Resolve test flakiness caused by connection leak (#355)

* Delete obsolet gradle config in root project

.gitignore

@@ -98,7 +98,6 @@ nomulus.iws
 .gradle/
 **/build
 node_modules/**
-!node_modules/soyutils_usegoog.js
 /repos/
 
 # Compiled JS/CSS code

build.gradle

@@ -288,20 +288,6 @@ subprojects {
       }
     }
   }
-
-  if (['util', 'proxy', 'core', 'prober', 'db'].contains(project.name)) return
-
-  // TODO(weiminyu): investigate if the block below is still needed
-  ext.relativePath = "google/registry/${project.name}"
-
-  sourceSets.each {
-    it.java {
-      include "${project.relativePath}/"
-    }
-    it.resources {
-      include "${project.relativePath}/"
-    }
-  }
 }
 
 // If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their

buildSrc/gradle/dependency-locks/buildscript-classpath.lockfile

@@ -16,7 +16,7 @@ com.jcraft:jsch:0.1.54
 com.jcraft:jzlib:1.1.1
 com.netflix.nebula:gradle-lint-plugin:10.4.2
 com.netflix.nebula:nebula-gradle-interop:1.0.11
-com.netflix.nebula:nebula-test:7.3.0
+com.netflix.nebula:nebula-test:7.4.0
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
 commons-lang:commons-lang:2.6
@@ -41,7 +41,7 @@ org.apache.maven:maven-builder-support:3.6.2
 org.apache.maven:maven-model-builder:3.6.2
 org.apache.maven:maven-model:3.6.2
 org.codehaus.gpars:gpars:1.2.1
-org.codehaus.groovy:groovy-all:2.4.9
+org.codehaus.groovy:groovy-all:2.4.15
 org.codehaus.groovy:groovy-ant:2.1.8
 org.codehaus.groovy:groovy-groovydoc:2.1.8
 org.codehaus.groovy:groovy-templates:2.1.8
@@ -65,4 +65,4 @@ org.multiverse:multiverse-core:0.7.0
 org.objenesis:objenesis:2.4
 org.ow2.asm:asm:7.0
 org.slf4j:slf4j-api:1.7.2
-org.spockframework:spock-core:1.1-groovy-2.4-rc-4
+org.spockframework:spock-core:1.3-groovy-2.4

buildSrc/src/main/java/google/registry/gradle/plugin/CoverPageGenerator.java

@@ -26,6 +26,7 @@ import com.google.common.collect.ImmutableSetMultimap;
 import com.google.template.soy.SoyFileSet;
 import com.google.template.soy.tofu.SoyTofu;
 import google.registry.gradle.plugin.ProjectData.TaskData;
+import java.io.File;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.function.Supplier;
@@ -148,10 +149,14 @@ final class CoverPageGenerator {
 
   /** returns a soy-friendly version of the given task data. */
   static ImmutableMap<String, Object> taskDataToSoy(TaskData task) {
+    // Note that all instances of File.separator are replaced with forward slashes so that we can
+    // generate a valid href on Windows.
     return new ImmutableMap.Builder<String, Object>()
         .put("uniqueName", task.uniqueName())
         .put("description", task.description())
-        .put("log", task.log().isPresent() ? getLogPath(task).toString() : "")
+        .put(
+            "log",
+            task.log().isPresent() ? getLogPath(task).toString().replace(File.separator, "/") : "")
         .put(
             "reports",
             task.reports().entrySet().stream()
@@ -161,7 +166,11 @@ final class CoverPageGenerator {
                         entry ->
                             entry.getValue().files().isEmpty()
                                 ? ""
-                                : entry.getValue().entryPoint().toString())))
+                                : entry
+                                    .getValue()
+                                    .entryPoint()
+                                    .toString()
+                                    .replace(File.separator, "/"))))
         .build();
   }
 
@@ -188,8 +197,10 @@ final class CoverPageGenerator {
   }
 
   private static Path getLogPath(TaskData task) {
-    // TODO(guyben):escape uniqueName to guarantee legal file name.
-    return Paths.get("logs", task.uniqueName() + ".log");
+    // We replace colons with dashes so that the resulting filename is always valid, even in
+    // Windows. As a dash is not a valid character in Java identifies, a task name cannot include
+    // it, so the uniqueness of the name is perserved.
+    return Paths.get("logs", task.uniqueName().replace(":", "-") + ".log");
   }
 
   private static Supplier<byte[]> resourceLoader(Path path) {

buildSrc/src/main/java/google/registry/gradle/plugin/GcsPluginUtils.java

@@ -64,7 +64,8 @@ final class GcsPluginUtils {
 
   static void uploadFileToGcs(
       Storage storage, String bucket, Path path, Supplier<byte[]> dataSupplier) {
-    String filename = path.toString();
+    // Replace Windows file separators with forward slashes.
+    String filename = path.toString().replace(File.separator, "/");
     storage.create(
         BlobInfo.newBuilder(bucket, filename).setContentType(getContentType(filename)).build(),
         dataSupplier.get());

buildSrc/src/test/java/google/registry/gradle/plugin/CoverPageGeneratorTest.java

@@ -20,9 +20,11 @@ import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.gradle.plugin.GcsPluginUtils.toByteArraySupplier;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
+import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import google.registry.gradle.plugin.ProjectData.TaskData;
+import java.io.File;
 import java.nio.file.Paths;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -63,6 +65,8 @@ public final class CoverPageGeneratorTest {
           .setState(TaskData.State.UP_TO_DATE)
           .build();
 
+  private static final Joiner filenameJoiner = Joiner.on(File.separator);
+
   private ImmutableMap<String, String> getGeneratedFiles(ProjectData project) {
     CoverPageGenerator coverPageGenerator = new CoverPageGenerator(project);
     FilesWithEntryPoint files = coverPageGenerator.getFilesToUpload();
@@ -172,8 +176,8 @@ public final class CoverPageGeneratorTest {
   @Test
   public void testGetFilesToUpload_containsCssFile() {
     ImmutableMap<String, String> files = getGeneratedFiles(EMPTY_PROJECT);
-    assertThat(files).containsKey("css/style.css");
-    assertThat(files.get("css/style.css")).contains("body {");
+    assertThat(files).containsKey(filenameJoiner.join("css", "style.css"));
+    assertThat(files.get(filenameJoiner.join("css", "style.css"))).contains("body {");
     assertThat(files.get("index.html"))
         .contains("<link rel=\"stylesheet\" type=\"text/css\" href=\"css/style.css\">");
   }
@@ -191,8 +195,8 @@ public final class CoverPageGeneratorTest {
                         .setLog(toByteArraySupplier("my log data"))
                         .build())
                 .build());
-    assertThat(files).containsEntry("logs/my:name.log", "my log data");
-    assertThat(files.get("index.html")).contains("<a href=\"logs/my:name.log\">[log]</a>");
+    assertThat(files).containsEntry(filenameJoiner.join("logs", "my-name.log"), "my log data");
+    assertThat(files.get("index.html")).contains("<a href=\"logs/my-name.log\">[log]</a>");
   }
 
   @Test
@@ -203,7 +207,7 @@ public final class CoverPageGeneratorTest {
                 .toBuilder()
                 .addTask(EMPTY_TASK_SUCCESS.toBuilder().setUniqueName("my:name").build())
                 .build());
-    assertThat(files).doesNotContainKey("logs/my:name.log");
+    assertThat(files).doesNotContainKey("logs/my-name.log");
     assertThat(files.get("index.html")).contains("<span class=\"report_link_broken\">[log]</span>");
   }
 
@@ -225,7 +229,7 @@ public final class CoverPageGeneratorTest {
                                 Paths.get("path", "report.txt")))
                         .build())
                 .build());
-    assertThat(files).containsEntry("path/report.txt", "report content");
+    assertThat(files).containsEntry(filenameJoiner.join("path", "report.txt"), "report content");
     assertThat(files.get("index.html")).contains("<a href=\"path/report.txt\">[someReport]</a>");
   }
 
@@ -244,7 +248,7 @@ public final class CoverPageGeneratorTest {
                                 ImmutableMap.of(), Paths.get("path", "report.txt")))
                         .build())
                 .build());
-    assertThat(files).doesNotContainKey("path/report.txt");
+    assertThat(files).doesNotContainKey(filenameJoiner.join("path", "report.txt"));
     assertThat(files.get("index.html"))
         .contains("<span class=\"report_link_broken\">[someReport]</span>");
   }
@@ -275,12 +279,15 @@ public final class CoverPageGeneratorTest {
                                 ImmutableMap.of(), Paths.get("path-empty", "report.txt")))
                         .build())
                 .build());
-    assertThat(files).containsEntry("path-filled/report.txt", "report content");
-    assertThat(files).containsEntry("path-filled/other/file.txt", "some other content");
-    assertThat(files).containsEntry("logs/my:name.log", "log data");
+    assertThat(files)
+        .containsEntry(filenameJoiner.join("path-filled", "report.txt"), "report content");
+    assertThat(files)
+        .containsEntry(
+            filenameJoiner.join("path-filled", "other", "file.txt"), "some other content");
+    assertThat(files).containsEntry(filenameJoiner.join("logs", "my-name.log"), "log data");
     assertThat(files.get("index.html"))
         .contains("<a href=\"path-filled/report.txt\">[filledReport]</a>");
-    assertThat(files.get("index.html")).contains("<a href=\"logs/my:name.log\">[log]</a>");
+    assertThat(files.get("index.html")).contains("<a href=\"logs/my-name.log\">[log]</a>");
     assertThat(files.get("index.html"))
         .contains("<span class=\"report_link_broken\">[emptyReport]</span>");
   }

buildSrc/src/test/java/google/registry/gradle/plugin/GcsPluginUtilsTest.java

@@ -29,6 +29,7 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 
 import com.google.cloud.storage.BlobInfo;
 import com.google.cloud.storage.Storage;
+import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableMap;
 import java.io.File;
 import java.nio.file.Files;
@@ -45,6 +46,8 @@ import org.junit.runners.JUnit4;
 @RunWith(JUnit4.class)
 public final class GcsPluginUtilsTest {
 
+  private static final Joiner filenameJoiner = Joiner.on(File.separator);
+
   @Rule public final TemporaryFolder folder = new TemporaryFolder();
 
   @Test
@@ -155,8 +158,10 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/file.txt");
-    assertThat(readAllFiles(files)).containsExactly("some/path/file.txt", "some data");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "file.txt"));
+    assertThat(readAllFiles(files))
+        .containsExactly(filenameJoiner.join("some", "path", "file.txt"), "some data");
   }
 
   @Test
@@ -171,7 +176,7 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("non/existing.txt");
+    assertThat(files.entryPoint().toString()).isEqualTo(filenameJoiner.join("non", "existing.txt"));
     assertThat(files.files()).isEmpty();
   }
 
@@ -187,7 +192,7 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path");
+    assertThat(files.entryPoint().toString()).isEqualTo(filenameJoiner.join("some", "path"));
     assertThat(files.files()).isEmpty();
   }
 
@@ -205,8 +210,10 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(ignoredHint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/a/file.txt");
-    assertThat(readAllFiles(files)).containsExactly("some/path/a/file.txt", "some data");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "a", "file.txt"));
+    assertThat(readAllFiles(files))
+        .containsExactly(filenameJoiner.join("some", "path", "a", "file.txt"), "some data");
   }
 
   /**
@@ -232,8 +239,10 @@ public final class GcsPluginUtilsTest {
 
     FilesWithEntryPoint files = readFilesWithEntryPoint(destination, Optional.empty(), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/path.zip");
-    assertThat(readAllFiles(files).keySet()).containsExactly("some/path/path.zip");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "path.zip"));
+    assertThat(readAllFiles(files).keySet())
+        .containsExactly(filenameJoiner.join("some", "path", "path.zip"));
   }
 
   /**
@@ -261,8 +270,10 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(badEntryPoint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/path.zip");
-    assertThat(readAllFiles(files).keySet()).containsExactly("some/path/path.zip");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "path.zip"));
+    assertThat(readAllFiles(files).keySet())
+        .containsExactly(filenameJoiner.join("some", "path", "path.zip"));
   }
 
   @Test
@@ -285,12 +296,13 @@ public final class GcsPluginUtilsTest {
     FilesWithEntryPoint files =
         readFilesWithEntryPoint(destination, Optional.of(goodEntryPoint), root);
 
-    assertThat(files.entryPoint().toString()).isEqualTo("some/path/index.html");
+    assertThat(files.entryPoint().toString())
+        .isEqualTo(filenameJoiner.join("some", "path", "index.html"));
     assertThat(readAllFiles(files))
         .containsExactly(
-            "some/path/index.html", "some data",
-            "some/path/a/index.html", "wrong index",
-            "some/path/c/style.css", "css file",
-            "some/path/my_image.png", "images");
+            filenameJoiner.join("some", "path", "index.html"), "some data",
+            filenameJoiner.join("some", "path", "a", "index.html"), "wrong index",
+            filenameJoiner.join("some", "path", "c", "style.css"), "css file",
+            filenameJoiner.join("some", "path", "my_image.png"), "images");
   }
 }

config/dependency-license/README.md

@@ -0,0 +1,16 @@
+## Summary
+
+This folder contains configuration files for the gradle-license-report plugin:
+
+*   allowed_licenses.json declares the acceptable licenses. A license may have
+    multiple entries in this file, since the 'moduleLicense' property value must
+    match exactly the phrases found in pom or manifest files.
+*   license_normalizer_bundle.json configures normalization rules for license
+    reporting.
+
+## Notes About Adding New Licenses
+
+*   The WTFPL license is not allowed.
+
+*   Each 'Public Domain' license entry must include a specific 'moduleName'. Do
+    not omit moduleName or use wildcards.

config/dependency-license/allowed_licenses.json

@@ -3,6 +3,9 @@
     {
       "moduleLicense": "Apache Software License, Version 1.1"
     },
+    {
+      "moduleLicense": "Apache Software License, version 1.1"
+    },
     {
       "moduleLicense": "Apache 2"
     },
@@ -90,6 +93,9 @@
     {
       "moduleLicense": "The BSD License"
     },
+    {
+      "moduleLicense": "The New BSD License"
+    },
     {
       "moduleLicense": "The PostgreSQL License"
     },
@@ -198,6 +204,9 @@
     {
       "moduleLicense": "The MIT license"
     },
+    {
+      "moduleLicense": "The MIT License (MIT)"
+    },
     {
       "moduleLicense": "The PostgreSQL License"
     },
@@ -205,10 +214,12 @@
       "moduleLicense": "Mozilla Public License Version 2.0"
     },
     {
-      "moduleLicense": "Public Domain"
+      "moduleLicense": "Public Domain",
+      "moduleName": "aopalliance:aopalliance"
     },
     {
-      "moduleLicense": "PUBLIC DOMAIN"
+      "moduleLicense": "Public Domain",
+      "moduleName": "org.tukaani:xz"
     },
     {
       "moduleLicense": "The W3C Software License"

config/presubmits.py

@@ -80,7 +80,7 @@ PRESUBMITS = {
             ".git", "/build/", "/generated/", "node_modules/",
             "JUnitBackports.java", "registrar_bin.", "registrar_dbg.",
             "google-java-format-diff.py",
-            "nomulus.golden.sql"
+            "nomulus.golden.sql", "soyutils_usegoog.js"
         }, REQUIRED):
         "File did not include the license header.",
 

core/build.gradle

@@ -76,9 +76,9 @@ sourceSets {
   main {
     java {
       srcDirs += generatedDir
-      // Javadoc API is deprecated and removed in Java 12.
+      // Javadoc API is deprecated in Java 11 and removed in Java 12.
       // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
         exclude 'google/registry/documentation/**'
       }
     }
@@ -88,9 +88,9 @@ sourceSets {
   }
   test {
     java {
-      // Javadoc API is deprecated and removed in Java 12.
+      // Javadoc API is deprecated in Java 11 and removed in Java 12.
       // TODO(jianglai): re-enable after migrating to the new Javadoc API
-      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
         exclude 'google/registry/documentation/**'
       }
     }
@@ -192,7 +192,7 @@ dependencies {
   compile deps['com.jcraft:jsch']
   testCompile deps['com.thoughtworks.qdox:qdox']
   compile deps['dnsjava:dnsjava']
-  runtime deps['org.glassfish.jaxb:jaxb-runtime']
+  testCompile deps['io.github.classgraph:classgraph']
   testCompile deps['javax.annotation:jsr250-api']
   compile deps['javax.inject:javax.inject']
   compile deps['javax.mail:mail']
@@ -218,6 +218,7 @@ dependencies {
   compile deps['org.bouncycastle:bcpg-jdk15on']
   testCompile deps['org.bouncycastle:bcpkix-jdk15on']
   compile deps['org.bouncycastle:bcprov-jdk15on']
+  runtime deps['org.glassfish.jaxb:jaxb-runtime']
   compile deps['org.joda:joda-money']
   compile deps['org.json:json']
   testCompile deps['org.mortbay.jetty:jetty']
@@ -289,12 +290,12 @@ dependencies {
 task jaxbToJava {
   def xsdFilesDir = "${javaDir}/google/registry/xml/xsd"
   def bindingsFile = "${javaDir}/google/registry/xjc/bindings.xjb"
-  def pkgInfoGenerator = "${javaDir}/google/registry/xjc/make_pkginfo.sh"
   def pkgInfoTemplate = "${javaDir}/google/registry/xjc/package-info.java.in"
+  def pkgInfoMap = "${javaDir}/google/registry/xjc/package-info.map"
   def outputDir = "${generatedDir}/google/registry/xjc"
 
   inputs.dir xsdFilesDir
-  inputs.files bindingsFile, pkgInfoTemplate, pkgInfoGenerator
+  inputs.files bindingsFile, pkgInfoTemplate, pkgInfoMap
   outputs.dir outputDir
 
   doLast {
@@ -332,11 +333,17 @@ task jaxbToJava {
       // below.
       arg(line: '-npa -quiet -extension')
     }
-    exec {
-      workingDir "${generatedDir}"
-
-      executable pkgInfoGenerator
-      args pkgInfoTemplate, outputDir
+    new File(pkgInfoMap).eachLine { line ->
+      def (packageName, namespace) = line.split()
+      ant.copy(
+          tofile: "${outputDir}/${packageName}/package-info.java",
+          overwrite: true,
+          file: "${pkgInfoTemplate}") {
+        filterSet() {
+          filter(token: 'PACKAGE', value: packageName)
+          filter(token: 'NAMESPACE', value: namespace)
+        }
+      }
     }
   }
 }
@@ -412,8 +419,10 @@ task soyToJS {
           "--allowExternalCalls", "false",
           "--srcs", "${soyFiles.join(',')}",
           "--shouldProvideRequireSoyNamespaces", "true",
-          "--compileTimeGlobalsFile", "${resourcesSourceDir}/google/registry/ui/globals.txt",
-          "--deps", "${deps.join(',')}"
+          "--compileTimeGlobalsFile", "${resourcesSourceDir}/google/registry/ui/globals.txt"
+      if (deps != "") {
+        args "--deps", "${deps.join(',')}"
+      }
     }
   }
 
@@ -514,7 +523,7 @@ task compileProdJS(type: JavaExec) {
 
   // manually include all the required js files
   closureArgs << "--js=${nodeModulesDir}/google-closure-library/**.js"
-  closureArgs << "--js=${nodeModulesDir}/soyutils_usegoog.js"
+  closureArgs << "--js=${jsDir}/soyutils_usegoog.js"
   closureArgs << "--js=${cssSourceDir}/registrar_bin.css.js"
   closureArgs << "--js=${jsSourceDir}/**.js"
   // TODO(shicong) Verify the compiled JS file works in Alpha
@@ -525,7 +534,12 @@ task compileProdJS(type: JavaExec) {
 
 compileJava.dependsOn jaxbToJava
 compileJava.dependsOn soyToJava
-compileJava.dependsOn compileProdJS
+// The Closure JS compiler does not support Windows. It is fine to disable it if
+// all we want to do is to complile the Java code on Windows.
+if (!System.properties['os.name'].toLowerCase().contains('windows')) {
+  compileJava.dependsOn compileProdJS
+  assemble.dependsOn compileProdJS
+}
 
 // stylesheetsToJavascript must happen after processResources, which wipes the
 // resources folder before copying data into it.
@@ -536,13 +550,12 @@ compileProdJS.dependsOn rootProject.npmInstall
 compileProdJS.dependsOn processResources
 compileProdJS.dependsOn processTestResources
 compileProdJS.dependsOn soyToJS
-assemble.dependsOn compileProdJS
 
 task karmaTest(type: Exec) {
   dependsOn ':npmInstall'
   workingDir rootProject.projectDir
   executable 'node_modules/karma/bin/karma'
-  args('start')
+  args('start', "${project.projectDir}/karma.conf.js")
 }
 
 test.dependsOn karmaTest
@@ -558,10 +571,67 @@ artifacts {
   testRuntime testJar
 }
 
-task fragileTest(type: Test) {
+/**
+ * We have to break out the test suites because some of the tests conflict
+ * with one another, but unfortunately this breaks the "--tests" flag.  The
+ * --tests flag only applies to the task named on the command line (usually
+ * just "test"), not for all tasks of type "Test".
+ *
+ * As a better solution, FilteringTest sets testNameIncludePatterns (the
+ * internal property that --tests sets) from the value of the "testFilter"
+ * property, allowing us to filter across all the tests in core without
+ * explicitly specifying a test task or causing errors because there are no
+ * matching tests in the main task.
+ *
+ * To use it, define "testFilter" to be a comma-separated collection of class
+ * names (wildcards are allowed):
+ *
+ *   ./gradlew test -P testFilter=*.FooBar,google.registry.tools.ShellCommandTest
+ */
+class FilteringTest extends Test {
+
+  private void applyTestFilter() {
+    if (project.testFilter) {
+      testNameIncludePatterns = project.testFilter.split(',')
+
+      // By default, gradle test tasks will produce a failure if no tests
+      // match the include/exclude/filter rules.  Since test filtering allows us
+      // to select a set of tests from a particular task, we don't want this
+      // behavior.
+      filter.failOnNoMatchingTests = false
+    }
+  }
+
+  /**
+   * Set to false if you also want to include TestCase and TestSuite classes.
+   *
+   * <p>Must be defined before "test", if at all.
+   */
+  boolean excludeTestCases = true
+
+  void setTests(List<String> tests) {
+    // Common exclude pattern. See README in parent directory for explanation.
+    if (excludeTestCases) {
+      exclude "**/*TestCase.*", "**/*TestSuite.*"
+    }
+    include tests
+    applyTestFilter()
+  }
+
+  /**
+   * Include all of the tests (except Test{Case,TestSuite}).  This actually
+   * doesn't explicitly "include" anything, in which cast the Test class tries
+   * to include everything that is not explicitly excluded.
+   */
+  void includeAllTests() {
+    exclude "**/*TestCase.*", "**/*TestSuite.*"
+    applyTestFilter()
+  }
+}
+
+task fragileTest(type: FilteringTest) {
   // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include fragileTestPatterns
+  tests = fragileTestPatterns
 
   if (rootProject.findProperty("skipDockerIncompatibleTests") == "true") {
     exclude dockerIncompatibleTestPatterns
@@ -571,15 +641,19 @@ task fragileTest(type: Test) {
   forkEvery 1
 }
 
-task outcastTest(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include outcastTestPatterns
+task outcastTest(type: FilteringTest) {
+  tests = outcastTestPatterns
 
   // Sets the maximum number of test executors that may exist at the same time.
   maxParallelForks 5
 }
 
