Verify RegistryTool can instantiate (#400 )

* Verify RegistryTool can instantiate Add a task that instantiates all command classes in RegistryTool with runtimeClasspath. Also make sure that runtimeClasspath is a superset of compileClasspath.
Adding junit back into the runtime classpath (#399 )
2026-07-07 08:36:50 +00:00 · 2019-12-06 12:08:16 -05:00 · 2019-12-05 16:01:05 -05:00 · 2019-12-05 13:12:56 -05:00 · 2019-12-04 12:52:18 -05:00 · 2019-12-04 12:00:13 -05:00
259 changed files with 4164 additions and 4386 deletions
@@ -81,7 +81,7 @@ appengine {
 }

 dependencies {
-    compile project(':core')
+    compile project(path: ':core', configuration: 'deploy_jar')
 }

 // The tools.jar file gets pulled in from the java environment and for some
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,61 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.google.api-client:google-api-client:1.27.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-httpjson:0.52.1
+com.google.api:gax:1.35.1
+com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.cloud:google-cloud-core-http:1.59.0
+com.google.cloud:google-cloud-core:1.59.0
+com.google.cloud:google-cloud-storage:1.59.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.7
+com.google.common.html.types:types:1.0.4
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.0-beta1
+com.google.http-client:google-http-client-appengine:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.oauth-client:google-oauth-client:1.27.0
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.template:soy:2018-03-14
+com.ibm.icu:icu4j:57.1
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+javax.annotation:javax.annotation-api:1.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.validation:validation-api:1.0.0.GA
+joda-time:joda-time:2.9.2
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.json:json:20160212
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.threeten:threetenbp:1.3.3
@@ -0,0 +1,61 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.google.api-client:google-api-client:1.27.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-httpjson:0.52.1
+com.google.api:gax:1.35.1
+com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.cloud:google-cloud-core-http:1.59.0
+com.google.cloud:google-cloud-core:1.59.0
+com.google.cloud:google-cloud-storage:1.59.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.7
+com.google.common.html.types:types:1.0.4
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.0-beta1
+com.google.http-client:google-http-client-appengine:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.oauth-client:google-oauth-client:1.27.0
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.template:soy:2018-03-14
+com.ibm.icu:icu4j:57.1
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+javax.annotation:javax.annotation-api:1.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.validation:validation-api:1.0.0.GA
+joda-time:joda-time:2.9.2
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.json:json:20160212
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.threeten:threetenbp:1.3.3
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,7 @@
+## Summary
+
+This project holds some of the general-purpose utility classes that do not rely
+on the registry domain model.
+
+This is an intermediate step in untangling the circular dependencies
+between :core and :util subprojects.
@@ -0,0 +1,52 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+sourceSets {
+  testing {
+    java {
+      compileClasspath += main.output
+      runtimeClasspath += main.output
+    }
+  }
+}
+
+configurations {
+  testingCompile.extendsFrom compile
+  testingRuntime.extendsFrom runtime
+
+  // All testing util classes. Other projects may declare dependency as:
+  // testCompile project(path: 'common', configuration: 'testing')
+  testing
+}
+
+task testingJar(type: Jar) {
+  archiveBaseName = 'testing'
+  from sourceSets.testing.output
+}
+
+artifacts {
+  testing testingJar
+}
+
+dependencies {
+  def deps = rootProject.dependencyMap
+
+  compile deps['com.google.code.findbugs:jsr305']
+  compile deps['com.google.guava:guava']
+  compile deps['javax.inject:javax.inject']
+  compile deps['joda-time:joda-time']
+
+  testingCompile deps['com.google.flogger:flogger']
+  testingRuntime deps['com.google.flogger:flogger-system-backend']
+}
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,18 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.0-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+com.puppycrawl.tools:checkstyle:8.24
+commons-beanutils:commons-beanutils:1.9.4
+commons-collections:commons-collections:3.2.2
+info.picocli:picocli:4.0.3
+net.sf.saxon:Saxon-HE:9.9.1-4
+org.antlr:antlr4-runtime:4.7.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.17
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.errorprone:javac:9+181-r4173-1
@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.5
@@ -0,0 +1,11 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+org.jacoco:org.jacoco.agent:0.8.5
+org.jacoco:org.jacoco.ant:0.8.5
+org.jacoco:org.jacoco.core:0.8.5
+org.jacoco:org.jacoco.report:0.8.5
+org.ow2.asm:asm-analysis:7.2
+org.ow2.asm:asm-commons:7.2
+org.ow2.asm:asm-tree:7.2
+org.ow2.asm:asm:7.2
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,24 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.github.kevinstern:software-and-algorithms:1.0
+com.github.stephenc.jcip:jcip-annotations:1.0-1
+com.google.auto:auto-common:0.10
+com.google.code.findbugs:jFormatString:3.0.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotation:2.3.3
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.errorprone:error_prone_check_api:2.3.3
+com.google.errorprone:error_prone_core:2.3.3
+com.google.errorprone:error_prone_type_annotations:2.3.3
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:27.0.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.1
+com.google.protobuf:protobuf-java:3.4.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+org.checkerframework:checker-qual:2.5.3
+org.checkerframework:dataflow:2.5.3
+org.checkerframework:javacutil:2.5.3
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.pcollections:pcollections:2.1.2
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,14 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,14 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
@@ -0,0 +1,15 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -0,0 +1,15 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+import java.lang.reflect.Constructor
+
 plugins {
  id 'java-library'
 }
@@ -241,6 +243,8 @@ dependencies {
  compile deps['com.google.appengine:appengine-api-1.0-sdk']

