Add Java classes for console history objects (#2350)

This also creates base classes for the objects contained within the
history classes, e.g. RegistrarBase. This is the same way that objects
stored in the HistoryEntry subclasses have base classes, e.g.
DomainBase.

core/src/main/java/google/registry/batch/SendExpiringCertificateNotificationEmailAction.java

@@ -33,7 +33,7 @@ import google.registry.flows.certs.CertificateChecker;
 import google.registry.groups.GmailClient;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -58,7 +58,7 @@ import google.registry.model.host.Host;
 import google.registry.model.host.HostHistory;
 import google.registry.model.rde.RdeMode;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -50,6 +50,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.model.tld.Tld;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
@@ -295,7 +296,7 @@ public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
 
       ImmutableList<InternetAddress> recipients =
           registrar.get().getContacts().stream()
-              .filter(c -> c.getTypes().contains(RegistrarPoc.Type.ADMIN))
+              .filter(c -> c.getTypes().contains(RegistrarPocBase.Type.ADMIN))
               .map(RegistrarPoc::getEmailAddress)
               .map(PublishDnsUpdatesAction::emailToInternetAddress)
               .collect(toImmutableList());

core/src/main/java/google/registry/export/SyncGroupMembersAction.java

@@ -33,6 +33,7 @@ import google.registry.groups.GroupsConnection;
 import google.registry.groups.GroupsConnection.Role;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.request.Action;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
@@ -99,7 +100,7 @@ public final class SyncGroupMembersAction implements Runnable {
    * Returns the Google Groups email address for the given registrar ID and RegistrarContact.Type.
    */
   public static String getGroupEmailAddressForContactType(
-      String registrarId, RegistrarPoc.Type type, String gSuiteDomainName) {
+      String registrarId, RegistrarPocBase.Type type, String gSuiteDomainName) {
     // Take the registrar's ID, make it lowercase, and remove all characters that aren't
     // alphanumeric, hyphens, or underscores.
     return String.format(
@@ -174,7 +175,7 @@ public final class SyncGroupMembersAction implements Runnable {
       Set<RegistrarPoc> registrarPocs = registrar.getContacts();
       long totalAdded = 0;
       long totalRemoved = 0;
-      for (final RegistrarPoc.Type type : RegistrarPoc.Type.values()) {
+      for (final RegistrarPocBase.Type type : RegistrarPocBase.Type.values()) {
         groupKey =
             getGroupEmailAddressForContactType(registrar.getRegistrarId(), type, gSuiteDomainName);
         Set<String> currentMembers = groupsConnection.getMembersOfGroup(groupKey);

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheet.java

@@ -17,13 +17,13 @@ package google.registry.export.sheet;
 import static com.google.common.base.MoreObjects.firstNonNull;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.model.common.Cursor.CursorType.SYNC_REGISTRAR_SHEET;
-import static google.registry.model.registrar.RegistrarPoc.Type.ABUSE;
-import static google.registry.model.registrar.RegistrarPoc.Type.ADMIN;
-import static google.registry.model.registrar.RegistrarPoc.Type.BILLING;
-import static google.registry.model.registrar.RegistrarPoc.Type.LEGAL;
-import static google.registry.model.registrar.RegistrarPoc.Type.MARKETING;
-import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
-import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ABUSE;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ADMIN;
+import static google.registry.model.registrar.RegistrarPocBase.Type.BILLING;
+import static google.registry.model.registrar.RegistrarPocBase.Type.LEGAL;
+import static google.registry.model.registrar.RegistrarPocBase.Type.MARKETING;
+import static google.registry.model.registrar.RegistrarPocBase.Type.TECH;
+import static google.registry.model.registrar.RegistrarPocBase.Type.WHOIS;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
@@ -36,6 +36,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.util.Clock;
 import google.registry.util.DateTimeUtils;
 import java.io.IOException;
@@ -173,7 +174,7 @@ class SyncRegistrarsSheet {
     return result.toString();
   }
 
-  private static Predicate<RegistrarPoc> byType(final RegistrarPoc.Type type) {
+  private static Predicate<RegistrarPoc> byType(final RegistrarPocBase.Type type) {
     return contact -> contact.getTypes().contains(type);
   }
 

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -123,7 +123,7 @@ import google.registry.model.eppoutput.EppResponse.ResponseExtension;
 import google.registry.model.host.Host;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;

core/src/main/java/google/registry/model/console/ConsoleEppActionHistory.java

@@ -0,0 +1,99 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.reporting.HistoryEntry;
+import google.registry.model.reporting.HistoryEntry.HistoryEntryId;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.AttributeOverride;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an EPP action via the console.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a reference to the
+ * history entry so that we can refer to it if necessary.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "historyActingUser"),
+      @Index(columnList = "repoId"),
+      @Index(columnList = "revisionId")
+    })
+public class ConsoleEppActionHistory extends ConsoleUpdateHistory {
+
+  @AttributeOverride(name = "repoId", column = @Column(nullable = false))
+  HistoryEntryId historyEntryId;
+
+  @Column(nullable = false)
+  Class<? extends HistoryEntry> historyEntryClass;
+
+  public HistoryEntryId getHistoryEntryId() {
+    return historyEntryId;
+  }
+
+  public Class<? extends HistoryEntry> getHistoryEntryClass() {
+    return historyEntryClass;
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<ConsoleEppActionHistory> createVKey() {
+    return VKey.create(ConsoleEppActionHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<ConsoleEppActionHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(ConsoleEppActionHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public ConsoleEppActionHistory build() {
+      checkArgumentNotNull(getInstance().historyEntryId, "History entry ID must be specified");
+      checkArgumentNotNull(
+          getInstance().historyEntryClass, "History entry class must be specified");
+      return super.build();
+    }
+
+    public Builder setHistoryEntryId(HistoryEntryId historyEntryId) {
+      getInstance().historyEntryId = historyEntryId;
+      return this;
+    }
+
+    public Builder setHistoryEntryClass(Class<? extends HistoryEntry> historyEntryClass) {
+      getInstance().historyEntryClass = historyEntryClass;
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/ConsoleUpdateHistory.java

@@ -0,0 +1,168 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.ImmutableObject;
+import google.registry.model.annotations.IdAllocation;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.MappedSuperclass;
+import org.joda.time.DateTime;
+
+/**
+ * A record of a resource that was updated through the console.
+ *
+ * <p>This abstract class has several subclasses that (mostly) include the modified resource itself
+ * so that the entire object history is persisted to SQL.
+ */
+@Access(AccessType.FIELD)
+@MappedSuperclass
+public abstract class ConsoleUpdateHistory extends ImmutableObject implements Buildable {
+
+  public enum Type {
+    EPP_ACTION,
+    POC_CREATE,
+    POC_UPDATE,
+    POC_DELETE,
+    REGISTRAR_UPDATE,
+    USER_CREATE,
+    USER_DELETE,
+    USER_UPDATE
+  }
+
+  /** Autogenerated ID of this event. */
+  @Id
+  @IdAllocation
+  @Column(nullable = false, name = "historyRevisionId")
+  protected Long revisionId;
+
+  /** The user that performed the modification. */
+  @JoinColumn(name = "historyActingUser", referencedColumnName = "emailAddress", nullable = false)
+  @ManyToOne
+  User actingUser;
+
+  /** The URL of the action that was used to make the modification. */
+  @Column(nullable = false, name = "historyUrl")
+  String url;
+
+  /** The HTTP method (e.g. POST, PUT) used to make this modification. */
+  @Column(nullable = false, name = "historyMethod")
+  String method;
+
+  /** The raw body of the request that was used to make this modification. */
+  @Column(name = "historyRequestBody")
+  String requestBody;
+
+  /** The time at which the modification was mode. */
+  @Column(nullable = false, name = "historyModificationTime")
+  DateTime modificationTime;
+
+  /** The type of modification. */
+  @Column(nullable = false, name = "historyType")
+  @Enumerated(EnumType.STRING)
+  Type type;
+
+  public long getRevisionId() {
+    return revisionId;
+  }
+
+  public User getActingUser() {
+    return actingUser;
+  }
+
+  public String getUrl() {
+    return url;
+  }
+
+  public String getMethod() {
+    return method;
+  }
+
+  public String getRequestBody() {
+    return requestBody;
+  }
+
+  public DateTime getModificationTime() {
+    return modificationTime;
+  }
+
+  public Type getType() {
+    return type;
+  }
+
+  @Override
+  public abstract Builder<? extends ConsoleUpdateHistory, ?> asBuilder();
+
+  /** Builder for the immutable ConsoleUpdateHistory. */
+  public abstract static class Builder<
+          T extends ConsoleUpdateHistory, B extends ConsoleUpdateHistory.Builder<?, ?>>
+      extends GenericBuilder<T, B> {
+
+    protected Builder() {}
+
+    protected Builder(T instance) {
+      super(instance);
+    }
+
+    @Override
+    public T build() {
+      checkArgumentNotNull(getInstance().actingUser, "Acting user must be specified");
+      checkArgumentNotNull(getInstance().url, "URL must be specified");
+      checkArgumentNotNull(getInstance().method, "HTTP method must be specified");
+      checkArgumentNotNull(getInstance().modificationTime, "modificationTime must be specified");
+      checkArgumentNotNull(getInstance().type, "Console History type must be specified");
+      return super.build();
+    }
+
+    public B setActingUser(User actingUser) {
+      getInstance().actingUser = actingUser;
+      return thisCastToDerived();
+    }
+
+    public B setUrl(String url) {
+      getInstance().url = url;
+      return thisCastToDerived();
+    }
+
+    public B setMethod(String method) {
+      getInstance().method = method;
+      return thisCastToDerived();
+    }
+
+    public B setRequestBody(String requestBody) {
+      getInstance().requestBody = requestBody;
+      return thisCastToDerived();
+    }
+
+    public B setModificationTime(DateTime modificationTime) {
+      getInstance().modificationTime = modificationTime;
+      return thisCastToDerived();
+    }
+
+    public B setType(Type type) {
+      getInstance().type = type;
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/model/console/RegistrarPocUpdateHistory.java

@@ -0,0 +1,99 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a RegistrarPoc.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified RegistrarPoc object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(
+    indexes = {
+      @Index(columnList = "historyActingUser"),
+      @Index(columnList = "emailAddress"),
+      @Index(columnList = "registrarId")
+    })
+public class RegistrarPocUpdateHistory extends ConsoleUpdateHistory {
+
+  RegistrarPocBase registrarPoc;
+
+  // These fields exist so that they can be populated in the SQL table
+  @Column(nullable = false)
+  String emailAddress;
+
+  @Column(nullable = false)
+  String registrarId;
+
+  public RegistrarPocBase getRegistrarPoc() {
+    return registrarPoc;
+  }
+
+  @PostLoad
+  void postLoad() {
+    registrarPoc.setEmailAddress(emailAddress);
+    registrarPoc.setRegistrarId(registrarId);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<RegistrarPocUpdateHistory> createVKey() {
+    return VKey.create(RegistrarPocUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<RegistrarPocUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(RegistrarPocUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistrarPocUpdateHistory build() {
+      checkArgumentNotNull(getInstance().registrarPoc, "Registrar POC must be specified");
+      return super.build();
+    }
+
+    public Builder setRegistrarPoc(RegistrarPoc registrarPoc) {
+      getInstance().registrarPoc = registrarPoc;
+      getInstance().registrarId = registrarPoc.getRegistrarId();
+      getInstance().emailAddress = registrarPoc.getEmailAddress();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/RegistrarUpdateHistory.java

@@ -0,0 +1,89 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.registrar.RegistrarBase;
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a Registrar.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified Registrar object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(indexes = {@Index(columnList = "historyActingUser"), @Index(columnList = "registrarId")})
+public class RegistrarUpdateHistory extends ConsoleUpdateHistory {
+
+  RegistrarBase registrar;
+
+  // This field exists so that it exists in the SQL table
+  @Column(nullable = false)
+  @SuppressWarnings("unused")
+  private String registrarId;
+
+  public RegistrarBase getRegistrar() {
+    return registrar;
+  }
+
+  @PostLoad
+  void postLoad() {
+    registrar.setRegistrarId(registrarId);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<RegistrarUpdateHistory> createVKey() {
+    return VKey.create(RegistrarUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new RegistrarUpdateHistory.Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder
+      extends ConsoleUpdateHistory.Builder<RegistrarUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(RegistrarUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public RegistrarUpdateHistory build() {
+      checkArgumentNotNull(getInstance().registrar, "Registrar must be specified");
+      return super.build();
+    }
+
+    public Builder setRegistrar(RegistrarBase registrar) {
+      getInstance().registrar = registrar;
+      getInstance().registrarId = registrar.getRegistrarId();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/console/User.java

@@ -14,19 +14,11 @@
 
 package google.registry.model.console;
 
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Strings.isNullOrEmpty;
-import static com.google.common.io.BaseEncoding.base64;
-import static google.registry.model.registrar.Registrar.checkValidEmail;
-import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
-import static google.registry.util.PasswordUtils.hashPassword;
-import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 
-import google.registry.model.Buildable;
-import google.registry.model.UpdateAutoTimestampEntity;
 import google.registry.persistence.VKey;
-import google.registry.util.PasswordUtils;
-import javax.persistence.Column;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Embeddable;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
@@ -35,74 +27,17 @@ import javax.persistence.Index;
 import javax.persistence.Table;
 
 /** A console user, either a registry employee or a registrar partner. */
+@Embeddable
 @Entity
 @Table(indexes = {@Index(columnList = "emailAddress", name = "user_email_address_idx")})
-public class User extends UpdateAutoTimestampEntity implements Buildable {
+public class User extends UserBase {
 
-  private static final long serialVersionUID = 6936728603828566721L;
-
-  /** Autogenerated unique ID of this user. */
+  @Override
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
-  private Long id;
-
-  /** Email address of the user in question. */
-  @Column(nullable = false)
-  private String emailAddress;
-
-  /** Roles (which grant permissions) associated with this user. */
-  @Column(nullable = false)
-  private UserRoles userRoles;
-
-  /**
-   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
-   * encoded SHA256 string.
-   */
-  String registryLockPasswordHash;
-
-  /** Randomly generated hash salt. */
-  String registryLockPasswordSalt;
-
+  @Access(AccessType.PROPERTY)
   public Long getId() {
-    return id;
-  }
-
-  public String getEmailAddress() {
-    return emailAddress;
-  }
-
-  public UserRoles getUserRoles() {
-    return userRoles;
-  }
-
-  public boolean hasRegistryLockPassword() {
-    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
-  }
-
-  public boolean verifyRegistryLockPassword(String registryLockPassword) {
-    if (isNullOrEmpty(registryLockPassword)
-        || isNullOrEmpty(registryLockPasswordSalt)
-        || isNullOrEmpty(registryLockPasswordHash)) {
-      return false;
-    }
-    return PasswordUtils.verifyPassword(
-        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
-  }
-
-  /**
-   * Whether the user has the registry lock permission on any registrar or globally.
-   *
-   * <p>If so, they should be allowed to (re)set their registry lock password.
-   */
-  public boolean hasAnyRegistryLockPermission() {
-    if (userRoles == null) {
-      return false;
-    }
-    if (userRoles.isAdmin() || userRoles.hasGlobalPermission(ConsolePermission.REGISTRY_LOCK)) {
-      return true;
-    }
-    return userRoles.getRegistrarRoles().values().stream()
-        .anyMatch(role -> role.hasPermission(ConsolePermission.REGISTRY_LOCK));
+    return super.getId();
   }
 
