Tailor Diffusion protocol rules slightly

Summary: Fixes T10948. Ref T10923. Make these rules a little more thorough and document their behavior.

Test Plan: Looked at Diffusion clone URIs.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10923, T10948

Differential Revision: https://secure.phabricator.com/D15887

src/applications/repository/storage/PhabricatorRepository.php

@@ -2091,10 +2091,10 @@ final class PhabricatorRepository extends PhabricatorRepositoryDAO
     // HTTP is not supported for Subversion.
     if ($this->isSVN()) {
       $has_http = false;
+      $has_https = false;
     }
 
-    // TODO: Maybe allow users to disable this by default somehow?
-    $has_ssh = true;
+    $has_ssh = (bool)strlen(PhabricatorEnv::getEnvConfig('phd.user'));
 
     $protocol_map = array(
       PhabricatorRepositoryURI::BUILTIN_PROTOCOL_SSH => $has_ssh,

src/docs/user/userguide/diffusion_uris.diviner

@@ -164,6 +164,32 @@ Once you've put a working copy in the right place on disk, activate the
 repository.
 
 
+Builtin Clone URIs
+==================
+
+By default, Phabricator automatically exposes and activates HTTP, HTTPS and
+SSH clone URIs by examining configuration.
+
+**HTTP**: The `http://` clone URI will be available if these conditions are
+satisfied:
+
+  - `diffusion.allow-http-auth` must be enabled.
+  - The repository must be a Git or Mercurial repository.
+  - `security.require-https` must be disabled.
+
+**HTTPS**: The `https://` clone URI will be available if these conditions are
+satisfied:
+
+  - `diffusion.allow-http-auth` must be enabled.
+  - The repository must be a Git or Mercurial repository.
+  - The `phabricator.base-uri` protocol must be `https://`.
+
+**SSH**: The `ssh://` or `svn+ssh://` clone URI will be available if these
+conditions are satisfied:
+
+  - `phd.user` must be configured.
+
+
 Customizing Displayed Clone URIs
 ================================