Convert CurrentUser to IdentifiedUser without casting

Add an asIdentifiedUser() method to CurrentUser that throws
UnsupportedOperationException if the user is not an IdentifiedUser.
This has a number of minor benefits:
 - Fewer extraneous parens required for writing
   ((IdentifiedUser) u).getAccount().
 - Slightly more descriptive error message "FooUser is not
   IdentifiedUser" rather than a ClassCastException when an assumed
   precondition does not hold.
 - Implementation may be slightly more efficient, by overriding the
   method to "return this" rather than an extra instruction for the
   cast. (Not benchmarked.)

By far the most common use of ((IdentifiedUser u) is to immediately
call getAccountId(), so add a similar method getAccountId() to
CurrentUser.

These methods still throw unchecked exceptions, which matches the
existing behavior. Some calls are guarded by isIdentifiedUser() and
take different behavior if false; this ranges from throwing a checked
exception, typically but not always AuthException, to substituting
GerritPersonIdent. Other calls just continue to assume that the user
is always an IdentifiedUser.

Change-Id: I2ab2028a7cdc0f703c4a4cdc2b5797d87ab7024c

gerrit-acceptance-framework/src/test/java/com/google/gerrit/acceptance/InProcessProtocol.java

@@ -326,8 +326,7 @@ class InProcessProtocol extends TestProtocol<Context> {
           throw new ServiceNotAuthorizedException();
         }
 
-        IdentifiedUser user = (IdentifiedUser) ctl.getUser();
+        rp.setRefLogIdent(ctl.getUser().asIdentifiedUser().newRefLogIdent());
-        rp.setRefLogIdent(user.newRefLogIdent());
         rp.setTimeout(config.getTimeout());
         rp.setMaxObjectSizeLimit(config.getMaxObjectSizeLimit());
 

gerrit-acceptance-tests/src/test/java/com/google/gerrit/acceptance/api/accounts/AccountIT.java

@@ -41,7 +41,6 @@ import com.google.gerrit.gpg.testutil.TestKey;
 import com.google.gerrit.gpg.testutil.TestKeys;
 import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.AccountExternalId;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.AllUsersName;
 import com.google.gerrit.testutil.ConfigSuite;
 import com.google.inject.Inject;
@@ -375,8 +374,7 @@ public class AccountIT extends AbstractDaemonTest {
     }
 
     // Check raw external IDs.
-    Account.Id currAccountId =
+    Account.Id currAccountId = atrScope.get().getUser().getAccountId();
-        ((IdentifiedUser) atrScope.get().getUser()).getAccountId();
     assertThat(
         GpgKeys.getGpgExtIds(db, currAccountId)
           .transform(new Function<AccountExternalId, String>() {

gerrit-httpd/src/main/java/com/google/gerrit/httpd/GetUserFilter.java

@@ -72,7 +72,7 @@ public class GetUserFilter implements Filter {
       throws IOException, ServletException {
     CurrentUser user = userProvider.get();
     if (user != null && user.isIdentifiedUser()) {
-      IdentifiedUser who = (IdentifiedUser) user;
+      IdentifiedUser who = user.asIdentifiedUser();
       if (who.getUserName() != null && !who.getUserName().isEmpty()) {
         req.setAttribute(REQ_ATTR_KEY, who.getUserName());
       } else {

gerrit-httpd/src/main/java/com/google/gerrit/httpd/GitOverHttpServlet.java

@@ -297,7 +297,7 @@ public class GitOverHttpServlet extends GitServlet {
         throw new ServiceNotAuthorizedException();
       }
 
-      final IdentifiedUser user = (IdentifiedUser) pc.getUser();
+      final IdentifiedUser user = pc.getUser().asIdentifiedUser();
       final ReceiveCommits rc = factory.create(pc, db).getReceiveCommits();
       ReceivePack rp = rc.getReceivePack();
       rp.setRefLogIdent(user.newRefLogIdent());
@@ -373,8 +373,7 @@ public class GitOverHttpServlet extends GitServlet {
       }
 
       AdvertisedObjectsCacheKey cacheKey = AdvertisedObjectsCacheKey.create(
-          ((IdentifiedUser) pc.getUser()).getAccountId(),
+          pc.getUser().getAccountId(), projectName);
-          projectName);
 
       if (isGet) {
         cache.invalidate(cacheKey);

gerrit-httpd/src/main/java/com/google/gerrit/httpd/gitweb/GitwebServlet.java

@@ -552,7 +552,7 @@ class GitwebServlet extends HttpServlet {
 
     String remoteUser = null;
     if (project.getUser().isIdentifiedUser()) {
-      final IdentifiedUser u = (IdentifiedUser) project.getUser();
+      final IdentifiedUser u = project.getUser().asIdentifiedUser();
       final String user = u.getUserName();
       env.set("GERRIT_USER_NAME", user);
       if (user != null && !user.isEmpty()) {

gerrit-httpd/src/main/java/com/google/gerrit/httpd/raw/HostPageServlet.java

@@ -31,7 +31,6 @@ import com.google.gerrit.extensions.webui.WebUiPlugin;
 import com.google.gerrit.httpd.HtmlDomUtil;
 import com.google.gerrit.httpd.WebSession;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.ConfigUtil;
 import com.google.gerrit.server.config.GerritServerConfig;
 import com.google.gerrit.server.config.SitePaths;
@@ -188,7 +187,7 @@ public class HostPageServlet extends HttpServlet {
       w.write(";");
 
       w.write(HPD_ID + ".accountDiffPref=");
-      json(((IdentifiedUser) user).getAccountDiffPreference(), w);
+      json(user.asIdentifiedUser().getAccountDiffPreference(), w);
       w.write(";");
 
       w.write(HPD_ID + ".theme=");

gerrit-httpd/src/main/java/com/google/gerrit/httpd/rpc/BaseServiceImplementation.java

@@ -21,7 +21,6 @@ import com.google.gerrit.common.errors.NoSuchGroupException;
 import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.project.NoSuchChangeException;
 import com.google.gerrit.server.project.NoSuchProjectException;
 import com.google.gwtjsonrpc.common.AsyncCallback;
@@ -42,10 +41,7 @@ public class BaseServiceImplementation {
 
   protected Account.Id getAccountId() {
     CurrentUser u = currentUser.get();
-    if (u.isIdentifiedUser()) {
+    return u.isIdentifiedUser() ? u.getAccountId() : null;
-      return ((IdentifiedUser) u).getAccountId();
-    }
-    return null;
   }
 
   protected CurrentUser getUser() {

gerrit-httpd/src/main/java/com/google/gerrit/httpd/rpc/account/AccountServiceImpl.java

@@ -141,7 +141,7 @@ class AccountServiceImpl extends BaseServiceImplementation implements
 
         AccountProjectWatch watch =
             new AccountProjectWatch(new AccountProjectWatch.Key(
-                ((IdentifiedUser) ctl.getUser()).getAccountId(),
+                ctl.getUser().getAccountId(),
                 nameKey, filter));
         try {
           db.accountProjectWatches().insert(Collections.singleton(watch));

gerrit-httpd/src/main/java/com/google/gerrit/httpd/rpc/changedetail/PatchSetDetailFactory.java

@@ -31,7 +31,6 @@ import com.google.gerrit.reviewdb.client.PatchSet;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.PatchLineCommentsUtil;
 import com.google.gerrit.server.edit.ChangeEdit;
 import com.google.gerrit.server.edit.ChangeEditUtil;
@@ -183,7 +182,7 @@ class PatchSetDetailFactory extends Handler<PatchSetDetail> {
       // current user on each of these patch files. This way they can more
       // quickly locate where they have pending drafts, and review them.
       //
-      final Account.Id me = ((IdentifiedUser) user).getAccountId();
+      final Account.Id me = user.getAccountId();
       for (PatchLineComment c
           : plcUtil.draftByPatchSetAuthor(db, psIdNew, me, notes)) {
         final Patch p = byKey.get(c.getKey().getParentKey());

gerrit-pgm/src/main/java/com/google/gerrit/pgm/http/jetty/ProjectQoSFilter.java

@@ -20,7 +20,6 @@ import static java.util.concurrent.TimeUnit.MINUTES;
 import static javax.servlet.http.HttpServletResponse.SC_SERVICE_UNAVAILABLE;
 
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.GerritServerConfig;
 import com.google.gerrit.server.git.QueueProvider;
 import com.google.gerrit.server.git.WorkQueue;
@@ -84,17 +83,17 @@ public class ProjectQoSFilter implements Filter {
     }
   }
 
-  private final Provider<CurrentUser> userProvider;
+  private final Provider<CurrentUser> user;
   private final QueueProvider queue;
 
   private final ServletContext context;
   private final long maxWait;
 
   @Inject
-  ProjectQoSFilter(final Provider<CurrentUser> userProvider,
+  ProjectQoSFilter(final Provider<CurrentUser> user,
       QueueProvider queue, final ServletContext context,
       @GerritServerConfig final Config cfg) {
-    this.userProvider = userProvider;
+    this.user = user;
     this.queue = queue;
     this.context = context;
     this.maxWait = MINUTES.toMillis(getTimeUnit(cfg, "httpd", null, "maxwait", 5, MINUTES));
@@ -142,7 +141,7 @@ public class ProjectQoSFilter implements Filter {
   }
 
   private WorkQueue.Executor getExecutor() {
-    return queue.getQueue(userProvider.get().getCapabilities().getQueueType());
+    return queue.getQueue(user.get().getCapabilities().getQueueType());
   }
 
   @Override
@@ -226,9 +225,9 @@ public class ProjectQoSFilter implements Filter {
     private String generateName(HttpServletRequest req) {
       String userName = "";
 