   @Override
@@ -116,7 +51,7 @@ public class User extends UpdateAutoTimestampEntity implements Buildable {
   }
 
   /** Builder for constructing immutable {@link User} objects. */
-  public static class Builder extends Buildable.Builder<User> {
+  public static class Builder extends UserBase.Builder<User, Builder> {
 
     public Builder() {}
 
@@ -124,41 +59,5 @@ public class User extends UpdateAutoTimestampEntity implements Buildable {
       super(user);
     }
 
-    @Override
-    public User build() {
-      checkArgumentNotNull(getInstance().emailAddress, "Email address cannot be null");
-      checkArgumentNotNull(getInstance().userRoles, "User roles cannot be null");
-      return super.build();
-    }
-
-    public Builder setEmailAddress(String emailAddress) {
-      getInstance().emailAddress = checkValidEmail(emailAddress);
-      return this;
-    }
-
-    public Builder setUserRoles(UserRoles userRoles) {
-      checkArgumentNotNull(userRoles, "User roles cannot be null");
-      getInstance().userRoles = userRoles;
-      return this;
-    }
-
-    public Builder removeRegistryLockPassword() {
-      getInstance().registryLockPasswordHash = null;
-      getInstance().registryLockPasswordSalt = null;
-      return this;
-    }
-
-    public Builder setRegistryLockPassword(String registryLockPassword) {
-      checkArgument(
-          getInstance().hasAnyRegistryLockPermission(), "User has no registry lock permission");
-      checkArgument(
-          !getInstance().hasRegistryLockPassword(), "User already has a password, remove it first");
-      checkArgument(
-          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
-      byte[] salt = SALT_SUPPLIER.get();
-      getInstance().registryLockPasswordSalt = base64().encode(salt);
-      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
-      return this;
-    }
   }
 }

core/src/main/java/google/registry/model/console/UserBase.java

@@ -0,0 +1,178 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.io.BaseEncoding.base64;
+import static google.registry.model.registrar.Registrar.checkValidEmail;
+import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
+import static google.registry.util.PasswordUtils.hashPassword;
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.model.Buildable;
+import google.registry.model.UpdateAutoTimestampEntity;
+import google.registry.util.PasswordUtils;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Embeddable;
+import javax.persistence.Id;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+
+/**
+ * A console user, either a registry employee or a registrar partner.
+ *
+ * <p>This class deliberately does not include an {@link Id} so that any foreign-keyed fields can
+ * refer to the proper parent entity's ID, whether we're storing this in the DB itself or as part of
+ * another entity.
+ */
+@Access(AccessType.FIELD)
+@Embeddable
+@MappedSuperclass
+public class UserBase extends UpdateAutoTimestampEntity implements Buildable {
+
+  private static final long serialVersionUID = 6936728603828566721L;
+
+  /** Autogenerated unique ID of this user. */
+  @Transient private Long id;
+
+  /** Email address of the user in question. */
+  @Column(nullable = false)
+  String emailAddress;
+
+  /** Roles (which grant permissions) associated with this user. */
+  @Column(nullable = false)
+  UserRoles userRoles;
+
+  /**
+   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
+   * encoded SHA256 string.
+   */
+  String registryLockPasswordHash;
+
+  /** Randomly generated hash salt. */
+  String registryLockPasswordSalt;
+
+  public Long getId() {
+    return id;
+  }
+
+  /**
+   * Sets the user ID.
+   *
+   * <p>This should only be used for restoring the user id of an object being loaded in a PostLoad
+   * method (effectively, when it is still under construction by Hibernate). In all other cases, the
+   * object should be regarded as immutable and changes should go through a Builder.
+   *
+   * <p>In addition to this special case use, this method must exist to satisfy Hibernate.
+   */
+  @SuppressWarnings("unused")
+  void setId(Long id) {
+    this.id = id;
+  }
+
+  public String getEmailAddress() {
+    return emailAddress;
+  }
+
+  public UserRoles getUserRoles() {
+    return userRoles;
+  }
+
+  public boolean hasRegistryLockPassword() {
+    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
+  }
+
+  public boolean verifyRegistryLockPassword(String registryLockPassword) {
+    if (isNullOrEmpty(registryLockPassword)
+        || isNullOrEmpty(registryLockPasswordSalt)
+        || isNullOrEmpty(registryLockPasswordHash)) {
+      return false;
+    }
+    return PasswordUtils.verifyPassword(
+        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
+  }
+
+  /**
+   * Whether the user has the registry lock permission on any registrar or globally.
+   *
+   * <p>If so, they should be allowed to (re)set their registry lock password.
+   */
+  public boolean hasAnyRegistryLockPermission() {
+    if (userRoles == null) {
+      return false;
+    }
+    if (userRoles.isAdmin() || userRoles.hasGlobalPermission(ConsolePermission.REGISTRY_LOCK)) {
+      return true;
+    }
+    return userRoles.getRegistrarRoles().values().stream()
+        .anyMatch(role -> role.hasPermission(ConsolePermission.REGISTRY_LOCK));
+  }
+
+  @Override
+  public Builder<? extends UserBase, ?> asBuilder() {
+    return new Builder<>(clone(this));
+  }
+
+  /** Builder for constructing immutable {@link UserBase} objects. */
+  public static class Builder<T extends UserBase, B extends Builder<T, B>>
+      extends GenericBuilder<T, B> {
+
+    public Builder() {}
+
+    public Builder(T abstractUser) {
+      super(abstractUser);
+    }
+
+    @Override
+    public T build() {
+      checkArgumentNotNull(getInstance().emailAddress, "Email address cannot be null");
+      checkArgumentNotNull(getInstance().userRoles, "User roles cannot be null");
+      return super.build();
+    }
+
+    public B setEmailAddress(String emailAddress) {
+      getInstance().emailAddress = checkValidEmail(emailAddress);
+      return thisCastToDerived();
+    }
+
+    public B setUserRoles(UserRoles userRoles) {
+      checkArgumentNotNull(userRoles, "User roles cannot be null");
+      getInstance().userRoles = userRoles;
+      return thisCastToDerived();
+    }
+
+    public B removeRegistryLockPassword() {
+      getInstance().registryLockPasswordHash = null;
+      getInstance().registryLockPasswordSalt = null;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockPassword(String registryLockPassword) {
+      checkArgument(
+          getInstance().hasAnyRegistryLockPermission(), "User has no registry lock permission");
+      checkArgument(
+          !getInstance().hasRegistryLockPassword(), "User already has a password, remove it first");
+      checkArgument(
+          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
+      byte[] salt = SALT_SUPPLIER.get();
+      getInstance().registryLockPasswordSalt = base64().encode(salt);
+      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/model/console/UserRoles.java

@@ -21,6 +21,8 @@ import com.google.common.collect.ImmutableMap;
 import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
 import java.util.Map;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Column;
 import javax.persistence.Embeddable;
 import javax.persistence.EnumType;
@@ -32,6 +34,7 @@ import javax.persistence.Enumerated;
  * <p>See <a href="https://go/nomulus-console-authz">go/nomulus-console-authz</a> for more
  * information.
  */
+@Access(AccessType.FIELD)
 @Embeddable
 public class UserRoles extends ImmutableObject implements Buildable {
 

core/src/main/java/google/registry/model/console/UserUpdateHistory.java

@@ -0,0 +1,86 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
+
+import google.registry.persistence.VKey;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Index;
+import javax.persistence.PostLoad;
+import javax.persistence.Table;
+
+/**
+ * A persisted history object representing an update to a User.
+ *
+ * <p>In addition to the generic history fields (time, URL, etc.) we also persist a copy of the
+ * modified User object at this point in time.
+ */
+@Access(AccessType.FIELD)
+@Entity
+@Table(indexes = {@Index(columnList = "historyActingUser"), @Index(columnList = "emailAddress")})
+public class UserUpdateHistory extends ConsoleUpdateHistory {
+
+  UserBase user;
+
+  // This field exists so that it's populated in the SQL table
+  @Column(nullable = false, name = "userId")
+  Long id;
+
+  public UserBase getUser() {
+    return user;
+  }
+
+  @PostLoad
+  void postLoad() {
+    user.setId(id);
+  }
+
+  /** Creates a {@link VKey} instance for this entity. */
+  @Override
+  public VKey<UserUpdateHistory> createVKey() {
+    return VKey.create(UserUpdateHistory.class, getRevisionId());
+  }
+
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
+  /** Builder for the immutable UserUpdateHistory. */
+  public static class Builder extends ConsoleUpdateHistory.Builder<UserUpdateHistory, Builder> {
+
+    public Builder() {}
+
+    public Builder(UserUpdateHistory instance) {
+      super(instance);
+    }
+
+    @Override
+    public UserUpdateHistory build() {
+      checkArgumentNotNull(getInstance().user, "User must be specified");
+      return super.build();
+    }
+
+    public Builder setUser(User user) {
+      getInstance().user = user;
+      getInstance().id = user.getId();
+      return this;
+    }
+  }
+}

core/src/main/java/google/registry/model/registrar/RegistrarPoc.java

@@ -14,35 +14,14 @@
 
 package google.registry.model.registrar;
 
-import static com.google.common.base.Preconditions.checkArgument;
-import static com.google.common.base.Preconditions.checkNotNull;
-import static com.google.common.base.Strings.isNullOrEmpty;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static com.google.common.io.BaseEncoding.base64;
-import static google.registry.model.registrar.Registrar.checkValidEmail;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
-import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
-import static google.registry.util.PasswordUtils.hashPassword;
-import static java.util.stream.Collectors.joining;
 
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.ImmutableSortedSet;
-import com.google.gson.annotations.Expose;
-import google.registry.model.Buildable;
 import google.registry.model.ImmutableObject;
-import google.registry.model.JsonMapBuilder;
-import google.registry.model.Jsonifiable;
-import google.registry.model.UnsafeSerializable;
 import google.registry.model.registrar.RegistrarPoc.RegistrarPocId;
 import google.registry.persistence.VKey;
-import google.registry.util.PasswordUtils;
 import java.io.Serializable;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
 import javax.persistence.Entity;
 import javax.persistence.Id;
 import javax.persistence.IdClass;
@@ -60,258 +39,20 @@ import javax.persistence.Table;
 @Entity
 @Table(indexes = @Index(columnList = "loginEmailAddress", name = "registrarpoc_login_email_idx"))
 @IdClass(RegistrarPocId.class)
-public class RegistrarPoc extends ImmutableObject implements Jsonifiable, UnsafeSerializable {
-
-  /**
-   * Registrar contacts types for partner communication tracking.
-   *
-   * <p><b>Note:</b> These types only matter to the registry. They are not meant to be used for
-   * WHOIS or RDAP results.
-   */
-  public enum Type {
-    ABUSE("abuse", true),
-    ADMIN("primary", true),
-    BILLING("billing", true),
-    LEGAL("legal", true),
-    MARKETING("marketing", false),
-    TECH("technical", true),
-    WHOIS("whois-inquiry", true);
-
-    private final String displayName;
-
-    private final boolean required;
-
-    public String getDisplayName() {
-      return displayName;
-    }
-
-    public boolean isRequired() {
-      return required;
-    }
-
-    Type(String display, boolean required) {
-      displayName = display;
-      this.required = required;
-    }
-  }
-
-  /** The name of the contact. */
-  @Expose String name;
-
-  /**
-   * The contact email address of the contact.
-   *
-   * <p>This is different from the login email which is assgined to the regstrar and cannot be
-   * changed.
-   */
-  @Expose @Id String emailAddress;
-
-  @Expose @Id public String registrarId;
-
-  /** External email address of this contact used for registry lock confirmations. */
-  String registryLockEmailAddress;
-
-  /** The voice number of the contact. */
-  @Expose String phoneNumber;
-
-  /** The fax number of the contact. */
-  @Expose String faxNumber;
-
-  /**
-   * Multiple types are used to associate the registrar contact with various mailing groups. This
-   * data is internal to the registry.
-   */
-  @Expose Set<Type> types;
-
-  /** A GAIA email address that was assigned to the registrar for console login purpose. */
-  String loginEmailAddress;
-
-  /**
-   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
-   */
-  @Expose boolean visibleInWhoisAsAdmin = false;
-
-  /**
-   * Whether this contact is publicly visible in WHOIS registrar query results as a Technical
-   * contact.
-   */
-  @Expose boolean visibleInWhoisAsTech = false;
-
-  /**
-   * Whether this contact's phone number and email address is publicly visible in WHOIS domain query
-   * results as registrar abuse contact info.
-   */
-  @Expose boolean visibleInDomainWhoisAsAbuse = false;
-
-  /**
-   * Whether the contact is allowed to set their registry lock password through the registrar
-   * console. This will be set to false on contact creation and when the user sets a password.
-   */
-  boolean allowedToSetRegistryLockPassword = false;
-
-  /**
-   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
-   * encoded SHA256 string.
-   */
-  String registryLockPasswordHash;
-
-  /** Randomly generated hash salt. */
-  String registryLockPasswordSalt;
-
-  /**
-   * Helper to update the contacts associated with a Registrar. This requires querying for the
-   * existing contacts, deleting existing contacts that are not part of the given {@code contacts}
-   * set, and then saving the given {@code contacts}.
-   *
-   * <p>IMPORTANT NOTE: If you call this method then it is your responsibility to also persist the
-   * relevant Registrar entity with the {@link Registrar#contactsRequireSyncing} field set to true.
-   */
-  public static void updateContacts(
-      final Registrar registrar, final ImmutableSet<RegistrarPoc> contacts) {
-    tm().transact(
-            () -> {
-              ImmutableSet<String> emailAddressesToKeep =
-                  contacts.stream().map(RegistrarPoc::getEmailAddress).collect(toImmutableSet());
-              tm().query(
-                      "DELETE FROM RegistrarPoc WHERE registrarId = :registrarId AND "
-                          + "emailAddress NOT IN :emailAddressesToKeep")
-                  .setParameter("registrarId", registrar.getRegistrarId())
-                  .setParameter("emailAddressesToKeep", emailAddressesToKeep)
-                  .executeUpdate();
-
-              tm().putAll(contacts);
-            });
-  }
-
-  public String getName() {
-    return name;
-  }
+@Access(AccessType.FIELD)
+public class RegistrarPoc extends RegistrarPocBase {
 
