Add new reserved domain creation from allocation tokens mechanism

Note that this gets rid of anchor tenant codes in reserved lists (yay!), which
are no longer valid.  They have to come from allocation tokens now.

This removes support for LRP from domain application create flow (that's fine,
we never used it and I'm going to delete all of LRP later).  It also uses
allocation tokens from EPP authcodes as a fallback, for now, but that will be
removed later once we switch fully to the allocation token mechanism.

This doesn't yet allow registration of RESERVED_FOR_SPECIFIC_USE domains using
the allocation token extension; that will come in the next CL.  Ditto for
showing these reserved domains as available on domain checks when the allocation
token is specified.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=209019617
This commit is contained in:
mcilwain 2018-08-16 11:41:34 -07:00 committed by jianglai
parent 782643ce33
commit d2f849ac0f
19 changed files with 184 additions and 346 deletions

View file

@ -82,10 +82,12 @@ public class DomainCheckFlowTest
}
private ReservedList createReservedList() {
persistResource(
new AllocationToken.Builder().setDomainName("anchor.tld").setToken("2fooBAR").build());
return persistReservedList(
"tld-reserved",
"reserved,FULLY_BLOCKED",
"anchor,RESERVED_FOR_ANCHOR_TENANT,foo2BAR",
"anchor,RESERVED_FOR_ANCHOR_TENANT",
"allowedinsunrise,ALLOWED_IN_SUNRISE",
"collision,NAME_COLLISION",
"premiumcollision,NAME_COLLISION");

View file

@ -180,6 +180,8 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
@Before
public void initCreateTest() {
createTld("tld");
persistResource(
new AllocationToken.Builder().setToken("abcDEF23456").setDomainName("anchor.tld").build());
persistResource(
Registry.get("tld")
.asBuilder()
@ -187,7 +189,8 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
persistReservedList(
"tld-reserved",
"reserved,FULLY_BLOCKED",
"anchor,RESERVED_FOR_ANCHOR_TENANT,2fooBAR",
"resdom,RESERVED_FOR_SPECIFIC_USE",
"anchor,RESERVED_FOR_ANCHOR_TENANT",
"test-and-validate,NAME_COLLISION",
"badcrash,NAME_COLLISION"))
.build());
@ -404,7 +407,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
@Test
public void testFailure_invalidAllocationToken() {
setEppInput("domain_create_allocationtoken.xml");
setEppInput("domain_create_allocationtoken.xml", ImmutableMap.of("DOMAIN", "example.tld"));
persistContactsAndHosts();
EppException thrown = assertThrows(InvalidAllocationTokenException.class, this::runFlow);
assertAboutEppExceptions().that(thrown).marshalsToXml();
@ -412,7 +415,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
@Test
public void testFailure_alreadyRedemeedAllocationToken() {
setEppInput("domain_create_allocationtoken.xml");
setEppInput("domain_create_allocationtoken.xml", ImmutableMap.of("DOMAIN", "example.tld"));
persistContactsAndHosts();
persistResource(
new AllocationToken.Builder()
@ -427,7 +430,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
@Test
public void testSuccess_validAllocationToken_isRedeemed() throws Exception {
setEppInput("domain_create_allocationtoken.xml");
setEppInput("domain_create_allocationtoken.xml", ImmutableMap.of("DOMAIN", "example.tld"));
persistContactsAndHosts();
AllocationToken token =
persistResource(new AllocationToken.Builder().setToken("abc123").build());
@ -1066,7 +1069,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testFailure_anchorTenantViaAuthCode_wrongAuthCode() {
public void testFailure_anchorTenant_viaAuthCode_wrongAuthCode() {
setEppInput("domain_create_anchor_wrong_authcode.xml");
persistContactsAndHosts();
EppException thrown = assertThrows(DomainReservedException.class, this::runFlow);
@ -1074,7 +1077,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testFailure_anchorTenantViaAuthCode_notTwoYearPeriod() {
public void testFailure_anchorTenant_notTwoYearPeriod() {
setEppInput("domain_create_anchor_authcode_invalid_years.xml");
persistContactsAndHosts();
EppException thrown = assertThrows(AnchorTenantCreatePeriodException.class, this::runFlow);
@ -1082,7 +1085,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testSuccess_anchorTenantViaAuthCode_matchingLrpToken() throws Exception {
public void testSuccess_anchorTenant_viaAuthCode_matchingLrpToken() throws Exception {
// This is definitely a corner case, as (without superuser) anchor tenants may only register
// via auth code during GA. We're running this as superuser to bypass the state checks, though
// anchor tenant code checks and LRP token redemption still happen regardless.
@ -1091,7 +1094,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
Registry.get("tld")
.asBuilder()
.setReservedLists(
persistReservedList("tld-reserved", "anchor,RESERVED_FOR_ANCHOR_TENANT,2fooBAR"))
persistReservedList("tld-reserved", "anchor,RESERVED_FOR_ANCHOR_TENANT"))
.build());
LrpTokenEntity token =
persistResource(
@ -1107,7 +1110,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testSuccess_anchorTenantViaAuthCode() throws Exception {
public void testSuccess_anchorTenant_viaAuthCode() throws Exception {
setEppInput("domain_create_anchor_authcode.xml");
persistContactsAndHosts();
runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
@ -1116,7 +1119,21 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testSuccess_anchorTenantViaAuthCode_duringLrp() throws Exception {
public void testSuccess_anchorTenant_viaAllocationTokenExtension() throws Exception {
setEppInput("domain_create_anchor_allocationtoken.xml");
persistContactsAndHosts();
runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT));
assertNoLordn();
AllocationToken reloadedToken =
ofy().load().key(Key.create(AllocationToken.class, "abcDEF23456")).now();
assertThat(reloadedToken.isRedeemed()).isTrue();
assertThat(reloadedToken.getRedemptionHistoryEntry())
.isEqualTo(Key.create(getHistoryEntries(reloadResourceByForeignKey()).get(0)));
}
@Test
public void testSuccess_anchorTenant_viaAuthCode_duringLrp() throws Exception {
persistResource(
Registry.get("tld")
.asBuilder()
@ -1130,7 +1147,7 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testSuccess_anchorTenantViaExtension_duringLrp() throws Exception {
public void testSuccess_anchorTenant_viaExtension_duringLrp() throws Exception {
persistResource(
Registry.get("tld")
.asBuilder()
@ -1146,13 +1163,15 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
}
@Test
public void testSuccess_anchorTenantViaAuthCode_withClaims() throws Exception {
public void testSuccess_anchorTenant_viaAuthCode_withClaims() throws Exception {
persistResource(
new AllocationToken.Builder().setDomainName("example-one.tld").setToken("2fooBAR").build());
persistResource(
Registry.get("tld")
.asBuilder()
.setReservedLists(
persistReservedList(
"anchor-with-claims", "example-one,RESERVED_FOR_ANCHOR_TENANT,2fooBAR"))
"anchor-with-claims", "example-one,RESERVED_FOR_ANCHOR_TENANT"))
.build());
setEppInput("domain_create_claim_notice.xml");
clock.setTo(DateTime.parse("2009-08-16T09:00:00.0Z"));