  // Known issue: nebula-lint misses inherited dependency.
+  compile project(':common')
+  testCompile project(path: ':common', configuration: 'testing')
  compile project(':third_party')
  compile project(':util')
  // Import NomulusPostreSql from ':db' for compile but exclude dependencies.
@@ -658,8 +662,37 @@ task outcastTest(type: FilteringTest) {
  maxParallelForks 5
 }

+// Whitebox test verifying that RegistryTool can be instantiated. Note the
+// use of runtimeClasspath. This test emulates the logic in RegistryCli#run.
+// A to-do is added there to refactor.
+// TODO(weiminyu): Need a similar test for Registry server.
+task registryToolIntegrationTest {
+  dependsOn compileJava
+  doLast {
+    def classLoader =
+        new URLClassLoader(sourceSets.main.runtimeClasspath.collect {
+            it.toURI().toURL()
+        } as URL[])
+    def commandClasses =
+        (classLoader.loadClass('google.registry.tools.RegistryTool')
+            .getDeclaredField('COMMAND_MAP').get(null) as Map).values()
+
+    commandClasses.each {
+      try {
+        Constructor<?> c = ((Class<?>) it).getDeclaredConstructor()
+        c.setAccessible(true)
+        c.newInstance()
+      } catch (Throwable e) {
+        throw new RuntimeException("Failed to instantiate ${it}:\n ${e}")
+      }
+    }
+  }
+}
+
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
+  systemProperties project.getProperties().subMap('sql_schema_resource_root')
+
  excludeTestCases = false
  tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
 }
@@ -775,7 +808,7 @@ test {
  // Don't run any tests from this task, all testing gets done in the
  // FilteringTest tasks.
  exclude "**"
-}.dependsOn(fragileTest, outcastTest, standardTest)
+}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest)

 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
 project.nomulus.dependsOn project(':third_party').jar
@@ -205,7 +205,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
@@ -0,0 +1,245 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
@@ -218,7 +218,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
@@ -47,7 +47,7 @@ import org.joda.time.DateTime;
    path = "/_dr/cron/commitLogCheckpoint",
    method = Action.Method.GET,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogCheckpointAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -65,7 +65,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteOldCommitLogs",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class DeleteOldCommitLogsAction implements Runnable {

  private static final int NUM_MAP_SHARDS = 20;
@@ -63,7 +63,7 @@ import org.joda.time.DateTime;
    path = ExportCommitLogDiffAction.PATH,
    method = Action.Method.POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ExportCommitLogDiffAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -111,7 +111,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteContactsAndHosts",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteContactsAndHostsAction implements Runnable {

  static final String KIND_CONTACT = getKind(ContactResource.class);
@@ -55,7 +55,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteLoadTestData",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteLoadTestDataAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -68,7 +68,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteProberData",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteProberDataAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -75,7 +75,7 @@ import org.joda.time.DateTime;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/expandRecurringBillingEvents",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExpandRecurringBillingEventsAction implements Runnable {

  public static final String PARAM_CURSOR_TIME = "cursorTime";
@@ -75,7 +75,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/refreshDnsOnHostRename",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class RefreshDnsOnHostRenameAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -33,7 +33,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/commitLogFanout",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogFanoutAction implements Runnable {

  public static final String BUCKET_PARAM = "bucket";
@@ -87,7 +87,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/fanout",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TldFanoutAction implements Runnable {

  /** A set of control params to TldFanoutAction that aren't passed down to the executing action. */
@@ -52,7 +52,7 @@ import org.joda.time.Duration;
    path = PublishDnsUpdatesAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {

  public static final String PATH = "/_dr/task/publishDnsUpdates";
@@ -80,7 +80,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/readDnsQueue",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ReadDnsQueueAction implements Runnable {

  private static final String PARAM_JITTER_SECONDS = "jitterSeconds";
@@ -35,7 +35,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/dnsRefresh",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RefreshDnsAction implements Runnable {

  private final Clock clock;
@@ -45,7 +45,7 @@ import javax.inject.Inject;
    path = BackupDatastoreAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BackupDatastoreAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -51,7 +51,7 @@ import org.joda.time.Duration;
    path = BigqueryPollJobAction.PATH,
    method = {Action.Method.GET, Action.Method.POST},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BigqueryPollJobAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -59,7 +59,7 @@ import org.joda.time.format.PeriodFormat;
    path = CheckBackupAction.PATH,
    method = {POST, GET},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class CheckBackupAction implements Runnable {

  /** Parameter names for passing parameters into this action. */
@@ -65,7 +65,7 @@ import org.joda.time.DateTime;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportDomainLists",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportDomainListsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -49,7 +49,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportPremiumTerms",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportPremiumTermsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -37,7 +37,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportReservedTerms",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportReservedTermsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -56,7 +56,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/syncGroupMembers",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class SyncGroupMembersAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -39,7 +39,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = UpdateSnapshotViewAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UpdateSnapshotViewAction implements Runnable {

  /** Headers for passing parameters into the servlet. */
@@ -52,7 +52,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = UploadDatastoreBackupAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UploadDatastoreBackupAction implements Runnable {

  /** Parameter names for passing parameters into the servlet. */
@@ -60,7 +60,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = SyncRegistrarsSheetAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class SyncRegistrarsSheetAction implements Runnable {

  private enum Result {
@@ -109,7 +109,9 @@ public class FlowRunner {
    }
  }

-  /** Exception for explicitly propagating an EppException out of the transactional {@code Work}. */
+  /**
+   * Exception for explicitly propagating an EppException out of the transactional {@code Supplier}.
+   */
  private static class EppRuntimeException extends RuntimeException {
    EppRuntimeException(EppException cause) {
      super(cause);
@@ -30,28 +30,28 @@ import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.ImmutableObject;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;

-/** Wrapper for {@link Work} that associates a time with each attempt. */
+/** Wrapper for {@link Supplier} that associates a time with each attempt. */
 class CommitLoggedWork<R> implements Runnable {

