Merge "Move {Ref,Change,Project}Control into permissions package"
diff --git a/java/com/google/gerrit/httpd/init/WebAppInitializer.java b/java/com/google/gerrit/httpd/init/WebAppInitializer.java
index 5b9cf3b..fa114e6 100644
--- a/java/com/google/gerrit/httpd/init/WebAppInitializer.java
+++ b/java/com/google/gerrit/httpd/init/WebAppInitializer.java
@@ -73,10 +73,10 @@
 import com.google.gerrit.server.notedb.GroupsMigration;
 import com.google.gerrit.server.notedb.NotesMigration;
 import com.google.gerrit.server.patch.DiffExecutorModule;
+import com.google.gerrit.server.permissions.DefaultPermissionBackendModule;
 import com.google.gerrit.server.plugins.PluginGuiceEnvironment;
 import com.google.gerrit.server.plugins.PluginModule;
 import com.google.gerrit.server.plugins.PluginRestApiModule;
-import com.google.gerrit.server.project.DefaultPermissionBackendModule;
 import com.google.gerrit.server.project.DefaultProjectNameLockManager;
 import com.google.gerrit.server.restapi.config.RestCacheAdminModule;
 import com.google.gerrit.server.schema.DataSourceModule;
diff --git a/java/com/google/gerrit/pgm/Daemon.java b/java/com/google/gerrit/pgm/Daemon.java
index 4bc06d0..1c0ce9c 100644
--- a/java/com/google/gerrit/pgm/Daemon.java
+++ b/java/com/google/gerrit/pgm/Daemon.java
@@ -82,10 +82,10 @@
 import com.google.gerrit.server.notedb.rebuild.NoteDbMigrator;
 import com.google.gerrit.server.notedb.rebuild.OnlineNoteDbMigrator;
 import com.google.gerrit.server.patch.DiffExecutorModule;
+import com.google.gerrit.server.permissions.DefaultPermissionBackendModule;
 import com.google.gerrit.server.plugins.PluginGuiceEnvironment;
 import com.google.gerrit.server.plugins.PluginModule;
 import com.google.gerrit.server.plugins.PluginRestApiModule;
-import com.google.gerrit.server.project.DefaultPermissionBackendModule;
 import com.google.gerrit.server.project.DefaultProjectNameLockManager;
 import com.google.gerrit.server.restapi.config.RestCacheAdminModule;
 import com.google.gerrit.server.schema.DataSourceProvider;
diff --git a/java/com/google/gerrit/pgm/util/BatchProgramModule.java b/java/com/google/gerrit/pgm/util/BatchProgramModule.java
index d39c73a..760afdc 100644
--- a/java/com/google/gerrit/pgm/util/BatchProgramModule.java
+++ b/java/com/google/gerrit/pgm/util/BatchProgramModule.java
@@ -60,12 +60,12 @@
 import com.google.gerrit.server.notedb.NoteDbModule;
 import com.google.gerrit.server.patch.DiffExecutorModule;
 import com.google.gerrit.server.patch.PatchListCacheImpl;
+import com.google.gerrit.server.permissions.DefaultPermissionBackendModule;
+import com.google.gerrit.server.permissions.SectionSortCache;
 import com.google.gerrit.server.project.CommentLinkProvider;
 import com.google.gerrit.server.project.CommitResource;
-import com.google.gerrit.server.project.DefaultPermissionBackendModule;
 import com.google.gerrit.server.project.ProjectCacheImpl;
 import com.google.gerrit.server.project.ProjectState;
-import com.google.gerrit.server.project.SectionSortCache;
 import com.google.gerrit.server.project.SubmitRuleEvaluator;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gerrit.server.query.change.ChangeQueryProcessor;
diff --git a/java/com/google/gerrit/server/config/GerritGlobalModule.java b/java/com/google/gerrit/server/config/GerritGlobalModule.java
index 74e19b6..e29968b 100644
--- a/java/com/google/gerrit/server/config/GerritGlobalModule.java
+++ b/java/com/google/gerrit/server/config/GerritGlobalModule.java
@@ -159,14 +159,14 @@
 import com.google.gerrit.server.patch.PatchListCacheImpl;
 import com.google.gerrit.server.patch.PatchScriptFactory;
 import com.google.gerrit.server.patch.PatchSetInfoFactory;
+import com.google.gerrit.server.permissions.PermissionCollection;
+import com.google.gerrit.server.permissions.SectionSortCache;
 import com.google.gerrit.server.plugins.ReloadPluginListener;
 import com.google.gerrit.server.project.AccessControlModule;
 import com.google.gerrit.server.project.CommentLinkProvider;
-import com.google.gerrit.server.project.PermissionCollection;
 import com.google.gerrit.server.project.ProjectCacheImpl;
 import com.google.gerrit.server.project.ProjectNameLockManager;
 import com.google.gerrit.server.project.ProjectState;
-import com.google.gerrit.server.project.SectionSortCache;
 import com.google.gerrit.server.project.SubmitRuleEvaluator;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gerrit.server.query.change.ChangeQueryBuilder;
diff --git a/java/com/google/gerrit/server/project/ChangeControl.java b/java/com/google/gerrit/server/permissions/ChangeControl.java
similarity index 97%
rename from java/com/google/gerrit/server/project/ChangeControl.java
rename to java/com/google/gerrit/server/permissions/ChangeControl.java
index 3e14d38..8dd418e 100644
--- a/java/com/google/gerrit/server/project/ChangeControl.java
+++ b/java/com/google/gerrit/server/permissions/ChangeControl.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.gerrit.server.permissions.LabelPermission.ForUser.ON_BEHALF_OF;
@@ -34,12 +34,7 @@
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.PatchSetUtil;
 import com.google.gerrit.server.notedb.ChangeNotes;
-import com.google.gerrit.server.permissions.ChangePermission;
-import com.google.gerrit.server.permissions.ChangePermissionOrLabel;
-import com.google.gerrit.server.permissions.LabelPermission;
 import com.google.gerrit.server.permissions.PermissionBackend.ForChange;
-import com.google.gerrit.server.permissions.PermissionBackendException;
-import com.google.gerrit.server.permissions.RefPermission;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.Inject;
diff --git a/java/com/google/gerrit/server/project/DefaultPermissionBackend.java b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
similarity index 95%
rename from java/com/google/gerrit/server/project/DefaultPermissionBackend.java
rename to java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
index c33c01f..152fdf9 100644
--- a/java/com/google/gerrit/server/project/DefaultPermissionBackend.java
+++ b/java/com/google/gerrit/server/permissions/DefaultPermissionBackend.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.base.Preconditions.checkNotNull;
 import static java.util.stream.Collectors.toSet;
@@ -28,10 +28,9 @@
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.PeerDaemonUser;
 import com.google.gerrit.server.account.CapabilityCollection;
-import com.google.gerrit.server.permissions.FailedPermissionBackend;
-import com.google.gerrit.server.permissions.GlobalPermission;
-import com.google.gerrit.server.permissions.PermissionBackend;
-import com.google.gerrit.server.permissions.PermissionBackendException;
+import com.google.gerrit.server.project.NoSuchProjectException;
+import com.google.gerrit.server.project.ProjectCache;
+import com.google.gerrit.server.project.ProjectState;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.io.IOException;
diff --git a/java/com/google/gerrit/server/project/DefaultPermissionBackendModule.java b/java/com/google/gerrit/server/permissions/DefaultPermissionBackendModule.java
similarity index 92%
rename from java/com/google/gerrit/server/project/DefaultPermissionBackendModule.java
rename to java/com/google/gerrit/server/permissions/DefaultPermissionBackendModule.java
index 44c5e0b..d9a43a9 100644
--- a/java/com/google/gerrit/server/project/DefaultPermissionBackendModule.java
+++ b/java/com/google/gerrit/server/permissions/DefaultPermissionBackendModule.java
@@ -12,10 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import com.google.gerrit.extensions.config.FactoryModule;
-import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.inject.AbstractModule;
 