+  @Id
+  @Access(AccessType.PROPERTY)
+  @Override
   public String getEmailAddress() {
     return emailAddress;
   }
 
-  public Optional<String> getRegistryLockEmailAddress() {
-    return Optional.ofNullable(registryLockEmailAddress);
-  }
-
-  public String getPhoneNumber() {
-    return phoneNumber;
-  }
-
-  public String getFaxNumber() {
-    return faxNumber;
-  }
-
-  public ImmutableSortedSet<Type> getTypes() {
-    return nullToEmptyImmutableSortedCopy(types);
-  }
-
-  public boolean getVisibleInWhoisAsAdmin() {
-    return visibleInWhoisAsAdmin;
-  }
-
-  public boolean getVisibleInWhoisAsTech() {
-    return visibleInWhoisAsTech;
-  }
-
-  public boolean getVisibleInDomainWhoisAsAbuse() {
-    return visibleInDomainWhoisAsAbuse;
-  }
-
-  public String getLoginEmailAddress() {
-    return loginEmailAddress;
-  }
-
-  public Builder asBuilder() {
-    return new Builder(clone(this));
-  }
-
-  public boolean isAllowedToSetRegistryLockPassword() {
-    return allowedToSetRegistryLockPassword;
-  }
-
-  public boolean isRegistryLockAllowed() {
-    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
-  }
-
-  public boolean verifyRegistryLockPassword(String registryLockPassword) {
-    if (isNullOrEmpty(registryLockPassword)
-        || isNullOrEmpty(registryLockPasswordSalt)
-        || isNullOrEmpty(registryLockPasswordHash)) {
-      return false;
-    }
-    return PasswordUtils.verifyPassword(
-        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
-  }
-
-  /**
-   * Returns a string representation that's human friendly.
-   *
-   * <p>The output will look something like this:
-   *
-   * <pre>{@code
-   * Some Person
-   * person@example.com
-   * Tel: +1.2125650666
-   * Types: [ADMIN, WHOIS]
-   * Visible in WHOIS as Admin contact: Yes
-   * Visible in WHOIS as Technical contact: No
-   * Registrar-Console access: Yes
-   * Login Email Address: person@registry.example
-   * }</pre>
-   */
-  public String toStringMultilinePlainText() {
-    StringBuilder result = new StringBuilder(256);
-    result.append(getName()).append('\n');
-    result.append(getEmailAddress()).append('\n');
-    if (phoneNumber != null) {
-      result.append("Tel: ").append(getPhoneNumber()).append('\n');
-    }
-    if (faxNumber != null) {
-      result.append("Fax: ").append(getFaxNumber()).append('\n');
-    }
-    result.append("Types: ").append(getTypes()).append('\n');
-    result
-        .append("Visible in registrar WHOIS query as Admin contact: ")
-        .append(getVisibleInWhoisAsAdmin() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append("Visible in registrar WHOIS query as Technical contact: ")
-        .append(getVisibleInWhoisAsTech() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append(
-            "Phone number and email visible in domain WHOIS query as "
-                + "Registrar Abuse contact info: ")
-        .append(getVisibleInDomainWhoisAsAbuse() ? "Yes" : "No")
-        .append('\n');
-    result
-        .append("Registrar-Console access: ")
-        .append(getLoginEmailAddress() != null ? "Yes" : "No")
-        .append('\n');
-    if (getLoginEmailAddress() != null) {
-      result.append("Login Email Address: ").append(getLoginEmailAddress()).append('\n');
-    }
-    return result.toString();
-  }
-
-  @Override
-  public Map<String, Object> toJsonMap() {
-    return new JsonMapBuilder()
-        .put("name", name)
-        .put("emailAddress", emailAddress)
-        .put("registryLockEmailAddress", registryLockEmailAddress)
-        .put("phoneNumber", phoneNumber)
-        .put("faxNumber", faxNumber)
-        .put("types", getTypes().stream().map(Object::toString).collect(joining(",")))
-        .put("visibleInWhoisAsAdmin", visibleInWhoisAsAdmin)
-        .put("visibleInWhoisAsTech", visibleInWhoisAsTech)
-        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
-        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
-        .put("registryLockAllowed", isRegistryLockAllowed())
-        .put("loginEmailAddress", loginEmailAddress)
-        .build();
+  @Id
+  @Access(AccessType.PROPERTY)
+  public String getRegistrarId() {
+    return registrarId;
   }
 
   @Override
@@ -319,6 +60,11 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
     return VKey.create(RegistrarPoc.class, new RegistrarPocId(emailAddress, registrarId));
   }
 
+  @Override
+  public Builder asBuilder() {
+    return new Builder(clone(this));
+  }
+
   /** Class to represent the composite primary key for {@link RegistrarPoc} entity. */
   @VisibleForTesting
   public static class RegistrarPocId extends ImmutableObject implements Serializable {
@@ -336,112 +82,24 @@ public class RegistrarPoc extends ImmutableObject implements Jsonifiable, Unsafe
       this.emailAddress = emailAddress;
       this.registrarId = registrarId;
     }
+
+    @Id
+    public String getEmailAddress() {
+      return emailAddress;
+    }
+
+    @Id
+    public String getRegistrarId() {
+      return registrarId;
+    }
   }
 
-  /** A builder for constructing a {@link RegistrarPoc}, since it is immutable. */
-  public static class Builder extends Buildable.Builder<RegistrarPoc> {
+  public static class Builder extends RegistrarPocBase.Builder<RegistrarPoc, Builder> {
+
     public Builder() {}
 
-    private Builder(RegistrarPoc instance) {
-      super(instance);
-    }
-
-    /** Build the registrar, nullifying empty fields. */
-    @Override
-    public RegistrarPoc build() {
-      checkNotNull(getInstance().registrarId, "Registrar ID cannot be null");
-      checkValidEmail(getInstance().emailAddress);
-      // Check allowedToSetRegistryLockPassword here because if we want to allow the user to set
-      // a registry lock password, we must also set up the correct registry lock email concurrently
-      // or beforehand.
-      if (getInstance().allowedToSetRegistryLockPassword) {
-        checkArgument(
-            !isNullOrEmpty(getInstance().registryLockEmailAddress),
-            "Registry lock email must not be null if allowing registry lock access");
-      }
-      return cloneEmptyToNull(super.build());
-    }
-
-    public Builder setName(String name) {
-      getInstance().name = name;
-      return this;
-    }
-
-    public Builder setEmailAddress(String emailAddress) {
-      getInstance().emailAddress = emailAddress;
-      return this;
-    }
-
-    public Builder setRegistryLockEmailAddress(@Nullable String registryLockEmailAddress) {
-      getInstance().registryLockEmailAddress = registryLockEmailAddress;
-      return this;
-    }
-
-    public Builder setPhoneNumber(String phoneNumber) {
-      getInstance().phoneNumber = phoneNumber;
-      return this;
-    }
-
-    public Builder setRegistrarId(String registrarId) {
-      getInstance().registrarId = registrarId;
-      return this;
-    }
-
-    public Builder setRegistrar(Registrar registrar) {
-      getInstance().registrarId = registrar.getRegistrarId();
-      return this;
-    }
-
-    public Builder setFaxNumber(String faxNumber) {
-      getInstance().faxNumber = faxNumber;
-      return this;
-    }
-
-    public Builder setTypes(Iterable<Type> types) {
-      getInstance().types = ImmutableSet.copyOf(types);
-      return this;
-    }
-
-    public Builder setVisibleInWhoisAsAdmin(boolean visible) {
-      getInstance().visibleInWhoisAsAdmin = visible;
-      return this;
-    }
-
-    public Builder setVisibleInWhoisAsTech(boolean visible) {
-      getInstance().visibleInWhoisAsTech = visible;
-      return this;
-    }
-
-    public Builder setVisibleInDomainWhoisAsAbuse(boolean visible) {
-      getInstance().visibleInDomainWhoisAsAbuse = visible;
-      return this;
-    }
-
-    public Builder setLoginEmailAddress(String loginEmailAddress) {
-      getInstance().loginEmailAddress = loginEmailAddress;
-      return this;
-    }
-
-    public Builder setAllowedToSetRegistryLockPassword(boolean allowedToSetRegistryLockPassword) {
-      if (allowedToSetRegistryLockPassword) {
-        getInstance().registryLockPasswordSalt = null;
-        getInstance().registryLockPasswordHash = null;
-      }
-      getInstance().allowedToSetRegistryLockPassword = allowedToSetRegistryLockPassword;
-      return this;
-    }
-
-    public Builder setRegistryLockPassword(String registryLockPassword) {
-      checkArgument(
-          getInstance().allowedToSetRegistryLockPassword,
-          "Not allowed to set registry lock password for this contact");
-      checkArgument(
-          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
-      byte[] salt = SALT_SUPPLIER.get();
-      getInstance().registryLockPasswordSalt = base64().encode(salt);
-      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
-      getInstance().allowedToSetRegistryLockPassword = false;
-      return this;
+    public Builder(RegistrarPoc registrarPoc) {
+      super(registrarPoc);
     }
   }
 }