-  private final Work<R> work;
+  private final Supplier<R> work;
  private final Clock clock;

  /**
   * Temporary place to store the result of a non-void work.
   *
   * <p>We don't want to return the result directly because we are going to try to recover from a
-   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify
-   * when it tries to commit the transaction. When an exception is thrown the return value would be
-   * lost, but sometimes we will be able to determine that we actually succeeded despite the
-   * timeout, and we'll want to get the result.
+   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify when
+   * it tries to commit the transaction. When an exception is thrown the return value would be lost,
+   * but sometimes we will be able to determine that we actually succeeded despite the timeout, and
+   * we'll want to get the result.
   */
  private R result;

@@ -76,7 +76,7 @@ class CommitLoggedWork<R> implements Runnable {
  /** Lifecycle marker to track whether {@link #run} has been called. */
  private boolean runCalled;

-  CommitLoggedWork(Work<R> work, Clock clock) {
+  CommitLoggedWork(Supplier<R> work, Clock clock) {
    this.work = work;
    this.clock = clock;
  }
@@ -111,7 +111,7 @@ class CommitLoggedWork<R> implements Runnable {
    // Set the time to be used for "now" within the transaction.
    try {
      Ofy.TRANSACTION_INFO.set(createNewTransactionInfo());
-      result = work.run();
+      result = work.get();
      saveCommitLog(Ofy.TRANSACTION_INFO.get());
    } finally {
      Ofy.TRANSACTION_INFO.set(previous);
@@ -17,6 +17,7 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;

 import google.registry.model.transaction.TransactionManager;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;

 /** Datastore implementation of {@link TransactionManager}. */
@@ -44,7 +45,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
    return getOfy().transact(work);
  }

@@ -54,7 +55,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
    return getOfy().transactNew(work);
  }

@@ -64,7 +65,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <R> R transactNewReadOnly(Work<R> work) {
+  public <R> R transactNewReadOnly(Supplier<R> work) {
    return getOfy().transactNewReadOnly(work);
  }

@@ -74,7 +75,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <R> R doTransactionless(Work<R> work) {
+  public <R> R doTransactionless(Supplier<R> work) {
    return getOfy().doTransactionless(work);
  }

@@ -38,7 +38,6 @@ import com.googlecode.objectify.cmd.Saver;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.VirtualEntity;
 import google.registry.model.ofy.ReadOnlyWork.KillTransactionException;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import google.registry.util.NonFinalForTesting;
 import google.registry.util.Sleeper;
@@ -46,6 +45,7 @@ import google.registry.util.SystemClock;
 import google.registry.util.SystemSleeper;
 import java.lang.annotation.Annotation;
 import java.util.Objects;
+import java.util.function.Supplier;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -194,9 +194,9 @@ public class Ofy {
  }

  /** Execute a transaction. */
-  <R> R transact(Work<R> work) {
+  <R> R transact(Supplier<R> work) {
    // If we are already in a transaction, don't wrap in a CommitLoggedWork.
-    return inTransaction() ? work.run() : transactNew(work);
+    return inTransaction() ? work.get() : transactNew(work);
  }

  /**
@@ -214,7 +214,7 @@ public class Ofy {
  }

  /** Pause the current transaction (if any) and complete this one before returning to it. */
-  <R> R transactNew(Work<R> work) {
+  <R> R transactNew(Supplier<R> work) {
    // Wrap the Work in a CommitLoggedWork so that we can give transactions a frozen view of time
    // and maintain commit logs for them.
    return transactCommitLoggedWork(new CommitLoggedWork<>(work, getClock()));
@@ -298,7 +298,7 @@ public class Ofy {
  }

  /** A read-only transaction is useful to get strongly consistent reads at a shared timestamp. */
-  <R> R transactNewReadOnly(Work<R> work) {
+  <R> R transactNewReadOnly(Supplier<R> work) {
    ReadOnlyWork<R> readOnlyWork = new ReadOnlyWork<>(work, getClock());
    try {
      ofy().transactNew(() -> {
@@ -324,11 +324,11 @@ public class Ofy {
  }

  /** Execute some work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work) {
+  <R> R doTransactionless(Supplier<R> work) {
    try {
      com.googlecode.objectify.ObjectifyService.push(
          com.googlecode.objectify.ObjectifyService.ofy().transactionless());
-      return work.run();
+      return work.get();
    } finally {
      com.googlecode.objectify.ObjectifyService.pop();
    }
@@ -342,11 +342,11 @@ public class Ofy {
   * Note that unlike a transaction's fresh session cache, the contents of this cache will be
   * discarded once the work completes, rather than being propagated into the enclosing session.
   */
-  public <R> R doWithFreshSessionCache(Work<R> work) {
+  public <R> R doWithFreshSessionCache(Supplier<R> work) {
    try {
      com.googlecode.objectify.ObjectifyService.push(
          com.googlecode.objectify.ObjectifyService.factory().begin());
-      return work.run();
+      return work.get();
    } finally {
      com.googlecode.objectify.ObjectifyService.pop();
    }
@@ -14,13 +14,13 @@

 package google.registry.model.ofy;

-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
+import java.util.function.Supplier;

-/** Wrapper for {@link Work} that disallows mutations and fails the transaction at the end. */
+/** Wrapper for {@link Supplier} that disallows mutations and fails the transaction at the end. */
 class ReadOnlyWork<R> extends CommitLoggedWork<R> {

-  ReadOnlyWork(Work<R> work, Clock clock) {
+  ReadOnlyWork(Supplier<R> work, Clock clock) {
    super(work, clock);
  }

