Make GKE networking work more properly (#2531)

This commit is contained in:
Lai Jiang
2024-08-22 13:10:56 +00:00
committed by GitHub
parent 730585cd14
commit 4e013603be
65 changed files with 842 additions and 425 deletions
@@ -19,6 +19,8 @@ import static com.google.common.truth.Truth.assertThat;
import com.google.common.base.Splitter;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Sets;
import google.registry.module.backend.BackendRequestComponent;
import google.registry.module.bsa.BsaRequestComponent;
import google.registry.module.frontend.FrontendRequestComponent;
@@ -26,8 +28,9 @@ import google.registry.module.pubapi.PubApiRequestComponent;
import google.registry.module.tools.ToolsRequestComponent;
import google.registry.testing.GoldenFileTestHelper;
import google.registry.testing.TestDataHelper;
import java.util.ArrayList;
import java.util.List;
import java.util.HashSet;
import java.util.Set;
import java.util.stream.Collectors;
import org.junit.jupiter.api.Test;
/** Unit tests for {@link RequestComponent}. */
@@ -40,6 +43,18 @@ public class RequestComponentTest {
PubApiRequestComponent.class, "pubapi",
BsaRequestComponent.class, "bsa");
// Paths that do not route to Jetty (all for the legacy console).
private static final ImmutableSet<String> ignoredPaths =
ImmutableSet.of(
"/registrar",
"/registrar-create",
"/registrar-ote-setup",
"/registrar-ote-status",
"/registrar-settings",
"/registry-lock-get",
"/registry-lock-post",
"/registry-lock-verify");
@Test
void testRoutingMap() {
GoldenFileTestHelper.assertThatRoutesFromComponent(RequestComponent.class)
@@ -49,32 +64,49 @@ public class RequestComponentTest {
@Test
void testGaeToJettyRoutingCoverage() {
List<Route> jettyRoutes = getRoutes(RequestComponent.class, "routing.txt");
List<Route> gaeRoutes = new ArrayList<>();
Set<Route> jettyRoutes = getRoutes(RequestComponent.class, "routing.txt");
Set<Route> gaeRoutes = new HashSet<>();
for (var component : GaeComponents.entrySet()) {
gaeRoutes.addAll(getRoutes(component.getKey(), component.getValue() + "_routing.txt"));
}
assertThat(jettyRoutes).containsExactlyElementsIn(gaeRoutes);
assertThat(Sets.difference(jettyRoutes, gaeRoutes)).isEmpty();
assertThat(
Sets.difference(gaeRoutes, jettyRoutes).stream()
.map(Route::path)
.collect(Collectors.toSet()))
.containsExactlyElementsIn(ignoredPaths);
}
private List<Route> getRoutes(Class<?> context, String filename) {
private Set<Route> getRoutes(Class<?> context, String filename) {
return TestDataHelper.loadFile(context, filename)
.trim()
.lines()
.skip(1) // Skip the headers
.map(Route::create)
.toList();
.collect(Collectors.toSet());
}
private record Route(
String path, String clazz, String methods, String ok, String min, String userPolicy) {
String service,
String path,
String clazz,
String methods,
String ok,
String min,
String userPolicy) {
private static final Splitter splitter = Splitter.on(' ').omitEmptyStrings().trimResults();
static Route create(String line) {
ImmutableList<String> parts = ImmutableList.copyOf(splitter.split(line));
assertThat(parts.size()).isEqualTo(6);
assertThat(parts.size()).isEqualTo(7);
return new Route(
parts.get(0), parts.get(1), parts.get(2), parts.get(3), parts.get(4), parts.get(5));
parts.get(0),
parts.get(1),
parts.get(2),
parts.get(3),
parts.get(4),
parts.get(5),
parts.get(6));
}
}
}
@@ -204,6 +204,7 @@ public final class RequestHandlerTest {
handler =
RequestHandler.create(
Component.class,
"registry.test",
() ->
new Builder() {
@Override
@@ -26,8 +26,8 @@ import static org.mockito.Mockito.when;
import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload;
import com.google.api.client.json.webtoken.JsonWebSignature;
import com.google.api.client.json.webtoken.JsonWebSignature.Header;
import com.google.auth.oauth2.TokenVerifier;
import com.google.auth.oauth2.TokenVerifier.VerificationException;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import dagger.Component;
import dagger.Module;
@@ -41,6 +41,7 @@ import google.registry.request.auth.AuthSettings.AuthLevel;
import google.registry.request.auth.OidcTokenAuthenticationMechanism.IapOidcAuthenticationMechanism;
import google.registry.request.auth.OidcTokenAuthenticationMechanism.RegularOidcAuthenticationMechanism;
import jakarta.servlet.http.HttpServletRequest;
import java.util.Map;
import javax.inject.Singleton;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
@@ -59,13 +60,13 @@ public class OidcTokenAuthenticationMechanismTest {
private final Payload payload = new Payload();
private final JsonWebSignature jwt =
new JsonWebSignature(new Header(), payload, new byte[0], new byte[0]);
