Implement Private Changes

Private changes are only visible to owner, reviewers and users with the
configured permission. This lets users stage changes without
advertising their change, and conduct sensitive reviews (eg. security)
mong a small group.

- Add Private field to change in ReviewDb
- Check visibility for private changes
- Add permission that allows users to see all private changes
- Add Private Footer to NoteDb
- Add field for private changes to index and QueryBuilder
- Add REST endpoints to Mark/Unmark private change
- VisibleRefsFilter filters private changes
- GWT UI: Mark/Unmark change as private and show private label
- GWT UI: Show 'status (Private)' in ChangeTable.
- Support to control privacy of a change on push
- Add tests for reviewer visibility and new permission
- Add tests for query by private
- Add tests for advertised references
- Add user documentation in intro-user

  To push a private change or to turn a change private on push the
  'private' option can be specified:

    git push host HEAD:refs/for/master%private

  Removing the privacy flag should not happen accidentally, but should be
  a very explicit action. This is why omitting the 'private' option when
  pushing updates to a private change doesn't remove the privacy flag on
  the change. To remove the privacy flag from a change on push the
  'remove-private' option can be used:

    git push host HEAD:refs/for/master%remove-private

Change-Id: Ib2b26ea19c0286cff9c05754b0875f61e5e9fceb
Signed-off-by: Edwin Kempin <ekempin@google.com>
Signed-off-by: Han-Wen Nienhuys <hanwen@google.com>
Signed-off-by: Patrick Hiesel <hiesel@google.com>
Signed-off-by: Changcheng Xiao <xchangcheng@google.com>
Signed-off-by: Alice Kober-Sotzek <aliceks@google.com>

gerrit-server/src/main/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java

@@ -51,6 +51,7 @@ import com.google.gerrit.server.change.Check;
 import com.google.gerrit.server.change.CreateMergePatchSet;
 import com.google.gerrit.server.change.DeleteAssignee;
 import com.google.gerrit.server.change.DeleteChange;
+import com.google.gerrit.server.change.DeletePrivate;
 import com.google.gerrit.server.change.GetAssignee;
 import com.google.gerrit.server.change.GetHashtags;
 import com.google.gerrit.server.change.GetPastAssignees;
@@ -64,6 +65,7 @@ import com.google.gerrit.server.change.PostHashtags;
 import com.google.gerrit.server.change.PostReviewers;
 import com.google.gerrit.server.change.PublishDraftPatchSet;
 import com.google.gerrit.server.change.PutAssignee;
+import com.google.gerrit.server.change.PutPrivate;
 import com.google.gerrit.server.change.PutTopic;
 import com.google.gerrit.server.change.Rebase;
 import com.google.gerrit.server.change.Restore;
@@ -122,6 +124,8 @@ class ChangeApiImpl implements ChangeApi {
   private final Check check;
   private final Index index;
   private final Move move;
+  private final PutPrivate putPrivate;
+  private final DeletePrivate deletePrivate;
 
   @Inject
   ChangeApiImpl(
@@ -157,6 +161,8 @@ class ChangeApiImpl implements ChangeApi {
       Check check,
       Index index,
       Move move,
+      PutPrivate putPrivate,
+      DeletePrivate deletePrivate,
       @Assisted ChangeResource change) {
     this.changeApi = changeApi;
     this.revert = revert;
@@ -190,6 +196,8 @@ class ChangeApiImpl implements ChangeApi {
     this.check = check;
     this.index = index;
     this.move = move;
+    this.putPrivate = putPrivate;
+    this.deletePrivate = deletePrivate;
     this.change = change;
   }
 
@@ -270,6 +278,19 @@ class ChangeApiImpl implements ChangeApi {
     }
   }
 
+  @Override
+  public void setPrivate(boolean value) throws RestApiException {
+    try {
+      if (value) {
+        putPrivate.apply(change, null);
+      } else {
+        deletePrivate.apply(change, null);
+      }
+    } catch (UpdateException e) {
+      throw new RestApiException("Cannot change private status", e);
+    }
+  }
+
   @Override
   public ChangeApi revert() throws RestApiException {
     return revert(new RevertInput());