+// Dedicated test suite for schema-dependent tests.
+task sqlIntegrationTest(type: FilteringTest) {
+  excludeTestCases = false
+  tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
+}
+
 task findGoldenImages(type: JavaExec) {
   classpath = sourceSets.test.runtimeClasspath
   main = 'google.registry.webdriver.GoldenImageFinder'
@@ -630,10 +704,8 @@ task registryTool(type: JavaExec) {
   }
 }
 
-task generateGoldenImages(type: Test) {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
-  include "**/webdriver/*"
+task generateGoldenImages(type: FilteringTest) {
+  tests = ["**/webdriver/*"]
 
   // Sets the maximum number of test executors that may exist at the same time.
   maxParallelForks 5
@@ -664,9 +736,8 @@ task flowDocsTool(type: JavaExec) {
   args arguments
 }
 
-test {
-  // Common exclude pattern. See README in parent directory for explanation.
-  exclude "**/*TestCase.*", "**/*TestSuite.*"
+task standardTest(type: FilteringTest) {
+  includeAllTests()
   exclude fragileTestPatterns
   exclude outcastTestPatterns
 
@@ -688,7 +759,13 @@ test {
   doFirst {
     new File(screenshotsDir).deleteDir()
   }
-}.dependsOn(fragileTest, outcastTest)
+}
+
+test {
+  // Don't run any tests from this task, all testing gets done in the
+  // FilteringTest tasks.
+  exclude "**"
+}.dependsOn(fragileTest, outcastTest, standardTest)
 
 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
 project.nomulus.dependsOn project(':third_party').jar

core/gradle/dependency-locks/compile.lockfile

@@ -6,11 +6,10 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -18,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -44,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -165,22 +164,23 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
@@ -204,7 +204,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5

core/gradle/dependency-locks/compileClasspath.lockfile

@@ -6,11 +6,10 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -18,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -44,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -163,22 +162,23 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
@@ -202,7 +202,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5

core/gradle/dependency-locks/default.lockfile

@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
 com.github.jnr:jffi:1.2.17
 com.github.jnr:jnr-a64asm:1.0.0
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -26,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -52,7 +51,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -176,22 +175,23 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
@@ -215,7 +215,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5

core/gradle/dependency-locks/runtime.lockfile

@@ -6,11 +6,10 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -18,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -44,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -165,22 +164,23 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
@@ -204,7 +204,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5

core/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
 com.github.jnr:jffi:1.2.17
 com.github.jnr:jnr-a64asm:1.0.0
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -26,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -52,7 +51,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -176,22 +175,23 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
 org.apache.httpcomponents:httpclient:4.5.8
@@ -215,7 +215,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:1.9.5

core/gradle/dependency-locks/testCompile.lockfile

@@ -6,11 +6,10 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -18,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -44,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -130,6 +129,7 @@ commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -173,24 +173,25 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -227,7 +228,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0

core/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -6,11 +6,10 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -18,7 +17,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -44,7 +43,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -129,6 +128,7 @@ commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -171,24 +171,25 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -225,7 +226,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0

core/gradle/dependency-locks/testRuntime.lockfile

@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
 com.github.jnr:jffi:1.2.17
 com.github.jnr:jnr-a64asm:1.0.0
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -26,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -52,7 +51,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -141,6 +140,7 @@ commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -184,24 +184,25 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,7 +240,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0

core/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -6,9 +6,9 @@ aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
 com.beust:jcommander:1.60
-com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.9
-com.fasterxml.jackson.core:jackson-databind:2.9.8
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
 com.github.jnr:jffi:1.2.17
 com.github.jnr:jnr-a64asm:1.0.0
@@ -18,7 +18,6 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.github.luben:zstd-jni:1.3.8-3
 com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
@@ -26,7 +25,7 @@ com.google.api-client:google-api-client-servlet:1.29.0
 com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
-com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
 com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
@@ -52,7 +51,7 @@ com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
 com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
 com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
 com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
-com.google.apis:google-api-services-dataflow:v1b3-rev20190126-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
 com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
 com.google.apis:google-api-services-drive:v2-rev160-1.19.1
 com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
@@ -141,6 +140,7 @@ commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
+io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -184,24 +184,25 @@ javax.transaction:transaction-api:1.1
 javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
-joda-time:joda-time:2.9.2
+joda-time:joda-time:2.10.3
 junit:junit:4.12
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
 org.apache.avro:avro:1.8.2
-org.apache.beam:beam-model-job-management:2.11.0
-org.apache.beam:beam-model-pipeline:2.11.0
-org.apache.beam:beam-runners-core-construction-java:2.11.0
-org.apache.beam:beam-runners-direct-java:2.11.0
-org.apache.beam:beam-runners-google-cloud-dataflow-java:2.11.0
-org.apache.beam:beam-sdks-java-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.11.0
-org.apache.beam:beam-sdks-java-extensions-protobuf:2.11.0
-org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.11.0
-org.apache.beam:beam-vendor-grpc-1_13_1:0.2
-org.apache.beam:beam-vendor-guava-20_0:0.1
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-direct-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-exec:1.3
 org.apache.commons:commons-lang3:3.8.1
@@ -239,7 +240,7 @@ org.jboss.logging:jboss-logging:3.3.2.Final
 org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
 org.jboss:jandex:2.0.5.Final
 org.jetbrains:annotations:17.0.0
-org.joda:joda-money:0.10.0
+org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
 org.mockito:mockito-core:2.25.0

core/karma.conf.js

@@ -16,6 +16,7 @@ process.env.CHROME_BIN = require('puppeteer').executablePath()
 
 module.exports = function(config) {
   config.set({
+    basePath: '..',
     browsers: ['ChromeHeadlessNoSandbox'],
     customLaunchers: {
       ChromeHeadlessNoSandbox: {
@@ -41,10 +42,6 @@ module.exports = function(config) {
         pattern: 'core/build/generated/source/custom/main/**/*.soy.js',
         included: false
       },
-      {
-        pattern: 'node_modules/soyutils_usegoog.js',
-        included: false
-      },
       {
         pattern: 'node_modules/google-closure-library/closure/goog/deps.js',
         included: false,
@@ -69,7 +66,6 @@ module.exports = function(config) {
       'node_modules/google-closure-library/closure/**/*.js': ['closure'],
       'core/src/*/javascript/**/*.js': ['closure'],
       'core/build/generated/source/custom/main/**/*.soy.js': ['closure'],
-      'node_modules/soyutils_usegoog.js': ['closure']
     },
     proxies: {
       "/assets/": "/base/core/build/resources/main/google/registry/ui/assets/"

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -1296,12 +1296,6 @@ public final class RegistryConfig {
       return config.registryTool.clientSecret;
     }
 
-    @Provides
-    @Config("toolsCloudSqlJdbcUrl")
-    public static String providesToolsCloudSqlJdbcUrl(RegistryConfigSettings config) {
-      return config.registryTool.jdbcUrl;
-    }
-
     @Provides
     @Config("toolsCloudSqlUsername")
     public static String providesToolsCloudSqlUsername(RegistryConfigSettings config) {

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -213,7 +213,6 @@ public class RegistryConfigSettings {
   public static class RegistryTool {
     public String clientId;
     public String clientSecret;
-    public String jdbcUrl;
     public String username;
   }
 }

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -422,6 +422,4 @@ registryTool:
   clientId: YOUR_CLIENT_ID
   # OAuth client secret used by the tool.
   clientSecret: YOUR_CLIENT_SECRET
-  # Nomulus tool uses a different jdbc url and user to connect to Cloud SQL
-  jdbcUrl: jdbc:postgresql://localhost/tool
   username: toolusername

core/src/main/java/google/registry/env/common/default/WEB-INF/web.xml

@@ -55,6 +55,12 @@
     <url-pattern>/registrar-settings</url-pattern>
   </servlet-mapping>
 
+  <!-- Registry lock get/post/verify. -->
+  <servlet-mapping>
+    <servlet-name>frontend-servlet</servlet-name>
+    <url-pattern>/registry-lock-get</url-pattern>
+  </servlet-mapping>
+
   <!-- Security config -->
   <security-constraint>
     <web-resource-collection>

core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml

@@ -144,7 +144,7 @@
   <cron>
     <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
     <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
     </description>
     <schedule>every 12 hours synchronized</schedule>
     <target>backend</target>

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml

@@ -112,7 +112,7 @@
   <cron>
     <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/exportDomainLists&runInEmpty]]></url>
     <description>
-      This job exports lists of all active domain names to Google Cloud Storage.
+      This job exports lists of all active domain names to Google Drive and Google Cloud Storage.
     </description>
     <schedule>every 12 hours synchronized</schedule>
     <target>backend</target>

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -56,7 +56,7 @@ import javax.inject.Inject;
 import org.joda.time.DateTime;
 
 /**
- * A mapreduce that exports the list of active domains on all real TLDs to Google Cloud Storage.
+ * A mapreduce that exports the list of active domains on all real TLDs to Google Drive and GCS.
  *
  * <p>Each TLD's active domain names are exported as a newline-delimited flat text file with the
  * name TLD.txt into the domain-lists bucket. Note that this overwrites the files in place.

core/src/main/java/google/registry/flows/domain/DomainCreateFlow.java

@@ -187,6 +187,7 @@ import org.joda.time.Duration;
  * @error {@link DomainFlowUtils.UnexpectedClaimsNoticeException}
  * @error {@link DomainFlowUtils.UnsupportedFeeAttributeException}
  * @error {@link DomainFlowUtils.UnsupportedMarkTypeException}
+ * @error {@link DomainPricingLogic.AllocationTokenInvalidForPremiumNameException}
  */
 @ReportingSpec(ActivityReportField.DOMAIN_CREATE)
 public class DomainCreateFlow implements TransactionalFlow {

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -14,12 +14,12 @@
 
 package google.registry.flows.domain;
 
-import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.pricing.PricingEngineProxy.getDomainFeeClass;
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;
 
 import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
+import google.registry.flows.EppException.CommandUseErrorException;
 import google.registry.flows.FlowScope;
 import google.registry.flows.custom.DomainPricingCustomLogic;
 import google.registry.flows.custom.DomainPricingCustomLogic.CreatePriceParameters;
@@ -182,13 +182,14 @@ public final class DomainPricingLogic {
   }
 
   private Money getDomainCreateCostWithDiscount(
-      String domainName, DateTime date, int years, Optional<AllocationToken> allocationToken) {
+      String domainName, DateTime date, int years, Optional<AllocationToken> allocationToken)
+      throws EppException {
     DomainPrices domainPrices = PricingEngineProxy.getPricesForDomainName(domainName, date);
-    checkArgument(
-        !allocationToken.isPresent()
-            || allocationToken.get().getDiscountFraction() == 0.0
-            || !domainPrices.isPremium(),
-        "A nonzero discount code cannot be applied to premium domains");
+    if (allocationToken.isPresent()
+        && allocationToken.get().getDiscountFraction() != 0.0
+        && domainPrices.isPremium()) {
+      throw new AllocationTokenInvalidForPremiumNameException();
+    }
     Money oneYearCreateCost = domainPrices.getCreateCost();
     Money totalDomainCreateCost = oneYearCreateCost.multipliedBy(years);
     // If a discount is applicable, apply it only to the first year
@@ -200,4 +201,12 @@ public final class DomainPricingLogic {
     }
     return totalDomainCreateCost;
   }
+
+  /** An allocation token was provided that is invalid for premium domains. */
+  public static class AllocationTokenInvalidForPremiumNameException
+      extends CommandUseErrorException {
+    public AllocationTokenInvalidForPremiumNameException() {
+      super("A nonzero discount code cannot be applied to premium domains");
+    }
+  }
 }

core/src/main/java/google/registry/model/common/Cursor.java

@@ -79,7 +79,16 @@ public class Cursor extends ImmutableObject {
      * stored is the last time that registrar changes were successfully synced to the sheet. If
      * there were no changes since the last time the action run, the cursor is not updated.
      */
-    SYNC_REGISTRAR_SHEET(EntityGroupRoot.class);
+    SYNC_REGISTRAR_SHEET(EntityGroupRoot.class),
+
+    /** Cursor for tracking monthly uploads of ICANN transaction reports. */
+    ICANN_UPLOAD_TX(Registry.class),
+
+    /** Cursor for tracking monthly uploads of ICANN activity reports. */
+    ICANN_UPLOAD_ACTIVITY(Registry.class),
+
+    /** Cursor for tracking monthly upload of MANIFEST.txt to ICANN. */
+    ICANN_UPLOAD_MANIFEST(EntityGroupRoot.class);
 
     /** See the definition of scope on {@link #getScopeClass}. */
     private final Class<? extends ImmutableObject> scope;

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -35,6 +35,8 @@ import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.Id;
 import com.googlecode.objectify.annotation.Index;
 import com.googlecode.objectify.annotation.Mapify;
+import google.registry.flows.EppException;
+import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.Buildable;
 import google.registry.model.CreateAutoTimestamp;
@@ -201,6 +203,13 @@ public class AllocationToken extends BackupGroupRoot implements Buildable {
           getInstance().redemptionHistoryEntry == null
               || TokenType.SINGLE_USE.equals(getInstance().tokenType),
           "Redemption history entry can only be specified for SINGLE_USE tokens");
+      if (getInstance().domainName != null) {
+        try {
+          DomainFlowUtils.validateDomainName(getInstance().domainName);
+        } catch (EppException e) {
+          throw new IllegalArgumentException("Invalid domain name: " + getInstance().domainName, e);
+        }
+      }
       return super.build();
     }
 

core/src/main/java/google/registry/model/registry/RegistryLockDao.java

@@ -17,6 +17,7 @@ package google.registry.model.registry;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
 
+import com.google.common.collect.ImmutableList;
 import google.registry.schema.domain.RegistryLock;
 import javax.persistence.EntityManager;
 
@@ -40,13 +41,29 @@ public final class RegistryLockDao {
                           Long.class)
                       .setParameter("verificationCode", verificationCode)
                       .getSingleResult();
+              // TODO(gbrodman): Don't throw NPE here. Maybe NoResultException fits better?
               checkNotNull(revisionId, "No registry lock with this code");
               return em.find(RegistryLock.class, revisionId);
             });
   }
 
-  public static void save(RegistryLock registryLock) {
+  public static ImmutableList<RegistryLock> getByRegistrarId(String registrarId) {
+    return jpaTm()
+        .transact(
+            () ->
+                ImmutableList.copyOf(
+                    jpaTm()
+                        .getEntityManager()
+                        .createQuery(
+                            "SELECT lock FROM RegistryLock lock WHERE"
+                                + " lock.registrarId = :registrarId",
+                            RegistryLock.class)
+                        .setParameter("registrarId", registrarId)
+                        .getResultList()));
+  }
+
+  public static RegistryLock save(RegistryLock registryLock) {
     checkNotNull(registryLock, "Null registry lock cannot be saved");
-    jpaTm().transact(() -> jpaTm().getEntityManager().persist(registryLock));
+    return jpaTm().transact(() -> jpaTm().getEntityManager().merge(registryLock));
   }
 }

core/src/main/java/google/registry/model/tmch/ClaimsListDao.java

@@ -0,0 +1,72 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.tmch;
+
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.flogger.FluentLogger;
+import google.registry.schema.tmch.ClaimsList;
+import javax.persistence.EntityManager;
+
+/** Data access object for {@link ClaimsList}. */
+public class ClaimsListDao {
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  private static void save(ClaimsList claimsList) {
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(claimsList));
+  }
+
+  /**
+   * Try to save the given {@link ClaimsList} into Cloud SQL. If the save fails, the error will be
+   * logged but no exception will be thrown.
+   *
+   * <p>This method is used during the dual-write phase of database migration as Datastore is still
+   * the authoritative database.
+   */
+  public static void trySave(ClaimsList claimsList) {
+    try {
+      ClaimsListDao.save(claimsList);
+      logger.atInfo().log(
+          "Inserted %,d claims into Cloud SQL, created at %s",
+          claimsList.getLabelsToKeys().size(), claimsList.getTmdbGenerationTime());
+    } catch (Throwable e) {
+      logger.atSevere().withCause(e).log("Error inserting claims into Cloud SQL");
+    }
+  }
+
+  /**
+   * Returns the current revision of the {@link ClaimsList} in Cloud SQL. Throws exception if there
+   * is no claims in the table.
+   */
+  public static ClaimsList getCurrent() {
+    return jpaTm()
+        .transact(
+            () -> {
+              EntityManager em = jpaTm().getEntityManager();
+              Long revisionId =
+                  em.createQuery("SELECT MAX(revisionId) FROM ClaimsList", Long.class)
+                      .getSingleResult();
+              return em.createQuery(
+                      "FROM ClaimsList cl LEFT JOIN FETCH cl.labelsToKeys WHERE cl.revisionId ="
+                          + " :revisionId",
+                      ClaimsList.class)
+                  .setParameter("revisionId", revisionId)
+                  .getSingleResult();
+            });
+  }
+
+  private ClaimsListDao() {}
+}

core/src/main/java/google/registry/model/tmch/ClaimsListShard.java

@@ -217,8 +217,7 @@ public class ClaimsListShard extends ImmutableObject {
             });
   }
 
-  public static ClaimsListShard create(
-      DateTime creationTime, ImmutableMap<String, String> labelsToKeys) {
+  public static ClaimsListShard create(DateTime creationTime, Map<String, String> labelsToKeys) {
     ClaimsListShard instance = new ClaimsListShard();
     instance.id = allocateId();
     instance.creationTime = checkNotNull(creationTime);

core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java

@@ -15,10 +15,7 @@
 package google.registry.model.transaction;
 
 import com.google.common.flogger.FluentLogger;
-import google.registry.persistence.PersistenceModule.AppEngineEmf;
 import google.registry.util.Clock;
-import javax.inject.Inject;
-import javax.inject.Singleton;
 import javax.persistence.EntityManager;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.EntityTransaction;
@@ -26,7 +23,6 @@ import javax.persistence.PersistenceException;
 import org.joda.time.DateTime;
 
 /** Implementation of {@link JpaTransactionManager} for JPA compatible database. */
-@Singleton
 public class JpaTransactionManagerImpl implements JpaTransactionManager {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -39,8 +35,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   private final ThreadLocal<TransactionInfo> transactionInfo =
       ThreadLocal.withInitial(TransactionInfo::new);
 
-  @Inject
-  JpaTransactionManagerImpl(@AppEngineEmf EntityManagerFactory emf, Clock clock) {
+  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock) {
     this.emf = emf;
     this.clock = clock;
   }
@@ -84,17 +79,14 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       T result = work.run();
       txn.commit();
       return result;
-    } catch (Throwable transactionException) {
-      String rollbackMessage;
+    } catch (RuntimeException e) {
       try {
         txn.rollback();
-        rollbackMessage = "transaction rolled back";
+        logger.atWarning().log("Error during transaction; transaction rolled back");
       } catch (Throwable rollbackException) {
-        logger.atSevere().withCause(rollbackException).log("Rollback failed, suppressing error");
-        rollbackMessage = "transaction rollback failed";
+        logger.atSevere().withCause(rollbackException).log("Rollback failed; suppressing error");
       }
-      throw new PersistenceException(
-          "Error during transaction, " + rollbackMessage, transactionException);
+      throw e;
     } finally {
       txnInfo.clear();
     }

core/src/main/java/google/registry/model/transaction/TransactionManagerFactory.java

@@ -14,8 +14,16 @@
 
 package google.registry.model.transaction;
 
+import static google.registry.config.RegistryEnvironment.ALPHA;
+import static google.registry.config.RegistryEnvironment.CRASH;
+import static google.registry.config.RegistryEnvironment.SANDBOX;
+
+import com.google.appengine.api.utils.SystemProperty;
+import com.google.appengine.api.utils.SystemProperty.Environment.Value;
 import com.google.common.annotations.VisibleForTesting;
+import google.registry.config.RegistryEnvironment;
 import google.registry.model.ofy.DatastoreTransactionManager;
+import google.registry.persistence.DaggerPersistenceComponent;
 
 /** Factory class to create {@link TransactionManager} instance. */
 // TODO: Rename this to PersistenceFactory and move to persistence package.
@@ -27,19 +35,11 @@ public class TransactionManagerFactory {
   private TransactionManagerFactory() {}
 
   private static JpaTransactionManager createJpaTransactionManager() {
-    // TODO(shicong): There is currently no environment where we want to create a real JPA
-    // transaction manager here.  The unit tests that require one are all set up using
-    // JpaTransactionManagerRule which launches its own PostgreSQL instance.  When we actually have
-    // PostgreSQL tables in production, ensure that all of the test environments are set up
-    // correctly and restore the code that creates a JpaTransactionManager when
-    // RegistryEnvironment.get() != UNITTEST.
-    //
-    // We removed the original code because it didn't work in sandbox (due to the absence of the
-    // persistence.xml file, which has since been added), and then (after adding this) didn't work
-    // in crash because the postgresql password hadn't been set up.  Prior to restoring, we'll need
-    // to do setup in all environments, and we probably only want to do this once we're actually
-    // using Cloud SQL for one of the new tables.
-    return DummyJpaTransactionManager.create();
+    if (shouldEnableJpaTm() && isInAppEngine()) {
+      return DaggerPersistenceComponent.create().appEngineJpaTransactionManager();
+    } else {
+      return DummyJpaTransactionManager.create();
+    }
   }
 
   private static TransactionManager createTransactionManager() {
@@ -49,6 +49,36 @@ public class TransactionManagerFactory {
     return new DatastoreTransactionManager(null);
   }
 
+  /**
+   * Sets jpaTm to the implementation for Nomulus tool. Note that this method should be only used by
+   * {@link google.registry.tools.RegistryCli} to initialize jpaTm.
+   */
+  public static void initForTool() {
+    if (shouldEnableJpaTm()) {
+      jpaTm = DaggerPersistenceComponent.create().nomulusToolJpaTransactionManager();
+    }
+  }
+
+  // TODO(shicong): Enable JpaTm for all environments and remove this function
+  private static boolean shouldEnableJpaTm() {
+    return RegistryEnvironment.get() == ALPHA
+        || RegistryEnvironment.get() == CRASH
+        || RegistryEnvironment.get() == SANDBOX;
+  }
+
+  /**
+   * This function uses App Engine API to determine if the current runtime environment is App
+   * Engine.
+   *
+   * @see <a
+   *     href="https://cloud.google.com/appengine/docs/standard/java/javadoc/com/google/appengine/api/utils/SystemProperty">App
+   *     Engine API public doc</a>
+   */
+  private static boolean isInAppEngine() {
+    // SystemProperty.environment.value() returns null if the current runtime is local JVM
+    return SystemProperty.environment.value() == Value.Production;
+  }
+
   /** Returns {@link TransactionManager} instance. */
   public static TransactionManager tm() {
     return TM;
@@ -56,11 +86,6 @@ public class TransactionManagerFactory {
 
   /** Returns {@link JpaTransactionManager} instance. */
   public static JpaTransactionManager jpaTm() {
-    // TODO: Returns corresponding TransactionManager based on the runtime environment.
-    //  We have 3 kinds of runtime environment:
-    //    1. App Engine
-    //    2. Local JVM used by nomulus tool
-    //    3. Unit test
     return jpaTm;
   }
 }

core/src/main/java/google/registry/module/frontend/FrontendRequestComponent.java

@@ -30,6 +30,7 @@ import google.registry.ui.server.registrar.ConsoleUiAction;
 import google.registry.ui.server.registrar.OteStatusAction;
 import google.registry.ui.server.registrar.RegistrarConsoleModule;
 import google.registry.ui.server.registrar.RegistrarSettingsAction;
+import google.registry.ui.server.registrar.RegistryLockGetAction;
 