private final TokenVerifier tokenVerifier = mock(TokenVerifier.class);
private final HttpServletRequest request = mock(HttpServletRequest.class);
private User user;
private AuthResult authResult;
private OidcTokenAuthenticationMechanism authenticationMechanism =
new OidcTokenAuthenticationMechanism(serviceAccounts, tokenVerifier, null, e -> rawToken) {};
new OidcTokenAuthenticationMechanism(
serviceAccounts, request -> rawToken, (service, token) -> jwt) {};
@RegisterExtension
public final JpaTestExtensions.JpaUnitTestExtension jpaExtension =
@@ -73,7 +74,6 @@ public class OidcTokenAuthenticationMechanismTest {
@BeforeEach
void beforeEach() throws Exception {
when(tokenVerifier.verify(rawToken)).thenReturn(jwt);
payload.setEmail(email);
payload.setSubject(gaiaId);
user = createAdminUser(email);
@@ -93,28 +93,23 @@ public class OidcTokenAuthenticationMechanismTest {
@Test
void testAuthenticate_noTokenFromRequest() {
authenticationMechanism =
new OidcTokenAuthenticationMechanism(serviceAccounts, tokenVerifier, null, e -> null) {};
new OidcTokenAuthenticationMechanism(
serviceAccounts, e -> null, (service, token) -> jwt) {};
authResult = authenticationMechanism.authenticate(request);
assertThat(authResult).isEqualTo(AuthResult.NOT_AUTHENTICATED);
}
@Test
void testAuthenticate_invalidToken() throws Exception {
when(tokenVerifier.verify(rawToken)).thenThrow(new VerificationException("Bad token"));
authResult = authenticationMechanism.authenticate(request);
assertThat(authResult).isEqualTo(AuthResult.NOT_AUTHENTICATED);
}
@Test
void testAuthenticate_fallbackVerifier() throws Exception {
TokenVerifier fallbackVerifier = mock(TokenVerifier.class);
when(tokenVerifier.verify(rawToken)).thenThrow(new VerificationException("Bad token"));
when(fallbackVerifier.verify(rawToken)).thenReturn(jwt);
authenticationMechanism =
new OidcTokenAuthenticationMechanism(
serviceAccounts, tokenVerifier, fallbackVerifier, e -> rawToken) {};
serviceAccounts,
e -> null,
(service, token) -> {
throw new VerificationException("Bad token");
}) {};
authResult = authenticationMechanism.authenticate(request);
assertThat(authResult.isAuthenticated()).isEqualTo(true);
assertThat(authResult).isEqualTo(AuthResult.NOT_AUTHENTICATED);
}
@Test
@@ -233,9 +228,9 @@ public class OidcTokenAuthenticationMechanismTest {
@Provides
@Singleton
@Config("fallbackOauthClientId")
String provideFallbackOauthClientId() {
return "fallback-client-id";
@Config("backendServiceIds")
Map<String, Long> provideBackendServiceIds() {
return ImmutableMap.of();
}
}
}
@@ -23,7 +23,7 @@ import google.registry.model.console.User;
import google.registry.request.auth.AuthResult;
import google.registry.security.XsrfTokenManager;
import google.registry.ui.server.SendEmailUtils;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.console.ConsoleApiParams;
import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletRequest;
import org.joda.time.DateTime;
@@ -33,7 +33,6 @@ import google.registry.request.auth.AuthResult;
import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.DatabaseHelper;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.RegisterExtension;
@@ -36,7 +36,6 @@ import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.tools.GsonUtils;
import google.registry.ui.server.console.ConsoleDomainListAction.DomainListResult;
import google.registry.ui.server.registrar.ConsoleApiParams;
import java.util.Optional;
import javax.annotation.Nullable;
import org.joda.time.DateTime;
@@ -33,7 +33,6 @@ import google.registry.testing.DatabaseHelper;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.tools.GsonUtils;
import google.registry.ui.server.registrar.ConsoleApiParams;
import java.io.IOException;
import org.joda.time.DateTime;
import org.junit.jupiter.api.BeforeEach;
@@ -44,8 +44,6 @@ import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.FakeResponse;
import google.registry.tools.GsonUtils;
import google.registry.ui.server.console.ConsoleEppPasswordAction.EppPasswordData;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.util.EmailMessage;
import jakarta.mail.internet.AddressException;
import jakarta.mail.internet.InternetAddress;
@@ -167,7 +165,7 @@ class ConsoleEppPasswordActionTest {
.when(consoleApiParams.request())
.getReader();
Optional<EppPasswordData> maybePasswordChangeRequest =
RegistrarConsoleModule.provideEppPasswordChangeRequest(
ConsoleModule.provideEppPasswordChangeRequest(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON));
return new ConsoleEppPasswordAction(
@@ -52,7 +52,6 @@ import google.registry.testing.DeterministicStringGenerator;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.tools.DomainLockUtils;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.util.EmailMessage;