View file

@ -3,7 +3,7 @@
<create>
<domain:create
xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
<domain:name>example.tld</domain:name>
<domain:name>%DOMAIN%</domain:name>
<domain:period unit="y">2</domain:period>
<domain:ns>
<domain:hostObj>ns1.example.net</domain:hostObj>

View file

@ -0,0 +1,29 @@
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
<command>
<create>
<domain:create
xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
<domain:name>anchor.tld</domain:name>
<domain:period unit="y">2</domain:period>
<domain:ns>
<domain:hostObj>ns1.example.net</domain:hostObj>
<domain:hostObj>ns2.example.net</domain:hostObj>
</domain:ns>
<domain:registrant>jd1234</domain:registrant>
<domain:contact type="admin">sh8013</domain:contact>
<domain:contact type="tech">sh8013</domain:contact>
<domain:authInfo>
<domain:pw>2fooBAR</domain:pw>
</domain:authInfo>
</domain:create>
</create>
<extension>
<allocationToken:allocationToken
xmlns:allocationToken=
"urn:ietf:params:xml:ns:allocationToken-1.0">
abcDEF23456
</allocationToken:allocationToken>
</extension>
<clTRID>ABC-12345</clTRID>
</command>
</epp>

View file

@ -13,7 +13,7 @@
<domain:contact type="admin">sh8013</domain:contact>
<domain:contact type="tech">sh8013</domain:contact>
<domain:authInfo>
<domain:pw>2fooBAR</domain:pw>
<domain:pw>abcDEF23456</domain:pw>
</domain:authInfo>
</domain:create>
</create>