-      CurrentUser who = userProvider.get();
+      CurrentUser who = user.get();
       if (who.isIdentifiedUser()) {
-        String name = ((IdentifiedUser) who).getUserName();
+        String name = who.asIdentifiedUser().getUserName();
         if (name != null && !name.isEmpty()) {
           userName = " (" + name + ")";
         }

gerrit-server/src/main/java/com/google/gerrit/server/ChangeUtil.java

@@ -190,7 +190,7 @@ public class ChangeUtil {
     return subject;
   }
 
-  private final Provider<CurrentUser> userProvider;
+  private final Provider<IdentifiedUser> user;
   private final Provider<ReviewDb> db;
   private final Provider<InternalChangeQuery> queryProvider;
   private final RevertedSender.Factory revertedSenderFactory;
@@ -201,7 +201,7 @@ public class ChangeUtil {
   private final BatchUpdate.Factory updateFactory;
 
   @Inject
-  ChangeUtil(Provider<CurrentUser> userProvider,
+  ChangeUtil(Provider<IdentifiedUser> user,
       Provider<ReviewDb> db,
       Provider<InternalChangeQuery> queryProvider,
       RevertedSender.Factory revertedSenderFactory,
@@ -210,7 +210,7 @@ public class ChangeUtil {
       GitReferenceUpdated gitRefUpdated,
       ChangeIndexer indexer,
       BatchUpdate.Factory updateFactory) {
-    this.userProvider = userProvider;
+    this.user = user;
     this.db = db;
     this.queryProvider = queryProvider;
     this.revertedSenderFactory = revertedSenderFactory;
@@ -239,8 +239,8 @@ public class ChangeUtil {
       RevCommit commitToRevert =
           revWalk.parseCommit(ObjectId.fromString(patch.getRevision().get()));
 
-      PersonIdent authorIdent =
+      PersonIdent authorIdent = user.get()
-          user().newCommitterIdent(myIdent.getWhen(), myIdent.getTimeZone());
+          .newCommitterIdent(myIdent.getWhen(), myIdent.getTimeZone());
 
       RevCommit parentToCommitToRevert = commitToRevert.getParent(0);
       revWalk.parseHeaders(parentToCommitToRevert);
@@ -274,7 +274,7 @@ public class ChangeUtil {
         Change change = new Change(
             new Change.Key("I" + computedChangeId.name()),
             new Change.Id(db.get().nextChangeId()),
-            user().getAccountId(),
+            user.get().getAccountId(),
             changeToRevert.getDest(),
             TimeUtil.nowTs());
         change.setTopic(changeToRevert.getTopic());
@@ -299,7 +299,7 @@ public class ChangeUtil {
       Change.Id id = ins.getChange().getId();
       try {
         RevertedSender cm = revertedSenderFactory.create(id);
-        cm.setFrom(user().getAccountId());
+        cm.setFrom(user.get().getAccountId());
         cm.setChangeMessage(ins.getChangeMessage());
         cm.send();
       } catch (Exception err) {
@@ -449,10 +449,6 @@ public class ChangeUtil {
     throw new ResourceNotFoundException(id);
   }
 
-  private IdentifiedUser user() {
-    return (IdentifiedUser) userProvider.get();
-  }
-
   private static void deleteOnlyDraftPatchSetPreserveRef(ReviewDb db,
       PatchSet patch) throws NoSuchChangeException, OrmException {
     PatchSet.Id patchSetId = patch.getId();

gerrit-server/src/main/java/com/google/gerrit/server/CurrentUser.java

@@ -14,6 +14,7 @@
 
 package com.google.gerrit.server;
 
+import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.AccountProjectWatch;
 import com.google.gerrit.reviewdb.client.Change;
 import com.google.gerrit.server.account.CapabilityControl;
@@ -101,6 +102,18 @@ public abstract class CurrentUser {
     return false;
   }
 
+  /** Cast to IdentifiedUser if possible. */
+  public IdentifiedUser asIdentifiedUser() {
+    throw new UnsupportedOperationException(
+        getClass().getSimpleName() + " is not an IdentifiedUser");
+  }
+
+  /** Return account ID if {@link #isIdentifiedUser} is true. */
+  public Account.Id getAccountId() {
+    throw new UnsupportedOperationException(
+        getClass().getSimpleName() + " is not an IdentifiedUser");
+  }
+
   /** Check if the CurrentUser is an InternalUser. */
   public boolean isInternalUser() {
     return false;

gerrit-server/src/main/java/com/google/gerrit/server/IdentifiedUser.java

@@ -254,7 +254,12 @@ public class IdentifiedUser extends CurrentUser {
     return state;
   }
 
-  /** The account identity for the user. */
+  @Override
+  public IdentifiedUser asIdentifiedUser() {
+    return this;
+  }
+
+  @Override
   public Account.Id getAccountId() {
     return accountId;
   }

gerrit-server/src/main/java/com/google/gerrit/server/account/AccountControl.java

@@ -61,19 +61,19 @@ public class AccountControl {
 
   private final AccountsSection accountsSection;
   private final GroupControl.Factory groupControlFactory;
-  private final CurrentUser currentUser;
+  private final CurrentUser user;
   private final IdentifiedUser.GenericFactory userFactory;
   private final AccountVisibility accountVisibility;
 
   AccountControl(final ProjectCache projectCache,
         final GroupControl.Factory groupControlFactory,
-        final CurrentUser currentUser,
+        final CurrentUser user,
         final IdentifiedUser.GenericFactory userFactory,
         final AccountVisibility accountVisibility) {
     this.accountsSection =
         projectCache.getAllProjects().getConfig().getAccountsSection();
     this.groupControlFactory = groupControlFactory;
-    this.currentUser = currentUser;
+    this.user = user;
     this.userFactory = userFactory;
     this.accountVisibility = accountVisibility;
   }
@@ -100,11 +100,10 @@ public class AccountControl {
    */
   public boolean canSee(final Account.Id otherUser) {
     // Special case: I can always see myself.
-    if (currentUser.isIdentifiedUser()
+    if (user.isIdentifiedUser() && user.getAccountId().equals(otherUser)) {
-        && ((IdentifiedUser) currentUser).getAccountId().equals(otherUser)) {
       return true;
     }
-    if (currentUser.getCapabilities().canViewAllAccounts()) {
+    if (user.getCapabilities().canViewAllAccounts()) {
       return true;
     }
 
@@ -119,7 +118,7 @@ public class AccountControl {
           }
         }
 
-        if (currentUser.getEffectiveGroups().containsAnyOf(usersGroups)) {
+        if (user.getEffectiveGroups().containsAnyOf(usersGroups)) {
           return true;
         }
         break;

gerrit-server/src/main/java/com/google/gerrit/server/account/AccountsCollection.java

@@ -114,7 +114,7 @@ public class AccountsCollection implements
     if (id.equals("self")) {
       CurrentUser user = self.get();
       if (user.isIdentifiedUser()) {
-        return (IdentifiedUser) user;
+        return user.asIdentifiedUser();
       } else if (user instanceof AnonymousUser) {
         throw new AuthException("Authentication required");
       } else {

gerrit-server/src/main/java/com/google/gerrit/server/account/GroupControl.java

@@ -20,7 +20,6 @@ import com.google.gerrit.common.errors.NoSuchGroupException;
 import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
@@ -159,8 +158,7 @@ public class GroupControl {
   }
 
   public boolean canSeeMember(Account.Id id) {
-    if (user.isIdentifiedUser()
+    if (user.isIdentifiedUser() && user.getAccountId().equals(id)) {
-        && ((IdentifiedUser) user).getAccountId().equals(id)) {
       return true;
     }
     return canSeeMembers();

gerrit-server/src/main/java/com/google/gerrit/server/api/accounts/AccountsImpl.java

@@ -22,7 +22,6 @@ import com.google.gerrit.extensions.restapi.IdString;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.TopLevelResource;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AccountResource;
 import com.google.gerrit.server.account.AccountsCollection;
 import com.google.gerrit.server.account.SuggestAccounts;
@@ -66,7 +65,7 @@ public class AccountsImpl implements Accounts {
     if (!self.get().isIdentifiedUser()) {
       throw new AuthException("Authentication required");
     }
-    return api.create(new AccountResource((IdentifiedUser)self.get()));
+    return api.create(new AccountResource(self.get().asIdentifiedUser()));
   }
 
   @Override

gerrit-server/src/main/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java

@@ -33,7 +33,6 @@ import com.google.gerrit.extensions.restapi.IdString;
 import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.change.Abandon;
 import com.google.gerrit.server.change.ChangeEdits;
 import com.google.gerrit.server.change.ChangeJson;
@@ -275,7 +274,7 @@ class ChangeApiImpl implements ChangeApi {
     try {
       CurrentUser u = user.get();
       if (u.isIdentifiedUser()) {
-        ((IdentifiedUser) u).clearStarredChanges();
+        u.asIdentifiedUser().clearStarredChanges();
       }
       return changeJson.create(s).format(change);
     } catch (OrmException e) {

gerrit-server/src/main/java/com/google/gerrit/server/api/changes/ChangesImpl.java

@@ -29,7 +29,6 @@ import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.TopLevelResource;
 import com.google.gerrit.extensions.restapi.Url;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.change.ChangesCollection;
 import com.google.gerrit.server.change.CreateChange;
 import com.google.gerrit.server.git.UpdateException;
@@ -131,7 +130,7 @@ class ChangesImpl implements Changes {
     try {
       CurrentUser u = user.get();
       if (u.isIdentifiedUser()) {
-        ((IdentifiedUser) u).clearStarredChanges();
+        u.asIdentifiedUser().clearStarredChanges();
       }
       List<?> result = qc.apply(TopLevelResource.INSTANCE);
       if (result.isEmpty()) {

gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/LdapGroupBackend.java

@@ -126,7 +126,7 @@ public class LdapGroupBackend implements GroupBackend {
     String groupDn = uuid.get().substring(LDAP_UUID.length());
     CurrentUser user = userProvider.get();
     if (!(user.isIdentifiedUser())
-        || !membershipsOf((IdentifiedUser) user).contains(uuid)) {
+        || !membershipsOf(user.asIdentifiedUser()).contains(uuid)) {
       try {
         if (!existsCache.get(groupDn)) {
           return null;

gerrit-server/src/main/java/com/google/gerrit/server/change/Abandon.java

@@ -81,7 +81,7 @@ public class Abandon implements RestModifyView<ChangeResource, AbandonInput>,
       final AbandonInput input)
       throws RestApiException, UpdateException, OrmException {
     ChangeControl control = req.getControl();
-    IdentifiedUser caller = (IdentifiedUser) control.getUser();
+    IdentifiedUser caller = control.getUser().asIdentifiedUser();
     if (!control.canAbandon()) {
       throw new AuthException("abandon not permitted");
     }

gerrit-server/src/main/java/com/google/gerrit/server/change/ChangeInserter.java

@@ -140,7 +140,7 @@ public class ChangeInserter extends BatchUpdate.InsertChangeOp {
     this.sendMail = true;
     this.updateRef = true;
 
