdentity $deleter User doing the deletion
	* @return Status
	*/
	public function adminDelete( $reason, UserIdentity $deleter ) {
	$this->checkWriteMode();

	$this->logger->info(
	'Deleting global account for user \'{user}\'',
	[ 'user' => $this->mName ]
	);
	$databaseManager = CentralAuthServices::getDatabaseManager();
	$centralDB = $databaseManager->getCentralPrimaryDB();

	# Synchronise passwords
	$password = $this->getPassword();
	$localUserRes = $centralDB->newSelectQueryBuilder()
	->select( 'lu_wiki' )
	->from( 'localuser' )
	->where( [ 'lu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchFieldValues();
	foreach ( $localUserRes as $wiki ) {
	$this->logger->debug( __METHOD__ . ": Fixing password on $wiki\n" );
	$localDB = $databaseManager->getLocalDB( DB_PRIMARY, $wiki );
	$localDB->newUpdateQueryBuilder()
	->update( 'user' )
	->set( [ 'user_password' => $password ] )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();

	$id = $localDB->newSelectQueryBuilder()
	->select( 'user_id' )
	->from( 'user' )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchField();

	$this->clearLocalUserCache( $wiki, $id );
	}
	$wasSuppressed = $this->isSuppressed();

	$centralDB->startAtomic( __METHOD__ );
	# Delete and lock the globaluser row
	$centralDB->newDeleteQueryBuilder()
	->deleteFrom( 'globaluser' )
	->where( [ 'gu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	if ( !$centralDB->affectedRows() ) {
	$centralDB->endAtomic( __METHOD__ );
	return Status::newFatal( 'centralauth-admin-delete-nonexistent', $this->mName );
	}
	# Delete all global user groups for the user
	$centralDB->newDeleteQueryBuilder()
	->deleteFrom( 'global_user_groups' )
	->where( [ 'gug_user' => $this->getId() ] )
	->caller( __METHOD__ )
	->execute();
	# Delete the localuser rows
	$centralDB->newDeleteQueryBuilder()
	->deleteFrom( 'localuser' )
	->where( [ 'lu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	$centralDB->endAtomic( __METHOD__ );

	if ( $wasSuppressed ) {
	// "suppress/delete" is taken by core, so use "cadelete"
	$this->logAction(
	'cadelete',
	$deleter,
	$reason,
	[],
	true
	);
	} else {
	$this->logAction(
	'delete',
	$deleter,
	$reason,
	[],
	);
	}
	$this->invalidateCache();

	return Status::newGood();
	}

	/**
	* Lock a global account
	*
	* @return Status
	*/
	public function adminLock() {
	$this->checkWriteMode();
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newUpdateQueryBuilder()
	->update( 'globaluser' )
	->set( [ 'gu_locked' => 1 ] )
	->where( [ 'gu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	if ( !$dbw->affectedRows() ) {
	return Status::newFatal( 'centralauth-state-mismatch' );
	}

	$this->invalidateCache();
	$user = User::newFromName( $this->mName );
	SessionManager::singleton()->invalidateSessionsForUser( $user );

	// T375870: Track rate of locks for monitoring of anti-abuse tool usage.
	MediaWikiServices::getInstance()->getStatsFactory()->withComponent( 'CentralAuth' )
	->getCounter( 'account_lock' )
	->increment();

	return Status::newGood();
	}

	/**
	* Unlock a global account
	*
	* @return Status
	*/
	public function adminUnlock() {
	$this->checkWriteMode();
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newUpdateQueryBuilder()
	->update( 'globaluser' )
	->set( [ 'gu_locked' => 0 ] )
	->where( [ 'gu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	if ( !$dbw->affectedRows() ) {
	return Status::newFatal( 'centralauth-state-mismatch' );
	}

	$this->invalidateCache();

	return Status::newGood();
	}

	/**
	* Change account hiding level.
	*
	* @param int $level CentralAuthUser::HIDDEN_LEVEL_* class constant
	* @return Status
	*/
	public function adminSetHidden( int $level ) {
	$this->checkWriteMode();

	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newUpdateQueryBuilder()
	->update( 'globaluser' )
	->set( [ 'gu_hidden_level' => $level ] )
	->where( [ 'gu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	if ( !$dbw->affectedRows() ) {
	return Status::newFatal( 'centralauth-admin-unhide-nonexistent', $this->mName );
	}

	$this->invalidateCache();

	return Status::newGood();
	}

	/**
	* Set locking and hiding settings for a Global User and log the changes made.
	*
	* @param bool\|null $setLocked
	* true = lock
	* false = unlock
	* null = don't change
	* @param int\|null $setHidden
	* hidden level, one of the HIDDEN_ constants
	* null = don't change
	* @param string $reason reason for hiding
	* @param IContextSource $context
	* @param bool $markAsBot Whether to mark the log entry in RC with the bot flag
	* @return Status
	*/
	public function adminLockHide(
	$setLocked, ?int $setHidden, $reason, IContextSource $context, bool $markAsBot = false
	) {
	$isLocked = $this->isLocked();
	$oldHiddenLevel = $this->getHiddenLevelInt();
	$lockStatus = $hideStatus = null;
	$added = [];
	$removed = [];
	$user = $context->getUser();

	if ( $setLocked === null ) {
	$setLocked = $isLocked;
	} elseif ( !$context->getAuthority()->isAllowed( 'centralauth-lock' ) ) {
	return Status::newFatal( 'centralauth-admin-not-authorized' );
	}

	if ( $setHidden === null ) {
	$setHidden = $oldHiddenLevel;
	} elseif (
	$setHidden !== self::HIDDEN_LEVEL_NONE
	\|\| $oldHiddenLevel !== self::HIDDEN_LEVEL_NONE
	) {
	if ( !$context->getAuthority()->isAllowed( 'centralauth-suppress' ) ) {
	return Status::newFatal( 'centralauth-admin-not-authorized' );
	} elseif ( $this->getGlobalEditCount() > self::HIDE_CONTRIBLIMIT ) {
	return Status::newFatal(
	$context->msg( 'centralauth-admin-too-many-edits', $this->mName )
	->numParams( self::HIDE_CONTRIBLIMIT )
	);
	}
	}

