mv com/google/domain/registry google/registry

This change renames directories in preparation for the great package
rename. The repository is now in a broken state because the code
itself hasn't been updated. However this should ensure that git
correctly preserves history for each file.

java/google/registry/flows/host/HostCheckFlow.java

@@ -0,0 +1,45 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import static com.google.domain.registry.model.EppResourceUtils.checkResourcesExist;
+
+import com.google.common.collect.ImmutableList;
+import com.google.domain.registry.flows.ResourceCheckFlow;
+import com.google.domain.registry.model.eppoutput.CheckData;
+import com.google.domain.registry.model.eppoutput.CheckData.HostCheck;
+import com.google.domain.registry.model.eppoutput.CheckData.HostCheckData;
+import com.google.domain.registry.model.host.HostCommand.Check;
+import com.google.domain.registry.model.host.HostResource;
+
+import java.util.Set;
+
+/**
+ * An EPP flow that checks whether a host can be provisioned.
+ *
+ * @error {@link com.google.domain.registry.flows.ResourceCheckFlow.TooManyResourceChecksException}
+ */
+public class HostCheckFlow extends ResourceCheckFlow<HostResource, Check> {
+  @Override
+  protected CheckData getCheckData() {
+    Set<String> existingIds = checkResourcesExist(resourceClass, targetIds, now);
+    ImmutableList.Builder<HostCheck> checks = new ImmutableList.Builder<>();
+    for (String id : targetIds) {
+      boolean unused = !existingIds.contains(id);
+      checks.add(HostCheck.create(unused, id, unused ? null : "In use"));
+    }
+    return HostCheckData.create(checks.build());
+  }
+}

