Problem/Motivation

#3410582: Optimize user logins by avoiding duplicate entity queries adds UserAuthenticationInterface to replace UserAuthInterface, but it doesn't yet deprecate the old interface because it would be a hard break for type hints of code relying on the current service. Instead we trigger runtime deprecations when we notice the new interface isn't in use, which should prompt contrib modules to update their UserAuth decorators to implement the new interface, and allow any code type hinting the old interface to update too.

Once we get to 11.1, we can assume that contrib should have updated and Drupal 10.2 support has been dropped. Then we can deprecate UserAuthInterface for removal in 12.x, and stop implementing it in the UserAuth class.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Issue fork drupal-3427298

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

catch created an issue. See original summary.

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

List of contrib modules currently implementing the UserAuthInterface

There are likely many others. This list is a snapshot of search results found from the Russian drupal module grepper.

catch’s picture

catch
he/him
Primary language English
commented

@joseph.olstad most of those are controllers and forms that are injecting the interface (and will be a one or two line change to update), not implementing it.

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

@catch ,
ya, I was just curious as to how far this reaches. Then I thought that this list might be helpful. Especially for the working group that will be assembled for D11.

catch’s picture

catch
he/him
Primary language English
commented
Title: [11.1] Deprecate UserAuthInterface » Deprecate UserAuthInterface

This should be possible to do now.

danielveza made their first commit to this issue’s fork.

danielveza opened merge request !13258

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Priority: Normal » Critical

Bumping this to critical, given the implementation is going away in 12.0 we really should notify users ASAP, but 11.4 is now the earliest we can do that.

catch’s picture

catch
he/him
Primary language English
commented
Status: Active » Needs work
Issue tags: +Needs reroll

rpayanm made their first commit to this issue’s fork.

rpayanm opened merge request !14126

rpayanm changed the visibility of the branch 3427298-deprecate-userauthinterface to hidden.

cmlara’s picture

cmlara
he/him
commented

I suggest care in how the deprecation is handled and any associated messaging.

This isn't a common deprecation where maintainers can just change from oldMethod() to newMethod() prior to the method removal.

There have already been bugs around contrib attempting to no longer support UserAuthInterface too soon.

Until 12.0 all code needs to assume it will interact with UserAuthInterface or UserAuthenticationInterface (and both in the same workflow due to decorators) .
See https://www.drupal.org/project/tfa/issues/3497020#comment-15925291 for some previously written details regarding decorator interactions (and why TFA can not reliably implement UserAuthenticationInterface until 12.0's release).

berdir’s picture

berdir
Primary language German
Location Switzerland
commented

Yes it is really tricky, I think we can only only triggering a deprecation in core when are dealing with a userAuth service that does not implement UserAuthenticationInterface. Core still actively implements this interface in \Drupal\user\UserAuthentication and will have to until that's no longer supported.

So in places like \Drupal\user\Form\UserLoginForm::validateAuthentication.

We also already trigger a deprecation in \Drupal\user\UserAuth::authenticate(), so anyone who still calls that already gets that.

In D12, \Drupal\user\UserAuthentication will then no longer implement UserAuthInterface and then we can deprecate the interface there for removal in D13.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.