	$returnStatus = Status::newGood();

	$hiddenLevels = [
	self::HIDDEN_LEVEL_NONE,
	self::HIDDEN_LEVEL_LISTS,
	self::HIDDEN_LEVEL_SUPPRESSED,
	];

	// if not a known value, default to none
	if ( !in_array( $setHidden, $hiddenLevels ) ) {
	$setHidden = self::HIDDEN_LEVEL_NONE;
	}

	if ( !$isLocked && $setLocked ) {
	$lockStatus = $this->adminLock();
	$added[] = 'locked';
	} elseif ( $isLocked && !$setLocked ) {
	$lockStatus = $this->adminUnlock();
	$removed[] = 'locked';
	}

	if ( $oldHiddenLevel != $setHidden ) {
	$hideStatus = $this->adminSetHidden( $setHidden );
	switch ( $setHidden ) {
	case self::HIDDEN_LEVEL_NONE:
	$removed[] = $oldHiddenLevel === self::HIDDEN_LEVEL_SUPPRESSED ?
	'oversighted' :
	'hidden';
	break;
	case self::HIDDEN_LEVEL_LISTS:
	$added[] = 'hidden';
	if ( $oldHiddenLevel === self::HIDDEN_LEVEL_SUPPRESSED ) {
	$removed[] = 'oversighted';
	}
	break;
	case self::HIDDEN_LEVEL_SUPPRESSED:
	$added[] = 'oversighted';
	if ( $oldHiddenLevel === self::HIDDEN_LEVEL_LISTS ) {
	$removed[] = 'hidden';
	}
	break;
	}

	$userName = $user->getName();
	if ( $setHidden === self::HIDDEN_LEVEL_SUPPRESSED ) {
	$this->suppress( $userName, $reason );
	} elseif ( $oldHiddenLevel === self::HIDDEN_LEVEL_SUPPRESSED ) {
	$this->unsuppress( $userName, $reason );
	}
	}

	$good = ( !$lockStatus \|\| $lockStatus->isGood() ) &&
	( !$hideStatus \|\| $hideStatus->isGood() );

	// Setup Status object to return all of the information for logging
	if ( $good && ( $added \|\| $removed ) ) {
	$returnStatus->successCount = count( $added ) + count( $removed );
	$this->logAction(
	'setstatus',
	$context->getUser(),
	$reason,
	[ 'added' => $added, 'removed' => $removed ],
	$setHidden !== self::HIDDEN_LEVEL_NONE,
	$markAsBot
	);
	} elseif ( !$good ) {
	if ( $lockStatus !== null && !$lockStatus->isGood() ) {
	$returnStatus->merge( $lockStatus );
	}
	if ( $hideStatus !== null && !$hideStatus->isGood() ) {
	$returnStatus->merge( $hideStatus );
	}
	}

	return $returnStatus;
	}

	/**
	* Suppresses all user accounts in all wikis.
	* @param string $name
	* @param string $reason
	*/
	public function suppress( $name, $reason ) {
	$this->doCrosswikiSuppression( true, $name, $reason );
	}

	/**
	* Unsuppresses all user accounts in all wikis.
	* @param string $name
	* @param string $reason
	*/
	public function unsuppress( $name, $reason ) {
	$this->doCrosswikiSuppression( false, $name, $reason );
	}

	/**
	* @param bool $suppress
	* @param string $by
	* @param string $reason
	*/
	protected function doCrosswikiSuppression( $suppress, $by, $reason ) {
	global $wgCentralAuthWikisPerSuppressJob;
	$this->loadAttached();
	if ( count( $this->mAttachedArray ) <= $wgCentralAuthWikisPerSuppressJob ) {
	foreach ( $this->mAttachedArray as $wiki ) {
	$this->doLocalSuppression( $suppress, $wiki, $by, $reason );
	}
	} else {
	$jobParams = [
	'username' => $this->getName(),
	'suppress' => $suppress,
	'by' => $by,
	'reason' => $reason,
	];
	$jobs = [];

	$services = MediaWikiServices::getInstance();
	$jobFactory = $services->getJobFactory();

	$chunks = array_chunk( $this->mAttachedArray, $wgCentralAuthWikisPerSuppressJob );
	foreach ( $chunks as $wikis ) {
	$jobParams['wikis'] = $wikis;
	$jobs[] = $jobFactory->newJob(
	'crosswikiSuppressUser',
	$jobParams
	);
	}

	// Push the jobs right before COMMIT (which is likely to succeed).
	// If the job push fails, then the transaction will roll back.
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->onTransactionPreCommitOrIdle( static function () use ( $services, $jobs ) {
	$services->getJobQueueGroup()->push( $jobs );
	}, __METHOD__ );
	}
	}

	/**
	* Suppresses a local account of a user.
	*
	* @param bool $suppress
	* @param string $wiki
	* @param string $by
	* @param string $reason
	* @return array\|null Error array on failure
	*/
	public function doLocalSuppression( $suppress, $wiki, $by, $reason ) {
	global $wgConf, $wgCentralAuthGlobalBlockInterwikiPrefix;

	$databaseManager = CentralAuthServices::getDatabaseManager();
	$dbw = $databaseManager->getLocalDB( DB_PRIMARY, $wiki );
	$data = $this->localUserData( $wiki );

	$wikiId = $wiki === WikiMap::getCurrentWikiId() ? WikiAwareEntity::LOCAL : $wiki;

	$blockStore = MediaWikiServices::getInstance()
	->getDatabaseBlockStoreFactory()
	->getDatabaseBlockStore( $wikiId );

	if ( $suppress ) {
	[ , $lang ] = $wgConf->siteFromDB( $wiki );
	if ( !MediaWikiServices::getInstance()->getLanguageNameUtils()->isSupportedLanguage( $lang ?? '' ) ) {
	$lang = 'en';
	}
	$blockReason = wfMessage( 'centralauth-admin-suppressreason', $by, $reason )
	->inLanguage( $lang )->text();

	// TODO DatabaseBlock is not @newable
	$block = new DatabaseBlock( [
	'address' => UserIdentityValue::newRegistered( $data['id'], $this->mName, $wikiId ),
	'wiki' => $wikiId,
	'reason' => $blockReason,
	'timestamp' => wfTimestampNow(),
	'expiry' => $dbw->getInfinity(),
	'createAccount' => true,
	'enableAutoblock' => true,
	'hideName' => true,
	'blockEmail' => true,
	'by' => UserIdentityValue::newExternal(
	$wgCentralAuthGlobalBlockInterwikiPrefix, $by, $wikiId
	)
	] );

	# On normal block, BlockIp hook would be run here, but doing
	# that from CentralAuth doesn't seem a good idea...

	if ( !$blockStore->insertBlock( $block ) ) {
	return [ 'ipb_already_blocked' ];
	}
	# Ditto for BlockIpComplete hook.

