PhabricatorEnv

'infratructure' -> 'infrastructure' (rofl) Recaptcha Email Login / Forgot Password Password Reset
2011-01-31 11:55:26 -08:00
parent 25aae76c8a
commit 03fec6e911
62 changed files with 1418 additions and 104 deletions
--- a/src/applications/auth/controller/email/PhabricatorEmailLoginController.php
+++ b/src/applications/auth/controller/email/PhabricatorEmailLoginController.php
@@ -0,0 +1,131 @@
+<?php
+
+/*
+ * Copyright 2011 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+class PhabricatorEmailLoginController extends PhabricatorAuthController {
+
+  public function shouldRequireLogin() {
+    return false;
+  }
+
+  public function processRequest() {
+    $request = $this->getRequest();
+
+    $e_email = true;
+    $e_captcha = true;
+    $errors = array();
+
+    if ($request->isFormPost()) {
+      $e_email = null;
+      $e_captcha = 'Again';
+
+      $captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
+      if (!$captcha_ok) {
+        $errors[] = "Captcha response is incorrect, try again.";
+        $e_captcha = 'Invalid';
+      }
+
+      $email = $request->getStr('email');
+      if (!strlen($email)) {
+       $errors[] = "You must provide an email address.";
+       $e_email = 'Required';
+      }
+
+      if (!$errors) {
+        // NOTE: Don't validate the email unless the captcha is good; this makes
+        // it expensive to fish for valid email addresses while giving the user
+        // a better error if they goof their email.
+
+        $target_user = id(new PhabricatorUser())->loadOneWhere(
+          'email = %s',
+          $email);
+
+        if (!$target_user) {
+          $errors[] = "There is no account associated with that email address.";
+          $e_email = "Invalid";
+        }
+
+        if (!$errors) {
+          $etoken = $target_user->generateEmailToken();
+
+          $mail = new PhabricatorMetaMTAMail();
+          $mail->setSubject('Phabricator Email Authentication');
+          $mail->addTos(
+            array(
+              $target_user->getEmail(),
+            ));
+          $mail->setBody(
+            "blah blah blah ".
+              PhabricatorEnv::getURI('/login/etoken/'.$etoken.'/').'?email='.phutil_escape_uri($target_user->getEmail()));
+          $mail->save();
+
+          $view = new AphrontRequestFailureView();
+          $view->setHeader('Check Your Email');
+          $view->appendChild(
+            '<p>An email has been sent with a link you can use to login.</p>');
+          return $this->buildStandardPageResponse(
+            $view,
+            array(
+              'title' => 'Email Sent',
+            ));
+        }
+      }
+
+    }
+
+    $email_auth = new AphrontFormView();
+    $email_auth
+      ->setAction('/login/email/')
+      ->setUser($request->getUser())
+      ->appendChild(
+        id(new AphrontFormTextControl())
+          ->setLabel('Email')
+          ->setName('email')
+          ->setValue($request->getStr('email'))
+          ->setError($e_email))
+      ->appendChild(
+        id(new AphrontFormRecaptchaControl())
+          ->setLabel('Captcha')
+          ->setError($e_captcha))
+      ->appendChild(
+        id(new AphrontFormSubmitControl())
+          ->setValue('Send Email'));
+
+    $error_view = null;
+    if ($errors) {
+      $error_view = new AphrontErrorView();
+      $error_view->setTitle('Login Error');
+      $error_view->setErrors($errors);
+    }
+
+
+    $panel = new AphrontPanelView();
+    $panel->setWidth(AphrontPanelView::WIDTH_FORM);
+    $panel->appendChild('<h1>Forgot Password / Email Login</h1>');
+    $panel->appendChild($email_auth);
+
+    return $this->buildStandardPageResponse(
+      array(
+        $error_view,
+        $panel,
+      ),
+      array(
+        'title' => 'Create New Account',
+      ));
+  }
+
+}
--- a/src/applications/auth/controller/email/init.php
+++ b/src/applications/auth/controller/email/init.php
@@ -0,0 +1,24 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'applications/metamta/storage/mail');
+phutil_require_module('phabricator', 'applications/people/storage/user');
+phutil_require_module('phabricator', 'infrastructure/env');
+phutil_require_module('phabricator', 'view/form/base');
