Fill in new URI credential edit web UI interfaces

Summary:
Ref T10748. Ref T10366. Allows users to set credential for new URIs.

  - Ref T7221. Our handling of the "git://" protocol is currently incorrect. This protocol is not authenticated, but is considered an SSH protocol. In the new UI, it is considered an anonymous/unauthenticated protocol instead.
  - Ref T10241. This fixes the `PassphraseCredentialControl` so it doesn't silently edit the value if the current value is not visible to you and/or not valid.

Test Plan:
Performed a whole lot of credential edits, removals, and adjustments. I'll give this additional vetting before cutting over to it.

{F1253207}

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7221, T10241, T10366, T10748

Differential Revision: https://secure.phabricator.com/D15829

src/applications/diffusion/editor/DiffusionURIEditEngine.php

@@ -83,6 +83,14 @@ final class DiffusionURIEditEngine
   protected function buildCustomEditFields($object) {
     $viewer = $this->getViewer();
 
+    if ($object->isBuiltin()) {
+      $is_builtin = true;
+      $uri_value = (string)$object->getDisplayURI();
+    } else {
+      $is_builtin = false;
+      $uri_value = $object->getURI();
+    }
+
     return array(
       id(new PhabricatorHandlesEditField())
         ->setKey('repository')
@@ -104,12 +112,13 @@ final class DiffusionURIEditEngine
       id(new PhabricatorTextEditField())
         ->setKey('uri')
         ->setLabel(pht('URI'))
-        ->setIsRequired(true)
         ->setTransactionType(PhabricatorRepositoryURITransaction::TYPE_URI)
         ->setDescription(pht('The repository URI.'))
         ->setConduitDescription(pht('Change the repository URI.'))
         ->setConduitTypeDescription(pht('New repository URI.'))
-        ->setValue($object->getURI()),
+        ->setIsRequired(!$is_builtin)
+        ->setIsLocked($is_builtin)
+        ->setValue($uri_value),
       id(new PhabricatorSelectEditField())
         ->setKey('io')
         ->setLabel(pht('I/O Type'))

src/applications/diffusion/editor/DiffusionURIEditor.php

@@ -70,7 +70,42 @@ final class DiffusionURIEditor
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorRepositoryURITransaction::TYPE_URI:
+        if (!$this->getIsNewObject()) {
+          $old_uri = $object->getEffectiveURI();
+        } else {
+          $old_uri = null;
+        }
+
         $object->setURI($xaction->getNewValue());
+
+        // If we've changed the domain or protocol of the URI, remove the
+        // current credential. This improves behavior in several cases:
+
+        // If a user switches between protocols with different credential
+        // types, like HTTP and SSH, the old credential won't be valid anyway.
+        // It's cleaner to remove it than leave a bad credential in place.
+
+        // If a user switches hosts, the old credential is probably not
+        // correct (and potentially confusing/misleading). Removing it forces
+        // users to double check that they have the correct credentials.
+
+        // If an attacker can't see a symmetric credential like a username and
+        // password, they could still potentially capture it by changing the
+        // host for a URI that uses it to `evil.com`, a server they control,
+        // then observing the requests. Removing the credential prevents this
+        // kind of escalation.
+
+        // Since port and path changes are less likely to fall among these
+        // cases, they don't trigger a credential wipe.
+
+        $new_uri = $object->getEffectiveURI();
+        if ($old_uri) {
+          $new_proto = ($old_uri->getProtocol() != $new_uri->getProtocol());
+          $new_domain = ($old_uri->getDomain() != $new_uri->getDomain());
+          if ($new_proto || $new_domain) {
+            $object->setCredentialPHID(null);
+          }
+        }
         break;
       case PhabricatorRepositoryURITransaction::TYPE_IO:
         $object->setIOType($xaction->getNewValue());
@@ -184,6 +219,11 @@ final class DiffusionURIEditor
             continue;
           }
 
+          // Anyone who can edit a URI can remove the credential.
+          if ($credential_phid === null) {
+            continue;
+          }
+
           $credential = id(new PassphraseCredentialQuery())
             ->setViewer($viewer)
             ->withPHIDs(array($credential_phid))