Genericize transactions in Pholio

Summary:
Split Pholio's transaction implementation into generic and application-specific parts. Moves us toward generic transactions, with support for:

  - Editing and deleting comments.
  - Setting visibility of individual comments (I'm not a fan of this feature but we'll see).

I want to move everything to a more generic piece of infrastructure but there's very little they can share right now so adding transactions to, e.g., Paste or Macros (T2157) means massive amounts of similar code.

Tons of work left to do here, but I think it basically works. Here's a screenshot:

{F26820}

Test Plan: Made transactions in Pholio.

Reviewers: btrahan, vrana, chad

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T2104

Differential Revision: https://secure.phabricator.com/D4136
Make timeline view prettier

Summary: Aligns the timeline view more closely with the `diff_full_view.png` mock.

Test Plan:
Desktop:

{F26822}

Mobile:

{F26823}

Reviewers: chad, btrahan

Reviewed By: chad

CC: aran

Maniphest Tasks: T2104

Differential Revision: https://secure.phabricator.com/D4137
Add "via", timestamps and anchors to new timeline/transaction view

Summary: I got rid of the "#4" and just linked the timestamps.

Test Plan: {F26826}

Reviewers: chad

Reviewed By: chad

CC: aran

Maniphest Tasks: T2104

Differential Revision: https://secure.phabricator.com/D4138
Add mail support to generic transactions

Summary:
  - Adds mail support to the generic transaction construct.
  - Restores mail support to Pholio (now much improved; the mails are actually useful).

Test Plan: Updated a Pholio mock, got mail.

Reviewers: btrahan, chad, vrana

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T2104

Differential Revision: https://secure.phabricator.com/D4139
Add feed integration to generic transactions

Summary: Publish feed stories, including from Pholio. Actual stories are somewhat garbage but it's all display-time; I'm going to do a pass on feed in general.

Test Plan: {F26832}

Reviewers: btrahan, chad, vrana

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T2104

Differential Revision: https://secure.phabricator.com/D4140
Modernize Macro application

Summary: Adds feed, email, notifications, comments, partial editing, subscriptions, enable/disable, flags and crumbs to Macro.

Test Plan:
{F26839}
{F26840}
{F26841}
{F26842}
{F26843}
{F26844}
{F26845}

Reviewers: vrana, btrahan, chad

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2157, T175, T2104

Differential Revision: https://secure.phabricator.com/D4141
Detect missing 'params' in Conduit calls

Summary:
Suhosin has about 50 options for filtering input variables, doucmented here:

http://www.hardened-php.net/suhosin/configuration.html

The default behavior of Suhosin is to drop the variable entirely if it violates any of the rules, then continue with the request. It doesn't affect 'php://input' and doesn't drop other variables, so it evades existing detection, and we can't figure out that it's happened at runtime. We could add blanket checks (Suhosin enabled + suhosin.filter.action set to nothing means this may happen, and will be undetectable if it does happen) but can't tailor a check or recovery to this specific problem.

Instead, raise a better error in the specific case where we encounter this, which is Conduit calls of "arc diff" of files over 1MB (the default POST limit). In these cases, Suhosin drops the variable entirely. If there is no 'params', scream. We never encounter this case normall (`arc`, including `arc call-conduit`, always sends this parameter) although other clients might omit it. The only exception is the web console with `conduit.ping`, which submits nothing; make it submit something so it keeps working.

See also https://github.com/facebook/phabricator/issues/233#issuecomment-11186074

Test Plan: Brought up a Debian + Suhosin box, verified the behavior of Suhosin, made requests with and without 'params'.

Reviewers: btrahan, vrana

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D4144
Lay in more styles from "diff_full_view.png"

Summary: Aligns more styles to the `diff_full_view.png` mock.

Test Plan: {F26859}

Reviewers: chad, btrahan

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D4142
Allow ApplicationTransaction comments to be edited and deleted

Summary:
Allows you to edit or delete comments in appplications which support ApplicationTransactions.

UI/UX stuff:

  - The dialogs are rough but I want to do a dialog design pass more generally, @chad has some mocks.
  - When you add new mentions via edit, they don't currently count as mentions. I'm not sure what I want to do about this.
  - When you edit or delete a comment, we do not publish any notifications about it. I think this is reasonable.
  - I didn't separate "delete" out versus "edit"; I assume it will be reasonably intuitive that deleting all the text deletes effectively deletes the comment. I also want to discourage deletion somewhat (we still show the transaction, just show that the comment has been deleted).

