Create a registry lock permission and corresponding account manager role (#1740)

* Create a registry lock permission and corresponding account manager role

This allows us to distinguish between standard account managers and
users that might have the registry lock permission. This will make the
registry lock password-setting flow easier (user can reset their
password iff they have the REGISTRY_LOCK permission, instead of having a
separate boolean) and allows us to easily determine whether or not a
user should have access to registry lock views in the UI.

core/src/test/java/google/registry/model/console/ConsoleRoleDefinitionsTest.java

@@ -49,21 +49,30 @@ public class ConsoleRoleDefinitionsTest {
     // Note: we can't use Truth's IterableSubject to check all the subset/superset restrictions
     // because it is generic to iterables and doesn't know about sets.
     assertThat(
-            ConsoleRoleDefinitions.SUPPORT_LEAD_PERMISSIONS.containsAll(
-                ConsoleRoleDefinitions.SUPPORT_AGENT_PERMISSIONS))
+            ConsoleRoleDefinitions.ACCOUNT_MANAGER_WITH_REGISTRY_LOCK_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.ACCOUNT_MANAGER_PERMISSIONS))
         .isTrue();
     assertThat(
-            ConsoleRoleDefinitions.SUPPORT_AGENT_PERMISSIONS.containsAll(
-                ConsoleRoleDefinitions.SUPPORT_LEAD_PERMISSIONS))
+            ConsoleRoleDefinitions.ACCOUNT_MANAGER_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.ACCOUNT_MANAGER_WITH_REGISTRY_LOCK_PERMISSIONS))
         .isFalse();
 
     assertThat(
-            ConsoleRoleDefinitions.SUPPORT_LEAD_PERMISSIONS.containsAll(
-                ConsoleRoleDefinitions.SUPPORT_AGENT_PERMISSIONS))
+            ConsoleRoleDefinitions.TECH_CONTACT_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.ACCOUNT_MANAGER_WITH_REGISTRY_LOCK_PERMISSIONS))
         .isTrue();
     assertThat(
-            ConsoleRoleDefinitions.SUPPORT_AGENT_PERMISSIONS.containsAll(
-                ConsoleRoleDefinitions.SUPPORT_LEAD_PERMISSIONS))
+            ConsoleRoleDefinitions.ACCOUNT_MANAGER_WITH_REGISTRY_LOCK_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.TECH_CONTACT_PERMISSIONS))
+        .isFalse();
+
+    assertThat(
+            ConsoleRoleDefinitions.PRIMARY_CONTACT_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.TECH_CONTACT_PERMISSIONS))
+        .isTrue();
+    assertThat(
+            ConsoleRoleDefinitions.TECH_CONTACT_PERMISSIONS.containsAll(
+                ConsoleRoleDefinitions.PRIMARY_CONTACT_PERMISSIONS))
         .isFalse();
   }
 }

core/src/test/java/google/registry/model/console/UserTest.java

@@ -58,4 +58,33 @@ public class UserTest {
     builder.setUserRoles(new UserRoles.Builder().build());
     builder.build();
   }
+
+  @Test
+  void testRegistryLockPassword() {
+    assertThat(
+            assertThrows(
+                IllegalArgumentException.class,
+                () ->
+                    new User.Builder()
+                        .setUserRoles(new UserRoles.Builder().build())
+                        .setRegistryLockPassword("foobar")))
+        .hasMessageThat()
+        .isEqualTo("User has no registry lock permission");
+
+    User user =
+        new User.Builder()
+            .setGaiaId("gaiaId")
+            .setEmailAddress("email@email.com")
+            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
+            .build();
+    assertThat(user.hasRegistryLockPassword()).isFalse();
+
+    user = user.asBuilder().setRegistryLockPassword("foobar").build();
+    assertThat(user.hasRegistryLockPassword()).isTrue();
+    assertThat(user.verifyRegistryLockPassword("foobar")).isTrue();
+
+    user = user.asBuilder().removeRegistryLockPassword().build();
+    assertThat(user.hasRegistryLockPassword()).isFalse();
+    assertThat(user.verifyRegistryLockPassword("foobar")).isFalse();
+  }
 }