 /** Dagger component with per-request lifetime for "default" App Engine module. */
 @RequestScope
@@ -50,6 +51,8 @@ interface FrontendRequestComponent {
   OteStatusAction oteStatusAction();
   RegistrarSettingsAction registrarSettingsAction();
 
+  RegistryLockGetAction registryLockGetAction();
+
   @Subcomponent.Builder
   abstract class Builder implements RequestComponentBuilder<FrontendRequestComponent> {
     @Override public abstract Builder requestModule(RequestModule requestModule);

core/src/main/java/google/registry/persistence/BloomFilterConverter.java

@@ -0,0 +1,59 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.hash.Funnels.stringFunnel;
+
+import com.google.common.hash.BloomFilter;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA converter for ASCII String {@link BloomFilter}s. */
+@Converter(autoApply = true)
+public class BloomFilterConverter implements AttributeConverter<BloomFilter<String>, byte[]> {
+
+  @Override
+  @Nullable
+  public byte[] convertToDatabaseColumn(@Nullable BloomFilter<String> entity) {
+    if (entity == null) {
+      return null;
+    }
+    ByteArrayOutputStream bos = new ByteArrayOutputStream();
+    try {
+      entity.writeTo(bos);
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error saving Bloom filter data", e);
+    }
+    return bos.toByteArray();
+  }
+
+  @Override
+  @Nullable
+  public BloomFilter<String> convertToEntityAttribute(@Nullable byte[] columnValue) {
+    if (columnValue == null) {
+      return null;
+    }
+    try {
+      return BloomFilter.readFrom(new ByteArrayInputStream(columnValue), stringFunnel(US_ASCII));
+    } catch (IOException e) {
+      throw new UncheckedIOException("Error loading Bloom filter data", e);
+    }
+  }
+}

core/src/main/java/google/registry/persistence/CreateAutoTimestampConverter.java

@@ -27,14 +27,13 @@ import javax.persistence.Converter;
 import org.joda.time.DateTime;
 
 /** JPA converter to for storing/retrieving CreateAutoTimestamp objects. */
-@Converter
+@Converter(autoApply = true)
 public class CreateAutoTimestampConverter
     implements AttributeConverter<CreateAutoTimestamp, Timestamp> {
 
   @Override
   public Timestamp convertToDatabaseColumn(CreateAutoTimestamp entity) {
-    DateTime dateTime =
-        firstNonNull(((CreateAutoTimestamp) entity).getTimestamp(), jpaTm().getTransactionTime());
+    DateTime dateTime = firstNonNull(entity.getTimestamp(), jpaTm().getTransactionTime());
     return Timestamp.from(DateTimeUtils.toZonedDateTime(dateTime).toInstant());
   }
 

core/src/main/java/google/registry/persistence/CurrencyUnitConverter.java

@@ -0,0 +1,29 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import javax.annotation.Nullable;
+import javax.persistence.Converter;
+import org.joda.money.CurrencyUnit;
+
+/** JPA converter for {@link CurrencyUnit}s. */
+@Converter(autoApply = true)
+public class CurrencyUnitConverter extends ToStringConverterBase<CurrencyUnit> {
+
+  @Override
+  @Nullable
+  public CurrencyUnit convertToEntityAttribute(@Nullable String columnValue) {
+    return (columnValue == null) ? null : CurrencyUnit.of(columnValue);
+  }
+}

core/src/main/java/google/registry/persistence/HibernateSchemaExporter.java

@@ -0,0 +1,107 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Maps;
+import java.io.File;
+import java.util.EnumSet;
+import java.util.Map;
+import java.util.Properties;
+import java.util.stream.Stream;
+import javax.persistence.AttributeConverter;
+import org.hibernate.boot.MetadataSources;
+import org.hibernate.boot.registry.StandardServiceRegistry;
+import org.hibernate.boot.registry.StandardServiceRegistryBuilder;
+import org.hibernate.cfg.Environment;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
+import org.hibernate.tool.hbm2ddl.SchemaExport;
+import org.hibernate.tool.schema.TargetType;
+
+/** Utility class to export DDL script for given {@link javax.persistence.Entity} classes. */
+public class HibernateSchemaExporter {
+  private final String jdbcUrl;
+  private final String username;
+  private final String password;
+
+  private HibernateSchemaExporter(String jdbcUrl, String username, String password) {
+    this.jdbcUrl = jdbcUrl;
+    this.username = username;
+    this.password = password;
+  }
+
+  /** Constructs a {@link HibernateSchemaExporter} instance. */
+  public static HibernateSchemaExporter create(String jdbcUrl, String username, String password) {
+    return new HibernateSchemaExporter(jdbcUrl, username, password);
+  }
+
+  /** Exports DDL script to the {@code outputFile} for the given {@code entityClasses}. */
+  public void export(ImmutableList<Class> entityClasses, File outputFile) {
+    // Configure Hibernate settings.
+    Map<String, String> settings = Maps.newHashMap();
+    settings.put(Environment.DIALECT, NomulusPostgreSQLDialect.class.getName());
+    settings.put(Environment.URL, jdbcUrl);
+    settings.put(Environment.USER, username);
+    settings.put(Environment.PASS, password);
+    settings.put(Environment.HBM2DDL_AUTO, "none");
+    settings.put(Environment.SHOW_SQL, "true");
+    settings.put(
+        Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());
+
+    try (StandardServiceRegistry registry =
+        new StandardServiceRegistryBuilder().applySettings(settings).build()) {
+      MetadataSources metadata = new MetadataSources(registry);
+
+      // Note that we need to also add all converters to the Hibernate context because
+      // the entity class may use the customized type.
+      Stream.concat(entityClasses.stream(), findAllConverters().stream())
+          .forEach(metadata::addAnnotatedClass);
+
+      SchemaExport export = new SchemaExport();
+      export.setHaltOnError(true);
+      export.setFormat(true);
+      export.setDelimiter(";");
+      export.setOutputFile(outputFile.getAbsolutePath());
+      export.createOnly(EnumSet.of(TargetType.SCRIPT), metadata.buildMetadata());
+    }
+  }
+
+  private ImmutableList<Class> findAllConverters() {
+    ParsedPersistenceXmlDescriptor descriptor =
+        PersistenceXmlParser.locatePersistenceUnits(new Properties()).stream()
+            .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+            .findFirst()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format(
+                            "Could not find persistence unit with name %s",
+                            PersistenceModule.PERSISTENCE_UNIT_NAME)));
+    return descriptor.getManagedClassNames().stream()
+        .map(
+            className -> {
+              try {
+                return Class.forName(className);
+              } catch (ClassNotFoundException e) {
+                throw new RuntimeException(e);
+              }
+            })
+        .filter(AttributeConverter.class::isAssignableFrom)
+        .collect(toImmutableList());
+  }
+}

core/src/main/java/google/registry/persistence/PersistenceComponent.java

@@ -18,7 +18,9 @@ import dagger.Component;
 import google.registry.config.CredentialModule;
 import google.registry.config.RegistryConfig.ConfigModule;
 import google.registry.keyring.kms.KmsModule;
-import google.registry.model.transaction.JpaTransactionManagerImpl;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.persistence.PersistenceModule.AppEngineJpaTm;
+import google.registry.persistence.PersistenceModule.NomulusToolJpaTm;
 import google.registry.util.UtilsModule;
 import javax.inject.Singleton;
 import javax.persistence.EntityManagerFactory;
@@ -34,5 +36,10 @@ import javax.persistence.EntityManagerFactory;
       UtilsModule.class
     })
 public interface PersistenceComponent {
-  JpaTransactionManagerImpl jpaTransactionManager();
+
+  @AppEngineJpaTm
+  JpaTransactionManager appEngineJpaTransactionManager();
+
+  @NomulusToolJpaTm
+  JpaTransactionManager nomulusToolJpaTransactionManager();
 }

core/src/main/java/google/registry/persistence/PersistenceModule.java

@@ -29,11 +29,14 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.keyring.kms.KmsKeyring;
+import google.registry.model.transaction.JpaTransactionManager;
+import google.registry.model.transaction.JpaTransactionManagerImpl;
+import google.registry.util.Clock;
 import java.lang.annotation.Documented;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
 import java.util.HashMap;
+import java.util.Map;
 import javax.inject.Qualifier;
+import javax.inject.Singleton;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.Persistence;
 import org.hibernate.cfg.Environment;
@@ -48,6 +51,10 @@ public class PersistenceModule {
   public static final String HIKARI_MAXIMUM_POOL_SIZE = "hibernate.hikari.maximumPoolSize";
   public static final String HIKARI_IDLE_TIMEOUT = "hibernate.hikari.idleTimeout";
 
+  public static final String HIKARI_DS_SOCKET_FACTORY = "hibernate.hikari.dataSource.socketFactory";
+  public static final String HIKARI_DS_CLOUD_SQL_INSTANCE =
+      "hibernate.hikari.dataSource.cloudSqlInstance";
+
   @Provides
   @DefaultHibernateConfigs
   public static ImmutableMap<String, String> providesDefaultDatabaseConfigs() {
@@ -61,6 +68,8 @@ public class PersistenceModule {
     // SessionFactory is created. Setting it to 'none' to turn off the feature.
     properties.put(Environment.HBM2DDL_AUTO, "none");
 
+    // Hibernate converts any date to this timezone when writing to the database.
+    properties.put(Environment.JDBC_TIME_ZONE, "UTC");
     properties.put(
         Environment.PHYSICAL_NAMING_STRATEGY, NomulusNamingStrategy.class.getCanonicalName());
 
@@ -75,24 +84,45 @@ public class PersistenceModule {
   }
 
   @Provides
-  @AppEngineEmf
-  public static EntityManagerFactory providesAppEngineEntityManagerFactory(
+  @Singleton
+  @PartialCloudSqlConfigs
+  public static ImmutableMap<String, String> providesPartialCloudSqlConfigs(
       @Config("cloudSqlJdbcUrl") String jdbcUrl,
-      @Config("cloudSqlUsername") String username,
       @Config("cloudSqlInstanceConnectionName") String instanceConnectionName,
-      KmsKeyring kmsKeyring,
       @DefaultHibernateConfigs ImmutableMap<String, String> defaultConfigs) {
-    String password = kmsKeyring.getCloudSqlPassword();
-
     HashMap<String, String> overrides = Maps.newHashMap(defaultConfigs);
-    // For Java users, the Cloud SQL JDBC Socket Factory can provide authenticated connections.
-    // See https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory for details.
-    overrides.put("socketFactory", "com.google.cloud.sql.postgres.SocketFactory");
-    overrides.put("cloudSqlInstance", instanceConnectionName);
+    overrides.put(Environment.URL, jdbcUrl);
+    overrides.put(HIKARI_DS_SOCKET_FACTORY, "com.google.cloud.sql.postgres.SocketFactory");
+    overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, instanceConnectionName);
+    return ImmutableMap.copyOf(overrides);
+  }
 
-    EntityManagerFactory emf = create(jdbcUrl, username, password, ImmutableMap.copyOf(overrides));
-    Runtime.getRuntime().addShutdownHook(new Thread(emf::close));
-    return emf;
+  @Provides
+  @Singleton
+  @AppEngineJpaTm
+  public static JpaTransactionManager providesAppEngineJpaTm(
+      @Config("cloudSqlUsername") String username,
+      KmsKeyring kmsKeyring,
+      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
+    overrides.put(Environment.USER, username);
+    overrides.put(Environment.PASS, kmsKeyring.getCloudSqlPassword());
+    return new JpaTransactionManagerImpl(create(overrides), clock);
+  }
+
+  @Provides
+  @Singleton
+  @NomulusToolJpaTm
+  public static JpaTransactionManager providesNomulusToolJpaTm(
+      @Config("toolsCloudSqlUsername") String username,
+      KmsKeyring kmsKeyring,
+      @PartialCloudSqlConfigs ImmutableMap<String, String> cloudSqlConfigs,
+      Clock clock) {
+    HashMap<String, String> overrides = Maps.newHashMap(cloudSqlConfigs);
+    overrides.put(Environment.USER, username);
+    overrides.put(Environment.PASS, kmsKeyring.getToolsCloudSqlPassword());
+    return new JpaTransactionManagerImpl(create(overrides), clock);
   }
 
   /** Constructs the {@link EntityManagerFactory} instance. */
@@ -104,29 +134,41 @@ public class PersistenceModule {
     properties.put(Environment.USER, username);
     properties.put(Environment.PASS, password);
 
+    return create(ImmutableMap.copyOf(properties));
+  }
+
+  private static EntityManagerFactory create(Map<String, String> properties) {
     // If there are no annotated classes, we can create the EntityManagerFactory from the generic
     // method.  Otherwise we have to use a more tailored approach.  Note that this adds to the set
     // of annotated classes defined in the configuration, it does not override them.
     EntityManagerFactory emf =
-        Persistence.createEntityManagerFactory(PERSISTENCE_UNIT_NAME, properties);
-
+        Persistence.createEntityManagerFactory(
+            PERSISTENCE_UNIT_NAME, ImmutableMap.copyOf(properties));
     checkState(
         emf != null,
         "Persistence.createEntityManagerFactory() returns a null EntityManagerFactory");
     return emf;
   }
 
-  /** Dagger qualifier for the {@link EntityManagerFactory} used for App Engine application. */
+  /** Dagger qualifier for {@link JpaTransactionManager} used for App Engine application. */
   @Qualifier
   @Documented
-  @Retention(RetentionPolicy.RUNTIME)
-  public @interface AppEngineEmf {}
+  @interface AppEngineJpaTm {}
+
+  /** Dagger qualifier for {@link JpaTransactionManager} used for Nomulus tool. */
+  @Qualifier
+  @Documented
+  @interface NomulusToolJpaTm {}
+
+  /** Dagger qualifier for the partial Cloud SQL configs. */
+  @Qualifier
+  @Documented
+  @interface PartialCloudSqlConfigs {}
 
   /** Dagger qualifier for the default Hibernate configurations. */
   // TODO(shicong): Change annotations in this class to none public or put them in a top level
   //  package
   @Qualifier
   @Documented
-  @Retention(RetentionPolicy.RUNTIME)
   public @interface DefaultHibernateConfigs {}
 }

core/src/main/java/google/registry/persistence/ToStringConverterBase.java

@@ -0,0 +1,27 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+
+/** Abstract JPA converter for objects that are stored by their toString() value. */
+abstract class ToStringConverterBase<T> implements AttributeConverter<T, String> {
+
+  @Override
+  @Nullable
+  public String convertToDatabaseColumn(@Nullable T entity) {
+    return (entity == null) ? null : entity.toString();
+  }
+}

core/src/main/java/google/registry/persistence/UpdateAutoTimestampConverter.java

@@ -25,7 +25,7 @@ import javax.persistence.AttributeConverter;
 import javax.persistence.Converter;
 
 /** JPA converter for storing/retrieving UpdateAutoTimestamp objects. */
-@Converter
+@Converter(autoApply = true)
 public class UpdateAutoTimestampConverter
     implements AttributeConverter<UpdateAutoTimestamp, Timestamp> {
 

core/src/main/java/google/registry/persistence/ZonedDateTimeConverter.java

@@ -0,0 +1,48 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.sql.Timestamp;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import javax.annotation.Nullable;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/**
+ * JPA converter to for storing/retrieving {@link ZonedDateTime} objects.
+ *
+ * <p>Hibernate provides a default converter for {@link ZonedDateTime}, but it converts timestamp to
+ * a non-normalized format, e.g., 2019-09-01T01:01:01Z will be converted to
+ * 2019-09-01T01:01:01Z[UTC]. This converter solves that problem by explicitly calling {@link
+ * ZoneId#normalized()} to normalize the zone id.
+ */
+@Converter(autoApply = true)
+public class ZonedDateTimeConverter implements AttributeConverter<ZonedDateTime, Timestamp> {
+
+  @Override
+  @Nullable
+  public Timestamp convertToDatabaseColumn(@Nullable ZonedDateTime attribute) {
+    return attribute == null ? null : Timestamp.from(attribute.toInstant());
+  }
+
+  @Override
+  @Nullable
+  public ZonedDateTime convertToEntityAttribute(@Nullable Timestamp dbData) {
+    return dbData == null
+        ? null
+        : ZonedDateTime.ofInstant(dbData.toInstant(), ZoneId.of("UTC").normalized());
+  }
+}

core/src/main/java/google/registry/reporting/icann/IcannReportingUploadAction.java

@@ -39,6 +39,7 @@ import google.registry.util.Retrier;
 import google.registry.util.SendEmailService;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import javax.inject.Inject;
 import javax.mail.internet.InternetAddress;
@@ -102,7 +103,7 @@ public final class IcannReportingUploadAction implements Runnable {
                   final byte[] payload = readBytesFromGcs(gcsFilename);
                   return icannReporter.send(payload, reportFilename);
                 },
-                IOException.class);
+                IcannReportingUploadAction::isUploadFailureRetryable);
       } catch (RuntimeException e) {
         logger.atWarning().withCause(e).log("Upload to %s failed.", gcsFilename);
       }
@@ -115,6 +116,21 @@ public final class IcannReportingUploadAction implements Runnable {
         String.format("OK, attempted uploading %d reports", manifestedFiles.size()));
   }
 
+  /** Don't retry when reports are already uploaded or can't be uploaded. */
+  private static final String ICANN_UPLOAD_PERMANENT_ERROR_MESSAGE =
+      "A report for that month already exists, the cut-off date already passed.";
+
+  /** Don't retry when the IP address isn't whitelisted, as retries go through the same IP. */
+  private static final Pattern ICANN_UPLOAD_WHITELIST_ERROR =
+      Pattern.compile("Your IP address .+ is not allowed to connect");
+
+  /** Predicate to retry uploads on IOException, so long as they aren't non-retryable errors. */
+  private static boolean isUploadFailureRetryable(Throwable e) {
+    return (e instanceof IOException)
+        && !e.getMessage().contains(ICANN_UPLOAD_PERMANENT_ERROR_MESSAGE)
+        && !ICANN_UPLOAD_WHITELIST_ERROR.matcher(e.getMessage()).matches();
+  }
+
   private void emailUploadResults(ImmutableMap<String, Boolean> reportSummary) {
     String subject = String.format(
         "ICANN Monthly report upload summary: %d/%d succeeded",

core/src/main/java/google/registry/request/auth/AuthenticatedRegistrarAccessor.java

@@ -347,7 +347,7 @@ public class AuthenticatedRegistrarAccessor {
 
   /** Exception thrown when the current user doesn't have access to the requested Registrar. */
   public static class RegistrarAccessDeniedException extends Exception {
-    RegistrarAccessDeniedException(String message) {
+    public RegistrarAccessDeniedException(String message) {
       super(message);
     }
   }

core/src/main/java/google/registry/schema/domain/RegistryLock.java

@@ -21,12 +21,10 @@ import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import google.registry.model.Buildable;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.ImmutableObject;
-import google.registry.persistence.CreateAutoTimestampConverter;
 import google.registry.util.DateTimeUtils;
 import java.time.ZonedDateTime;
 import java.util.Optional;
 import javax.persistence.Column;
-import javax.persistence.Convert;
 import javax.persistence.Entity;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
@@ -67,7 +65,8 @@ import org.joda.time.DateTime;
           name = "idx_registry_lock_repo_id_revision_id",
           columnList = "repoId, revisionId",
           unique = true),
-      @Index(name = "idx_registry_lock_verification_code", columnList = "verificationCode")
+      @Index(name = "idx_registry_lock_verification_code", columnList = "verificationCode"),
+      @Index(name = "idx_registry_lock_registrar_id", columnList = "registrarId")
     })
 public final class RegistryLock extends ImmutableObject implements Buildable {
 
@@ -109,7 +108,6 @@ public final class RegistryLock extends ImmutableObject implements Buildable {
 
   /** Creation timestamp is when the lock/unlock is first requested. */
   @Column(nullable = false)
-  @Convert(converter = CreateAutoTimestampConverter.class)
   private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
 
   /**
@@ -178,12 +176,13 @@ public final class RegistryLock extends ImmutableObject implements Buildable {
     this.completionTimestamp = toZonedDateTime(dateTime);
   }
 
+  public boolean isVerified() {
+    return completionTimestamp != null;
+  }
+
   @Override
   public Builder asBuilder() {
-    RegistryLock clone = clone(this);
-    // Revision ID should be different for every object
-    clone.revisionId = null;
-    return new Builder(clone);
+    return new Builder(clone(this));
   }
 
   /** Builder for {@link google.registry.schema.domain.RegistryLock}. */

core/src/main/java/google/registry/schema/tld/PremiumList.java

@@ -14,10 +14,14 @@
 
 package google.registry.schema.tld;
 
+import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.base.Preconditions.checkState;
+import static com.google.common.hash.Funnels.stringFunnel;
 
+import com.google.common.collect.ImmutableMap;
+import com.google.common.hash.BloomFilter;
+import google.registry.model.CreateAutoTimestamp;
 import java.math.BigDecimal;
-import java.time.ZonedDateTime;
 import java.util.Map;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
@@ -26,10 +30,12 @@ import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
+import javax.persistence.Index;
 import javax.persistence.JoinColumn;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
 import org.joda.money.CurrencyUnit;
+import org.joda.time.DateTime;
 
 /**
  * A list of premium prices for domain names.
@@ -40,47 +46,55 @@ import org.joda.money.CurrencyUnit;
  * This is fine though, because we only use the list with the highest revisionId.
  */
 @Entity
-@Table(name = "PremiumList")
+@Table(indexes = {@Index(columnList = "name", name = "premiumlist_name_idx")})
 public class PremiumList {
 
+  @Column(nullable = false)
+  private String name;
+
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Column(name = "revision_id")
+  @Column(nullable = false)
   private Long revisionId;
 
-  @Column(name = "creation_timestamp", nullable = false)
-  private ZonedDateTime creationTimestamp;
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
 
-  @Column(name = "currency", nullable = false)
+  @Column(nullable = false)
   private CurrencyUnit currency;
 
   @ElementCollection
   @CollectionTable(
       name = "PremiumEntry",
-      joinColumns = @JoinColumn(name = "revision_id", referencedColumnName = "revision_id"))
-  @MapKeyColumn(name = "domain_label")
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel")
   @Column(name = "price", nullable = false)
   private Map<String, BigDecimal> labelsToPrices;
 
-  private PremiumList(
-      ZonedDateTime creationTimestamp,
-      CurrencyUnit currency,
-      Map<String, BigDecimal> labelsToPrices) {
-    this.creationTimestamp = creationTimestamp;
+  @Column(nullable = false)
+  private BloomFilter<String> bloomFilter;
+
+  private PremiumList(String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    this.name = name;
     this.currency = currency;
     this.labelsToPrices = labelsToPrices;
+    // ASCII is used for the charset because all premium list domain labels are stored punycoded.
+    this.bloomFilter = BloomFilter.create(stringFunnel(US_ASCII), labelsToPrices.size());
+    labelsToPrices.keySet().forEach(this.bloomFilter::put);
   }
 
   // Hibernate requires this default constructor.
   private PremiumList() {}
 
-  // TODO(mcilwain): Change creationTimestamp to Joda DateTime.
   /** Constructs a {@link PremiumList} object. */
   public static PremiumList create(
-      ZonedDateTime creationTimestamp,
-      CurrencyUnit currency,
-      Map<String, BigDecimal> labelsToPrices) {
-    return new PremiumList(creationTimestamp, currency, labelsToPrices);
+      String name, CurrencyUnit currency, Map<String, BigDecimal> labelsToPrices) {
+    return new PremiumList(name, currency, labelsToPrices);
+  }
+
+  /** Returns the name of the premium list, which is usually also a TLD string. */
+  public String getName() {
+    return name;
   }
 