import google.registry.util.StringGenerator;
import jakarta.mail.internet.InternetAddress;
@@ -40,7 +40,6 @@ import google.registry.testing.DeterministicStringGenerator;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.tools.DomainLockUtils;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.util.StringGenerator;
import jakarta.servlet.http.HttpServletResponse;
import org.joda.time.Duration;
@@ -42,8 +42,6 @@ import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.FakeResponse;
import google.registry.testing.SystemPropertyExtension;
import google.registry.tools.GsonUtils;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.util.EmailMessage;
import google.registry.util.RegistryEnvironment;
import jakarta.mail.internet.AddressException;
@@ -172,7 +170,7 @@ class ConsoleUpdateRegistrarActionTest {
.when(consoleApiParams.request())
.getReader();
Optional<Registrar> maybeRegistrarUpdateData =
RegistrarConsoleModule.provideRegistrar(
ConsoleModule.provideRegistrar(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON));
return new ConsoleUpdateRegistrarAction(consoleApiParams, maybeRegistrarUpdateData);
}
@@ -28,7 +28,6 @@ import google.registry.request.auth.AuthResult;
import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.DatabaseHelper;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import jakarta.servlet.http.Cookie;
import java.io.IOException;
import java.util.List;
@@ -41,8 +41,6 @@ import google.registry.request.auth.AuthResult;
import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.DeterministicStringGenerator;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.util.StringGenerator;
import java.io.BufferedReader;
import java.io.IOException;
@@ -253,7 +251,7 @@ class RegistrarsActionTest {
passcodeGenerator);
}
Optional<Registrar> maybeRegistrar =
RegistrarConsoleModule.provideRegistrar(
ConsoleModule.provideRegistrar(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON));
return new RegistrarsAction(
consoleApiParams, GSON, maybeRegistrar, passwordGenerator, passcodeGenerator);
@@ -45,8 +45,8 @@ import google.registry.request.RequestModule;
import google.registry.request.auth.AuthResult;
import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.ui.server.console.ConsoleApiParams;
import google.registry.ui.server.console.ConsoleModule;
import google.registry.util.EmailMessage;
import jakarta.mail.internet.AddressException;
import jakarta.mail.internet.InternetAddress;
@@ -296,7 +296,7 @@ class ContactActionTest {
.when(consoleApiParams.request())
.getReader();
Optional<ImmutableSet<RegistrarPoc>> maybeContacts =
RegistrarConsoleModule.provideContacts(
ConsoleModule.provideContacts(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON));
return new ContactAction(consoleApiParams, GSON, registrarId, maybeContacts);
}
@@ -38,8 +38,8 @@ import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.DatabaseHelper;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.ui.server.console.ConsoleApiParams;
import google.registry.ui.server.console.ConsoleModule;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.StringReader;
@@ -108,7 +108,7 @@ class SecurityActionTest {
.when(consoleApiParams.request())
.getReader();
Optional<Registrar> maybeRegistrar =
RegistrarConsoleModule.provideRegistrar(
ConsoleModule.provideRegistrar(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON));
return new SecurityAction(
consoleApiParams, certificateChecker, registrarAccessor, registrarId, maybeRegistrar);
@@ -40,8 +40,8 @@ import google.registry.testing.ConsoleApiParamsUtils;
import google.registry.testing.DatabaseHelper;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.ui.server.registrar.ConsoleApiParams;
import google.registry.ui.server.registrar.RegistrarConsoleModule;
import google.registry.ui.server.console.ConsoleApiParams;
import google.registry.ui.server.console.ConsoleModule;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.StringReader;
@@ -169,7 +169,7 @@ public class WhoisRegistrarFieldsActionTest {
return new WhoisRegistrarFieldsAction(
consoleApiParams,
registrarAccessor,
RegistrarConsoleModule.provideRegistrar(
ConsoleModule.provideRegistrar(
GSON, RequestModule.provideJsonBody(consoleApiParams.request(), GSON)));
}
}
@@ -1,38 +1,38 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/cron/fanout TldFanoutAction GET y APP ADMIN
/_dr/dnsRefresh RefreshDnsAction GET y APP ADMIN
/_dr/task/brdaCopy BrdaCopyAction POST y APP ADMIN
/_dr/task/copyDetailReports CopyDetailReportsAction POST n APP ADMIN
