Merge remote branch 'symfony/master' into event-manager

Conflicts:
	src/Symfony/Bundle/FrameworkBundle/Debug/TraceableEventManager.php
	src/Symfony/Bundle/WebProfilerBundle/WebDebugToolbarListener.php
	src/Symfony/Component/Security/Http/Firewall.php
	src/Symfony/Component/Security/Http/Firewall/AbstractAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/AbstractPreAuthenticatedListener.php
	src/Symfony/Component/Security/Http/Firewall/AccessListener.php
	src/Symfony/Component/Security/Http/Firewall/AnonymousAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/BasicAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/ChannelListener.php
	src/Symfony/Component/Security/Http/Firewall/ContextListener.php
	src/Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener.php
	src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php
	src/Symfony/Component/Security/Http/Firewall/ListenerInterface.php
	src/Symfony/Component/Security/Http/Firewall/LogoutListener.php
	src/Symfony/Component/Security/Http/Firewall/RememberMeListener.php
	src/Symfony/Component/Security/Http/Firewall/SwitchUserListener.php
	tests/Symfony/Tests/Component/Security/Http/Firewall/RememberMeListenerTest.php

6 files changed, 194 insertions, 172 deletions

diff --git a/Core/Authentication/Token/Token.php b/Core/Authentication/Token/AbstractToken.php
index ac0879f..ee6b207 100644
--- a/Core/Authentication/Token/Token.php
+++ b/Core/Authentication/Token/AbstractToken.php
@@ -13,7 +13,7 @@ namespace Symfony\Component\Security\Core\Authentication\Token;
 
 use Symfony\Component\Security\Core\Role\RoleInterface;
 use Symfony\Component\Security\Core\Role\Role;
-use Symfony\Component\Security\Core\User\AccountInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 /**
  * Base class for Token instances.
@@ -21,15 +21,12 @@ use Symfony\Component\Security\Core\User\AccountInterface;
  * @author Fabien Potencier <fabien@symfony.com>
  * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  */
-abstract class Token implements TokenInterface
+abstract class AbstractToken implements TokenInterface
 {
-    protected $roles;
-    protected $authenticated;
-    protected $user;
-    protected $credentials;
-    protected $immutable;
-    protected $providerKey;
-    protected $attributes;
+    private $user;
+    private $roles;
+    private $authenticated;
+    private $attributes;
 
     /**
      * Constructor.
@@ -38,156 +35,97 @@ abstract class Token implements TokenInterface
      */
     public function __construct(array $roles = array())
     {
-        $this->setRoles($roles);
         $this->authenticated = false;
-        $this->immutable = false;
         $this->attributes = array();
-    }
 
-    /**
-     * Adds a Role to the token.
-     *
-     * @param RoleInterface $role A RoleInterface instance
-     */
-    public function addRole(RoleInterface $role)
-    {
-        if ($this->immutable) {
-            throw new \LogicException('This token is considered immutable.');
-        }
-
-        $this->roles[] = $role;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function getRoles()
-    {
-        return $this->roles;
-    }
-
-    /**
-     * {@inheritDoc}
-     */
-    public function setRoles(array $roles)
-    {
         $this->roles = array();
-
         foreach ($roles as $role) {
             if (is_string($role)) {
                 $role = new Role($role);
+            } else if (!$role instanceof RoleInterface) {
+                throw new \InvalidArgumentException(sprintf('$roles must be an array of strings, or RoleInterface instances, but got %s.', gettype($role)));
             }
 
-            $this->addRole($role);
+            $this->roles[] = $role;
         }
     }
 
     /**
      * {@inheritdoc}
      */
-    public function __toString()
-    {
-        if ($this->user instanceof AccountInterface) {
-            return $this->user->getUsername();
-        }
-
-        return (string) $this->user;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function isAuthenticated()
+    public function getRoles()
     {
-        return $this->authenticated;
+        return $this->roles;
     }
 
     /**
      * {@inheritdoc}
      */
-    public function setAuthenticated($authenticated)
+    public function getUsername()
     {
-        if ($this->immutable) {
-            throw new \LogicException('This token is considered immutable.');
+        if ($this->user instanceof UserInterface) {
+            return $this->user->getUsername();
         }
 
-        $this->authenticated = (Boolean) $authenticated;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function getCredentials()
-    {
-        return $this->credentials;
+        return (string) $this->user;
     }
 
-    /**
-     * {@inheritdoc}
-     */
     public function getUser()
     {
         return $this->user;
     }
 
-    /**
-     * {@inheritDoc}
-     */
     public function setUser($user)
     {
-        if ($this->immutable) {
-            throw new \LogicException('This token is considered immutable.');
+        if (!($user instanceof UserInterface || (is_object($user) && method_exists($user, '__toString')) || is_string($user))) {
+            throw new \InvalidArgumentException('$user must be an instanceof of UserInterface, an object implementing a __toString method, or a primitive string.');
         }
 