@@ -19,6 +19,7 @@ import static com.google.common.base.Predicates.equalTo;
 import static com.google.common.base.Predicates.in;
 import static com.google.common.base.Predicates.not;
 import static com.google.common.base.Strings.emptyToNull;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.filterValues;
 import static google.registry.model.CacheUtils.memoizeWithShortExpiration;
@@ -31,10 +32,12 @@ import com.google.common.base.Joiner;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Maps;
 import com.google.common.collect.Streams;
 import com.google.common.net.InternetDomainName;
 import com.googlecode.objectify.Key;
 import google.registry.model.registry.Registry.TldType;
+import java.util.Map;
 import java.util.Optional;

 /** Utilities for finding and listing {@link Registry} entities. */
@@ -54,16 +57,21 @@ public final class Registries {
  private static Supplier<ImmutableMap<String, TldType>> createFreshCache() {
    return memoizeWithShortExpiration(
        () ->
-            tm()
-                .doTransactionless(
+            tm().doTransactionless(
                    () -> {
-                      ImmutableMap.Builder<String, TldType> builder =
-                          new ImmutableMap.Builder<>();
-                      for (Registry registry :
-                          ofy().load().type(Registry.class).ancestor(getCrossTldKey())) {
-                        builder.put(registry.getTldStr(), registry.getTldType());
-                      }
-                      return builder.build();
+                      ImmutableSet<String> tlds =
+                          ofy()
+                              .load()
+                              .type(Registry.class)
+                              .ancestor(getCrossTldKey())
+                              .keys()
+                              .list()
+                              .stream()
+                              .map(Key::getName)
+                              .collect(toImmutableSet());
+                      return Registry.getAll(tlds).stream()
+                          .map(e -> Maps.immutableEntry(e.getTldStr(), e.getTldType()))
+                          .collect(toImmutableMap(Map.Entry::getKey, Map.Entry::getValue));
                    }));
  }

@@ -83,11 +91,7 @@ public final class Registries {

  /** Returns the Registry entities themselves of the given type loaded fresh from Datastore. */
  public static ImmutableSet<Registry> getTldEntitiesOfType(TldType type) {
-    ImmutableSet<Key<Registry>> keys =
-        filterValues(cache.get(), equalTo(type)).keySet().stream()
-            .map(tld -> Key.create(getCrossTldKey(), Registry.class, tld))
-            .collect(toImmutableSet());
-    return ImmutableSet.copyOf(tm().doTransactionless(() -> ofy().load().keys(keys).values()));
+    return Registry.getAll(filterValues(cache.get(), equalTo(type)).keySet());
  }

  /** Pass-through check that the specified TLD exists, otherwise throw an IAE. */
@@ -18,6 +18,8 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Predicates.equalTo;
 import static com.google.common.base.Predicates.not;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.collect.Maps.toMap;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.ofy.ObjectifyService.ofy;
@@ -30,12 +32,15 @@ import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static org.joda.money.CurrencyUnit.USD;

 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Joiner;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.LoadingCache;
+import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
+import com.google.common.collect.Maps;
 import com.google.common.collect.Ordering;
 import com.google.common.collect.Range;
 import com.google.common.net.InternetDomainName;
@@ -58,8 +63,10 @@ import google.registry.model.domain.fee.Fee;
 import google.registry.model.registry.label.PremiumList;
 import google.registry.model.registry.label.ReservedList;
 import google.registry.util.Idn;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import java.util.concurrent.ExecutionException;
 import java.util.function.Predicate;
 import java.util.regex.Pattern;
 import javax.annotation.Nullable;
@@ -201,6 +208,25 @@ public class Registry extends ImmutableObject implements Buildable {
    return registry;
  }

+  /** Returns the registry entities for the given TLD strings, throwing if any don't exist. */
+  static ImmutableSet<Registry> getAll(Set<String> tlds) {
+    try {
+      ImmutableMap<String, Optional<Registry>> registries = CACHE.getAll(tlds);
+      ImmutableSet<String> missingRegistries =
+          registries.entrySet().stream()
+              .filter(e -> !e.getValue().isPresent())
+              .map(Map.Entry::getKey)
+              .collect(toImmutableSet());
+      if (missingRegistries.isEmpty()) {
+        return registries.values().stream().map(Optional::get).collect(toImmutableSet());
+      } else {
+        throw new RegistryNotFoundException(missingRegistries);
+      }
+    } catch (ExecutionException e) {
+      throw new RuntimeException("Unexpected error retrieving TLDs " + tlds, e);
+    }
+  }
+
  /**
   * Invalidates the cache entry.
   *
@@ -220,15 +246,27 @@ public class Registry extends ImmutableObject implements Buildable {
              new CacheLoader<String, Optional<Registry>>() {
                @Override
                public Optional<Registry> load(final String tld) {
-                  // Enter a transactionless context briefly; we don't want to enroll every TLD in a
-                  // transaction that might be wrapping this call.
+                  // Enter a transaction-less context briefly; we don't want to enroll every TLD in
+                  // a transaction that might be wrapping this call.
                  return Optional.ofNullable(
-                      tm()
-                          .doTransactionless(
-                              () -> ofy()
-                                  .load()
-                                  .key(Key.create(getCrossTldKey(), Registry.class, tld))
-                                  .now()));
+                      tm().doTransactionless(
+                              () ->
+                                  ofy()
+                                      .load()
+                                      .key(Key.create(getCrossTldKey(), Registry.class, tld))
+                                      .now()));
+                }
+
+                @Override
+                public Map<String, Optional<Registry>> loadAll(Iterable<? extends String> tlds) {
+                  ImmutableMap<String, Key<Registry>> keysMap =
+                      toMap(
+                          ImmutableSet.copyOf(tlds),
+                          tld -> Key.create(getCrossTldKey(), Registry.class, tld));
+                  Map<Key<Registry>, Registry> entities =
+                      tm().doTransactionless(() -> ofy().load().keys(keysMap.values()));
+                  return Maps.transformEntries(
+                      keysMap, (k, v) -> Optional.ofNullable(entities.getOrDefault(v, null)));
                }
              });