/_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n APP ADMIN
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n APP ADMIN
/_dr/task/deleteProberData DeleteProberDataAction POST n APP ADMIN
/_dr/task/executeCannedScript CannedScriptExecutionAction POST,GET y APP ADMIN
/_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n APP ADMIN
/_dr/task/exportDomainLists ExportDomainListsAction POST n APP ADMIN
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n APP ADMIN
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n APP ADMIN
/_dr/task/generateInvoices GenerateInvoicesAction POST n APP ADMIN
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n APP ADMIN
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n APP ADMIN
/_dr/task/icannReportingUpload IcannReportingUploadAction POST n APP ADMIN
/_dr/task/nordnUpload NordnUploadAction POST y APP ADMIN
/_dr/task/nordnVerify NordnVerifyAction POST y APP ADMIN
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y APP ADMIN
/_dr/task/publishInvoices PublishInvoicesAction POST n APP ADMIN
/_dr/task/publishSpec11 PublishSpec11ReportAction POST n APP ADMIN
/_dr/task/rdeReport RdeReportAction POST n APP ADMIN
/_dr/task/rdeStaging RdeStagingAction GET,POST n APP ADMIN
/_dr/task/rdeUpload RdeUploadAction POST n APP ADMIN
/_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y APP ADMIN
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n APP ADMIN
/_dr/task/relockDomain RelockDomainAction POST y APP ADMIN
/_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n APP ADMIN
/_dr/task/resaveEntity ResaveEntityAction POST n APP ADMIN
/_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n APP ADMIN
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n APP ADMIN
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n APP ADMIN
/_dr/task/tmchCrl TmchCrlAction POST y APP ADMIN
/_dr/task/tmchDnl TmchDnlAction POST y APP ADMIN
/_dr/task/tmchSmdrl TmchSmdrlAction POST y APP ADMIN
/_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y APP ADMIN
/_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n APP ADMIN
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
BACKEND /_dr/cron/fanout TldFanoutAction GET y APP ADMIN
BACKEND /_dr/task/brdaCopy BrdaCopyAction POST y APP ADMIN
BACKEND /_dr/task/copyDetailReports CopyDetailReportsAction POST n APP ADMIN
BACKEND /_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n APP ADMIN
BACKEND /_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n APP ADMIN
BACKEND /_dr/task/deleteProberData DeleteProberDataAction POST n APP ADMIN
BACKEND /_dr/task/dnsRefresh RefreshDnsAction GET y APP ADMIN
BACKEND /_dr/task/executeCannedScript CannedScriptExecutionAction POST,GET y APP ADMIN
BACKEND /_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n APP ADMIN
BACKEND /_dr/task/exportDomainLists ExportDomainListsAction POST n APP ADMIN
BACKEND /_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n APP ADMIN
BACKEND /_dr/task/exportReservedTerms ExportReservedTermsAction POST n APP ADMIN
BACKEND /_dr/task/generateInvoices GenerateInvoicesAction POST n APP ADMIN
BACKEND /_dr/task/generateSpec11 GenerateSpec11ReportAction POST n APP ADMIN
BACKEND /_dr/task/icannReportingStaging IcannReportingStagingAction POST n APP ADMIN
BACKEND /_dr/task/icannReportingUpload IcannReportingUploadAction POST n APP ADMIN
BACKEND /_dr/task/nordnUpload NordnUploadAction POST y APP ADMIN
BACKEND /_dr/task/nordnVerify NordnVerifyAction POST y APP ADMIN
BACKEND /_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y APP ADMIN
BACKEND /_dr/task/publishInvoices PublishInvoicesAction POST n APP ADMIN
BACKEND /_dr/task/publishSpec11 PublishSpec11ReportAction POST n APP ADMIN
BACKEND /_dr/task/rdeReport RdeReportAction POST n APP ADMIN
BACKEND /_dr/task/rdeStaging RdeStagingAction GET,POST n APP ADMIN
BACKEND /_dr/task/rdeUpload RdeUploadAction POST n APP ADMIN
BACKEND /_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y APP ADMIN
BACKEND /_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n APP ADMIN
BACKEND /_dr/task/relockDomain RelockDomainAction POST y APP ADMIN
BACKEND /_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n APP ADMIN
BACKEND /_dr/task/resaveEntity ResaveEntityAction POST n APP ADMIN
BACKEND /_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n APP ADMIN
BACKEND /_dr/task/syncGroupMembers SyncGroupMembersAction POST n APP ADMIN
BACKEND /_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n APP ADMIN
BACKEND /_dr/task/tmchCrl TmchCrlAction POST y APP ADMIN
BACKEND /_dr/task/tmchDnl TmchDnlAction POST y APP ADMIN
BACKEND /_dr/task/tmchSmdrl TmchSmdrlAction POST y APP ADMIN