java/google/registry/flows/host/HostCreateFlow.java

@@ -0,0 +1,143 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import static com.google.domain.registry.flows.host.HostFlowUtils.lookupSuperordinateDomain;
+import static com.google.domain.registry.flows.host.HostFlowUtils.validateHostName;
+import static com.google.domain.registry.flows.host.HostFlowUtils.verifyDomainIsSameRegistrar;
+import static com.google.domain.registry.model.EppResourceUtils.createContactHostRoid;
+import static com.google.domain.registry.model.eppoutput.Result.Code.Success;
+import static com.google.domain.registry.model.ofy.ObjectifyService.ofy;
+import static com.google.domain.registry.util.CollectionUtils.isNullOrEmpty;
+
+import com.google.common.base.Optional;
+import com.google.domain.registry.dns.DnsQueue;
+import com.google.domain.registry.flows.EppException;
+import com.google.domain.registry.flows.EppException.ParameterValueRangeErrorException;
+import com.google.domain.registry.flows.EppException.RequiredParameterMissingException;
+import com.google.domain.registry.flows.ResourceCreateFlow;
+import com.google.domain.registry.model.domain.DomainResource;
+import com.google.domain.registry.model.eppoutput.CreateData.HostCreateData;
+import com.google.domain.registry.model.eppoutput.EppOutput;
+import com.google.domain.registry.model.host.HostCommand.Create;
+import com.google.domain.registry.model.host.HostResource;
+import com.google.domain.registry.model.host.HostResource.Builder;
+import com.google.domain.registry.model.ofy.ObjectifyService;
+import com.google.domain.registry.model.reporting.HistoryEntry;
+
+import com.googlecode.objectify.Ref;
+
+/**
+ * An EPP flow that creates a new host resource.
+ *
+ * @error {@link com.google.domain.registry.flows.EppXmlTransformer.IpAddressVersionMismatchException}
+ * @error {@link com.google.domain.registry.flows.ResourceCreateFlow.ResourceAlreadyExistsException}
+ * @error {@link HostFlowUtils.HostNameTooLongException}
+ * @error {@link HostFlowUtils.HostNameTooShallowException}
+ * @error {@link HostFlowUtils.InvalidHostNameException}
+ * @error {@link HostFlowUtils.SuperordinateDomainDoesNotExistException}
+ * @error {@link SubordinateHostMustHaveIpException}
+ * @error {@link UnexpectedExternalHostIpException}
+ */
+public class HostCreateFlow extends ResourceCreateFlow<HostResource, Builder, Create> {
+
+  /**
+   * The superordinate domain of the host object if creating an in-bailiwick host, or null if
+   * creating an external host. This is looked up before we actually create the Host object so that
+   * we can detect error conditions earlier. By the time {@link #setCreateProperties} is called
+   * (where this reference is actually used), we no longer have the ability to return an
+   * {@link EppException}.
+   *
+   * <p>The general model of these classes is to do validation of parameters up front before we get
+   * to the actual object creation, which is why this class looks up and stores the superordinate
+   * domain ahead of time.
+   */
+  private Optional<Ref<DomainResource>> superordinateDomain;
+
+  @Override
+  protected void initResourceCreateOrMutateFlow() throws EppException {
+    superordinateDomain = Optional.fromNullable(lookupSuperordinateDomain(
+        validateHostName(command.getFullyQualifiedHostName()), now));
+  }
+
+  @Override
+  protected String createFlowRepoId() {
+    return createContactHostRoid(ObjectifyService.allocateId());
+  }
+
+  @Override
+  protected void verifyCreateIsAllowed() throws EppException {
+    verifyDomainIsSameRegistrar(superordinateDomain.orNull(), getClientId());
+    boolean willBeSubordinate = superordinateDomain.isPresent();
+    boolean hasIpAddresses = !isNullOrEmpty(command.getInetAddresses());
+    if (willBeSubordinate != hasIpAddresses) {
+      // Subordinate hosts must have ip addresses and external hosts must not have them.
+      throw willBeSubordinate
+          ? new SubordinateHostMustHaveIpException()
+          : new UnexpectedExternalHostIpException();
+    }
+  }
+
+  @Override
+  protected void setCreateProperties(Builder builder) {
+    if (superordinateDomain.isPresent()) {
+      builder.setSuperordinateDomain(superordinateDomain.get());
+    }
+  }
+
+  /** Modify any other resources that need to be informed of this create. */
+  @Override
+  protected void modifyCreateRelatedResources() {
+    if (superordinateDomain.isPresent()) {
+      ofy().save().entity(superordinateDomain.get().get().asBuilder()
+          .addSubordinateHost(command.getFullyQualifiedHostName())
+          .build());
+    }
+  }
+
+  @Override
+  protected void enqueueTasks() {
+    // Only update DNS if this is a subordinate host. External hosts have no glue to write, so they
+    // are only written as NS records from the referencing domain.
+    if (superordinateDomain.isPresent()) {
+      DnsQueue.create().addHostRefreshTask(newResource.getFullyQualifiedHostName());
+    }
+  }
+
+  @Override
+  protected final HistoryEntry.Type getHistoryEntryType() {
+    return HistoryEntry.Type.HOST_CREATE;
+  }
+
+  @Override
+  protected EppOutput getOutput() {
+    return createOutput(Success,
+        HostCreateData.create(newResource.getFullyQualifiedHostName(), now));
+  }
+
+  /** Subordinate hosts must have an ip address. */
+  static class SubordinateHostMustHaveIpException extends RequiredParameterMissingException {
+    public SubordinateHostMustHaveIpException() {
+      super("Subordinate hosts must have an ip address");
+    }
+  }
+
+  /** External hosts must not have ip addresses. */
+  static class UnexpectedExternalHostIpException extends ParameterValueRangeErrorException {
+    public UnexpectedExternalHostIpException() {
+      super("External hosts must not have ip addresses");
+    }
+  }
+}