-    user = checkUser(refControl);
+    user = refControl.getUser().asIdentifiedUser();
     patchSet =
         new PatchSet(new PatchSet.Id(change.getId(), INITIAL_PATCH_SET_ID));
     patchSet.setCreatedOn(change.getCreatedOn());
@@ -148,12 +148,6 @@ public class ChangeInserter extends BatchUpdate.InsertChangeOp {
     patchSet.setRevision(new RevId(commit.name()));
   }
 
-  private static IdentifiedUser checkUser(RefControl ctl) {
-    checkArgument(ctl.getUser().isIdentifiedUser(),
-        "only IdentifiedUser may create change");
-    return (IdentifiedUser) ctl.getUser();
-  }
-
   @Override
   public Change getChange() {
     return change;
@@ -307,9 +301,8 @@ public class ChangeInserter extends BatchUpdate.InsertChangeOp {
       ReviewDb db = ctx.getDb();
       hooks.doPatchsetCreatedHook(change, patchSet, db);
       if (approvals != null && !approvals.isEmpty()) {
-        hooks.doCommentAddedHook(change,
+        hooks.doCommentAddedHook(
-            ((IdentifiedUser) refControl.getUser()).getAccount(),
+            change, user.getAccount(), patchSet, null, approvals, db);
-            patchSet, null, approvals, db);
       }
     }
   }

gerrit-server/src/main/java/com/google/gerrit/server/change/ChangeJson.java

@@ -424,7 +424,7 @@ public class ChangeJson {
         ? true
         : null;
     if (in.getStatus().isOpen() && has(REVIEWED) && user.isIdentifiedUser()) {
-      Account.Id accountId = ((IdentifiedUser) user).getAccountId();
+      Account.Id accountId = user.getAccountId();
       out.reviewed = cd.reviewedBy().contains(accountId) ? true : null;
     }
 

gerrit-server/src/main/java/com/google/gerrit/server/change/ChangeResource.java

@@ -23,7 +23,6 @@ import com.google.gerrit.extensions.restapi.RestView;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.Change;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.notedb.ChangeNotes;
 import com.google.gerrit.server.project.ChangeControl;
 import com.google.gerrit.server.project.ProjectState;
@@ -63,9 +62,7 @@ public class ChangeResource implements RestResource, HasETag {
   public void prepareETag(Hasher h, CurrentUser user) {
     h.putLong(getChange().getLastUpdatedOn().getTime())
       .putInt(getChange().getRowVersion())
-      .putInt(user.isIdentifiedUser()
+      .putInt(user.isIdentifiedUser() ? user.getAccountId().get() : 0);
-          ? ((IdentifiedUser) user).getAccountId().get()
-          : 0);
 
     if (user.isIdentifiedUser()) {
       for (AccountGroup.UUID uuid : user.getEffectiveGroups().getKnownGroups()) {

gerrit-server/src/main/java/com/google/gerrit/server/change/CherryPickChange.java

@@ -27,7 +27,6 @@ import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.ChangeMessagesUtil;
 import com.google.gerrit.server.ChangeUtil;
-import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.GerritPersonIdent;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.git.BatchUpdate;
@@ -75,7 +74,7 @@ public class CherryPickChange {
   private final Provider<InternalChangeQuery> queryProvider;
   private final GitRepositoryManager gitManager;
   private final TimeZone serverTimeZone;
-  private final Provider<CurrentUser> currentUser;
+  private final Provider<IdentifiedUser> user;
   private final ChangeInserter.Factory changeInserterFactory;
   private final PatchSetInserter.Factory patchSetInserterFactory;
   private final MergeUtil.Factory mergeUtilFactory;
@@ -88,7 +87,7 @@ public class CherryPickChange {
       Provider<InternalChangeQuery> queryProvider,
       @GerritPersonIdent PersonIdent myIdent,
       GitRepositoryManager gitManager,
-      Provider<CurrentUser> currentUser,
+      Provider<IdentifiedUser> user,
       ChangeInserter.Factory changeInserterFactory,
       PatchSetInserter.Factory patchSetInserterFactory,
       MergeUtil.Factory mergeUtilFactory,
@@ -99,7 +98,7 @@ public class CherryPickChange {
     this.queryProvider = queryProvider;
     this.gitManager = gitManager;
     this.serverTimeZone = myIdent.getTimeZone();
-    this.currentUser = currentUser;
+    this.user = user;
     this.changeInserterFactory = changeInserterFactory;
     this.patchSetInserterFactory = patchSetInserterFactory;
     this.mergeUtilFactory = mergeUtilFactory;
@@ -123,7 +122,7 @@ public class CherryPickChange {
 
     Project.NameKey project = change.getProject();
     String destinationBranch = RefNames.shortName(ref);
-    IdentifiedUser identifiedUser = (IdentifiedUser) currentUser.get();
+    IdentifiedUser identifiedUser = user.get();
     try (Repository git = gitManager.openRepository(project);
         CodeReviewRevWalk revWalk = CodeReviewCommit.newRevWalk(git)) {
       Ref destRef = git.getRefDatabase().exactRef(ref);

gerrit-server/src/main/java/com/google/gerrit/server/change/ConsistencyChecker.java

@@ -41,7 +41,6 @@ import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.ChangeUtil;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.GerritPersonIdent;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.git.BatchUpdate;
 import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.git.UpdateException;
@@ -473,7 +472,7 @@ public class ConsistencyChecker {
             .setRunHooks(false)
             .setSendMail(false)
             .setAllowClosed(true)
-            .setUploader(((IdentifiedUser) user.get()).getAccountId())
+            .setUploader(user.get().getAccountId())
             // TODO: fix setMessage to work without init()
             .setMessage(
                 "Patch set for merged commit inserted by consistency checker"));
@@ -603,7 +602,7 @@ public class ConsistencyChecker {
   private PersonIdent newRefLogIdent() {
     CurrentUser u = user.get();
     if (u.isIdentifiedUser()) {
-      return ((IdentifiedUser) u).newRefLogIdent();
+      return u.asIdentifiedUser().newRefLogIdent();
     } else {
       return serverIdent.get();
     }

gerrit-server/src/main/java/com/google/gerrit/server/change/CreateChange.java

@@ -77,7 +77,7 @@ public class CreateChange implements
   private final Provider<ReviewDb> db;
   private final GitRepositoryManager gitManager;
   private final TimeZone serverTimeZone;
-  private final Provider<CurrentUser> userProvider;
+  private final Provider<CurrentUser> user;
   private final ProjectsCollection projectsCollection;
   private final ChangeInserter.Factory changeInserterFactory;
   private final ChangeJson.Factory jsonFactory;
@@ -89,7 +89,7 @@ public class CreateChange implements
   CreateChange(Provider<ReviewDb> db,
       GitRepositoryManager gitManager,
       @GerritPersonIdent PersonIdent myIdent,
-      Provider<CurrentUser> userProvider,
+      Provider<CurrentUser> user,
       ProjectsCollection projectsCollection,
       ChangeInserter.Factory changeInserterFactory,
       ChangeJson.Factory json,
@@ -99,7 +99,7 @@ public class CreateChange implements
     this.db = db;
     this.gitManager = gitManager;
     this.serverTimeZone = myIdent.getTimeZone();
-    this.userProvider = userProvider;
+    this.user = user;
     this.projectsCollection = projectsCollection;
     this.changeInserterFactory = changeInserterFactory;
     this.jsonFactory = json;
@@ -182,7 +182,7 @@ public class CreateChange implements
       RevCommit mergeTip = rw.parseCommit(parentCommit);
 
       Timestamp now = TimeUtil.nowTs();
-      IdentifiedUser me = (IdentifiedUser) userProvider.get();
+      IdentifiedUser me = user.get().asIdentifiedUser();
       PersonIdent author = me.newCommitterIdent(now, serverTimeZone);
 
       ObjectId id = ChangeIdUtil.computeChangeId(mergeTip.getTree(),

gerrit-server/src/main/java/com/google/gerrit/server/change/DeleteReviewer.java

@@ -111,7 +111,7 @@ public class DeleteReviewer implements RestModifyView<ReviewerResource, Input> {
         ChangeMessage changeMessage =
             new ChangeMessage(new ChangeMessage.Key(rsrc.getChange().getId(),
                 ChangeUtil.messageUUID(db)),
-                ((IdentifiedUser) control.getUser()).getAccountId(),
+                control.getUser().getAccountId(),
                 TimeUtil.nowTs(), rsrc.getChange().currentPatchSetId());
         changeMessage.setMessage(msg.toString());
         cmUtil.addChangeMessage(db, update, changeMessage);

gerrit-server/src/main/java/com/google/gerrit/server/change/DraftCommentResource.java

@@ -20,7 +20,6 @@ import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.Change;
 import com.google.gerrit.reviewdb.client.PatchLineComment;
 import com.google.gerrit.reviewdb.client.PatchSet;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.project.ChangeControl;
 import com.google.inject.TypeLiteral;
 
@@ -57,6 +56,6 @@ public class DraftCommentResource implements RestResource {
   }
 
