zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-21 11:49:37 +02:00
Code Issues Projects Releases Packages Wiki Activity

Remove AUTH_INTERNAL_ONLY (#393)

Browse source 
Endpoints annotated with AUTH_INTERNAL_ONLY used to be accessible
manually with an internal RPC tool that adds App Engine specific HTTP
headers to a request to make it look like it comes from App Engine
(hence internal). This tool is used by admins to hit such endpoints
during debugging, making them effectively AUTH_INTERNAL_OR_ADMIN.

This RPC tool has never been made available outside Google so the open
source admins do not have such ability. A recent change in the RPC tool
made this hack stop working internally as well. This PR replaces all
all occurances of AUTH_INTERNAL_ONLY with AUTH_INTERNAL_OR_ADMIN and
brings the open source build into feature parity with the internal
version.

Also fixed a few issues the router tests.
This commit is contained in:
Lai Jiang 2019-12-04 12:52:18 -05:00 • committed by GitHub
parent 1e1c8cdd80
commit 369c1259fb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
44 changed files with 89 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java
View file

@ -47,7 +47,7 @@ import org.joda.time.DateTime;
path = "/_dr/cron/commitLogCheckpoint",
method = Action.Method.GET,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class CommitLogCheckpointAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java
View file

@ -65,7 +65,7 @@ import org.joda.time.Duration;
@Action(
service = Action.Service.BACKEND,
path = "/_dr/task/deleteOldCommitLogs",
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class DeleteOldCommitLogsAction implements Runnable {
private static final int NUM_MAP_SHARDS = 20;

2
core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java
View file

@ -63,7 +63,7 @@ import org.joda.time.DateTime;
path = ExportCommitLogDiffAction.PATH,
method = Action.Method.POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class ExportCommitLogDiffAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
View file

@ -111,7 +111,7 @@ import org.joda.time.Duration;
@Action(
service = Action.Service.BACKEND,
path = "/_dr/task/deleteContactsAndHosts",
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class DeleteContactsAndHostsAction implements Runnable {
static final String KIND_CONTACT = getKind(ContactResource.class);

2
core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java
View file

@ -55,7 +55,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/task/deleteLoadTestData",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class DeleteLoadTestDataAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/batch/DeleteProberDataAction.java
View file

@ -68,7 +68,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = "/_dr/task/deleteProberData",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class DeleteProberDataAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java
View file

@ -75,7 +75,7 @@ import org.joda.time.DateTime;
@Action(
service = Action.Service.BACKEND,
path = "/_dr/task/expandRecurringBillingEvents",
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class ExpandRecurringBillingEventsAction implements Runnable {
public static final String PARAM_CURSOR_TIME = "cursorTime";

2
core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java
View file

@ -75,7 +75,7 @@ import org.joda.time.Duration;
@Action(
service = Action.Service.BACKEND,
path = "/_dr/task/refreshDnsOnHostRename",
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class RefreshDnsOnHostRenameAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/cron/CommitLogFanoutAction.java
View file

@ -33,7 +33,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/cron/commitLogFanout",
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class CommitLogFanoutAction implements Runnable {
public static final String BUCKET_PARAM = "bucket";

2
core/src/main/java/google/registry/cron/TldFanoutAction.java
View file

@ -87,7 +87,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/cron/fanout",
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class TldFanoutAction implements Runnable {
/** A set of control params to TldFanoutAction that aren't passed down to the executing action. */

2
core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java
View file

@ -52,7 +52,7 @@ import org.joda.time.Duration;
path = PublishDnsUpdatesAction.PATH,
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
public static final String PATH = "/_dr/task/publishDnsUpdates";

2
core/src/main/java/google/registry/dns/ReadDnsQueueAction.java
View file

@ -80,7 +80,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = "/_dr/cron/readDnsQueue",
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class ReadDnsQueueAction implements Runnable {
private static final String PARAM_JITTER_SECONDS = "jitterSeconds";