core/src/main/java/google/registry/model/registrar/RegistrarPocBase.java

@@ -0,0 +1,441 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.registrar;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.io.BaseEncoding.base64;
+import static google.registry.model.registrar.RegistrarBase.checkValidEmail;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
+import static google.registry.util.PasswordUtils.SALT_SUPPLIER;
+import static google.registry.util.PasswordUtils.hashPassword;
+import static java.util.stream.Collectors.joining;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.gson.annotations.Expose;
+import google.registry.model.Buildable.GenericBuilder;
+import google.registry.model.ImmutableObject;
+import google.registry.model.JsonMapBuilder;
+import google.registry.model.Jsonifiable;
+import google.registry.model.UnsafeSerializable;
+import google.registry.util.PasswordUtils;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import javax.annotation.Nullable;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.Embeddable;
+import javax.persistence.Id;
+import javax.persistence.MappedSuperclass;
+import javax.persistence.Transient;
+
+/**
+ * A contact for a Registrar. Note, equality, hashCode and comparable have been overridden to only
+ * enable key equality.
+ *
+ * <p>IMPORTANT NOTE: Any time that you change, update, or delete RegistrarContact entities, you
+ * *MUST* also modify the persisted Registrar entity with {@link Registrar#contactsRequireSyncing}
+ * set to true.
+ *
+ * <p>This class deliberately does not include an {@link Id} so that any foreign-keyed fields can
+ * refer to the proper parent entity's ID, whether we're storing this in the DB itself or as part of
+ * another entity.
+ */
+@Access(AccessType.FIELD)
+@Embeddable
+@MappedSuperclass
+public class RegistrarPocBase extends ImmutableObject implements Jsonifiable, UnsafeSerializable {
+  /**
+   * Registrar contacts types for partner communication tracking.
+   *
+   * <p><b>Note:</b> These types only matter to the registry. They are not meant to be used for
+   * WHOIS or RDAP results.
+   */
+  public enum Type {
+    ABUSE("abuse", true),
+    ADMIN("primary", true),
+    BILLING("billing", true),
+    LEGAL("legal", true),
+    MARKETING("marketing", false),
+    TECH("technical", true),
+    WHOIS("whois-inquiry", true);
+
+    private final String displayName;
+
+    private final boolean required;
+
+    public String getDisplayName() {
+      return displayName;
+    }
+
+    public boolean isRequired() {
+      return required;
+    }
+
+    Type(String display, boolean required) {
+      displayName = display;
+      this.required = required;
+    }
+  }
+
+  /** The name of the contact. */
+  @Expose String name;
+
+  /**
+   * The contact email address of the contact.
+   *
+   * <p>This is different from the login email which is assgined to the regstrar and cannot be
+   * changed.
+   */
+  @Expose @Transient String emailAddress;
+
+  @Expose @Transient public String registrarId;
+
+  /** External email address of this contact used for registry lock confirmations. */
+  String registryLockEmailAddress;
+
+  /** The voice number of the contact. */
+  @Expose String phoneNumber;
+
+  /** The fax number of the contact. */
+  @Expose String faxNumber;
+
+  /**
+   * Multiple types are used to associate the registrar contact with various mailing groups. This
+   * data is internal to the registry.
+   */
+  @Expose Set<Type> types;
+
+  /** A GAIA email address that was assigned to the registrar for console login purpose. */
+  String loginEmailAddress;
+
+  /**
+   * Whether this contact is publicly visible in WHOIS registrar query results as an Admin contact.
+   */
+  @Expose boolean visibleInWhoisAsAdmin = false;
+
+  /**
+   * Whether this contact is publicly visible in WHOIS registrar query results as a Technical
+   * contact.
+   */
+  @Expose boolean visibleInWhoisAsTech = false;
+
+  /**
+   * Whether this contact's phone number and email address is publicly visible in WHOIS domain query
+   * results as registrar abuse contact info.
+   */
+  @Expose boolean visibleInDomainWhoisAsAbuse = false;
+
+  /**
+   * Whether the contact is allowed to set their registry lock password through the registrar
+   * console. This will be set to false on contact creation and when the user sets a password.
+   */
+  boolean allowedToSetRegistryLockPassword = false;
+
+  /**
+   * A hashed password that exists iff this contact is registry-lock-enabled. The hash is a base64
+   * encoded SHA256 string.
+   */
+  String registryLockPasswordHash;
+
+  /** Randomly generated hash salt. */
+  String registryLockPasswordSalt;
+
+  /**
+   * Helper to update the contacts associated with a Registrar. This requires querying for the
+   * existing contacts, deleting existing contacts that are not part of the given {@code contacts}
+   * set, and then saving the given {@code contacts}.
+   *
+   * <p>IMPORTANT NOTE: If you call this method then it is your responsibility to also persist the
+   * relevant Registrar entity with the {@link Registrar#contactsRequireSyncing} field set to true.
+   */
+  public static void updateContacts(
+      final Registrar registrar, final ImmutableSet<RegistrarPoc> contacts) {
+    tm().transact(
+            () -> {
+              ImmutableSet<String> emailAddressesToKeep =
+                  contacts.stream().map(RegistrarPoc::getEmailAddress).collect(toImmutableSet());
+              tm().query(
+                      "DELETE FROM RegistrarPoc WHERE registrarId = :registrarId AND "
+                          + "emailAddress NOT IN :emailAddressesToKeep")
+                  .setParameter("registrarId", registrar.getRegistrarId())
+                  .setParameter("emailAddressesToKeep", emailAddressesToKeep)
+                  .executeUpdate();
+
+              tm().putAll(contacts);
+            });
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public String getEmailAddress() {
+    return emailAddress;
+  }
+
+  public Optional<String> getRegistryLockEmailAddress() {
+    return Optional.ofNullable(registryLockEmailAddress);
+  }
+
+  public String getPhoneNumber() {
+    return phoneNumber;
+  }
+
+  public String getFaxNumber() {
+    return faxNumber;
+  }
+
+  public ImmutableSortedSet<Type> getTypes() {
+    return nullToEmptyImmutableSortedCopy(types);
+  }
+
+  public boolean getVisibleInWhoisAsAdmin() {
+    return visibleInWhoisAsAdmin;
+  }
+
+  public boolean getVisibleInWhoisAsTech() {
+    return visibleInWhoisAsTech;
+  }
+
+  public boolean getVisibleInDomainWhoisAsAbuse() {
+    return visibleInDomainWhoisAsAbuse;
+  }
+
+  public String getLoginEmailAddress() {
+    return loginEmailAddress;
+  }
+
+  public Builder<? extends RegistrarPocBase, ?> asBuilder() {
+    return new Builder<>(clone(this));
+  }
+
+  public boolean isAllowedToSetRegistryLockPassword() {
+    return allowedToSetRegistryLockPassword;
+  }
+
+  public boolean isRegistryLockAllowed() {
+    return !isNullOrEmpty(registryLockPasswordHash) && !isNullOrEmpty(registryLockPasswordSalt);
+  }
+
+  public boolean verifyRegistryLockPassword(String registryLockPassword) {
+    if (isNullOrEmpty(registryLockPassword)
+        || isNullOrEmpty(registryLockPasswordSalt)
+        || isNullOrEmpty(registryLockPasswordHash)) {
+      return false;
+    }
+    return PasswordUtils.verifyPassword(
+        registryLockPassword, registryLockPasswordHash, registryLockPasswordSalt);
+  }
+
+  /**
+   * Returns a string representation that's human friendly.
+   *
+   * <p>The output will look something like this:
+   *
+   * <pre>{@code
+   * Some Person
+   * person@example.com
+   * Tel: +1.2125650666
+   * Types: [ADMIN, WHOIS]
+   * Visible in WHOIS as Admin contact: Yes
+   * Visible in WHOIS as Technical contact: No
+   * Registrar-Console access: Yes
+   * Login Email Address: person@registry.example
+   * }</pre>
+   */
+  public String toStringMultilinePlainText() {
+    StringBuilder result = new StringBuilder(256);
+    result.append(getName()).append('\n');
+    result.append(getEmailAddress()).append('\n');
+    if (phoneNumber != null) {
+      result.append("Tel: ").append(getPhoneNumber()).append('\n');
+    }
+    if (faxNumber != null) {
+      result.append("Fax: ").append(getFaxNumber()).append('\n');
+    }
+    result.append("Types: ").append(getTypes()).append('\n');
+    result
+        .append("Visible in registrar WHOIS query as Admin contact: ")
+        .append(getVisibleInWhoisAsAdmin() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append("Visible in registrar WHOIS query as Technical contact: ")
+        .append(getVisibleInWhoisAsTech() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append(
+            "Phone number and email visible in domain WHOIS query as "
+                + "Registrar Abuse contact info: ")
+        .append(getVisibleInDomainWhoisAsAbuse() ? "Yes" : "No")
+        .append('\n');
+    result
+        .append("Registrar-Console access: ")
+        .append(getLoginEmailAddress() != null ? "Yes" : "No")
+        .append('\n');
+    if (getLoginEmailAddress() != null) {
+      result.append("Login Email Address: ").append(getLoginEmailAddress()).append('\n');
+    }
+    return result.toString();
+  }
+
+  @Override
+  public Map<String, Object> toJsonMap() {
+    return new JsonMapBuilder()
+        .put("name", name)
+        .put("emailAddress", emailAddress)
+        .put("registryLockEmailAddress", registryLockEmailAddress)
+        .put("phoneNumber", phoneNumber)
+        .put("faxNumber", faxNumber)
+        .put("types", getTypes().stream().map(Object::toString).collect(joining(",")))
+        .put("visibleInWhoisAsAdmin", visibleInWhoisAsAdmin)
+        .put("visibleInWhoisAsTech", visibleInWhoisAsTech)
+        .put("visibleInDomainWhoisAsAbuse", visibleInDomainWhoisAsAbuse)
+        .put("allowedToSetRegistryLockPassword", allowedToSetRegistryLockPassword)
+        .put("registryLockAllowed", isRegistryLockAllowed())
+        .put("loginEmailAddress", loginEmailAddress)
+        .build();
+  }
+
+  /**
+   * These methods set the email address and registrar ID
+   *
+   * <p>This should only be used for restoring the fields of an object being loaded in a PostLoad
+   * method (effectively, when it is still under construction by Hibernate). In all other cases, the
+   * object should be regarded as immutable and changes should go through a Builder.
+   *
+   * <p>In addition to this special case use, this method must exist to satisfy Hibernate.
+   */
+  public void setEmailAddress(String emailAddress) {
+    this.emailAddress = emailAddress;
+  }
+
+  public void setRegistrarId(String registrarId) {
+    this.registrarId = registrarId;
+  }
+
+  /** A builder for constructing a {@link RegistrarPoc}, since it is immutable. */
+  public static class Builder<T extends RegistrarPocBase, B extends Builder<T, B>>
+      extends GenericBuilder<T, B> {
+    public Builder() {}
+
+    protected Builder(T instance) {
+      super(instance);
+    }
+
+    /** Build the registrar, nullifying empty fields. */
+    @Override
+    public T build() {
+      checkNotNull(getInstance().registrarId, "Registrar ID cannot be null");
+      checkValidEmail(getInstance().emailAddress);
+      // Check allowedToSetRegistryLockPassword here because if we want to allow the user to set
+      // a registry lock password, we must also set up the correct registry lock email concurrently
+      // or beforehand.
+      if (getInstance().allowedToSetRegistryLockPassword) {
+        checkArgument(
+            !isNullOrEmpty(getInstance().registryLockEmailAddress),
+            "Registry lock email must not be null if allowing registry lock access");
+      }
+      return cloneEmptyToNull(super.build());
+    }
+
+    public B setName(String name) {
+      getInstance().name = name;
+      return thisCastToDerived();
+    }
+
+    public B setEmailAddress(String emailAddress) {
+      getInstance().emailAddress = emailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockEmailAddress(@Nullable String registryLockEmailAddress) {
+      getInstance().registryLockEmailAddress = registryLockEmailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setPhoneNumber(String phoneNumber) {
+      getInstance().phoneNumber = phoneNumber;
+      return thisCastToDerived();
+    }
+
+    public B setRegistrarId(String registrarId) {
+      getInstance().registrarId = registrarId;
+      return thisCastToDerived();
+    }
+
+    public B setRegistrar(Registrar registrar) {
+      getInstance().registrarId = registrar.getRegistrarId();
+      return thisCastToDerived();
+    }
+
+    public B setFaxNumber(String faxNumber) {
+      getInstance().faxNumber = faxNumber;
+      return thisCastToDerived();
+    }
+
+    public B setTypes(Iterable<Type> types) {
+      getInstance().types = ImmutableSet.copyOf(types);
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInWhoisAsAdmin(boolean visible) {
+      getInstance().visibleInWhoisAsAdmin = visible;
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInWhoisAsTech(boolean visible) {
+      getInstance().visibleInWhoisAsTech = visible;
+      return thisCastToDerived();
+    }
+
+    public B setVisibleInDomainWhoisAsAbuse(boolean visible) {
+      getInstance().visibleInDomainWhoisAsAbuse = visible;
+      return thisCastToDerived();
+    }
+
+    public B setLoginEmailAddress(String loginEmailAddress) {
+      getInstance().loginEmailAddress = loginEmailAddress;
+      return thisCastToDerived();
+    }
+
+    public B setAllowedToSetRegistryLockPassword(boolean allowedToSetRegistryLockPassword) {
+      if (allowedToSetRegistryLockPassword) {
+        getInstance().registryLockPasswordSalt = null;
+        getInstance().registryLockPasswordHash = null;
+      }
+      getInstance().allowedToSetRegistryLockPassword = allowedToSetRegistryLockPassword;
+      return thisCastToDerived();
+    }
+
+    public B setRegistryLockPassword(String registryLockPassword) {
+      checkArgument(
+          getInstance().allowedToSetRegistryLockPassword,
+          "Not allowed to set registry lock password for this contact");
+      checkArgument(
+          !isNullOrEmpty(registryLockPassword), "Registry lock password was null or empty");
+      byte[] salt = SALT_SUPPLIER.get();
+      getInstance().registryLockPasswordSalt = base64().encode(salt);
+      getInstance().registryLockPasswordHash = hashPassword(registryLockPassword, salt);
+      getInstance().allowedToSetRegistryLockPassword = false;
+      return thisCastToDerived();
+    }
+  }
+}

core/src/main/java/google/registry/persistence/converter/RegistrarPocSetConverter.java

@@ -14,7 +14,7 @@
 
 package google.registry.persistence.converter;
 
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import javax.persistence.AttributeConverter;
 import javax.persistence.Converter;
 

core/src/main/java/google/registry/rde/RegistrarToXjcConverter.java

@@ -19,8 +19,9 @@ import static com.google.common.base.Preconditions.checkState;
 
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.xjc.contact.XjcContactE164Type;
 import google.registry.xjc.rderegistrar.XjcRdeRegistrar;
 import google.registry.xjc.rderegistrar.XjcRdeRegistrarAddrType;
@@ -40,7 +41,7 @@ final class RegistrarToXjcConverter {
   private static final String UNKNOWN_CC = "US";
 
   /** A conversion map between internal Registrar states and external RDE states. */
-  private static final ImmutableMap<Registrar.State, XjcRdeRegistrarStatusType>
+  private static final ImmutableMap<RegistrarBase.State, XjcRdeRegistrarStatusType>
       REGISTRAR_STATUS_CONVERSIONS =
           ImmutableMap.of(
               State.ACTIVE, XjcRdeRegistrarStatusType.OK,

core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java

@@ -28,7 +28,7 @@ import dagger.Lazy;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.groups.GroupsConnection;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.registrar.RegistrarPoc;
 import java.util.Optional;
 import javax.annotation.concurrent.Immutable;

core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java

@@ -31,6 +31,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase;
 import google.registry.tools.params.KeyValueMapParameter.CurrencyUnitToStringMap;
 import google.registry.tools.params.OptionalLongParameter;
 import google.registry.tools.params.OptionalPhoneNumberParameter;
@@ -59,16 +60,12 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
   @Parameter(description = "Client identifier of the registrar account", required = true)
   List<String> mainParameters;
 
-  @Parameter(
-      names = "--registrar_type",
-      description = "Type of the registrar")
-  Registrar.Type registrarType;
+  @Parameter(names = "--registrar_type", description = "Type of the registrar")
+  RegistrarBase.Type registrarType;
 
   @Nullable
-  @Parameter(
-      names = "--registrar_state",
-      description = "Initial state of the registrar")
-  Registrar.State registrarState;
+  @Parameter(names = "--registrar_state", description = "Initial state of the registrar")
+  RegistrarBase.State registrarState;
 
   @Parameter(
       names = "--allowed_tlds",

core/src/main/java/google/registry/tools/CreateRegistrarCommand.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.base.Strings.emptyToNull;
 import static com.google.common.collect.Iterables.getOnlyElement;
-import static google.registry.model.registrar.Registrar.State.ACTIVE;
+import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
 import static google.registry.tools.RegistryToolEnvironment.PRODUCTION;
 import static google.registry.tools.RegistryToolEnvironment.SANDBOX;
 import static google.registry.tools.RegistryToolEnvironment.UNITTEST;

core/src/main/java/google/registry/tools/RegistrarPocCommand.java

@@ -30,6 +30,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.tools.params.OptionalPhoneNumberParameter;
 import google.registry.tools.params.PathParameter;
 import google.registry.tools.params.StringListParameter;
@@ -167,7 +168,7 @@ final class RegistrarPocCommand extends MutatingCommand {
   private static final ImmutableSet<Mode> MODES_REQUIRING_CONTACT_SYNC =
       ImmutableSet.of(Mode.CREATE, Mode.UPDATE, Mode.DELETE);
 
-  @Nullable private ImmutableSet<RegistrarPoc.Type> contactTypes;
+  @Nullable private ImmutableSet<RegistrarPocBase.Type> contactTypes;
 
   @Override
   protected void init() throws Exception {
@@ -183,7 +184,7 @@ final class RegistrarPocCommand extends MutatingCommand {
     } else {
       contactTypes =
           contactTypeNames.stream()
-              .map(Enums.stringConverter(RegistrarPoc.Type.class))
+              .map(Enums.stringConverter(RegistrarPocBase.Type.class))
               .collect(toImmutableSet());
     }
     ImmutableSet<RegistrarPoc> contacts = registrar.getContacts();

core/src/main/java/google/registry/tools/server/CreateGroupsAction.java

@@ -24,7 +24,7 @@ import google.registry.config.RegistryConfig.Config;
 import google.registry.groups.GroupsConnection;
 import google.registry.groups.GroupsConnection.Role;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.request.Action;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.InternalServerErrorException;
@@ -64,7 +64,7 @@ public class CreateGroupsAction implements Runnable {
     if (registrar == null) {
       return;
     }
-    List<RegistrarPoc.Type> types = asList(RegistrarPoc.Type.values());
+    List<RegistrarPocBase.Type> types = asList(RegistrarPocBase.Type.values());
     // Concurrently create the groups for each RegistrarContact.Type, collecting the results from
     // each call (which are either an Exception if it failed, or absent() if it succeeded).
     List<Optional<Exception>> results =

core/src/main/java/google/registry/ui/server/RegistrarFormFields.java

@@ -29,6 +29,7 @@ import com.google.re2j.Pattern;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.ui.forms.FormException;
 import google.registry.ui.forms.FormField;
 import google.registry.ui.forms.FormFieldException;
@@ -90,12 +91,6 @@ public final class RegistrarFormFields {
           .matches(ASCII_PATTERN, ASCII_ERROR)
           .build();
 
-  public static final FormField<String, Registrar.State> STATE_FIELD =
-      FormField.named("state")
-          .emptyToNull()
-          .asEnum(Registrar.State.class)
-          .build();
-
   public static final FormField<List<String>, Set<String>> ALLOWED_TLDS_FIELD =
       FormFields.LABEL.asBuilderNamed("allowedTlds")
           .asSet()
@@ -106,14 +101,6 @@ public final class RegistrarFormFields {
           .transform(RegistrarFormFields::parseHostname)
           .build();
 
