From b1c6e07fa2f8a747e647c56497bfab40558e512c Mon Sep 17 00:00:00 2001 From: gbrodman Date: Tue, 21 Jul 2026 12:22:33 -0400 Subject: [PATCH] Only allow console actions on live registrars (#3162) DISABLED registrars aren't allowed to do anything. This should include console actions. --- .../ui/server/console/ConsoleApiAction.java | 12 +++++ .../console/ConsoleHistoryDataActionTest.java | 3 +- .../domains/ConsoleBulkDomainActionTest.java | 52 +++++++++++++++++-- 3 files changed, 63 insertions(+), 4 deletions(-) diff --git a/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java b/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java index 98175f651..1cf08f9be 100644 --- a/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java +++ b/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java @@ -107,6 +107,18 @@ public abstract class ConsoleApiAction implements Runnable { protected static void checkPermission( User user, String registrarId, ConsolePermission permission) { + Registrar registrar = + Registrar.loadByRegistrarIdCached(registrarId) + .orElseThrow( + () -> + new ConsolePermissionForbiddenException( + String.format("Registrar %s does not exist", registrarId))); + if (!registrar.isLive()) { + throw new ConsolePermissionForbiddenException( + String.format( + "Permission forbidden because registrar %s is currently %s", + registrarId, registrar.getState())); + } if (!user.getUserRoles().hasPermission(registrarId, permission)) { throw new ConsolePermissionForbiddenException( String.format( diff --git a/core/src/test/java/google/registry/ui/server/console/ConsoleHistoryDataActionTest.java b/core/src/test/java/google/registry/ui/server/console/ConsoleHistoryDataActionTest.java index 137d31572..254fae188 100644 --- a/core/src/test/java/google/registry/ui/server/console/ConsoleHistoryDataActionTest.java +++ b/core/src/test/java/google/registry/ui/server/console/ConsoleHistoryDataActionTest.java @@ -157,8 +157,9 @@ class ConsoleHistoryDataActionTest extends ConsoleActionBaseTestCase { @Test void testSuccess_noResults() { + DatabaseHelper.persistNewRegistrar("NoHistory"); ConsoleHistoryDataAction action = - createAction(AuthResult.createUser(fteUser), "NoHistoryRegistrar", Optional.empty()); + createAction(AuthResult.createUser(fteUser), "NoHistory", Optional.empty()); action.run(); assertThat(response.getStatus()).isEqualTo(SC_OK); assertThat(response.getPayload()).isEqualTo("[]"); diff --git a/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java b/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java index ed83fd741..4028129d1 100644 --- a/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java +++ b/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java @@ -16,6 +16,7 @@ package google.registry.ui.server.console.domains; import static com.google.common.truth.Truth.assertThat; import static google.registry.testing.DatabaseHelper.loadByEntity; +import static google.registry.testing.DatabaseHelper.loadRegistrar; import static google.registry.testing.DatabaseHelper.loadSingleton; import static google.registry.testing.DatabaseHelper.persistDomainWithDependentResources; import static google.registry.testing.DatabaseHelper.persistResource; @@ -40,6 +41,7 @@ import google.registry.model.console.User; import google.registry.model.console.UserRoles; import google.registry.model.domain.Domain; import google.registry.model.eppcommon.StatusValue; +import google.registry.model.registrar.Registrar; import google.registry.request.auth.AuthResult; import google.registry.testing.ConsoleApiParamsUtils; import google.registry.testing.FakeResponse; @@ -237,6 +239,40 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase { assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); } + @Test + void testFailure_disabledRegistrar() { + persistResource( + loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.DISABLED).build()); + JsonElement payload = + GSON.toJsonTree( + ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test")); + ConsoleBulkDomainAction action = createAction("DELETE", payload); + action.run(); + assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); + } + + @Test + void testFailure_pendingRegistrar() { + persistResource( + loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build()); + JsonElement payload = + GSON.toJsonTree( + ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test")); + ConsoleBulkDomainAction action = createAction("DELETE", payload); + action.run(); + assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); + } + + @Test + void testFailure_nonexistentRegistrar() { + JsonElement payload = + GSON.toJsonTree( + ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test")); + ConsoleBulkDomainAction action = createAction("nonexistentRegistrar", "DELETE", payload); + action.run(); + assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); + } + // @ptkach - reenable with suspend change // @Test // void testFailure_suspend_nonAdmin() { @@ -258,20 +294,30 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase { // } private ConsoleBulkDomainAction createAction(String action, JsonElement payload) { - return createAction(action, payload, fteUser, 500); + return createAction("TheRegistrar", action, payload, fteUser, 500); + } + + private ConsoleBulkDomainAction createAction( + String registrarId, String action, JsonElement payload) { + return createAction(registrarId, action, payload, fteUser, 500); } private ConsoleBulkDomainAction createAction(String action, JsonElement payload, User user) { - return createAction(action, payload, user, 500); + return createAction("TheRegistrar", action, payload, user, 500); } private ConsoleBulkDomainAction createAction( String action, JsonElement payload, User user, int limit) { + return createAction("TheRegistrar", action, payload, user, limit); + } + + private ConsoleBulkDomainAction createAction( + String registrarId, String action, JsonElement payload, User user, int limit) { AuthResult authResult = AuthResult.createUser(user); ConsoleApiParams params = ConsoleApiParamsUtils.createFake(authResult); when(params.request().getMethod()).thenReturn("POST"); response = (FakeResponse) params.response(); return new ConsoleBulkDomainAction( - params, eppController, limit, "TheRegistrar", action, Optional.ofNullable(payload)); + params, eppController, limit, registrarId, action, Optional.ofNullable(payload)); } }