 /** Binds the default {@link PermissionBackend}. */
diff --git a/java/com/google/gerrit/server/permissions/PermissionBackend.java b/java/com/google/gerrit/server/permissions/PermissionBackend.java
index c87e8e4..2a652d9 100644
--- a/java/com/google/gerrit/server/permissions/PermissionBackend.java
+++ b/java/com/google/gerrit/server/permissions/PermissionBackend.java
@@ -27,7 +27,6 @@
 import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.notedb.ChangeNotes;
-import com.google.gerrit.server.project.DefaultPermissionBackend;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.ImplementedBy;
diff --git a/java/com/google/gerrit/server/project/PermissionCollection.java b/java/com/google/gerrit/server/permissions/PermissionCollection.java
similarity index 94%
rename from java/com/google/gerrit/server/project/PermissionCollection.java
rename to java/com/google/gerrit/server/permissions/PermissionCollection.java
index 9febb3f..1e8ea9a 100644
--- a/java/com/google/gerrit/server/project/PermissionCollection.java
+++ b/java/com/google/gerrit/server/permissions/PermissionCollection.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.gerrit.server.project.RefPattern.isRE;
@@ -29,6 +29,9 @@
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.project.RefPattern;
+import com.google.gerrit.server.project.RefPatternMatcher.ExpandParameters;
+import com.google.gerrit.server.project.SectionMatcher;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.util.ArrayList;
@@ -91,16 +94,16 @@
         // that will never be shared with non-user references, and the per-user
         // references are usually less frequent than the non-user references.
         //
-        if (sm.matcher instanceof RefPatternMatcher.ExpandParameters) {
-          if (!((RefPatternMatcher.ExpandParameters) sm.matcher).matchPrefix(ref)) {
+        if (sm.getMatcher() instanceof ExpandParameters) {
+          if (!((ExpandParameters) sm.getMatcher()).matchPrefix(ref)) {
             continue;
           }
           perUser = true;
           if (sm.match(ref, user)) {
-            sectionToProject.put(sm.section, sm.project);
+            sectionToProject.put(sm.getSection(), sm.getProject());
           }
         } else if (sm.match(ref, null)) {
-          sectionToProject.put(sm.section, sm.project);
+          sectionToProject.put(sm.getSection(), sm.getProject());
         }
       }
       List<AccessSection> sections = Lists.newArrayList(sectionToProject.keySet());
diff --git a/java/com/google/gerrit/server/project/ProjectControl.java b/java/com/google/gerrit/server/permissions/ProjectControl.java
similarity index 92%
rename from java/com/google/gerrit/server/project/ProjectControl.java
rename to java/com/google/gerrit/server/permissions/ProjectControl.java
index 4d6cdfa..d37b254 100644
--- a/java/com/google/gerrit/server/project/ProjectControl.java
+++ b/java/com/google/gerrit/server/permissions/ProjectControl.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.base.Preconditions.checkArgument;
 