+phutil_require_module('phabricator', 'view/form/control/recaptcha');
+phutil_require_module('phabricator', 'view/form/control/submit');
+phutil_require_module('phabricator', 'view/form/error');
+phutil_require_module('phabricator', 'view/layout/panel');
+phutil_require_module('phabricator', 'view/page/failure');
+
+phutil_require_module('phutil', 'markup');
+phutil_require_module('phutil', 'utils');
+
+
+phutil_require_source('PhabricatorEmailLoginController.php');
--- a/src/applications/auth/controller/emailtoken/PhabricatorEmailTokenController.php
+++ b/src/applications/auth/controller/emailtoken/PhabricatorEmailTokenController.php
@@ -0,0 +1,137 @@
+<?php
+
+/*
+ * Copyright 2011 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+class PhabricatorEmailTokenController extends PhabricatorAuthController {
+
+  private $token;
+
+  public function shouldRequireLogin() {
+    return false;
+  }
+
+  public function willProcessRequest(array $data) {
+    $this->token = $data['token'];
+  }
+
+  public function processRequest() {
+    $request = $this->getRequest();
+
+    $token = $this->token;
+    $email = $request->getStr('email');
+
+    $target_user = id(new PhabricatorUser())->loadOneWhere(
+      'email = %s',
+      $email);
+
+    if (!$target_user || !$target_user->validateEmailToken($token)) {
+      $view = new AphrontRequestFailureView();
+      $view->setHeader('Unable to Login');
+      $view->appendChild(
+        '<p>The authentication information in the link you clicked is '.
+        'invalid or out of date. Make sure you are copy-and-pasting the '.
+        'entire link into your browser. You can try again, or request '.
+        'a new email.</p>');
+      $view->appendChild(
+        '<div class="aphront-failure-continue">'.
+          '<a class="button" href="/login/email/">Send Another Email</a>'.
+        '</div>');
+      return $this->buildStandardPageResponse(
+        $view,
+        array(
+          'title' => 'Email Sent',
+        ));
+    }
+
+    if ($request->getUser()->getPHID() != $target_user->getPHID()) {
+      $session_key = $target_user->establishSession('web');
+      $request->setCookie('phusr', $target_user->getUsername());
+      $request->setCookie('phsid', $session_key);
+    }
+
+    $errors = array();
+
+    $e_pass = true;
+    $e_confirm = true;
+
+    if ($request->isFormPost()) {
+      $e_pass = 'Error';
+      $e_confirm = 'Error';
+
+      $pass = $request->getStr('password');
+      $confirm = $request->getStr('confirm');
+
+      if (strlen($pass) < 3) {
+        $errors[] = 'That password is ridiculously short.';
+      }
+
+      if ($pass !== $confirm) {
+        $errors[] = "Passwords do not match.";
+      }
+
+      if (!$errors) {
+        $target_user->setPassword($pass);
+        $target_user->save();
+        return id(new AphrontRedirectResponse())
+          ->setURI('/');
+      }
+    }
+
+    if ($errors) {
+      $error_view = new AphrontErrorView();
+      $error_view->setTitle('Password Reset Failed');
+      $error_view->setErrors($errors);
+    } else {
+      $error_view = null;
+    }
+
+    $form = new AphrontFormView();
+    $form
+      ->setUser($target_user)
+      ->setAction('/login/etoken/'.$token.'/')
+      ->addHiddenInput('email', $email)
+      ->appendChild(
+        id(new AphrontFormPasswordControl())
+          ->setLabel('New Password')
+          ->setName('password')
+          ->setError($e_pass))
+      ->appendChild(
+        id(new AphrontFormPasswordControl())
+          ->setLabel('Confirm Password')
+          ->setName('confirm')
+          ->setError($e_confirm))
+      ->appendChild(
+        id(new AphrontFormSubmitControl())
+          ->setValue('Reset Password')
+          ->addCancelButton('/', 'Skip'));
+
+    $panel = new AphrontPanelView();
+    $panel->setWidth(AphrontPanelView::WIDTH_FORM);
+    $panel->setHeader('Reset Password');
+    $panel->appendChild($form);
+
+    return $this->buildStandardPageResponse(
+      array(
+        $error_view,
+        $panel,
+      ),
+      array(
+        'title' => 'Create New Account',
+      ));
+  }
+
+}
--- a/src/applications/auth/controller/facebookconnect/init.php
+++ b/src/applications/auth/controller/facebookconnect/init.php
@@ -8,15 +8,14 @@

