Add basic support for editing project policies

Summary:
This case is unusually complicated because there are more rules than most objects will have.

  - Edits are either "joins", "leaves" or "other edits".
  - "Joins" require "can join" or "can edit".
  - "Leaves" don't require any policy.
  - "Other edits" require "can edit".
  - You can't edit away your ability to edit.
  - You //can// leave a project that you wouldn't be able to rejoin.

Things I'm going to add:

  - Global log of policy changes.
  - `bin/policy` script for undoing policy changes.
  - Test coverage for these rules.

Test Plan: Made various project visibility edits with various users, joined / left projects, etc. I'll add more complete coverage in the next diff.

Reviewers: btrahan, vrana

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D3270

src/applications/project/controller/PhabricatorProjectProfileController.php

@@ -31,24 +31,30 @@ final class PhabricatorProjectProfileController
     $request = $this->getRequest();
     $user = $request->getUser();
 
-    $project = id(new PhabricatorProject())->load($this->id);
+    $query = id(new PhabricatorProjectQuery())
+      ->setViewer($user)
+      ->withIDs(array($this->id));
+
+    if ($this->page == 'people') {
+      $query->needMembers(true);
+    }
+
+    $project = $query->executeOne();
     if (!$project) {
       return new Aphront404Response();
     }
+
     $profile = $project->loadProfile();
     if (!$profile) {
       $profile = new PhabricatorProjectProfile();
     }
 
     $picture = $profile->loadProfileImageURI();
-    $members = $project->loadMemberPHIDs();
-    $member_map = array_fill_keys($members, true);
 
     $nav_view = $this->buildLocalNavigation($project);
 
     $this->page = $nav_view->selectFilter($this->page, 'dashboard');
 
-
     require_celerity_resource('phabricator-profile-css');
     switch ($this->page) {
       case 'dashboard':
@@ -88,7 +94,15 @@ final class PhabricatorProjectProfileController
     $header->setProfilePicture($picture);
 
     $action = null;
-    if (empty($member_map[$user->getPHID()])) {
+    if (!$project->isUserMember($user->getPHID())) {
+      $can_join = PhabricatorPolicyCapability::CAN_JOIN;
+
+      if (PhabricatorPolicyFilter::hasCapability($user, $project, $can_join)) {
+        $class = 'green';
+      } else {
+        $class = 'grey disabled';
+      }
+
       $action = phabricator_render_form(
         $user,
         array(
@@ -98,7 +112,7 @@ final class PhabricatorProjectProfileController
         phutil_render_tag(
           'button',
           array(
-            'class' => 'green',
+            'class' => $class,
           ),
           'Join Project'));
     } else {
@@ -172,7 +186,7 @@ final class PhabricatorProjectProfileController
     PhabricatorProject $project,
     PhabricatorProjectProfile $profile) {
 
-    $member_phids = $project->loadMemberPHIDs();
+    $member_phids = $project->getMemberPHIDs();
     $handles = id(new PhabricatorObjectHandleData($member_phids))
       ->loadHandles();