@@ -883,10 +921,14 @@ public class Registry extends ImmutableObject implements Buildable {
    }
  }

-  /** Exception to throw when no Registry is found for a given tld. */
+  /** Exception to throw when no Registry entity is found for given TLD string(s). */
  public static class RegistryNotFoundException extends RuntimeException {
+    RegistryNotFoundException(ImmutableSet<String> tlds) {
+      super("No registry object(s) found for " + Joiner.on(", ").join(tlds));
+    }
+
    RegistryNotFoundException(String tld) {
-      super("No registry object found for " + tld);
+      this(ImmutableSet.of(tld));
    }
  }
 }
@@ -16,6 +16,7 @@ package google.registry.model.transaction;

 import com.google.common.flogger.FluentLogger;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 import javax.persistence.EntityManager;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.EntityTransaction;
@@ -63,11 +64,11 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
    // TODO(shicong): Investigate removing transactNew functionality after migration as it may
    //  be same as this one.
    if (inTransaction()) {
-      return work.run();
+      return work.get();
    }
    TransactionInfo txnInfo = transactionInfo.get();
    txnInfo.entityManager = emf.createEntityManager();
@@ -76,7 +77,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
      txn.begin();
      txnInfo.inTransaction = true;
      txnInfo.transactionTime = clock.nowUtc();
-      T result = work.run();
+      T result = work.get();
      txn.commit();
      return result;
    } catch (RuntimeException e) {
@@ -102,7 +103,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
    // TODO(shicong): Implements the functionality to start a new transaction.
    throw new UnsupportedOperationException();
  }
@@ -114,7 +115,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transactNewReadOnly(Work<T> work) {
+  public <T> T transactNewReadOnly(Supplier<T> work) {
    // TODO(shicong): Implements read only transaction.
    throw new UnsupportedOperationException();
  }
@@ -126,7 +127,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T doTransactionless(Work<T> work) {
+  public <T> T doTransactionless(Supplier<T> work) {
    // TODO(shicong): Implements doTransactionless.
    throw new UnsupportedOperationException();
  }
@@ -14,6 +14,7 @@

 package google.registry.model.transaction;

+import java.util.function.Supplier;
 import org.joda.time.DateTime;

 /**
@@ -21,12 +22,6 @@ import org.joda.time.DateTime;
 */
 public interface TransactionManager {

-  /** This functional interface defines a method to execute a work and return the result. */
-  @FunctionalInterface
-  interface Work<R> {
-    R run();
-  }
-
  /** Returns {@code true} if the caller is in a transaction.
   *
   *  <p>Note that this function is kept for backward compatibility. We will review the use case
@@ -42,18 +37,19 @@ public interface TransactionManager {
  void assertInTransaction();

  /** Executes the work in a transaction and returns the result. */
-  <T> T transact(Work<T> work);
+  <T> T transact(Supplier<T> work);

  /** Executes the work in a transaction. */
  void transact(Runnable work);

-  /** Pauses the current transaction (if any), executes the work in a new transaction
-   *  and returns the result.
+  /**
+   * Pauses the current transaction (if any), executes the work in a new transaction and returns the
+   * result.
   *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
   */
-  <T> T transactNew(Work<T> work);
+  <T> T transactNew(Supplier<T> work);

  /** Pauses the current transaction (if any) and executes the work in a new transaction.
   *
@@ -62,12 +58,13 @@ public interface TransactionManager {
   */
  void transactNew(Runnable work);

-  /** Executes the work in a read-only transaction and returns the result.
+  /**
+   * Executes the work in a read-only transaction and returns the result.
   *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
   */
-  <R> R transactNewReadOnly(Work<R> work);
+  <R> R transactNewReadOnly(Supplier<R> work);

  /** Executes the work in a read-only transaction.
   *
@@ -77,7 +74,7 @@ public interface TransactionManager {
  void transactNewReadOnly(Runnable work);

  /** Executes the work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work);
+  <R> R doTransactionless(Supplier<R> work);

  /** Returns the time associated with the start of this particular transaction attempt. */
  DateTime getTransactionTime();
@@ -58,7 +58,7 @@ import org.joda.time.DateTime;
    path = BrdaCopyAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class BrdaCopyAction implements Runnable {

  static final String PATH = "/_dr/task/brdaCopy";
@@ -53,7 +53,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = RdeReportAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeReportAction implements Runnable, EscrowTask {

  static final String PATH = "/_dr/task/rdeReport";
@@ -195,7 +195,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = RdeStagingAction.PATH,
    method = {GET, POST},
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeStagingAction implements Runnable {

  public static final String PATH = "/_dr/task/rdeStaging";
@@ -84,7 +84,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = RdeUploadAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeUploadAction implements Runnable, EscrowTask {

  static final String PATH = "/_dr/task/rdeUpload";
@@ -50,7 +50,7 @@ import org.joda.time.YearMonth;
    service = Action.Service.BACKEND,
    path = GenerateInvoicesAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateInvoicesAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -68,7 +68,7 @@ import org.joda.time.format.DateTimeFormat;
    service = Action.Service.BACKEND,
    path = IcannReportingStagingAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class IcannReportingStagingAction implements Runnable {

  static final String PATH = "/_dr/task/icannReportingStaging";
@@ -15,34 +15,51 @@
 package google.registry.reporting.icann;

 import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
+import static google.registry.model.common.Cursor.getCursorTimeOrStartOfTime;
+import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.reporting.icann.IcannReportingModule.MANIFEST_FILE_NAME;
 import static google.registry.reporting.icann.IcannReportingModule.PARAM_SUBDIR;
 import static google.registry.request.Action.Method.POST;
-import static java.nio.charset.StandardCharsets.UTF_8;
 import static javax.servlet.http.HttpServletResponse.SC_OK;