2
core/src/main/java/google/registry/dns/RefreshDnsAction.java
View file

@ -35,7 +35,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/dnsRefresh",
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class RefreshDnsAction implements Runnable {
private final Clock clock;

2
core/src/main/java/google/registry/export/BackupDatastoreAction.java
View file

@ -45,7 +45,7 @@ import javax.inject.Inject;
path = BackupDatastoreAction.PATH,
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class BackupDatastoreAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/BigqueryPollJobAction.java
View file

@ -51,7 +51,7 @@ import org.joda.time.Duration;
path = BigqueryPollJobAction.PATH,
method = {Action.Method.GET, Action.Method.POST},
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class BigqueryPollJobAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/CheckBackupAction.java
View file

@ -59,7 +59,7 @@ import org.joda.time.format.PeriodFormat;
path = CheckBackupAction.PATH,
method = {POST, GET},
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class CheckBackupAction implements Runnable {
/** Parameter names for passing parameters into this action. */

2
core/src/main/java/google/registry/export/ExportDomainListsAction.java
View file

@ -65,7 +65,7 @@ import org.joda.time.DateTime;
service = Action.Service.BACKEND,
path = "/_dr/task/exportDomainLists",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class ExportDomainListsAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
View file

@ -49,7 +49,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/task/exportPremiumTerms",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class ExportPremiumTermsAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/ExportReservedTermsAction.java
View file

@ -37,7 +37,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/task/exportReservedTerms",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class ExportReservedTermsAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/SyncGroupMembersAction.java
View file

@ -56,7 +56,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = "/_dr/task/syncGroupMembers",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class SyncGroupMembersAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/export/UpdateSnapshotViewAction.java
View file

@ -39,7 +39,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = UpdateSnapshotViewAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class UpdateSnapshotViewAction implements Runnable {
/** Headers for passing parameters into the servlet. */

2
core/src/main/java/google/registry/export/UploadDatastoreBackupAction.java
View file

@ -52,7 +52,7 @@ import javax.inject.Inject;
service = Action.Service.BACKEND,
path = UploadDatastoreBackupAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class UploadDatastoreBackupAction implements Runnable {
/** Parameter names for passing parameters into the servlet. */

2
core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java
View file

@ -60,7 +60,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = SyncRegistrarsSheetAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class SyncRegistrarsSheetAction implements Runnable {
private enum Result {

2
core/src/main/java/google/registry/rde/BrdaCopyAction.java
View file

@ -58,7 +58,7 @@ import org.joda.time.DateTime;
path = BrdaCopyAction.PATH,
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class BrdaCopyAction implements Runnable {
static final String PATH = "/_dr/task/brdaCopy";

2
core/src/main/java/google/registry/rde/RdeReportAction.java
View file

@ -53,7 +53,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = RdeReportAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class RdeReportAction implements Runnable, EscrowTask {
static final String PATH = "/_dr/task/rdeReport";

2
core/src/main/java/google/registry/rde/RdeStagingAction.java
View file

@ -195,7 +195,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = RdeStagingAction.PATH,
method = {GET, POST},
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class RdeStagingAction implements Runnable {
public static final String PATH = "/_dr/task/rdeStaging";

2
core/src/main/java/google/registry/rde/RdeUploadAction.java
View file

@ -84,7 +84,7 @@ import org.joda.time.Duration;
service = Action.Service.BACKEND,
path = RdeUploadAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class RdeUploadAction implements Runnable, EscrowTask {
static final String PATH = "/_dr/task/rdeUpload";

2
core/src/main/java/google/registry/reporting/billing/GenerateInvoicesAction.java
View file

@ -50,7 +50,7 @@ import org.joda.time.YearMonth;
service = Action.Service.BACKEND,
path = GenerateInvoicesAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class GenerateInvoicesAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java
View file

@ -68,7 +68,7 @@ import org.joda.time.format.DateTimeFormat;
service = Action.Service.BACKEND,
path = IcannReportingStagingAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class IcannReportingStagingAction implements Runnable {
static final String PATH = "/_dr/task/icannReportingStaging";