java/google/registry/flows/host/HostDeleteFlow.java

@@ -0,0 +1,87 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import static com.google.domain.registry.model.EppResourceUtils.queryDomainsUsingResource;
+import static com.google.domain.registry.model.ofy.ObjectifyService.ofy;
+
+import com.google.common.base.Predicate;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Iterables;
+import com.google.domain.registry.config.RegistryEnvironment;
+import com.google.domain.registry.flows.EppException;
+import com.google.domain.registry.flows.ResourceAsyncDeleteFlow;
+import com.google.domain.registry.flows.async.AsyncFlowUtils;
+import com.google.domain.registry.flows.async.DeleteEppResourceAction;
+import com.google.domain.registry.flows.async.DeleteHostResourceAction;
+import com.google.domain.registry.model.domain.DomainBase;
+import com.google.domain.registry.model.domain.ReferenceUnion;
+import com.google.domain.registry.model.host.HostCommand.Delete;
+import com.google.domain.registry.model.host.HostResource;
+import com.google.domain.registry.model.host.HostResource.Builder;
+import com.google.domain.registry.model.reporting.HistoryEntry;
+
+import com.googlecode.objectify.Key;
+
+/**
+ * An EPP flow that deletes a host resource.
+ *
+ * @error {@link com.google.domain.registry.flows.ResourceAsyncDeleteFlow.ResourceToDeleteIsReferencedException}
+ * @error {@link com.google.domain.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
+ * @error {@link com.google.domain.registry.flows.ResourceMutateFlow.ResourceToMutateDoesNotExistException}
+ * @error {@link com.google.domain.registry.flows.SingleResourceFlow.ResourceStatusProhibitsOperationException}
+ */
+public class HostDeleteFlow extends ResourceAsyncDeleteFlow<HostResource, Builder, Delete> {
+
+  /** In {@link #isLinkedForFailfast}, check this (arbitrary) number of resources from the query. */
+  private static final int FAILFAST_CHECK_COUNT = 5;
+
+  @Override
+  protected boolean isLinkedForFailfast(final ReferenceUnion<HostResource> ref) {
+    // Query for the first few linked domains, and if found, actually load them. The query is
+    // eventually consistent and so might be very stale, but the direct load will not be stale,
+    // just non-transactional. If we find at least one actual reference then we can reliably
+    // fail. If we don't find any, we can't trust the query and need to do the full mapreduce.
+    return Iterables.any(
+        ofy().load().keys(
+            queryDomainsUsingResource(
+                  HostResource.class, ref.getLinked(), now, FAILFAST_CHECK_COUNT)).values(),
+        new Predicate<DomainBase>() {
+            @Override
+            public boolean apply(DomainBase domain) {
+              return domain.getNameservers().contains(ref);
+            }});
+  }
+
+  /** Enqueues a host resource deletion on the mapreduce queue. */
+  @Override
+  protected final void enqueueTasks() throws EppException {
+    AsyncFlowUtils.enqueueMapreduceAction(
+        DeleteHostResourceAction.class,
+        ImmutableMap.of(
+            DeleteEppResourceAction.PARAM_RESOURCE_KEY,
+            Key.create(existingResource).getString(),
+            DeleteEppResourceAction.PARAM_REQUESTING_CLIENT_ID,
+            getClientId(),
+            DeleteEppResourceAction.PARAM_IS_SUPERUSER,
+            Boolean.toString(superuser)),
+        RegistryEnvironment.get().config().getAsyncDeleteFlowMapreduceDelay());
+  }
+
+  @Override
+  protected final HistoryEntry.Type getHistoryEntryType() {
+    return HistoryEntry.Type.HOST_PENDING_DELETE;
+  }
+}

