mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-09-19 14:34:18 +00:00
Code Issues Releases Wiki Activity

Only forbid DISABLED registrars in the console (#3188)

Browse Source 
PENDING registrars may just need to add contacts etc in order to be
enabled, and they should be able to use the console to do so.
This commit is contained in:
gbrodman
2026-07-30 20:57:43 +00:00
committed by GitHub
parent 49cecf6776
commit 92b684d7ec
3 changed files with 43 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java
+2 -3
View File
@@ -113,11 +113,10 @@ public abstract class ConsoleApiAction implements Runnable {
() -> () ->
new ConsolePermissionForbiddenException( new ConsolePermissionForbiddenException(
String.format("Registrar %s does not exist", registrarId))); String.format("Registrar %s does not exist", registrarId)));
if (!registrar.isLive()) { if (registrar.getState().equals(Registrar.State.DISABLED)) {
throw new ConsolePermissionForbiddenException( throw new ConsolePermissionForbiddenException(
String.format( String.format(
"Permission forbidden because registrar %s is currently %s", "Permission forbidden because registrar %s is currently DISABLED", registrarId));
registrarId, registrar.getState()));
} }
if (!user.getUserRoles().hasPermission(registrarId, permission)) { if (!user.getUserRoles().hasPermission(registrarId, permission)) {
throw new ConsolePermissionForbiddenException( throw new ConsolePermissionForbiddenException(
core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java
+41 -20
View File
@@ -15,6 +15,9 @@
package google.registry.ui.server.console; package google.registry.ui.server.console;
import static com.google.common.truth.Truth.assertThat; import static com.google.common.truth.Truth.assertThat;
import static google.registry.testing.DatabaseHelper.loadByKey;
import static google.registry.testing.DatabaseHelper.loadRegistrar;
import static google.registry.testing.DatabaseHelper.persistResource;
import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST; import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
import static jakarta.servlet.http.HttpServletResponse.SC_CREATED; import static jakarta.servlet.http.HttpServletResponse.SC_CREATED;
import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN; import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
@@ -36,6 +39,7 @@ import google.registry.model.console.GlobalRole;
import google.registry.model.console.RegistrarRole; import google.registry.model.console.RegistrarRole;
import google.registry.model.console.User; import google.registry.model.console.User;
import google.registry.model.console.UserRoles; import google.registry.model.console.UserRoles;
import google.registry.model.registrar.Registrar;
import google.registry.persistence.VKey; import google.registry.persistence.VKey;
import google.registry.request.auth.AuthResult; import google.registry.request.auth.AuthResult;
import google.registry.testing.CloudTasksHelper; import google.registry.testing.CloudTasksHelper;
@@ -126,6 +130,23 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
"[{\"emailAddress\":\"test1@test.com\",\"role\":\"PRIMARY_CONTACT\"},{\"emailAddress\":\"test2@test.com\",\"role\":\"PRIMARY_CONTACT\"}]"); "[{\"emailAddress\":\"test1@test.com\",\"role\":\"PRIMARY_CONTACT\"},{\"emailAddress\":\"test2@test.com\",\"role\":\"PRIMARY_CONTACT\"}]");
} }
@Test
void testSuccess_pendingRegistrar() throws Exception {
persistResource(
loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build());
AuthResult authResult =
AuthResult.createUser(loadByKey(VKey.create(User.class, "test1@test.com")));
ConsoleUsersAction action =
createAction(
Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
Optional.of("GET"),
Optional.empty());
action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
assertThat(response.getPayload()).contains("test1@test.com");
}
@Test @Test
void testFailure_noPermission() throws IOException { void testFailure_noPermission() throws IOException {
UserRoles userRoles = UserRoles userRoles =
@@ -205,7 +226,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testFailure_noPermissionToDeleteUser() throws IOException { void testFailure_noPermissionToDeleteUser() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -248,7 +269,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeletion() void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeletion()
throws IOException { throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -274,7 +295,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() throws IOException { void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -282,7 +303,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
.setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build()) .setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build())
.build()); .build());
String mintedEmail = "abc.TheRegistrar@email.com"; String mintedEmail = "abc.TheRegistrar@email.com";
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress(mintedEmail) .setEmailAddress(mintedEmail)
.setUserRoles( .setUserRoles(
@@ -311,14 +332,14 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testSuccess_removesRole() throws IOException { void testSuccess_removesRole() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
.asBuilder() .asBuilder()
.setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build()) .setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build())
.build()); .build());
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("test4@test.com") .setEmailAddress("test4@test.com")
.setUserRoles( .setUserRoles(
@@ -355,7 +376,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testFailure_limitedTo4UsersPerRegistrar() throws IOException { void testFailure_limitedTo4UsersPerRegistrar() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -395,7 +416,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testSuccess_updatesUserRole() throws IOException { void testSuccess_updatesUserRole() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -404,7 +425,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
.build()); .build());
assertThat( assertThat(
DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com")) loadByKey(VKey.create(User.class, "test2@test.com"))