2
core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java
View file

@ -49,7 +49,7 @@ import org.joda.time.LocalDate;
service = Action.Service.BACKEND,
path = GenerateSpec11ReportAction.PATH,
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class GenerateSpec11ReportAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

10
core/src/main/java/google/registry/request/auth/Auth.java
View file

@ -73,15 +73,7 @@ public enum Auth {
AUTH_INTERNAL_OR_ADMIN(
ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API),
AuthLevel.APP,
UserPolicy.ADMIN),
/**
* Allows only internal (App Engine task-queue) access.
*/
AUTH_INTERNAL_ONLY(
ImmutableList.of(AuthMethod.INTERNAL),
AuthLevel.APP,
UserPolicy.IGNORED);
UserPolicy.ADMIN);
private final AuthSettings authSettings;

2
core/src/main/java/google/registry/tmch/NordnUploadAction.java
View file

@ -74,7 +74,7 @@ import org.joda.time.Duration;
path = NordnUploadAction.PATH,
method = Action.Method.POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class NordnUploadAction implements Runnable {
static final String PATH = "/_dr/task/nordnUpload";

2
core/src/main/java/google/registry/tmch/NordnVerifyAction.java
View file

@ -56,7 +56,7 @@ import javax.inject.Inject;
path = NordnVerifyAction.PATH,
method = Action.Method.POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class NordnVerifyAction implements Runnable {
static final String PATH = "/_dr/task/nordnVerify";

2
core/src/main/java/google/registry/tmch/TmchCrlAction.java
View file

@ -32,7 +32,7 @@ import javax.inject.Inject;
path = "/_dr/task/tmchCrl",
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class TmchCrlAction implements Runnable {
@Inject Marksdb marksdb;

2
core/src/main/java/google/registry/tmch/TmchDnlAction.java
View file

@ -36,7 +36,7 @@ import org.bouncycastle.openpgp.PGPException;
path = "/_dr/task/tmchDnl",
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class TmchDnlAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/tmch/TmchSmdrlAction.java
View file

@ -34,7 +34,7 @@ import org.bouncycastle.openpgp.PGPException;
path = "/_dr/task/tmchSmdrl",
method = POST,
automaticallyPrintOk = true,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public final class TmchSmdrlAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();

2
core/src/main/java/google/registry/tools/server/KillAllCommitLogsAction.java
View file

@ -48,7 +48,7 @@ import javax.inject.Inject;
service = Action.Service.TOOLS,
path = "/_dr/task/killAllCommitLogs",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class KillAllCommitLogsAction implements Runnable {
@Inject MapreduceRunner mrRunner;

2
core/src/main/java/google/registry/tools/server/KillAllEppResourcesAction.java
View file

@ -44,7 +44,7 @@ import javax.inject.Inject;
service = Action.Service.TOOLS,
path = "/_dr/task/killAllEppResources",
method = POST,
auth = Auth.AUTH_INTERNAL_ONLY)
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class KillAllEppResourcesAction implements Runnable {
@Inject MapreduceRunner mrRunner;