java/google/registry/flows/host/HostFlowUtils.java

@@ -0,0 +1,143 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import static com.google.domain.registry.model.EppResourceUtils.isActive;
+import static com.google.domain.registry.model.EppResourceUtils.loadByUniqueId;
+import static com.google.domain.registry.model.registry.Registries.findTldForName;
+
+import com.google.common.base.Joiner;
+import com.google.common.base.Optional;
+import com.google.common.collect.Iterables;
+import com.google.common.net.InternetDomainName;
+import com.google.domain.registry.flows.EppException;
+import com.google.domain.registry.flows.EppException.AuthorizationErrorException;
+import com.google.domain.registry.flows.EppException.ObjectDoesNotExistException;
+import com.google.domain.registry.flows.EppException.ParameterValuePolicyErrorException;
+import com.google.domain.registry.flows.EppException.ParameterValueRangeErrorException;
+import com.google.domain.registry.flows.EppException.ParameterValueSyntaxErrorException;
+import com.google.domain.registry.model.domain.DomainResource;
+
+import com.googlecode.objectify.Ref;
+
+import org.joda.time.DateTime;
+
+/** Static utility functions for host flows. */
+public class HostFlowUtils {
+
+  /** Checks that a host name is valid. */
+  static InternetDomainName validateHostName(String name) throws EppException {
+    if (name == null) {
+      return null;
+    }
+    if (name.length() > 253) {
+      throw new HostNameTooLongException();
+    }
+    try {
+      InternetDomainName hostName = InternetDomainName.from(name);
+      // Checks whether a hostname is deep enough. Technically a host can be just one under a
+      // public suffix (e.g. example.com) but we require by policy that it has to be at least one
+      // part beyond that (e.g. ns1.example.com). The public suffix list includes all current
+      // ccTlds, so this check requires 4+ parts if it's a ccTld that doesn't delegate second
+      // level domains, such as .co.uk. But the list does not include new tlds, so in that case
+      // we just ensure 3+ parts. In the particular case where our own tld has a '.' in it, we know
+      // that there need to be 4 parts as well.
+      if (hostName.isUnderPublicSuffix()) {
+        if (hostName.parent().isUnderPublicSuffix()) {
+          return hostName;
+        }
+      } else {
+        // We need to know how many parts the hostname has beyond the public suffix, but we don't
+        // know what the public suffix is. If the host is in bailiwick and we are hosting a
+        // multipart "tld" like .co.uk the publix suffix might be 2 parts. Otherwise it's an
+        // unrecognized tld that's not on the public suffix list, so assume the tld alone is the
+        // public suffix.
+        Optional<InternetDomainName> tldParsed = findTldForName(hostName);
+        int suffixSize = tldParsed.isPresent() ? tldParsed.get().parts().size() : 1;
+        if (hostName.parts().size() >= suffixSize + 2) {
+          return hostName;
+        }
+      }
+      throw new HostNameTooShallowException();
+    } catch (IllegalArgumentException e) {
+      throw new InvalidHostNameException();
+    }
+  }
+
+  /** Return the {@link DomainResource} this host is subordinate to, or null for external hosts. */
+  static Ref<DomainResource> lookupSuperordinateDomain(
+      InternetDomainName hostName, DateTime now) throws EppException {
+    Optional<InternetDomainName> tldParsed = findTldForName(hostName);
+    if (!tldParsed.isPresent()) {
+      // This is an host on a TLD we don't run, therefore obviously external, so we are done.
+      return null;
+    }
+
+    // This is a subordinate host
+    @SuppressWarnings("deprecation")
+    String domainName = Joiner.on('.').join(Iterables.skip(
+        hostName.parts(), hostName.parts().size() - (tldParsed.get().parts().size() + 1)));
+    DomainResource superordinateDomain = loadByUniqueId(DomainResource.class, domainName, now);
+    if (superordinateDomain == null || !isActive(superordinateDomain, now)) {
+      throw new SuperordinateDomainDoesNotExistException(domainName);
+    }
+    return Ref.create(superordinateDomain);
+  }
+
+  /** Superordinate domain for this hostname does not exist. */
+  static class SuperordinateDomainDoesNotExistException extends ObjectDoesNotExistException {
+    public SuperordinateDomainDoesNotExistException(String domainName) {
+      super(DomainResource.class, domainName);
+    }
+  }
+
+  /** Ensure that the superordinate domain is sponsored by the provided clientId. */
+  static void verifyDomainIsSameRegistrar(
+      Ref<DomainResource> superordinateDomain,
+      String clientId) throws EppException {
+    if (superordinateDomain != null
+        && !clientId.equals(superordinateDomain.get().getCurrentSponsorClientId())) {
+      throw new HostDomainNotOwnedException();
+    }
+  }
+
+  /** Domain for host is sponsored by another registrar. */
+  static class HostDomainNotOwnedException extends AuthorizationErrorException {
+    public HostDomainNotOwnedException() {
+      super("Domain for host is sponsored by another registrar");
+    }
+  }
+
+  /** Host names are limited to 253 characters. */
+  static class HostNameTooLongException extends ParameterValueRangeErrorException {
+    public HostNameTooLongException() {
+      super("Host names are limited to 253 characters");
+    }
+  }
+
+  /** Host names must be at least two levels below the public suffix. */
+  static class HostNameTooShallowException extends ParameterValuePolicyErrorException {
+    public HostNameTooShallowException() {
+      super("Host names must be at least two levels below the public suffix");
+    }
+  }
+
+  /** Invalid host name. */
+  static class InvalidHostNameException extends ParameterValueSyntaxErrorException {
+    public InvalidHostNameException() {
+      super("Invalid host name");
+    }
+  }
+}