BACKEND /_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y APP ADMIN
BACKEND /_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n APP ADMIN
@@ -1,5 +1,5 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/task/bsaDownload BsaDownloadAction GET,POST n APP ADMIN
/_dr/task/bsaRefresh BsaRefreshAction GET,POST n APP ADMIN
/_dr/task/bsaValidate BsaValidateAction GET,POST n APP ADMIN
/_dr/task/uploadBsaUnavailableNames UploadBsaUnavailableDomainsAction GET,POST n APP ADMIN
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
BACKEND /_dr/task/bsaDownload BsaDownloadAction GET,POST n APP ADMIN
BACKEND /_dr/task/bsaRefresh BsaRefreshAction GET,POST n APP ADMIN
BACKEND /_dr/task/bsaValidate BsaValidateAction GET,POST n APP ADMIN
BACKEND /_dr/task/uploadBsaUnavailableNames UploadBsaUnavailableDomainsAction GET,POST n APP ADMIN
@@ -1,22 +1,22 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/epp EppTlsAction POST n APP ADMIN
/console-api/domain ConsoleDomainGetAction GET n USER PUBLIC
/console-api/domain-list ConsoleDomainListAction GET n USER PUBLIC
/console-api/dum-download ConsoleDumDownloadAction GET n USER PUBLIC
/console-api/eppPassword ConsoleEppPasswordAction POST n USER PUBLIC
/console-api/registrar ConsoleUpdateRegistrarAction POST n USER PUBLIC
/console-api/registrars RegistrarsAction GET,POST n USER PUBLIC
/console-api/registry-lock ConsoleRegistryLockAction GET,POST n USER PUBLIC
/console-api/registry-lock-verify ConsoleRegistryLockVerifyAction GET n USER PUBLIC
/console-api/settings/contacts ContactAction GET,POST n USER PUBLIC
/console-api/settings/security SecurityAction POST n USER PUBLIC
/console-api/settings/whois-fields WhoisRegistrarFieldsAction POST n USER PUBLIC
/console-api/userdata ConsoleUserDataAction GET n USER PUBLIC
/registrar ConsoleUiAction GET n USER PUBLIC
/registrar-create ConsoleRegistrarCreatorAction POST,GET n USER PUBLIC
/registrar-ote-setup ConsoleOteSetupAction POST,GET n USER PUBLIC
/registrar-ote-status OteStatusAction POST n USER PUBLIC
/registrar-settings RegistrarSettingsAction POST n USER PUBLIC
/registry-lock-get RegistryLockGetAction GET n USER PUBLIC
/registry-lock-post RegistryLockPostAction POST n USER PUBLIC
/registry-lock-verify RegistryLockVerifyAction GET n USER PUBLIC
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
FRONTEND /_dr/epp EppTlsAction POST n APP ADMIN
FRONTEND /registrar ConsoleUiAction GET n USER PUBLIC
FRONTEND /registrar-create ConsoleRegistrarCreatorAction POST,GET n USER PUBLIC
FRONTEND /registrar-ote-setup ConsoleOteSetupAction POST,GET n USER PUBLIC
FRONTEND /registrar-ote-status OteStatusAction POST n USER PUBLIC
FRONTEND /registrar-settings RegistrarSettingsAction POST n USER PUBLIC
FRONTEND /registry-lock-get RegistryLockGetAction GET n USER PUBLIC
FRONTEND /registry-lock-post RegistryLockPostAction POST n USER PUBLIC
FRONTEND /registry-lock-verify RegistryLockVerifyAction GET n USER PUBLIC
CONSOLE /console-api/domain ConsoleDomainGetAction GET n USER PUBLIC
CONSOLE /console-api/domain-list ConsoleDomainListAction GET n USER PUBLIC
CONSOLE /console-api/dum-download ConsoleDumDownloadAction GET n USER PUBLIC
CONSOLE /console-api/eppPassword ConsoleEppPasswordAction POST n USER PUBLIC
CONSOLE /console-api/registrar ConsoleUpdateRegistrarAction POST n USER PUBLIC
CONSOLE /console-api/registrars RegistrarsAction GET,POST n USER PUBLIC
CONSOLE /console-api/registry-lock ConsoleRegistryLockAction GET,POST n USER PUBLIC
CONSOLE /console-api/registry-lock-verify ConsoleRegistryLockVerifyAction GET n USER PUBLIC
CONSOLE /console-api/settings/contacts ContactAction GET,POST n USER PUBLIC
CONSOLE /console-api/settings/security SecurityAction POST n USER PUBLIC
CONSOLE /console-api/settings/whois-fields WhoisRegistrarFieldsAction POST n USER PUBLIC
CONSOLE /console-api/userdata ConsoleUserDataAction GET n USER PUBLIC
@@ -1,13 +1,13 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/whois WhoisAction POST n APP ADMIN
/check CheckApiAction GET n NONE PUBLIC
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n NONE PUBLIC
/rdap/domain/(*) RdapDomainAction GET,HEAD n NONE PUBLIC
/rdap/domains RdapDomainSearchAction GET,HEAD n NONE PUBLIC
/rdap/entities RdapEntitySearchAction GET,HEAD n NONE PUBLIC
/rdap/entity/(*) RdapEntityAction GET,HEAD n NONE PUBLIC
/rdap/help(*) RdapHelpAction GET,HEAD n NONE PUBLIC
/rdap/ip/(*) RdapIpAction GET,HEAD n NONE PUBLIC
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n NONE PUBLIC
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n NONE PUBLIC
/whois/(*) WhoisHttpAction GET n NONE PUBLIC