-        if (!is_string($user) && !is_object($user)) {
-            throw new \InvalidArgumentException('$user must be an object, or a primitive string.');
-        } else if (is_object($user) && !$user instanceof AccountInterface && !method_exists($user, '__toString')) {
-            throw new \InvalidArgumentException('If $user is an object, it must implement __toString().');
-        }
-
-        $this->user = $user;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function eraseCredentials()
-    {
-        if ($this->immutable) {
-            throw new \LogicException('This token is considered immutable.');
+        if (null === $this->user) {
+            $changed = false;
+        } else if ($this->user instanceof UserInterface) {
+            if (!$user instanceof UserInterface) {
+                $changed = true;
+            } else {
+                $changed = !$this->user->equals($user);
+            }
+        } else if ($user instanceof UserInterface) {
+            $changed = true;
+        } else {
+            $changed = (string) $this->user !== (string) $user;
         }
 
-        if ($this->getCredentials() instanceof AccountInterface) {
-            $this->getCredentials()->eraseCredentials();
+        if ($changed) {
+            $this->setAuthenticated(false);
         }
 
-        if ($this->getUser() instanceof AccountInterface) {
-            $this->getUser()->eraseCredentials();
-        }
+        $this->user = $user;
     }
 
     /**
      * {@inheritdoc}
      */
-    public function isImmutable()
+    public function isAuthenticated()
     {
-        return $this->immutable;
+        return $this->authenticated;
     }
 
     /**
      * {@inheritdoc}
      */
-    public function setImmutable()
+    public function setAuthenticated($authenticated)
     {
-        $this->immutable = true;
+        $this->authenticated = (Boolean) $authenticated;
     }
 
     /**
      * {@inheritdoc}
      */
-    public function getProviderKey()
+    public function eraseCredentials()
     {
-        return $this->providerKey;
+        if ($this->getUser() instanceof UserInterface) {
+            $this->getUser()->eraseCredentials();
+        }
     }
 
     /**
@@ -195,7 +133,7 @@ abstract class Token implements TokenInterface
      */
     public function serialize()
     {
-        return serialize(array($this->user, $this->credentials, $this->authenticated, $this->roles, $this->immutable, $this->providerKey, $this->attributes));
+        return serialize(array($this->user, $this->authenticated, $this->roles, $this->attributes));
     }
 
     /**
@@ -203,7 +141,7 @@ abstract class Token implements TokenInterface
      */
     public function unserialize($serialized)
     {
-        list($this->user, $this->credentials, $this->authenticated, $this->roles, $this->immutable, $this->providerKey, $this->attributes) = unserialize($serialized);
+        list($this->user, $this->authenticated, $this->roles, $this->attributes) = unserialize($serialized);
     }
 
     /**
@@ -266,4 +204,20 @@ abstract class Token implements TokenInterface
     {
         $this->attributes[$name] = $value;
     }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function __toString()
+    {
+        $class = get_class($this);
+        $class = substr($class, strrpos($class, '\\')+1);
+
+        $roles = array();
+        foreach ($this->roles as $role) {
+            $roles[] = $role->getRole();
+        }
+
+        return sprintf('%s(user="%s", authenticated=%s, roles="%s")', $class, $this->getUsername(), json_encode($this->authenticated), implode(', ', $roles));
+    }
 }
diff --git a/Core/Authentication/Token/AnonymousToken.php b/Core/Authentication/Token/AnonymousToken.php
index a22460f..92d95de 100644
--- a/Core/Authentication/Token/AnonymousToken.php
+++ b/Core/Authentication/Token/AnonymousToken.php
@@ -16,10 +16,11 @@ namespace Symfony\Component\Security\Core\Authentication\Token;
  *
  * @author Fabien Potencier <fabien@symfony.com>
  */
-class AnonymousToken extends Token
+use Symfony\Component\Security\Core\User\UserInterface;
+
+class AnonymousToken extends AbstractToken
 {
-    protected $user;
-    protected $key;
+    private $key;
 
     /**
      * Constructor.
@@ -33,9 +34,8 @@ class AnonymousToken extends Token
         parent::__construct($roles);
 
         $this->key = $key;
-        $this->user = $user;
-
-        parent::setAuthenticated(true);
+        $this->setUser($user);
+        $this->setAuthenticated(true);
     }
 