java/google/registry/flows/host/HostInfoFlow.java

@@ -0,0 +1,26 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import com.google.domain.registry.flows.ResourceInfoFlow;
+import com.google.domain.registry.model.host.HostCommand;
+import com.google.domain.registry.model.host.HostResource;
+
+/**
+ * An EPP flow that reads a host.
+ *
+ * @error {@link com.google.domain.registry.flows.ResourceQueryFlow.ResourceToQueryDoesNotExistException}
+ */
+public class HostInfoFlow extends ResourceInfoFlow<HostResource, HostCommand.Info> {}

java/google/registry/flows/host/HostUpdateFlow.java

@@ -0,0 +1,235 @@
+// Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.domain.registry.flows.host;
+
+import static com.google.common.base.MoreObjects.firstNonNull;
+import static com.google.domain.registry.flows.host.HostFlowUtils.lookupSuperordinateDomain;
+import static com.google.domain.registry.flows.host.HostFlowUtils.validateHostName;
+import static com.google.domain.registry.flows.host.HostFlowUtils.verifyDomainIsSameRegistrar;
+import static com.google.domain.registry.model.index.ForeignKeyIndex.loadAndGetReference;
+import static com.google.domain.registry.model.ofy.ObjectifyService.ofy;
+import static com.google.domain.registry.util.CollectionUtils.isNullOrEmpty;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.domain.registry.dns.DnsQueue;
+import com.google.domain.registry.flows.EppException;
+import com.google.domain.registry.flows.EppException.ObjectAlreadyExistsException;
+import com.google.domain.registry.flows.EppException.ParameterValueRangeErrorException;
+import com.google.domain.registry.flows.EppException.RequiredParameterMissingException;
+import com.google.domain.registry.flows.EppException.StatusProhibitsOperationException;
+import com.google.domain.registry.flows.ResourceUpdateFlow;
+import com.google.domain.registry.flows.async.AsyncFlowUtils;
+import com.google.domain.registry.flows.async.DnsRefreshForHostRenameAction;
+import com.google.domain.registry.model.domain.DomainResource;
+import com.google.domain.registry.model.host.HostCommand.Update;
+import com.google.domain.registry.model.host.HostResource;
+import com.google.domain.registry.model.host.HostResource.Builder;
+import com.google.domain.registry.model.index.ForeignKeyIndex;
+import com.google.domain.registry.model.reporting.HistoryEntry;
+
+import com.googlecode.objectify.Key;
+import com.googlecode.objectify.Ref;
+
+import org.joda.time.Duration;
+
+import java.util.Objects;
+
+/**
+ * An EPP flow that updates a host resource.
+ *
+ * @error {@link com.google.domain.registry.flows.ResourceFlowUtils.ResourceNotOwnedException}
+ * @error {@link com.google.domain.registry.flows.ResourceMutateFlow.ResourceToMutateDoesNotExistException}
+ * @error {@link com.google.domain.registry.flows.ResourceUpdateFlow.ResourceHasClientUpdateProhibitedException}
+ * @error {@link com.google.domain.registry.flows.ResourceUpdateFlow.StatusNotClientSettableException}
+ * @error {@link com.google.domain.registry.flows.SingleResourceFlow.ResourceStatusProhibitsOperationException}
+ * @error {@link HostFlowUtils.HostNameTooShallowException}
+ * @error {@link HostFlowUtils.InvalidHostNameException}
+ * @error {@link HostFlowUtils.SuperordinateDomainDoesNotExistException}
+ * @error {@link CannotAddIpToExternalHostException}
+ * @error {@link CannotRemoveSubordinateHostLastIpException}
+ * @error {@link HostAlreadyExistsException}
+ * @error {@link RenameHostToExternalRemoveIpException}
+ * @error {@link RenameHostToSubordinateRequiresIpException}
+ */