	RevisionDeleteUser::suppressUserName( $this->mName, $data['id'], $dbw );

	# Locally log to suppress ?
	} else {
	$affected = $blockStore->deleteBlocksMatchingConds( [
	'bt_user' => $data['id'],
	// Our blocks don't have a user associated
	'bl_by' => null,
	'bl_deleted' => true,
	] );

	// Unsuppress only if unblocked
	if ( $affected ) {
	RevisionDeleteUser::unsuppressUserName( $this->mName, $data['id'], $dbw );
	}
	}
	return null;
	}

	/**
	* Add a local account record for the given wiki to the central database.
	* @param string $wikiID
	* @param string $method
	* @param bool $sendToRC
	* @param string\|int $ts MediaWiki timestamp or 0 for current time
	*
	* Prerequisites:
	* - completed migration state
	*/
	public function attach( $wikiID, $method = 'new', $sendToRC = true, $ts = 0 ) {
	global $wgCentralAuthRC;

	$this->checkWriteMode();

	$dbcw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbcw->newInsertQueryBuilder()
	->insertInto( 'localuser' )
	->ignore()
	->row( [
	'lu_wiki' => $wikiID,
	'lu_name' => $this->mName,
	'lu_attached_timestamp' => $dbcw->timestamp( $ts ),
	'lu_attached_method' => $method,
	'lu_local_id' => $this->getLocalId( $wikiID ),
	'lu_global_id' => $this->getId()
	] )
	->caller( __METHOD__ )
	->execute();
	$success = $dbcw->affectedRows() === 1;

	if ( $wikiID === WikiMap::getCurrentWikiId() ) {
	$this->resetState();
	}

	$this->invalidateCache();

	if ( !$success ) {
	$this->logger->info(
	'Race condition? Already attached {user}@{wiki}, just tried by \'{method}\'',
	[ 'user' => $this->mName, 'wiki' => $wikiID, 'method' => $method ]
	);
	return;
	}

	$this->logger->info(
	'Attaching local user {user}@{wiki} by \'{method}\'',
	[ 'user' => $this->mName, 'wiki' => $wikiID, 'method' => $method ]
	);

	$this->addLocalEdits( $wikiID );

	if ( $sendToRC ) {
	$userpage = Title::makeTitleSafe( NS_USER, $this->mName );

	foreach ( $wgCentralAuthRC as $rc ) {
	$engine = RCFeed::factory( $rc );
	if ( !( $engine instanceof FormattedRCFeed ) ) {
	throw new RuntimeException(
	'wgCentralAuthRC only supports feeds that use FormattedRCFeed, got '
	. get_class( $engine ) . ' instead'
	);
	}

	/** @var CARCFeedFormatter $formatter */
	$formatter = new $rc['formatter']();

	$engine->send( $rc, $formatter->getLine( $userpage, $wikiID ) );
	}
	}
	}

	/**
	* Add edits from a wiki to the global edit count
	*
	* @param string $wikiID
	*/
	protected function addLocalEdits( $wikiID ) {
	$dblw = CentralAuthServices::getDatabaseManager()->getLocalDB( DB_PRIMARY, $wikiID );
	$editCount = $dblw->newSelectQueryBuilder()
	->select( 'user_editcount' )
	->from( 'user' )
	->where( [ 'user_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchField();
	$counter = CentralAuthServices::getEditCounter();
	$counter->increment( $this, $editCount );
	}

	/**
	* If the user provides the correct password, would we let them log in?
	* This encompasses checks on missing and locked accounts, at present.
	* @return bool\|string true if login available, or const authenticate status
	*/
	public function canAuthenticate() {
	if ( !$this->getId() ) {
	$this->logger->info(
	"authentication for '{user}' failed due to missing account",
	[ 'user' => $this->mName ]
	);
	return self::AUTHENTICATE_NO_USER;
	}

	// If the global account has been locked, we don't want to spam
	// other wikis with local account creations.
	if ( $this->isLocked() ) {
	return self::AUTHENTICATE_LOCKED;
	}

	// Don't allow users to autocreate if they are oversighted.
	// If they do, their name will appear on local user list
	// (and since it contains private info, its unacceptable).
	if ( $this->isSuppressed() ) {
	// Avoid unnecessary database connections by only loading the user
	// details if the account is suppressed, since that's a very small minority
	// of login attempts for non-locked users.
	$userIdentity = MediaWikiServices::getInstance()->getUserIdentityLookup()
	->getUserIdentityByName( $this->getName() );
	if ( !$userIdentity \|\| !$userIdentity->isRegistered() ) {
	return self::AUTHENTICATE_LOCKED;
	}
	}

	return true;
	}

	/**
	* Attempt to authenticate the global user account with the given password
	* @param string $password
	* @return string[] status represented by const(s) AUTHENTICATE_LOCKED,
	* AUTHENTICATE_NO_USER, AUTHENTICATE_BAD_PASSWORD
	* and AUTHENTICATE_OK
	*/
	public function authenticate( $password ) {
	$canAuthenticate = $this->canAuthenticate();
	if (
	$canAuthenticate !== true &&
	$canAuthenticate !== self::AUTHENTICATE_LOCKED
	) {
	return [ $canAuthenticate ];
	}