     /**
@@ -55,4 +55,21 @@ class AnonymousToken extends Token
     {
         return $this->key;
     }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function serialize()
+    {
+        return serialize(array($this->key, parent::serialize()));
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function unserialize($str)
+    {
+        list($this->key, $parentStr) = unserialize($str);
+        parent::unserialize($parentStr);
+    }
 }
diff --git a/Core/Authentication/Token/PreAuthenticatedToken.php b/Core/Authentication/Token/PreAuthenticatedToken.php
index 0db56bd..ff0572f 100644
--- a/Core/Authentication/Token/PreAuthenticatedToken.php
+++ b/Core/Authentication/Token/PreAuthenticatedToken.php
@@ -16,21 +16,39 @@ namespace Symfony\Component\Security\Core\Authentication\Token;
  *
  * @author Fabien Potencier <fabien@symfony.com>
  */
-class PreAuthenticatedToken extends Token
+class PreAuthenticatedToken extends AbstractToken
 {
+    private $credentials;
+    private $providerKey;
+
     /**
      * Constructor.
      */
-    public function __construct($user, $credentials, $providerKey, array $roles = null)
+    public function __construct($user, $credentials, $providerKey, array $roles = array())
     {
-        parent::__construct(null === $roles ? array() : $roles);
-        if (null !== $roles) {
-            $this->setAuthenticated(true);
+        parent::__construct($roles);
+
+        if (empty($providerKey)) {
+            throw new \InvalidArgumentException('$providerKey must not be empty.');
         }
 
-        $this->user = $user;
+        $this->setUser($user);
         $this->credentials = $credentials;
         $this->providerKey = $providerKey;
+
+        if ($roles) {
+            $this->setAuthenticated(true);
+        }
+    }
+
+    public function getProviderKey()
+    {
+        return $this->providerKey;
+    }
+
+    public function getCredentials()
+    {
+        return $this->credentials;
     }
 
     /**
@@ -42,4 +60,15 @@ class PreAuthenticatedToken extends Token
 
         $this->credentials = null;
     }
+
+    public function serialize()
+    {
+        return serialize(array($this->credentials, $this->providerKey, parent::serialize()));
+    }
+
+    public function unserialize($str)
+    {
+        list($this->credentials, $this->providerKey, $parentStr) = unserialize($str);
+        parent::unserialize($parentStr);
+    }
 }
diff --git a/Core/Authentication/Token/RememberMeToken.php b/Core/Authentication/Token/RememberMeToken.php
index ce1ed5d..7978427 100644
--- a/Core/Authentication/Token/RememberMeToken.php
+++ b/Core/Authentication/Token/RememberMeToken.php
@@ -11,69 +11,77 @@
 
 namespace Symfony\Component\Security\Core\Authentication\Token;
 
-use Symfony\Component\Security\Core\Authentication\RememberMe\PersistentTokenInterface;
-use Symfony\Component\Security\Core\User\AccountInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 /**
- * Base class for "Remember Me" tokens
+ * Authentication Token for "Remember-Me".
  *
  * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  */
-class RememberMeToken extends Token
+class RememberMeToken extends AbstractToken
 {
-    protected $key;
-
-    /**
-     * The persistent token which resulted in this authentication token.
-     *
-     * @var PersistentTokenInterface
-     */
-    protected $persistentToken;
+    private $key;
+    private $providerKey;
 
     /**
      * Constructor.
      *
-     * @param string $username
+     * @param UserInterface $user
+     * @param string $providerKey
      * @param string $key
      */
-    public function __construct(AccountInterface $user, $providerKey, $key) {
+    public function __construct(UserInterface $user, $providerKey, $key) {
         parent::__construct($user->getRoles());
 
         if (empty($key)) {
             throw new \InvalidArgumentException('$key must not be empty.');
         }
+
         if (empty($providerKey)) {
             throw new \InvalidArgumentException('$providerKey must not be empty.');
         }
 
-        $this->setUser($user);
         $this->providerKey = $providerKey;
         $this->key = $key;
-        $this->setAuthenticated(true);
+
+        $this->setUser($user);
+        parent::setAuthenticated(true);
     }
 
-    public function getKey()
+    public function setAuthenticated($authenticated)
     {
-        return $this->key;
+        if ($authenticated) {
+            throw new \RuntimeException('You cannot set this token to authenticated after creation.');
+        }
+
+        parent::setAuthenticated(false);
     }
 
-    public function getPersistentToken()
+    public function getProviderKey()
     {
-        return $this->persistentToken;
+        return $this->providerKey;
     }
 
-    public function setPersistentToken(PersistentTokenInterface $persistentToken)
+    public function getKey()
     {
-        $this->persistentToken = $persistentToken;
+        return $this->key;
     }
 
+    public function getCredentials()
+    {
+        return '';
+    }
 
     /**
      * {@inheritdoc}
      */
     public function serialize()
     {
-        return serialize(array($this->user, $this->credentials, $this->authenticated, $this->roles, $this->immutable, $this->providerKey, $this->attributes, $this->key));
+        return serialize(array(
+            $this->key,
+            $this->providerKey,
+            parent::serialize(),
+        ));
     }
 
