Merge branch 'master' into log-error-when-cert-path-is-missing

app/controllers/epp/base_controller.rb

@@ -1,9 +1,8 @@
 module Epp
   class BaseController < ActionController::Base
     class AuthorizationError < StandardError; end
-
-    check_authorization
     skip_before_action :verify_authenticity_token
+    check_authorization
     layout false
 
     before_action :ensure_session_id_passed
@@ -11,7 +10,7 @@ module Epp
     before_action :latin_only
     before_action :validate_against_schema
     before_action :validate_request
-    before_action :update_epp_session, if: 'signed_in?'
+    before_action :update_epp_session, if: -> { signed_in? }
 
     around_action :wrap_exceptions
 
@@ -21,6 +20,7 @@ module Epp
     rescue_from StandardError, with: :respond_with_command_failed_error
     rescue_from AuthorizationError, with: :respond_with_authorization_error
     rescue_from ActiveRecord::RecordNotFound, with: :respond_with_object_does_not_exist_error
+    before_action :set_paper_trail_whodunnit
 
     protected
 
@@ -119,7 +119,7 @@ module Epp
     end
 
     def render_epp_response(*args)
-      @response = render_to_string(*args, formats: 'xml')
+      @response = render_to_string(*args, formats: [:xml])
       render xml: @response
       write_to_epp_log
     end
@@ -395,7 +395,12 @@ module Epp
     end
 
     def log_exception(exception)
+      logger.error(([exception.message] + exception.backtrace).join($INPUT_RECORD_SEPARATOR))
       notify_airbrake(exception)
     end
+
+    def user_for_paper_trail
+      current_user ? current_user.id_role_username : 'anonymous'
+    end
   end
 end

app/controllers/epp/contacts_controller.rb

@@ -1,3 +1,5 @@
+require 'deserializers/xml/contact_update'
+
 module Epp
   class ContactsController < BaseController
     before_action :find_contact, only: [:info, :update, :delete]
@@ -43,9 +45,14 @@ module Epp
     def update
       authorize! :update, @contact, @password
 
-      frame = params[:parsed_frame]
+      collected_data = ::Deserializers::Xml::ContactUpdate.new(params[:parsed_frame])
+      action = Actions::ContactUpdate.new(@contact,
+                                          collected_data.contact,
+                                          collected_data.legal_document,
+                                          collected_data.ident,
+                                          current_user)
 
-      if @contact.update_attributes(frame, current_user)
+      if action.call
         if !address_processing? && address_given?
           @response_code = 1100
           @response_description = t('epp.contacts.completed_without_address')

app/controllers/epp/domains_controller.rb

@@ -2,6 +2,7 @@ module Epp
   class DomainsController < BaseController
     before_action :find_domain, only: %i[info renew update transfer delete]
     before_action :find_password, only: %i[info update transfer delete]
+    before_action :set_paper_trail_whodunnit
 
     def info
       authorize! :info, @domain
@@ -91,7 +92,7 @@ module Epp
                                              status: Auction.statuses[:payment_received])
             active_auction.domain_registered!
           end
-
+          Dispute.close_by_domain(@domain.name)
           render_epp_response '/epp/domains/create'
         else
           handle_errors(@domain)
@@ -102,21 +103,17 @@ module Epp
     def update
       authorize! :update, @domain, @password
 
-      if @domain.update(params[:parsed_frame], current_user)
-        if @domain.epp_pending_update.present?
-          render_epp_response '/epp/domains/success_pending'
-        else
-          render_epp_response '/epp/domains/success'
-        end
-      else
-        handle_errors(@domain)
-      end
+      updated = @domain.update(params[:parsed_frame], current_user)
+      (handle_errors(@domain) && return) unless updated
+
+      pending = @domain.epp_pending_update.present?
+      render_epp_response "/epp/domains/success#{'_pending' if pending}"
     end
 
     def delete
       authorize! :delete, @domain, @password
 
-      handle_errors(@domain) and return unless @domain.can_be_deleted?
+      (handle_errors(@domain) && return) unless @domain.can_be_deleted?
 
       if @domain.epp_destroy(params[:parsed_frame], current_user.id)
         if @domain.epp_pending_delete.present?
@@ -240,7 +237,7 @@ module Epp
       mutually_exclusive 'keyData', 'dsData'
 
       @prefix = nil
-      requires 'extension > extdata > legalDocument'
+      requires 'extension > extdata > legalDocument' if current_user.legaldoc_mandatory?
 
       optional_attribute 'period', 'unit', values: %w(d m y)
 
@@ -249,7 +246,7 @@ module Epp
 
     def validate_update
       if element_count('update > chg > registrant') > 0
-        requires 'extension > extdata > legalDocument'
+        requires 'extension > extdata > legalDocument' if current_user.legaldoc_mandatory?
       end
 
       @prefix = 'update > update >'
@@ -259,8 +256,6 @@ module Epp
     end
 
     def validate_delete
-      requires 'extension > extdata > legalDocument'
-
       @prefix = 'delete > delete >'
       requires 'name'
     end
@@ -311,6 +306,7 @@ module Epp
 
     def status_editing_disabled
       return true if Setting.client_status_editing_enabled
+      return true if check_client_hold
       return true if params[:parsed_frame].css('status').empty?
       epp_errors << {
         code: '2306',
@@ -318,6 +314,11 @@ module Epp
       }
     end
 
+    def check_client_hold
+      statuses = params[:parsed_frame].css('status').map { |element| element['s'] }
+      statuses == [::DomainStatus::CLIENT_HOLD]
+    end
+
     def balance_ok?(operation, period = nil, unit = nil)
       @domain_pricelist = @domain.pricelist(operation, period.try(:to_i), unit)
       if @domain_pricelist.try(:price) # checking if price list is not found

app/controllers/epp/sessions_controller.rb

@@ -1,6 +1,7 @@
 module Epp
   class SessionsController < BaseController
     skip_authorization_check only: [:hello, :login, :logout]
+    before_action :set_paper_trail_whodunnit
 
     def hello
       render_epp_response('greeting')
@@ -29,7 +30,8 @@ module Epp
       end
 
       if !Rails.env.development? && (!webclient_request && @api_user)
-        unless @api_user.api_pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'], request.env['HTTP_SSL_CLIENT_S_DN_CN'])
+        unless @api_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
+                                 request.env['HTTP_SSL_CLIENT_S_DN_CN'])
           epp_errors << {
             msg: 'Authentication error; server closing connection (certificate is not valid)',
             code: '2501'