	$passwordMatchStatus = $this->matchHash( $password, $this->getPasswordObject() );

	if ( $canAuthenticate === true ) {
	if ( $passwordMatchStatus->isGood() ) {
	$this->logger->info( "authentication for '{user}' succeeded", [ 'user' => $this->mName ] );

	$config = RequestContext::getMain()->getConfig();
	$passwordFactory = new PasswordFactory(
	$config->get( MainConfigNames::PasswordConfig ),
	$config->get( MainConfigNames::PasswordDefault )
	);

	if ( $passwordFactory->needsUpdate( $passwordMatchStatus->getValue() ) ) {
	DeferredUpdates::addCallableUpdate( function () use ( $password ) {
	if ( CentralAuthServices::getDatabaseManager()->isReadOnly() ) {
	return;
	}

	$centralUser = CentralAuthUser::newPrimaryInstanceFromId( $this->getId() );
	if ( $centralUser ) {
	// Don't bother resetting the auth token for a hash
	// upgrade. It's not really a password change, and
	// since this is being done post-send it'll cause the
	// user to be logged out when they just tried to log in
	// since it can't update the just-sent session cookies.
	$centralUser->setPassword( $password, false );
	$centralUser->saveSettings();
	}
	} );
	}

	return [ self::AUTHENTICATE_OK ];
	} else {
	$this->logger->info( "authentication for '{user}' failed, bad pass", [ 'user' => $this->mName ] );
	return [ self::AUTHENTICATE_BAD_PASSWORD ];
	}
	} else {
	if ( $passwordMatchStatus->isGood() ) {
	$this->logger->info(
	"authentication for '{user}' failed, correct pass but locked",
	[ 'user' => $this->mName ]
	);
	return [ self::AUTHENTICATE_LOCKED ];
	} else {
	$this->logger->info(
	"authentication for '{user}' failed, locked with wrong password",
	[ 'user' => $this->mName ]
	);
	return [ self::AUTHENTICATE_BAD_PASSWORD, self::AUTHENTICATE_LOCKED ];
	}
	}
	}

	/**
	* Attempt to authenticate the global user account with the given global authtoken
	* @param string $token
	* @return string status, one of: AUTHENTICATE_LOCKED,
	* AUTHENTICATE_NO_USER, AUTHENTICATE_BAD_TOKEN
	* and AUTHENTICATE_OK
	*/
	public function authenticateWithToken( $token ) {
	$canAuthenticate = $this->canAuthenticate();
	if ( $canAuthenticate !== true ) {
	return $canAuthenticate;
	}

	return $this->validateAuthToken( $token ) ? self::AUTHENTICATE_OK : self::AUTHENTICATE_BAD_TOKEN;
	}

	/**
	* @param string $plaintext User-provided password plaintext.
	* @param Password $password Password to check against
	*
	* @return Status
	*/
	protected function matchHash( $plaintext, Password $password ) {
	$matched = false;

	if ( $password->verify( $plaintext ) ) {
	$matched = true;
	} elseif ( !( $password instanceof AbstractPbkdf2Password ) && function_exists( 'iconv' ) ) {
	// Some wikis were converted from ISO 8859-1 to UTF-8;
	// retained hashes may contain non-latin chars.
	AtEase::suppressWarnings();
	$latin1 = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $plaintext );
	AtEase::restoreWarnings();
	if ( $latin1 !== false && $password->verify( $latin1 ) ) {
	$matched = true;
	}
	}

	if ( $matched ) {
	return Status::newGood( $password );
	} else {
	return Status::newFatal( 'bad' );
	}
	}

	/**
	* @param string[] $passwords
	* @param Password $password Password to check against
	*
	* @return bool
	*/
	protected function matchHashes( array $passwords, Password $password ) {
	foreach ( $passwords as $plaintext ) {
	if ( $this->matchHash( $plaintext, $password )->isGood() ) {
	return true;
	}
	}

	return false;
	}

	/**
	* @param string $encrypted Fully salted and hashed database crypto text from db.
	* @param string $salt The hash "salt", eg a local id for migrated passwords.
	*
	* @return Password
	* @throws PasswordError
	*/
	private function getPasswordFromString( $encrypted, $salt ) {
	$config = RequestContext::getMain()->getConfig();
	$passwordFactory = new PasswordFactory(
	$config->get( MainConfigNames::PasswordConfig ),
	$config->get( MainConfigNames::PasswordDefault )
	);

	if ( preg_match( '/^[0-9a-f]{32}$/', $encrypted ) ) {
	$encrypted = ":B:{$salt}:{$encrypted}";
	}

	return $passwordFactory->newFromCiphertext( $encrypted );
	}

	/**
	* Fetch a list of databases where this account name is registered,
	* but not yet attached to the global account. It would be used for
	* an alert or management system to show which accounts have still
	* to be dealt with.
	*
	* @return string[] of database name strings
	*/
	public function listUnattached() {
	if ( IPUtils::isIPAddress( $this->mName ) ) {
	// don't bother with primary database queries
	return [];
	}

	return $this->doListUnattached();
	}

	/**
	* @return string[]
	*/
	private function doListUnattached() {
	$databaseManager = CentralAuthServices::getDatabaseManager();
	// Make sure lazy-loading in listUnattached() works, as we
	// may need to switch to using the primary DB for this query
	$db = $databaseManager->centralLBHasRecentPrimaryChanges()
	? $databaseManager->getCentralPrimaryDB()
	: $this->getSafeReadDB();

	$result = $db->newSelectQueryBuilder()
	->select( 'ln_wiki' )
	->from( 'localnames' )
	->leftJoin( 'localuser', null, [ 'ln_wiki=lu_wiki', 'ln_name=lu_name' ] )
	->where( [ 'ln_name' => $this->mName, 'lu_name' => null ] )
	->caller( __METHOD__ )
	->fetchFieldValues();

	$wikis = [];
	foreach ( $result as $wiki ) {
	if ( !WikiMap::getWiki( $wiki ) ) {
	$this->logger->warning( __METHOD__ . ': invalid wiki in localnames: ' . $wiki );
	continue;
	}