   Account.Id getAuthorId() {
-    return ((IdentifiedUser) getControl().getUser()).getAccountId();
+    return getControl().getUser().getAccountId();
   }
 }

gerrit-server/src/main/java/com/google/gerrit/server/change/Files.java

@@ -34,7 +34,6 @@ import com.google.gerrit.reviewdb.client.PatchSet;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.patch.PatchList;
 import com.google.gerrit.server.patch.PatchListCache;
@@ -207,7 +206,7 @@ public class Files implements ChildCollection<RevisionResource, FileResource> {
         throw new AuthException("Authentication required");
       }
 
-      Account.Id userId = ((IdentifiedUser) user).getAccountId();
+      Account.Id userId = user.getAccountId();
       List<String> r = scan(userId, resource.getPatchSet().getId());
 
       if (r.isEmpty() && 1 < resource.getPatchSet().getPatchSetId()) {

gerrit-server/src/main/java/com/google/gerrit/server/change/ListChangeDrafts.java

@@ -19,7 +19,6 @@ import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.reviewdb.client.PatchLineComment;
 import com.google.gerrit.reviewdb.server.ReviewDb;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.PatchLineCommentsUtil;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gwtorm.server.OrmException;
@@ -54,10 +53,9 @@ public class ListChangeDrafts implements RestReadView<ChangeResource> {
     if (!rsrc.getControl().getUser().isIdentifiedUser()) {
       throw new AuthException("Authentication required");
     }
-    IdentifiedUser user = (IdentifiedUser) rsrc.getControl().getUser();
     ChangeData cd = changeDataFactory.create(db.get(), rsrc.getControl());
-    List<PatchLineComment> drafts =
+    List<PatchLineComment> drafts = plcUtil.draftByChangeAuthor(
-        plcUtil.draftByChangeAuthor(db.get(), cd.notes(), user.getAccountId());
+        db.get(), cd.notes(), rsrc.getControl().getUser().getAccountId());
     return commentJson.get()
         .setFillAccounts(false)
         .setFillPatchSet(true)

gerrit-server/src/main/java/com/google/gerrit/server/change/PatchSetInserter.java

@@ -15,7 +15,6 @@
 package com.google.gerrit.server.change;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
-import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 
@@ -141,14 +140,7 @@ public class PatchSetInserter extends BatchUpdate.Op {
     this.revWalk = revWalk;
     this.commit = commit;
     this.ctl = ctl;
-    this.user = checkUser(ctl);
+    this.user = ctl.getUser().asIdentifiedUser();
-  }
-
-  private static IdentifiedUser checkUser(ChangeControl ctl) {
-    checkArgument(ctl.getUser().isIdentifiedUser(),
-        "only IdentifiedUser may create patch set on change %s",
-        ctl.getChange().getId());
-    return (IdentifiedUser) ctl.getUser();
   }
 
   public PatchSet.Id getPatchSetId() throws IOException {

gerrit-server/src/main/java/com/google/gerrit/server/change/PostReview.java

@@ -318,7 +318,7 @@ public class PostReview implements RestModifyView<RevisionResource, ReviewInput>
 
     @Override
     public void updateChange(ChangeContext ctx) throws OrmException {
-      user = (IdentifiedUser) ctx.getUser();
+      user = ctx.getUser().asIdentifiedUser();
       change = ctx.getChange();
       if (change.getLastUpdatedOn().before(ctx.getWhen())) {
         change.setLastUpdatedOn(ctx.getWhen());

gerrit-server/src/main/java/com/google/gerrit/server/change/PostReviewers.java

@@ -36,7 +36,6 @@ import com.google.gerrit.reviewdb.client.PatchSetApproval;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.ApprovalsUtil;
 import com.google.gerrit.server.ChangeUtil;
-import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AccountCache;
 import com.google.gerrit.server.account.AccountLoader;
@@ -84,7 +83,7 @@ public class PostReviewers implements RestModifyView<ChangeResource, AddReviewer
   private final AccountLoader.Factory accountLoaderFactory;
   private final Provider<ReviewDb> dbProvider;
   private final ChangeUpdate.Factory updateFactory;
-  private final Provider<CurrentUser> currentUser;
+  private final Provider<IdentifiedUser> user;
   private final IdentifiedUser.GenericFactory identifiedUserFactory;
   private final Config cfg;
   private final ChangeHooks hooks;
@@ -102,7 +101,7 @@ public class PostReviewers implements RestModifyView<ChangeResource, AddReviewer
       AccountLoader.Factory accountLoaderFactory,
       Provider<ReviewDb> db,
       ChangeUpdate.Factory updateFactory,
-      Provider<CurrentUser> currentUser,
+      Provider<IdentifiedUser> user,
       IdentifiedUser.GenericFactory identifiedUserFactory,
       @GerritServerConfig Config cfg,
       ChangeHooks hooks,
@@ -118,7 +117,7 @@ public class PostReviewers implements RestModifyView<ChangeResource, AddReviewer
     this.accountLoaderFactory = accountLoaderFactory;
     this.dbProvider = db;
     this.updateFactory = updateFactory;
-    this.currentUser = currentUser;
+    this.user = user;
     this.identifiedUserFactory = identifiedUserFactory;
     this.cfg = cfg;
     this.hooks = hooks;
@@ -275,16 +274,16 @@ public class PostReviewers implements RestModifyView<ChangeResource, AddReviewer
     //
     // The user knows they added themselves, don't bother emailing them.
     List<Account.Id> toMail = Lists.newArrayListWithCapacity(added.size());
-    IdentifiedUser identifiedUser = (IdentifiedUser) currentUser.get();
+    Account.Id userId = user.get().getAccountId();
     for (PatchSetApproval psa : added) {
-      if (!psa.getAccountId().equals(identifiedUser.getAccountId())) {
+      if (!psa.getAccountId().equals(userId)) {
         toMail.add(psa.getAccountId());
       }
     }
     if (!toMail.isEmpty()) {
       try {
         AddReviewerSender cm = addReviewerSenderFactory.create(change.getId());
-        cm.setFrom(identifiedUser.getAccountId());
+        cm.setFrom(userId);
         cm.addReviewers(toMail);
         cm.send();
       } catch (Exception err) {

gerrit-server/src/main/java/com/google/gerrit/server/change/PutTopic.java

@@ -97,7 +97,7 @@ public class PutTopic implements RestModifyView<ChangeResource, Input>,
 
     public Op(ChangeControl ctl, Input input) {
       this.input = input;
-      this.caller = (IdentifiedUser) ctl.getUser();
+      this.caller = ctl.getUser().asIdentifiedUser();
     }
 
     @Override

gerrit-server/src/main/java/com/google/gerrit/server/change/RebaseChange.java

@@ -120,7 +120,7 @@ public class RebaseChange {
           UpdateException, RestApiException {
     Change change = rsrc.getChange();
     PatchSet patchSet = rsrc.getPatchSet();
-    IdentifiedUser uploader = (IdentifiedUser) rsrc.getControl().getUser();
+    IdentifiedUser uploader = rsrc.getControl().getUser().asIdentifiedUser();
 
     try (ObjectInserter inserter = git.newObjectInserter()) {
       String baseRev = newBaseRev;

gerrit-server/src/main/java/com/google/gerrit/server/change/Restore.java

@@ -109,7 +109,7 @@ public class Restore implements RestModifyView<ChangeResource, RestoreInput>,
     @Override
     public void updateChange(ChangeContext ctx) throws OrmException,
         ResourceConflictException {
-      caller = (IdentifiedUser) ctx.getUser();
+      caller = ctx.getUser().asIdentifiedUser();
       change = ctx.getChange();
       if (change == null || change.getStatus() != Status.ABANDONED) {
         throw new ResourceConflictException("change is " + status(change));

gerrit-server/src/main/java/com/google/gerrit/server/change/RevisionResource.java

@@ -84,7 +84,7 @@ public class RevisionResource implements RestResource, HasETag {
   }
 
   IdentifiedUser getUser() {
-    return (IdentifiedUser) getControl().getUser();
+    return getControl().getUser().asIdentifiedUser();
   }
 
   RevisionResource doNotCache() {

gerrit-server/src/main/java/com/google/gerrit/server/change/SetHashtagsOp.java

@@ -25,7 +25,6 @@ import com.google.gerrit.extensions.registration.DynamicSet;
 import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.extensions.restapi.BadRequestException;
 import com.google.gerrit.reviewdb.client.Change;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.git.BatchUpdate;
 import com.google.gerrit.server.git.BatchUpdate.ChangeContext;
 import com.google.gerrit.server.git.BatchUpdate.Context;
@@ -118,9 +117,8 @@ public class SetHashtagsOp extends BatchUpdate.Op {
   @Override
   public void postUpdate(Context ctx) throws OrmException {
     if (updated() && runHooks) {
-      IdentifiedUser currentUser = (IdentifiedUser) ctx.getUser();
       hooks.doHashtagsChangedHook(
-          change, currentUser.getAccount(),
+          change, ctx.getUser().asIdentifiedUser().getAccount(),
           toAdd, toRemove, updatedHashtags,
           ctx.getDb());
     }

gerrit-server/src/main/java/com/google/gerrit/server/change/Submit.java

@@ -165,7 +165,7 @@ public class Submit implements RestModifyView<RevisionResource, SubmitInput>,
       rsrc = onBehalfOf(rsrc, input);
     }
     ChangeControl control = rsrc.getControl();
-    IdentifiedUser caller = (IdentifiedUser) control.getUser();
+    IdentifiedUser caller = control.getUser().asIdentifiedUser();
     Change change = rsrc.getChange();
     if (input.onBehalfOf == null && !control.canSubmit()) {
       throw new AuthException("submit not permitted");

gerrit-server/src/main/java/com/google/gerrit/server/config/ConfirmEmail.java

@@ -21,7 +21,6 @@ import com.google.gerrit.extensions.restapi.RestModifyView;
 import com.google.gerrit.extensions.restapi.UnprocessableEntityException;
 import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AccountException;
 import com.google.gerrit.server.account.AccountManager;
 import com.google.gerrit.server.config.ConfirmEmail.Input;
@@ -69,7 +68,7 @@ public class ConfirmEmail implements RestModifyView<ConfigResource, Input> {
 
     try {
       EmailTokenVerifier.ParsedToken token = emailTokenVerifier.decode(input.token);
-      Account.Id accId = ((IdentifiedUser)user).getAccountId();
+      Account.Id accId = user.getAccountId();
       if (accId.equals(token.getAccountId())) {
         accountManager.link(accId, token.toAuthRequest());
         return Response.none();

gerrit-server/src/main/java/com/google/gerrit/server/edit/ChangeEditModifier.java