 import com.google.appengine.tools.cloudstorage.GcsFilename;
-import com.google.common.base.Splitter;
-import com.google.common.collect.ImmutableList;
+import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.io.ByteStreams;
+import com.googlecode.objectify.Key;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.gcs.GcsUtils;
+import google.registry.model.common.Cursor;
+import google.registry.model.common.Cursor.CursorType;
+import google.registry.model.registry.Registries;
+import google.registry.model.registry.Registry;
+import google.registry.model.registry.Registry.TldType;
 import google.registry.request.Action;
+import google.registry.request.HttpException.ServiceUnavailableException;
 import google.registry.request.Parameter;
 import google.registry.request.Response;
 import google.registry.request.auth.Auth;
+import google.registry.request.lock.LockHandler;
+import google.registry.util.Clock;
 import google.registry.util.EmailMessage;
 import google.registry.util.Retrier;
 import google.registry.util.SendEmailService;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.Map;
+import java.util.concurrent.Callable;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
+import javax.annotation.Nullable;
 import javax.inject.Inject;
 import javax.mail.internet.InternetAddress;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;

 /**
 * Action that uploads the monthly activity/transactions reports from GCS to ICANN via an HTTP PUT.
@@ -81,44 +98,175 @@ public final class IcannReportingUploadAction implements Runnable {
  @Inject @Config("gSuiteOutgoingEmailAddress") InternetAddress sender;
  @Inject @Config("alertRecipientEmailAddress") InternetAddress recipient;
  @Inject SendEmailService emailService;
+  @Inject Clock clock;
+  @Inject LockHandler lockHandler;
+
  @Inject
  IcannReportingUploadAction() {}