	$wikis[] = $wiki;
	}

	return $wikis;
	}

	/**
	* @param string $wikiID
	*/
	public function addLocalName( $wikiID ) {
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newInsertQueryBuilder()
	->insertInto( 'localnames' )
	->ignore()
	->row( [
	'ln_wiki' => $wikiID,
	'ln_name' => $this->mName
	] )
	->caller( __METHOD__ )
	->execute();
	}

	/**
	* @param string $wikiID
	*/
	public function removeLocalName( $wikiID ) {
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newDeleteQueryBuilder()
	->deleteFrom( 'localnames' )
	->where( [
	'ln_wiki' => $wikiID,
	'ln_name' => $this->mName
	] )
	->caller( __METHOD__ )
	->execute();
	}

	/**
	* Updates the localname table after a rename
	* @param string $wikiID
	* @param string $newname
	*/
	public function updateLocalName( $wikiID, $newname ) {
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newUpdateQueryBuilder()
	->update( 'localnames' )
	->set( [ 'ln_name' => $newname ] )
	->where( [ 'ln_wiki' => $wikiID, 'ln_name' => $this->mName ] )
	->caller( __METHOD__ )
	->execute();
	}

	/**
	* Load the list of databases where this account has been successfully
	* attached
	*/
	public function loadAttached() {
	if ( isset( $this->mAttachedArray ) ) {
	// Already loaded
	return;
	}

	if ( isset( $this->mAttachedList ) && $this->mAttachedList !== '' ) {
	// We have a list already, probably from the cache.
	$this->mAttachedArray = explode( "\n", $this->mAttachedList );

	return;
	}

	$this->logger->debug(
	"Loading attached wiki list for global user {$this->mName} from DB"
	);

	$db = $this->getSafeReadDB();

	$wikis = $db->newSelectQueryBuilder()
	->select( 'lu_wiki' )
	->from( 'localuser' )
	->where( [ 'lu_name' => $this->mName ] )
	->caller( __METHOD__ )
	->fetchFieldValues();

	$this->mAttachedArray = $wikis;
	$this->mAttachedList = implode( "\n", $wikis );
	}

	/**
	* Fetch a list of databases where this account has been successfully
	* attached.
	*
	* @return string[] Database name strings
	*/
	public function listAttached() {
	$this->loadAttached();

	return $this->mAttachedArray;
	}

	/**
	* Same as $this->renameInProgress, but only checks one wiki
	* Not cached
	* @see CentralAuthUser::renameInProgress
	* @param string $wiki
	* @param int $recency Bitfield of IDBAccessObject::READ_* constants
	* @return string[]\|false
	*/
	public function renameInProgressOn( string $wiki, int $recency = IDBAccessObject::READ_NORMAL ) {
	return CentralAuthServices::getGlobalRenameFactory()
	->newGlobalRenameUserStatus( $this->mName )
	->getNames(
	$wiki,
	$recency
	) ?: false;
	}

	/**
	* Check if a rename from the old name is in progress
	* @return string[] (oldname, newname) if being renamed, or empty if not
	*/
	public function renameInProgress() {
	$this->loadState();
	if ( $this->mBeingRenamedArray === null ) {
	$this->mBeingRenamedArray = $this->mBeingRenamed === ''
	? [] : explode( '\|', $this->mBeingRenamed );
	}

	return $this->mBeingRenamedArray;
	}

	/**
	* Returns a list of all groups where the user is a member of the group on at
	* least one wiki where their account is attached.
	* @return string[] List of group names where the user is a member on at least one wiki
	*/
	public function getLocalGroups() {
	$localgroups = [];
	foreach ( $this->queryAttached() as $local ) {
	$localgroups = array_unique( array_merge(
	$localgroups, array_keys( $local['groupMemberships'] )
	) );
	}
	return $localgroups;
	}

	/**
	* Get information about each local user attached to this account
	*
	* @return array[] Map of database name to property table with members:
	* wiki The wiki ID (database name)
	* attachedTimestamp The MW timestamp when the account was attached
	* attachedMethod Attach method: password, mail or primary
	* ... All information returned by localUserData()
	*/
	public function queryAttached() {
	// Cache $wikis to avoid expensive query whenever possible
	// mAttachedInfo is shared with queryAttachedBasic(); check whether it contains partial data
	if (
	$this->mAttachedInfo !== null
	&& ( !$this->mAttachedInfo \|\| array_key_exists( 'id', reset( $this->mAttachedInfo ) ) )
	) {
	return $this->mAttachedInfo;
	}

	$wikis = $this->queryAttachedBasic();

	foreach ( $wikis as $wikiId => $_ ) {
	try {
	$localUser = $this->localUserData( $wikiId );
	$wikis[$wikiId] = array_merge( $wikis[$wikiId], $localUser );
	} catch ( LocalUserNotFoundException $e ) {
	// T119736: localuser table told us that the user was attached
	// from $wikiId but there is no data in the primary database or replicas
	// that corroborates that.
	unset( $wikis[$wikiId] );
	// Queue a job to delete the bogus attachment record.
	$this->queueAdminUnattachJob( $wikiId );
	}
	}

	$this->mAttachedInfo = $wikis;

	return $wikis;
	}

	/**
	* Helper method for queryAttached().
	*
	* Does the cheap part of the lookup by checking the cross-wiki localuser table,
	* and returns attach time and method.
	*
	* @return array[]
	*/
	public function queryAttachedBasic() {
	if ( $this->mAttachedInfo !== null ) {
	return $this->mAttachedInfo;
	}

	$db = $this->getSafeReadDB();

	$result = $db->newSelectQueryBuilder()
	->select( [
	'lu_wiki',
	'lu_attached_timestamp',
	'lu_attached_method',
	] )
	->from( 'localuser' )
	->where( [ 'lu_name' => $this->mName, ] )
	->caller( __METHOD__ )
	->fetchResultSet();

	$wikis = [];
	foreach ( $result as $row ) {
	/** @var stdClass $row */

	if ( !WikiMap::getWiki( $row->lu_wiki ) ) {
	$this->logger->warning( __METHOD__ . ': invalid wiki in localuser: ' . $row->lu_wiki );
	continue;
	}