@@ -21,9 +21,6 @@
 import com.google.gerrit.common.data.Permission;
 import com.google.gerrit.common.data.PermissionRule;
 import com.google.gerrit.extensions.restapi.AuthException;
-import com.google.gerrit.metrics.Counter0;
-import com.google.gerrit.metrics.Description;
-import com.google.gerrit.metrics.MetricMaker;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.Branch;
 import com.google.gerrit.reviewdb.client.Change;
@@ -36,18 +33,14 @@
 import com.google.gerrit.server.config.GitUploadPackGroups;
 import com.google.gerrit.server.group.SystemGroupBackend;
 import com.google.gerrit.server.notedb.ChangeNotes;
-import com.google.gerrit.server.permissions.FailedPermissionBackend;
-import com.google.gerrit.server.permissions.GlobalPermission;
-import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.gerrit.server.permissions.PermissionBackend.ForChange;
 import com.google.gerrit.server.permissions.PermissionBackend.ForProject;
 import com.google.gerrit.server.permissions.PermissionBackend.ForRef;
-import com.google.gerrit.server.permissions.PermissionBackendException;
-import com.google.gerrit.server.permissions.ProjectPermission;
+import com.google.gerrit.server.project.ProjectState;
+import com.google.gerrit.server.project.SectionMatcher;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.Inject;
-import com.google.inject.Singleton;
 import com.google.inject.assistedinject.Assisted;
 import java.util.Collection;
 import java.util.Collections;
@@ -64,19 +57,6 @@
     ProjectControl create(CurrentUser who, ProjectState ps);
   }
 