-  public static final FormField<Boolean, Boolean> BLOCK_PREMIUM_NAMES_FIELD =
-      FormField.named("blockPremiumNames", Boolean.class)
-          .build();
-
-  public static final FormField<String, String> DRIVE_FOLDER_ID_FIELD =
-      FormFields.XS_NORMALIZED_STRING.asBuilderNamed("driveFolderId")
-          .build();
-
   public static final FormField<String, String> CLIENT_CERTIFICATE_HASH_FIELD =
       FormField.named("clientCertificateHash")
           .emptyToNull()
@@ -217,10 +204,10 @@ public final class RegistrarFormFields {
   public static final FormField<String, String> CONTACT_REGISTRY_LOCK_PASSWORD_FIELD =
       FormFields.NAME.asBuilderNamed("registryLockPassword").build();
 
-  public static final FormField<String, Set<RegistrarPoc.Type>> CONTACT_TYPES =
+  public static final FormField<String, Set<RegistrarPocBase.Type>> CONTACT_TYPES =
       FormField.named("types")
           .uppercased()
-          .asEnum(RegistrarPoc.Type.class)
+          .asEnum(RegistrarPocBase.Type.class)
           .asSet(Splitter.on(',').omitEmptyStrings().trimResults())
           .build();
 

core/src/main/java/google/registry/ui/server/console/RegistrarsAction.java

@@ -27,7 +27,7 @@ import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
 import google.registry.request.Parameter;

core/src/main/java/google/registry/ui/server/registrar/ConsoleRegistrarCreatorAction.java

@@ -27,8 +27,8 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
 import com.google.template.soy.tofu.SoyTofu;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
 import google.registry.request.Action.Method;

core/src/main/java/google/registry/ui/server/registrar/OteStatusAction.java

@@ -26,7 +26,7 @@ import google.registry.model.OteAccountBuilder;
 import google.registry.model.OteStats;
 import google.registry.model.OteStats.StatType;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.request.Action;
 import google.registry.request.JsonActionRunner;
 import google.registry.request.auth.Auth;

core/src/main/java/google/registry/ui/server/registrar/RegistrarSettingsAction.java

@@ -41,7 +41,7 @@ import google.registry.flows.certs.CertificateChecker;
 import google.registry.flows.certs.CertificateChecker.InsecureCertificateException;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import google.registry.request.Action;
 import google.registry.request.Action.Service;
 import google.registry.request.HttpException.BadRequestException;

core/src/main/resources/META-INF/persistence.xml

@@ -47,7 +47,11 @@
     <class>google.registry.model.billing.BillingRecurrence</class>
     <class>google.registry.model.common.Cursor</class>
     <class>google.registry.model.common.DnsRefreshRequest</class>
+    <class>google.registry.model.console.ConsoleEppActionHistory</class>
+    <class>google.registry.model.console.RegistrarPocUpdateHistory</class>
+    <class>google.registry.model.console.RegistrarUpdateHistory</class>
     <class>google.registry.model.console.User</class>
+    <class>google.registry.model.console.UserUpdateHistory</class>
     <class>google.registry.model.contact.ContactHistory</class>
     <class>google.registry.model.contact.Contact</class>
     <class>google.registry.model.domain.Domain</class>

core/src/test/java/google/registry/batch/SendExpiringCertificateNotificationEmailActionTest.java

@@ -36,7 +36,8 @@ import google.registry.groups.GmailClient;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
@@ -223,7 +224,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("will@example-registrar.tld")
                 .setPhoneNumber("+1.3105551213")
                 .setFaxNumber("+1.3105551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .setVisibleInWhoisAsAdmin(true)
                 .setVisibleInWhoisAsTech(false)
                 .build());
@@ -513,7 +514,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("jd@example-registrar.tld")
                 .setPhoneNumber("+1.3105551213")
                 .setFaxNumber("+1.3105551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .setVisibleInWhoisAsAdmin(true)
                 .setVisibleInWhoisAsTech(false)
                 .build(),
@@ -523,7 +524,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("js@example-registrar.tld")
                 .setPhoneNumber("+1.1111111111")
                 .setFaxNumber("+1.1111111111")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .build(),
             new RegistrarPoc.Builder()
                 .setRegistrar(registrar)
@@ -531,7 +532,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("will@example-registrar.tld")
                 .setPhoneNumber("+1.3105551213")
                 .setFaxNumber("+1.3105551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .setVisibleInWhoisAsAdmin(true)
                 .setVisibleInWhoisAsTech(false)
                 .build(),
@@ -541,7 +542,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("mike@example-registrar.tld")
                 .setPhoneNumber("+1.1111111111")
                 .setFaxNumber("+1.1111111111")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 .build(),
             new RegistrarPoc.Builder()
                 .setRegistrar(registrar)
@@ -549,7 +550,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
                 .setEmailAddress("john@example-registrar.tld")
                 .setPhoneNumber("+1.3105551215")
                 .setFaxNumber("+1.3105551216")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 .setVisibleInWhoisAsTech(true)
                 .build());
     persistSimpleResources(contacts);
@@ -703,7 +704,7 @@ class SendExpiringCertificateNotificationEmailActionTest {
 
   /** Returns persisted sample contacts with a customized contact email type. */
   private static ImmutableList<RegistrarPoc> persistSampleContacts(
-      Registrar registrar, RegistrarPoc.Type emailType) {
+      Registrar registrar, RegistrarPocBase.Type emailType) {
     return persistSimpleResources(
         ImmutableList.of(
             new RegistrarPoc.Builder()

core/src/test/java/google/registry/beam/rde/RdePipelineTest.java

@@ -69,7 +69,7 @@ import google.registry.model.rde.RdeMode;
 import google.registry.model.rde.RdeRevision;
 import google.registry.model.rde.RdeRevision.RdeRevisionId;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;

core/src/test/java/google/registry/export/SyncGroupMembersActionTest.java

@@ -16,9 +16,9 @@ package google.registry.export;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.export.SyncGroupMembersAction.getGroupEmailAddressForContactType;
-import static google.registry.model.registrar.RegistrarPoc.Type.ADMIN;
-import static google.registry.model.registrar.RegistrarPoc.Type.MARKETING;
-import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ADMIN;
+import static google.registry.model.registrar.RegistrarPocBase.Type.MARKETING;
+import static google.registry.model.registrar.RegistrarPocBase.Type.TECH;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;

core/src/test/java/google/registry/export/sheet/SyncRegistrarsSheetTest.java

@@ -38,6 +38,7 @@ import google.registry.model.common.Cursor;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.DatabaseHelper;
@@ -157,7 +158,8 @@ public class SyncRegistrarsSheetTest {
                 .setName("Jane Doe")
                 .setEmailAddress("contact@example.com")
                 .setPhoneNumber("+1.1234567890")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN, RegistrarPoc.Type.BILLING))
+                .setTypes(
+                    ImmutableSet.of(RegistrarPocBase.Type.ADMIN, RegistrarPocBase.Type.BILLING))
                 .build(),
             new RegistrarPoc.Builder()
                 .setRegistrar(registrar)
@@ -165,7 +167,7 @@ public class SyncRegistrarsSheetTest {
                 .setEmailAddress("john.doe@example.tld")
                 .setPhoneNumber("+1.1234567890")
                 .setFaxNumber("+1.1234567891")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 // Purposely flip the internal/external admin/tech
                 // distinction to make sure we're not relying on it.  Sigh.
                 .setVisibleInWhoisAsAdmin(false)
@@ -176,7 +178,7 @@ public class SyncRegistrarsSheetTest {
                 .setRegistrar(registrar)
                 .setName("Jane Smith")
                 .setEmailAddress("pride@example.net")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .build());
     // Use registrar key for contacts' parent.
     DateTime registrarCreationTime = persistResource(registrar).getCreationTime();

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -173,7 +173,7 @@ import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.PendingActionNotificationResponse.DomainPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;

core/src/test/java/google/registry/flows/domain/DomainRenewFlowTest.java

@@ -93,7 +93,7 @@ import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;

core/src/test/java/google/registry/flows/domain/DomainRestoreRequestFlowTest.java

@@ -69,7 +69,7 @@ import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
 import google.registry.model.reporting.HistoryEntry;

core/src/test/java/google/registry/flows/domain/DomainTransferRequestFlowTest.java

@@ -114,7 +114,7 @@ import google.registry.model.eppcommon.Trid;
 import google.registry.model.poll.PendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.DomainTransactionRecord;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntry.HistoryEntryId;

core/src/test/java/google/registry/flows/session/LoginFlowTestCase.java

@@ -36,7 +36,7 @@ import google.registry.flows.session.LoginFlow.TooManyFailedLoginsException;
 import google.registry.flows.session.LoginFlow.UnsupportedLanguageException;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.testing.DatabaseHelper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

core/src/test/java/google/registry/model/console/ConsoleEppActionHistoryTest.java

@@ -0,0 +1,68 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.collect.Iterables.getOnlyElement;
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.persistActiveContact;
+import static google.registry.testing.DatabaseHelper.persistDomainWithDependentResources;
+
+import google.registry.model.EntityTestCase;
+import google.registry.model.domain.DomainHistory;
+import google.registry.testing.DatabaseHelper;
+import google.registry.util.DateTimeUtils;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/** Tests for {@link ConsoleEppActionHistory}. */
+public class ConsoleEppActionHistoryTest extends EntityTestCase {
+
+  ConsoleEppActionHistoryTest() {
+    super(JpaEntityCoverageCheck.ENABLED);
+  }
+
+  @BeforeEach
+  void beforeEach() {
+    createTld("tld");
+    persistDomainWithDependentResources(
+        "example",
+        "tld",
+        persistActiveContact("contact1234"),
+        fakeClock.nowUtc(),
+        fakeClock.nowUtc(),
+        DateTimeUtils.END_OF_TIME);
+  }
+
+  @Test
+  void testPersistence() {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    DomainHistory domainHistory = getOnlyElement(DatabaseHelper.loadAllOf(DomainHistory.class));
+    ConsoleEppActionHistory history =
+        new ConsoleEppActionHistory.Builder()
+            .setType(ConsoleUpdateHistory.Type.EPP_ACTION)
+            .setActingUser(user)
+            .setModificationTime(fakeClock.nowUtc())
+            .setMethod("POST")
+            .setUrl("https://some/url/for/creating/a/domain")
+            .setHistoryEntryClass(DomainHistory.class)
+            .setHistoryEntryId(domainHistory.getHistoryEntryId())
+            .build();
+    tm().transact(() -> tm().put(history));
+    assertThat(getOnlyElement(DatabaseHelper.loadAllOf(ConsoleEppActionHistory.class)))
+        .isEqualTo(history);
+  }
+}

core/src/test/java/google/registry/model/console/RegistrarPocUpdateHistoryTest.java

@@ -0,0 +1,61 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+
+import com.google.common.collect.Iterables;
+import google.registry.model.EntityTestCase;
+import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPoc.RegistrarPocId;
+import google.registry.persistence.VKey;
+import google.registry.testing.DatabaseHelper;
+import org.junit.jupiter.api.Test;
+
+/** Tests for {@link RegistrarPocUpdateHistory}. */
+public class RegistrarPocUpdateHistoryTest extends EntityTestCase {
+
+  RegistrarPocUpdateHistoryTest() {
+    super(JpaEntityCoverageCheck.ENABLED);
+  }
+
+  @Test
+  void testPersistence() {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    RegistrarPoc registrarPoc =
+        DatabaseHelper.loadByKey(
+            VKey.create(
+                RegistrarPoc.class,
+                new RegistrarPocId("johndoe@theregistrar.com", "TheRegistrar")));
+    RegistrarPocUpdateHistory history =
+        new RegistrarPocUpdateHistory.Builder()
+            .setRegistrarPoc(registrarPoc)
+            .setActingUser(user)
+            .setModificationTime(fakeClock.nowUtc())
+            .setType(ConsoleUpdateHistory.Type.USER_UPDATE)
+            .setMethod("POST")
+            .setUrl("someUrl")
+            .build();
+    tm().transact(() -> tm().put(history));
+
+    // Change the POC and make sure the history stays the same
+    tm().transact(() -> tm().put(registrarPoc.asBuilder().setName("Some Othername").build()));
+
+    RegistrarPocUpdateHistory fromDb =
+        Iterables.getOnlyElement(DatabaseHelper.loadAllOf(RegistrarPocUpdateHistory.class));
+    assertThat(fromDb.getRegistrarPoc().getName()).isEqualTo("John Doe");
+  }
+}

core/src/test/java/google/registry/model/console/RegistrarUpdateHistoryTest.java

@@ -0,0 +1,55 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+
+import com.google.common.collect.Iterables;
+import google.registry.model.EntityTestCase;
+import google.registry.model.registrar.Registrar;
+import google.registry.testing.DatabaseHelper;
+import org.junit.jupiter.api.Test;
+
+/** Tests for {@link RegistrarUpdateHistory}. */
+public class RegistrarUpdateHistoryTest extends EntityTestCase {
+
+  RegistrarUpdateHistoryTest() {
+    super(JpaEntityCoverageCheck.ENABLED);
+  }
+
+  @Test
+  void testPersistence() {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    Registrar theRegistrar = DatabaseHelper.loadRegistrar("TheRegistrar");
+    RegistrarUpdateHistory history =
+        new RegistrarUpdateHistory.Builder()
+            .setRegistrar(theRegistrar)
+            .setActingUser(user)
+            .setModificationTime(fakeClock.nowUtc())
+            .setType(ConsoleUpdateHistory.Type.USER_UPDATE)
+            .setMethod("POST")
+            .setUrl("someUrl")
+            .build();
+    tm().transact(() -> tm().put(history));
+
+    // Change the registrar and make sure the history stays the same
+    tm().transact(() -> tm().put(theRegistrar.asBuilder().setUrl("https://other.url").build()));
+
+    RegistrarUpdateHistory fromDb =
+        Iterables.getOnlyElement(DatabaseHelper.loadAllOf(RegistrarUpdateHistory.class));
+    assertThat(fromDb.getRegistrar().getUrl()).isEqualTo("http://my.fake.url");
+  }
+}

core/src/test/java/google/registry/model/console/UserTest.java

@@ -20,6 +20,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import google.registry.model.EntityTestCase;
+import google.registry.testing.DatabaseHelper;
 import org.junit.jupiter.api.Test;
 
 /** Tests for {@link User}. */
@@ -31,13 +32,7 @@ public class UserTest extends EntityTestCase {
 