 phutil_require_module('phabricator', 'aphront/response/redirect');
 phutil_require_module('phabricator', 'applications/auth/controller/base');
-phutil_require_module('phabricator', 'applications/files/storage/file');
 phutil_require_module('phabricator', 'applications/people/storage/user');
 phutil_require_module('phabricator', 'view/form/base');
 phutil_require_module('phabricator', 'view/form/control/submit');
 phutil_require_module('phabricator', 'view/form/error');
 phutil_require_module('phabricator', 'view/layout/panel');
+phutil_require_module('phabricator', 'view/page/failure');

-phutil_require_module('phutil', 'markup');
 phutil_require_module('phutil', 'utils');


-phutil_require_source('PhabricatorFacebookConnectController.php');
+phutil_require_source('PhabricatorEmailTokenController.php');
--- a/src/applications/auth/controller/facebookconnect/PhabricatorFacebookConnectController.php
+++ b/src/applications/auth/controller/facebookconnect/PhabricatorFacebookConnectController.php
@@ -16,31 +16,99 @@
 * limitations under the License.
 */

-class PhabricatorFacebookConnectController extends PhabricatorAuthController {
+class PhabricatorFacebookAuthController extends PhabricatorAuthController {

  public function shouldRequireLogin() {
    return false;
  }

  public function processRequest() {
+    $auth_enabled = PhabricatorEnv::getEnvConfig('facebook.auth-enabled');
+    if (!$auth_enabled) {
+      return new Aphront400Response();
+    }
+
+    $diagnose_auth =
+      '<a href="/facebook-auth/diagnose/" class="button green">'.
+        'Diagnose Facebook Auth Problems'.
+      '</a>';
+
    $request = $this->getRequest();

    if ($request->getStr('error')) {
-      die("OMG ERROR");
+      $view = new AphrontRequestFailureView();
+      $view->setHeader('Facebook Auth Failed');
+      $view->appendChild(
+        '<p>'.
+          '<strong>Description:</strong> '.
+          phutil_escape_html($request->getStr('error_description')).
+        '</p>');
+      $view->appendChild(
+        '<p>'.
+          '<strong>Error:</strong> '.
+          phutil_escape_html($request->getStr('error')).
+        '</p>');
+      $view->appendChild(
+        '<p>'.
+          '<strong>Error Reason:</strong> '.
+          phutil_escape_html($request->getStr('error_reason')).
+        '</p>');
+      $view->appendChild(
+        '<div class="aphront-failure-continue">'.
+          '<a href="/login/" class="button">Continue</a>'.
+        '</div>');
+
+      return $this->buildStandardPageResponse(
+        $view,
+        array(
+          'title' => 'Facebook Auth Failed',
+        ));
    }

    $token = $request->getStr('token');
    if (!$token) {
+      $app_id = PhabricatorEnv::getEnvConfig('facebook.application-id');
+      $app_secret = PhabricatorEnv::getEnvConfig('facebook.application-secret');
+      $redirect_uri = PhabricatorEnv::getURI('/facebook-auth/');
+
      $code = $request->getStr('code');
-      $auth_uri = 'https://graph.facebook.com/oauth/access_token'.
-                  '?client_id=184510521580034'.
-                  '&redirect_uri=http://local.aphront.com/facebook-connect/'.
-                  '&client_secret=OMGSECRETS'.
-                  '&code='.$code;
+      $auth_uri = new PhutilURI(
+        "https://graph.facebook.com/oauth/access_token");
+      $auth_uri->setQueryParams(
+        array(
+          'client_id'     => $app_id,
+          'redirect_uri'  => $redirect_uri,
+          'client_secret' => $app_secret,
+          'code'          => $code,
+        ));