@@ -123,7 +123,7 @@ public class ChangeEditModifier {
       throw new AuthException("Authentication required");
     }
 
-    IdentifiedUser me = (IdentifiedUser) currentUser.get();
+    IdentifiedUser me = currentUser.get().asIdentifiedUser();
     String refPrefix = RefNames.refsEditPrefix(me.getAccountId(), change.getId());
 
     try (Repository repo = gitManager.openRepository(change.getProject())) {
@@ -162,7 +162,7 @@ public class ChangeEditModifier {
     }
 
     Change change = edit.getChange();
-    IdentifiedUser me = (IdentifiedUser) currentUser.get();
+    IdentifiedUser me = currentUser.get().asIdentifiedUser();
     String refName = RefNames.refsEdit(me.getAccountId(), change.getId(),
         current.getId());
     try (Repository repo = gitManager.openRepository(change.getProject());
@@ -237,7 +237,7 @@ public class ChangeEditModifier {
       throw new UnchangedCommitMessageException();
     }
 
-    IdentifiedUser me = (IdentifiedUser) currentUser.get();
+    IdentifiedUser me = currentUser.get().asIdentifiedUser();
     Project.NameKey project = edit.getChange().getProject();
     try (Repository repo = gitManager.openRepository(project);
         RevWalk rw = new RevWalk(repo);
@@ -323,7 +323,7 @@ public class ChangeEditModifier {
     if (!currentUser.get().isIdentifiedUser()) {
       throw new AuthException("Authentication required");
     }
-    IdentifiedUser me = (IdentifiedUser) currentUser.get();
+    IdentifiedUser me = currentUser.get().asIdentifiedUser();
     Project.NameKey project = edit.getChange().getProject();
     try (Repository repo = gitManager.openRepository(project);
         RevWalk rw = new RevWalk(repo);

gerrit-server/src/main/java/com/google/gerrit/server/edit/ChangeEditUtil.java

@@ -109,7 +109,7 @@ public class ChangeEditUtil {
     if (!currentUser.isIdentifiedUser()) {
       throw new AuthException("Authentication required");
     }
-    return byChange(change, (IdentifiedUser)currentUser);
+    return byChange(change, currentUser.asIdentifiedUser());
   }
 
   /**

gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java

@@ -277,7 +277,7 @@ public class ReceiveCommits {
   private Set<Account.Id> reviewersFromCommandLine = Sets.newLinkedHashSet();
   private Set<Account.Id> ccFromCommandLine = Sets.newLinkedHashSet();
 
-  private final IdentifiedUser currentUser;
+  private final IdentifiedUser user;
   private final ReviewDb db;
   private final Provider<InternalChangeQuery> queryProvider;
   private final ChangeData.Factory changeDataFactory;
@@ -390,7 +390,7 @@ public class ReceiveCommits {
       final ChangeEditUtil editUtil,
       final BatchUpdate.Factory batchUpdateFactory,
       final SetHashtagsOp.Factory hashtagsFactory) throws IOException {
-    this.currentUser = (IdentifiedUser) projectControl.getUser();
+    this.user = projectControl.getUser().asIdentifiedUser();
     this.db = db;
     this.queryProvider = queryProvider;
     this.changeDataFactory = changeDataFactory;
@@ -606,7 +606,7 @@ public class ReceiveCommits {
       for (Error error : errors.keySet()) {
         rp.sendMessage(buildError(error, errors.get(error)));
       }
-      rp.sendMessage(String.format("User: %s", displayName(currentUser)));
+      rp.sendMessage(String.format("User: %s", displayName(user)));
       rp.sendMessage(COMMAND_REJECTION_MESSAGE_FOOTER);
     }
 
@@ -662,7 +662,7 @@ public class ReceiveCommits {
                 new Branch.NameKey(project.getNameKey(), c.getRefName()),
                 c.getOldId(),
                 c.getNewId(),
-                currentUser.getAccount());
+                user.getAccount());
           }
         }
     }
@@ -881,7 +881,7 @@ public class ReceiveCommits {
       }
 
       HookResult result = hooks.doRefUpdateHook(project, cmd.getRefName(),
-                              currentUser.getAccount(), cmd.getOldId(),
+                              user.getAccount(), cmd.getOldId(),
                               cmd.getNewId());
 
       if (result != null) {
@@ -952,7 +952,7 @@ public class ReceiveCommits {
                   addError("  " + err.getMessage());
                 }
                 reject(cmd, "invalid project configuration");
-                log.error("User " + currentUser.getUserName()
+                log.error("User " + user.getUserName()
                     + " tried to push invalid project configuration "
                     + cmd.getNewId().name() + " for " + project.getName());
                 continue;
@@ -967,7 +967,7 @@ public class ReceiveCommits {
                 }
               } else {
                 if (!oldParent.equals(newParent)
-                    && !currentUser.getCapabilities().canAdministrateServer()) {
+                    && !user.getCapabilities().canAdministrateServer()) {
                   reject(cmd, "invalid project configuration: only Gerrit admin can set parent");
                   continue;
                 }
@@ -1013,7 +1013,7 @@ public class ReceiveCommits {
               }
             } catch (Exception e) {
               reject(cmd, "invalid project configuration");
-              log.error("User " + currentUser.getUserName()
+              log.error("User " + user.getUserName()
                   + " tried to push invalid project configuration "
                   + cmd.getNewId().name() + " for " + project.getName(), e);
               continue;
@@ -1529,7 +1529,7 @@ public class ReceiveCommits {
       List<ChangeLookup> pending = Lists.newArrayList();
       final Set<Change.Key> newChangeIds = new HashSet<>();
       final int maxBatchChanges =
-          receiveConfig.getEffectiveMaxBatchChangesLimit(currentUser);
+          receiveConfig.getEffectiveMaxBatchChangesLimit(user);
       for (;;) {
         final RevCommit c = rp.getRevWalk().next();
         if (c == null) {
@@ -1723,7 +1723,7 @@ public class ReceiveCommits {
       commit = c;
       change = new Change(changeKey,
           new Change.Id(db.nextChangeId()),
-          currentUser.getAccountId(),
+          user.getAccountId(),
           magicBranch.dest,
           TimeUtil.nowTs());
       change.setTopic(magicBranch.topic);
@@ -1763,7 +1763,7 @@ public class ReceiveCommits {
     private void insertChange(ReviewDb threadLocalDb)
         throws OrmException, RestApiException, UpdateException {
       final PatchSet ps = ins.setGroups(groups).getPatchSet();
-      final Account.Id me = currentUser.getAccountId();
+      final Account.Id me = user.getAccountId();
       final List<FooterLine> footerLines = commit.getFooterLines();
       final MailRecipients recipients = new MailRecipients();
       Map<String, Short> approvals = new HashMap<>();
@@ -1777,7 +1777,7 @@ public class ReceiveCommits {
           approvals, Collections.<String, PatchSetApproval> emptyMap());
       try (ObjectInserter oi = repo.newObjectInserter();
           BatchUpdate bu = batchUpdateFactory.create(threadLocalDb,
-            change.getProject(), currentUser, change.getCreatedOn())) {
+            change.getProject(), user, change.getCreatedOn())) {
         bu.setRepository(repo, rp.getRevWalk(), oi);
         bu.insertChange(ins
             .setReviewers(recipients.getReviewers())
@@ -1809,7 +1809,7 @@ public class ReceiveCommits {
     RevisionResource rsrc = new RevisionResource(changes.parse(changeCtl), ps);
     try {
       mergeOpProvider.get().merge(db, rsrc.getChange(),
-          (IdentifiedUser) changeCtl.getUser(), false);
+          changeCtl.getUser().asIdentifiedUser(), false);
     } catch (NoSuchChangeException e) {
       throw new OrmException(e);
     }
@@ -2073,7 +2073,7 @@ public class ReceiveCommits {
       Optional<ChangeEdit> edit = null;
 
       try {
-        edit = editUtil.byChange(change, currentUser);
+        edit = editUtil.byChange(change, user);
       } catch (IOException e) {
         log.error("Cannt retrieve edit", e);
         return false;
@@ -2107,7 +2107,7 @@ public class ReceiveCommits {
           ObjectId.zeroId(),
           newCommit,
           RefNames.refsEdit(
-              currentUser.getAccountId(),
+              user.getAccountId(),
               change.getId(),
               newPatchSet.getId()));
     }
@@ -2117,7 +2117,7 @@ public class ReceiveCommits {
           ChangeUtil.nextPatchSetId(allRefs, change.currentPatchSetId());
       newPatchSet = new PatchSet(id);
       newPatchSet.setCreatedOn(TimeUtil.nowTs());
-      newPatchSet.setUploader(currentUser.getAccountId());
+      newPatchSet.setUploader(user.getAccountId());
       newPatchSet.setRevision(toRevId(newCommit));
       newPatchSet.setGroups(groups);
       if (rp.getPushCertificate() != null) {
@@ -2170,7 +2170,7 @@ public class ReceiveCommits {
         throws OrmException {
       msg =
           new ChangeMessage(new ChangeMessage.Key(change.getId(), ChangeUtil
-              .messageUUID(db)), currentUser.getAccountId(), newPatchSet.getCreatedOn(),
+              .messageUUID(db)), user.getAccountId(), newPatchSet.getCreatedOn(),
               newPatchSet.getId());
 
       msg.setMessage(renderMessageWithApprovals(newPatchSet.getPatchSetId(),
@@ -2199,7 +2199,7 @@ public class ReceiveCommits {
       // We optimize here and only retrieve current when approvals provided
       if (!approvals.isEmpty()) {
         for (PatchSetApproval a : approvalsUtil.byPatchSetUser(
-            db, changeCtl, priorPatchSet, currentUser.getAccountId())) {
+            db, changeCtl, priorPatchSet, user.getAccountId())) {
           if (a.isSubmit()) {
             continue;
           }
@@ -2222,7 +2222,7 @@ public class ReceiveCommits {
 