   /** Returns the ID of this revision, or throws if null. */
@@ -91,12 +105,23 @@ public class PremiumList {
   }
 
   /** Returns the creation time of this revision of the premium list. */
-  public ZonedDateTime getCreationTimestamp() {
-    return creationTimestamp;
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
   }
 
   /** Returns a {@link Map} of domain labels to prices. */
-  public Map<String, BigDecimal> getLabelsToPrices() {
-    return labelsToPrices;
+  public ImmutableMap<String, BigDecimal> getLabelsToPrices() {
+    return ImmutableMap.copyOf(labelsToPrices);
+  }
+
+  /**
+   * Returns a Bloom filter to determine whether a label might be premium, or is definitely not.
+   *
+   * <p>If the domain label might be premium, then the next step is to check for the existence of a
+   * corresponding row in the PremiumListEntry table. Otherwise, we know for sure it's not premium,
+   * and no DB load is required.
+   */
+  public BloomFilter<String> getBloomFilter() {
+    return bloomFilter;
   }
 }

core/src/main/java/google/registry/schema/tld/PremiumListDao.java

@@ -0,0 +1,56 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+/** Data access object class for {@link PremiumList}. */
+public class PremiumListDao {
+
+  /** Persist a new premium list to Cloud SQL. */
+  public static void saveNew(PremiumList premiumList) {
+    jpaTm()
+        .transact(
+            () -> {
+              checkArgument(
+                  !checkExists(premiumList.getName()),
+                  "A premium list of this name already exists: %s.",
+                  premiumList.getName());
+              jpaTm().getEntityManager().persist(premiumList);
+            });
+  }
+
+  /**
+   * Returns whether the premium list of the given name exists.
+   *
+   * <p>This means that at least one premium list revision must exist for the given name.
+   */
+  public static boolean checkExists(String premiumListName) {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                        .getEntityManager()
+                        .createQuery("SELECT 1 FROM PremiumList WHERE name = :name", Integer.class)
+                        .setParameter("name", premiumListName)
+                        .setMaxResults(1)
+                        .getResultList()
+                        .size()
+                    > 0);
+  }
+
+  private PremiumListDao() {}
+}

core/src/main/java/google/registry/schema/tmch/ClaimsList.java

@@ -15,7 +15,11 @@
 package google.registry.schema.tmch;
 
 import static com.google.common.base.Preconditions.checkState;
+import static google.registry.util.DateTimeUtils.toJodaDateTime;
+import static google.registry.util.DateTimeUtils.toZonedDateTime;
 
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
 import java.time.ZonedDateTime;
 import java.util.Map;
 import java.util.Optional;
@@ -29,6 +33,7 @@ import javax.persistence.Id;
 import javax.persistence.JoinColumn;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
+import org.joda.time.DateTime;
 
 /**
  * A list of TMCH claims labels and their associated claims keys.
@@ -40,26 +45,29 @@ import javax.persistence.Table;
  * highest {@link #revisionId}.
  */
 @Entity
-@Table(name = "ClaimsList")
-public class ClaimsList {
+@Table
+public class ClaimsList extends ImmutableObject {
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
-  @Column(name = "revision_id")
+  @Column
   private Long revisionId;
 
-  @Column(name = "creation_timestamp", nullable = false)
-  private ZonedDateTime creationTimestamp;
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  @Column(nullable = false)
+  private ZonedDateTime tmdbGenerationTime;
 
   @ElementCollection
   @CollectionTable(
       name = "ClaimsEntry",
-      joinColumns = @JoinColumn(name = "revision_id", referencedColumnName = "revision_id"))
-  @MapKeyColumn(name = "domain_label", nullable = false)
-  @Column(name = "claim_key", nullable = false)
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel", nullable = false)
+  @Column(name = "claimKey", nullable = false)
   private Map<String, String> labelsToKeys;
 
-  private ClaimsList(ZonedDateTime creationTimestamp, Map<String, String> labelsToKeys) {
-    this.creationTimestamp = creationTimestamp;
+  private ClaimsList(ZonedDateTime tmdbGenerationTime, Map<String, String> labelsToKeys) {
+    this.tmdbGenerationTime = tmdbGenerationTime;
     this.labelsToKeys = labelsToKeys;
   }
 
@@ -67,9 +75,8 @@ public class ClaimsList {
   private ClaimsList() {}
 
   /** Constructs a {@link ClaimsList} object. */
-  public static ClaimsList create(
-      ZonedDateTime creationTimestamp, Map<String, String> labelsToKeys) {
-    return new ClaimsList(creationTimestamp, labelsToKeys);
+  public static ClaimsList create(DateTime creationTimestamp, Map<String, String> labelsToKeys) {
+    return new ClaimsList(toZonedDateTime(creationTimestamp), labelsToKeys);
   }
 
   /** Returns the revision id of this claims list, or throws exception if it is null. */
@@ -79,9 +86,14 @@ public class ClaimsList {
     return revisionId;
   }
 
+  /** Returns the TMDB generation time of this claims list. */
+  public DateTime getTmdbGenerationTime() {
+    return toJodaDateTime(tmdbGenerationTime);
+  }
+
   /** Returns the creation time of this claims list. */
-  public ZonedDateTime getCreationTimestamp() {
-    return creationTimestamp;
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
   }
 
   /** Returns an {@link Map} mapping domain label to its lookup key. */

core/src/main/java/google/registry/tmch/ClaimsListParser.java

@@ -18,7 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
-import google.registry.model.tmch.ClaimsListShard;
+import google.registry.schema.tmch.ClaimsList;
 import java.util.List;
 import org.joda.time.DateTime;
 
@@ -34,11 +34,11 @@ import org.joda.time.DateTime;
 public class ClaimsListParser {
 
   /**
-   * Converts the lines from the DNL CSV file into a {@link ClaimsListShard} object.
+   * Converts the lines from the DNL CSV file into a {@link ClaimsList} object.
    *
    * <p>Please note that this does <b>not</b> insert the object into Datastore.
    */
-  public static ClaimsListShard parse(List<String> lines) {
+  public static ClaimsList parse(List<String> lines) {
     ImmutableMap.Builder<String, String> builder = new ImmutableMap.Builder<>();
 
     // First line: <version>,<DNL List creation datetime>
@@ -74,6 +74,6 @@ public class ClaimsListParser {
       builder.put(label, lookupKey);
     }
 
-    return ClaimsListShard.create(creationTime, builder.build());
+    return ClaimsList.create(creationTime, builder.build());
   }
 }

core/src/main/java/google/registry/tmch/TmchDnlAction.java

@@ -18,9 +18,11 @@ import static google.registry.request.Action.Method.POST;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.keyring.api.KeyModule.Key;
+import google.registry.model.tmch.ClaimsListDao;
 import google.registry.model.tmch.ClaimsListShard;
 import google.registry.request.Action;
 import google.registry.request.auth.Auth;
+import google.registry.schema.tmch.ClaimsList;
 import java.io.IOException;
 import java.security.SignatureException;
 import java.util.List;
@@ -54,10 +56,14 @@ public final class TmchDnlAction implements Runnable {
     } catch (SignatureException | IOException | PGPException e) {
       throw new RuntimeException(e);
     }
-    ClaimsListShard claims = ClaimsListParser.parse(lines);
-    claims.save();
+    ClaimsList claims = ClaimsListParser.parse(lines);
+    ClaimsListShard claimsListShard =
+        ClaimsListShard.create(claims.getTmdbGenerationTime(), claims.getLabelsToKeys());
+    claimsListShard.save();
     logger.atInfo().log(
         "Inserted %,d claims into Datastore, created at %s",
-        claims.size(), claims.getCreationTime());
+        claimsListShard.size(), claimsListShard.getCreationTime());
+
+    ClaimsListDao.trySave(claims);
   }
 }

core/src/main/java/google/registry/tools/CommandWithCloudSql.java

@@ -0,0 +1,23 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+/**
+ * Marker interface for commands that use Cloud Sql.
+ *
+ * <p>Just implementing this is sufficient to use Cloud Sql; {@link RegistryTool} will install it as
+ * needed.
+ */
+interface CommandWithCloudSql extends CommandWithRemoteApi {}

core/src/main/java/google/registry/tools/CreateDomainCommand.java

@@ -72,7 +72,7 @@ final class CreateDomainCommand extends CreateOrUpdateDomainCommand
             !force || forcePremiums,
             "Forced creates on premium domain(s) require --force_premiums");
         Money createCost = prices.getCreateCost();
-        currency = createCost.getCurrencyUnit().getCurrencyCode();
+        currency = createCost.getCurrencyUnit().getCode();
         cost = createCost.multipliedBy(period).getAmount().toString();
         System.out.printf(
             "NOTE: %s is premium at %s per year; sending total cost for %d year(s) of %s %s.\n",

core/src/main/java/google/registry/tools/CreateOrUpdatePremiumListCommand.java

@@ -16,6 +16,7 @@ package google.registry.tools;
 
 import static com.google.common.base.Strings.isNullOrEmpty;
 import static google.registry.security.JsonHttp.JSON_SAFETY_PREFIX;
+import static google.registry.tools.server.CreateOrUpdatePremiumListAction.ALSO_CLOUD_SQL_PARAM;
 import static google.registry.tools.server.CreateOrUpdatePremiumListAction.INPUT_PARAM;
 import static google.registry.tools.server.CreateOrUpdatePremiumListAction.NAME_PARAM;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
@@ -57,6 +58,12 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
       required = true)
   Path inputFile;
 
+  @Parameter(
+      names = {"--also_cloud_sql"},
+      description =
+          "Persist premium list to Cloud SQL in addition to Datastore; defaults to false.")
+  boolean alsoCloudSql;
+
   protected AppEngineConnection connection;
   protected int inputLineCount;
 
@@ -67,7 +74,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
 
   abstract String getCommandPath();
 
-  ImmutableMap<String, ?> getParameterMap() {
+  ImmutableMap<String, String> getParameterMap() {
     return ImmutableMap.of();
   }
 
@@ -88,14 +95,15 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
 
   @Override
   public String execute() throws Exception {
-    ImmutableMap.Builder<String, Object> params = new ImmutableMap.Builder<>();
+    ImmutableMap.Builder<String, String> params = new ImmutableMap.Builder<>();
     params.put(NAME_PARAM, name);
+    params.put(ALSO_CLOUD_SQL_PARAM, Boolean.toString(alsoCloudSql));
     String inputFileContents = new String(Files.readAllBytes(inputFile), UTF_8);
     String requestBody =
         Joiner.on('&').withKeyValueSeparator("=").join(
             ImmutableMap.of(INPUT_PARAM, URLEncoder.encode(inputFileContents, UTF_8.toString())));
 
-    ImmutableMap<String, ?> extraParams = getParameterMap();
+    ImmutableMap<String, String> extraParams = getParameterMap();
     if (extraParams != null) {
       params.putAll(extraParams);
     }
@@ -110,7 +118,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
 
   // TODO(user): refactor this behavior into a better general-purpose
   // response validation that can be re-used across the new client/server commands.
-  String extractServerResponse(String response) {
+  private String extractServerResponse(String response) {
     Map<String, Object> responseMap = toMap(JSONValue.parse(stripJsonPrefix(response)));
 
     // TODO(user): consider using jart's FormField Framework.
@@ -127,7 +135,7 @@ abstract class CreateOrUpdatePremiumListCommand extends ConfirmingCommand
   }
 
   // TODO(user): figure out better place to put this method to make it re-usable
-  static String stripJsonPrefix(String json) {
+  private static String stripJsonPrefix(String json) {
     Verify.verify(json.startsWith(JSON_SAFETY_PREFIX));
     return json.substring(JSON_SAFETY_PREFIX.length());
   }

core/src/main/java/google/registry/tools/CreatePremiumListCommand.java

@@ -36,12 +36,11 @@ public class CreatePremiumListCommand extends CreateOrUpdatePremiumListCommand {
   }
 
   @Override
-  ImmutableMap<String, ?> getParameterMap() {
+  ImmutableMap<String, String> getParameterMap() {
     if (override) {
-      return ImmutableMap.of("override", override);
+      return ImmutableMap.of("override", "true");
     } else {
       return ImmutableMap.of();
     }
   }
-
 }

core/src/main/java/google/registry/tools/GenerateSqlSchemaCommand.java

@@ -19,31 +19,23 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.ImmutableSet;
-import google.registry.model.domain.DesignatedContact;
-import google.registry.model.domain.DomainBase;
-import google.registry.model.domain.GracePeriod;
-import google.registry.model.domain.secdns.DelegationSignerData;
-import google.registry.model.eppcommon.Trid;
-import google.registry.model.transfer.BaseTransferObject;
-import google.registry.model.transfer.TransferData;
 import google.registry.persistence.NomulusNamingStrategy;
 import google.registry.persistence.NomulusPostgreSQLDialect;
-import google.registry.schema.domain.RegistryLock;
-import google.registry.schema.tld.PremiumList;
-import google.registry.schema.tmch.ClaimsList;
+import google.registry.persistence.PersistenceModule;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.util.EnumSet;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import org.hibernate.boot.MetadataSources;
 import org.hibernate.boot.registry.StandardServiceRegistryBuilder;
 import org.hibernate.cfg.Environment;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
 import org.hibernate.tool.hbm2ddl.SchemaExport;
 import org.hibernate.tool.schema.TargetType;
-import org.joda.time.Period;
 import org.testcontainers.containers.PostgreSQLContainer;
 
 /**
@@ -56,22 +48,6 @@ import org.testcontainers.containers.PostgreSQLContainer;
 @Parameters(separators = " =", commandDescription = "Generate PostgreSQL schema.")
 public class GenerateSqlSchemaCommand implements Command {
 
-  // TODO(mmuller): These should be read from persistence.xml so we don't need to maintain two
-  //                separate lists of all SQL table classes.
-  private static final ImmutableSet<Class> SQL_TABLE_CLASSES =
-      ImmutableSet.of(
-          BaseTransferObject.class,
-          ClaimsList.class,
-          DelegationSignerData.class,
-          DesignatedContact.class,
-          DomainBase.class,
-          GracePeriod.class,
-          Period.class,
-          PremiumList.class,
-          RegistryLock.class,
-          TransferData.class,
-          Trid.class);
-
   @VisibleForTesting
   public static final String DB_OPTIONS_CLASH =
       "Database host and port may not be specified along with the option to start a "
@@ -158,7 +134,9 @@ public class GenerateSqlSchemaCommand implements Command {
 
       MetadataSources metadata =
           new MetadataSources(new StandardServiceRegistryBuilder().applySettings(settings).build());
-      SQL_TABLE_CLASSES.forEach(metadata::addAnnotatedClass);
+
+      addAnnotatedClasses(metadata, settings);
+
       SchemaExport schemaExport = new SchemaExport();
       schemaExport.setHaltOnError(true);
       schemaExport.setFormat(true);
@@ -197,4 +175,30 @@ public class GenerateSqlSchemaCommand implements Command {
       }
     }
   }
+
+  private void addAnnotatedClasses(MetadataSources metadata, Map<String, String> settings) {
+    ParsedPersistenceXmlDescriptor descriptor =
+        PersistenceXmlParser.locatePersistenceUnits(settings).stream()
+            .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+            .findFirst()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format(
+                            "Could not find persistence unit with name %s",
+                            PersistenceModule.PERSISTENCE_UNIT_NAME)));
+
+    List<String> classNames = descriptor.getManagedClassNames();
+    for (String className : classNames) {
+      try {
+        Class<?> clazz = Class.forName(className);
+        metadata.addAnnotatedClass(clazz);
+      } catch (ClassNotFoundException e) {
+        throw new IllegalArgumentException(
+            String.format(
+                "Could not load class with name %s present in persistence.xml", className),
+            e);
+      }
+    }
+  }
 }

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -31,6 +31,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
 import google.registry.config.RegistryConfig;
 import google.registry.model.ofy.ObjectifyService;
+import google.registry.model.transaction.TransactionManagerFactory;
 import google.registry.tools.AuthModule.LoginRequiredException;
 import google.registry.tools.params.ParameterFactory;
 import java.io.ByteArrayInputStream;
@@ -210,6 +211,8 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
     }
 
     // CommandWithRemoteApis need to have the remote api installed to work.
+    // CommandWithCloudSql extends CommandWithRemoteApi so the command will also get the remote
+    // api installed. This is because the DB password is stored in Datastore.
     if (command instanceof CommandWithRemoteApi) {
       if (installer == null) {
         installer = new RemoteApiInstaller();
@@ -233,6 +236,10 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
       ofy().clearSessionCache();
     }
 
+    if (command instanceof CommandWithCloudSql) {
+      TransactionManagerFactory.initForTool();
+    }
+
     command.run();
   }
 

core/src/main/java/google/registry/tools/UploadClaimsListCommand.java

@@ -21,7 +21,9 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Joiner;
 import com.google.common.io.Files;
+import google.registry.model.tmch.ClaimsListDao;
 import google.registry.model.tmch.ClaimsListShard;
+import google.registry.schema.tmch.ClaimsList;
 import google.registry.tmch.ClaimsListParser;
 import java.io.File;
 import java.io.IOException;
@@ -30,14 +32,19 @@ import java.util.List;
 
 /** A command to upload a {@link ClaimsListShard}. */
 @Parameters(separators = " =", commandDescription = "Manually upload a new claims list file")
-final class UploadClaimsListCommand extends ConfirmingCommand implements CommandWithRemoteApi {
+final class UploadClaimsListCommand extends ConfirmingCommand implements CommandWithCloudSql {
 
   @Parameter(description = "Claims list filename")
   private List<String> mainParameters = new ArrayList<>();
 
+  @Parameter(
+      names = {"--also_cloud_sql"},
+      description = "Persist claims list to Cloud SQL in addition to Datastore; defaults to false.")
+  boolean alsoCloudSql;
+
   private String claimsListFilename;
 
-  private ClaimsListShard claimsList;
+  private ClaimsList claimsList;
 
   @Override
   protected void init() throws IOException {
@@ -56,7 +63,10 @@ final class UploadClaimsListCommand extends ConfirmingCommand implements Command
 
   @Override
   public String execute() {
-    claimsList.save();
+    ClaimsListShard.create(claimsList.getTmdbGenerationTime(), claimsList.getLabelsToKeys()).save();
+    if (alsoCloudSql) {
+      ClaimsListDao.trySave(claimsList);
+    }
     return String.format("Successfully uploaded claims list %s", claimsListFilename);
   }
 }

core/src/main/java/google/registry/tools/server/CreateOrUpdatePremiumListAction.java

@@ -14,17 +14,28 @@
 
 package google.registry.tools.server;
 
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.flogger.LazyArgs.lazy;
 
+import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedSet;
+import com.google.common.collect.Iterables;
+import com.google.common.collect.Maps;
 import com.google.common.flogger.FluentLogger;
+import google.registry.model.registry.label.PremiumList;
+import google.registry.model.registry.label.PremiumList.PremiumListEntry;
 import google.registry.request.JsonResponse;
 import google.registry.request.Parameter;
+import java.math.BigDecimal;
+import java.util.List;
+import java.util.Map;
 import javax.inject.Inject;
+import org.joda.money.CurrencyUnit;
 
-/**
- * Abstract base class for actions that update premium lists.
- */
+/** Abstract base class for actions that update premium lists. */
 public abstract class CreateOrUpdatePremiumListAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -33,24 +44,70 @@ public abstract class CreateOrUpdatePremiumListAction implements Runnable {
 
   public static final String NAME_PARAM = "name";
   public static final String INPUT_PARAM = "inputData";
+  public static final String ALSO_CLOUD_SQL_PARAM = "alsoCloudSql";
 
   @Inject JsonResponse response;
-  @Inject @Parameter("premiumListName") String name;
-  @Inject @Parameter(INPUT_PARAM) String inputData;
+
+  @Inject
+  @Parameter("premiumListName")
+  String name;
+
+  @Inject
+  @Parameter(INPUT_PARAM)
+  String inputData;
+
+  @Inject
+  @Parameter(ALSO_CLOUD_SQL_PARAM)
+  boolean alsoCloudSql;
 
   @Override
   public void run() {
     try {
-      savePremiumList();
+      saveToDatastore();
     } catch (IllegalArgumentException e) {
       logger.atInfo().withCause(e).log(
           "Usage error in attempting to save premium list from nomulus tool command");
       response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+      return;
     } catch (Exception e) {
       logger.atSevere().withCause(e).log(
-          "Unexpected error saving premium list from nomulus tool command");
+          "Unexpected error saving premium list to Datastore from nomulus tool command");
       response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+      return;
     }
+
+    if (alsoCloudSql) {
+      try {
+        saveToCloudSql();
+      } catch (Throwable e) {
+        logger.atSevere().withCause(e).log(
+            "Unexpected error saving premium list to Cloud SQL from nomulus tool command");
+        response.setPayload(ImmutableMap.of("error", e.toString(), "status", "error"));
+        return;
+      }
+    }
+  }
+
+  google.registry.schema.tld.PremiumList parseInputToPremiumList() {
+    List<String> inputDataPreProcessed =
+        Splitter.on('\n').omitEmptyStrings().splitToList(inputData);
+
+    ImmutableMap<String, PremiumListEntry> prices =
+        new PremiumList.Builder().setName(name).build().parse(inputDataPreProcessed);
+    ImmutableSet<CurrencyUnit> currencies =
+        prices.values().stream()
+            .map(e -> e.getValue().getCurrencyUnit())
+            .distinct()
+            .collect(toImmutableSet());
+    checkArgument(
+        currencies.size() == 1,
+        "The Cloud SQL schema requires exactly one currency, but got: %s",
+        ImmutableSortedSet.copyOf(currencies));
+    CurrencyUnit currency = Iterables.getOnlyElement(currencies);
+
+    Map<String, BigDecimal> priceAmounts =
+        Maps.transformValues(prices, ple -> ple.getValue().getAmount());
+    return google.registry.schema.tld.PremiumList.create(name, currency, priceAmounts);
   }
 
   /** Logs the premium list data at INFO, truncated if too long. */
@@ -64,6 +121,9 @@ public abstract class CreateOrUpdatePremiumListAction implements Runnable {
                     : (inputData.substring(0, MAX_LOGGING_PREMIUM_LIST_LENGTH) + "<truncated>")));
   }
 
-  /** Creates a new premium list or updates an existing one. */
-  protected abstract void savePremiumList();
+  /** Saves the premium list to Datastore. */
+  protected abstract void saveToDatastore();
+
+  /** Saves the premium list to Cloud SQL. */
+  protected abstract void saveToCloudSql();
 }

core/src/main/java/google/registry/tools/server/CreatePremiumListAction.java

@@ -27,6 +27,7 @@ import google.registry.model.registry.label.PremiumList;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
+import google.registry.schema.tld.PremiumListDao;
 import java.util.List;
 import javax.inject.Inject;
 
@@ -50,7 +51,7 @@ public class CreatePremiumListAction extends CreateOrUpdatePremiumListAction {
   @Inject CreatePremiumListAction() {}
 