12
core/src/test/java/google/registry/request/RouterTest.java
View file

@ -16,7 +16,7 @@ package google.registry.request;
import static com.google.common.truth.Truth.assertThat;
import static com.google.common.truth.Truth8.assertThat;
import static google.registry.request.auth.Auth.AUTH_INTERNAL_ONLY;
import static google.registry.request.auth.Auth.AUTH_INTERNAL_OR_ADMIN;
import static google.registry.testing.JUnitBackports.assertThrows;
import java.util.Optional;
@ -45,7 +45,7 @@ public final class RouterTest {
////////////////////////////////////////////////////////////////////////////////////////////////
@Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_ONLY)
@Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_OR_ADMIN)
public static final class SlothTask implements Runnable {
@Override
public void run() {}
@ -79,7 +79,7 @@ public final class RouterTest {
service = Action.Service.DEFAULT,
path = "/prefix",
isPrefix = true,
auth = AUTH_INTERNAL_ONLY)
auth = AUTH_INTERNAL_OR_ADMIN)
public static final class PrefixTask implements Runnable {
@Override
public void run() {}
@ -109,7 +109,7 @@ public final class RouterTest {
service = Action.Service.DEFAULT,
path = "/prefix/long",
isPrefix = true,
auth = AUTH_INTERNAL_ONLY)
auth = AUTH_INTERNAL_OR_ADMIN)
public static final class LongTask implements Runnable {
@Override
public void run() {}
@ -164,7 +164,7 @@ public final class RouterTest {
@Action(
service = Action.Service.DEFAULT,
path = "/samePathAsOtherTask",
auth = AUTH_INTERNAL_ONLY)
auth = AUTH_INTERNAL_OR_ADMIN)
public static final class DuplicateTask1 implements Runnable {
@Override
public void run() {}
@ -173,7 +173,7 @@ public final class RouterTest {
@Action(
service = Action.Service.DEFAULT,
path = "/samePathAsOtherTask",
auth = AUTH_INTERNAL_ONLY)
auth = AUTH_INTERNAL_OR_ADMIN)
public static final class DuplicateTask2 implements Runnable {
@Override
public void run() {}

6
core/src/test/java/google/registry/request/auth/RequestAuthenticatorTest.java
View file

@ -53,7 +53,7 @@ public class RequestAuthenticatorTest {
AuthLevel.NONE,
UserPolicy.IGNORED);
private static final AuthSettings AUTH_INTERNAL_ONLY = AuthSettings.create(
private static final AuthSettings AUTH_INTERNAL_OR_ADMIN = AuthSettings.create(
ImmutableList.of(AuthMethod.INTERNAL),
AuthLevel.APP,
UserPolicy.IGNORED);
@ -157,7 +157,7 @@ public class RequestAuthenticatorTest {
@Test
public void testInternalAuth_notInvokedInternally() {
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
verifyZeroInteractions(mockUserService);
assertThat(authResult).isEmpty();
@ -167,7 +167,7 @@ public class RequestAuthenticatorTest {
public void testInternalAuth_success() {
when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
verifyZeroInteractions(mockUserService);
assertThat(authResult).isPresent();

10
core/src/test/java/google/registry/testing/GoldenFileTestHelper.java
View file

@ -37,18 +37,18 @@ public class GoldenFileTestHelper {
String goldenFileDescription = null;
private static final String UPDATE_COMMAND =
"nomulus -e localhost %1$s > %2$s";
"../gradlew nomulus && java -jar build/libs/nomulus.jar -e localhost %s > %s";
private static final String UPDATE_INSTRUCTIONS =
Joiner.on('\n')
.join(
"",
"-------------------------------------------------------------------------------",
"Your changes affect the %3$s. To update the checked-in version, run:",
"Your changes affect the %s. To update the checked-in version, run the following"
+ " command in the core project:",
UPDATE_COMMAND,
"");
public static GoldenFileTestHelper assertThat(String actualValue) {
return new GoldenFileTestHelper().setActualValue(actualValue);
}
@ -82,9 +82,9 @@ public class GoldenFileTestHelper {
actualValue, expectedValue);
assertWithMessage(
UPDATE_INSTRUCTIONS,
goldenFileDescription,
nomulusCommand,
filePath(context, filename),
goldenFileDescription)
filePath(context, filename))
.fail();
}
}

70
core/src/test/resources/google/registry/module/backend/backend_routing.txt
View file

