gwtui: remove HTTP password GET calls.

With the move to NoteDB, the per-account data (including the HTTP
password) will be stored in a user-branch in the All-Users repo, where
it is subject to Gerrit ACLs.  Since these are notoriously hard to
setup correctly, we want to avoid storing the password in plaintext.

The simplest solution is to store the password in hashed form, which
precludes showing the current passwords in the settings UI.

This change removes the password GET call from the GWT UI, and the
clear button. To revoke an existing password, the user must simply
generate a new password.

Tested:
  Manual test.

Change-Id: Ia832d5a27dd48ef17398aba6b405a7db2b8533ec

gerrit-gwtui/src/main/java/com/google/gerrit/client/account/AccountApi.java

@@ -174,11 +174,6 @@ public class AccountApi {
     group.done();
   }
 
-  /** Retrieve the HTTP password */
-  public static void getHttpPassword(String account, AsyncCallback<NativeString> cb) {
-    new RestApi("/accounts/").id(account).view("password.http").get(cb);
-  }
-
   /** Generate a new HTTP password */
   public static void generateHttpPassword(String account, AsyncCallback<NativeString> cb) {
     HttpPasswordInput in = HttpPasswordInput.create();
@@ -186,11 +181,6 @@ public class AccountApi {
     new RestApi("/accounts/").id(account).view("password.http").put(in, cb);
   }
 
-  /** Clear HTTP password */
-  public static void clearHttpPassword(String account, AsyncCallback<VoidResult> cb) {
-    new RestApi("/accounts/").id(account).view("password.http").delete(cb);
-  }
-
   /** Enter a contributor agreement */
   public static void enterAgreement(String account, String name, AsyncCallback<NativeString> cb) {
     AgreementInput in = AgreementInput.create();

gerrit-gwtui/src/main/java/com/google/gerrit/client/account/MyPasswordScreen.java

@@ -16,12 +16,10 @@ package com.google.gerrit.client.account;
 
 import com.google.gerrit.client.Gerrit;
 import com.google.gerrit.client.GerritUiExtensionPoint;
-import com.google.gerrit.client.VoidResult;
 import com.google.gerrit.client.api.ExtensionPanel;
 import com.google.gerrit.client.rpc.GerritCallback;
 import com.google.gerrit.client.rpc.NativeString;
 import com.google.gerrit.client.rpc.RestApi;
-import com.google.gerrit.client.rpc.ScreenLoadCallback;
 import com.google.gwt.event.dom.client.ClickEvent;
 import com.google.gwt.event.dom.client.ClickHandler;
 import com.google.gwt.i18n.client.LocaleInfo;
@@ -36,7 +34,6 @@ import com.google.gwtexpui.clippy.client.CopyableLabel;
 public class MyPasswordScreen extends SettingsScreen {
   private CopyableLabel password;
   private Button generatePassword;
-  private Button clearPassword;
 
   @Override
   protected void onInitUI() {
@@ -52,7 +49,7 @@ public class MyPasswordScreen extends SettingsScreen {
       return;
     }
 
-    password = new CopyableLabel("");
+    password = new CopyableLabel("(click 'generate' to revoke an old password)");
     password.addStyleName(Gerrit.RESOURCES.css().accountPassword());
 
     generatePassword = new Button(Util.C.buttonGeneratePassword());
@@ -64,15 +61,6 @@ public class MyPasswordScreen extends SettingsScreen {
           }
         });
 
-    clearPassword = new Button(Util.C.buttonClearPassword());
-    clearPassword.addClickHandler(
-        new ClickHandler() {
-          @Override
-          public void onClick(ClickEvent event) {
-            doClearPassword();
-          }
-        });
-
     final Grid userInfo = new Grid(2, 2);
     final CellFormatter fmt = userInfo.getCellFormatter();
     userInfo.setStyleName(Gerrit.RESOURCES.css().infoBlock());
@@ -88,7 +76,6 @@ public class MyPasswordScreen extends SettingsScreen {
 
     final FlowPanel buttons = new FlowPanel();
     buttons.add(generatePassword);
-    buttons.add(clearPassword);
     add(buttons);
   }
 
@@ -112,7 +99,8 @@ public class MyPasswordScreen extends SettingsScreen {
           @Override
           public void onSuccess(NativeString user) {
             Gerrit.getUserAccount().username(user.asString());
-            refreshHttpPassword();
+            enableUI(true);
+            display();
           }
 
           @Override
@@ -127,27 +115,6 @@ public class MyPasswordScreen extends SettingsScreen {
         });
   }
 
-  private void refreshHttpPassword() {
-    AccountApi.getHttpPassword(
-        "self",
-        new ScreenLoadCallback<NativeString>(this) {
-          @Override
-          protected void preDisplay(NativeString httpPassword) {
-            display(httpPassword.asString());
-          }
-
-          @Override
-          public void onFailure(final Throwable caught) {
-            if (RestApi.isNotFound(caught)) {
-              display(null);
-              display();
-            } else {
-              super.onFailure(caught);
-            }
-          }
-        });
-  }
-
   private void display(String pass) {
     password.setText(pass != null ? pass : "");
     password.setVisible(pass != null);
@@ -186,29 +153,9 @@ public class MyPasswordScreen extends SettingsScreen {
     }
   }
 
-  private void doClearPassword() {
-    if (Gerrit.getUserAccount().username() != null) {
-      enableUI(false);
-      AccountApi.clearHttpPassword(
-          "self",
-          new GerritCallback<VoidResult>() {
-            @Override
-            public void onSuccess(VoidResult result) {
-              display(null);
-            }
-
-            @Override
-            public void onFailure(final Throwable caught) {
-              enableUI(true);
-            }
-          });
-    }
-  }
-
   private void enableUI(boolean on) {
     on &= Gerrit.getUserAccount().username() != null;
 
     generatePassword.setEnabled(on);
-    clearPassword.setVisible(on && !"".equals(password.getText()));
   }
 }