   @Override
-  protected void savePremiumList() {
+  protected void saveToDatastore() {
     checkArgument(
         !doesPremiumListExist(name), "A premium list of this name already exists: %s.", name);
     if (!override) {
@@ -71,4 +72,22 @@ public class CreatePremiumListAction extends CreateOrUpdatePremiumListAction {
     logger.atInfo().log(message);
     response.setPayload(ImmutableMap.of("status", "success", "message", message));
   }
+
+  @Override
+  protected void saveToCloudSql() {
+    if (!override) {
+      assertTldExists(name);
+    }
+    logger.atInfo().log("Saving premium list to Cloud SQL for TLD %s", name);
+    // TODO(mcilwain): Call logInputData() here once Datastore persistence is removed.
+
+    google.registry.schema.tld.PremiumList premiumList = parseInputToPremiumList();
+    PremiumListDao.saveNew(premiumList);
+
+    String message =
+        String.format(
+            "Saved premium list %s with %d entries", name, premiumList.getLabelsToPrices().size());
+    logger.atInfo().log(message);
+    // TODO(mcilwain): Call response.setPayload(...) here once Datastore persistence is removed.
+  }
 }

core/src/main/java/google/registry/tools/server/ToolsServerModule.java

@@ -60,6 +60,12 @@ public class ToolsServerModule {
     return extractRequiredParameter(req, CreatePremiumListAction.INPUT_PARAM);
   }
 
+  @Provides
+  @Parameter("alsoCloudSql")
+  static boolean provideAlsoCloudSql(HttpServletRequest req) {
+    return extractBooleanParameter(req, CreatePremiumListAction.ALSO_CLOUD_SQL_PARAM);
+  }
+
   @Provides
   @Parameter("premiumListName")
   static String provideName(HttpServletRequest req) {

core/src/main/java/google/registry/tools/server/UpdatePremiumListAction.java

@@ -46,7 +46,7 @@ public class UpdatePremiumListAction extends CreateOrUpdatePremiumListAction {
   @Inject UpdatePremiumListAction() {}
 
   @Override
-  protected void savePremiumList() {
+  protected void saveToDatastore() {
     Optional<PremiumList> existingPremiumList = PremiumList.getUncached(name);
     checkArgument(
         existingPremiumList.isPresent(),
@@ -67,4 +67,11 @@ public class UpdatePremiumListAction extends CreateOrUpdatePremiumListAction {
     logger.atInfo().log(message);
     response.setPayload(ImmutableMap.of("status", "success", "message", message));
   }
+
+  // TODO(mcilwain): Implement this in a subsequent PR.
+  @Override
+  protected void saveToCloudSql() {
+    throw new UnsupportedOperationException(
+        "Updating of premium lists in Cloud SQL is not supported yet");
+  }
 }

core/src/main/java/google/registry/ui/server/RegistrarFormFields.java

@@ -21,7 +21,9 @@ import static google.registry.util.DomainNameUtils.canonicalizeDomainName;
 
 import com.google.common.base.Ascii;
 import com.google.common.base.Splitter;
+import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.net.InternetDomainName;
 import com.google.re2j.Pattern;
 import google.registry.model.registrar.Registrar;
@@ -194,12 +196,10 @@ public final class RegistrarFormFields {
           FormField.named("visibleInDomainWhoisAsAbuse", Boolean.class).build();
 
   public static final FormField<String, String> CONTACT_PHONE_NUMBER_FIELD =
-      FormFields.PHONE_NUMBER.asBuilder()
-          .build();
+      FormFields.PHONE_NUMBER.asBuilder().build();
 
   public static final FormField<String, String> CONTACT_FAX_NUMBER_FIELD =
-      FormFields.PHONE_NUMBER.asBuilderNamed("faxNumber")
-          .build();
+      FormFields.PHONE_NUMBER.asBuilderNamed("faxNumber").build();
 
   public static final FormField<String, String> CONTACT_GAE_USER_ID_FIELD =
       FormFields.NAME.asBuilderNamed("gaeUserId").build();
@@ -217,11 +217,8 @@ public final class RegistrarFormFields {
           .asSet(Splitter.on(',').omitEmptyStrings().trimResults())
           .build();
 
-  public static final FormField<List<Map<String, ?>>, List<RegistrarContact.Builder>>
-      CONTACTS_FIELD = FormField.mapNamed("contacts")
-          .transform(RegistrarContact.Builder.class, RegistrarFormFields::toRegistrarContactBuilder)
-          .asList()
-          .build();
+  public static final FormField<List<Map<String, ?>>, List<Map<String, ?>>> CONTACTS_AS_MAPS =
+      FormField.mapNamed("contacts").asList().build();
 
   public static final FormField<List<String>, List<String>> I18N_STREET_FIELD =
       FormFields.XS_NORMALIZED_STRING.asBuilderNamed("street")
@@ -344,33 +341,60 @@ public final class RegistrarFormFields {
     }
   }
 
-  private static @Nullable RegistrarContact.Builder toRegistrarContactBuilder(
-      @Nullable Map<String, ?> args) {
+  public static ImmutableList<RegistrarContact.Builder> getRegistrarContactBuilders(
+      ImmutableSet<RegistrarContact> existingContacts, @Nullable Map<String, ?> args) {
     if (args == null) {
-      return null;
+      return ImmutableList.of();
     }
-    RegistrarContact.Builder builder = new RegistrarContact.Builder();
-    CONTACT_NAME_FIELD.extractUntyped(args).ifPresent(builder::setName);
-    CONTACT_EMAIL_ADDRESS_FIELD.extractUntyped(args).ifPresent(builder::setEmailAddress);
-    CONTACT_VISIBLE_IN_WHOIS_AS_ADMIN_FIELD
-        .extractUntyped(args)
-        .ifPresent(builder::setVisibleInWhoisAsAdmin);
-    CONTACT_VISIBLE_IN_WHOIS_AS_TECH_FIELD
-        .extractUntyped(args)
-        .ifPresent(builder::setVisibleInWhoisAsTech);
-    PHONE_AND_EMAIL_VISIBLE_IN_DOMAIN_WHOIS_AS_ABUSE_FIELD
-        .extractUntyped(args)
-        .ifPresent(builder::setVisibleInDomainWhoisAsAbuse);
-    CONTACT_PHONE_NUMBER_FIELD.extractUntyped(args).ifPresent(builder::setPhoneNumber);
-    CONTACT_FAX_NUMBER_FIELD.extractUntyped(args).ifPresent(builder::setFaxNumber);
-    CONTACT_TYPES.extractUntyped(args).ifPresent(builder::setTypes);
-    CONTACT_GAE_USER_ID_FIELD.extractUntyped(args).ifPresent(builder::setGaeUserId);
-    CONTACT_ALLOWED_TO_SET_REGISTRY_LOCK_PASSWORD
-        .extractUntyped(args)
-        .ifPresent(builder::setAllowedToSetRegistryLockPassword);
+    Optional<List<Map<String, ?>>> contactsAsMaps = CONTACTS_AS_MAPS.extractUntyped(args);
+    if (!contactsAsMaps.isPresent()) {
+      return ImmutableList.of();
+    }
+    ImmutableList.Builder<RegistrarContact.Builder> result = new ImmutableList.Builder<>();
+    for (Map<String, ?> contactAsMap : contactsAsMaps.get()) {
+      String emailAddress =
+          CONTACT_EMAIL_ADDRESS_FIELD
+              .extractUntyped(contactAsMap)
+              .orElseThrow(
+                  () -> new IllegalArgumentException("Contacts from UI must have email addresses"));
+      // Start with a new builder if the contact didn't previously exist
+      RegistrarContact.Builder contactBuilder =
+          existingContacts.stream()
+              .filter(rc -> rc.getEmailAddress().equals(emailAddress))
+              .findFirst()
+              .map(RegistrarContact::asBuilder)
+              .orElse(new RegistrarContact.Builder());
+      applyRegistrarContactArgs(contactBuilder, contactAsMap);
+      result.add(contactBuilder);
+    }
+    return result.build();
+  }
+
+  private static void applyRegistrarContactArgs(
+      RegistrarContact.Builder builder, Map<String, ?> args) {
+    builder.setName(CONTACT_NAME_FIELD.extractUntyped(args).orElse(null));
+    builder.setEmailAddress(CONTACT_EMAIL_ADDRESS_FIELD.extractUntyped(args).orElse(null));
+    builder.setVisibleInWhoisAsAdmin(
+        CONTACT_VISIBLE_IN_WHOIS_AS_ADMIN_FIELD.extractUntyped(args).orElse(false));
+    builder.setVisibleInWhoisAsTech(
+        CONTACT_VISIBLE_IN_WHOIS_AS_TECH_FIELD.extractUntyped(args).orElse(false));
+    builder.setVisibleInDomainWhoisAsAbuse(
+        PHONE_AND_EMAIL_VISIBLE_IN_DOMAIN_WHOIS_AS_ABUSE_FIELD.extractUntyped(args).orElse(false));
+    builder.setPhoneNumber(CONTACT_PHONE_NUMBER_FIELD.extractUntyped(args).orElse(null));
+    builder.setFaxNumber(CONTACT_FAX_NUMBER_FIELD.extractUntyped(args).orElse(null));
+    builder.setTypes(CONTACT_TYPES.extractUntyped(args).orElse(ImmutableSet.of()));
+    builder.setGaeUserId(CONTACT_GAE_USER_ID_FIELD.extractUntyped(args).orElse(null));
+    builder.setAllowedToSetRegistryLockPassword(
+        CONTACT_ALLOWED_TO_SET_REGISTRY_LOCK_PASSWORD.extractUntyped(args).orElse(false));
+
+    // Registry lock password does not need to be set every time
     CONTACT_REGISTRY_LOCK_PASSWORD_FIELD
         .extractUntyped(args)
-        .ifPresent(builder::setRegistryLockPassword);
-    return builder;
+        .ifPresent(
+            password -> {
+              if (!Strings.isNullOrEmpty(password)) {
+                builder.setRegistryLockPassword(password);
+              }
+            });
   }
 }

core/src/main/java/google/registry/ui/server/registrar/RegistrarSettingsAction.java

@@ -60,7 +60,6 @@ import google.registry.util.CollectionUtils;
 import google.registry.util.DiffUtils;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
@@ -175,8 +174,7 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
   }
 
   private RegistrarResult update(final Map<String, ?> args, String clientId) {
-    return tm()
-        .transact(
+    return tm().transact(
             () -> {
               // We load the registrar here rather than outside of the transaction - to make
               // sure we have the latest version. This one is loaded inside the transaction, so it's
@@ -215,7 +213,8 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
               updatedRegistrar = checkAndUpdateAdminControlledFields(updatedRegistrar, args);
 
               // read the contacts from the request.
-              ImmutableSet<RegistrarContact> updatedContacts = readContacts(registrar, args);
+              ImmutableSet<RegistrarContact> updatedContacts =
+                  readContacts(registrar, contacts, args);
 
               // Save the updated contacts
               if (!updatedContacts.equals(contacts)) {
@@ -240,11 +239,18 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
             });
   }
 
-  private Map<String, Object> expandRegistrarWithContacts(Iterable<RegistrarContact> contacts,
-                                                          Registrar registrar) {
+  private Map<String, Object> expandRegistrarWithContacts(
+      Iterable<RegistrarContact> contacts, Registrar registrar) {
     ImmutableSet<Map<String, Object>> expandedContacts =
         Streams.stream(contacts)
             .map(RegistrarContact::toDiffableFieldMap)
+            // Note: per the javadoc, toDiffableFieldMap includes sensitive data but we don't want
+            // to display it here
+            .peek(
+                map -> {
+                  map.remove("registryLockPasswordHash");
+                  map.remove("registryLockPasswordSalt");
+                })
             .collect(toImmutableSet());
     // Use LinkedHashMap here to preserve ordering; null values mean we can't use ImmutableMap.
     LinkedHashMap<String, Object> result = new LinkedHashMap<>(registrar.toDiffableFieldMap());
@@ -377,16 +383,10 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
 
   /** Reads the contacts from the supplied args. */
   public static ImmutableSet<RegistrarContact> readContacts(
-      Registrar registrar, Map<String, ?> args) {
-
-    ImmutableSet.Builder<RegistrarContact> contacts = new ImmutableSet.Builder<>();
-    Optional<List<RegistrarContact.Builder>> builders =
-        RegistrarFormFields.CONTACTS_FIELD.extractUntyped(args);
-    if (builders.isPresent()) {
-      builders.get().forEach(c -> contacts.add(c.setParent(registrar).build()));
-    }
-
-    return contacts.build();
+      Registrar registrar, ImmutableSet<RegistrarContact> existingContacts, Map<String, ?> args) {
+    return RegistrarFormFields.getRegistrarContactBuilders(existingContacts, args).stream()
+        .map(builder -> builder.setParent(registrar).build())
+        .collect(toImmutableSet());
   }
 
   /**
@@ -452,8 +452,17 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
                     () ->
                         new FormException(
                             "Not allowed to set registry lock password directly on new contact"));
-        if (!existingContact.isAllowedToSetRegistryLockPassword()) {
-          throw new FormException("Registrar contact not allowed to set registry lock password");
+        if (updatedContact.isRegistryLockAllowed()) {
+          // the password must have been set before or the user was allowed to set it now
+          if (!existingContact.isAllowedToSetRegistryLockPassword()
+              && !existingContact.isRegistryLockAllowed()) {
+            throw new FormException("Registrar contact not allowed to set registry lock password");
+          }
+        }
+        if (updatedContact.isAllowedToSetRegistryLockPassword()) {
+          if (!existingContact.isAllowedToSetRegistryLockPassword()) {
+            throw new FormException("Cannot set isAllowedToSetRegistryLockPassword through UI");
+          }
         }
       }
     }

core/src/main/java/google/registry/ui/server/registrar/RegistryLockGetAction.java

@@ -0,0 +1,171 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server.registrar;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.net.HttpHeaders.X_FRAME_OPTIONS;
+import static google.registry.security.JsonResponseHelper.Status.SUCCESS;
+import static google.registry.ui.server.registrar.RegistrarConsoleModule.PARAM_CLIENT_ID;
+import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
+import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+
+import com.google.appengine.api.users.User;
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.flogger.FluentLogger;
+import com.google.common.net.MediaType;
+import com.google.gson.Gson;
+import google.registry.model.registrar.Registrar;
+import google.registry.model.registrar.RegistrarContact;
+import google.registry.model.registry.RegistryLockDao;
+import google.registry.request.Action;
+import google.registry.request.Action.Method;
+import google.registry.request.Parameter;
+import google.registry.request.RequestMethod;
+import google.registry.request.Response;
+import google.registry.request.auth.Auth;
+import google.registry.request.auth.AuthResult;
+import google.registry.request.auth.AuthenticatedRegistrarAccessor;
+import google.registry.request.auth.AuthenticatedRegistrarAccessor.RegistrarAccessDeniedException;
+import google.registry.request.auth.UserAuthInfo;
+import google.registry.schema.domain.RegistryLock;
+import google.registry.security.JsonResponseHelper;
+import java.util.Optional;
+import javax.inject.Inject;
+import org.joda.time.DateTime;
+
+/**
+ * Servlet that allows for getting locks for a particular registrar.
+ *
+ * <p>Note: at the moment we have no mechanism for JSON GET/POSTs in the same class or at the same
+ * URL, which is why this is distinct from the {@link RegistryLockPostAction}.
+ */
+@Action(
+    service = Action.Service.DEFAULT,
+    path = RegistryLockGetAction.PATH,
+    auth = Auth.AUTH_PUBLIC_LOGGED_IN)
+public final class RegistryLockGetAction implements Runnable {
+
+  public static final String PATH = "/registry-lock-get";
+
+  private static final String LOCK_ENABLED_FOR_CONTACT_PARAM = "lockEnabledForContact";
+  private static final String EMAIL_PARAM = "email";
+  private static final String LOCKS_PARAM = "locks";
+  private static final String FULLY_QUALIFIED_DOMAIN_NAME_PARAM = "fullyQualifiedDomainName";
+  private static final String LOCKED_TIME_PARAM = "lockedTime";
+  private static final String LOCKED_BY_PARAM = "lockedBy";
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private static final Gson GSON = new Gson();
+
+  @VisibleForTesting Method method;
+  private final Response response;
+  private final AuthenticatedRegistrarAccessor registrarAccessor;
+  @VisibleForTesting AuthResult authResult;
+  @VisibleForTesting Optional<String> paramClientId;
+
+  @Inject
+  RegistryLockGetAction(
+      @RequestMethod Method method,
+      Response response,
+      AuthenticatedRegistrarAccessor registrarAccessor,
+      AuthResult authResult,
+      @Parameter(PARAM_CLIENT_ID) Optional<String> paramClientId) {
+    this.method = method;
+    this.response = response;
+    this.registrarAccessor = registrarAccessor;
+    this.authResult = authResult;
+    this.paramClientId = paramClientId;
+  }
+
+  @Override
+  public void run() {
+    checkArgument(Method.GET.equals(method), "Only GET requests allowed");
+    checkArgument(authResult.userAuthInfo().isPresent(), "User auth info must be present");
+    checkArgument(paramClientId.isPresent(), "clientId must be present");
+    response.setContentType(MediaType.JSON_UTF_8);
+    response.setHeader(X_FRAME_OPTIONS, "SAMEORIGIN"); // Disallow iframing.
+    response.setHeader("X-Ui-Compatible", "IE=edge"); // Ask IE not to be silly.
+
+    try {
+      ImmutableMap<String, ?> resultMap = getLockedDomainsMap(paramClientId.get());
+      ImmutableMap<String, ?> payload =
+          JsonResponseHelper.create(SUCCESS, "Successful locks retrieval", resultMap);
+      response.setPayload(GSON.toJson(payload));
+    } catch (RegistrarAccessDeniedException e) {
+      logger.atWarning().withCause(e).log(
+          "User %s doesn't have access to this registrar", authResult.userIdForLogging());
+      response.setStatus(SC_FORBIDDEN);
+    } catch (Exception e) {
+      logger.atWarning().withCause(e).log("Unexpected error when retrieving locks for a registrar");
+      response.setStatus(SC_INTERNAL_SERVER_ERROR);
+    }
+  }
+
+  private ImmutableMap<String, ?> getLockedDomainsMap(String clientId)
+      throws RegistrarAccessDeniedException {
+    // Note: admins always have access to the locks page
+    checkArgument(authResult.userAuthInfo().isPresent(), "User auth info must be present");
+    UserAuthInfo userAuthInfo = authResult.userAuthInfo().get();
+    boolean isAdmin = userAuthInfo.isUserAdmin();
+    Registrar registrar = getRegistrarAndVerifyLockAccess(clientId, isAdmin);
+    User user = userAuthInfo.user();
+    boolean isRegistryLockAllowed =
+        isAdmin
+            || registrar.getContacts().stream()
+                .filter(contact -> contact.getEmailAddress().equals(user.getEmail()))
+                .findFirst()
+                .map(RegistrarContact::isRegistryLockAllowed)
+                .orElse(false);
+    return ImmutableMap.of(
+        LOCK_ENABLED_FOR_CONTACT_PARAM,
+        isRegistryLockAllowed,
+        EMAIL_PARAM,
+        user.getEmail(),
+        PARAM_CLIENT_ID,
+        registrar.getClientId(),
+        LOCKS_PARAM,
+        getLockedDomains(clientId));
+  }
+
+  private Registrar getRegistrarAndVerifyLockAccess(String clientId, boolean isAdmin)
+      throws RegistrarAccessDeniedException {
+    Registrar registrar = registrarAccessor.getRegistrar(clientId);
+    checkArgument(
+        isAdmin || registrar.isRegistryLockAllowed(),
+        "Registry lock not allowed for this registrar");
+    return registrar;
+  }
+
+  private ImmutableList<ImmutableMap<String, ?>> getLockedDomains(String clientId) {
+    ImmutableList<RegistryLock> locks =
+        RegistryLockDao.getByRegistrarId(clientId).stream()
+            .filter(RegistryLock::isVerified)
+            .collect(toImmutableList());
+    return locks.stream().map(this::lockToMap).collect(toImmutableList());
+  }
+
+  private ImmutableMap<String, ?> lockToMap(RegistryLock lock) {
+    return ImmutableMap.of(
+        FULLY_QUALIFIED_DOMAIN_NAME_PARAM,
+        lock.getDomainName(),
+        LOCKED_TIME_PARAM,
+        lock.getCompletionTimestamp().map(DateTime::toString).orElse(""),
+        LOCKED_BY_PARAM,
+        lock.isSuperuser() ? "admin" : lock.getRegistrarPocId());
+  }
+}

core/src/main/java/google/registry/xjc/list_generated_files.sh

@@ -1,66 +0,0 @@
-#!/bin/sh
-# Copyright 2017 The Nomulus Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-tmp="$(mktemp -d "${TMPDIR:-/tmp}/list_generated_files.XXXXXXXX")"
-[[ "${tmp}" != "" ]] || exit 1
-trap "rm -rf ${tmp}" EXIT
-
-base="${PWD}"
-export LC_ALL=C
-
-cd "${tmp}"
-cp "${base}/java/google/registry/xjc/bindings.xjb" .
-cp "${base}"/java/google/registry/xml/xsd/*.xsd .
-"${base}/third_party/java/jaxb/jaxb-xjc" -extension -d "${tmp}" -b *.xjb *.xsd \
-  | sed -ne s@google/registry/xjc/@@p \
-  | grep -v package-info.java \
-  | sort \
-  > xjc_generated_files
-
-cat <<EOF
-#
-#      .'\`\`'.      ...
-#     :o  o \`....'\`  ;
-#     \`. O         :'
-#       \`':          \`.
-#         \`:.          \`.
-#          : \`.         \`.
-#         \`..'\`...       \`.
-#                 \`...     \`.
-#  DO NOT EDIT        \`\`...  \`.
-#         THIS FILE        \`\`\`\`\`.
-#
-# When you make changes to the XML schemas (*.xsd) or the JAXB bindings file
-# (bindings.xjb), you must regenerate this file with the following commands:
-#
-#   bazel run java/google/registry/xjc:list_generated_files | tee /tmp/lol
-#   mv /tmp/lol java/google/registry/xjc/generated_files.bzl
-#
-EOF
-
-echo
-echo "pkginfo_generated_files = ["
-while read package; do
-  printf '    "%s/package-info.java",\n' "${package}"
-done < <(awk -F/ '{print $1}' xjc_generated_files | sort -u)
-echo "]"
-
-echo
-echo "xjc_generated_files = ["
-while read path; do
-  printf '    "%s",\n' "${path}"
-done <xjc_generated_files
-echo "]"

core/src/main/java/google/registry/xjc/make_pkginfo.sh

@@ -1,57 +0,0 @@
-#!/bin/bash
-# Copyright 2017 The Nomulus Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-[[ $# != 2 ]] && { echo "usage: $0 TEMPLATE OUTDIR" >&2; exit 1; }
-
-template="$1"
-outdir="$2"
-
-create() {
-  package=$1
-  namespace=$2
-  sed -e "s,@PACKAGE@,${package},g" \
-      -e "s,@NAMESPACE@,${namespace},g" \
-    < "${template}" \
-    > "${outdir}/${package}/package-info.java"
-}
-
-create contact urn:ietf:params:xml:ns:contact-1.0
-create domain urn:ietf:params:xml:ns:domain-1.0
-create dsig http://www.w3.org/2000/09/xmldsig#
-create epp urn:ietf:params:xml:ns:epp-1.0
-create eppcom urn:ietf:params:xml:ns:eppcom-1.0
-create fee06 urn:ietf:params:xml:ns:fee-0.6
-create fee11 urn:ietf:params:xml:ns:fee-0.11
-create fee12 urn:ietf:params:xml:ns:fee-0.12
-create host urn:ietf:params:xml:ns:host-1.0
-create iirdea urn:ietf:params:xml:ns:iirdea-1.0
-create launch urn:ietf:params:xml:ns:launch-1.0
-create mark urn:ietf:params:xml:ns:mark-1.0
-create rde urn:ietf:params:xml:ns:rde-1.0
-create rdecontact urn:ietf:params:xml:ns:rdeContact-1.0
-create rdedomain urn:ietf:params:xml:ns:rdeDomain-1.0
-create rdeeppparams urn:ietf:params:xml:ns:rdeEppParams-1.0
-create rdeheader urn:ietf:params:xml:ns:rdeHeader-1.0
-create rdehost urn:ietf:params:xml:ns:rdeHost-1.0
-create rdeidn urn:ietf:params:xml:ns:rdeIDN-1.0
-create rdenndn urn:ietf:params:xml:ns:rdeNNDN-1.0
-create rdenotification urn:ietf:params:xml:ns:rdeNotification-1.0
-create rdepolicy urn:ietf:params:xml:ns:rdePolicy-1.0
-create rderegistrar urn:ietf:params:xml:ns:rdeRegistrar-1.0
-create rdereport urn:ietf:params:xml:ns:rdeReport-1.0
-create rgp urn:ietf:params:xml:ns:rgp-1.0
-create secdns urn:ietf:params:xml:ns:secDNS-1.1
-create smd urn:ietf:params:xml:ns:signedMark-1.0