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
PUBAPI /_dr/whois WhoisAction POST n APP ADMIN
PUBAPI /check CheckApiAction GET n NONE PUBLIC
PUBAPI /rdap/autnum/(*) RdapAutnumAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/domain/(*) RdapDomainAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/domains RdapDomainSearchAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/entities RdapEntitySearchAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/entity/(*) RdapEntityAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/help(*) RdapHelpAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/ip/(*) RdapIpAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/nameserver/(*) RdapNameserverAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/nameservers RdapNameserverSearchAction GET,HEAD n NONE PUBLIC
PUBAPI /whois/(*) WhoisHttpAction GET n NONE PUBLIC
@@ -1,88 +1,80 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/admin/createGroups CreateGroupsAction POST n APP ADMIN
/_dr/admin/list/domains ListDomainsAction GET,POST n APP ADMIN
/_dr/admin/list/hosts ListHostsAction GET,POST n APP ADMIN
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n APP ADMIN
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n APP ADMIN
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n APP ADMIN
/_dr/admin/list/tlds ListTldsAction GET,POST n APP ADMIN
/_dr/admin/updateUserGroup UpdateUserGroupAction POST n APP ADMIN
/_dr/admin/verifyOte VerifyOteAction POST n APP ADMIN
/_dr/cron/fanout TldFanoutAction GET y APP ADMIN
/_dr/dnsRefresh RefreshDnsAction GET y APP ADMIN
/_dr/epp EppTlsAction POST n APP ADMIN
/_dr/epptool EppToolAction POST n APP ADMIN
/_dr/loadtest LoadTestAction POST y APP ADMIN
/_dr/task/brdaCopy BrdaCopyAction POST y APP ADMIN
/_dr/task/bsaDownload BsaDownloadAction GET,POST n APP ADMIN
/_dr/task/bsaRefresh BsaRefreshAction GET,POST n APP ADMIN
/_dr/task/bsaValidate BsaValidateAction GET,POST n APP ADMIN
/_dr/task/copyDetailReports CopyDetailReportsAction POST n APP ADMIN
/_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n APP ADMIN
/_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n APP ADMIN
/_dr/task/deleteProberData DeleteProberDataAction POST n APP ADMIN
/_dr/task/executeCannedScript CannedScriptExecutionAction POST,GET y APP ADMIN
/_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n APP ADMIN
/_dr/task/exportDomainLists ExportDomainListsAction POST n APP ADMIN
/_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n APP ADMIN
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n APP ADMIN
/_dr/task/generateInvoices GenerateInvoicesAction POST n APP ADMIN
/_dr/task/generateSpec11 GenerateSpec11ReportAction POST n APP ADMIN
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n APP ADMIN
/_dr/task/icannReportingStaging IcannReportingStagingAction POST n APP ADMIN
/_dr/task/icannReportingUpload IcannReportingUploadAction POST n APP ADMIN
/_dr/task/nordnUpload NordnUploadAction POST y APP ADMIN
/_dr/task/nordnVerify NordnVerifyAction POST y APP ADMIN
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y APP ADMIN
/_dr/task/publishInvoices PublishInvoicesAction POST n APP ADMIN
/_dr/task/publishSpec11 PublishSpec11ReportAction POST n APP ADMIN
/_dr/task/rdeReport RdeReportAction POST n APP ADMIN
/_dr/task/rdeStaging RdeStagingAction GET,POST n APP ADMIN
/_dr/task/rdeUpload RdeUploadAction POST n APP ADMIN
/_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y APP ADMIN
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n APP ADMIN
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n APP ADMIN
/_dr/task/relockDomain RelockDomainAction POST y APP ADMIN
/_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n APP ADMIN
/_dr/task/resaveEntity ResaveEntityAction POST n APP ADMIN
/_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n APP ADMIN
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n APP ADMIN
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n APP ADMIN
/_dr/task/tmchCrl TmchCrlAction POST y APP ADMIN
/_dr/task/tmchDnl TmchDnlAction POST y APP ADMIN
/_dr/task/tmchSmdrl TmchSmdrlAction POST y APP ADMIN
/_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y APP ADMIN
/_dr/task/uploadBsaUnavailableNames UploadBsaUnavailableDomainsAction GET,POST n APP ADMIN
/_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n APP ADMIN
/_dr/whois WhoisAction POST n APP ADMIN
/check CheckApiAction GET n NONE PUBLIC
/console-api/domain ConsoleDomainGetAction GET n USER PUBLIC
/console-api/domain-list ConsoleDomainListAction GET n USER PUBLIC
/console-api/dum-download ConsoleDumDownloadAction GET n USER PUBLIC