     PatchSet.Id insertPatchSet(ReviewDb db) throws OrmException, IOException,
         ResourceConflictException {
-      final Account.Id me = currentUser.getAccountId();
+      final Account.Id me = user.getAccountId();
       final List<FooterLine> footerLines = newCommit.getFooterLines();
       final MailRecipients recipients = new MailRecipients();
       Map<String, Short> approvals = new HashMap<>();
@@ -2374,11 +2374,11 @@ public class ReceiveCommits {
       hooks.doPatchsetCreatedHook(change, newPatchSet, db);
       if (mergedIntoRef != null) {
         hooks.doChangeMergedHook(
-            change, currentUser.getAccount(), newPatchSet, db, newCommit.getName());
+            change, user.getAccount(), newPatchSet, db, newCommit.getName());
       }
 
       if (!approvals.isEmpty()) {
-        hooks.doCommentAddedHook(change, currentUser.getAccount(), newPatchSet,
+        hooks.doCommentAddedHook(change, user.getAccount(), newPatchSet,
             null, approvals, db);
       }
 
@@ -2555,7 +2555,7 @@ public class ReceiveCommits {
       return;
     }
 
-    boolean defaultName = Strings.isNullOrEmpty(currentUser.getAccount().getFullName());
+    boolean defaultName = Strings.isNullOrEmpty(user.getAccount().getFullName());
     final RevWalk walk = rp.getRevWalk();
     walk.reset();
     walk.sort(RevSort.NONE);
@@ -2574,14 +2574,14 @@ public class ReceiveCommits {
           break;
         }
 
-        if (defaultName && currentUser.hasEmailAddress(
+        if (defaultName && user.hasEmailAddress(
               c.getCommitterIdent().getEmailAddress())) {
           try {
-            Account a = db.accounts().get(currentUser.getAccountId());
+            Account a = db.accounts().get(user.getAccountId());
             if (a != null && Strings.isNullOrEmpty(a.getFullName())) {
               a.setFullName(c.getCommitterIdent().getName());
               db.accounts().update(Collections.singleton(a));
-              currentUser.getAccount().setFullName(a.getFullName());
+              user.getAccount().setFullName(a.getFullName());
               accountCache.evict(a.getId());
             }
           } catch (OrmException e) {
@@ -2605,7 +2605,7 @@ public class ReceiveCommits {
     }
 
     CommitReceivedEvent receiveEvent =
-        new CommitReceivedEvent(cmd, project, ctl.getRefName(), c, currentUser);
+        new CommitReceivedEvent(cmd, project, ctl.getRefName(), c, user);
     CommitValidators commitValidators =
         commitValidatorsFactory.create(ctl, sshInfo, repo);
 
@@ -2713,7 +2713,7 @@ public class ReceiveCommits {
     result.mergedIntoRef = refName;
     markChangeMergedByPush(db, result, result.changeCtl);
     hooks.doChangeMergedHook(
-        change, currentUser.getAccount(), result.newPatchSet, db, commit.getName());
+        change, user.getAccount(), result.newPatchSet, db, commit.getName());
     sendMergedEmail(result);
     return change.getKey();
   }
@@ -2762,7 +2762,7 @@ public class ReceiveCommits {
       msgBuf.append(".");
       ChangeMessage msg = new ChangeMessage(
           new ChangeMessage.Key(id, ChangeUtil.messageUUID(db)),
-          currentUser.getAccountId(), change.getLastUpdatedOn(),
+          user.getAccountId(), change.getLastUpdatedOn(),
           result.info.getKey());
       msg.setMessage(msgBuf.toString());
 
@@ -2785,7 +2785,7 @@ public class ReceiveCommits {
       public void run() {
         try {
           final MergedSender cm = mergedSenderFactory.create(id);
-          cm.setFrom(currentUser.getAccountId());
+          cm.setFrom(user.getAccountId());
           cm.setPatchSet(result.newPatchSet, result.info);
           cm.send();
         } catch (Exception e) {

gerrit-server/src/main/java/com/google/gerrit/server/git/VisibleRefFilter.java

@@ -80,7 +80,7 @@ public class VisibleRefFilter extends AbstractAdvertiseRefsHook {
     Account.Id currAccountId;
     boolean canViewMetadata;
     if (projectCtl.getUser().isIdentifiedUser()) {
-      IdentifiedUser user = ((IdentifiedUser) projectCtl.getUser());
+      IdentifiedUser user = projectCtl.getUser().asIdentifiedUser();
       currAccountId = user.getAccountId();
       canViewMetadata = user.getCapabilities().canAccessDatabase();
     } else {

gerrit-server/src/main/java/com/google/gerrit/server/git/validators/CommitValidators.java

@@ -193,7 +193,7 @@ public class CommitValidators {
       this.canonicalWebUrl = canonicalWebUrl;
       this.installCommitMsgHookCommand = installCommitMsgHookCommand;
       this.sshInfo = sshInfo;
-      this.user = (IdentifiedUser) projectControl.getUser();
+      this.user = projectControl.getUser().asIdentifiedUser();
     }
 
     @Override
@@ -316,7 +316,7 @@ public class CommitValidators {
     @Override
     public List<CommitValidationMessage> onCommitReceived(
         CommitReceivedEvent receiveEvent) throws CommitValidationException {
-      IdentifiedUser currentUser = (IdentifiedUser) refControl.getUser();
+      IdentifiedUser currentUser = refControl.getUser().asIdentifiedUser();
 
       if (REFS_CONFIG.equals(refControl.getRefName())) {
         List<CommitValidationMessage> messages = new LinkedList<>();
@@ -402,7 +402,7 @@ public class CommitValidators {
     @Override
     public List<CommitValidationMessage> onCommitReceived(
         CommitReceivedEvent receiveEvent) throws CommitValidationException {
-      IdentifiedUser currentUser = (IdentifiedUser) refControl.getUser();
+      IdentifiedUser currentUser = refControl.getUser().asIdentifiedUser();
       final PersonIdent committer = receiveEvent.commit.getCommitterIdent();
       final PersonIdent author = receiveEvent.commit.getAuthorIdent();
       final ProjectControl projectControl = refControl.getProjectControl();
@@ -445,7 +445,7 @@ public class CommitValidators {
     @Override
     public List<CommitValidationMessage> onCommitReceived(
         CommitReceivedEvent receiveEvent) throws CommitValidationException {
-      IdentifiedUser currentUser = (IdentifiedUser) refControl.getUser();
+      IdentifiedUser currentUser = refControl.getUser().asIdentifiedUser();
       final PersonIdent author = receiveEvent.commit.getAuthorIdent();
 
       if (!currentUser.hasEmailAddress(author.getEmailAddress())
@@ -475,7 +475,7 @@ public class CommitValidators {
     @Override
     public List<CommitValidationMessage> onCommitReceived(
         CommitReceivedEvent receiveEvent) throws CommitValidationException {
-      IdentifiedUser currentUser = (IdentifiedUser) refControl.getUser();
+      IdentifiedUser currentUser = refControl.getUser().asIdentifiedUser();
       final PersonIdent committer = receiveEvent.commit.getCommitterIdent();
       if (!currentUser.hasEmailAddress(committer.getEmailAddress())
           && !refControl.canForgeCommitter()) {
@@ -561,7 +561,7 @@ public class CommitValidators {
         CommitReceivedEvent receiveEvent) throws CommitValidationException {
 
       if (refControl.getUser().isIdentifiedUser()) {
-        IdentifiedUser user = (IdentifiedUser) refControl.getUser();
+        IdentifiedUser user = refControl.getUser().asIdentifiedUser();
 
         String refname = receiveEvent.refName;
         ObjectId old = receiveEvent.commit.getParent(0);

gerrit-server/src/main/java/com/google/gerrit/server/group/AddIncludedGroups.java

@@ -31,7 +31,6 @@ import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.AccountGroupById;
 import com.google.gerrit.reviewdb.server.ReviewDb;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.GroupControl;
 import com.google.gerrit.server.account.GroupIncludeCache;
 import com.google.gerrit.server.group.AddIncludedGroups.Input;
@@ -101,7 +100,7 @@ public class AddIncludedGroups implements RestModifyView<GroupResource, Input> {
     GroupControl control = resource.getControl();
     Map<AccountGroup.UUID, AccountGroupById> newIncludedGroups = Maps.newHashMap();
     List<GroupInfo> result = Lists.newLinkedList();
-    Account.Id me = ((IdentifiedUser) control.getUser()).getAccountId();
+    Account.Id me = control.getUser().getAccountId();
 
     for (String includedGroup : input.groups) {
       GroupDescription.Basic d = groupsCollection.parse(includedGroup);

gerrit-server/src/main/java/com/google/gerrit/server/group/DeleteIncludedGroups.java

@@ -29,7 +29,6 @@ import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.AccountGroupById;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.GroupControl;
 import com.google.gerrit.server.account.GroupIncludeCache;
 import com.google.gerrit.server.group.AddIncludedGroups.Input;
@@ -110,7 +109,7 @@ public class DeleteIncludedGroups implements RestModifyView<GroupResource, Input
   }
 
   private void writeAudits(final List<AccountGroupById> toRemoved) {
-    final Account.Id me = ((IdentifiedUser) self.get()).getAccountId();
+    final Account.Id me = self.get().getAccountId();
     auditService.dispatchDeleteGroupsFromGroup(me, toRemoved);
   }
 

gerrit-server/src/main/java/com/google/gerrit/server/group/DeleteMembers.java

@@ -27,7 +27,6 @@ import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.AccountGroupMember;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.account.AccountCache;
 import com.google.gerrit.server.account.AccountsCollection;
 import com.google.gerrit.server.account.GroupControl;
@@ -97,7 +96,7 @@ public class DeleteMembers implements RestModifyView<GroupResource, Input> {
   }
 
   private void writeAudits(final List<AccountGroupMember> toRemove) {
-    final Account.Id me = ((IdentifiedUser) self.get()).getAccountId();
+    final Account.Id me = self.get().getAccountId();
     auditService.dispatchDeleteAccountsFromGroup(me, toRemove);
   }
 

gerrit-server/src/main/java/com/google/gerrit/server/notedb/AbstractChangeUpdate.java