+public class HostUpdateFlow extends ResourceUpdateFlow<HostResource, Builder, Update> {
+
+  private Ref<DomainResource> superordinateDomain;
+
+  private String oldHostName;
+  private String newHostName;
+  private boolean isHostRename;
+
+  @Override
+  protected void initResourceCreateOrMutateFlow() throws EppException {
+    String suppliedNewHostName = command.getInnerChange().getFullyQualifiedHostName();
+    isHostRename = suppliedNewHostName != null;
+    oldHostName = targetId;
+    newHostName = firstNonNull(suppliedNewHostName, oldHostName);
+    superordinateDomain =
+        lookupSuperordinateDomain(validateHostName(newHostName), now);
+  }
+
+  @Override
+  protected void verifyUpdateIsAllowed() throws EppException {
+    verifyDomainIsSameRegistrar(superordinateDomain, getClientId());
+    if (isHostRename
+        && loadAndGetReference(HostResource.class, newHostName, now) != null) {
+      throw new HostAlreadyExistsException(newHostName);
+    }
+  }
+
+  @Override
+  protected void verifyNewUpdatedStateIsAllowed() throws EppException {
+    boolean wasExternal = existingResource.getSuperordinateDomain() == null;
+    boolean wasSubordinate = !wasExternal;
+    boolean willBeExternal = superordinateDomain == null;
+    boolean willBeSubordinate = !willBeExternal;
+    boolean newResourceHasIps = !isNullOrEmpty(newResource.getInetAddresses());
+    boolean commandAddsIps = !isNullOrEmpty(command.getInnerAdd().getInetAddresses());
+    // These checks are order-dependent. For example a subordinate-to-external rename that adds new
+    // ips should hit the first exception, whereas one that only fails to remove the existing ips
+    // should hit the second.
+    if (willBeExternal && commandAddsIps) {
+      throw new CannotAddIpToExternalHostException();
+    }
+    if (wasSubordinate && willBeExternal && newResourceHasIps) {
+      throw new RenameHostToExternalRemoveIpException();
+    }
+    if (wasExternal && willBeSubordinate && !commandAddsIps) {
+      throw new RenameHostToSubordinateRequiresIpException();
+    }
+    if (willBeSubordinate && !newResourceHasIps) {
+      throw new CannotRemoveSubordinateHostLastIpException();
+    }
+  }
+
+  @Override
+  protected Builder setUpdateProperties(Builder builder) {
+    // The superordinateDomain can be null if the new name is external.
+    // Note that the value of superordinateDomain is projected to the current time inside of
+    // the lookupSuperordinateDomain(...) call above, so that it will never be stale.
+    builder.setSuperordinateDomain(superordinateDomain);
+    builder.setLastSuperordinateChange(superordinateDomain == null ? null : now);
+    // Rely on the host's cloneProjectedAtTime() method to handle setting of transfer data.
+    return builder.build().cloneProjectedAtTime(now).asBuilder();
+  }
+
+  /** Keep the {@link ForeignKeyIndex} for this host up to date. */
+  @Override
+  protected void modifyRelatedResources() {
+    if (isHostRename) {
+      // Update the foreign key for the old host name.
+      ofy().save().entity(ForeignKeyIndex.create(existingResource, now));
+      // Save the foreign key for the new host name.
+      ofy().save().entity(ForeignKeyIndex.create(newResource, newResource.getDeletionTime()));
+      updateSuperordinateDomains();
+    }
+  }
+
+  @Override
+  public void enqueueTasks() throws EppException {
+    DnsQueue dnsQueue = DnsQueue.create();
+    // Only update DNS for subordinate hosts. External hosts have no glue to write, so they
+    // are only written as NS records from the referencing domain.