.getUserRoles() .getUserRoles()
.getRegistrarRoles() .getRegistrarRoles()
.get("TheRegistrar")) .get("TheRegistrar"))
@@ -420,7 +441,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
action.run(); action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK); assertThat(response.getStatus()).isEqualTo(SC_OK);
assertThat( assertThat(
DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com")) loadByKey(VKey.create(User.class, "test2@test.com"))
.getUserRoles() .getUserRoles()
.getRegistrarRoles() .getRegistrarRoles()
.get("TheRegistrar")) .get("TheRegistrar"))
@@ -429,7 +450,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testFailure_noPermissionToUpdateUser() throws IOException { void testFailure_noPermissionToUpdateUser() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult authResult =
AuthResult.createUser( AuthResult.createUser(
user1 user1
@@ -461,14 +482,14 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null))); new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
action.run(); action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK); assertThat(response.getStatus()).isEqualTo(SC_OK);
User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com")); User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com"));
assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar")) assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar"))
.isEqualTo(RegistrarRole.TECH_CONTACT); .isEqualTo(RegistrarRole.TECH_CONTACT);
} }
@Test @Test
void testFailure_appendUser_crossTenantNoPermission() throws IOException { void testFailure_appendUser_crossTenantNoPermission() throws IOException {
User callingUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); User callingUser = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult.createUser(callingUser); AuthResult authResult = AuthResult.createUser(callingUser);
ConsoleUsersAction action = ConsoleUsersAction action =
createAction( createAction(
@@ -483,7 +504,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
@Test @Test
void testSuccess_appendUser_crossTenantWithPermission() throws IOException { void testSuccess_appendUser_crossTenantWithPermission() throws IOException {
User callingUser = User callingUser =
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("multitenant@test.com") .setEmailAddress("multitenant@test.com")
.setUserRoles( .setUserRoles(
@@ -506,7 +527,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null))); new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
action.run(); action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK); assertThat(response.getStatus()).isEqualTo(SC_OK);
User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com")); User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com"));
assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar")) assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar"))
.isEqualTo(RegistrarRole.TECH_CONTACT); .isEqualTo(RegistrarRole.TECH_CONTACT);
} }
@@ -515,7 +536,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
void testFailure_appendUser_globalAdmin() throws IOException { void testFailure_appendUser_globalAdmin() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com"); User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user); AuthResult authResult = AuthResult.createUser(user);
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("globaladmin@test.com") .setEmailAddress("globaladmin@test.com")
.setUserRoles( .setUserRoles(
@@ -539,7 +560,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
void testFailure_appendUser_globalRole() throws IOException { void testFailure_appendUser_globalRole() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com"); User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user); AuthResult authResult = AuthResult.createUser(user);
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("support@test.com") .setEmailAddress("support@test.com")
.setUserRoles( .setUserRoles(
@@ -566,7 +587,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
User user = DatabaseHelper.createAdminUser("email@email.com"); User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user); AuthResult authResult = AuthResult.createUser(user);
// Historically associated global admin // Historically associated global admin
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("globaladmin@test.com") .setEmailAddress("globaladmin@test.com")
.setUserRoles( .setUserRoles(
@@ -596,7 +617,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
User user = DatabaseHelper.createAdminUser("email@email.com"); User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user); AuthResult authResult = AuthResult.createUser(user);
// Historically associated global admin // Historically associated global admin
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("globaladmin@test.com") .setEmailAddress("globaladmin@test.com")
.setUserRoles( .setUserRoles(
@@ -626,7 +647,7 @@ class ConsoleUsersActionTest extends ConsoleActionBaseTestCase {
User user = DatabaseHelper.createAdminUser("email@email.com"); User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user); AuthResult authResult = AuthResult.createUser(user);
// Historically associated user with global role // Historically associated user with global role
DatabaseHelper.persistResource( persistResource(
new User.Builder() new User.Builder()
.setEmailAddress("support@test.com") .setEmailAddress("support@test.com")
.setUserRoles( .setUserRoles(
core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java
-12
View File
@@ -251,18 +251,6 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase {
assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
} }
@Test
void testFailure_pendingRegistrar() {
persistResource(
loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build());
JsonElement payload =
GSON.toJsonTree(
ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test"));
ConsoleBulkDomainAction action = createAction("DELETE", payload);
action.run();
assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
}
@Test @Test
void testFailure_nonexistentRegistrar() { void testFailure_nonexistentRegistrar() {
JsonElement payload = JsonElement payload =