      $response = @file_get_contents($auth_uri);
      if ($response === false) {
-        throw new Exception('failed to open oauth thing');
+        $view = new AphrontRequestFailureView();
+        $view->setHeader('Facebook Auth Failed');
+        $view->appendChild(
+          '<p>Unable to authenticate with Facebook. There are several reasons '.
+          'this might happen:</p>'.
+            '<ul>'.
+              '<li>Phabricator may be configured with the wrong Application '.
+              'Secret; or</li>'.
+              '<li>the Facebook OAuth access token may have expired; or</li>'.
+              '<li>Facebook may have revoked authorization for the '.
+              'Application; or</li>'.
+              '<li>Facebook may be having technical problems.</li>'.
+            '</ul>'.
+          '<p>You can try again, or login using another method.</p>');
+        $view->appendChild(
+          '<div class="aphront-failure-continue">'.
+            $diagnose_auth.
+            '<a href="/login/" class="button">Continue</a>'.
+          '</div>');
+
+        return $this->buildStandardPageResponse(
+          $view,
+          array(
+            'title' => 'Facebook Auth Failed',
+          ));
      }

      $data = array();
@@ -89,12 +157,12 @@ class PhabricatorFacebookConnectController extends PhabricatorAuthController {
      $form
        ->addHiddenInput('token', $token)
        ->setUser($request->getUser())
-        ->setAction('/facebook-connect/')
+        ->setAction('/facebook-auth/')
        ->appendChild(
          '<p class="aphront-form-view-instructions">Do you want to link your '.
          "existing Phabricator account (<strong>{$ph_account}</strong>) ".
          "with your Facebook account (<strong>{$fb_account}</strong>) so ".
-          "you can login with Facebook Connect?")
+          "you can login with Facebook?")
        ->appendChild(
          id(new AphrontFormSubmitControl())
            ->setValue('Link Accounts')
@@ -170,7 +238,7 @@ class PhabricatorFacebookConnectController extends PhabricatorAuthController {
    $error_view = null;
    if ($errors) {
      $error_view = new AphrontErrorView();
-      $error_view->setTitle('Facebook Connect Failed');
+      $error_view->setTitle('Facebook Auth Failed');
      $error_view->setErrors($errors);
    }