+    if (existingResource.getSuperordinateDomain() != null) {
+      dnsQueue.addHostRefreshTask(oldHostName);
+    }
+    // In case of a rename, there are many updates we need to queue up.
+    if (isHostRename) {
+      // If the renamed host is also subordinate, then we must enqueue an update to write the new
+      // glue.
+      if (newResource.getSuperordinateDomain() != null) {
+        dnsQueue.addHostRefreshTask(newHostName);
+      }
+      // We must also enqueue updates for all domains that use this host as their nameserver so
+      // that their NS records can be updated to point at the new name.
+      AsyncFlowUtils.enqueueMapreduceAction(
+          DnsRefreshForHostRenameAction.class,
+          ImmutableMap.of(
+              DnsRefreshForHostRenameAction.PARAM_HOST_KEY,
+              Key.create(existingResource).getString()),
+          Duration.ZERO);
+    }
+  }
+
+  @Override
+  protected final HistoryEntry.Type getHistoryEntryType() {
+    return HistoryEntry.Type.HOST_UPDATE;
+  }
+
+  private void updateSuperordinateDomains() {
+    Ref<DomainResource> oldSuperordinateDomain = existingResource.getSuperordinateDomain();
+    if (oldSuperordinateDomain != null || superordinateDomain != null) {
+      if (Objects.equals(oldSuperordinateDomain, superordinateDomain)) {
+        ofy().save().entity(oldSuperordinateDomain.get().asBuilder()
+            .removeSubordinateHost(oldHostName)
+            .addSubordinateHost(newHostName)
+            .build());
+      } else {
+        if (oldSuperordinateDomain != null) {
+          ofy().save().entity(
+              oldSuperordinateDomain.get()
+                  .asBuilder()
+                  .removeSubordinateHost(oldHostName)
+                  .build());
+        }
+        if (superordinateDomain != null) {
+          ofy().save().entity(
+              superordinateDomain.get()
+                  .asBuilder()
+                  .addSubordinateHost(newHostName)
+                  .build());
+        }
+      }
+    }
+  }
+
+  /** Host with specified name already exists. */
+  static class HostAlreadyExistsException extends ObjectAlreadyExistsException {
+    public HostAlreadyExistsException(String hostName) {
+      super(String.format("Object with given ID (%s) already exists", hostName));
+    }
+  }
+
+  /** Cannot add ip addresses to an external host. */
+  static class CannotAddIpToExternalHostException extends ParameterValueRangeErrorException {
+    public CannotAddIpToExternalHostException() {
+      super("Cannot add ip addresses to external hosts");
+    }
+  }
+
+  /** Cannot remove all ip addresses from a subordinate host. */
+  static class CannotRemoveSubordinateHostLastIpException
+      extends StatusProhibitsOperationException {
+    public CannotRemoveSubordinateHostLastIpException() {
+      super("Cannot remove all ip addresses from a subordinate host");
+    }
+  }
+
+  /** Host rename from external to subordinate must also add an ip addresses. */
+  static class RenameHostToSubordinateRequiresIpException
+      extends RequiredParameterMissingException {
+    public RenameHostToSubordinateRequiresIpException() {
+      super("Host rename from external to subordinate must also add an ip address");
+    }
+  }
+
+  /** Host rename from subordinate to external must also remove all ip addresses. */
+  static class RenameHostToExternalRemoveIpException extends ParameterValueRangeErrorException {
+    public RenameHostToExternalRemoveIpException() {
+      super("Host rename from subordinate to external must also remove all ip addresses");
+    }
+  }
+}