Merge branch 'stable-3.0'

* stable-3.0:
  Upgrade bazlets to latest stable-3.0 to build with 3.0.5 API
  Allow HTML in success messages
  Upgrade bazlets to latest stable-3.0 to build with 3.0.4 API
  Upgrade bazlets to latest stable-2.16 to build with 2.16.13 API
  Upgrade bazlets to latest stable-3.0
  Upgrade bazlets to latest stable-2.16
  Upgrade bazlets to latest stable-2.15 to build with 2.15.18 API
  Bazel: Migrate workspace status script to python
  Upgrade bazlets to latest stable-2.15
  Upgrade bazlets to latest stable-2.14
  Upgrade bazlets to latest stable-2.16
  Upgrade bazlets to latest stable-2.15
  Upgrade bazlets to latest stable-2.14
  Bump Bazel version to 1.1.0
  Check if full name and email edit are allowed in realm
  Show success message in dialog
  Fix display of owner group input on details screen
  Make full name and email in details screen better readable
  Use on-click instead of on-tap
  Replace bazel-genfiles with bazel-bin in documentation
  Upgrade bazlets to latest stable-3.0 to build with 3.0.3 API
  Bump bazel version to 1.0.0
  Upgrade bazlets to latest stable-2.16 to build with 2.16.12 API
  Upgrade bazlets to latest stable-2.15 to build with 2.15.17 API

Change-Id: I5ad452358d11cc90359db5dded41a519ac50a6cb
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
index 80ddf1b..9965edb 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUser.java
@@ -14,6 +14,8 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
+
 import com.google.common.base.Function;
 import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
@@ -151,7 +153,12 @@
 
     input.email = Strings.emptyToNull(input.email);
     if (input.email != null) {
-      Boolean emailAllowed = getConfig.get().apply(new ConfigResource()).allowEmail;
+      Boolean emailAllowed;
+      try {
+        emailAllowed = getConfig.get().apply(new ConfigResource()).value().allowEmail;
+      } catch (Exception e) {
+        throw asRestApiException("Cannot get configuration", e);
+      }
       if (emailAllowed == null || !emailAllowed) {
         throw new ResourceConflictException("email not allowed");
       }
@@ -159,7 +166,13 @@
 
     AccountInput in = new ServiceUserInput(username, input.email, input.sshKey);
     in.groups = Arrays.asList(cfg.getStringList("group"));
-    Response<AccountInfo> response = createAccount.apply(IdString.fromDecoded(username), in);
+
+    AccountInfo response;
+    try {
+      response = createAccount.apply(IdString.fromDecoded(username), in).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot create account", e);
+    }
 
     String creator = user.getUserName().get();
     Account.Id creatorId = ((IdentifiedUser) user).getAccountId();
@@ -175,8 +188,7 @@
     MetaDataUpdate md = metaDataUpdateFactory.create(allProjects);
     md.setMessage("Create service user '" + username + "'\n");
     storage.commit(md);
-
-    ServiceUserInfo info = new ServiceUserInfo(response.value());
+    ServiceUserInfo info = new ServiceUserInfo(response);
     AccountLoader al = accountLoader.create(true);
     info.createdBy = al.get(creatorId);
     al.fill();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
index 63cb875..fd54a55 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/CreateServiceUserNotes.java
@@ -20,7 +20,6 @@
 import static org.eclipse.jgit.lib.Constants.OBJ_COMMIT;
 
 import com.google.gerrit.extensions.common.AccountInfo;
-import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.reviewdb.client.Project;
 import com.google.gerrit.server.GerritPersonIdent;
@@ -154,13 +153,13 @@
   }
 
   private ObjectId createNoteContent(String branch, ServiceUserInfo serviceUser)
-      throws IOException, MethodNotAllowedException, PermissionBackendException {
+      throws IOException, PermissionBackendException, RestApiException, RuntimeException {
     return getInserter()
         .insert(Constants.OBJ_BLOB, createServiceUserNote(branch, serviceUser).getBytes(UTF_8));
   }
 
   private String createServiceUserNote(String branch, ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws PermissionBackendException, RestApiException, RuntimeException {
     HeaderFormatter fmt = new HeaderFormatter(gerritServerIdent.getTimeZone(), anonymousCowardName);
     fmt.appendDate();
     fmt.append("Project", project.get());
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
index 3939119..b6284b0 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetActive.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -29,7 +30,7 @@
   }
 