View file

@ -17,6 +17,13 @@
</domain:authInfo>
</domain:create>
</create>
<extension>
<allocationToken:allocationToken
xmlns:allocationToken=
"urn:ietf:params:xml:ns:allocationToken-1.0">
abcDEF23456
</allocationToken:allocationToken>
</extension>
<clTRID>ABC-12345</clTRID>
</command>
</epp>

View file

@ -37,7 +37,7 @@ public class AllocationTokenTest extends EntityTestCase {
.setToken("abc123")
.setRedemptionHistoryEntry(Key.create(HistoryEntry.class, 1L))
.setDomainName("foo.example")
.setCreationTime(DateTime.parse("2010-11-12T05:00:00Z"))
.setCreationTimeForTest(DateTime.parse("2010-11-12T05:00:00Z"))
.build());
assertThat(ofy().load().entity(token).now()).isEqualTo(token);
}
@ -49,7 +49,7 @@ public class AllocationTokenTest extends EntityTestCase {
new AllocationToken.Builder()
.setToken("abc123")
.setDomainName("blahdomain.fake")
.setCreationTime(DateTime.parse("2010-11-12T05:00:00Z"))
.setCreationTimeForTest(DateTime.parse("2010-11-12T05:00:00Z"))
.build()),
"token",
"domainName");
@ -69,11 +69,11 @@ public class AllocationTokenTest extends EntityTestCase {
AllocationToken.Builder builder =
new AllocationToken.Builder()
.setToken("foobar")
.setCreationTime(DateTime.parse("2010-11-12T05:00:00Z"));
.setCreationTimeForTest(DateTime.parse("2010-11-12T05:00:00Z"));
IllegalStateException thrown =
assertThrows(
IllegalStateException.class,
() -> builder.setCreationTime(DateTime.parse("2010-11-13T05:00:00Z")));
() -> builder.setCreationTimeForTest(DateTime.parse("2010-11-13T05:00:00Z")));
assertThat(thrown).hasMessageThat().isEqualTo("creationTime can only be set once");
}

View file

@ -180,46 +180,6 @@ public class RegistryTest extends EntityTestCase {
assertThat(r.getReservedLists()).isEmpty();
}
@Test
public void testSetReservedLists_succeedsWithDuplicateIdenticalAuthCodes() {
ReservedList rl1 = persistReservedList(
"tld-reserved007",
"lol,RESERVED_FOR_ANCHOR_TENANT,identical",
"cat,FULLY_BLOCKED");
ReservedList rl2 = persistReservedList(
"tld-reserved008",
"lol,RESERVED_FOR_ANCHOR_TENANT,identical",
"tim,FULLY_BLOCKED");
Registry registry = Registry.get("tld").asBuilder().setReservedLists(rl1, rl2).build();
assertThat(registry.getReservedLists()).containsExactly(Key.create(rl1), Key.create(rl2));
}
@Test
public void testSetReservedLists_failsForConflictingAuthCodes() {
ReservedList rl1 = persistReservedList(
"tld-reserved055",
"lol,RESERVED_FOR_ANCHOR_TENANT,conflict1",
"cat,FULLY_BLOCKED");
ReservedList rl2 = persistReservedList(
"tld-reserved056",
"lol,RESERVED_FOR_ANCHOR_TENANT,conflict2",
"tim,FULLY_BLOCKED");
ReservedList rl3 = persistReservedList(
"tld-reserved057",
"lol,RESERVED_FOR_ANCHOR_TENANT,another_conflict");
IllegalArgumentException thrown =
assertThrows(
IllegalArgumentException.class,
() -> {
@SuppressWarnings("unused")
Registry unused =
Registry.get("tld").asBuilder().setReservedLists(rl1, rl2, rl3).build();
});
assertThat(thrown)
.hasMessageThat()
.contains("auth code conflicts for labels: [lol=[conflict1, conflict2, another_conflict]]");
}
@Test
public void testSetPremiumList() {
PremiumList pl2 = persistPremiumList("tld2", "lol,USD 50", "cat,USD 700");