	$wikis[$row->lu_wiki] = [
	'wiki' => $row->lu_wiki,
	'attachedTimestamp' => wfTimestampOrNull( TS_MW, $row->lu_attached_timestamp ),
	'attachedMethod' => $row->lu_attached_method,
	];
	}

	$this->mAttachedInfo = $wikis;

	return $wikis;
	}

	/**
	* Find any remaining migration records for this username which haven't gotten attached to
	* some global account.
	* Formatted as associative array with some data.
	*
	* @throws Exception
	* @return array[]
	*/
	public function queryUnattached() {
	$wikiIDs = $this->listUnattached();

	$items = [];
	foreach ( $wikiIDs as $wikiID ) {
	try {
	$items[$wikiID] = $this->localUserData( $wikiID );
	} catch ( LocalUserNotFoundException $e ) {
	// T119736: localnames table told us that the name was
	// unattached on $wikiId but there is no data in the primary database
	// or replicas that corroborates that.
	// Queue a job to delete the bogus record.
	$this->queueAdminUnattachJob( $wikiID );
	}
	}

	return $items;
	}

	/**
	* Fetch a row of user data needed for migration.
	*
	* Returns most data in the user and ipblocks tables, user groups, and editcount.
	*
	* @param string $wikiID
	* @throws LocalUserNotFoundException if local user not found
	* @return array
	*/
	protected function localUserData( $wikiID ) {
	$mwServices = MediaWikiServices::getInstance();
	$databaseManager = CentralAuthServices::getDatabaseManager();

	$db = $databaseManager->getLocalDB( DB_REPLICA, $wikiID );
	$fields = [
	'user_id',
	'user_email',
	'user_name',
	'user_email_authenticated',
	'user_password',
	'user_editcount',
	'user_registration',
	];
	$conds = [ 'user_name' => $this->mName ];
	$row = $db->newSelectQueryBuilder()
	->select( $fields )
	->from( 'user' )
	->where( $conds )
	->caller( __METHOD__ )
	->fetchRow();
	if ( !$row ) {
	# Row missing from replica, try the primary database instead
	$db = $databaseManager->getLocalDB( DB_PRIMARY, $wikiID );
	$row = $db->newSelectQueryBuilder()
	->select( $fields )
	->from( 'user' )
	->where( $conds )
	->caller( __METHOD__ )
	->fetchRow();
	}
	if ( !$row ) {
	$ex = new LocalUserNotFoundException(
	"Could not find local user data for {$this->mName}@{$wikiID}"
	);
	$this->logger->warning(
	'Could not find local user data for {username}@{wikiId}',
	[
	'username' => $this->mName,
	'wikiId' => $wikiID,
	'exception' => $ex,
	]
	);
	throw $ex;
	}

	$data = [
	'wiki' => $wikiID,
	'id' => $row->user_id,
	'name' => $row->user_name,
	'email' => $row->user_email,
	'emailAuthenticated' => wfTimestampOrNull( TS_MW, $row->user_email_authenticated ),
	'registration' => wfTimestampOrNull( TS_MW, $row->user_registration ),
	'password' => $row->user_password,
	'editCount' => $row->user_editcount,
	// array of (group name => UserGroupMembership object)
	'groupMemberships' => [],
	'blocked' => false,
	];

	// Edit count field may not be initialized...
	if ( $row->user_editcount === null ) {
	$data['editCount'] = $db->newSelectQueryBuilder()
	->select( 'COUNT(*)' )
	->from( 'revision' )
	->where( [ 'actor_user' => $data['id'] ] )
	->join( 'actor', null, 'actor_id = rev_actor' )
	->caller( __METHOD__ )
	->fetchField();
	}

	// And we have to fetch groups separately, sigh...
	$data['groupMemberships'] = $mwServices
	->getUserGroupManagerFactory()
	->getUserGroupManager( $wikiID )
	->getUserGroupMemberships(
	new UserIdentityValue(
	(int)$data['id'],
	$data['name'],
	$wikiID === WikiMap::getCurrentWikiId() ? UserIdentity::LOCAL : $wikiID
	)
	);

	// And while we're in here, look for user blocks :D
	$blockStore = $mwServices
	->getDatabaseBlockStoreFactory()
	->getDatabaseBlockStore( $wikiID );
	$blocks = $blockStore->newListFromConds( [ 'bt_user' => $data['id'] ] );
	foreach ( $blocks as $block ) {
	$data['block-expiry'] = $block->getExpiry();
	$data['block-reason'] = $block->getReasonComment()->text;
	$data['block-anononly'] = !$block->isHardblock();
	$data['block-nocreate'] = $block->isCreateAccountBlocked();
	$data['block-noautoblock'] = !$block->isAutoblocking();
	// Poorly named database column
	$data['block-nousertalk'] = !$block->isUsertalkEditAllowed();
	$data['block-noemail'] = $block->isEmailBlocked();
	$data['block-sitewide'] = $block->isSitewide();
	$data['block-restrictions'] = $block->getRestrictions();
	$data['blocked'] = true;
	}

	return $data;
	}

	/**
	* @return string
	*/
	public function getEmail(): string {
	$this->loadState();
	return $this->mEmail ?? '';
	}

	/**
	* @return string
	*/
	public function getEmailAuthenticationTimestamp() {
	$this->loadState();
	return $this->mAuthenticationTimestamp;
	}

	/**
	* @param string $email
	* @return void
	*/
	public function setEmail( $email ) {
	$this->checkWriteMode();
	$this->loadState();
	if ( $this->mEmail !== $email ) {
	$this->mEmail = $email;
	$this->mStateDirty = true;
	}
	}

	/**
	* @param string\|null $ts
	* @return void
	*/
	public function setEmailAuthenticationTimestamp( $ts ) {
	$this->checkWriteMode();
	$this->loadState();
	if ( $this->mAuthenticationTimestamp !== $ts ) {
	$this->mAuthenticationTimestamp = $ts;
	$this->mStateDirty = true;
	}
	}