core/src/main/java/google/registry/xjc/package-info.java.in

@@ -1,4 +1,3 @@
-// See build.xml and make_pkginfo.sh which preprocess this into actual files.
 @XmlSchema(
     elementFormDefault = XmlNsForm.QUALIFIED,
     namespace = "@NAMESPACE@",

core/src/main/java/google/registry/xjc/package-info.map

@@ -0,0 +1,27 @@
+contact urn:ietf:params:xml:ns:contact-1.0
+domain urn:ietf:params:xml:ns:domain-1.0
+dsig http://www.w3.org/2000/09/xmldsig#
+epp urn:ietf:params:xml:ns:epp-1.0
+eppcom urn:ietf:params:xml:ns:eppcom-1.0
+fee06 urn:ietf:params:xml:ns:fee-0.6
+fee11 urn:ietf:params:xml:ns:fee-0.11
+fee12 urn:ietf:params:xml:ns:fee-0.12
+host urn:ietf:params:xml:ns:host-1.0
+iirdea urn:ietf:params:xml:ns:iirdea-1.0
+launch urn:ietf:params:xml:ns:launch-1.0
+mark urn:ietf:params:xml:ns:mark-1.0
+rde urn:ietf:params:xml:ns:rde-1.0
+rdecontact urn:ietf:params:xml:ns:rdeContact-1.0
+rdedomain urn:ietf:params:xml:ns:rdeDomain-1.0
+rdeeppparams urn:ietf:params:xml:ns:rdeEppParams-1.0
+rdeheader urn:ietf:params:xml:ns:rdeHeader-1.0
+rdehost urn:ietf:params:xml:ns:rdeHost-1.0
+rdeidn urn:ietf:params:xml:ns:rdeIDN-1.0
+rdenndn urn:ietf:params:xml:ns:rdeNNDN-1.0
+rdenotification urn:ietf:params:xml:ns:rdeNotification-1.0
+rdepolicy urn:ietf:params:xml:ns:rdePolicy-1.0
+rderegistrar urn:ietf:params:xml:ns:rdeRegistrar-1.0
+rdereport urn:ietf:params:xml:ns:rdeReport-1.0
+rgp urn:ietf:params:xml:ns:rgp-1.0
+secdns urn:ietf:params:xml:ns:secDNS-1.1
+smd urn:ietf:params:xml:ns:signedMark-1.0

core/src/main/resources/META-INF/orm.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entity-mappings xmlns="http://xmlns.jcp.org/xml/ns/persistence/orm"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/persistence/orm
+          http://xmlns.jcp.org/xml/ns/persistence/orm_2_2.xsd"
+    version="2.2">
+  <embeddable class="org.joda.money.Money" access="FIELD">
+    <attributes>
+      <embedded name="money" access="FIELD"/>
+    </attributes>
+  </embeddable>
+  <embeddable class="org.joda.money.BigMoney" access="FIELD">
+    <attributes>
+      <basic name="amount" access="FIELD"/>
+      <basic name="currency" access="FIELD"/>
+    </attributes>
+  </embeddable>
+</entity-mappings>

core/src/main/resources/META-INF/persistence.xml

@@ -32,6 +32,13 @@
     <class>google.registry.model.transfer.TransferData</class>
     <class>google.registry.model.eppcommon.Trid</class>
 
+    <!-- Customized type converters -->
+    <class>google.registry.persistence.BloomFilterConverter</class>
+    <class>google.registry.persistence.CreateAutoTimestampConverter</class>
+    <class>google.registry.persistence.CurrencyUnitConverter</class>
+    <class>google.registry.persistence.UpdateAutoTimestampConverter</class>
+    <class>google.registry.persistence.ZonedDateTimeConverter</class>
+
     <!-- TODO(weiminyu): check out application-layer validation. -->
     <validation-mode>NONE</validation-mode>
   </persistence-unit>

core/src/main/resources/google/registry/reporting/spec11/soy/Spec11Email.soy

@@ -37,17 +37,18 @@
   {/call}
 
   <p>Please work with the registrant to mitigate any security issues and have the
-    domains delisted.</p>
+    domains delisted. If you believe that any of the domains were reported in error, or are still
+    receiving reports for issues that have been remediated,
+    please <a href="https://safebrowsing.google.com/safebrowsing/report_error/?hl=en">submit a
+    request</a> to have the site reviewed.</p>
 
   {call .resourceList}
     {param resources: $resources /}
   {/call}
 
   <p>You will continue to receive a monthly summary of all domains managed by your registrar
-    that remain on our lists of potential security threats. You will additionally receive a daily
-    notice when any new domains that are added to these lists. Once the registrant has resolved
-    the security issues and followed the steps to have his or her domain reviewed and delisted
-    it will automatically be removed from our monthly reporting.</p>
+    that remain on our lists of potential security threats. You will also receive a daily
+    notice when any new domains are added to these lists.</p>
 
   <p>If you have any questions regarding this notice, please contact {$replyToEmail}.</p>
 {/template}
@@ -79,11 +80,14 @@
     {param resources: $resources /}
   {/call}
 
+   <p>If you believe that any of the domains were reported in error, or are still receiving
+   reports for issues that have been remediated,
+   please <a href="https://safebrowsing.google.com/safebrowsing/report_error/?hl=en">submit
+   a request</a> to have the site reviewed.</p>
+
   <p>You will continue to receive daily notices when new domains managed by your registrar
     are flagged for abuse, as well as a monthly summary of all of your domains under management
-    that remain flagged for abuse. Once the registrant has resolved the security issues and
-    followed the steps to have his or her domain reviewed and delisted it will automatically
-    be removed from our reporting.</p>
+    that remain flagged for abuse.</p>
 
   <p>If you would like to change the email to which these notices are sent please update your
     abuse contact using your registrar portal account.</p>

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -129,6 +129,7 @@ import google.registry.flows.domain.DomainFlowUtils.TrailingDashException;
 import google.registry.flows.domain.DomainFlowUtils.UnexpectedClaimsNoticeException;
 import google.registry.flows.domain.DomainFlowUtils.UnsupportedFeeAttributeException;
 import google.registry.flows.domain.DomainFlowUtils.UnsupportedMarkTypeException;
+import google.registry.flows.domain.DomainPricingLogic.AllocationTokenInvalidForPremiumNameException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotInPromotionException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForRegistrarException;
 import google.registry.flows.domain.token.AllocationTokenFlowUtils.AllocationTokenNotValidForTldException;
@@ -1227,9 +1228,9 @@ public class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow,
             .build());
     clock.advanceOneMilli();
     setEppInput("domain_create_premium_allocationtoken.xml");
-    assertThat(assertThrows(IllegalArgumentException.class, this::runFlow))
-        .hasMessageThat()
-        .isEqualTo("A nonzero discount code cannot be applied to premium domains");
+    assertAboutEppExceptions()
+        .that(assertThrows(AllocationTokenInvalidForPremiumNameException.class, this::runFlow))
+        .marshalsToXml();
   }
 
   @Test

core/src/test/java/google/registry/flows/domain/DomainFlowUtilsTest.java

@@ -0,0 +1,154 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.flows.domain;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.DatastoreHelper.createTld;
+import static google.registry.testing.DatastoreHelper.persistResource;
+import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import google.registry.flows.EppException;
+import google.registry.flows.ResourceFlowTestCase;
+import google.registry.flows.domain.DomainFlowUtils.BadDomainNameCharacterException;
+import google.registry.flows.domain.DomainFlowUtils.BadDomainNamePartsCountException;
+import google.registry.flows.domain.DomainFlowUtils.DashesInThirdAndFourthException;
+import google.registry.flows.domain.DomainFlowUtils.DomainLabelTooLongException;
+import google.registry.flows.domain.DomainFlowUtils.EmptyDomainNamePartException;
+import google.registry.flows.domain.DomainFlowUtils.InvalidPunycodeException;
+import google.registry.flows.domain.DomainFlowUtils.LeadingDashException;
+import google.registry.flows.domain.DomainFlowUtils.TldDoesNotExistException;
+import google.registry.flows.domain.DomainFlowUtils.TrailingDashException;
+import google.registry.model.domain.DomainBase;
+import google.registry.testing.AppEngineRule;
+import org.junit.Before;
+import org.junit.Test;
+
+public class DomainFlowUtilsTest extends ResourceFlowTestCase<DomainInfoFlow, DomainBase> {
+
+  @Before
+  public void setup() {
+    setEppInput("domain_info.xml");
+    createTld("tld");
+    persistResource(AppEngineRule.makeRegistrar1().asBuilder().build());
+  }
+
+  @Test
+  public void testValidateDomainNameAcceptsValidName() throws EppException {
+    assertThat(DomainFlowUtils.validateDomainName("example.tld")).isNotNull();
+  }
+
+  @Test
+  public void testValidateDomainName_IllegalCharacters() {
+    BadDomainNameCharacterException thrown =
+        assertThrows(
+            BadDomainNameCharacterException.class,
+            () -> DomainFlowUtils.validateDomainName("$.foo"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Domain names can only contain a-z, 0-9, '.' and '-'");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_DomainNameWithEmptyParts() {
+    EmptyDomainNamePartException thrown =
+        assertThrows(
+            EmptyDomainNamePartException.class,
+            () -> DomainFlowUtils.validateDomainName("example."));
+    assertThat(thrown).hasMessageThat().isEqualTo("No part of a domain name can be empty");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_DomainNameWithLessThanTwoParts() {
+    BadDomainNamePartsCountException thrown =
+        assertThrows(
+            BadDomainNamePartsCountException.class,
+            () -> DomainFlowUtils.validateDomainName("example"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Domain name must have exactly one part above the TLD");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_invalidTLD() {
+    TldDoesNotExistException thrown =
+        assertThrows(
+            TldDoesNotExistException.class,
+            () -> DomainFlowUtils.validateDomainName("example.nosuchtld"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Domain name is under tld nosuchtld which doesn't exist");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_DomainNameIsTooLong() {
+    DomainLabelTooLongException thrown =
+        assertThrows(
+            DomainLabelTooLongException.class,
+            () ->
+                DomainFlowUtils.validateDomainName(
+                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.foo"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Domain labels cannot be longer than 63 characters");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_leadingDash() {
+    LeadingDashException thrown =
+        assertThrows(
+            LeadingDashException.class, () -> DomainFlowUtils.validateDomainName("-example.foo"));
+    assertThat(thrown).hasMessageThat().isEqualTo("Domain labels cannot begin with a dash");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_trailingDash() {
+    TrailingDashException thrown =
+        assertThrows(
+            TrailingDashException.class, () -> DomainFlowUtils.validateDomainName("example-.foo"));
+    assertThat(thrown).hasMessageThat().isEqualTo("Domain labels cannot end with a dash");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_invalidIDN() {
+    InvalidPunycodeException thrown =
+        assertThrows(
+            InvalidPunycodeException.class,
+            () -> DomainFlowUtils.validateDomainName("xn--abcd.foo"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Domain name starts with xn-- but is not a valid IDN");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  public void testValidateDomainName_containsInvalidDashes() {
+    DashesInThirdAndFourthException thrown =
+        assertThrows(
+            DashesInThirdAndFourthException.class,
+            () -> DomainFlowUtils.validateDomainName("ab--cd.foo"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Non-IDN domain names cannot contain dashes in the third or fourth position");
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+}

core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java

@@ -23,6 +23,7 @@ import static google.registry.model.domain.token.AllocationToken.TokenStatus.VAL
 import static google.registry.model.domain.token.AllocationToken.TokenType.SINGLE_USE;
 import static google.registry.model.domain.token.AllocationToken.TokenType.UNLIMITED_USE;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.testing.DatastoreHelper.createTld;
 import static google.registry.testing.DatastoreHelper.persistResource;
 import static google.registry.testing.JUnitBackports.assertThrows;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
@@ -36,11 +37,17 @@ import google.registry.model.domain.token.AllocationToken.TokenStatus;
 import google.registry.model.domain.token.AllocationToken.TokenType;
 import google.registry.model.reporting.HistoryEntry;
 import org.joda.time.DateTime;
+import org.junit.Before;
 import org.junit.Test;
 
 /** Unit tests for {@link AllocationToken}. */
 public class AllocationTokenTest extends EntityTestCase {
 
+  @Before
+  public void setup() {
+    createTld("foo");
+  }
+
   @Test
   public void testPersistence() {
     AllocationToken unlimitedUseToken =
@@ -66,7 +73,7 @@ public class AllocationTokenTest extends EntityTestCase {
             new AllocationToken.Builder()
                 .setToken("abc123")
                 .setRedemptionHistoryEntry(Key.create(HistoryEntry.class, 1L))
-                .setDomainName("foo.example")
+                .setDomainName("example.foo")
                 .setCreationTimeForTest(DateTime.parse("2010-11-12T05:00:00Z"))
                 .setTokenType(SINGLE_USE)
                 .build());
@@ -81,7 +88,7 @@ public class AllocationTokenTest extends EntityTestCase {
                 .setToken("abc123")
                 .setTokenType(SINGLE_USE)
                 .setRedemptionHistoryEntry(Key.create(HistoryEntry.class, 1L))
-                .setDomainName("blahdomain.fake")
+                .setDomainName("blahdomain.foo")
                 .setCreationTimeForTest(DateTime.parse("2010-11-12T05:00:00Z"))
                 .build()),
         "token",
@@ -129,13 +136,49 @@ public class AllocationTokenTest extends EntityTestCase {
     assertThat(thrown).hasMessageThat().isEqualTo("Token type can only be set once");
   }
 
+  @Test
+  public void testBuild_DomainNameWithLessThanTwoParts() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                new AllocationToken.Builder()
+                    .setDomainName("example")
+                    .setTokenType(SINGLE_USE)
+                    .setToken("barfoo")
+                    .build());
+    assertThat(thrown)
+        .hasCauseThat()
+        .hasMessageThat()
+        .isEqualTo("Domain name must have exactly one part above the TLD");
+    assertThat(thrown).hasMessageThat().isEqualTo("Invalid domain name: example");
+  }
+
+  @Test
+  public void testBuild_invalidTLD() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                new AllocationToken.Builder()
+                    .setDomainName("example.nosuchtld")
+                    .setTokenType(SINGLE_USE)
+                    .setToken("barfoo")
+                    .build());
+    assertThat(thrown)
+        .hasCauseThat()
+        .hasMessageThat()
+        .isEqualTo("Domain name is under tld nosuchtld which doesn't exist");
+    assertThat(thrown).hasMessageThat().isEqualTo("Invalid domain name: example.nosuchtld");
+  }
+
   @Test
   public void testBuild_domainNameOnlyOnSingleUse() {
     AllocationToken.Builder builder =
         new AllocationToken.Builder()
             .setToken("foobar")
             .setTokenType(TokenType.UNLIMITED_USE)
-            .setDomainName("foo.example");
+            .setDomainName("example.foo");
     IllegalArgumentException thrown = assertThrows(IllegalArgumentException.class, builder::build);
     assertThat(thrown)
         .hasMessageThat()

core/src/test/java/google/registry/model/registry/RegistryLockDaoTest.java

@@ -14,6 +14,7 @@
 
 package google.registry.model.registry;
 
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.testing.JUnitBackports.assertThrows;
@@ -22,8 +23,8 @@ import google.registry.model.transaction.JpaTransactionManagerRule;
 import google.registry.schema.domain.RegistryLock;
 import google.registry.schema.domain.RegistryLock.Action;
 import google.registry.testing.AppEngineRule;
+import java.util.Optional;
 import java.util.UUID;
-import javax.persistence.PersistenceException;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -37,7 +38,7 @@ public final class RegistryLockDaoTest {
 
   @Rule
   public final JpaTransactionManagerRule jpaTmRule =
-      new JpaTransactionManagerRule.Builder().withEntityClass(RegistryLock.class).build();
+      new JpaTransactionManagerRule.Builder().build();
 
   @Test
   public void testSaveAndLoad_success() {
@@ -52,15 +53,11 @@ public final class RegistryLockDaoTest {
   public void testSaveAndLoad_failure_differentCode() {
     RegistryLock lock = createLock();
     RegistryLockDao.save(lock);
-    PersistenceException exception =
+    NullPointerException thrown =
         assertThrows(
-            PersistenceException.class,
+            NullPointerException.class,
             () -> RegistryLockDao.getByVerificationCode(UUID.randomUUID().toString()));
-    assertThat(exception)
-        .hasCauseThat()
-        .hasMessageThat()
-        .isEqualTo("No registry lock with this code");
-    assertThat(exception).hasCauseThat().isInstanceOf(NullPointerException.class);
+    assertThat(thrown).hasMessageThat().isEqualTo("No registry lock with this code");
   }
 
   @Test
@@ -71,10 +68,10 @@ public final class RegistryLockDaoTest {
     jpaTm()
         .transact(
             () -> {
-              RegistryLock secondLock =
+              RegistryLock updatedLock =
                   RegistryLockDao.getByVerificationCode(lock.getVerificationCode());
-              secondLock.setCompletionTimestamp(jpaTmRule.getTxnClock().nowUtc());
-              RegistryLockDao.save(secondLock);
+              updatedLock.setCompletionTimestamp(jpaTmRule.getTxnClock().nowUtc());
+              RegistryLockDao.save(updatedLock);
             });
     jpaTm()
         .transact(
@@ -86,11 +83,43 @@ public final class RegistryLockDaoTest {
             });
   }
 
+  @Test
+  public void testUpdateLock_usingSamePrimaryKey() {
+    RegistryLock lock = RegistryLockDao.save(createLock());
+    jpaTmRule.getTxnClock().advanceOneMilli();
+    RegistryLock updatedLock =
+        lock.asBuilder().setCompletionTimestamp(jpaTmRule.getTxnClock().nowUtc()).build();
+    jpaTm().transact(() -> RegistryLockDao.save(updatedLock));
+    jpaTm()
+        .transact(
+            () -> {
+              RegistryLock fromDatabase =
+                  RegistryLockDao.getByVerificationCode(lock.getVerificationCode());
+              assertThat(fromDatabase.getCompletionTimestamp())
+                  .isEqualTo(Optional.of(jpaTmRule.getTxnClock().nowUtc()));
+            });
+  }
+
   @Test
   public void testFailure_saveNull() {
     assertThrows(NullPointerException.class, () -> RegistryLockDao.save(null));
   }
 
+  @Test
+  public void testLoad_byRegistrarId() {
+    RegistryLock lock = createLock();
+    RegistryLock secondLock = createLock().asBuilder().setDomainName("otherexample.test").build();
+    RegistryLockDao.save(lock);
+    RegistryLockDao.save(secondLock);
+
+    assertThat(
+            RegistryLockDao.getByRegistrarId("TheRegistrar").stream()
+                .map(RegistryLock::getDomainName)
+                .collect(toImmutableSet()))
+        .containsExactly("example.test", "otherexample.test");
+    assertThat(RegistryLockDao.getByRegistrarId("nonexistent")).isEmpty();
+  }
+
   private RegistryLock createLock() {
     return new RegistryLock.Builder()
         .setRepoId("repoId")

core/src/test/java/google/registry/model/tmch/ClaimsListDaoTest.java

@@ -0,0 +1,92 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model.tmch;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import google.registry.schema.tmch.ClaimsList;
+import google.registry.testing.FakeClock;
+import javax.persistence.NoResultException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link ClaimsListDao}. */
+@RunWith(JUnit4.class)
+public class ClaimsListDaoTest {
+
+  private FakeClock fakeClock = new FakeClock();
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder().build();
+
+  @Test
+  public void trySave_insertsClaimsListSuccessfully() {
+    ClaimsList claimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    assertThat(insertedClaimsList.getCreationTimestamp())
+        .isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+  }
+
+  @Test
+  public void trySave_noExceptionThrownWhenSaveFail() {
+    ClaimsList claimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    // Save ClaimsList with existing revisionId should fail because revisionId is the primary key.
+    ClaimsListDao.trySave(insertedClaimsList);
+  }
+
+  @Test
+  public void trySave_claimsListWithNoEntries() {
+    ClaimsList claimsList = ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of());
+    ClaimsListDao.trySave(claimsList);
+    ClaimsList insertedClaimsList = ClaimsListDao.getCurrent();
+    assertClaimsListEquals(claimsList, insertedClaimsList);
+    assertThat(insertedClaimsList.getLabelsToKeys()).isEmpty();
+  }
+
+  @Test
+  public void getCurrent_throwsNoResultExceptionIfTableIsEmpty() {
+    assertThrows(NoResultException.class, ClaimsListDao::getCurrent);
+  }
+
+  @Test
+  public void getCurrent_returnsLatestClaims() {
+    ClaimsList oldClaimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label1", "key1", "label2", "key2"));
+    ClaimsList newClaimsList =
+        ClaimsList.create(fakeClock.nowUtc(), ImmutableMap.of("label3", "key3", "label4", "key4"));
+    ClaimsListDao.trySave(oldClaimsList);
+    ClaimsListDao.trySave(newClaimsList);
+    assertClaimsListEquals(newClaimsList, ClaimsListDao.getCurrent());
+  }
+
+  private void assertClaimsListEquals(ClaimsList left, ClaimsList right) {
+    assertThat(left.getRevisionId()).isEqualTo(right.getRevisionId());
+    assertThat(left.getTmdbGenerationTime()).isEqualTo(right.getTmdbGenerationTime());
+    assertThat(left.getLabelsToKeys()).isEqualTo(right.getLabelsToKeys());
+  }
+}

core/src/test/java/google/registry/model/transaction/JpaTransactionManagerRule.java

@@ -14,26 +14,41 @@
 
 package google.registry.model.transaction;
 
+import static com.google.common.truth.Truth.assertThat;
 import static org.joda.time.DateTimeZone.UTC;
+import static org.testcontainers.containers.PostgreSQLContainer.POSTGRESQL_PORT;
 
+import com.google.common.base.Charsets;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Maps;
+import com.google.common.io.Resources;
+import google.registry.persistence.HibernateSchemaExporter;
 import google.registry.persistence.PersistenceModule;
 import google.registry.testing.FakeClock;
+import java.io.File;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.sql.Connection;
+import java.sql.Driver;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import javax.persistence.EntityManagerFactory;
-import org.hibernate.boot.MetadataSources;
-import org.hibernate.boot.registry.StandardServiceRegistryBuilder;
 import org.hibernate.cfg.Environment;
+import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
+import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
+import org.hibernate.jpa.boot.spi.Bootstrap;
 import org.joda.time.DateTime;
 import org.junit.rules.ExternalResource;
-import org.junit.rules.RuleChain;
-import org.junit.runner.Description;
-import org.junit.runners.model.Statement;
 import org.testcontainers.containers.JdbcDatabaseContainer;
 import org.testcontainers.containers.PostgreSQLContainer;
 