   @Override
-  public Object apply(ServiceUserResource rsrc) {
-    return getActive.get().apply(rsrc);
+  public Response<Object> apply(ServiceUserResource rsrc) {
+    return Response.ok(getActive.get().apply(rsrc));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
index 85da7b0..7a8c7e2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetConfig.java
@@ -17,6 +17,7 @@
 import com.google.common.base.Strings;
 import com.google.gerrit.extensions.annotations.PluginName;
 import com.google.gerrit.extensions.common.GroupInfo;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.server.account.GroupCache;
@@ -59,7 +60,7 @@
   }
 
   @Override
-  public ConfigInfo apply(ConfigResource rsrc) throws PermissionBackendException {
+  public Response<ConfigInfo> apply(ConfigResource rsrc) throws PermissionBackendException {
     PluginConfig cfg = cfgFactory.getFromGerritConfig(pluginName);
     ConfigInfo info = new ConfigInfo();
     info.info = Strings.emptyToNull(cfg.getString("infoMessage"));
@@ -77,7 +78,7 @@
     String[] groups = cfg.getStringList("group");
     info.groups = new TreeMap<>();
     for (String g : groups) {
-      Optional<InternalGroup> group = groupCache.get(new AccountGroup.NameKey(g));
+      Optional<InternalGroup> group = groupCache.get(AccountGroup.nameKey(g));
       if (group.isPresent()) {
         GroupInfo groupInfo = groupJson.format(new InternalGroupDescription(group.get()));
         groupInfo.name = null;
@@ -87,7 +88,7 @@
       }
     }
 
-    return info;
+    return Response.ok(info);
   }
 
   private static Boolean toBoolean(boolean v) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
index 0fd97da..440bcfa 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetEmail.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Singleton;
 
@@ -21,7 +22,7 @@
 class GetEmail implements RestReadView<ServiceUserResource> {
 
   @Override
-  public String apply(ServiceUserResource rsrc) {
-    return rsrc.getUser().getAccount().getPreferredEmail();
+  public Response<String> apply(ServiceUserResource rsrc) {
+    return Response.ok(rsrc.getUser().getAccount().preferredEmail());
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
index 6ed1af6..7294911 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetName.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -29,7 +30,7 @@
   }
 
   @Override
-  public String apply(ServiceUserResource rsrc) {
+  public Response<String> apply(ServiceUserResource rsrc) {
     return getName.get().apply(rsrc);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
index 3a2460f..3363708 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetServiceUser.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_CREATED_AT;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_CREATOR_ID;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
@@ -60,7 +61,7 @@
   }
 
   @Override
-  public ServiceUserInfo apply(ServiceUserResource rsrc)
+  public Response<ServiceUserInfo> apply(ServiceUserResource rsrc)
       throws RestApiException, PermissionBackendException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
     String username = rsrc.getUser().getUserName().get();
@@ -69,25 +70,35 @@
       throw new ResourceNotFoundException(username);
     }
 
-    ServiceUserInfo info = new ServiceUserInfo(getAccount.get().apply(rsrc));
+    ServiceUserInfo info;
+    try {
+      info = new ServiceUserInfo(getAccount.get().apply(rsrc).value());
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get service user", e);
+    }
+
     AccountLoader al = accountLoader.create(true);
-    info.createdBy = al.get(new Account.Id(db.getInt(USER, username, KEY_CREATOR_ID, -1)));
+    info.createdBy = al.get(Account.id(db.getInt(USER, username, KEY_CREATOR_ID, -1)));
     al.fill();
     info.createdAt = db.getString(USER, username, KEY_CREATED_AT);
     info.inactive = !rsrc.getUser().getAccount().isActive() ? true : null;
 
     Response<GroupInfo> response = getOwner.apply(rsrc);
+
     if (response.statusCode() == SC_OK) {
-      info.owner = response.value();
+      try {
+        info.owner = response.value();
+      } catch (Exception e) {
+        throw asRestApiException("Cannot get owner", e);
+      }
     }
 