-  @Singleton
-  protected static class Metrics {
-    final Counter0 claCheckCount;
-
-    @Inject
-    Metrics(MetricMaker metricMaker) {
-      claCheckCount =
-          metricMaker.newCounter(
-              "license/cla_check_count",
-              new Description("Total number of CLA check requests").setRate().setUnit("requests"));
-    }
-  }
-
   private final Set<AccountGroup.UUID> uploadGroups;
   private final Set<AccountGroup.UUID> receiveGroups;
   private final PermissionBackend permissionBackend;
@@ -227,7 +207,7 @@
 
   private boolean canCreateChanges() {
     for (SectionMatcher matcher : access()) {
-      AccessSection section = matcher.section;
+      AccessSection section = matcher.getSection();
       if (section.getName().startsWith("refs/for/")) {
         Permission permission = section.getPermission(Permission.PUSH);
         if (permission != null && controlForRef(section.getName()).canPerform(Permission.PUSH)) {
@@ -248,7 +228,7 @@
 
   private boolean canPerformOnAnyRef(String permissionName) {
     for (SectionMatcher matcher : access()) {
-      AccessSection section = matcher.section;
+      AccessSection section = matcher.getSection();
       Permission permission = section.getPermission(permissionName);
       if (permission == null) {
         continue;
@@ -297,7 +277,7 @@
   private Set<String> allRefPatterns(String permissionName) {
     Set<String> all = new HashSet<>();
     for (SectionMatcher matcher : access()) {
-      AccessSection section = matcher.section;
+      AccessSection section = matcher.getSection();
       Permission permission = section.getPermission(permissionName);
       if (permission != null) {
         all.add(section.getName());
diff --git a/java/com/google/gerrit/server/project/ProjectRef.java b/java/com/google/gerrit/server/permissions/ProjectRef.java
similarity index 95%
rename from java/com/google/gerrit/server/project/ProjectRef.java
rename to java/com/google/gerrit/server/permissions/ProjectRef.java
index be5fda0..deb224e 100644
--- a/java/com/google/gerrit/server/project/ProjectRef.java
+++ b/java/com/google/gerrit/server/permissions/ProjectRef.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import com.google.auto.value.AutoValue;
 import com.google.gerrit.reviewdb.client.Project;
diff --git a/java/com/google/gerrit/server/project/RefControl.java b/java/com/google/gerrit/server/permissions/RefControl.java
similarity index 98%
rename from java/com/google/gerrit/server/project/RefControl.java
rename to java/com/google/gerrit/server/permissions/RefControl.java
index c406b48..66d1db8 100644
--- a/java/com/google/gerrit/server/project/RefControl.java
+++ b/java/com/google/gerrit/server/permissions/RefControl.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.base.Preconditions.checkArgument;
 