/console-api/eppPassword ConsoleEppPasswordAction POST n USER PUBLIC
/console-api/registrar ConsoleUpdateRegistrarAction POST n USER PUBLIC
/console-api/registrars RegistrarsAction GET,POST n USER PUBLIC
/console-api/registry-lock ConsoleRegistryLockAction GET,POST n USER PUBLIC
/console-api/registry-lock-verify ConsoleRegistryLockVerifyAction GET n USER PUBLIC
/console-api/settings/contacts ContactAction GET,POST n USER PUBLIC
/console-api/settings/security SecurityAction POST n USER PUBLIC
/console-api/settings/whois-fields WhoisRegistrarFieldsAction POST n USER PUBLIC
/console-api/userdata ConsoleUserDataAction GET n USER PUBLIC
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n NONE PUBLIC
/rdap/domain/(*) RdapDomainAction GET,HEAD n NONE PUBLIC
/rdap/domains RdapDomainSearchAction GET,HEAD n NONE PUBLIC
/rdap/entities RdapEntitySearchAction GET,HEAD n NONE PUBLIC
/rdap/entity/(*) RdapEntityAction GET,HEAD n NONE PUBLIC
/rdap/help(*) RdapHelpAction GET,HEAD n NONE PUBLIC
/rdap/ip/(*) RdapIpAction GET,HEAD n NONE PUBLIC
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n NONE PUBLIC
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n NONE PUBLIC
/registrar ConsoleUiAction GET n USER PUBLIC
/registrar-create ConsoleRegistrarCreatorAction POST,GET n USER PUBLIC
/registrar-ote-setup ConsoleOteSetupAction POST,GET n USER PUBLIC
/registrar-ote-status OteStatusAction POST n USER PUBLIC
/registrar-settings RegistrarSettingsAction POST n USER PUBLIC
/registry-lock-get RegistryLockGetAction GET n USER PUBLIC
/registry-lock-post RegistryLockPostAction POST n USER PUBLIC
/registry-lock-verify RegistryLockVerifyAction GET n USER PUBLIC
/whois/(*) WhoisHttpAction GET n NONE PUBLIC
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
FRONTEND /_dr/epp EppTlsAction POST n APP ADMIN
BACKEND /_dr/admin/createGroups CreateGroupsAction POST n APP ADMIN
BACKEND /_dr/admin/list/domains ListDomainsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/hosts ListHostsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/registrars ListRegistrarsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/reservedLists ListReservedListsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/tlds ListTldsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/updateUserGroup UpdateUserGroupAction POST n APP ADMIN
BACKEND /_dr/admin/verifyOte VerifyOteAction POST n APP ADMIN
BACKEND /_dr/cron/fanout TldFanoutAction GET y APP ADMIN
BACKEND /_dr/epptool EppToolAction POST n APP ADMIN
BACKEND /_dr/loadtest LoadTestAction POST y APP ADMIN
BACKEND /_dr/task/brdaCopy BrdaCopyAction POST y APP ADMIN
BACKEND /_dr/task/bsaDownload BsaDownloadAction GET,POST n APP ADMIN
BACKEND /_dr/task/bsaRefresh BsaRefreshAction GET,POST n APP ADMIN
BACKEND /_dr/task/bsaValidate BsaValidateAction GET,POST n APP ADMIN
BACKEND /_dr/task/copyDetailReports CopyDetailReportsAction POST n APP ADMIN
BACKEND /_dr/task/deleteExpiredDomains DeleteExpiredDomainsAction GET n APP ADMIN
BACKEND /_dr/task/deleteLoadTestData DeleteLoadTestDataAction POST n APP ADMIN
BACKEND /_dr/task/deleteProberData DeleteProberDataAction POST n APP ADMIN
BACKEND /_dr/task/dnsRefresh RefreshDnsAction GET y APP ADMIN
BACKEND /_dr/task/executeCannedScript CannedScriptExecutionAction POST,GET y APP ADMIN
BACKEND /_dr/task/expandBillingRecurrences ExpandBillingRecurrencesAction GET n APP ADMIN
BACKEND /_dr/task/exportDomainLists ExportDomainListsAction POST n APP ADMIN
BACKEND /_dr/task/exportPremiumTerms ExportPremiumTermsAction POST n APP ADMIN
BACKEND /_dr/task/exportReservedTerms ExportReservedTermsAction POST n APP ADMIN
BACKEND /_dr/task/generateInvoices GenerateInvoicesAction POST n APP ADMIN
BACKEND /_dr/task/generateSpec11 GenerateSpec11ReportAction POST n APP ADMIN
BACKEND /_dr/task/generateZoneFiles GenerateZoneFilesAction POST n APP ADMIN
BACKEND /_dr/task/icannReportingStaging IcannReportingStagingAction POST n APP ADMIN
BACKEND /_dr/task/icannReportingUpload IcannReportingUploadAction POST n APP ADMIN
BACKEND /_dr/task/nordnUpload NordnUploadAction POST y APP ADMIN
BACKEND /_dr/task/nordnVerify NordnVerifyAction POST y APP ADMIN
BACKEND /_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y APP ADMIN
BACKEND /_dr/task/publishInvoices PublishInvoicesAction POST n APP ADMIN
BACKEND /_dr/task/publishSpec11 PublishSpec11ReportAction POST n APP ADMIN
BACKEND /_dr/task/rdeReport RdeReportAction POST n APP ADMIN
BACKEND /_dr/task/rdeStaging RdeStagingAction GET,POST n APP ADMIN
BACKEND /_dr/task/rdeUpload RdeUploadAction POST n APP ADMIN
BACKEND /_dr/task/readDnsRefreshRequests ReadDnsRefreshRequestsAction POST y APP ADMIN