  @Override
  public void run() {
-    String reportBucketname = String.format("%s/%s", reportingBucket, subdir);
-    ImmutableList<String> manifestedFiles = getManifestedFiles(reportBucketname);
-    ImmutableMap.Builder<String, Boolean> reportSummaryBuilder = new ImmutableMap.Builder<>();
-    // Report on all manifested files
-    for (String reportFilename : manifestedFiles) {
-      logger.atInfo().log(
-          "Reading ICANN report %s from bucket %s", reportFilename, reportBucketname);
-      final GcsFilename gcsFilename = new GcsFilename(reportBucketname, reportFilename);
-      verifyFileExists(gcsFilename);
-      boolean success = false;
-      try {
-        success =
-            retrier.callWithRetry(
-                () -> {
-                  final byte[] payload = readBytesFromGcs(gcsFilename);
-                  return icannReporter.send(payload, reportFilename);
-                },
-                IcannReportingUploadAction::isUploadFailureRetryable);
-      } catch (RuntimeException e) {
-        logger.atWarning().withCause(e).log("Upload to %s failed.", gcsFilename);
-      }
-      reportSummaryBuilder.put(reportFilename, success);
+    Callable<Void> lockRunner =
+        () -> {
+          ImmutableMap.Builder<String, Boolean> reportSummaryBuilder = new ImmutableMap.Builder<>();
+
+          ImmutableMap<Cursor, CursorInfo> cursors = loadCursors();
+
+          // If cursor time is before now, upload the corresponding report
+          cursors.entrySet().stream()
+              .filter(entry -> getCursorTimeOrStartOfTime(entry.getKey()).isBefore(clock.nowUtc()))
+              .forEach(
+                  entry -> {
+                    DateTime cursorTime = getCursorTimeOrStartOfTime(entry.getKey());
+                    uploadReport(
+                        cursorTime,
+                        entry.getValue().getType(),
+                        entry.getValue().getTld(),
+                        reportSummaryBuilder);
+                  });
+          // Send email of which reports were uploaded
+          emailUploadResults(reportSummaryBuilder.build());
+          response.setStatus(SC_OK);
+          response.setContentType(PLAIN_TEXT_UTF_8);
+          return null;
+        };
+
+    String lockname = "IcannReportingUploadAction";
+    if (!lockHandler.executeWithLocks(lockRunner, null, Duration.standardHours(2), lockname)) {
+      throw new ServiceUnavailableException("Lock for IcannReportingUploadAction already in use");
    }
-    emailUploadResults(reportSummaryBuilder.build());
-    response.setStatus(SC_OK);
-    response.setContentType(PLAIN_TEXT_UTF_8);
-    response.setPayload(
-        String.format("OK, attempted uploading %d reports", manifestedFiles.size()));
+  }
+
+  /** Uploads the report and rolls forward the cursor for that report. */
+  private void uploadReport(
+      DateTime cursorTime,
+      CursorType cursorType,
+      String tldStr,
+      ImmutableMap.Builder<String, Boolean> reportSummaryBuilder) {
+    String reportBucketname = String.format("%s/%s", reportingBucket, subdir);
+    String filename = getFileName(cursorType, cursorTime, tldStr);
+    final GcsFilename gcsFilename = new GcsFilename(reportBucketname, filename);
+    logger.atInfo().log("Reading ICANN report %s from bucket %s", filename, reportBucketname);
+    // Check that the report exists
+    try {
+      verifyFileExists(gcsFilename);
+    } catch (IllegalArgumentException e) {
+      String logMessage =
+          String.format(
+              "Could not upload %s report for %s because file %s did not exist.",
+              cursorType, tldStr, filename);
+      if (clock.nowUtc().dayOfMonth().get() == 1) {
+        logger.atInfo().withCause(e).log(logMessage + " This report may not have been staged yet.");
+      } else {
+        logger.atSevere().withCause(e).log(logMessage);
+      }
+      reportSummaryBuilder.put(filename, false);
+      return;
+    }
+
+    // Upload the report
+    boolean success = false;
+    try {
+      success =
+          retrier.callWithRetry(
+              () -> {
+                final byte[] payload = readBytesFromGcs(gcsFilename);
+                return icannReporter.send(payload, filename);
+              },
+              IcannReportingUploadAction::isUploadFailureRetryable);
+    } catch (RuntimeException e) {
+      logger.atWarning().withCause(e).log("Upload to %s failed", gcsFilename);
+    }
+    reportSummaryBuilder.put(filename, success);
+
+    // Set cursor to first day of next month if the upload succeeded
+    if (success) {
+      Cursor newCursor;
+      if (cursorType.equals(CursorType.ICANN_UPLOAD_MANIFEST)) {
+        newCursor =
+            Cursor.createGlobal(
+                cursorType, cursorTime.withTimeAtStartOfDay().withDayOfMonth(1).plusMonths(1));
+      } else {
+        newCursor =
+            Cursor.create(
+                cursorType,
+                cursorTime.withTimeAtStartOfDay().withDayOfMonth(1).plusMonths(1),
+                Registry.get(tldStr));
+      }
+      tm().transact(() -> ofy().save().entity(newCursor));
+    }
+  }
+
+  private String getFileName(CursorType cursorType, DateTime cursorTime, String tld) {
+    if (cursorType.equals(CursorType.ICANN_UPLOAD_MANIFEST)) {
+      return MANIFEST_FILE_NAME;
+    }
+    return String.format(
+        "%s%s%d%02d.csv",
+        tld,
+        (cursorType.equals(CursorType.ICANN_UPLOAD_ACTIVITY) ? "-activity-" : "-transactions-"),
+        cursorTime.year().get(),
+        cursorTime.monthOfYear().get());
+  }
+
+  /** Returns a map of each cursor to the CursorType and tld. */
+  private ImmutableMap<Cursor, CursorInfo> loadCursors() {
+
+    ImmutableSet<Registry> registries = Registries.getTldEntitiesOfType(TldType.REAL);
+
+    Map<Key<Cursor>, Registry> activityKeyMap =
+        loadKeyMap(registries, CursorType.ICANN_UPLOAD_ACTIVITY);
+    Map<Key<Cursor>, Registry> transactionKeyMap =
+        loadKeyMap(registries, CursorType.ICANN_UPLOAD_TX);
+
+    ImmutableSet.Builder<Key<Cursor>> keys = new ImmutableSet.Builder<>();
+    keys.addAll(activityKeyMap.keySet());
+    keys.addAll(transactionKeyMap.keySet());
+    keys.add(Cursor.createGlobalKey(CursorType.ICANN_UPLOAD_MANIFEST));
+
+    Map<Key<Cursor>, Cursor> cursorMap = ofy().load().keys(keys.build());
+    ImmutableMap.Builder<Cursor, CursorInfo> cursors = new ImmutableMap.Builder<>();
+    defaultNullCursorsToNextMonthAndAddToMap(
+        activityKeyMap, CursorType.ICANN_UPLOAD_ACTIVITY, cursorMap, cursors);
+    defaultNullCursorsToNextMonthAndAddToMap(
+        transactionKeyMap, CursorType.ICANN_UPLOAD_TX, cursorMap, cursors);
+    Cursor manifestCursor =
+        cursorMap.getOrDefault(
+            Cursor.createGlobalKey(CursorType.ICANN_UPLOAD_MANIFEST),
+            Cursor.createGlobal(CursorType.ICANN_UPLOAD_MANIFEST, clock.nowUtc().minusDays(1)));
+    cursors.put(manifestCursor, CursorInfo.create(CursorType.ICANN_UPLOAD_MANIFEST, null));
+    return cursors.build();
+  }
+
+  private Map<Key<Cursor>, Registry> loadKeyMap(
+      ImmutableSet<Registry> registries, CursorType type) {
+    return registries.stream().collect(toImmutableMap(r -> Cursor.createKey(type, r), r -> r));
+  }
+
+  /**
+   * Populate the cursors map with the Cursor and CursorInfo for each key in the keyMap. If the key
+   * from the keyMap does not have an existing cursor, create a new cursor with a default cursorTime
+   * of the first of next month.
+   */
+  private void defaultNullCursorsToNextMonthAndAddToMap(
+      Map<Key<Cursor>, Registry> keyMap,
+      CursorType type,
+      Map<Key<Cursor>, Cursor> cursorMap,
+      ImmutableMap.Builder<Cursor, CursorInfo> cursors) {
+    keyMap.forEach(
+        (key, registry) -> {
+          // Cursor time is defaulted to the first of next month since a new tld will not yet have a
+          // report staged for upload.
+          Cursor cursor =
+              cursorMap.getOrDefault(
+                  key, Cursor.create(type, clock.nowUtc().minusDays(1), registry));
+          cursors.put(cursor, CursorInfo.create(type, registry.getTldStr()));
+        });
  }

  /** Don't retry when reports are already uploaded or can't be uploaded. */
  private static final String ICANN_UPLOAD_PERMANENT_ERROR_MESSAGE =
-      "A report for that month already exists, the cut-off date already passed.";
+      "A report for that month already exists, the cut-off date already passed";

  /** Don't retry when the IP address isn't whitelisted, as retries go through the same IP. */
  private static final Pattern ICANN_UPLOAD_WHITELIST_ERROR =
@@ -146,18 +294,6 @@ public final class IcannReportingUploadAction implements Runnable {
    emailService.sendEmail(EmailMessage.create(subject, body, recipient, sender));
  }