@ -1,43 +1,43 @@
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
/_dr/cron/commitLogCheckpoint CommitLogCheckpointAction GET y INTERNAL APP IGNORED
/_dr/cron/commitLogFanout CommitLogFanoutAction GET y INTERNAL APP IGNORED
/_dr/cron/fanout TldFanoutAction GET y INTERNAL APP IGNORED
/_dr/cron/readDnsQueue ReadDnsQueueAction GET y INTERNAL APP IGNORED
/_dr/dnsRefresh RefreshDnsAction GET y INTERNAL APP IGNORED
/_dr/task/backupDatastore BackupDatastoreAction POST y INTERNAL APP IGNORED
/_dr/task/brdaCopy BrdaCopyAction POST y INTERNAL APP IGNORED
/_dr/task/checkDatastoreBackup CheckBackupAction POST,GET y INTERNAL APP IGNORED
/_dr/cron/commitLogCheckpoint CommitLogCheckpointAction GET y INTERNAL,API APP ADMIN
/_dr/cron/commitLogFanout CommitLogFanoutAction GET y INTERNAL,API APP ADMIN
/_dr/cron/fanout TldFanoutAction GET y INTERNAL,API APP ADMIN
/_dr/cron/readDnsQueue ReadDnsQueueAction GET y INTERNAL,API APP ADMIN
/_dr/dnsRefresh RefreshDnsAction GET y INTERNAL,API APP ADMIN
/_dr/task/backupDatastore BackupDatastoreAction POST y INTERNAL,API APP ADMIN
/_dr/task/brdaCopy BrdaCopyAction POST y INTERNAL,API APP ADMIN
/_dr/task/checkDatastoreBackup CheckBackupAction POST,GET y INTERNAL,API APP ADMIN
/_dr/task/copyDetailReports CopyDetailReportsAction POST n INTERNAL,API APP ADMIN
/_dr/task/deleteContactsAndHosts DeleteContactsAndHostsAction GET n INTERNAL APP IGNORED
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n INTERNAL APP IGNORED
/_dr/task/deleteOldCommitLogs DeleteOldCommitLogsAction GET n INTERNAL APP IGNORED
/_dr/task/deleteProberData DeleteProberDataAction POST n INTERNAL APP IGNORED
/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET n INTERNAL APP IGNORED
/_dr/task/exportCommitLogDiff ExportCommitLogDiffAction POST y INTERNAL APP IGNORED
/_dr/task/exportDomainLists ExportDomainListsAction POST n INTERNAL APP IGNORED
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n INTERNAL APP IGNORED
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n INTERNAL APP IGNORED
/_dr/task/generateInvoices GenerateInvoicesAction POST n INTERNAL APP IGNORED
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n INTERNAL APP IGNORED
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n INTERNAL APP IGNORED
/_dr/task/deleteContactsAndHosts DeleteContactsAndHostsAction GET n INTERNAL,API APP ADMIN
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n INTERNAL,API APP ADMIN
/_dr/task/deleteOldCommitLogs DeleteOldCommitLogsAction GET n INTERNAL,API APP ADMIN
/_dr/task/deleteProberData DeleteProberDataAction POST n INTERNAL,API APP ADMIN
/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET n INTERNAL,API APP ADMIN
/_dr/task/exportCommitLogDiff ExportCommitLogDiffAction POST y INTERNAL,API APP ADMIN
/_dr/task/exportDomainLists ExportDomainListsAction POST n INTERNAL,API APP ADMIN
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n INTERNAL,API APP ADMIN
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n INTERNAL,API APP ADMIN
/_dr/task/generateInvoices GenerateInvoicesAction POST n INTERNAL,API APP ADMIN
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n INTERNAL,API APP ADMIN
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n INTERNAL,API APP ADMIN
/_dr/task/icannReportingUpload IcannReportingUploadAction POST n INTERNAL,API APP ADMIN
/_dr/task/nordnUpload NordnUploadAction POST y INTERNAL APP IGNORED
/_dr/task/nordnVerify NordnVerifyAction POST y INTERNAL APP IGNORED
/_dr/task/pollBigqueryJob BigqueryPollJobAction GET,POST y INTERNAL APP IGNORED
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y INTERNAL APP IGNORED
/_dr/task/nordnUpload NordnUploadAction POST y INTERNAL,API APP ADMIN
/_dr/task/nordnVerify NordnVerifyAction POST y INTERNAL,API APP ADMIN
/_dr/task/pollBigqueryJob BigqueryPollJobAction GET,POST y INTERNAL,API APP ADMIN
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y INTERNAL,API APP ADMIN
/_dr/task/publishInvoices PublishInvoicesAction POST n INTERNAL,API APP ADMIN
/_dr/task/publishSpec11 PublishSpec11ReportAction POST n INTERNAL,API APP ADMIN
/_dr/task/rdeReport RdeReportAction POST n INTERNAL APP IGNORED
/_dr/task/rdeStaging RdeStagingAction GET,POST n INTERNAL APP IGNORED
/_dr/task/rdeUpload RdeUploadAction POST n INTERNAL APP IGNORED
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction GET n INTERNAL APP IGNORED
/_dr/task/rdeReport RdeReportAction POST n INTERNAL,API APP ADMIN
/_dr/task/rdeStaging RdeStagingAction GET,POST n INTERNAL,API APP ADMIN
/_dr/task/rdeUpload RdeUploadAction POST n INTERNAL,API APP ADMIN
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction GET n INTERNAL,API APP ADMIN
/_dr/task/resaveAllEppResources ResaveAllEppResourcesAction GET n INTERNAL,API APP ADMIN
/_dr/task/resaveEntity ResaveEntityAction POST n INTERNAL,API APP ADMIN
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n INTERNAL APP IGNORED
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n INTERNAL APP IGNORED
/_dr/task/tmchCrl TmchCrlAction POST y INTERNAL APP IGNORED
/_dr/task/tmchDnl TmchDnlAction POST y INTERNAL APP IGNORED
/_dr/task/tmchSmdrl TmchSmdrlAction POST y INTERNAL APP IGNORED
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n INTERNAL,API APP ADMIN
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n INTERNAL,API APP ADMIN
/_dr/task/tmchCrl TmchCrlAction POST y INTERNAL,API APP ADMIN
/_dr/task/tmchDnl TmchDnlAction POST y INTERNAL,API APP ADMIN
/_dr/task/tmchSmdrl TmchSmdrlAction POST y INTERNAL,API APP ADMIN
/_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y INTERNAL,API APP ADMIN
/_dr/task/updateSnapshotView UpdateSnapshotViewAction POST n INTERNAL APP IGNORED
/_dr/task/uploadDatastoreBackup UploadDatastoreBackupAction POST n INTERNAL APP IGNORED
/_dr/task/updateSnapshotView UpdateSnapshotViewAction POST n INTERNAL,API APP ADMIN
/_dr/task/uploadDatastoreBackup UploadDatastoreBackupAction POST n INTERNAL,API APP ADMIN