BACKEND /_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n APP ADMIN
BACKEND /_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction POST n APP ADMIN
BACKEND /_dr/task/relockDomain RelockDomainAction POST y APP ADMIN
BACKEND /_dr/task/resaveAllEppResourcesPipeline ResaveAllEppResourcesPipelineAction GET n APP ADMIN
BACKEND /_dr/task/resaveEntity ResaveEntityAction POST n APP ADMIN
BACKEND /_dr/task/sendExpiringCertificateNotificationEmail SendExpiringCertificateNotificationEmailAction GET n APP ADMIN
BACKEND /_dr/task/syncGroupMembers SyncGroupMembersAction POST n APP ADMIN
BACKEND /_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n APP ADMIN
BACKEND /_dr/task/tmchCrl TmchCrlAction POST y APP ADMIN
BACKEND /_dr/task/tmchDnl TmchDnlAction POST y APP ADMIN
BACKEND /_dr/task/tmchSmdrl TmchSmdrlAction POST y APP ADMIN
BACKEND /_dr/task/updateRegistrarRdapBaseUrls UpdateRegistrarRdapBaseUrlsAction GET y APP ADMIN
BACKEND /_dr/task/uploadBsaUnavailableNames UploadBsaUnavailableDomainsAction GET,POST n APP ADMIN
BACKEND /_dr/task/wipeOutContactHistoryPii WipeOutContactHistoryPiiAction GET n APP ADMIN
PUBAPI /_dr/whois WhoisAction POST n APP ADMIN
PUBAPI /check CheckApiAction GET n NONE PUBLIC
PUBAPI /rdap/autnum/(*) RdapAutnumAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/domain/(*) RdapDomainAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/domains RdapDomainSearchAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/entities RdapEntitySearchAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/entity/(*) RdapEntityAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/help(*) RdapHelpAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/ip/(*) RdapIpAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/nameserver/(*) RdapNameserverAction GET,HEAD n NONE PUBLIC
PUBAPI /rdap/nameservers RdapNameserverSearchAction GET,HEAD n NONE PUBLIC
PUBAPI /whois/(*) WhoisHttpAction GET n NONE PUBLIC
CONSOLE /console-api/domain ConsoleDomainGetAction GET n USER PUBLIC
CONSOLE /console-api/domain-list ConsoleDomainListAction GET n USER PUBLIC
CONSOLE /console-api/dum-download ConsoleDumDownloadAction GET n USER PUBLIC
CONSOLE /console-api/eppPassword ConsoleEppPasswordAction POST n USER PUBLIC
CONSOLE /console-api/registrar ConsoleUpdateRegistrarAction POST n USER PUBLIC
CONSOLE /console-api/registrars RegistrarsAction GET,POST n USER PUBLIC
CONSOLE /console-api/registry-lock ConsoleRegistryLockAction GET,POST n USER PUBLIC
CONSOLE /console-api/registry-lock-verify ConsoleRegistryLockVerifyAction GET n USER PUBLIC
CONSOLE /console-api/settings/contacts ContactAction GET,POST n USER PUBLIC
CONSOLE /console-api/settings/security SecurityAction POST n USER PUBLIC
CONSOLE /console-api/settings/whois-fields WhoisRegistrarFieldsAction POST n USER PUBLIC
CONSOLE /console-api/userdata ConsoleUserDataAction GET n USER PUBLIC
@@ -1,14 +1,14 @@
PATH CLASS METHODS OK MIN USER_POLICY
/_dr/admin/createGroups CreateGroupsAction POST n APP ADMIN
/_dr/admin/list/domains ListDomainsAction GET,POST n APP ADMIN
/_dr/admin/list/hosts ListHostsAction GET,POST n APP ADMIN
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n APP ADMIN
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n APP ADMIN
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n APP ADMIN
/_dr/admin/list/tlds ListTldsAction GET,POST n APP ADMIN
/_dr/admin/updateUserGroup UpdateUserGroupAction POST n APP ADMIN
/_dr/admin/verifyOte VerifyOteAction POST n APP ADMIN
/_dr/epptool EppToolAction POST n APP ADMIN
/_dr/loadtest LoadTestAction POST y APP ADMIN
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n APP ADMIN
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n APP ADMIN
SERVICE PATH CLASS METHODS OK MIN USER_POLICY
BACKEND /_dr/admin/createGroups CreateGroupsAction POST n APP ADMIN
BACKEND /_dr/admin/list/domains ListDomainsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/hosts ListHostsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/registrars ListRegistrarsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/reservedLists ListReservedListsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/list/tlds ListTldsAction GET,POST n APP ADMIN
BACKEND /_dr/admin/updateUserGroup UpdateUserGroupAction POST n APP ADMIN
BACKEND /_dr/admin/verifyOte VerifyOteAction POST n APP ADMIN
BACKEND /_dr/epptool EppToolAction POST n APP ADMIN
BACKEND /_dr/loadtest LoadTestAction POST y APP ADMIN
BACKEND /_dr/task/generateZoneFiles GenerateZoneFilesAction POST n APP ADMIN
BACKEND /_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n APP ADMIN