-    return info;
+    return Response.ok(info);
   }
 
   public static class ServiceUserInfo extends AccountInfo {
     public AccountInfo createdBy;
     public String createdAt;
-    public Boolean inactive;
     public GroupInfo owner;
 
     public ServiceUserInfo(AccountInfo info) {
@@ -97,6 +108,7 @@
       email = info.email;
       username = info.username;
       avatars = info.avatars;
+      inactive = info.inactive;
     }
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
index 00a0968..6c8a008 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKey.java
@@ -15,6 +15,7 @@
 package com.googlesource.gerrit.plugins.serviceuser;
 
 import com.google.gerrit.extensions.common.SshKeyInfo;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.server.account.AccountResource;
 import com.google.inject.Inject;
@@ -31,7 +32,7 @@
   }
 
   @Override
-  public SshKeyInfo apply(ServiceUserResource.SshKey rsrc) {
+  public Response<SshKeyInfo> apply(ServiceUserResource.SshKey rsrc) {
     return getSshKey.get().apply(new AccountResource.SshKey(rsrc.getUser(), rsrc.getSshKey()));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
index 60dfc15..747190c 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/GetSshKeys.java
@@ -16,6 +16,7 @@
 
 import com.google.gerrit.extensions.common.SshKeyInfo;
 import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -35,8 +36,8 @@
   }
 
   @Override
-  public List<SshKeyInfo> apply(ServiceUserResource rsrc)
+  public Response<List<SshKeyInfo>> apply(ServiceUserResource rsrc)
       throws AuthException, RepositoryNotFoundException, IOException, ConfigInvalidException {
-    return getSshKeys.get().apply(rsrc.getUser());
+    return Response.ok(getSshKeys.get().apply(rsrc.getUser()));
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
index 0b93721..5e77ce2 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ListServiceUsers.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
 
 import com.google.common.collect.Maps;
@@ -21,6 +22,7 @@
 import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.extensions.restapi.IdString;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.extensions.restapi.Response;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestReadView;
 import com.google.gerrit.server.CurrentUser;
@@ -66,7 +68,7 @@
   }
 
   @Override
-  public Map<String, ServiceUserInfo> apply(ConfigResource rscr)
+  public Response<Map<String, ServiceUserInfo>> apply(ConfigResource rscr)
       throws IOException, RestApiException, PermissionBackendException, ConfigInvalidException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
     CurrentUser user = userProvider.get();
@@ -86,16 +88,17 @@
                   .get()
                   .parse(
                       new ConfigResource(),
-                      IdString.fromDecoded(
-                          String.valueOf(account.get().getAccount().getId().get())));
-          info = getServiceUser.get().apply(serviceUserResource);
+                      IdString.fromDecoded(String.valueOf(account.get().account().id().get())));
+          info = getServiceUser.get().apply(serviceUserResource).value();
           info.username = null;
           accounts.put(username, info);
         } catch (ResourceNotFoundException e) {
           // this service user is not visible to the caller -> ignore it
+        } catch (Exception e) {
+          throw asRestApiException("Cannot list service users", e);
         }
       }
     }
-    return accounts;
+    return Response.ok(accounts);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
index 09a559e..29e7ea7 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutConfig.java
@@ -99,7 +99,7 @@
     }
     if (input.groups != null) {
       for (String g : input.groups) {
-        if (groupCache.get(new AccountGroup.NameKey(g)) == null) {
+        if (groupCache.get(AccountGroup.nameKey(g)) == null) {
           throw new UnprocessableEntityException(String.format("Group %s does not exist.", g));
         }
       }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
index 986b2bb..0fb9269 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutEmail.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 
 import com.google.common.base.Strings;
@@ -74,12 +75,23 @@
   public Response<?> apply(ServiceUserResource rsrc, Input input)
       throws ConfigInvalidException, EmailException, IOException, PermissionBackendException,
           RestApiException {
-    Boolean emailAllowed = getConfig.get().apply(new ConfigResource()).allowEmail;
+    Boolean emailAllowed;
+    try {
+      emailAllowed = getConfig.get().apply(new ConfigResource()).value().allowEmail;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
     if ((emailAllowed == null || !emailAllowed)) {
       permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
     }
 