View file

@ -23,13 +23,10 @@ import static google.registry.model.registry.label.DomainLabelMetrics.reservedLi
import static google.registry.model.registry.label.DomainLabelMetrics.reservedListProcessingTime;
import static google.registry.model.registry.label.ReservationType.ALLOWED_IN_SUNRISE;
import static google.registry.model.registry.label.ReservationType.FULLY_BLOCKED;
import static google.registry.model.registry.label.ReservationType.MISTAKEN_PREMIUM;
import static google.registry.model.registry.label.ReservationType.NAMESERVER_RESTRICTED;
import static google.registry.model.registry.label.ReservationType.NAME_COLLISION;
import static google.registry.model.registry.label.ReservationType.RESERVED_FOR_ANCHOR_TENANT;
import static google.registry.model.registry.label.ReservedList.getAllowedNameservers;
import static google.registry.model.registry.label.ReservedList.getReservationTypes;
import static google.registry.model.registry.label.ReservedList.matchesAnchorTenantReservation;
import static google.registry.testing.DatastoreHelper.createTld;
import static google.registry.testing.DatastoreHelper.persistReservedList;
import static google.registry.testing.DatastoreHelper.persistResource;
@ -118,47 +115,6 @@ public class ReservedListTest {
verifyUnreservedCheckCount(26);
}
@Test
public void testMatchesAnchorTenantReservation() {
persistResource(
Registry.get("tld")
.asBuilder()
.setReservedLists(ImmutableSet.of(
persistReservedList(
"reserved1",
"lol,RESERVED_FOR_ANCHOR_TENANT,foobar1",
"lol2,RESERVED_FOR_ANCHOR_TENANT,abcdefg # This is a comment")))
.build());
assertThat(getReservationTypes("lol", "tld")).containsExactly(RESERVED_FOR_ANCHOR_TENANT);
assertThat(getReservationTypes("lol2", "tld")).containsExactly(RESERVED_FOR_ANCHOR_TENANT);
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "foobar1"))
.isTrue();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "foobar"))
.isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol2.tld"), "abcdefg"))
.isTrue();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol2.tld"), "abcdefg "))
.isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("random.tld"), "abcdefg"))
.isFalse();
assertThat(reservedListChecks)
.hasValueForLabels(1, "tld", "0", "(none)", "(none)")
.and()
.hasValueForLabels(6, "tld", "1", "reserved1", RESERVED_FOR_ANCHOR_TENANT.toString())
.and()
.hasNoOtherValues();
assertThat(reservedListProcessingTime)
.hasAnyValueForLabels("tld", "0", "(none)", "(none)")
.and()
.hasAnyValueForLabels("tld", "1", "reserved1", RESERVED_FOR_ANCHOR_TENANT.toString())
.and()
.hasNoOtherValues();
assertThat(reservedListHits)
.hasValueForLabels(6, "tld", "reserved1", RESERVED_FOR_ANCHOR_TENANT.toString())
.and()
.hasNoOtherValues();
}
@Test
public void testGetAllowedNameservers() {
ReservedList rl1 =
@ -191,87 +147,6 @@ public class ReservedListTest {
assertThat(getAllowedNameservers(InternetDomainName.from("lol4.tld"))).isEmpty();
}
@Test
public void testMatchesAnchorTenantReservation_falseOnOtherReservationTypes() {
persistResource(
Registry.get("tld")
.asBuilder()
.setReservedLists(
ImmutableSet.of(
persistReservedList(
"reserved2",
"lol,FULLY_BLOCKED",
"lol2,NAME_COLLISION",
"lol3,MISTAKEN_PREMIUM",
"lol4,ALLOWED_IN_SUNRISE",
"lol5,NAMESERVER_RESTRICTED,na1.domain.tld")))
.build());
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "")).isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol2.tld"), "")).isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol3.tld"), "")).isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol4.tld"), "")).isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol5.tld"), "")).isFalse();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol6.tld"), "")).isFalse();
assertThat(reservedListChecks)
.hasValueForLabels(1, "tld", "1", "reserved2", FULLY_BLOCKED.toString())
.and()
.hasValueForLabels(1, "tld", "1", "reserved2", NAME_COLLISION.toString())
.and()
.hasValueForLabels(1, "tld", "1", "reserved2", MISTAKEN_PREMIUM.toString())
.and()
.hasValueForLabels(1, "tld", "1", "reserved2", ALLOWED_IN_SUNRISE.toString())