4
core/src/test/resources/google/registry/module/tools/tools_routing.txt
View file

@ -13,8 +13,8 @@ PATH CLASS METHODS OK AUTH
/_dr/epptool EppToolAction POST n INTERNAL,API APP ADMIN
/_dr/loadtest LoadTestAction POST y INTERNAL,API APP ADMIN
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n INTERNAL,API APP ADMIN
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n INTERNAL APP IGNORED
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n INTERNAL APP IGNORED
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n INTERNAL,API APP ADMIN
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n INTERNAL,API APP ADMIN
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n INTERNAL,API APP ADMIN
/_dr/task/resaveAllHistoryEntries ResaveAllHistoryEntriesAction GET n INTERNAL,API APP ADMIN
/_dr/task/restoreCommitLogs RestoreCommitLogsAction POST y INTERNAL,API APP ADMIN

5
docs/authentication-framework.md
View file

@ -117,11 +117,6 @@ make sense. A master enumeration lists all the valid triplets. They are:
because we don't require a user for internal requests, but the user policy
is `ADMIN`, meaning that if there *is* a user, it needs to be an admin.
* `AUTH_INTERNAL_ONLY`: Only internal requests are allowed. This is appropriate
for actions which are only executed by cron jobs, and therefore have no
authenticated user. The method is `INTERNAL`, the minimum level is `APP`,
and the user policy is `IGNORED`.
* `AUTH_PUBLIC_OR_INTERNAL`: Allows anyone access, as long as they use OAuth to
authenticate. Also allows access from App Engine task-queue. Note that OAuth
client ID still needs to be whitelisted in the config file for OAuth-based