	/**
	* Salt and hash a new plaintext password.
	* @param string\|null $password plaintext
	* @return string Password in the form :<TYPE>:<PARAM1>:<PARAM2>:...:<HASH>
	*/
	protected function saltedPassword( $password ) {
	$config = RequestContext::getMain()->getConfig();
	$passwordFactory = new PasswordFactory(
	$config->get( MainConfigNames::PasswordConfig ),
	$config->get( MainConfigNames::PasswordDefault )
	);

	return $passwordFactory->newFromPlaintext( $password )->toString();
	}

	/**
	* Set the account's password
	* @param string\|null $password plaintext
	* @param bool $resetAuthToken if we should reset the login token
	* @return bool true
	*/
	public function setPassword( $password, $resetAuthToken = true ) {
	$this->checkWriteMode();

	// Make sure state is loaded before updating ->mPassword
	$this->loadState();

	$hash = $this->saltedPassword( $password );

	$this->mPassword = $hash;

	if ( $this->getId() ) {
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();
	$dbw->newUpdateQueryBuilder()
	->update( 'globaluser' )
	->set( [ 'gu_password' => $hash ] )
	->where( [ 'gu_id' => $this->getId(), ] )
	->caller( __METHOD__ )
	->execute();

	$this->logger->info( "Set global password for {user}", [ 'user' => $this->mName ] );
	} else {
	$this->logger->warning( "Tried changing password for user that doesn't exist {user}",
	[ 'user' => $this->mName ] );
	}

	if ( $resetAuthToken ) {
	$this->resetAuthToken();
	}
	$this->invalidateCache();
	return true;
	}

	/**
	* Get the password hash.
	* Automatically converts to a new-style hash
	* @return string
	*/
	public function getPassword() {
	$this->loadState();
	return $this->mPassword;
	}

	/**
	* @return CentralAuthSessionProvider
	*/
	private static function getSessionProvider(): CentralAuthSessionProvider {
	// @phan-suppress-next-line PhanTypeMismatchReturnSuperType
	return SessionManager::singleton()->getProvider( CentralAuthSessionProvider::class );
	}

	/**
	* Get the domain parameter for setting a global cookie.
	* This allows other extensions to easily set global cookies without directly relying on
	* $wgCentralAuthCookieDomain (in case CentralAuth's implementation changes at some point).
	*
	* @return string
	*/
	public static function getCookieDomain() {
	$provider = self::getSessionProvider();
	return $provider->getCentralCookieDomain();
	}

	/**
	* Check a global auth token against the one we know of in the database.
	*
	* @param string $token
	* @return bool
	*/
	public function validateAuthToken( $token ) {
	return hash_equals( $this->getAuthToken(), $token );
	}

	/**
	* Generate a new random auth token, and store it in the database.
	* Should be called as often as possible, to the extent that it will
	* not randomly log users out (so on logout, as is done currently, is a good time).
	*/
	public function resetAuthToken() {
	$this->checkWriteMode();

	// Load state, since its hard to reset the token without it
	$this->loadState();

	// Generate a random token.
	$this->mAuthToken = MWCryptRand::generateHex( 32 );
	$this->mStateDirty = true;

	// Save it.
	$this->saveSettings();
	}

	public function saveSettings() {
	$this->checkWriteMode();

	if ( !$this->mStateDirty ) {
	return;
	}
	$this->mStateDirty = false;

	$databaseManager = CentralAuthServices::getDatabaseManager();
	if ( $databaseManager->isReadOnly() ) {
	return;
	}

	$this->loadState();
	if ( !$this->mGlobalId ) {
	return;
	}

	$newCasToken = $this->mCasToken + 1;

	$dbw = $databaseManager->getCentralPrimaryDB();

	$toSet = [
	'gu_password' => $this->mPassword,
	'gu_auth_token' => $this->mAuthToken,
	'gu_locked' => $this->mLocked,
	'gu_hidden_level' => $this->getHiddenLevelInt(),
	'gu_email' => $this->mEmail,
	'gu_email_authenticated' =>
	$dbw->timestampOrNull( $this->mAuthenticationTimestamp ),
	'gu_home_db' => $this->getHomeWiki(),
	'gu_cas_token' => $newCasToken
	];

	$dbw->newUpdateQueryBuilder()
	->update( 'globaluser' )
	->set( $toSet )
	->where( [
	'gu_id' => $this->mGlobalId,
	'gu_cas_token' => $this->mCasToken
	] )
	->caller( __METHOD__ )
	->execute();

	if ( !$dbw->affectedRows() ) {
	// Maybe the problem was a missed cache update; clear it to be safe
	$this->invalidateCache();
	// User was changed in the meantime or loaded with stale data
	$from = ( $this->mFromPrimary ) ? 'primary' : 'replica';
	$this->logger->warning(
	"CAS update failed on gu_cas_token for user ID '{globalId}' " .
	"(read from {from}); the version of the user to be saved is older than " .
	"the current version.",
	[
	'globalId' => $this->mGlobalId,
	'from' => $from,
	'exception' => new RuntimeException,
	]
	);
	return;
	}

	$this->mCasToken = $newCasToken;
	$this->invalidateCache();
	}

	/**
	* @return string[]
	*/
	public function getGlobalGroups() {
	return array_keys( $this->getGlobalGroupsWithExpiration() );
	}

	/**
	* @return array<string,?string> of [group name => expiration timestamp or null if permanent]
	*/
	public function getGlobalGroupsWithExpiration() {
	$this->loadGroups();

	$groupExpirations = [];
	foreach ( $this->mGroups as [ 'group' => $group, 'expiry' => $expiration ] ) {
	$groupExpirations[ $group ] = $expiration;
	}
	ksort( $groupExpirations );

	return $groupExpirations;
	}

	/**
	* Return the user's groups that are active on the current wiki (according to WikiSet settings).
	*
	* @return string[]
	*/
	public function getActiveGlobalGroups() {
	$this->loadGroups();

	$groups = [];
	$sets = [];
	foreach ( $this->mGroups as [ 'group' => $group, 'set' => $setId ] ) {
	if ( $setId ) {
	$sets[$setId] ??= WikiSet::newFromID( $setId );
	if ( !$sets[$setId]->inSet() ) {
	continue;
	}
	}
	$groups[] = $group;
	}
	sort( $groups );
	return $groups;
	}

	/**
	* @return string[]
	*/
	public function getGlobalRights() {
	$this->loadGroups();