Test Plan:
Transaction view, note "Edit" and "Edited" links:

{F26914}

Edit view, has some design issues but I want to do a pass on dialogs in general:

{F26915}

History view:

{F26913}

Reviewers: vrana, btrahan, chad

Reviewed By: vrana

CC: aran

Maniphest Tasks: T1082

Differential Revision: https://secure.phabricator.com/D4149
Apply ApplicationTransaction edits and deletes via Ajax if available

Summary: When possible, replace the edited or deleted transaction inline using Ajax.

Test Plan: Repeatedly edited and deleted transactions. Clicked their anchors to verify anchors were correctly preserved.

Reviewers: vrana, btrahan, chad

Reviewed By: vrana

CC: aran

Maniphest Tasks: T1082

Differential Revision: https://secure.phabricator.com/D4150
Render application transactions via Ajax

Summary:
When possible, render application transactions via Ajax. Instead of reloading the page when the response returns, append new transactions to the transaction view.

Scroll the window to the new transactions, animate them in, and clear the form to make this interaction feel reasonable.

When editing transactions, fade them in but do not scroll to them (i.e., don't disrupt the user's position).

Test Plan: Edited and appended transactions via Ajax. Observed fade in animations and scroll behavior. Clicked anchors to verify proper anchor accounting.

Reviewers: vrana, btrahan, chad

Reviewed By: vrana

CC: aran

Maniphest Tasks: T1960

Differential Revision: https://secure.phabricator.com/D4151
Improve overflow behavior of Timeline view

Summary:
For text like "MMM", make the right parts of the element scroll.

Also fixed a couple of 1px issues here and there.

Test Plan: Added, viewed UIExamples.

Reviewers: chad, btrahan

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D4152
Modernize the top half of Maniphest

Summary:
Use modern elements: crumbs, header, action list, property list, tags.

No functional changes.

Test Plan: {F26934}

Reviewers: chad, btrahan, vrana

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D4153
change DifferentialRevisionDetailView to use newer fangled UI abstractions

Summary: actions are still a bit messy - unsatisfactory icons (T2013 will help!)

Test Plan: viewed diffs - they look good

Reviewers: epriestley, vrana

Reviewed By: epriestley

CC: chad, aran, Korvin

Maniphest Tasks: T2007

Differential Revision: https://secure.phabricator.com/D3904
Add background to haunted differential comment panel

Summary:
Warning boxes in a haunted differential comment panel were showing up
without a background (so the contents below were showing through).
This adds the background.

Test Plan:
viewed haunted differential comment panel on a diff with lint errors
and selected "accept revision". Confirmed that the diff and sidebar did
not show through underneath the red warning box.

Reviewers: epriestley, chad

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4154
Parse Conflicts field in commit message

Summary:
Git adds it automatically.

I don't like this solution much because there could be other unknown fields appended to the end of the commit message which will break parsing.

Test Plan:
Reparsed commit ending with:

> Differential Revision: ...
> Conflicts: ...

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4157
Minor, remove a mention of AphrontSideNavView from an old comment (see D4035).
Restore Maniphest to use comma-style lists for subscribers, projects

Summary: D4153 made these render with newlines between items; use commas instead.

Test Plan: {F26950}

Reviewers: btrahan, chad, vrana

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D4162
Implement "USER" policy

Summary: I thought I'd already implemented this, but hadn't. Implement a "USER" policy -- a USER phid means only that user has the capability.

Test Plan: Looked at macros as a user other than the comment owner.

Reviewers: btrahan, vrana

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D4155
refactor pass 2 of N on DifferentialChangesetParser and bonus bug fix

Summary: pull out some more stuff from the TwoUp renderer that's generically useful. also clean up $xhp variable and add a get method for the $coverage. Finally, fix T2177 while I'm in here.

Test Plan: played around with Differential. Also opened things up in Firefox to verify T2177.

Reviewers: epriestley, vrana

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2009, T2177

Differential Revision: https://secure.phabricator.com/D4161