   @Test
   void testPersistence_lookupByEmail() {
-    User user =
-        new User.Builder()
-            .setEmailAddress("email@email.com")
-            .setUserRoles(
-                new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).setIsAdmin(true).build())
-            .build();
-    tm().transact(() -> tm().put(user));
+    User user = DatabaseHelper.createAdminUser("email@email.com");
     tm().transact(
             () -> {
               assertAboutImmutableObjects()

core/src/test/java/google/registry/model/console/UserUpdateHistoryTest.java

@@ -0,0 +1,65 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.console;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.testing.DatabaseHelper.loadAllOf;
+
+import com.google.common.collect.Iterables;
+import google.registry.model.EntityTestCase;
+import google.registry.testing.DatabaseHelper;
+import org.junit.jupiter.api.Test;
+
+/** Tests for {@link UserUpdateHistory}. */
+public class UserUpdateHistoryTest extends EntityTestCase {
+
+  UserUpdateHistoryTest() {
+    super(JpaEntityCoverageCheck.ENABLED);
+  }
+
+  @Test
+  void testPersistence() {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    User otherUser = DatabaseHelper.createAdminUser("otherEmail@email.com");
+    UserUpdateHistory history =
+        new UserUpdateHistory.Builder()
+            .setUser(otherUser)
+            .setActingUser(user)
+            .setModificationTime(fakeClock.nowUtc())
+            .setType(ConsoleUpdateHistory.Type.USER_UPDATE)
+            .setMethod("POST")
+            .setUrl("someUrl")
+            .build();
+    tm().transact(() -> tm().put(history));
+
+    // Change the acted-upon user and make sure that nothing changed in the history DB
+    tm().transact(
+            () ->
+                tm().put(
+                        otherUser
+                            .asBuilder()
+                            .setUserRoles(
+                                otherUser
+                                    .getUserRoles()
+                                    .asBuilder()
+                                    .setGlobalRole(GlobalRole.SUPPORT_LEAD)
+                                    .build())
+                            .build()));
+
+    UserUpdateHistory fromDb = Iterables.getOnlyElement(loadAllOf(UserUpdateHistory.class));
+    assertThat(fromDb.getUser().getUserRoles().getGlobalRole()).isEqualTo(GlobalRole.FTE);
+  }
+}

core/src/test/java/google/registry/model/registrar/RegistrarTest.java

@@ -39,8 +39,8 @@ import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.ImmutableSortedSet;
 import google.registry.config.RegistryConfig;
 import google.registry.model.EntityTestCase;
-import google.registry.model.registrar.Registrar.State;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.State;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.Tlds;
@@ -129,7 +129,7 @@ class RegistrarTest extends EntityTestCase {
             .setVisibleInWhoisAsTech(false)
             .setPhoneNumber("+1.2125551213")
             .setFaxNumber("+1.2125551213")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.ABUSE, RegistrarPoc.Type.ADMIN))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ABUSE, RegistrarPocBase.Type.ADMIN))
             .build();
     persistSimpleResources(
         ImmutableList.of(
@@ -140,7 +140,8 @@ class RegistrarTest extends EntityTestCase {
                 .setEmailAddress("johndoe@example.com")
                 .setPhoneNumber("+1.2125551213")
                 .setFaxNumber("+1.2125551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.LEGAL, RegistrarPoc.Type.MARKETING))
+                .setTypes(
+                    ImmutableSet.of(RegistrarPocBase.Type.LEGAL, RegistrarPocBase.Type.MARKETING))
                 .build()));
   }
 
@@ -326,7 +327,7 @@ class RegistrarTest extends EntityTestCase {
                 .setVisibleInWhoisAsTech(true)
                 .setPhoneNumber("+1.2125551213")
                 .setFaxNumber("+1.2125551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .build());
     RegistrarPoc newTechAbuseContact =
         persistSimpleResource(
@@ -338,13 +339,13 @@ class RegistrarTest extends EntityTestCase {
                 .setVisibleInWhoisAsTech(true)
                 .setPhoneNumber("+1.2125551213")
                 .setFaxNumber("+1.2125551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH, RegistrarPoc.Type.ABUSE))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH, RegistrarPocBase.Type.ABUSE))
                 .build());
     ImmutableSortedSet<RegistrarPoc> techContacts =
-        registrar.getContactsOfType(RegistrarPoc.Type.TECH);
+        registrar.getContactsOfType(RegistrarPocBase.Type.TECH);
     assertThat(techContacts).containsExactly(newTechContact, newTechAbuseContact).inOrder();
     ImmutableSortedSet<RegistrarPoc> abuseContacts =
-        registrar.getContactsOfType(RegistrarPoc.Type.ABUSE);
+        registrar.getContactsOfType(RegistrarPocBase.Type.ABUSE);
     assertThat(abuseContacts).containsExactly(newTechAbuseContact, abuseAdminContact).inOrder();
   }
 

core/src/test/java/google/registry/persistence/converter/StringValueEnumeratedTest.java

@@ -19,7 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import static google.registry.testing.DatabaseHelper.insertInDb;
 
 import google.registry.model.ImmutableObject;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaUnitTestExtension;
 import javax.persistence.Entity;

core/src/test/java/google/registry/persistence/transaction/JpaTransactionManagerExtension.java

@@ -31,9 +31,10 @@ import com.google.common.collect.Maps;
 import com.google.common.collect.Streams;
 import com.google.common.io.Resources;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.persistence.HibernateSchemaExporter;
 import google.registry.persistence.NomulusPostgreSql;
 import google.registry.persistence.PersistenceModule;
@@ -410,7 +411,7 @@ public abstract class JpaTransactionManagerExtension
         .setVisibleInWhoisAsTech(false)
         .setEmailAddress("janedoe@theregistrar.com")
         .setPhoneNumber("+1.1234567890")
-        .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+        .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
         .build();
   }
 
@@ -424,7 +425,7 @@ public abstract class JpaTransactionManagerExtension
         .setName("John Doe")
         .setEmailAddress("johndoe@theregistrar.com")
         .setPhoneNumber("+1.1234567890")
-        .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+        .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
         .setLoginEmailAddress("johndoe@theregistrar.com")
         .build();
   }
@@ -436,7 +437,7 @@ public abstract class JpaTransactionManagerExtension
         .setEmailAddress("Marla.Singer@crr.com")
         .setRegistryLockEmailAddress("Marla.Singer.RegistryLock@crr.com")
         .setPhoneNumber("+1.2128675309")
-        .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+        .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
         .setLoginEmailAddress("Marla.Singer@crr.com")
         .setAllowedToSetRegistryLockPassword(true)
         .setRegistryLockPassword("hi")

core/src/test/java/google/registry/rdap/RdapJsonFormatterTest.java

@@ -39,6 +39,7 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.Host;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
@@ -259,7 +260,7 @@ class RdapJsonFormatterTest {
             .setEmailAddress("babydoe@example.com")
             .setPhoneNumber("+1.2125551217")
             .setFaxNumber("+1.2125551218")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
             .setVisibleInWhoisAsAdmin(false)
             .setVisibleInWhoisAsTech(false)
             .build(),
@@ -268,7 +269,7 @@ class RdapJsonFormatterTest {
             .setName("John Doe")
             .setEmailAddress("johndoe@example.com")
             .setFaxNumber("+1.2125551213")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
             .setVisibleInWhoisAsAdmin(false)
             .setVisibleInWhoisAsTech(true)
             .build(),
@@ -277,7 +278,7 @@ class RdapJsonFormatterTest {
             .setName("Jane Doe")
             .setEmailAddress("janedoe@example.com")
             .setPhoneNumber("+1.2125551215")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH, RegistrarPoc.Type.ADMIN))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH, RegistrarPocBase.Type.ADMIN))
             .setVisibleInWhoisAsAdmin(true)
             .setVisibleInWhoisAsTech(false)
             .build(),
@@ -287,7 +288,7 @@ class RdapJsonFormatterTest {
             .setEmailAddress("playdoe@example.com")
             .setPhoneNumber("+1.2125551217")
             .setFaxNumber("+1.2125551218")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.BILLING))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.BILLING))
             .setVisibleInWhoisAsAdmin(true)
             .setVisibleInWhoisAsTech(true)
             .build());

core/src/test/java/google/registry/rdap/UpdateRegistrarRdapBaseUrlsActionTest.java

@@ -30,6 +30,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.request.HttpException.InternalServerErrorException;
@@ -91,7 +92,7 @@ public final class UpdateRegistrarRdapBaseUrlsActionTest {
   }
 
   private static void persistRegistrar(
-      String registrarId, Long ianaId, Registrar.Type type, String... rdapBaseUrls) {
+      String registrarId, Long ianaId, RegistrarBase.Type type, String... rdapBaseUrls) {
     persistSimpleResource(
         new Registrar.Builder()
             .setRegistrarId(registrarId)

core/src/test/java/google/registry/rde/RegistrarToXjcConverterTest.java

@@ -22,8 +22,8 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableList;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;

core/src/test/java/google/registry/request/auth/AuthenticatedRegistrarAccessorTest.java

@@ -38,7 +38,7 @@ import google.registry.model.console.GlobalRole;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor.RegistrarAccessDeniedException;

core/src/test/java/google/registry/request/auth/OidcTokenAuthenticationMechanismTest.java

@@ -18,6 +18,7 @@ import static com.google.common.net.HttpHeaders.AUTHORIZATION;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.request.auth.AuthModule.BEARER_PREFIX;
 import static google.registry.request.auth.AuthModule.IAP_HEADER_NAME;
+import static google.registry.testing.DatabaseHelper.createAdminUser;
 import static google.registry.testing.DatabaseHelper.insertInDb;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -56,17 +57,12 @@ public class OidcTokenAuthenticationMechanismTest {
       ImmutableSet.of("service@email.test", "email@service.goog");
 
   private final Payload payload = new Payload();
-  private final User user =
-      new User.Builder()
-          .setEmailAddress(email)
-          .setUserRoles(
-              new UserRoles.Builder().setIsAdmin(true).setGlobalRole(GlobalRole.FTE).build())
-          .build();
   private final JsonWebSignature jwt =
       new JsonWebSignature(new Header(), payload, new byte[0], new byte[0]);
   private final TokenVerifier tokenVerifier = mock(TokenVerifier.class);
   private final HttpServletRequest request = mock(HttpServletRequest.class);
 
+  private User user;
   private AuthResult authResult;
   private OidcTokenAuthenticationMechanism authenticationMechanism =
       new OidcTokenAuthenticationMechanism(serviceAccounts, tokenVerifier, null, e -> rawToken) {};
@@ -80,7 +76,7 @@ public class OidcTokenAuthenticationMechanismTest {
     when(tokenVerifier.verify(rawToken)).thenReturn(jwt);
     payload.setEmail(email);
     payload.setSubject(gaiaId);
-    insertInDb(user);
+    user = createAdminUser(email);
   }
 
   @AfterEach

core/src/test/java/google/registry/schema/integration/SqlIntegrationTestSuite.java

@@ -23,7 +23,11 @@ import google.registry.bsa.persistence.BsaUnblockableDomainTest;
 import google.registry.model.billing.BillingBaseTest;
 import google.registry.model.common.CursorTest;
 import google.registry.model.common.DnsRefreshRequestTest;
+import google.registry.model.console.ConsoleEppActionHistoryTest;
+import google.registry.model.console.RegistrarPocUpdateHistoryTest;
+import google.registry.model.console.RegistrarUpdateHistoryTest;
 import google.registry.model.console.UserTest;
+import google.registry.model.console.UserUpdateHistoryTest;
 import google.registry.model.contact.ContactTest;
 import google.registry.model.domain.DomainSqlTest;
 import google.registry.model.domain.token.AllocationTokenTest;
@@ -92,6 +96,7 @@ import org.junit.runner.RunWith;
   BsaUnblockableDomainTest.class,
   BulkPricingPackageTest.class,
   ClaimsListDaoTest.class,
+  ConsoleEppActionHistoryTest.class,
   ContactHistoryTest.class,
   ContactTest.class,
   CursorTest.class,
@@ -104,6 +109,8 @@ import org.junit.runner.RunWith;
   PremiumListDaoTest.class,
   RdeRevisionTest.class,
   RegistrarDaoTest.class,
+  RegistrarPocUpdateHistoryTest.class,
+  RegistrarUpdateHistoryTest.class,
   TldTest.class,
   ReservedListDaoTest.class,
   RegistryLockDaoTest.class,
@@ -112,6 +119,7 @@ import org.junit.runner.RunWith;
   Spec11ThreatMatchTest.class,
   TmchCrlTest.class,
   UserTest.class,
+  UserUpdateHistoryTest.class,
   // AfterSuiteTest must be the last entry. See class javadoc for details.
   AfterSuiteTest.class
 })

core/src/test/java/google/registry/schema/registrar/RegistrarPocTest.java

@@ -15,7 +15,7 @@
 package google.registry.schema.registrar;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
+import static google.registry.model.registrar.RegistrarPocBase.Type.WHOIS;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.insertInDb;
 import static google.registry.testing.DatabaseHelper.loadByEntity;

core/src/test/java/google/registry/testing/DatabaseHelper.java

@@ -72,6 +72,10 @@ import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.DnsRefreshRequest;
+import google.registry.model.console.GlobalRole;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
+import google.registry.model.console.UserRoles;
 import google.registry.model.contact.Contact;
 import google.registry.model.contact.ContactAuthInfo;
 import google.registry.model.contact.ContactHistory;
@@ -91,8 +95,9 @@ import google.registry.model.host.Host;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.reporting.HistoryEntryDao;
 import google.registry.model.tld.Tld;
@@ -752,7 +757,7 @@ public final class DatabaseHelper {
   public static Registrar persistNewRegistrar(
       String registrarId,
       String registrarName,
-      Registrar.Type type,
+      RegistrarBase.Type type,
       @Nullable Long ianaIdentifier) {
     return persistSimpleResource(
         new Registrar.Builder()
@@ -1011,6 +1016,22 @@ public final class DatabaseHelper {
     return tm().transact(() -> tm().loadByEntity(resource));
   }
 