@@ -26,11 +26,8 @@
 import com.google.gerrit.reviewdb.client.RefNames;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.notedb.ChangeNotes;
-import com.google.gerrit.server.permissions.FailedPermissionBackend;
 import com.google.gerrit.server.permissions.PermissionBackend.ForChange;
 import com.google.gerrit.server.permissions.PermissionBackend.ForRef;
-import com.google.gerrit.server.permissions.PermissionBackendException;
-import com.google.gerrit.server.permissions.RefPermission;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gerrit.server.util.MagicBranch;
 import com.google.gwtorm.server.OrmException;
diff --git a/java/com/google/gerrit/server/project/SectionSortCache.java b/java/com/google/gerrit/server/permissions/SectionSortCache.java
similarity index 98%
rename from java/com/google/gerrit/server/project/SectionSortCache.java
rename to java/com/google/gerrit/server/permissions/SectionSortCache.java
index a02941e..c51bb80 100644
--- a/java/com/google/gerrit/server/project/SectionSortCache.java
+++ b/java/com/google/gerrit/server/permissions/SectionSortCache.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import com.google.auto.value.AutoValue;
 import com.google.common.cache.Cache;
diff --git a/java/com/google/gerrit/server/project/ContributorAgreementsChecker.java b/java/com/google/gerrit/server/project/ContributorAgreementsChecker.java
index 2f96bd5..d840123 100644
--- a/java/com/google/gerrit/server/project/ContributorAgreementsChecker.java
+++ b/java/com/google/gerrit/server/project/ContributorAgreementsChecker.java
@@ -20,6 +20,9 @@
 import com.google.gerrit.common.data.PermissionRule;
 import com.google.gerrit.common.data.PermissionRule.Action;
 import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.metrics.Counter0;
+import com.google.gerrit.metrics.Description;
+import com.google.gerrit.metrics.MetricMaker;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.reviewdb.client.AccountGroup.UUID;
 import com.google.gerrit.reviewdb.client.BooleanProjectConfig;
@@ -27,7 +30,6 @@
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.IdentifiedUser;
 import com.google.gerrit.server.config.CanonicalWebUrl;
-import com.google.gerrit.server.project.ProjectControl.Metrics;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.io.IOException;
@@ -42,6 +44,19 @@
   private final ProjectCache projectCache;
   private final Metrics metrics;
 
+  @Singleton
+  protected static class Metrics {
+    final Counter0 claCheckCount;
+
+    @Inject
+    Metrics(MetricMaker metricMaker) {
+      claCheckCount =
+          metricMaker.newCounter(
+              "license/cla_check_count",
+              new Description("Total number of CLA check requests").setRate().setUnit("requests"));
+    }
+  }
+
   @Inject
   ContributorAgreementsChecker(
       @CanonicalWebUrl @Nullable String canonicalWebUrl,
diff --git a/java/com/google/gerrit/server/project/ProjectState.java b/java/com/google/gerrit/server/project/ProjectState.java
index b45f119..b70a520 100644
--- a/java/com/google/gerrit/server/project/ProjectState.java
+++ b/java/com/google/gerrit/server/project/ProjectState.java
@@ -310,7 +310,7 @@
    * Obtain all local and inherited sections. This collection is looked up dynamically and is not
    * cached. Callers should try to cache this result per-request as much as possible.
    */
-  List<SectionMatcher> getAllSections() {
+  public List<SectionMatcher> getAllSections() {
     if (isAllProjects) {
       return getLocalAccessSections();
     }
@@ -520,7 +520,7 @@
   private static Set<GroupReference> getGroups(List<SectionMatcher> sectionMatcherList) {
     final Set<GroupReference> all = new HashSet<>();
     for (SectionMatcher matcher : sectionMatcherList) {
-      final AccessSection section = matcher.section;
+      final AccessSection section = matcher.getSection();
       for (Permission permission : section.getPermissions()) {
         for (PermissionRule rule : permission.getRules()) {
           all.add(rule.getGroup());
diff --git a/java/com/google/gerrit/server/project/RefPatternMatcher.java b/java/com/google/gerrit/server/project/RefPatternMatcher.java
index af30633..bfd5b46 100644
--- a/java/com/google/gerrit/server/project/RefPatternMatcher.java
+++ b/java/com/google/gerrit/server/project/RefPatternMatcher.java
@@ -83,7 +83,7 @@
     }
   }
 
-  static class ExpandParameters extends RefPatternMatcher {
+  public static class ExpandParameters extends RefPatternMatcher {
     private final ParameterizedString template;
     private final String prefix;
 
@@ -145,7 +145,7 @@
       return ImmutableSet.of();
     }
 
-    boolean matchPrefix(String ref) {
+    public boolean matchPrefix(String ref) {
       return ref.startsWith(prefix);
     }
 
diff --git a/java/com/google/gerrit/server/project/SectionMatcher.java b/java/com/google/gerrit/server/project/SectionMatcher.java
index 65b17bb..11b1f37 100644
--- a/java/com/google/gerrit/server/project/SectionMatcher.java
+++ b/java/com/google/gerrit/server/project/SectionMatcher.java
@@ -16,6 +16,7 @@
 
 import com.google.gerrit.common.data.AccessSection;
 import com.google.gerrit.reviewdb.client.Project;
+import com.google.gerrit.reviewdb.client.Project.NameKey;
 import com.google.gerrit.server.CurrentUser;
 