@@ -78,7 +78,7 @@ public abstract class AbstractChangeUpdate extends VersionedMetaData {
   }
 
   public IdentifiedUser getUser() {
-    return (IdentifiedUser) ctl.getUser();
+    return ctl.getUser().asIdentifiedUser();
   }
 
   public PatchSet.Id getPatchSetId() {

gerrit-server/src/main/java/com/google/gerrit/server/notedb/ChangeDraftUpdate.java

@@ -95,7 +95,7 @@ public class ChangeDraftUpdate extends AbstractChangeUpdate {
     this.commentsUtil = commentsUtil;
     checkState(ctl.getUser().isIdentifiedUser(),
         "Current user must be identified");
-    IdentifiedUser user = (IdentifiedUser) ctl.getUser();
+    IdentifiedUser user = ctl.getUser().asIdentifiedUser();
     this.accountId = user.getAccountId();
     this.changeNotes = getChangeNotes().load();
     this.draftNotes = draftNotesFactory.create(ctl.getChange().getId(),

gerrit-server/src/main/java/com/google/gerrit/server/patch/PatchScriptFactory.java

@@ -30,7 +30,6 @@ import com.google.gerrit.reviewdb.client.PatchSet;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.PatchLineCommentsUtil;
 import com.google.gerrit.server.account.AccountInfoCacheFactory;
 import com.google.gerrit.server.edit.ChangeEdit;
@@ -316,7 +315,7 @@ public class PatchScriptFactory implements Callable<PatchScript> {
 
       final CurrentUser user = control.getUser();
       if (user.isIdentifiedUser()) {
-        final Account.Id me = ((IdentifiedUser) user).getAccountId();
+        final Account.Id me = user.getAccountId();
         switch (changeType) {
           case ADDED:
           case MODIFIED:

gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java

@@ -27,7 +27,6 @@ import com.google.gerrit.reviewdb.client.PatchSetApproval;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.notedb.ChangeNotes;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gwtorm.server.OrmException;
@@ -253,8 +252,8 @@ public class ChangeControl {
   /** Is this user the owner of the change? */
   public boolean isOwner() {
     if (getUser().isIdentifiedUser()) {
-      final IdentifiedUser i = (IdentifiedUser) getUser();
+      Account.Id id = getUser().asIdentifiedUser().getAccountId();
-      return i.getAccountId().equals(getChange().getOwner());
+      return id.equals(getChange().getOwner());
     }
     return false;
   }
@@ -269,8 +268,7 @@ public class ChangeControl {
       throws OrmException {
     if (getUser().isIdentifiedUser()) {
       Collection<Account.Id> results = changeData(db, cd).reviewers().values();
-      IdentifiedUser user = (IdentifiedUser) getUser();
+      return results.contains(getUser().getAccountId());
-      return results.contains(user.getAccountId());
     }
     return false;
   }
@@ -285,8 +283,7 @@ public class ChangeControl {
       // A user can always remove themselves.
       //
       if (getUser().isIdentifiedUser()) {
-        final IdentifiedUser i = (IdentifiedUser) getUser();
+        if (getUser().getAccountId().equals(reviewer)) {
-        if (i.getAccountId().equals(reviewer)) {
           return true; // can remove self
         }
       }

gerrit-server/src/main/java/com/google/gerrit/server/project/ProjectControl.java

@@ -211,7 +211,7 @@ public class ProjectControl {
         public List<String> get() {
           List<String> r;
           if (user.isIdentifiedUser()) {
-            Set<String> emails = ((IdentifiedUser) user).getEmailAddresses();
+            Set<String> emails = user.asIdentifiedUser().getEmailAddresses();
             r = new ArrayList<>(emails.size() + 1);
             r.addAll(emails);
           } else {
@@ -349,7 +349,7 @@ public class ProjectControl {
     if (! (user.isIdentifiedUser())) {
       return new Capable("Must be logged in to verify Contributor Agreement");
     }
-    final IdentifiedUser iUser = (IdentifiedUser) user;
+    final IdentifiedUser iUser = user.asIdentifiedUser();
 
     List<AccountGroup.UUID> okGroupIds = Lists.newArrayList();
     for (ContributorAgreement ca : contributorAgreements) {

gerrit-server/src/main/java/com/google/gerrit/server/project/PutConfig.java

@@ -32,7 +32,6 @@ import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.EnableSignedPush;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.AllProjectsNameProvider;
 import com.google.gerrit.server.config.PluginConfig;
 import com.google.gerrit.server.config.PluginConfigFactory;
@@ -87,7 +86,7 @@ public class PutConfig implements RestModifyView<ProjectResource, Input> {
   private final PluginConfigFactory cfgFactory;
   private final AllProjectsNameProvider allProjects;
   private final DynamicMap<RestView<ProjectResource>> views;
-  private final Provider<CurrentUser> currentUser;
+  private final Provider<CurrentUser> user;
   private final ChangeHooks hooks;
 
   @Inject
@@ -102,7 +101,7 @@ public class PutConfig implements RestModifyView<ProjectResource, Input> {
       AllProjectsNameProvider allProjects,
       DynamicMap<RestView<ProjectResource>> views,
       ChangeHooks hooks,
-      Provider<CurrentUser> currentUser) {
+      Provider<CurrentUser> user) {
     this.serverEnableSignedPush = serverEnableSignedPush;
     this.metaDataUpdateFactory = metaDataUpdateFactory;
     this.projectCache = projectCache;
@@ -114,7 +113,7 @@ public class PutConfig implements RestModifyView<ProjectResource, Input> {
     this.allProjects = allProjects;
     this.views = views;
     this.hooks = hooks;
-    this.currentUser = currentUser;
+    this.user = user;
   }
 
   @Override
@@ -194,10 +193,9 @@ public class PutConfig implements RestModifyView<ProjectResource, Input> {
         ObjectId commitRev = projectConfig.commit(md);
         // Only fire hook if project was actually changed.
         if (!Objects.equals(baseRev, commitRev)) {
-          IdentifiedUser user = (IdentifiedUser) currentUser.get();
           hooks.doRefUpdatedHook(
             new Branch.NameKey(projectName, RefNames.REFS_CONFIG),
-            baseRev, commitRev, user.getAccount());
+            baseRev, commitRev, user.get().asIdentifiedUser().getAccount());
         }
         projectCache.evict(projectConfig.getProject());
         gitMgr.setProjectDescription(projectName, p.getDescription());
@@ -214,7 +212,7 @@ public class PutConfig implements RestModifyView<ProjectResource, Input> {
 
       ProjectState state = projectStateFactory.create(projectConfig);
       return new ConfigInfo(serverEnableSignedPush,
-          state.controlFor(currentUser.get()), config, pluginConfigEntries,
+          state.controlFor(user.get()), config, pluginConfigEntries,
           cfgFactory, allProjects, views);
     } catch (ConfigInvalidException err) {
       throw new ResourceConflictException("Cannot read project " + projectName, err);

gerrit-server/src/main/java/com/google/gerrit/server/project/PutDescription.java

@@ -67,7 +67,7 @@ public class PutDescription implements RestModifyView<ProjectResource, PutDescri
     }
 
     ProjectControl ctl = resource.getControl();
-    IdentifiedUser user = (IdentifiedUser) ctl.getUser();
+    IdentifiedUser user = ctl.getUser().asIdentifiedUser();
     if (!ctl.isOwner()) {
       throw new AuthException("not project owner");
     }

gerrit-server/src/main/java/com/google/gerrit/server/project/RefControl.java

@@ -26,7 +26,6 @@ import com.google.gerrit.extensions.client.ProjectState;
 import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.group.SystemGroupBackend;
 
 import dk.brics.automaton.RegExp;
@@ -303,9 +302,8 @@ public class RefControl {
       if (tagger != null) {
         boolean valid;
         if (getUser().isIdentifiedUser()) {
-          final IdentifiedUser user = (IdentifiedUser) getUser();
           final String addr = tagger.getEmailAddress();
-          valid = user.hasEmailAddress(addr);
+          valid = getUser().asIdentifiedUser().hasEmailAddress(addr);
         } else {
           valid = false;
         }

gerrit-server/src/main/java/com/google/gerrit/server/project/SetDefaultDashboard.java

@@ -24,7 +24,6 @@ import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestModifyView;
 import com.google.gerrit.reviewdb.client.Project;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.git.MetaDataUpdate;
 import com.google.gerrit.server.git.ProjectConfig;
 import com.google.gerrit.server.project.DashboardsCollection.DashboardInfo;
@@ -68,7 +67,6 @@ class SetDefaultDashboard implements RestModifyView<DashboardResource, Input> {
     input.id = Strings.emptyToNull(input.id);
 