-    String email = getEmail.get().apply(rsrc);
+    String email;
+    try {
+      email = getEmail.get().apply(rsrc).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get email", e);
+    }
+
     if (Strings.emptyToNull(input.email) == null) {
       if (Strings.emptyToNull(email) == null) {
         return Response.none();
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
index 8d0110a..4ff0525 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutHttpPassword.java
@@ -13,14 +13,13 @@
 // limitations under the License.
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.google.gerrit.server.restapi.account.PutHttpPassword.generate;
 
 import com.google.common.base.Strings;
-import com.google.gerrit.extensions.restapi.AuthException;
-import com.google.gerrit.extensions.restapi.ResourceConflictException;
-import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.extensions.restapi.RestModifyView;
 import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.config.ConfigResource;
@@ -59,14 +58,20 @@
 
   @Override
   public Response<String> apply(ServiceUserResource rsrc, Input input)
-      throws AuthException, ResourceConflictException, ConfigInvalidException,
-          ResourceNotFoundException, IOException, PermissionBackendException {
+      throws ConfigInvalidException, IOException, PermissionBackendException, RestApiException,
+          RuntimeException {
     if (input == null) {
       input = new Input();
     }
     input.httpPassword = Strings.emptyToNull(input.httpPassword);
 
-    Boolean httpPasswordAllowed = getConfig.get().apply(new ConfigResource()).allowHttpPassword;
+    Boolean httpPasswordAllowed;
+    try {
+      httpPasswordAllowed = getConfig.get().apply(new ConfigResource()).value().allowHttpPassword;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
+
     if (input.generate || input.httpPassword == null) {
       if ((httpPasswordAllowed == null || !httpPasswordAllowed)) {
         permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
index f444380..7d6e10d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/PutOwner.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
 import static com.google.gerrit.server.permissions.GlobalPermission.ADMINISTRATE_SERVER;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.KEY_OWNER;
 import static com.googlesource.gerrit.plugins.serviceuser.CreateServiceUser.USER;
@@ -88,7 +89,12 @@
   public Response<GroupInfo> apply(ServiceUserResource rsrc, Input input)
       throws RestApiException, IOException, PermissionBackendException {
     ProjectLevelConfig storage = projectCache.getAllProjects().getConfig(pluginName + ".db");
-    Boolean ownerAllowed = getConfig.get().apply(new ConfigResource()).allowOwner;
+    Boolean ownerAllowed;
+    try {
+      ownerAllowed = getConfig.get().apply(new ConfigResource()).value().allowOwner;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get configuration", e);
+    }
     if ((ownerAllowed == null || !ownerAllowed)) {
       permissionBackend.user(self.get()).check(ADMINISTRATE_SERVER);
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
index c4090ac..f56679d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/RefUpdateListener.java
@@ -73,7 +73,7 @@
 
           @Override
           public Project.NameKey getProjectNameKey() {
-            return new Project.NameKey(event.getProjectName());
+            return Project.nameKey(event.getProjectName());
           }
 
           @Override
@@ -99,7 +99,7 @@
   }
 
   private void createServiceUserNotes(Event e) {
-    Project.NameKey projectName = new Project.NameKey(e.getProjectName());
+    Project.NameKey projectName = Project.nameKey(e.getProjectName());
     try (Repository git = repoManager.openRepository(projectName)) {
       CreateServiceUserNotes crn = serviceUserNotesFactory.create(projectName, git);
       crn.createNotes(
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
index 066898f..88bfbde 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserCollection.java
@@ -101,7 +101,7 @@
         }
       } else if (!((IdentifiedUser) user)
           .getAccountId()
-          .equals(new Account.Id(storage.get().getInt(USER, username, KEY_CREATOR_ID, -1)))) {
+          .equals(Account.id(storage.get().getInt(USER, username, KEY_CREATOR_ID, -1)))) {
         throw new ResourceNotFoundException(id);
       }
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
index e2f16a6..4158e82 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ServiceUserResolver.java
@@ -14,9 +14,10 @@
 
 package com.googlesource.gerrit.plugins.serviceuser;
 
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
+
 import com.google.gerrit.common.data.GroupDescription;
 import com.google.gerrit.extensions.common.AccountInfo;
-import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
 import com.google.gerrit.extensions.restapi.RestApiException;
 import com.google.gerrit.reviewdb.client.Account;
@@ -31,7 +32,6 @@
 import com.google.gerrit.server.account.GroupMembership;
 import com.google.gerrit.server.group.GroupResolver;
 import com.google.gerrit.server.group.GroupResource;
-import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.gerrit.server.restapi.group.ListMembers;
 import com.google.gerrit.server.util.RequestContext;
 import com.google.gerrit.server.util.ThreadLocalRequestContext;
@@ -39,13 +39,11 @@
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import com.googlesource.gerrit.plugins.serviceuser.GetServiceUser.ServiceUserInfo;
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
-import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.lib.PersonIdent;
 