	$rights = [];
	$sets = [];
	foreach ( $this->mRights as [ 'right' => $right, 'set' => $setId ] ) {
	if ( $setId ) {
	$sets[$setId] ??= WikiSet::newFromID( $setId );
	if ( !$sets[$setId]->inSet() ) {
	continue;
	}
	}
	$rights[] = $right;
	}
	return $rights;
	}

	/**
	* @param string $groups
	* @return void
	*/
	public function removeFromGlobalGroups( $groups ) {
	$this->checkWriteMode();
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();

	# Delete from the DB
	$dbw->newDeleteQueryBuilder()
	->deleteFrom( 'global_user_groups' )
	->where( [ 'gug_user' => $this->getId(), 'gug_group' => $groups ] )
	->caller( __METHOD__ )
	->execute();

	$this->invalidateCache();
	}

	/**
	* @param string $group
	* @param string\|null $expiry Timestamp of membership expiry in TS_MW format, or null if no expiry
	* @return void
	*/
	public function addToGlobalGroup( string $group, ?string $expiry = null ) {
	$this->checkWriteMode();
	$dbw = CentralAuthServices::getDatabaseManager()->getCentralPrimaryDB();

	# Replace into the DB
	$dbw->newReplaceQueryBuilder()
	->replaceInto( 'global_user_groups' )
	->uniqueIndexFields( [ 'gug_user', 'gug_group' ] )
	->row( [
	'gug_user' => $this->getId(),
	'gug_group' => $group,
	'gug_expiry' => $dbw->timestampOrNull( $expiry )
	] )
	->caller( __METHOD__ )
	->execute();

	$this->invalidateCache();
	}

	/**
	* @param string $perm
	* @return bool
	*/
	public function hasGlobalPermission( $perm ) {
	return in_array( $perm, $this->getGlobalRights() );
	}

	public function invalidateCache() {
	if ( !$this->mDelayInvalidation ) {
	$this->logger->debug( "Updating cache for global user {$this->mName}" );
	// Purge the cache
	$this->quickInvalidateCache();
	// Reload the state
	$this->loadStateNoCache();
	} else {
	$this->logger->debug( "Deferring cache invalidation because we're in a transaction" );
	}
	}

	/**
	* For when speed is of the essence (e.g. when batch-purging users after rights changes)
	*/
	public function quickInvalidateCache() {
	$this->logger->debug(
	"Quick cache invalidation for global user {$this->mName}"
	);

	CentralAuthServices::getDatabaseManager()
	->getCentralPrimaryDB()
	->onTransactionPreCommitOrIdle( function () {
	$cache = MediaWikiServices::getInstance()->getMainWANObjectCache();
	$cache->delete( $this->getCacheKey( $cache ) );
	}, __METHOD__ );
	}

	/**
	* End a "transaction".
	* A transaction delays cache invalidation until after
	* some operation which would otherwise repeatedly do so.
	* Intended to be used for things like migration.
	*/
	public function endTransaction() {
	$this->logger->debug( 'End CentralAuthUser cache-invalidating transaction' );
	$this->mDelayInvalidation = false;
	$this->invalidateCache();
	}

	/**
	* Start a "transaction".
	* A transaction delays cache invalidation until after
	* some operation which would otherwise repeatedly do so.
	* Intended to be used for things like migration.
	*/
	public function startTransaction() {
	$this->logger->debug( 'Start CentralAuthUser cache-invalidating transaction' );
	// Delay cache invalidation
	$this->mDelayInvalidation = 1;
	}

	/**
	* Check if the user is attached on a given wiki id.
	*
	* @param string $wiki
	* @return bool
	*/
	public function attachedOn( $wiki ) {
	$this->loadAttached();
	return $this->exists() && in_array( $wiki, $this->mAttachedArray );
	}

	/**
	* Get a hash representing the user/locked/hidden state of this user,
	* used to check for edit conflicts
	*
	* @param bool $recache Force a reload of the user from the database
	* @return string
	*/
	public function getStateHash( bool $recache = false ) {
	$this->loadState( $recache );

	return md5( $this->mGlobalId . ':' . $this->mName . ':' . $this->mHiddenLevel . ':' .
	( $this->mLocked ? '1' : '0' ) );
	}

	/**
	* Log an action for the current user
	*
	* @param string $action
	* @param UserIdentity $user
	* @param string $reason
	* @param array $params
	* @param bool $suppressLog
	* @param bool $markAsBot If true, log entry is marked as made by a bot. If false, default
	* behavior is observed.
	*/
	public function logAction(
	$action,
	UserIdentity $user,
	$reason = '',
	$params = [],
	bool $suppressLog = false,
	bool $markAsBot = false
	) {
	$nsUser = MediaWikiServices::getInstance()
	->getNamespaceInfo()
	->getCanonicalName( NS_USER );
	// Not centralauth because of some weird length limitations
	$logType = $suppressLog ? 'suppress' : 'globalauth';
	$entry = new ManualLogEntry( $logType, $action );
	$entry->setTarget( Title::newFromText( "$nsUser:{$this->mName}@global" ) );
	$entry->setPerformer( $user );
	$entry->setComment( $reason );
	$entry->setParameters( $params );
	if ( $markAsBot ) {
	// NOTE: This is intentionally called conditionally, to respect default behavior when
	// $markAsBot is set to false.
	$entry->setForceBotFlag( $markAsBot );
	}
	$logid = $entry->insert();
	$entry->publish( $logid );
	}

	/**
	* @param string $wikiId
	* @param int $userId
	*/
	private function clearLocalUserCache( $wikiId, $userId ) {
	User::purge( $wikiId, $userId );
	}
	}

File Metadata

Mime Type: text/x-php
Expires: Sat, Oct 3, 08:07 (1 w, 6 d ago)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 0b/09/5fcca92d338acd700af73ef82267
Default Alt Text: CentralAuthUser.php (92 KB)

CentralAuthUser.phpNo OneTemporaryActions

CentralAuthUser.phpView Options

File Metadata

Event Timeline

CentralAuthUser.php
No OneTemporary
Actions

CentralAuthUser.php
View Options