.and()
.hasValueForLabels(1, "tld", "1", "reserved2", NAMESERVER_RESTRICTED.toString())
.and()
.hasValueForLabels(1, "tld", "0", "(none)", "(none)")
.and()
.hasNoOtherValues();
assertThat(reservedListProcessingTime)
.hasAnyValueForLabels("tld", "1", "reserved2", FULLY_BLOCKED.toString())
.and()
.hasAnyValueForLabels("tld", "1", "reserved2", NAME_COLLISION.toString())
.and()
.hasAnyValueForLabels("tld", "1", "reserved2", MISTAKEN_PREMIUM.toString())
.and()
.hasAnyValueForLabels("tld", "1", "reserved2", ALLOWED_IN_SUNRISE.toString())
.and()
.hasAnyValueForLabels("tld", "1", "reserved2", NAMESERVER_RESTRICTED.toString())
.and()
.hasAnyValueForLabels("tld", "0", "(none)", "(none)")
.and()
.hasNoOtherValues();
assertThat(reservedListHits)
.hasValueForLabels(1, "tld", "reserved2", FULLY_BLOCKED.toString())
.and()
.hasValueForLabels(1, "tld", "reserved2", NAME_COLLISION.toString())
.and()
.hasValueForLabels(1, "tld", "reserved2", MISTAKEN_PREMIUM.toString())
.and()
.hasValueForLabels(1, "tld", "reserved2", ALLOWED_IN_SUNRISE.toString())
.and()
.hasValueForLabels(1, "tld", "reserved2", NAMESERVER_RESTRICTED.toString())
.and()
.hasNoOtherValues();
}
@Test
public void testMatchesAnchorTenantReservation_duplicatingAuthCodes() {
ReservedList rl1 = persistReservedList("reserved1", "lol,RESERVED_FOR_ANCHOR_TENANT,foo");
ReservedList rl2 = persistReservedList("reserved2", "lol,RESERVED_FOR_ANCHOR_TENANT,foo");
createTld("tld");
persistResource(Registry.get("tld").asBuilder().setReservedLists(rl1, rl2).build());
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "foo")).isTrue();
assertThat(matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "bar")).isFalse();
persistReservedList("reserved2", "lol,RESERVED_FOR_ANCHOR_TENANT,bar");
IllegalStateException thrown =
assertThrows(
IllegalStateException.class,
() -> matchesAnchorTenantReservation(InternetDomainName.from("lol.tld"), "bar"));
assertThat(thrown)
.hasMessageThat()
.contains("There are conflicting auth codes for domain: lol.tld");
}
@Test
public void testGetReservationTypes_concatsMultipleListsCorrectly() {
ReservedList rl1 = persistReservedList(
@ -494,8 +369,7 @@ public class ReservedListTest {
assertThat(thrown)
.hasMessageThat()
.contains(
"Only anchor tenant and nameserver restricted reservations "
+ "should have restrictions imposed");
"Allowed nameservers must be specified for NAMESERVER_RESTRICTED reservations only");
}
@Test
@ -524,24 +398,6 @@ public class ReservedListTest {
assertThat(thrown).hasMessageThat().contains("domain.tld is not a valid nameserver hostname");
}
@Test
public void testSave_noPasswordWithAnchorTenantReservation() {
IllegalArgumentException thrown =
assertThrows(
IllegalArgumentException.class,
() ->
persistResource(
Registry.get("tld")
.asBuilder()
.setReservedLists(
ImmutableSet.of(
persistReservedList("reserved1", "lol,RESERVED_FOR_ANCHOR_TENANT")))
.build()));
assertThat(thrown)
.hasMessageThat()
.contains("Anchor tenant reservations must have an auth code configured");
}
@Test
public void testSave_noNameserversWithNameserverRestrictedReservation() {
IllegalArgumentException thrown =
@ -558,7 +414,7 @@ public class ReservedListTest {
assertThat(thrown)
.hasMessageThat()
.contains(
"Nameserver restricted reservations must have at least one nameserver configured");
"Allowed nameservers must be specified for NAMESERVER_RESTRICTED reservations only");
}
@Test

View file

@ -723,6 +723,7 @@ enum google.registry.model.registry.label.ReservationType {
NAMESERVER_RESTRICTED;
NAME_COLLISION;
RESERVED_FOR_ANCHOR_TENANT;
RESERVED_FOR_SPECIFIC_USE;
}
class google.registry.model.registry.label.ReservedList {
@Id java.lang.String name;
@ -737,7 +738,6 @@ class google.registry.model.registry.label.ReservedList$ReservedListEntry {
@Id java.lang.String label;
google.registry.model.registry.label.ReservationType reservationType;
java.lang.String allowedNameservers;
java.lang.String authCode;
java.lang.String comment;
}
class google.registry.model.reporting.DomainTransactionRecord {