@@ -46,38 +61,54 @@ import org.testcontainers.containers.PostgreSQLContainer;
  * PostgreSQLContainer} to achieve test purpose.
  */
 public class JpaTransactionManagerRule extends ExternalResource {
-  private static final String SCHEMA_GOLDEN_SQL = "sql/schema/nomulus.golden.sql";
+  private static final String GOLDEN_SCHEMA_SQL_PATH = "sql/schema/nomulus.golden.sql";
+  private static final String DB_CLEANUP_SQL_PATH =
+      "google/registry/model/transaction/cleanup_database.sql";
+  private static final String MANAGEMENT_DB_NAME = "management";
+  private static final String POSTGRES_DB_NAME = "postgres";
 
   private final DateTime now = DateTime.now(UTC);
   private final FakeClock clock = new FakeClock(now);
-  private final String initScript;
+  private final String initScriptPath;
   private final ImmutableList<Class> extraEntityClasses;
   private final ImmutableMap userProperties;
 
-  private JdbcDatabaseContainer database;
+  private static final JdbcDatabaseContainer database = create();
+  private static final HibernateSchemaExporter exporter =
+      HibernateSchemaExporter.create(
+          database.getJdbcUrl(), database.getUsername(), database.getPassword());
   private EntityManagerFactory emf;
   private JpaTransactionManager cachedTm;
 
   private JpaTransactionManagerRule(
-      String initScript,
+      String initScriptPath,
       ImmutableList<Class> extraEntityClasses,
       ImmutableMap<String, String> userProperties) {
-    this.initScript = initScript;
+    this.initScriptPath = initScriptPath;
     this.extraEntityClasses = extraEntityClasses;
     this.userProperties = userProperties;
   }
 
-  /** Wraps {@link JpaTransactionManagerRule} in a {@link PostgreSQLContainer}. */
-  @Override
-  public Statement apply(Statement base, Description description) {
-    database = new PostgreSQLContainer().withInitScript(initScript);
-    return RuleChain.outerRule(database)
-        .around(JpaTransactionManagerRule.super::apply)
-        .apply(base, description);
+  private static JdbcDatabaseContainer create() {
+    PostgreSQLContainer container = new PostgreSQLContainer().withDatabaseName(MANAGEMENT_DB_NAME);
+    container.start();
+    Runtime.getRuntime().addShutdownHook(new Thread(() -> container.close()));
+    return container;
   }
 
   @Override
-  public void before() {
+  public void before() throws Exception {
+    executeSql(MANAGEMENT_DB_NAME, readSqlInClassPath(DB_CLEANUP_SQL_PATH));
+    executeSql(POSTGRES_DB_NAME, readSqlInClassPath(initScriptPath));
+    if (!extraEntityClasses.isEmpty()) {
+      File tempSqlFile = File.createTempFile("tempSqlFile", ".sql");
+      tempSqlFile.deleteOnExit();
+      exporter.export(extraEntityClasses, tempSqlFile);
+      executeSql(
+          POSTGRES_DB_NAME,
+          new String(Files.readAllBytes(tempSqlFile.toPath()), StandardCharsets.UTF_8));
+    }
+
     ImmutableMap properties = PersistenceModule.providesDefaultDatabaseConfigs();
     if (!userProperties.isEmpty()) {
       // If there are user properties, create a new properties object with these added.
@@ -85,10 +116,10 @@ public class JpaTransactionManagerRule extends ExternalResource {
       builder.putAll(userProperties);
       properties = builder.build();
     }
-
+    assertNormalActiveConnection();
     emf =
         createEntityManagerFactory(
-            database.getJdbcUrl(),
+            getJdbcUrlFor(POSTGRES_DB_NAME),
             database.getUsername(),
             database.getPassword(),
             properties,
@@ -103,8 +134,71 @@ public class JpaTransactionManagerRule extends ExternalResource {
     TransactionManagerFactory.jpaTm = cachedTm;
     if (emf != null) {
       emf.close();
+      emf = null;
     }
     cachedTm = null;
+    assertNormalActiveConnection();
+  }
+
+  /**
+   * This function throws exception if it detects connection leak by checking the metadata table
+   * pg_stat_activity.
+   */
+  private void assertNormalActiveConnection() {
+    try (Connection conn = createConnection(POSTGRES_DB_NAME);
+        Statement statement = conn.createStatement()) {
+      ResultSet rs =
+          statement.executeQuery(
+              "SELECT COUNT(1) FROM pg_stat_activity WHERE usename = '"
+                  + database.getUsername()
+                  + "'");
+      rs.next();
+      long activeConns = rs.getLong(1);
+      // There should be only 1 active connection which is executing this query
+      assertThat(activeConns).isEqualTo(1L);
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  private static String readSqlInClassPath(String sqlScriptPath) {
+    try {
+      return Resources.toString(Resources.getResource(sqlScriptPath), Charsets.UTF_8);
+    } catch (IOException e) {
+      throw new UncheckedIOException(e);
+    }
+  }
+
+  private void executeSql(String dbName, String sqlScript) {
+    try (Connection conn = createConnection(dbName);
+        Statement statement = conn.createStatement()) {
+      statement.execute(sqlScript);
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  private String getJdbcUrlFor(String dbName) {
+    // Disable Postgres driver use of java.util.logging to reduce noise at startup time
+    return "jdbc:postgresql://"
+        + database.getContainerIpAddress()
+        + ":"
+        + database.getMappedPort(POSTGRESQL_PORT)
+        + "/"
+        + dbName
+        + "?loggerLevel=OFF";
+  }
+
+  private Connection createConnection(String dbName) {
+    final Properties info = new Properties();
+    info.put("user", database.getUsername());
+    info.put("password", database.getPassword());
+    final Driver jdbcDriverInstance = database.getJdbcDriverInstance();
+    try {
+      return jdbcDriverInstance.connect(getJdbcUrlFor(dbName), info);
+    } catch (SQLException e) {
+      throw new RuntimeException(e);
+    }
   }
 
   /** Constructs the {@link EntityManagerFactory} instance. */
@@ -119,10 +213,19 @@ public class JpaTransactionManagerRule extends ExternalResource {
     properties.put(Environment.USER, username);
     properties.put(Environment.PASS, password);
 
-    MetadataSources metadataSources =
-        new MetadataSources(new StandardServiceRegistryBuilder().applySettings(properties).build());
-    extraEntityClasses.forEach(metadataSources::addAnnotatedClass);
-    return metadataSources.buildMetadata().getSessionFactoryBuilder().build();
+    ParsedPersistenceXmlDescriptor descriptor =
+        PersistenceXmlParser.locatePersistenceUnits(properties).stream()
+            .filter(unit -> PersistenceModule.PERSISTENCE_UNIT_NAME.equals(unit.getName()))
+            .findFirst()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        String.format(
+                            "Could not find persistence unit with name %s",
+                            PersistenceModule.PERSISTENCE_UNIT_NAME)));
+
+    extraEntityClasses.stream().map(Class::getName).forEach(descriptor::addClasses);
+    return Bootstrap.getEntityManagerFactoryBuilder(descriptor, properties).build();
   }
 
   /** Returns the {@link FakeClock} used by the underlying {@link JpaTransactionManagerImpl}. */
@@ -145,9 +248,9 @@ public class JpaTransactionManagerRule extends ExternalResource {
       return this;
     }
 
-    /** Adds an annotated class to the known entities for the database. */
-    public Builder withEntityClass(Class clazz) {
-      this.extraEntityClasses.add(clazz);
+    /** Adds annotated class(es) to the known entities for the database. */
+    public Builder withEntityClass(Class... classes) {
+      this.extraEntityClasses.addAll(ImmutableSet.copyOf(classes));
       return this;
     }
 
@@ -160,7 +263,7 @@ public class JpaTransactionManagerRule extends ExternalResource {
     /** Builds a {@link JpaTransactionManagerRule} instance. */
     public JpaTransactionManagerRule build() {
       if (initScript == null) {
-        initScript = SCHEMA_GOLDEN_SQL;
+        initScript = GOLDEN_SCHEMA_SQL_PATH;
       }
       return new JpaTransactionManagerRule(
           initScript,

core/src/test/java/google/registry/model/transaction/JpaTransactionManagerRuleTest.java

@@ -23,7 +23,6 @@ import java.util.List;
 import javax.persistence.Entity;
 import javax.persistence.Id;
 import javax.persistence.PersistenceException;
-import org.hibernate.cfg.Environment;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -37,7 +36,6 @@ public class JpaTransactionManagerRuleTest {
   public final JpaTransactionManagerRule jpaTmRule =
       new JpaTransactionManagerRule.Builder()
           .withEntityClass(TestEntity.class)
-          .withProperty(Environment.HBM2DDL_AUTO, "update")
           .build();
 
   @Test

core/src/test/java/google/registry/persistence/BloomFilterConverterTest.java

@@ -0,0 +1,66 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.base.Charsets.US_ASCII;
+import static com.google.common.hash.Funnels.stringFunnel;
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.hash.BloomFilter;
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link BloomFilterConverter}. */
+@RunWith(JUnit4.class)
+public class BloomFilterConverterTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .build();
+
+  @Test
+  public void roundTripConversion_returnsSameBloomFilter() {
+    BloomFilter<String> bloomFilter = BloomFilter.create(stringFunnel(US_ASCII), 3);
+    ImmutableSet.of("foo", "bar", "baz").forEach(bloomFilter::put);
+    TestEntity entity = new TestEntity(bloomFilter);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    TestEntity persisted =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "id"));
+    assertThat(persisted.bloomFilter).isEqualTo(bloomFilter);
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  public static class TestEntity extends ImmutableObject {
+
+    @Id String name = "id";
+
+    BloomFilter<String> bloomFilter;
+
+    public TestEntity() {}
+
+    TestEntity(BloomFilter<String> bloomFilter) {
+      this.bloomFilter = bloomFilter;
+    }
+  }
+}

core/src/test/java/google/registry/persistence/CreateAutoTimestampConverterTest.java

@@ -19,37 +19,24 @@ import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
 import google.registry.model.CreateAutoTimestamp;
 import google.registry.model.ImmutableObject;
 import google.registry.model.transaction.JpaTransactionManagerRule;
-import javax.persistence.Convert;
 import javax.persistence.Entity;
 import javax.persistence.Id;
-import org.hibernate.cfg.Environment;
 import org.joda.time.DateTime;
-import org.junit.ClassRule;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
-import org.testcontainers.containers.PostgreSQLContainer;
 
+/** Unit tests for {@link CreateAutoTimestampConverter}. */
 @RunWith(JUnit4.class)
 public class CreateAutoTimestampConverterTest {
 
-  @ClassRule
-  public static PostgreSQLContainer postgres =
-      new PostgreSQLContainer()
-          .withDatabaseName("postgres")
-          .withUsername("postgres")
-          .withPassword("domain-registry");
-
   @Rule
   public final JpaTransactionManagerRule jpaTmRule =
       new JpaTransactionManagerRule.Builder()
           .withEntityClass(TestEntity.class)
-          .withProperty(Environment.HBM2DDL_AUTO, "update")
           .build();
 
-  public CreateAutoTimestampConverterTest() {}
-
   @Test
   public void testTypeConversion() {
     CreateAutoTimestamp ts = CreateAutoTimestamp.create(DateTime.parse("2019-09-9T11:39:00Z"));
@@ -78,12 +65,11 @@ public class CreateAutoTimestampConverterTest {
 
     @Id String name;
 
-    @Convert(converter = CreateAutoTimestampConverter.class)
     CreateAutoTimestamp cat;
 
     public TestEntity() {}
 
-    public TestEntity(String name, CreateAutoTimestamp cat) {
+    TestEntity(String name, CreateAutoTimestamp cat) {
       this.name = name;
       this.cat = cat;
     }

core/src/test/java/google/registry/persistence/CurrencyUnitConverterTest.java

@@ -0,0 +1,93 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.PersistenceException;
+import org.joda.money.CurrencyUnit;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link CurrencyUnitConverter}. */
+@RunWith(JUnit4.class)
+public class CurrencyUnitConverterTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .build();
+
+  @Test
+  public void roundTripConversion() {
+    TestEntity entity = new TestEntity(CurrencyUnit.EUR);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    assertThat(
+            jpaTm()
+                .transact(
+                    () ->
+                        jpaTm()
+                            .getEntityManager()
+                            .createNativeQuery(
+                                "SELECT currency FROM \"TestEntity\" WHERE name = 'id'")
+                            .getResultList()))
+        .containsExactly("EUR");
+    TestEntity persisted =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "id"));
+    assertThat(persisted.currency).isEqualTo(CurrencyUnit.EUR);
+  }
+
+  @Test
+  public void invalidCurrency() {
+    jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createNativeQuery(
+                        "INSERT INTO \"TestEntity\" (name, currency) VALUES('id', 'XXXX')")
+                    .executeUpdate());
+    PersistenceException thrown =
+        assertThrows(
+            PersistenceException.class,
+            () ->
+                jpaTm()
+                    .transact(
+                        () -> jpaTm().getEntityManager().find(TestEntity.class, "id").currency));
+    assertThat(thrown).hasCauseThat().hasMessageThat().isEqualTo("Unknown currency 'XXXX'");
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  public static class TestEntity extends ImmutableObject {
+
+    @Id String name = "id";
+
+    CurrencyUnit currency;
+
+    public TestEntity() {}
+
+    TestEntity(CurrencyUnit currency) {
+      this.currency = currency;
+    }
+  }
+}

core/src/test/java/google/registry/persistence/HibernateSchemaExporterTest.java

@@ -0,0 +1,72 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import com.google.common.collect.ImmutableList;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import org.joda.money.CurrencyUnit;
+import org.junit.BeforeClass;
+import org.junit.ClassRule;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+import org.testcontainers.containers.PostgreSQLContainer;
+
+/** Unit tests for {@link HibernateSchemaExporter}. */
+@RunWith(JUnit4.class)
+public class HibernateSchemaExporterTest {
+  @ClassRule public static final PostgreSQLContainer database = new PostgreSQLContainer();
+  private static HibernateSchemaExporter exporter;
+
+  @Rule public final TemporaryFolder tempFolder = new TemporaryFolder();
+
+  @BeforeClass
+  public static void init() {
+    exporter =
+        HibernateSchemaExporter.create(
+            database.getJdbcUrl(), database.getUsername(), database.getPassword());
+  }
+
+  @Test
+  public void export_succeeds() throws IOException {
+    File sqlFile = tempFolder.newFile();
+    exporter.export(ImmutableList.of(TestEntity.class), sqlFile);
+    assertThat(Files.readAllBytes(sqlFile.toPath()))
+        .isEqualTo(
+            ("\n"
+                    + "    create table \"TestEntity\" (\n"
+                    + "       name text not null,\n"
+                    + "        cu text,\n"
+                    + "        primary key (name)\n"
+                    + "    );\n")
+                .getBytes(StandardCharsets.UTF_8));
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  private static class TestEntity {
+    @Id String name;
+
+    CurrencyUnit cu;
+  }
+}

core/src/test/java/google/registry/persistence/JodaMoneyConverterTest.java

@@ -0,0 +1,217 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package google.registry.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import java.math.BigDecimal;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import javax.persistence.AttributeOverride;
+import javax.persistence.AttributeOverrides;
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.PostLoad;
+import org.hibernate.cfg.Environment;
+import org.joda.money.CurrencyUnit;
+import org.joda.money.Money;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Unit tests for embeddable {@link Money}.
+ *
+ * <p>{@link Money} is a wrapper around {@link org.joda.money.BigMoney} which itself contains two
+ * fields: a {@link BigDecimal} {@code amount} and a {@link CurrencyUnit} {@code currency}. When we
+ * store an entity with a {@link Money} field, we would like to store it in two columns, for the
+ * amount and the currency separately, so that it is easily queryable. This requires that we make
+ * {@link Money} a nested embeddable object.
+ *
+ * <p>However becaues {@link Money} is not a class that we control, we cannot use annotation-based
+ * mapping. Therefore there is no {@code JodaMoneyConverter} class. Instead, we define the mapping
+ * in {@code META-INF/orm.xml}.
+ *
+ * <p>Also note that any entity that contains a {@link Money} should should implement a
+ * {@link @PostLoad} callback that converts the amount in the {@link Money} to a scale that is
+ * appropriate for the currency. This is espcially necessary for currencies like JPY where the scale
+ * is 0, which is different from the default scale that {@link BigDecimal} is persisted in database.
+ */
+@RunWith(JUnit4.class)
+public class JodaMoneyConverterTest {
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class, ComplexTestEntity.class)
+          .withProperty(Environment.HBM2DDL_AUTO, "update")
+          .build();
+
+  @Test
+  public void roundTripConversion() {
+    Money money = Money.of(CurrencyUnit.USD, 100);
+    TestEntity entity = new TestEntity(money);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    List<?> result =
+        jpaTm()
+            .transact(
+                () ->
+                    jpaTm()
+                        .getEntityManager()
+                        .createNativeQuery(
+                            "SELECT amount, currency FROM TestEntity WHERE name = 'id'")
+                        .getResultList());
+    assertThat(result.size()).isEqualTo(1);
+    assertThat(Arrays.asList((Object[]) result.get(0)))
+        .containsExactly(
+            BigDecimal.valueOf(100).setScale(CurrencyUnit.USD.getDecimalPlaces()), "USD")
+        .inOrder();
+    TestEntity persisted =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "id"));
+    assertThat(persisted.money).isEqualTo(money);
+  }
+
+  @Test
+  public void roundTripConversionWithComplexEntity() {
+    Money myMoney = Money.of(CurrencyUnit.USD, 100);
+    Money yourMoney = Money.of(CurrencyUnit.GBP, 80);
+    ImmutableMap<String, Money> moneyMap =
+        ImmutableMap.of(
+            "uno", Money.of(CurrencyUnit.EUR, 500),
+            "dos", Money.ofMajor(CurrencyUnit.JPY, 2000),
+            "tres", Money.of(CurrencyUnit.GBP, 20));
+    ComplexTestEntity entity = new ComplexTestEntity(moneyMap, myMoney, yourMoney);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    List<?> result =
+        jpaTm()
+            .transact(
+                () ->
+                    jpaTm()
+                        .getEntityManager()
+                        .createNativeQuery(
+                            "SELECT my_amount, my_currency, your_amount, your_currency FROM"
+                                + " ComplexTestEntity WHERE name = 'id'")
+                        .getResultList());
+    assertThat(result.size()).isEqualTo(1);
+    assertThat(Arrays.asList((Object[]) result.get(0)))
+        .containsExactly(
+            BigDecimal.valueOf(100).setScale(2), "USD", BigDecimal.valueOf(80).setScale(2), "GBP")
+        .inOrder();
+    result =
+        jpaTm()
+            .transact(
+                () ->
+                    jpaTm()
+                        .getEntityManager()
+                        .createNativeQuery(
+                            "SELECT map_amount, map_currency FROM MoneyMap"
+                                + " WHERE entity_name = 'id' AND map_key = 'dos'")
+                        .getResultList());
+    ComplexTestEntity persisted =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(ComplexTestEntity.class, "id"));
+    assertThat(result.size()).isEqualTo(1);
+
+    // Note that the amount has two decimal places even though JPY is supposed to have scale 0.
+    // This is due to the unfournate fact that we need to accommodate differet currencies stored
+    // in the same table so that the scale has to be set to the largest (2). When a Money field is
+    // persisted in an entity, the entity should always have a @PostLoad callback to convert the
+    // Money to the correct scale.
+    assertThat(Arrays.asList((Object[]) result.get(0)))
+        .containsExactly(BigDecimal.valueOf(2000).setScale(2), "JPY")
+        .inOrder();
+    // Make sure that the loaded entity contains the fields exactly as they are persisted.
+    assertThat(persisted.myMoney).isEqualTo(myMoney);
+    assertThat(persisted.yourMoney).isEqualTo(yourMoney);
+    assertThat(persisted.moneyMap).containsExactlyEntriesIn(moneyMap);
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  public static class TestEntity extends ImmutableObject {
+
+    @Id String name = "id";
+
+    Money money;
+
+    public TestEntity() {}
+
+    TestEntity(Money money) {
+      this.money = money;
+    }
+  }
+
+  @Entity(name = "ComplexTestEntity") // Override entity name to avoid the nested class reference.
+  // This entity is used to test column override for embedded fields and collections.
+  public static class ComplexTestEntity extends ImmutableObject {
+
+    // After the entity is loaded from the database, go through the money map and make sure that
+    // the scale is consistent with the currency. This is necessary for currency like JPY where
+    // the scale is 0 but the amount is persisteted as BigDecimal with scale 2.
+    @PostLoad
+    void setCurrencyScale() {
+      moneyMap
+          .entrySet()
+          .forEach(
+              entry -> {
+                Money money = entry.getValue();
+                if (!money.toBigMoney().isCurrencyScale()) {
+                  CurrencyUnit currency = money.getCurrencyUnit();
+                  BigDecimal amount = money.getAmount().setScale(currency.getDecimalPlaces());
+                  entry.setValue(Money.of(currency, amount));
+                }
+              });
+    }
+
+    @Id String name = "id";
+
+    @ElementCollection(fetch = FetchType.EAGER)
+    @CollectionTable(name = "MoneyMap", joinColumns = @JoinColumn(name = "entity_name"))
+    @MapKeyColumn(name = "map_key")
+    @AttributeOverrides({
+      @AttributeOverride(name = "value.money.amount", column = @Column(name = "map_amount")),
+      @AttributeOverride(name = "value.money.currency", column = @Column(name = "map_currency"))
+    })
+    Map<String, Money> moneyMap;
+
+    @AttributeOverrides({
+      @AttributeOverride(name = "money.amount", column = @Column(name = "my_amount")),
+      @AttributeOverride(name = "money.currency", column = @Column(name = "my_currency"))
+    })
+    Money myMoney;
+
+    @AttributeOverrides({
+      @AttributeOverride(name = "money.amount", column = @Column(name = "your_amount")),
+      @AttributeOverride(name = "money.currency", column = @Column(name = "your_currency"))
+    })
+    Money yourMoney;
+
+    public ComplexTestEntity() {}
+
+    ComplexTestEntity(ImmutableMap<String, Money> moneyMap, Money myMoney, Money yourMoney) {
+      this.moneyMap = moneyMap;
+      this.myMoney = myMoney;
+      this.yourMoney = yourMoney;
+    }
+  }
+}

core/src/test/java/google/registry/persistence/UpdateAutoTimestampConverterTest.java

@@ -19,36 +19,23 @@ import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UpdateAutoTimestamp;
 import google.registry.model.transaction.JpaTransactionManagerRule;
-import javax.persistence.Convert;
 import javax.persistence.Entity;
 import javax.persistence.Id;
-import org.hibernate.cfg.Environment;
-import org.junit.ClassRule;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
-import org.testcontainers.containers.PostgreSQLContainer;
 
+/** Unit tests for {@link UpdateAutoTimestampConverter}. */
 @RunWith(JUnit4.class)
 public class UpdateAutoTimestampConverterTest {
 
-  @ClassRule
-  public static PostgreSQLContainer postgres =
-      new PostgreSQLContainer()
-          .withDatabaseName("postgres")
-          .withUsername("postgres")
-          .withPassword("domain-registry");
-
   @Rule
   public final JpaTransactionManagerRule jpaTmRule =
       new JpaTransactionManagerRule.Builder()
           .withEntityClass(TestEntity.class)
-          .withProperty(Environment.HBM2DDL_AUTO, "update")
           .build();
 
-  public UpdateAutoTimestampConverterTest() {}
-
   @Test
   public void testTypeConversion() {
     TestEntity ent = new TestEntity("myinst", null);
@@ -89,12 +76,11 @@ public class UpdateAutoTimestampConverterTest {
 