 /**
@@ -24,7 +25,7 @@
  * <p>These matchers are "compiled" versions of the AccessSection name, supporting faster selection
  * of which sections are relevant to any given input reference.
  */
-class SectionMatcher extends RefPatternMatcher {
+public class SectionMatcher extends RefPatternMatcher {
   static SectionMatcher wrap(Project.NameKey project, AccessSection section) {
     String ref = section.getName();
     if (AccessSection.isValid(ref)) {
@@ -33,11 +34,11 @@
     return null;
   }
 
-  final Project.NameKey project;
-  final AccessSection section;
-  final RefPatternMatcher matcher;
+  private final Project.NameKey project;
+  private final AccessSection section;
+  private final RefPatternMatcher matcher;
 
-  SectionMatcher(Project.NameKey project, AccessSection section, RefPatternMatcher matcher) {
+  public SectionMatcher(Project.NameKey project, AccessSection section, RefPatternMatcher matcher) {
     this.project = project;
     this.section = section;
     this.matcher = matcher;
@@ -47,4 +48,16 @@
   public boolean match(String ref, CurrentUser user) {
     return this.matcher.match(ref, user);
   }
+
+  public AccessSection getSection() {
+    return section;
+  }
+
+  public RefPatternMatcher getMatcher() {
+    return matcher;
+  }
+
+  public NameKey getProject() {
+    return project;
+  }
 }
diff --git a/java/com/google/gerrit/testing/InMemoryModule.java b/java/com/google/gerrit/testing/InMemoryModule.java
index c714d741..f6f18bd 100644
--- a/java/com/google/gerrit/testing/InMemoryModule.java
+++ b/java/com/google/gerrit/testing/InMemoryModule.java
@@ -67,9 +67,9 @@
 import com.google.gerrit.server.notedb.MutableNotesMigration;
 import com.google.gerrit.server.notedb.NotesMigration;
 import com.google.gerrit.server.patch.DiffExecutor;
+import com.google.gerrit.server.permissions.DefaultPermissionBackendModule;
 import com.google.gerrit.server.plugins.PluginRestApiModule;
 import com.google.gerrit.server.plugins.ServerInformationImpl;
-import com.google.gerrit.server.project.DefaultPermissionBackendModule;
 import com.google.gerrit.server.project.DefaultProjectNameLockManager;
 import com.google.gerrit.server.schema.DataSourceType;
 import com.google.gerrit.server.schema.InMemoryAccountPatchReviewStore;
diff --git a/javatests/com/google/gerrit/server/project/RefControlTest.java b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
similarity index 98%
rename from javatests/com/google/gerrit/server/project/RefControlTest.java
rename to javatests/com/google/gerrit/server/permissions/RefControlTest.java
index 643519b..50c2d96 100644
--- a/javatests/com/google/gerrit/server/project/RefControlTest.java
+++ b/javatests/com/google/gerrit/server/permissions/RefControlTest.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package com.google.gerrit.server.project;
+package com.google.gerrit.server.permissions;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.gerrit.common.data.Permission.EDIT_TOPIC_NAME;
@@ -55,9 +55,9 @@
 import com.google.gerrit.server.config.SitePaths;
 import com.google.gerrit.server.git.ProjectConfig;
 import com.google.gerrit.server.index.SingleVersionModule.SingleVersionListener;
-import com.google.gerrit.server.permissions.PermissionBackend;
-import com.google.gerrit.server.permissions.ProjectPermission;
-import com.google.gerrit.server.permissions.RefPermission;
+import com.google.gerrit.server.project.ProjectCache;
+import com.google.gerrit.server.project.ProjectState;
+import com.google.gerrit.server.project.RefPattern;
 import com.google.gerrit.server.project.testing.Util;
 import com.google.gerrit.server.rules.PrologEnvironment;
 import com.google.gerrit.server.rules.RulesCache;