@@ -178,7 +246,7 @@ class PhabricatorFacebookConnectController extends PhabricatorAuthController {
    $form
      ->addHiddenInput('token', $token)
      ->setUser($request->getUser())
-      ->setAction('/facebook-connect/')
+      ->setAction('/facebook-auth/')
      ->appendChild(
        id(new AphrontFormTextControl())
          ->setLabel('Username')
--- a/src/applications/auth/controller/facebookauth/init.php
+++ b/src/applications/auth/controller/facebookauth/init.php
@@ -0,0 +1,25 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'aphront/response/400');
+phutil_require_module('phabricator', 'aphront/response/redirect');
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'applications/files/storage/file');
+phutil_require_module('phabricator', 'applications/people/storage/user');
+phutil_require_module('phabricator', 'infrastructure/env');
+phutil_require_module('phabricator', 'view/form/base');
+phutil_require_module('phabricator', 'view/form/control/submit');
+phutil_require_module('phabricator', 'view/form/error');
+phutil_require_module('phabricator', 'view/layout/panel');
+phutil_require_module('phabricator', 'view/page/failure');
+
+phutil_require_module('phutil', 'markup');
+phutil_require_module('phutil', 'parser/uri');
+phutil_require_module('phutil', 'utils');
+
+phutil_require_source('PhabricatorFacebookAuthController.php');
--- a/src/applications/auth/controller/facebookauth/diagnostics/PhabricatorFacebookAuthDiagnosticsController.php
+++ b/src/applications/auth/controller/facebookauth/diagnostics/PhabricatorFacebookAuthDiagnosticsController.php
@@ -0,0 +1,230 @@
+<?php
+
+/*
+ * Copyright 2011 Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+class PhabricatorFacebookAuthDiagnosticsController
+  extends PhabricatorAuthController {
+
+  public function shouldRequireLogin() {
+    return false;
+  }
+
+  public function processRequest() {
+
+    $auth_enabled = PhabricatorEnv::getEnvConfig('facebook.auth-enabled');
+    $app_id = PhabricatorEnv::getEnvConfig('facebook.application-id');
+    $app_secret = PhabricatorEnv::getEnvConfig('facebook.application-secret');
+
+    $res_ok = '<strong style="color: #00aa00;">OK</strong>';
+    $res_no = '<strong style="color: #aa0000;">NO</strong>';
+    $res_na = '<strong style="color: #999999;">N/A</strong>';
+
+    $results = array();
+
+    if (!$auth_enabled) {
+      $results['facebook.auth-enabled'] = array(
+        $res_no,
+        'false',
+        'Facebook authentication is disabled in the configuration. Edit the '.
+        'environmental configuration to enable "facebook.auth-enabled".');
+    } else {
+      $results['facebook.auth-enabled'] = array(
+        $res_ok,
+        'true',
+        'Facebook authentication is enabled.');
+    }
+
+    if (!$app_id) {
+      $results['facebook.application-id'] = array(
+        $res_no,
+        null,
+        'No Facebook Application ID is configured. Edit the environmental '.
+        'configuration to specify an application ID in '.
+        '"facebook.application-id". To generate an ID, sign into Facebook, '.
+        'install the "Developer" application, and use it to create a new '.
+        'Facebook application.');
+    } else {
+      $results['facebook.application-id'] = array(
+        $res_ok,
+        $app_id,
+        'Application ID is set.');
+    }
+
+    if (!$app_secret) {
+      $results['facebook.application-secret'] = array(
+        $res_no,
+        null,
+        'No Facebook Application secret is configured. Edit the environmental '.
+        'configuration to specify an Application Secret, in '.
+        '"facebook.application-secret". You can find the application secret '.
+        'in the Facebook "Developer" application on Facebook.');
+    } else {
+      $results['facebook.application-secret'] = array(
+        $res_ok,
+        "It's a secret!",
+        'Application secret is set.');
+    }
+
+    $timeout = stream_context_create(
+      array(
+        'http' => array(
+          'ignore_errors' => true,
+          'timeout'       => 5,
+        ),
+      ));
+    $timeout_strict = stream_context_create(
+      array(
+        'http' => array(
+          'timeout'       => 5,
+        ),
+      ));
+
+    $internet = @file_get_contents("http://google.com/", false, $timeout);
+    if ($internet === false) {
+      $results['internet'] = array(
+        $res_no,
+        null,
+        'Unable to make an HTTP request to Google. Check your outbound '.
+        'internet connection and firewall/filtering settings.');
+    } else {
+      $results['internet'] = array(
+        $res_ok,
+        null,
+        'Internet seems OK.');
+    }
+
