8000 feature #398 Deprecate Argon2i encoder used in make:user (nicolas-gre… · symfony/maker-bundle@9cd017d · GitHub
[go: up one dir, main page]
8000
Skip to content

Commit 9cd017d

Browse files
weaverryanweaverryan
committed
feature #398 Deprecate Argon2i encoder used in make:user (nicolas-grekas, weaverryan)
This PR was merged into the 1.0-dev branch. Discussion ---------- Deprecate Argon2i encoder used in make:user `auto` is the only future-proof option, no need to allow ppl to choose. Fixes #386 Commits ------- 89e7f59 updating security tests for bcrypt vs auto setting dee904b Deprecate Argon2i encoder used in make:user
2 parents c5739e3 + 89e7f59 commit 9cd017d

10 files changed

+26
-31
lines changed

‎composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"symfony/http-client": "^4.3",
3232
"symfony/phpunit-bridge": "^3.4|^4.0",
3333
"symfony/process": "^3.4|^4.0",
34+
"symfony/security-core": "^3.4|^4.0",
3435
"symfony/yaml": "^3.4|^4.0"
3536
},
3637
"config": {

‎src/Maker/MakeUser.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
use Symfony\Component\Console\Input\InputInterface;
3333
use Symfony\Component\Console\Input\InputOption;
3434
use Symfony\Component\Security\Core\Encoder\Argon2iPasswordEncoder;
35+
use Symfony\Component\Security\Core\Encoder\NativePasswordEncoder;
3536
use Symfony\Component\Yaml\Yaml;
3637

3738
/**
@@ -67,7 +68,7 @@ public function configureCommand(Command $command, InputConfiguration $inputConf
6768
->addOption('is-entity', null, InputOption::VALUE_NONE, 'Do you want to store user data in the database (via Doctrine)?')
6869
->addOption('identity-property-name', null, InputOption::VALUE_REQUIRED, 'Enter a property name that will be the unique "display" name for the user (e.g. <comment>email, username, uuid</comment>)')
6970
->addOption('with-password', null, InputOption::VALUE_NONE, 'Will this app be responsible for checking the password? Choose <comment>No</comment> if the password is actually checked by some other system (e.g. a single sign-on server)')
70-
->addOption('use-argon2', null, InputOption::VALUE_NONE, 'Use the Argon2i password encoder?')
71+
->addOption('use-argon2', null, InputOption::VALUE_NONE, 'Use the Argon2i password encoder? (deprecated)')
7172
->setHelp(file_get_contents(__DIR__.'/../Resources/help/MakeUser.txt'))
7273
;
7374

@@ -107,12 +108,12 @@ class_exists(DoctrineBundle::class)
107108
$input->setOption('with-password', $userWillHavePassword);
108109

109110
$useArgon2Encoder = false;
110-
if ($userWillHavePassword && Argon2iPasswordEncoder::isSupported()) {
111+
if ($userWillHavePassword && !class_exists(NativePasswordEncoder::class) && Argon2iPasswordEncoder::isSupported()) {
111112
$io->writeln('The newer <comment>Argon2i</comment> password hasher requires PHP 7.2, libsodium or paragonie/sodium_compat. Your system DOES support this algorithm.');
112113
$io->writeln('You should use <comment>Argon2i</comment> unless your production system will not support it.');
113114
$useArgon2Encoder = $io->confirm('Use <comment>Argon2i</comment> as your password hasher (bcrypt will be used otherwise)?');
115+
$input->setOption('use-argon2', $useArgon2Encoder);
114116
}
115-
$input->setOption('use-argon2', $useArgon2Encoder);
116117
}
117118

118119
public function generate(InputInterface $input, ConsoleStyle $io, Generator $generator)
@@ -122,7 +123,10 @@ public function generate(InputInterface $input, ConsoleStyle $io, Generator $gen
122123
$input->getOption('identity-property-name'),
123124
$input->getOption('with-password')
124125
);
125-
$userClassConfiguration->useArgon2($input->getOption('use-argon2'));
126+
if ($input->getOption('use-argon2')) {
127+
@trigger_error('The "--use-argon2" option is deprecated since MakerBundle 1.12.', E_USER_DEPRECATED);
128+
$userClassConfiguration->useArgon2(true);
129+
}
126130

127131
$userClassNameDetails = $generator->createClassNameDetails(
128132
$input->getArgument('name'),

‎src/Security/SecurityConfigUpdater.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Bundle\MakerBundle\Security;
1313