+  /** Persists an admin {@link User} with the given email address if it doesn't already exist. */
+  public static User createAdminUser(String emailAddress) {
+    Optional<User> existingUser = UserDao.loadUser(emailAddress);
+    if (existingUser.isPresent()) {
+      return existingUser.get();
+    }
+    User user =
+        new User.Builder()
+            .setEmailAddress(emailAddress)
+            .setUserRoles(
+                new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).setIsAdmin(true).build())
+            .build();
+    tm().transact(() -> tm().put(user));
+    return UserDao.loadUser(emailAddress).get();
+  }
+
   /** Returns all the history entries that are parented off the given EppResource. */
   public static List<HistoryEntry> getHistoryEntries(EppResource resource) {
     return HistoryEntryDao.loadHistoryObjectsForResource(resource.createVKey());

core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java

@@ -38,7 +38,9 @@ import google.registry.model.eppcommon.Trid;
 import google.registry.model.host.Host;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
+import google.registry.model.registrar.RegistrarBase;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.model.reporting.HistoryEntry;
 import google.registry.persistence.VKey;
 import google.registry.util.Idn;
@@ -51,12 +53,12 @@ import org.joda.time.DateTime;
 public final class FullFieldsTestEntityHelper {
 
   public static Registrar makeRegistrar(
-      String registrarId, String registrarName, Registrar.State state) {
+      String registrarId, String registrarName, RegistrarBase.State state) {
     return makeRegistrar(registrarId, registrarName, state, 1L);
   }
 
   public static Registrar makeRegistrar(
-      String registrarId, String registrarName, Registrar.State state, Long ianaIdentifier) {
+      String registrarId, String registrarName, RegistrarBase.State state, Long ianaIdentifier) {
     return new Registrar.Builder()
         .setRegistrarId(registrarId)
         .setRegistrarName(registrarName)
@@ -98,7 +100,7 @@ public final class FullFieldsTestEntityHelper {
             .setEmailAddress("johndoe@example.com")
             .setPhoneNumber("+1.2125551213")
             .setFaxNumber("+1.2125551213")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
             // Purposely flip the internal/external admin/tech
             // distinction to make sure we're not relying on it.  Sigh.
             .setVisibleInWhoisAsAdmin(false)
@@ -110,7 +112,7 @@ public final class FullFieldsTestEntityHelper {
             .setEmailAddress("janedoe@example.com")
             .setPhoneNumber("+1.2125551215")
             .setFaxNumber("+1.2125551216")
-            .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+            .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
             // Purposely flip the internal/external admin/tech
             // distinction to make sure we're not relying on it.  Sigh.
             .setVisibleInWhoisAsAdmin(true)

core/src/test/java/google/registry/tools/CheckDomainClaimsCommandTest.java

@@ -18,7 +18,7 @@ import static google.registry.testing.DatabaseHelper.persistNewRegistrar;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.beust.jcommander.ParameterException;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 

core/src/test/java/google/registry/tools/CheckDomainCommandTest.java

@@ -18,7 +18,7 @@ import static google.registry.testing.DatabaseHelper.persistNewRegistrar;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.beust.jcommander.ParameterException;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 

core/src/test/java/google/registry/tools/DeleteUserCommandTest.java

@@ -22,10 +22,8 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
-import google.registry.model.console.GlobalRole;
-import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
-import google.registry.model.console.UserRoles;
+import google.registry.testing.DatabaseHelper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -41,13 +39,7 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
 
   @Test
   void testSuccess_deletesUser() throws Exception {
-    User user =
-        new User.Builder()
-            .setEmailAddress("email@example.test")
-            .setUserRoles(
-                new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).setIsAdmin(true).build())
-            .build();
-    UserDao.saveUser(user);
+    DatabaseHelper.createAdminUser("email@example.test");
     assertThat(UserDao.loadUser("email@example.test")).isPresent();
     runCommandForced("--email", "email@example.test");
     assertThat(UserDao.loadUser("email@example.test")).isEmpty();

core/src/test/java/google/registry/tools/LockDomainCommandTest.java

@@ -26,7 +26,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.common.collect.ImmutableList;
 import google.registry.model.domain.Domain;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.testing.CloudTasksHelper;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.DeterministicStringGenerator;

core/src/test/java/google/registry/tools/RegistrarPocCommandTest.java

@@ -15,10 +15,10 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.registrar.RegistrarPoc.Type.ABUSE;
-import static google.registry.model.registrar.RegistrarPoc.Type.ADMIN;
-import static google.registry.model.registrar.RegistrarPoc.Type.TECH;
-import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ABUSE;
+import static google.registry.model.registrar.RegistrarPocBase.Type.ADMIN;
+import static google.registry.model.registrar.RegistrarPocBase.Type.TECH;
+import static google.registry.model.registrar.RegistrarPocBase.Type.WHOIS;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DatabaseHelper.persistSimpleResource;

core/src/test/java/google/registry/tools/SetupOteCommandTest.java

@@ -15,7 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.registrar.Registrar.State.ACTIVE;
+import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.testing.CertificateSamples.SAMPLE_CERT_HASH;

core/src/test/java/google/registry/tools/UnlockDomainCommandTest.java

@@ -29,7 +29,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.RegistryLock;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.testing.CloudTasksHelper;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.DeterministicStringGenerator;

core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java

@@ -37,8 +37,8 @@ import com.google.common.collect.ImmutableSortedMap;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.flows.certs.CertificateChecker.InsecureCertificateException;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.State;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.persistence.transaction.JpaTransactionManagerExtension;
 import google.registry.util.CidrAddressBlock;
 import java.math.BigDecimal;

core/src/test/java/google/registry/tools/ValidateLoginCredentialsCommandTest.java

@@ -15,7 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.registrar.Registrar.State.ACTIVE;
+import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;
@@ -32,7 +32,7 @@ import google.registry.flows.EppException;
 import google.registry.flows.TransportCredentials.BadRegistrarPasswordException;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.testing.CertificateSamples;
 import google.registry.util.CidrAddressBlock;
 import java.nio.file.Files;

core/src/test/java/google/registry/ui/server/console/ConsoleDomainListActionTest.java

@@ -16,6 +16,7 @@ package google.registry.ui.server.console;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.DatabaseHelper.createAdminUser;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistDomainAsDeleted;
@@ -24,9 +25,6 @@ import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.Iterables;
 import com.google.gson.Gson;
 import google.registry.model.EppResourceUtils;
-import google.registry.model.console.GlobalRole;
-import google.registry.model.console.User;
-import google.registry.model.console.UserRoles;
 import google.registry.model.domain.Domain;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.request.auth.AuthResult;
@@ -232,12 +230,7 @@ public class ConsoleDomainListActionTest {
       @Nullable String searchTerm) {
     response = new FakeResponse();
     AuthResult authResult =
-        AuthResult.createUser(
-            UserAuthInfo.create(
-                new User.Builder()
-                    .setEmailAddress("email@email.example")
-                    .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
-                    .build()));
+        AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.example")));
     return new ConsoleDomainListAction(
         authResult,
         response,

core/src/test/java/google/registry/ui/server/console/ConsoleUserDataActionTest.java

@@ -20,14 +20,13 @@ import static org.mockito.Mockito.when;
 
 import com.google.api.client.http.HttpStatusCodes;
 import com.google.gson.Gson;
-import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
-import google.registry.model.console.UserRoles;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.request.Action;
 import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.UserAuthInfo;
+import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeConsoleApiParams;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.ConsoleApiParams;
@@ -52,12 +51,7 @@ class ConsoleUserDataActionTest {
 
   @Test
   void testSuccess_hasXSRFCookie() throws IOException {
-    User user =
-        new User.Builder()
-            .setEmailAddress("email@email.com")
-            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
-            .build();
-
+    User user = DatabaseHelper.createAdminUser("email@email.com");
     AuthResult authResult = AuthResult.createUser(UserAuthInfo.create(user));
     ConsoleUserDataAction action =
         createAction(
@@ -70,12 +64,7 @@ class ConsoleUserDataActionTest {
 
   @Test
   void testSuccess_getContactInfo() throws IOException {
-    User user =
-        new User.Builder()
-            .setEmailAddress("email@email.com")
-            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
-            .build();
-
+    User user = DatabaseHelper.createAdminUser("email@email.com");
     AuthResult authResult = AuthResult.createUser(UserAuthInfo.create(user));
     ConsoleUserDataAction action =
         createAction(
@@ -88,7 +77,7 @@ class ConsoleUserDataActionTest {
     assertThat(jsonObject)
         .containsExactly(
             "isAdmin",
-            false,
+            true,
             "technicalDocsUrl",
             "test",
             "globalRole",

core/src/test/java/google/registry/ui/server/console/settings/ContactActionTest.java

@@ -16,7 +16,8 @@ package google.registry.ui.server.console.settings;
 
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.model.registrar.RegistrarPoc.Type.WHOIS;
+import static google.registry.model.registrar.RegistrarPocBase.Type.WHOIS;
+import static google.registry.testing.DatabaseHelper.createAdminUser;
 import static google.registry.testing.DatabaseHelper.insertInDb;
 import static google.registry.testing.DatabaseHelper.loadAllOf;
 import static google.registry.testing.SqlHelper.saveRegistrar;
@@ -27,7 +28,6 @@ import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.gson.Gson;
-import google.registry.model.console.GlobalRole;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
@@ -102,9 +102,7 @@ class ContactActionTest {
     ContactAction action =
         createAction(
             Action.Method.GET,
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+            AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId(),
             null);
     action.run();
@@ -119,9 +117,7 @@ class ContactActionTest {
     ContactAction action =
         createAction(
             Action.Method.GET,
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+            AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId(),
             null);
     action.run();
@@ -134,9 +130,7 @@ class ContactActionTest {
     ContactAction action =
         createAction(
             Action.Method.POST,
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+            AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId(),
             "[" + jsonRegistrar1 + "," + jsonRegistrar2 + "]");
     action.run();
@@ -156,9 +150,7 @@ class ContactActionTest {
     ContactAction action =
         createAction(
             Action.Method.POST,
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+            AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId(),
             "[" + jsonRegistrar1 + "," + jsonRegistrar2 + "]");
     action.run();
@@ -181,9 +173,7 @@ class ContactActionTest {
     ContactAction action =
         createAction(
             Action.Method.POST,
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+            AuthResult.createUser(UserAuthInfo.create(createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId(),
             "[" + jsonRegistrar2 + "]");
     action.run();
@@ -204,25 +194,22 @@ class ContactActionTest {
             Action.Method.POST,
             AuthResult.createUser(
                 UserAuthInfo.create(
-                    createUser(
-                        new UserRoles.Builder()
-                            .setRegistrarRoles(
-                                ImmutableMap.of(
-                                    testRegistrar.getRegistrarId(), RegistrarRole.ACCOUNT_MANAGER))
-                            .build()))),
+                    new User.Builder()
+                        .setEmailAddress("email@email.com")
+                        .setUserRoles(
+                            new UserRoles.Builder()
+                                .setRegistrarRoles(
+                                    ImmutableMap.of(
+                                        testRegistrar.getRegistrarId(),
+                                        RegistrarRole.ACCOUNT_MANAGER))
+                                .build())
+                        .build())),
             testRegistrar.getRegistrarId(),
             "[" + jsonRegistrar2 + "]");
     action.run();
     assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
   }
 
-  private User createUser(UserRoles userRoles) {
-    return new User.Builder()
-        .setEmailAddress("email@email.com")
-        .setUserRoles(userRoles)
-        .build();
-  }
-
   private ContactAction createAction(
       Action.Method method, AuthResult authResult, String registrarId, String contacts)
       throws IOException {

core/src/test/java/google/registry/ui/server/console/settings/SecurityActionTest.java

@@ -28,15 +28,13 @@ import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.gson.Gson;
 import google.registry.flows.certs.CertificateChecker;
-import google.registry.model.console.GlobalRole;
-import google.registry.model.console.User;
-import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;
 import google.registry.request.auth.UserAuthInfo;
+import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
@@ -92,8 +90,7 @@ class SecurityActionTest {
     SecurityAction action =
         createAction(
             AuthResult.createUser(
-                UserAuthInfo.create(
-                    createUser(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build()))),
+                UserAuthInfo.create(DatabaseHelper.createAdminUser("email@email.com"))),
             testRegistrar.getRegistrarId());
     action.run();
     assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
@@ -104,13 +101,6 @@ class SecurityActionTest {
     assertThat(r.getIpAddressAllowList().get(0).getNetmask()).isEqualTo(32);
   }
 
-  private User createUser(UserRoles userRoles) {
-    return new User.Builder()
-        .setEmailAddress("email@email.com")
-        .setUserRoles(userRoles)
-        .build();
-  }
-
   private SecurityAction createAction(AuthResult authResult, String registrarId)
       throws IOException {
     doReturn(new BufferedReader(new StringReader(jsonRegistrar1))).when(request).getReader();
@@ -124,6 +114,5 @@ class SecurityActionTest {
           registrarAccessor,
           registrarId,
           maybeRegistrar);
-
   }
 }

core/src/test/java/google/registry/ui/server/console/settings/WhoisRegistrarFieldsActionTest.java

@@ -25,7 +25,6 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSetMultimap;
 import com.google.common.collect.Maps;
 import com.google.gson.Gson;
-import google.registry.model.console.GlobalRole;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
@@ -146,11 +145,7 @@ public class WhoisRegistrarFieldsActionTest {
 
   private AuthResult defaultUserAuth() {
     return AuthResult.createUser(
-        UserAuthInfo.create(
-            new User.Builder()
-                .setEmailAddress("email@email.example")
-                .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
-                .build()));
+        UserAuthInfo.create(DatabaseHelper.createAdminUser("email@email.example")));
   }
 
   private WhoisRegistrarFieldsAction createAction() throws IOException {

core/src/test/java/google/registry/ui/server/registrar/ContactSettingsTest.java

@@ -24,7 +24,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
-import google.registry.model.registrar.RegistrarPoc.Type;
+import google.registry.model.registrar.RegistrarPocBase.Type;
 import google.registry.persistence.transaction.JpaTransactionManagerExtension;
 import java.util.List;
 import java.util.Map;

core/src/test/java/google/registry/ui/server/registrar/OteStatusActionTest.java

@@ -26,7 +26,7 @@ import com.google.common.collect.Iterables;
 import google.registry.model.OteAccountBuilder;
 import google.registry.model.OteStats.StatType;
 import google.registry.model.OteStatsTestHelper;
-import google.registry.model.registrar.Registrar.Type;
+import google.registry.model.registrar.RegistrarBase.Type;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;

core/src/test/java/google/registry/ui/server/registrar/RegistrarSettingsActionTestCase.java