+    $facebook = @file_get_contents("http://facebook.com/", false, $timeout);
+    if ($facebook === false) {
+      $results['facebook.com'] = array(
+        $res_no,
+        null,
+        'Unable to make an HTTP request to facebook.com. Facebook may be '.
+        'down or inaccessible.');
+    } else {
+      $results['facebook.com'] = array(
+        $res_ok,
+        null,
+        'Made a request to facebook.com.');
+    }
+
+    $graph = @file_get_contents(
+      "https://graph.facebook.com/me",
+      false,
+      $timeout);
+    if ($graph === false) {
+      $results['Facebook Graph'] = array(
+        $res_no,
+        null,
+        "Unable to make an HTTPS request to graph.facebook.com. ".
+        "The Facebook graph may be down or inaccessible.");
+    } else {
+      $results['Facebook Graph'] = array(
+        $res_ok,
+        null,
+        'Made a request to graph.facebook.com.');
+    }
+
+    $test_uri = new PhutilURI('https://graph.facebook.com/oauth/access_token');
+    $test_uri->setQueryParams(
+      array(
+        'client_id'       => $app_id,
+        'client_secret'   => $app_secret,
+        'grant_type'      => 'client_credentials',
+      ));
+
+    $token_value  = @file_get_contents($test_uri, false, $timeout);
+    $token_strict = @file_get_contents($test_uri, false, $timeout_strict);
+    if ($token_value === false) {
+      $results['App Login'] = array(
+        $res_no,
+        null,
+        "Unable to perform an application login with your Application ID and ".
+        "Application Secret. You may have mistyped or misconfigured them; ".
+        "Facebook may have revoked your authorization; or Facebook may be ".
+        "having technical problems.");
+    } else {
+      if ($token_strict) {
+        $results['App Login'] = array(
+          $res_ok,
+          $token_strict,
+          "Raw application login to Facebook works.");
+      } else {
+        $data = json_decode($token_value, true);
+        if (!is_array($data)) {
+          $results['App Login'] = array(
+            $res_no,
+            $token_value,
+            "Application Login failed but the graph server did not respond ".
+            "with valid JSON error information. Facebook may be experiencing ".
+            "technical problems.");
+        } else {
+          $results['App Login'] = array(
+            $res_no,
+            null,
+            "Application Login failed with error: ".$token_value);
+        }
+      }
+    }
+
+    return $this->renderResults($results);
+  }
+
+  private function renderResults($results) {
+
+    $rows = array();
+    foreach ($results as $key => $result) {
+      $rows[] = array(
+        phutil_escape_html($key),
+        $result[0],
+        phutil_escape_html($result[1]),
+        phutil_escape_html($result[2]),
+      );
+    }
+
+    $table_view = new AphrontTableView($rows);
+    $table_view->setHeaders(
+      array(
+        'Test',
+        'Result',
+        'Value',
+        'Details',
+      ));
+    $table_view->setColumnClasses(
+      array(
+        null,
+        null,
+        null,
+        'wide',
+      ));
+
+    $panel_view = new AphrontPanelView();
+    $panel_view->setHeader('Facebook Auth Diagnostics');
+    $panel_view->appendChild(
+      '<p class="aphront-panel-instructions">These tests may be able to '.
+      'help diagnose the root cause of problems you experience with '.
+      'Facebook Authentication. Reload the page to run the tests again.</p>');
+    $panel_view->appendChild($table_view);
+
+    return $this->buildStandardPageResponse(
+      $panel_view,
+      array(
+        'title' => 'Facebook Auth Diagnostics',
+      ));
+
+  }
+
+}
--- a/src/applications/auth/controller/facebookauth/diagnostics/init.php
+++ b/src/applications/auth/controller/facebookauth/diagnostics/init.php
@@ -0,0 +1,18 @@
+<?php
+/**
+ * This file is automatically generated. Lint this module to rebuild it.
+ * @generated
+ */
+
+
+
+phutil_require_module('phabricator', 'applications/auth/controller/base');
+phutil_require_module('phabricator', 'infrastructure/env');
+phutil_require_module('phabricator', 'view/control/table');
+phutil_require_module('phabricator', 'view/layout/panel');
+
+phutil_require_module('phutil', 'markup');
+phutil_require_module('phutil', 'parser/uri');
+
+
+phutil_require_source('PhabricatorFacebookAuthDiagnosticsController.php');
--- a/src/applications/auth/controller/login/PhabricatorLoginController.php
+++ b/src/applications/auth/controller/login/PhabricatorLoginController.php
@@ -34,9 +34,6 @@ class PhabricatorLoginController extends PhabricatorAuthController {
        'username = %s',
        $username);