1414
use Symfony\Bundle\MakerBundle\Util\YamlSourceManipulator;
15+
use Symfony\Component\Security\Core\Encoder\NativePasswordEncoder;
1516

1617
/**
1718
* @internal
@@ -137,7 +138,7 @@ private function updateEncoders(UserClassConfiguration $userConfig, string $user
137138
}
138139

139140
$newData['security']['encoders'][$userClass] = [
140-
'algorithm' => $userConfig->shouldUseArgon2() ? 'argon2i' : 'bcrypt',
141+
'algorithm' => $userConfig->shouldUseArgon2() ? 'argon2i' : (class_exists(NativePasswordEncoder::class) ? 'auto' : 'bcrypt'),
141142
];
142143
$newData['security']['encoders']['_'] = $this->manipulator->createEmptyLine();
143144

‎src/Security/UserClassConfiguration.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ final class UserClassConfiguration
2424

2525
private $hasPassword;
2626

27-
private $useArgon2 = true;
27+
private $useArgon2 = false;
2828

2929
private $userProviderClass;
3030

@@ -50,11 +50,17 @@ public function hasPassword(): bool
5050
return $this->hasPassword;
5151
}
5252

53+
/**
54+
* @deprecated since MakerBundle 1.12
55+
*/
5356
public function useArgon2(bool $shouldUse)
5457
{
5558
$this->useArgon2 = $shouldUse;
5659
}
5760

61+
/**
62+
* @deprecated since MakerBundle 1.12
63+
*/
5864
public function shouldUseArgon2(): bool
5965
{
6066
return $this->useArgon2;

‎tests/Security/SecurityConfigUpdaterTest.php

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use PHPUnit\Framework\TestCase;
66
use Symfony\Bundle\MakerBundle\Security\SecurityConfigUpdater;
77
use Symfony\Bundle\MakerBundle\Security\UserClassConfiguration;
8+
use Symfony\Component\Security\Core\Encoder\NativePasswordEncoder;
89

910
class SecurityConfigUpdaterTest extends TestCase
1011
{
@@ -23,6 +24,9 @@ public function testUpdateForUserClass(UserClassConfiguration $userConfig, strin
2324
$actualSource = $updater->updateForUserClass($source, $userConfig, $userClass);
2425
$expectedSource = file_get_contents(__DIR__.'/yaml_fixtures/expected_user_class/'.$expectedSourceFilename);
2526

27+
$bcryptOrAuto = class_exists(NativePasswordEncoder::class) ? 'auto' : 'bcrypt';
28+
$expectedSource = str_replace('{BCRYPT_OR_AUTO}', $bcryptOrAuto, $expectedSource);
29+
2630
$this->assertSame($expectedSource, $actualSource);
2731
}
2832

@@ -48,13 +52,6 @@ public function getUserClassTests()
4852
'model_username_no_password.yaml',
4953
];
5054

51-
$config = new UserClassConfiguration(false, 'email', true);
52-
$config->useArgon2(false);
53-
yield 'model_email_password_bcrypt' => [
54-
$config,
55-
'model_email_password_bcrypt.yaml',
56-
];
57-
5855
yield 'model_email_password_existing_providers' => [
5956
new UserClassConfiguration(false, 'email', true),
6057
'model_email_password_existing_providers.yaml',

‎tests/Security/yaml_fixtures/expected_user_class/empty_source_model_email_with_password.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
security:
22
encoders:
33
App\Security\User:
4-
algorithm: argon2i
4+
algorithm: {BCRYPT_OR_AUTO}
55

66
providers:
77
# used to reload user from session & other features (e.g. switch_user)

‎tests/Security/yaml_fixtures/expected_user_class/entity_email_with_password.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
security:
22
encoders:
33
App\Entity\User:
4-
algorithm: argon2i
4+
algorithm: {BCRYPT_OR_AUTO}
55

66
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
77
providers:

‎tests/Security/yaml_fixtures/expected_user_class/model_email_password_bcrypt.yaml

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎tests/Security/yaml_fixtures/expected_user_class/model_email_password_existing_providers.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
security:
22
encoders:
33
App\Security\User:
4-
algorithm: argon2i
4+
algorithm: {BCRYPT_OR_AUTO}
55

66
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
77
providers:

‎tests/Security/yaml_fixtures/expected_user_class/model_email_with_password.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
security:
22
encoders:
33
App\Security\User:
4-
algorithm: argon2i
4+
algorithm: {BCRYPT_OR_AUTO}
55

66
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
77
providers:

0 commit comments

Comments
 (0)
0