     /**
@@ -81,6 +89,7 @@ class RememberMeToken extends Token
      */
     public function unserialize($serialized)
     {
-        list($this->user, $this->credentials, $this->authenticated, $this->roles, $this->immutable, $this->providerKey, $this->attributes, $this->key) = unserialize($serialized);
+        list($this->key, $this->providerKey, $parentStr) = unserialize($serialized);
+        parent::unserialize($parentStr);
     }
 }
\ No newline at end of file
diff --git a/Core/Authentication/Token/TokenInterface.php b/Core/Authentication/Token/TokenInterface.php
index f3947dd..63e2243 100644
--- a/Core/Authentication/Token/TokenInterface.php
+++ b/Core/Authentication/Token/TokenInterface.php
@@ -11,19 +11,22 @@
 
 namespace Symfony\Component\Security\Core\Authentication\Token;
 
-use Symfony\Component\Security\Core\User\AccountInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 /**
  * TokenInterface is the interface for the user authentication information.
  *
  * @author Fabien Potencier <fabien@symfony.com>
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  */
 interface TokenInterface extends \Serializable
 {
     /**
-     * Returns a string representation of the token.
+     * Returns a string representation ofthe Token.
      *
-     * @return string A string representation
+     * This is only to be used for debugging purposes.
+     *
+     * @return string
      */
     function __toString();
 
@@ -35,14 +38,6 @@ interface TokenInterface extends \Serializable
     function getRoles();
 
     /**
-     * Sets the user's roles
-     *
-     * @param array $roles
-     * @return void
-     */
-    function setRoles(array $roles);
-
-    /**
      * Returns the user credentials.
      *
      * @return mixed The user credentials
@@ -58,14 +53,20 @@ interface TokenInterface extends \Serializable
     function getUser();
 
     /**
-     * Sets the user.
+     * Sets a user.
      *
-     * @param mixed $user can either be an object which implements __toString(), or
-     *                       only a primitive string
+     * @param mixed $user
      */
     function setUser($user);
 
     /**
+     * Returns the username.
+     *
+     * @return string
+     */
+    function getUsername();
+
+    /**
      * Checks if the user is authenticated or not.
      *
      * @return Boolean true if the token has been authenticated, false otherwise
@@ -80,22 +81,6 @@ interface TokenInterface extends \Serializable
     function setAuthenticated($isAuthenticated);
 
     /**
-     * Whether this token is considered immutable
-     *
-     * @return Boolean
-     */
-    function isImmutable();
-
-    /**
-     * Marks this token as immutable. This change cannot be reversed.
-     *
-     * You'll need to create a new token if you want a mutable token again.
-     *
-     * @return void
-     */
-    function setImmutable();
-
-    /**
      * Removes sensitive information from the token.
      */
     function eraseCredentials();
diff --git a/Core/Authentication/Token/UsernamePasswordToken.php b/Core/Authentication/Token/UsernamePasswordToken.php
index 58b2b5b..67311db 100644
--- a/Core/Authentication/Token/UsernamePasswordToken.php
+++ b/Core/Authentication/Token/UsernamePasswordToken.php
@@ -16,8 +16,11 @@ namespace Symfony\Component\Security\Core\Authentication\Token;
  *
  * @author Fabien Potencier <fabien@symfony.com>
  */
-class UsernamePasswordToken extends Token
+class UsernamePasswordToken extends AbstractToken
 {
+    private $credentials;
+    private $providerKey;
+
     /**
      * Constructor.
      *
@@ -28,11 +31,15 @@ class UsernamePasswordToken extends Token
     {
         parent::__construct($roles);
 
+        if (empty($providerKey)) {
+            throw new \InvalidArgumentException('$providerKey must not be empty.');
+        }
+
         $this->setUser($user);
         $this->credentials = $credentials;
         $this->providerKey = $providerKey;
 
-        parent::setAuthenticated((Boolean) count($roles));
+        parent::setAuthenticated(count($roles) > 0);
     }
 
     /**
@@ -47,6 +54,16 @@ class UsernamePasswordToken extends Token
         parent::setAuthenticated(false);
     }
 
+    public function getCredentials()
+    {
+        return $this->credentials;
+    }
+
+    public function getProviderKey()
+    {
+        return $this->providerKey;
+    }
+
     /**
      * {@inheritdoc}
      */
@@ -56,4 +73,15 @@ class UsernamePasswordToken extends Token
 
         $this->credentials = null;
     }
+
+    public function serialize()
+    {
+        return serialize(array($this->credentials, $this->providerKey, parent::serialize()));
+    }
+
+    public function unserialize($str)
+    {
+        list($this->credentials, $this->providerKey, $parentStr) = unserialize($str);
+        parent::unserialize($parentStr);
+    }
 }