@@ -36,6 +36,7 @@ import com.google.common.collect.ImmutableSortedMap;
 import google.registry.flows.certs.CertificateChecker;
 import google.registry.groups.GmailClient;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.request.JsonActionRunner;
@@ -97,7 +98,7 @@ public abstract class RegistrarSettingsActionTestCase {
     // Add a technical contact to the registrar (in addition to the default admin contact created by
     // JpaTransactionManagerExtension).
     techContact =
-        getOnlyElement(loadRegistrar(CLIENT_ID).getContactsOfType(RegistrarPoc.Type.TECH));
+        getOnlyElement(loadRegistrar(CLIENT_ID).getContactsOfType(RegistrarPocBase.Type.TECH));
 
     action.registrarAccessor = null;
     action.jsonActionRunner =

core/src/test/java/google/registry/webdriver/RegistrarConsoleScreenshotTest.java

@@ -31,7 +31,7 @@ import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import com.google.common.collect.ImmutableMap;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.RegistryLock;
-import google.registry.model.registrar.Registrar.State;
+import google.registry.model.registrar.RegistrarBase.State;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.module.frontend.FrontendServlet;
 import google.registry.server.RegistryTestServer;

core/src/test/java/google/registry/whois/RegistrarWhoisResponseTest.java

@@ -25,6 +25,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarPoc;
+import google.registry.model.registrar.RegistrarPocBase;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
@@ -74,7 +75,7 @@ class RegistrarWhoisResponseTest {
                 .setEmailAddress("joeregistrar@example-registrar.tld")
                 .setPhoneNumber("+1.3105551213")
                 .setFaxNumber("+1.3105551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 .setVisibleInWhoisAsAdmin(true)
                 .setVisibleInWhoisAsTech(false)
                 .build(),
@@ -84,7 +85,7 @@ class RegistrarWhoisResponseTest {
                 .setEmailAddress("johndoe@example-registrar.tld")
                 .setPhoneNumber("+1.1111111111")
                 .setFaxNumber("+1.1111111111")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 .build(),
             new RegistrarPoc.Builder()
                 .setRegistrar(registrar)
@@ -92,7 +93,7 @@ class RegistrarWhoisResponseTest {
                 .setEmailAddress("janeregistrar@example-registrar.tld")
                 .setPhoneNumber("+1.3105551214")
                 .setFaxNumber("+1.3105551213")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.ADMIN))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.ADMIN))
                 .setVisibleInWhoisAsAdmin(true)
                 .build(),
             new RegistrarPoc.Builder()
@@ -101,7 +102,7 @@ class RegistrarWhoisResponseTest {
                 .setEmailAddress("janedoe@example-registrar.tld")
                 .setPhoneNumber("+1.1111111112")
                 .setFaxNumber("+1.1111111112")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .build(),
             new RegistrarPoc.Builder()
                 .setRegistrar(registrar)
@@ -109,7 +110,7 @@ class RegistrarWhoisResponseTest {
                 .setEmailAddress("johngeek@example-registrar.tld")
                 .setPhoneNumber("+1.3105551215")
                 .setFaxNumber("+1.3105551216")
-                .setTypes(ImmutableSet.of(RegistrarPoc.Type.TECH))
+                .setTypes(ImmutableSet.of(RegistrarPocBase.Type.TECH))
                 .setVisibleInWhoisAsTech(true)
                 .build());
     persistResource(registrar);

core/src/test/java/google/registry/whois/WhoisActionTest.java

@@ -17,8 +17,8 @@ package google.registry.whois;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.bsa.persistence.BsaTestingUtils.persistBsaLabel;
 import static google.registry.model.EppResourceUtils.loadByForeignKeyCached;
-import static google.registry.model.registrar.Registrar.State.ACTIVE;
-import static google.registry.model.registrar.Registrar.Type.PDT;
+import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
+import static google.registry.model.registrar.RegistrarBase.Type.PDT;
 import static google.registry.model.tld.Tlds.getTlds;
 import static google.registry.testing.DatabaseHelper.createTlds;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;

core/src/test/java/google/registry/whois/WhoisHttpActionTest.java

@@ -17,7 +17,7 @@ package google.registry.whois;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.bsa.persistence.BsaTestingUtils.persistBsaLabel;
-import static google.registry.model.registrar.Registrar.State.ACTIVE;
+import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
 import static google.registry.testing.DatabaseHelper.createTlds;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;

db/src/main/resources/sql/er_diagram/brief_er_diagram.html

@@ -261,7 +261,7 @@ td.section {
     </tr>
     <tr>
      <td class="property_name">generated on</td>
-     <td class="property_value">2024-04-24 21:30:39.425345476</td>
+     <td class="property_value">2024-04-29 19:20:24.144414867</td>
     </tr>
     <tr>
      <td class="property_name">last flyway file</td>
@@ -280,7 +280,7 @@ td.section {
     <text text-anchor="start" x="3730.5" y="-29.8" font-family="Helvetica,sans-Serif" font-size="14.00">generated by</text>
     <text text-anchor="start" x="3813.5" y="-29.8" font-family="Helvetica,sans-Serif" font-size="14.00">SchemaCrawler 16.10.1</text>
     <text text-anchor="start" x="3729.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">generated on</text>
-    <text text-anchor="start" x="3813.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">2024-04-24 21:30:39.425345476</text>
+    <text text-anchor="start" x="3813.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">2024-04-29 19:20:24.144414867</text>
     <polygon fill="none" stroke="#888888" points="3726,-4 3726,-44 4013,-44 4013,-4 3726,-4" /> <!-- allocationtoken_a08ccbef -->
     <g id="node1" class="node">
      <title>

db/src/main/resources/sql/er_diagram/full_er_diagram.html

@@ -261,7 +261,7 @@ td.section {
     </tr>
     <tr>
      <td class="property_name">generated on</td>
-     <td class="property_value">2024-04-24 21:30:36.545885131</td>
+     <td class="property_value">2024-04-29 19:20:21.522169488</td>
     </tr>
     <tr>
      <td class="property_name">last flyway file</td>
@@ -280,7 +280,7 @@ td.section {
     <text text-anchor="start" x="4443.5" y="-29.8" font-family="Helvetica,sans-Serif" font-size="14.00">generated by</text>
     <text text-anchor="start" x="4526.5" y="-29.8" font-family="Helvetica,sans-Serif" font-size="14.00">SchemaCrawler 16.10.1</text>
     <text text-anchor="start" x="4442.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">generated on</text>
-    <text text-anchor="start" x="4526.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">2024-04-24 21:30:36.545885131</text>
+    <text text-anchor="start" x="4526.5" y="-10.8" font-family="Helvetica,sans-Serif" font-size="14.00">2024-04-29 19:20:21.522169488</text>
     <polygon fill="none" stroke="#888888" points="4439,-4 4439,-44 4726,-44 4726,-4 4439,-4" /> <!-- allocationtoken_a08ccbef -->
     <g id="node1" class="node">
      <title>

db/src/main/resources/sql/schema/db-schema.sql.generated

@@ -130,6 +130,20 @@
         primary key (revision_id)
     );
 
+    create table "ConsoleEppActionHistory" (
+       history_revision_id int8 not null,
+        history_method text not null,
+        history_modification_time timestamptz not null,
+        history_request_body text,
+        history_type text not null,
+        history_url text not null,
+        history_entry_class text not null,
+        repo_id text not null,
+        revision_id int8 not null,
+        history_acting_user text not null,
+        primary key (history_revision_id)
+    );
+
     create table "Contact" (
        repo_id text not null,
         update_timestamp timestamptz,
@@ -663,6 +677,88 @@
         primary key (email_address, registrar_id)
     );
 
+    create table "RegistrarPocUpdateHistory" (
+       history_revision_id int8 not null,
+        history_method text not null,
+        history_modification_time timestamptz not null,
+        history_request_body text,
+        history_type text not null,
+        history_url text not null,
+        email_address text not null,
+        registrar_id text not null,
+        allowed_to_set_registry_lock_password boolean not null,
+        fax_number text,
+        login_email_address text,
+        name text,
+        phone_number text,
+        registry_lock_email_address text,
+        registry_lock_password_hash text,
+        registry_lock_password_salt text,
+        types text[],
+        visible_in_domain_whois_as_abuse boolean not null,
+        visible_in_whois_as_admin boolean not null,
+        visible_in_whois_as_tech boolean not null,
+        history_acting_user text not null,
+        primary key (history_revision_id)
+    );
+
+    create table "RegistrarUpdateHistory" (
+       history_revision_id int8 not null,
+        history_method text not null,
+        history_modification_time timestamptz not null,
+        history_request_body text,
+        history_type text not null,
+        history_url text not null,
+        allowed_tlds text[],
+        billing_account_map hstore,
+        block_premium_names boolean not null,
+        client_certificate text,
+        client_certificate_hash text,
+        contacts_require_syncing boolean not null,
+        creation_time timestamptz not null,
+        drive_folder_id text,
+        email_address text,
+        failover_client_certificate text,
+        failover_client_certificate_hash text,
+        fax_number text,
+        iana_identifier int8,
+        icann_referral_email text,
+        i18n_address_city text,
+        i18n_address_country_code text,
+        i18n_address_state text,
+        i18n_address_street_line1 text,
+        i18n_address_street_line2 text,
+        i18n_address_street_line3 text,
+        i18n_address_zip text,
+        ip_address_allow_list text[],
+        last_certificate_update_time timestamptz,
+        last_expiring_cert_notification_sent_date timestamptz,
+        last_expiring_failover_cert_notification_sent_date timestamptz,
+        localized_address_city text,
+        localized_address_country_code text,
+        localized_address_state text,
+        localized_address_street_line1 text,
+        localized_address_street_line2 text,
+        localized_address_street_line3 text,
+        localized_address_zip text,
+        password_hash text,
+        phone_number text,
+        phone_passcode text,
+        po_number text,
+        rdap_base_urls text[],
+        registrar_name text not null,
+        registry_lock_allowed boolean not null,
+        password_salt text,
+        state text,
+        type text not null,
+        url text,
+        whois_server text,
+        update_timestamp timestamptz,
+        registrar_id text not null,
+        history_acting_user text not null,
+        primary key (history_revision_id)
+    );
+
     create table "RegistryLock" (
        revision_id  bigserial not null,
         last_update_time timestamptz not null,
@@ -795,6 +891,25 @@
         registrar_roles hstore,
         primary key (id)
     );
+
+    create table "UserUpdateHistory" (
+       history_revision_id int8 not null,
+        history_method text not null,
+        history_modification_time timestamptz not null,
+        history_request_body text,
+        history_type text not null,
+        history_url text not null,
+        user_id int8 not null,
+        email_address text not null,
+        registry_lock_password_hash text,
+        registry_lock_password_salt text,
+        global_role text not null,
+        is_admin boolean not null,
+        registrar_roles hstore,
+        update_timestamp timestamptz,
+        history_acting_user text not null,
+        primary key (history_revision_id)
+    );
 create index allocation_token_domain_name_idx on "AllocationToken" (domain_name);
 create index IDX9g3s7mjv1yn4t06nqid39whss on "AllocationToken" (token_type);
 create index IDXtmlqd31dpvvd2g1h9i7erw6aj on "AllocationToken" (redemption_domain_repo_id);
@@ -818,6 +933,9 @@ create index IDXp3usbtvk0v1m14i5tdp4xnxgc on "BillingRecurrence" (recurrence_end
 create index IDXp0pxi708hlu4n40qhbtihge8x on "BillingRecurrence" (recurrence_last_expansion);
 create index IDXjny8wuot75b5e6p38r47wdawu on "BillingRecurrence" (recurrence_time_of_year);
 create index IDXj874kw19bgdnkxo1rue45jwlw on "BsaDownload" (creation_time);
+create index IDXcclyb3n5gbex8u8m9fjlujitw on "ConsoleEppActionHistory" (history_acting_user);
+create index IDX6y67d6wsffmr6jcxax5ghwqhd on "ConsoleEppActionHistory" (repo_id);
+create index IDXiahqo1d1fqdfknywmj2xbxl7t on "ConsoleEppActionHistory" (revision_id);
 create index IDX3y752kr9uh4kh6uig54vemx0l on "Contact" (creation_time);
 create index IDXtm415d6fe1rr35stm33s5mg18 on "Contact" (current_sponsor_registrar_id);
 create index IDXn1f711wicdnooa2mqb7g1m55o on "Contact" (deletion_time);
@@ -877,6 +995,11 @@ create index premiumlist_name_idx on "PremiumList" (name);
 create index registrar_name_idx on "Registrar" (registrar_name);
 create index registrar_iana_identifier_idx on "Registrar" (iana_identifier);
 create index registrarpoc_login_email_idx on "RegistrarPoc" (login_email_address);
+create index IDXrn6posxkx58de1cp09g5257cw on "RegistrarPocUpdateHistory" (history_acting_user);
+create index IDXr1cxua6it0rxgt9tpyugspxk on "RegistrarPocUpdateHistory" (email_address);
+create index IDXfr24wvpg8qalwqy4pni7evrpj on "RegistrarPocUpdateHistory" (registrar_id);
+create index IDXm6k18dusy2lfi5y81k8g256sa on "RegistrarUpdateHistory" (history_acting_user);
+create index IDX3d1mucv7axrhud8w8jl4vsu62 on "RegistrarUpdateHistory" (registrar_id);
 create index idx_registry_lock_verification_code on "RegistryLock" (verification_code);
 create index idx_registry_lock_registrar_id on "RegistryLock" (registrar_id);
 
@@ -888,6 +1011,16 @@ create index spec11threatmatch_tld_idx on "Spec11ThreatMatch" (tld);
 create index spec11threatmatch_check_date_idx on "Spec11ThreatMatch" (check_date);
 create index user_email_address_idx on "User" (email_address);
 
+    alter table if exists "User" 
+       add constraint UK_seshmd8qn3lcffsjw5j8wnbnd unique (email_address);
+create index IDXbjacjlm8ianc4kxxvamnu94k5 on "UserUpdateHistory" (history_acting_user);
+create index IDX5yqacw829y5bm6f7eajsq1cts on "UserUpdateHistory" (email_address);
+
+    alter table if exists "ConsoleEppActionHistory" 
+       add constraint FKb686b9os2nsjpv930npa4r3b4 
+       foreign key (history_acting_user) 
+       references "User" (email_address);
+
     alter table if exists "DelegationSignerData" 
        add constraint FKtr24j9v14ph2mfuw2gsmt12kq 
        foreign key (domain_repo_id) 
@@ -923,6 +1056,16 @@ create index user_email_address_idx on "User" (email_address);
        foreign key (domain_repo_id, domain_history_revision_id) 
        references "DomainHistory";
 
+    alter table if exists "RegistrarPocUpdateHistory" 
+       add constraint FKftpbwctxtkc1i0njc0tdcaa2g 
+       foreign key (history_acting_user) 
+       references "User" (email_address);
+
+    alter table if exists "RegistrarUpdateHistory" 
+       add constraint FKsr7w342s7x5s5jvdti2axqeq8 
+       foreign key (history_acting_user) 
+       references "User" (email_address);
+
     alter table if exists "RegistryLock" 
        add constraint FK2lhcwpxlnqijr96irylrh1707 
        foreign key (relock_revision_id) 
@@ -932,3 +1075,8 @@ create index user_email_address_idx on "User" (email_address);
        add constraint FK5ivlhvs3121yx2li5tqh54u4 
        foreign key (revision_id) 
        references "SignedMarkRevocationList";
+
+    alter table if exists "UserUpdateHistory" 
+       add constraint FK1s7bopbl3pwrhv3jkkofnv3o0 
+       foreign key (history_acting_user) 
+       references "User" (email_address);