     @Id String name;
 
-    @Convert(converter = UpdateAutoTimestampConverter.class)
     UpdateAutoTimestamp uat;
 
     public TestEntity() {}
 
-    public TestEntity(String name, UpdateAutoTimestamp uat) {
+    TestEntity(String name, UpdateAutoTimestamp uat) {
       this.name = name;
       this.uat = uat;
     }

core/src/test/java/google/registry/persistence/ZonedDateTimeConverterTest.java

@@ -0,0 +1,119 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.ImmutableObject;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import java.sql.Timestamp;
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link ZonedDateTimeConverter}. */
+@RunWith(JUnit4.class)
+public class ZonedDateTimeConverterTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder()
+          .withEntityClass(TestEntity.class)
+          .build();
+
+  private final ZonedDateTimeConverter converter = new ZonedDateTimeConverter();
+
+  @Test
+  public void convertToDatabaseColumn_returnsNullIfInputIsNull() {
+    assertThat(converter.convertToDatabaseColumn(null)).isNull();
+  }
+
+  @Test
+  public void convertToDatabaseColumn_convertsCorrectly() {
+    ZonedDateTime zonedDateTime = ZonedDateTime.parse("2019-09-01T01:01:01Z");
+    assertThat(converter.convertToDatabaseColumn(zonedDateTime).toInstant())
+        .isEqualTo(zonedDateTime.toInstant());
+  }
+
+  @Test
+  public void convertToEntityAttribute_returnsNullIfInputIsNull() {
+    assertThat(converter.convertToEntityAttribute(null)).isNull();
+  }
+
+  @Test
+  public void convertToEntityAttribute_convertsCorrectly() {
+    ZonedDateTime zonedDateTime = ZonedDateTime.parse("2019-09-01T01:01:01Z");
+    Instant instant = zonedDateTime.toInstant();
+    assertThat(converter.convertToEntityAttribute(Timestamp.from(instant)))
+        .isEqualTo(zonedDateTime);
+  }
+
+  @Test
+  public void converter_generatesTimestampWithNormalizedZone() {
+    ZonedDateTime zdt = ZonedDateTime.parse("2019-09-01T01:01:01Z");
+    TestEntity entity = new TestEntity("normalized_utc_time", zdt);
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    TestEntity retrievedEntity =
+        jpaTm()
+            .transact(
+                () -> jpaTm().getEntityManager().find(TestEntity.class, "normalized_utc_time"));
+    assertThat(retrievedEntity.zdt.toString()).isEqualTo("2019-09-01T01:01:01Z");
+  }
+
+  @Test
+  public void converter_convertsNonNormalizedZoneCorrectly() {
+    ZonedDateTime zdt = ZonedDateTime.parse("2019-09-01T01:01:01Z[UTC]");
+    TestEntity entity = new TestEntity("non_normalized_utc_time", zdt);
+
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    TestEntity retrievedEntity =
+        jpaTm()
+            .transact(
+                () -> jpaTm().getEntityManager().find(TestEntity.class, "non_normalized_utc_time"));
+    assertThat(retrievedEntity.zdt.toString()).isEqualTo("2019-09-01T01:01:01Z");
+  }
+
+  @Test
+  public void converter_convertsNonUtcZoneCorrectly() {
+    ZonedDateTime zdt = ZonedDateTime.parse("2019-09-01T01:01:01+05:00");
+    TestEntity entity = new TestEntity("new_york_time", zdt);
+
+    jpaTm().transact(() -> jpaTm().getEntityManager().persist(entity));
+    TestEntity retrievedEntity =
+        jpaTm().transact(() -> jpaTm().getEntityManager().find(TestEntity.class, "new_york_time"));
+    assertThat(retrievedEntity.zdt.toString()).isEqualTo("2019-08-31T20:01:01Z");
+  }
+
+  @Entity(name = "TestEntity") // Override entity name to avoid the nested class reference.
+  private static class TestEntity extends ImmutableObject {
+
+    @Id String name;
+
+    ZonedDateTime zdt;
+
+    public TestEntity() {}
+
+    TestEntity(String name, ZonedDateTime zdt) {
+      this.name = name;
+      this.zdt = zdt;
+    }
+  }
+}

core/src/test/java/google/registry/rde/EscrowTaskRunnerTest.java

@@ -35,6 +35,7 @@ import google.registry.testing.FakeClock;
 import google.registry.testing.FakeLockHandler;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
+import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -54,9 +55,11 @@ public class EscrowTaskRunnerTest {
   private final EscrowTask task = mock(EscrowTask.class);
   private final FakeClock clock = new FakeClock(DateTime.parse("2000-01-01TZ"));
 
+  private DateTimeZone previousDateTimeZone;
   private EscrowTaskRunner runner;
   private Registry registry;
 
+
   @Before
   public void before() {
     createTld("lol");
@@ -64,9 +67,15 @@ public class EscrowTaskRunnerTest {
     runner = new EscrowTaskRunner();
     runner.clock = clock;
     runner.lockHandler = new FakeLockHandler(true);
+    previousDateTimeZone = DateTimeZone.getDefault();
     DateTimeZone.setDefault(DateTimeZone.forID("America/New_York"));  // Make sure UTC stuff works.
   }
 
+  @After
+  public void after() {
+    DateTimeZone.setDefault(previousDateTimeZone);
+  }
+
   @Test
   public void testRun_cursorIsToday_advancesCursorToTomorrow() throws Exception {
     clock.setTo(DateTime.parse("2006-06-06T00:30:00Z"));

core/src/test/java/google/registry/reporting/icann/IcannReportingUploadActionTest.java

@@ -154,6 +154,45 @@ public class IcannReportingUploadActionTest {
                 new InternetAddress("recipient@example.com"),
                 new InternetAddress("sender@example.com")));
   }
+
+  @Test
+  public void testFailure_quicklySkipsOverNonRetryableUploadException() throws Exception {
+    runTest_nonRetryableException(
+        new IOException(
+            "<msg>A report for that month already exists, the cut-off date already"
+                + " passed.</msg>"));
+  }
+
+  @Test
+  public void testFailure_quicklySkipsOverIpWhitelistException() throws Exception {
+    runTest_nonRetryableException(
+        new IOException("Your IP address 25.147.130.158 is not allowed to connect"));
+  }
+
+  private void runTest_nonRetryableException(Exception nonRetryableException) throws Exception {
+    IcannReportingUploadAction action = createAction();
+    when(mockReporter.send(PAYLOAD_FAIL, "a-activity-201706.csv"))
+        .thenThrow(nonRetryableException)
+        .thenThrow(
+            new AssertionError(
+                "This should never be thrown because the previous exception isn't retryable"));
+    action.run();
+    verify(mockReporter, times(1)).send(PAYLOAD_FAIL, "a-activity-201706.csv");
+    verify(mockReporter).send(PAYLOAD_SUCCESS, "test-transactions-201706.csv");
+    verifyNoMoreInteractions(mockReporter);
+    assertThat(((FakeResponse) action.response).getPayload())
+        .isEqualTo("OK, attempted uploading 2 reports");
+    verify(emailService)
+        .sendEmail(
+            EmailMessage.create(
+                "ICANN Monthly report upload summary: 1/2 succeeded",
+                "Report Filename - Upload status:\n"
+                    + "test-transactions-201706.csv - SUCCESS\n"
+                    + "a-activity-201706.csv - FAILURE",
+                new InternetAddress("recipient@example.com"),
+                new InternetAddress("sender@example.com")));
+  }
+
   @Test
   public void testFail_FileNotFound() throws Exception {
     IcannReportingUploadAction action = createAction();

core/src/test/java/google/registry/reporting/spec11/Spec11EmailUtilsTest.java

@@ -61,63 +61,40 @@ public class Spec11EmailUtilsTest {
 
   private static final ImmutableList<String> FAKE_RESOURCES = ImmutableList.of("foo");
   private static final String DAILY_EMAIL_FORMAT =
-      "Dear registrar partner,"
-          + ""
-          + "<p>Super Cool Registry conducts a daily analysis of all domains registered in its "
-          + "TLDs to identify potential security concerns. On 2018-07-15, the following domains "
-          + "that your registrar manages were flagged for potential security concerns:</p>"
-          + ""
-          + "<table>"
-          + "<tr><th>Domain Name</th><th>Threat Type</th></tr>"
-          + "%s"
-          + "</table>"
-          + "<p><b>Please communicate these findings to the registrant and work with the "
-          + "registrant to mitigate any security issues and have the domains delisted.</b></p>"
-          + ""
+      "Dear registrar partner,<p>Super Cool Registry conducts a daily analysis of all domains"
+          + " registered in its TLDs to identify potential security concerns. On 2018-07-15, the"
+          + " following domains that your registrar manages were flagged for potential security"
+          + " concerns:</p><table><tr><th>Domain Name</th><th>Threat Type</th></tr>%s"
+          + "</table><p><b>Please communicate these findings to the registrant and work with the"
+          + " registrant to mitigate any security issues and have the domains delisted.</b></p>"
           + "Some helpful resources for getting off a blocked list include:"
-          + "<ul><li>foo</li></ul><p>"
-          + ""
-          + "You will continue to receive daily notices when new domains managed by your registrar "
-          + "are flagged for abuse, as well as a monthly summary of all of your domains under "
-          + "management that remain flagged for abuse. Once the registrant has resolved the "
-          + "security issues and followed the steps to have his or her domain reviewed and "
-          + "delisted it will automatically be removed from our reporting.</p>"
-          + ""
-          + "<p>If you would like to change the email to which these notices are sent please "
-          + "update your abuse contact using your registrar portal account.</p>"
-          + ""
-          + "<p>If you have any questions regarding this notice, please contact "
-          + "abuse@test.com.</p>";
+          + "<ul><li>foo</li></ul><p>If you believe that any of the domains were reported in"
+          + " error, or are still receiving reports for issues that have been remediated, please"
+          + " <a href=\"https://safebrowsing.google.com/safebrowsing/report_error/?hl=en\">submit"
+          + " a request</a> to have the site reviewed.</p><p>You will continue to receive daily"
+          + " notices when new domains managed by your registrar are flagged for abuse, as well as"
+          + " a monthly summary of all of your domains under management that remain flagged for"
+          + " abuse.</p><p>If you would like to change the email to which these notices are sent"
+          + " please update your abuse contact using your registrar portal account.</p><p>If you"
+          + " have any questions regarding this notice, please contact abuse@test.com.</p>";
   private static final String MONTHLY_EMAIL_FORMAT =
-      "Dear registrar partner,"
-          + ""
-          + "<p>Super Cool Registry previously notified you when the following "
-          + "domains managed by your registrar were flagged for potential security concerns.</p>"
-          + "<p>The following domains that you manage continue to be flagged by our analysis "
-          + "for potential security concerns. This may be because the registrants have not "
-          + "completed the requisite steps to mitigate the potential security abuse and/or have "
-          + "it reviewed and delisted.</p>"
-          + ""
-          + "<table>"
-          + "<tr><th>Domain Name</th><th>Threat Type</th></tr>"
-          + "%s"
-          + "</table>"
-          + ""
-          + "<p>Please work with the registrant to mitigate any security issues "
-          + "and have the domains delisted.</p>"
-          + ""
-          + "Some helpful resources for getting off a blocked list include:"
-          + "<ul><li>foo</li></ul><p>"
-          + ""
-          + "You will continue to receive a monthly summary of all domains managed by your "
-          + "registrar that remain on our lists of potential security threats. You will "
-          + "additionally receive a daily notice when any new domains that are added to these "
-          + "lists. Once the registrant has resolved the security issues and followed the steps to "
-          + "have his or her domain reviewed and delisted it will automatically be removed from "
-          + "our monthly reporting.</p>"
-          + ""
-          + "<p>If you have any questions regarding this notice, please contact "
-          + "abuse@test.com.</p>";
+      "Dear registrar partner,<p>Super Cool Registry previously notified you when the following"
+          + " domains managed by your registrar were flagged for potential security"
+          + " concerns.</p><p>The following domains that you manage continue to be flagged by our"
+          + " analysis for potential security concerns. This may be because the registrants have"
+          + " not completed the requisite steps to mitigate the potential security abuse and/or"
+          + " have it reviewed and delisted.</p><table><tr><th>Domain Name</th><th>Threat"
+          + " Type</th></tr>%s</table><p>Please work with the registrant to mitigate any security"
+          + " issues and have the domains delisted. If you believe that any of the domains were"
+          + " reported in error, or are still receiving reports for issues that have been"
+          + " remediated, please <a"
+          + " href=\"https://safebrowsing.google.com/safebrowsing/report_error/?hl=en\">submit a"
+          + " request</a> to have the site reviewed.</p>Some helpful resources for getting off a"
+          + " blocked list include:<ul><li>foo</li></ul><p>You will continue to receive a monthly"
+          + " summary of all domains managed by your registrar that remain on our lists of"
+          + " potential security threats. You will also receive a daily notice when any new"
+          + " domains are added to these lists.</p><p>If you have any questions regarding this"
+          + " notice, please contact abuse@test.com.</p>";
 
   @Rule public final AppEngineRule appEngine = AppEngineRule.builder().withDatastore().build();
 

core/src/test/java/google/registry/schema/integration/SqlIntegrationMembershipTest.java

@@ -0,0 +1,78 @@
+// Copyright 2018 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.integration;
+
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Sets;
+import com.google.common.collect.Sets.SetView;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import io.github.classgraph.ClassGraph;
+import io.github.classgraph.ScanResult;
+import java.lang.reflect.Field;
+import java.util.stream.Stream;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+import org.junit.runners.Suite.SuiteClasses;
+
+/**
+ * Verifies that all tests that depends on the Cloud SQL schema are included in the project's
+ * sqlIntegrationTest suite. Names of the test classes is set to the 'test.sqlIntergrationTests'
+ * system property as a comma-separated string.
+ *
+ * <p>A test is deemed dependent on the SQL schema iff it has a field with type {@link
+ * JpaTransactionManagerRule}.
+ */
+// TODO(weiminyu): consider generating a TestSuite class instead.
+@RunWith(JUnit4.class)
+public class SqlIntegrationMembershipTest {
+
+  @Test
+  public void sqlIntegrationMembershipComplete() {
+    ImmutableSet<String> sqlDependentTests;
+    try (ScanResult scanResult =
+        new ClassGraph().enableAnnotationInfo().whitelistPackages("google.registry").scan()) {
+      sqlDependentTests =
+          scanResult.getClassesWithAnnotation(RunWith.class.getName()).stream()
+              .filter(clazz -> clazz.getSimpleName().endsWith("Test"))
+              .map(clazz -> clazz.loadClass())
+              .filter(SqlIntegrationMembershipTest::isSqlDependent)
+              .map(Class::getName)
+              .collect(ImmutableSet.toImmutableSet());
+    }
+    ImmutableSet<String> declaredTests =
+        Stream.of(SqlIntegrationTestSuite.class.getAnnotation(SuiteClasses.class).value())
+            .map(Class::getName)
+            .collect(ImmutableSet.toImmutableSet());
+    SetView<String> undeclaredTests = Sets.difference(sqlDependentTests, declaredTests);
+    assertWithMessage(
+            "Undeclared sql-dependent tests found. "
+                + "Please add them to SqlIntegrationTestSuite.java.")
+        .that(undeclaredTests)
+        .isEmpty();
+    SetView<String> unnecessaryDeclarations = Sets.difference(declaredTests, sqlDependentTests);
+    assertWithMessage("Found tests that should not be included in SqlIntegrationTestSuite.java.")
+        .that(unnecessaryDeclarations)
+        .isEmpty();
+  }
+
+  private static boolean isSqlDependent(Class<?> testClass) {
+    return Stream.of(testClass.getDeclaredFields())
+        .map(Field::getType)
+        .anyMatch(JpaTransactionManagerRule.class::equals);
+  }
+}

core/src/test/java/google/registry/schema/integration/SqlIntegrationTestSuite.java

@@ -0,0 +1,58 @@
+// Copyright 2018 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.integration;
+
+import google.registry.model.registry.RegistryLockDaoTest;
+import google.registry.model.tmch.ClaimsListDaoTest;
+import google.registry.model.transaction.JpaTransactionManagerImplTest;
+import google.registry.model.transaction.JpaTransactionManagerRuleTest;
+import google.registry.persistence.BloomFilterConverterTest;
+import google.registry.persistence.CreateAutoTimestampConverterTest;
+import google.registry.persistence.CurrencyUnitConverterTest;
+import google.registry.persistence.JodaMoneyConverterTest;
+import google.registry.persistence.UpdateAutoTimestampConverterTest;
+import google.registry.persistence.ZonedDateTimeConverterTest;
+import google.registry.schema.tld.PremiumListDaoTest;
+import google.registry.ui.server.registrar.RegistryLockGetActionTest;
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+import org.junit.runners.Suite.SuiteClasses;
+
+/**
+ * Groups all tests that may depends on Cloud SQL schema. They will be run for server-schema
+ * compatibility check.
+ *
+ * <p>Schema dependency is approximated by the use of {@link
+ * google.registry.model.transaction.JpaTransactionManagerRule}.
+ *
+ * @see SqlIntegrationMembershipTest
+ */
+// TODO(weiminyu): refactor JpaTransactionManagerRule to eliminate false positives.
+@RunWith(Suite.class)
+@SuiteClasses({
+  BloomFilterConverterTest.class,
+  ClaimsListDaoTest.class,
+  CreateAutoTimestampConverterTest.class,
+  CurrencyUnitConverterTest.class,
+  JodaMoneyConverterTest.class,
+  JpaTransactionManagerImplTest.class,
+  JpaTransactionManagerRuleTest.class,
+  PremiumListDaoTest.class,
+  RegistryLockDaoTest.class,
+  RegistryLockGetActionTest.class,
+  UpdateAutoTimestampConverterTest.class,
+  ZonedDateTimeConverterTest.class
+})
+public class SqlIntegrationTestSuite {}

core/src/test/java/google/registry/schema/tld/PremiumListDaoTest.java

@@ -0,0 +1,85 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.JUnitBackports.assertThrows;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import java.math.BigDecimal;
+import org.joda.money.CurrencyUnit;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link PremiumListDao}. */
+@RunWith(JUnit4.class)
+public class PremiumListDaoTest {
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder().build();
+
+  private static final ImmutableMap<String, BigDecimal> TEST_PRICES =
+      ImmutableMap.of(
+          "silver",
+          BigDecimal.valueOf(10.23),
+          "gold",
+          BigDecimal.valueOf(1305.47),
+          "palladium",
+          BigDecimal.valueOf(1552.78));
+
+  @Test
+  public void saveNew_worksSuccessfully() {
+    PremiumList premiumList = PremiumList.create("testname", CurrencyUnit.USD, TEST_PRICES);
+    PremiumListDao.saveNew(premiumList);
+    jpaTm()
+        .transact(
+            () -> {
+              PremiumList persistedList =
+                  jpaTm()
+                      .getEntityManager()
+                      .createQuery(
+                          "SELECT pl FROM PremiumList pl WHERE pl.name = :name", PremiumList.class)
+                      .setParameter("name", "testname")
+                      .getSingleResult();
+              assertThat(persistedList.getLabelsToPrices()).containsExactlyEntriesIn(TEST_PRICES);
+              assertThat(persistedList.getCreationTimestamp())
+                  .isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+            });
+  }
+
+  @Test
+  public void saveNew_throwsWhenPremiumListAlreadyExists() {
+    PremiumListDao.saveNew(PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES));
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                PremiumListDao.saveNew(
+                    PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES)));
+    assertThat(thrown).hasMessageThat().contains("A premium list of this name already exists");
+  }
+
+  @Test
+  public void checkExists_worksSuccessfully() {
+    assertThat(PremiumListDao.checkExists("testlist")).isFalse();
+    PremiumListDao.saveNew(PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES));
+    assertThat(PremiumListDao.checkExists("testlist")).isTrue();
+  }
+}

core/src/test/java/google/registry/schema/tld/PremiumListTest.java

@@ -0,0 +1,50 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.hash.BloomFilter;
+import java.math.BigDecimal;
+import org.joda.money.CurrencyUnit;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link PremiumList}. */
+@RunWith(JUnit4.class)
+public class PremiumListTest {
+
+  private static final ImmutableMap<String, BigDecimal> TEST_PRICES =
+      ImmutableMap.of(
+          "silver",
+          BigDecimal.valueOf(10.23),
+          "gold",
+          BigDecimal.valueOf(1305.47),
+          "palladium",
+          BigDecimal.valueOf(1552.78));
+
+  @Test
+  public void bloomFilter_worksCorrectly() {
+    BloomFilter<String> bloomFilter =
+        PremiumList.create("testname", CurrencyUnit.USD, TEST_PRICES).getBloomFilter();
+    ImmutableSet.of("silver", "gold", "palladium")
+        .forEach(l -> assertThat(bloomFilter.mightContain(l)).isTrue());
+    ImmutableSet.of("dirt", "pyrite", "zirconia")
+        .forEach(l -> assertThat(bloomFilter.mightContain(l)).isFalse());
+  }
+}

core/src/test/java/google/registry/server/RegistryTestServer.java

@@ -82,7 +82,8 @@ public final class RegistryTestServer {
           route("/registrar-create", FrontendServlet.class),
           route("/registrar-ote-setup", FrontendServlet.class),
           route("/registrar-ote-status", FrontendServlet.class),
-          route("/registrar-settings", FrontendServlet.class));
+          route("/registrar-settings", FrontendServlet.class),
+          route("/registry-lock-get", FrontendServlet.class));
 
   private static final ImmutableList<Class<? extends Filter>> FILTERS = ImmutableList.of(
       ObjectifyFilter.class,

core/src/test/java/google/registry/testing/AppEngineRule.java

@@ -193,6 +193,7 @@ public final class AppEngineRule extends ExternalResource {
         .setPassword("foo-BAR2")
         .setPhoneNumber("+1.3334445555")
         .setPhonePasscode("12345")
+        .setRegistryLockAllowed(false)
         .build();
   }
 
@@ -206,6 +207,7 @@ public final class AppEngineRule extends ExternalResource {
         .setPassword("password2")
         .setPhoneNumber("+1.2223334444")
         .setPhonePasscode("22222")
+        .setRegistryLockAllowed(true)
         .build();
   }
 
@@ -241,6 +243,19 @@ public final class AppEngineRule extends ExternalResource {
         .build();
   }
 
+  public static RegistrarContact makeRegistrarContact3() {
+    return new RegistrarContact.Builder()
+        .setParent(makeRegistrar2())
+        .setName("Marla Singer")
+        .setEmailAddress("Marla.Singer@crr.com")
+        .setPhoneNumber("+1.2128675309")
+        .setTypes(ImmutableSet.of(RegistrarContact.Type.TECH))
+        .setGaeUserId(THE_REGISTRAR_GAE_USER_ID)
+        .setAllowedToSetRegistryLockPassword(true)
+        .setRegistryLockPassword("hi")
+        .build();
+  }
+
   /** Hack to make sure AppEngineRule is always wrapped in a TemporaryFolder rule. */
   @Override
   public Statement apply(Statement base, Description description) {
@@ -412,6 +427,10 @@ public final class AppEngineRule extends ExternalResource {
   public static void loadInitialData() {
     persistSimpleResources(
         ImmutableList.of(
-            makeRegistrar1(), makeRegistrarContact1(), makeRegistrar2(), makeRegistrarContact2()));
+            makeRegistrar1(),
+            makeRegistrarContact1(),
+            makeRegistrar2(),
+            makeRegistrarContact2(),
+            makeRegistrarContact3()));
   }
 }