     ProjectControl ctl = resource.getControl();
-    IdentifiedUser user = (IdentifiedUser) ctl.getUser();
     if (!ctl.isOwner()) {
       throw new AuthException("not project owner");
     }
@@ -105,7 +103,7 @@ class SetDefaultDashboard implements RestModifyView<DashboardResource, Input> {
         if (!msg.endsWith("\n")) {
           msg += "\n";
         }
-        md.setAuthor(user);
+        md.setAuthor(ctl.getUser().asIdentifiedUser());
         md.setMessage(msg);
         config.commit(md);
         cache.evict(ctl.getProject());

gerrit-server/src/main/java/com/google/gerrit/server/project/SetParent.java

@@ -71,7 +71,6 @@ public class SetParent implements RestModifyView<ProjectResource, Input> {
       ResourceNotFoundException, UnprocessableEntityException, IOException {
     ProjectControl ctl = rsrc.getControl();
     validateParentUpdate(ctl, input.parent, checkIfAdmin);
-    IdentifiedUser user = (IdentifiedUser) ctl.getUser();
     try {
       MetaDataUpdate md = updateFactory.create(rsrc.getNameKey());
       try {
@@ -88,7 +87,7 @@ public class SetParent implements RestModifyView<ProjectResource, Input> {
         } else if (!msg.endsWith("\n")) {
           msg += "\n";
         }
-        md.setAuthor(user);
+        md.setAuthor(ctl.getUser().asIdentifiedUser());
         md.setMessage(msg);
         config.commit(md);
         cache.evict(ctl.getProject());
@@ -109,7 +108,7 @@ public class SetParent implements RestModifyView<ProjectResource, Input> {
   public void validateParentUpdate(final ProjectControl ctl, String newParent,
       boolean checkIfAdmin) throws AuthException, ResourceConflictException,
       UnprocessableEntityException {
-    IdentifiedUser user = (IdentifiedUser) ctl.getUser();
+    IdentifiedUser user = ctl.getUser().asIdentifiedUser();
     if (checkIfAdmin && !user.getCapabilities().canAdministrateServer()) {
       throw new AuthException("not administrator");
     }

gerrit-server/src/main/java/com/google/gerrit/server/query/change/ChangeQueryBuilder.java

@@ -263,8 +263,7 @@ public class ChangeQueryBuilder extends QueryBuilder<ChangeData> {
     Arguments asUser(Account.Id otherId) {
       try {
         CurrentUser u = self.get();
-        if (u.isIdentifiedUser()
+        if (u.isIdentifiedUser() && otherId.equals(u.getAccountId())) {
-            && otherId.equals(((IdentifiedUser) u).getAccountId())) {
           return this;
         }
       } catch (ProvisionException e) {
@@ -277,7 +276,7 @@ public class ChangeQueryBuilder extends QueryBuilder<ChangeData> {
       try {
         CurrentUser u = getUser();
         if (u.isIdentifiedUser()) {
-          return (IdentifiedUser) u;
+          return u.asIdentifiedUser();
         }
         throw new QueryParseException(NotSignedInException.MESSAGE);
       } catch (ProvisionException e) {
@@ -612,11 +611,7 @@ public class ChangeQueryBuilder extends QueryBuilder<ChangeData> {
     Account.Id callerId;
     try {
       CurrentUser caller = args.self.get();
-      if (caller.isIdentifiedUser()) {
+      callerId = caller.isIdentifiedUser() ? caller.getAccountId() : null;
-        callerId = ((IdentifiedUser) caller).getAccountId();
-      } else {
-        callerId = null;
-      }
     } catch (ProvisionException e) {
       callerId = null;
     }

gerrit-server/src/main/java/com/google/gerrit/server/query/change/IsStarredByPredicate.java

@@ -33,7 +33,7 @@ class IsStarredByPredicate extends OrPredicate<ChangeData> implements
     ChangeDataSource {
   private static String describe(CurrentUser user) {
     if (user.isIdentifiedUser()) {
-      return ((IdentifiedUser) user).getAccountId().toString();
+      return user.getAccountId().toString();
     }
     return user.toString();
   }

gerrit-server/src/main/java/com/google/gerrit/server/query/change/IsVisibleToPredicate.java

@@ -17,7 +17,6 @@ package com.google.gerrit.server.query.change;
 import com.google.gerrit.reviewdb.client.Change;
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.project.ChangeControl;
 import com.google.gerrit.server.project.NoSuchChangeException;
 import com.google.gerrit.server.query.OperatorPredicate;
@@ -27,7 +26,7 @@ import com.google.inject.Provider;
 class IsVisibleToPredicate extends OperatorPredicate<ChangeData> {
   private static String describe(CurrentUser user) {
     if (user.isIdentifiedUser()) {
-      return ((IdentifiedUser) user).getAccountId().toString();
+      return user.getAccountId().toString();
     }
     if (user instanceof SingleGroupUser) {
       return "group:" + user.getEffectiveGroups().getKnownGroups() //

gerrit-server/src/main/java/com/google/gerrit/server/query/change/IsWatchedByPredicate.java

@@ -18,7 +18,6 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Lists;
 import com.google.gerrit.reviewdb.client.AccountProjectWatch;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.query.AndPredicate;
 import com.google.gerrit.server.query.Predicate;
 import com.google.gerrit.server.query.QueryBuilder;
@@ -29,7 +28,7 @@ import java.util.List;
 class IsWatchedByPredicate extends AndPredicate<ChangeData> {
   private static String describe(CurrentUser user) {
     if (user.isIdentifiedUser()) {
-      return ((IdentifiedUser) user).getAccountId().toString();
+      return user.getAccountId().toString();
     }
     return user.toString();
   }

gerrit-server/src/main/java/com/google/gerrit/server/query/change/QueryChanges.java

@@ -127,7 +127,7 @@ public class QueryChanges implements RestReadView<TopLevelResource> {
     IdentifiedUser self = null;
     try {
       if (user.get().isIdentifiedUser()) {
-        self = (IdentifiedUser) user.get();
+        self = user.get().asIdentifiedUser();
         self.asyncStarredChanges();
       }
       return query0();

gerrit-server/src/main/java/com/google/gerrit/server/util/ThreadLocalRequestContext.java

@@ -59,7 +59,7 @@ public class ThreadLocalRequestContext {
       @Provides
       IdentifiedUser provideCurrentUser(CurrentUser user) {
         if (user.isIdentifiedUser()) {
-          return (IdentifiedUser) user;
+          return user.asIdentifiedUser();
         }
         throw new ProvisionException(NotSignedInException.MESSAGE,
             new NotSignedInException());

gerrit-server/src/main/java/gerrit/PRED_current_user_1.java

@@ -18,7 +18,6 @@ import com.google.gerrit.reviewdb.client.Account;
 import com.google.gerrit.rules.StoredValues;
 import com.google.gerrit.server.AnonymousUser;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.PeerDaemonUser;
 
 import com.googlecode.prolog_cafe.exceptions.EvaluationException;
@@ -54,7 +53,7 @@ public class PRED_current_user_1 extends Predicate.P1 {
     Term resultTerm;
 
     if (curUser.isIdentifiedUser()) {
-      Account.Id id = ((IdentifiedUser)curUser).getAccountId();
+      Account.Id id = curUser.getAccountId();
       resultTerm = new IntegerTerm(id.get());
     } else if (curUser instanceof AnonymousUser) {
       resultTerm = anonymous;

gerrit-sshd/src/main/java/com/google/gerrit/sshd/BaseCommand.java

@@ -89,7 +89,7 @@ public abstract class BaseCommand implements Command {
   private WorkQueue.Executor executor;
 
   @Inject
-  private Provider<CurrentUser> userProvider;
+  private Provider<CurrentUser> user;
 
   @Inject
   private Provider<SshScope.Context> contextProvider;
@@ -278,7 +278,7 @@ public abstract class BaseCommand implements Command {
     final TaskThunk tt = new TaskThunk(thunk);
 
     if (isAdminHighPriorityCommand()
-        && userProvider.get().getCapabilities().canAdministrateServer()) {
+        && user.get().getCapabilities().canAdministrateServer()) {
       // Admin commands should not block the main work threads (there
       // might be an interactive shell there), nor should they wait
       // for the main work threads.
@@ -332,8 +332,8 @@ public abstract class BaseCommand implements Command {
     if (!(e instanceof UnloggedFailure)) {
       final StringBuilder m = new StringBuilder();
       m.append("Internal server error");
-      if (userProvider.get().isIdentifiedUser()) {
+      if (user.get().isIdentifiedUser()) {
-        final IdentifiedUser u = (IdentifiedUser) userProvider.get();
+        final IdentifiedUser u = user.get().asIdentifiedUser();
         m.append(" (user ");
         m.append(u.getAccount().getUserName());
         m.append(" account ");
@@ -398,8 +398,8 @@ public abstract class BaseCommand implements Command {
 
       StringBuilder m = new StringBuilder();
       m.append(context.getCommandLine());
-      if (userProvider.get().isIdentifiedUser()) {
+      if (user.get().isIdentifiedUser()) {
-        IdentifiedUser u = (IdentifiedUser) userProvider.get();
+        IdentifiedUser u = user.get().asIdentifiedUser();
         m.append(" (").append(u.getAccount().getUserName()).append(")");
       }
       this.taskName = m.toString();

gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshLog.java

@@ -224,7 +224,7 @@ class SshLog implements LifecycleListener {
     String accountId = "-";
 
     if (user != null && user.isIdentifiedUser()) {
-      IdentifiedUser u = (IdentifiedUser) user;
+      IdentifiedUser u = user.asIdentifiedUser();
       userName = u.getAccount().getUserName();
       accountId = "a/" + u.getAccountId().toString();
 

gerrit-sshd/src/main/java/com/google/gerrit/sshd/SshScope.java

@@ -81,9 +81,9 @@ public class SshScope {
 
     @Override
     public CurrentUser getUser() {
-      final CurrentUser user = session.getUser();
+      CurrentUser user = session.getUser();
       if (user != null && user.isIdentifiedUser()) {
-        IdentifiedUser identifiedUser = userFactory.create(((IdentifiedUser) user).getAccountId());
+        IdentifiedUser identifiedUser = userFactory.create(user.getAccountId());
         identifiedUser.setAccessPath(user.getAccessPath());
         return identifiedUser;
       }

gerrit-sshd/src/main/java/com/google/gerrit/sshd/commands/ShowConnections.java

@@ -181,7 +181,7 @@ final class ShowConnections extends SshCommand {
 
     final CurrentUser user = sd.getUser();
     if (user != null && user.isIdentifiedUser()) {
-      IdentifiedUser u = (IdentifiedUser) user;
+      IdentifiedUser u = user.asIdentifiedUser();
 
       if (!numeric) {
         String name = u.getAccount().getUserName();