 @Singleton
@@ -79,8 +77,7 @@
     this.groupResolver = groupResolver;
   }
 
-  ServiceUserInfo getAsServiceUser(PersonIdent committerIdent)
-      throws ConfigInvalidException, IOException, PermissionBackendException, RestApiException {
+  ServiceUserInfo getAsServiceUser(PersonIdent committerIdent) throws RestApiException {
     StringBuilder committer = new StringBuilder();
     committer.append(committerIdent.getName());
     committer.append(" <");
@@ -88,17 +85,20 @@
     committer.append("> ");
 
     try {
-      Account account = resolver.resolve(committer.toString()).asUnique().getAccount();
+      Account account = resolver.resolve(committer.toString()).asUnique().account();
       return getServiceUser
           .get()
-          .apply(new ServiceUserResource(genericUserFactory.create(account.getId())));
+          .apply(new ServiceUserResource(genericUserFactory.create(account.id())))
+          .value();
     } catch (ResourceNotFoundException | UnresolvableAccountException e) {
       return null;
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get service user", e);
     }
   }
 
   List<AccountInfo> listOwners(ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws RestApiException, RuntimeException {
     if (serviceUser.owner == null) {
       return Collections.emptyList();
     }
@@ -149,8 +149,12 @@
       GroupResource rsrc = new GroupResource(ctl);
       lm.setRecursive(true);
       List<AccountInfo> owners = new ArrayList<>();
-      for (AccountInfo a : lm.apply(rsrc)) {
-        owners.add(a);
+      try {
+        for (AccountInfo a : lm.apply(rsrc).value()) {
+          owners.add(a);
+        }
+      } catch (Exception e) {
+        throw asRestApiException("Cannot list group members", e);
       }
       return owners;
     } finally {
@@ -159,11 +163,11 @@
   }
 
   List<AccountInfo> listActiveOwners(ServiceUserInfo serviceUser)
-      throws MethodNotAllowedException, PermissionBackendException {
+      throws RestApiException, RuntimeException {
     List<AccountInfo> activeOwners = new ArrayList<>();
     for (AccountInfo owner : listOwners(serviceUser)) {
-      Optional<AccountState> accountState = accountCache.get(new Account.Id(owner._accountId));
-      if (accountState.isPresent() && accountState.get().getAccount().isActive()) {
+      Optional<AccountState> accountState = accountCache.get(Account.id(owner._accountId));
+      if (accountState.isPresent() && accountState.get().account().isActive()) {
         activeOwners.add(owner);
       }
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
index d8c2176..e4d031b 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serviceuser/ValidateServiceUserCommits.java
@@ -22,15 +22,12 @@
 import com.google.gerrit.server.git.validators.CommitValidationException;
 import com.google.gerrit.server.git.validators.CommitValidationListener;
 import com.google.gerrit.server.git.validators.CommitValidationMessage;
-import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.googlesource.gerrit.plugins.serviceuser.GetServiceUser.ServiceUserInfo;
-import java.io.IOException;
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
-import org.eclipse.jgit.errors.ConfigInvalidException;
 import org.eclipse.jgit.lib.PersonIdent;
 
 @Singleton
@@ -62,8 +59,8 @@
                   committer.getEmailAddress()));
         }
         Optional<AccountState> creator =
-            accountCache.get(new Account.Id(serviceUser.createdBy._accountId));
-        if (!creator.isPresent() || !creator.get().getAccount().isActive()) {
+            accountCache.get(Account.id(serviceUser.createdBy._accountId));
+        if (!creator.isPresent() || !creator.get().account().isActive()) {
           throw new CommitValidationException(
               String.format(
                   "Commit %s of service user %s (%s) is rejected because "
@@ -73,10 +70,7 @@
                   committer.getEmailAddress()));
         }
       }
-    } catch (IOException
-        | ConfigInvalidException
-        | PermissionBackendException
-        | RestApiException e) {
+    } catch (RestApiException e) {
       throw new CommitValidationException(
           "Internal error while checking for service user commits.", e);
     }