-      $user->setPassword('asdf');
-      $user->save();
-
      $okay = false;
      if ($user) {
        if ($user->comparePassword($request->getStr('password'))) {
@@ -71,13 +68,15 @@ class PhabricatorLoginController extends PhabricatorAuthController {
      ->setAction('/login/')
      ->appendChild(
        id(new AphrontFormTextControl())
-          ->setLabel('Username')
+          ->setLabel('Username/Email')
          ->setName('username')
          ->setValue($username))
      ->appendChild(
-        id(new AphrontFormTextControl())
+        id(new AphrontFormPasswordControl())
          ->setLabel('Password')
-          ->setName('password'))
+          ->setName('password')
+          ->setCaption(
+            '<a href="/login/email/">Forgot your password? / Email Login</a>'))
      ->appendChild(
        id(new AphrontFormSubmitControl())
          ->setValue('Login'));
@@ -88,27 +87,39 @@ class PhabricatorLoginController extends PhabricatorAuthController {
    $panel->setWidth(AphrontPanelView::WIDTH_FORM);
    $panel->appendChild($form);

+    $fbauth_enabled = PhabricatorEnv::getEnvConfig('facebook.auth-enabled');
+    if ($fbauth_enabled) {
+      $auth_uri = new PhutilURI("https://www.facebook.com/dialog/oauth");

-    // TODO: Hardcoded junk
-    $connect_uri = "https://www.facebook.com/dialog/oauth";
+      $user = $request->getUser();

-    $user = $request->getUser();
+      $redirect_uri = PhabricatorEnv::getURI('/facebook-auth/');
+      $app_id = PhabricatorEnv::getEnvConfig('facebook.application-id');

-    $facebook_connect = new AphrontFormView();
-    $facebook_connect
-      ->setAction($connect_uri)
-      ->addHiddenInput('client_id', 184510521580034)
-      ->addHiddenInput('redirect_uri', 'http://local.aphront.com/facebook-connect/')
-      ->addHiddenInput('scope', 'email')
-      ->addHiddenInput('state', $user->getCSRFToken())
-      ->setUser($request->getUser())
-      ->setMethod('GET')
-      ->appendChild(
-        id(new AphrontFormSubmitControl())
-          ->setValue("Login with Facebook Connect \xC2\xBB"));
+      // TODO: In theory we should use 'state' to prevent CSRF, but the total
+      // effect of the CSRF attack is that an attacker can cause a user to login
+      // to Phabricator if they're already logged into Facebook. This does not
+      // seem like the most severe threat in the world, and generating CSRF for
+      // logged-out users is vaugely tricky.

-    $panel->appendChild('<br /><h1>Login with Facebook</h1>');
-    $panel->appendChild($facebook_connect);
+      $facebook_auth = new AphrontFormView();
+      $facebook_auth
+        ->setAction($auth_uri)
+        ->addHiddenInput('client_id', $app_id)
+        ->addHiddenInput('redirect_uri', $redirect_uri)
+        ->addHiddenInput('scope', 'email')
+        ->setUser($request->getUser())
+        ->setMethod('GET')
+        ->appendChild(
+          '<p class="aphront-form-instructions">Login or register for '.
+          'Phabricator using your Facebook account.</p>')
+        ->appendChild(
+          id(new AphrontFormSubmitControl())
+            ->setValue("Login with Facebook \xC2\xBB"));
+
+      $panel->appendChild('<br /><h1>Login with Facebook</h1>');
+      $panel->appendChild($facebook_auth);
+    }

    return $this->buildStandardPageResponse(
      array(
--- a/src/applications/auth/controller/login/init.php
+++ b/src/applications/auth/controller/login/init.php
@@ -9,11 +9,13 @@
 phutil_require_module('phabricator', 'aphront/response/redirect');
 phutil_require_module('phabricator', 'applications/auth/controller/base');
 phutil_require_module('phabricator', 'applications/people/storage/user');
+phutil_require_module('phabricator', 'infrastructure/env');
 phutil_require_module('phabricator', 'view/form/base');
 phutil_require_module('phabricator', 'view/form/control/submit');
 phutil_require_module('phabricator', 'view/form/error');
 phutil_require_module('phabricator', 'view/layout/panel');

+phutil_require_module('phutil', 'parser/uri');
 phutil_require_module('phutil', 'utils');