-  private ImmutableList<String> getManifestedFiles(String reportBucketname) {
-    GcsFilename manifestFilename = new GcsFilename(reportBucketname, MANIFEST_FILE_NAME);
-    verifyFileExists(manifestFilename);
-    return retrier.callWithRetry(
-        () ->
-            ImmutableList.copyOf(
-                Splitter.on('\n')
-                    .omitEmptyStrings()
-                    .split(new String(readBytesFromGcs(manifestFilename), UTF_8))),
-        IOException.class);
-  }
-
  private byte[] readBytesFromGcs(GcsFilename reportFilename) throws IOException {
    try (InputStream gcsInput = gcsUtils.openInputStream(reportFilename)) {
      return ByteStreams.toByteArray(gcsInput);
@@ -171,4 +307,16 @@ public final class IcannReportingUploadAction implements Runnable {
        gcsFilename.getObjectName(),
        gcsFilename.getBucketName());
  }
+
+  @AutoValue
+  abstract static class CursorInfo {
+    static CursorInfo create(CursorType type, @Nullable String tld) {
+      return new AutoValue_IcannReportingUploadAction_CursorInfo(type, tld);
+    }
+
+    public abstract CursorType getType();
+
+    @Nullable
+    abstract String getTld();
+  }
 }
@@ -49,7 +49,7 @@ import org.joda.time.LocalDate;
    service = Action.Service.BACKEND,
    path = GenerateSpec11ReportAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateSpec11ReportAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -73,15 +73,7 @@ public enum Auth {
  AUTH_INTERNAL_OR_ADMIN(
      ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API),
      AuthLevel.APP,
-      UserPolicy.ADMIN),
-
-  /**
-   * Allows only internal (App Engine task-queue) access.
-   */
-  AUTH_INTERNAL_ONLY(
-      ImmutableList.of(AuthMethod.INTERNAL),
-      AuthLevel.APP,
-      UserPolicy.IGNORED);
+      UserPolicy.ADMIN);

  private final AuthSettings authSettings;

@@ -0,0 +1,147 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static com.google.common.base.Preconditions.checkState;
+
+import com.google.common.collect.ImmutableMap;
+import google.registry.model.CreateAutoTimestamp;
+import google.registry.model.ImmutableObject;
+import google.registry.model.registry.label.ReservationType;
+import java.util.Map;
+import javax.annotation.Nullable;
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Embeddable;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Index;
+import javax.persistence.JoinColumn;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.Table;
+import org.joda.time.DateTime;
+
+/**
+ * A list of reserved domain labels that are blocked from being registered for various reasons.
+ *
+ * <p>Note that the primary key of this entity is {@link #revisionId}, which is auto-generated by
+ * the database. So, if a retry of insertion happens after the previous attempt unexpectedly
+ * succeeds, we will end up with having two exact same reserved lists that differ only by
+ * revisionId. This is fine though, because we only use the list with the highest revisionId.
+ */
+@Entity
+@Table(indexes = {@Index(columnList = "name", name = "reservedlist_name_idx")})
+public class ReservedList extends ImmutableObject {
+
+  @Column(nullable = false)
+  private String name;
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  @Column(nullable = false)
+  private Long revisionId;
+
+  @Column(nullable = false)
+  private CreateAutoTimestamp creationTimestamp = CreateAutoTimestamp.create(null);
+
+  @Column(nullable = false)
+  private Boolean shouldPublish;
+
+  @ElementCollection
+  @CollectionTable(
+      name = "ReservedEntry",
+      joinColumns = @JoinColumn(name = "revisionId", referencedColumnName = "revisionId"))
+  @MapKeyColumn(name = "domainLabel")
+  private Map<String, ReservedEntry> labelsToReservations;
+
+  @Embeddable
+  public static class ReservedEntry extends ImmutableObject {
+    @Column(nullable = false)
+    private ReservationType reservationType;
+
+    @Column(nullable = true)
+    private String comment;
+
+    private ReservedEntry(ReservationType reservationType, @Nullable String comment) {
+      this.reservationType = reservationType;
+      this.comment = comment;
+    }
+
+    // Hibernate requires this default constructor.
+    private ReservedEntry() {}
+
+    /** Constructs a {@link ReservedEntry} object. */
+    public static ReservedEntry create(ReservationType reservationType, @Nullable String comment) {
+      return new ReservedEntry(reservationType, comment);
+    }
+
+    /** Returns the reservation type for this entry. */
+    public ReservationType getReservationType() {
+      return reservationType;
+    }
+
+    /** Returns the comment for this entry. Retruns null if there is no comment. */
+    public String getComment() {
+      return comment;
+    }
+  }
+
+  private ReservedList(
+      String name, Boolean shouldPublish, Map<String, ReservedEntry> labelsToReservations) {
+    this.name = name;
+    this.shouldPublish = shouldPublish;
+    this.labelsToReservations = labelsToReservations;
+  }
+
+  // Hibernate requires this default constructor.
+  private ReservedList() {}
+
+  /** Constructs a {@link ReservedList} object. */
+  public static ReservedList create(
+      String name, Boolean shouldPublish, Map<String, ReservedEntry> labelsToReservations) {
+    return new ReservedList(name, shouldPublish, labelsToReservations);
+  }
+
+  /** Returns the name of the reserved list. */
+  public String getName() {
+    return name;
+  }
+
+  /** Returns the ID of this revision, or throws if null. */
+  public Long getRevisionId() {
+    checkState(
+        revisionId != null,
+        "revisionId is null because this object has not been persisted to the database yet");
+    return revisionId;
+  }
+
+  /** Returns the creation time of this revision of the reserved list. */
+  public DateTime getCreationTimestamp() {
+    return creationTimestamp.getTimestamp();
+  }
+
+  /** Returns a {@link Map} of domain labels to {@link ReservedEntry}. */
+  public ImmutableMap<String, ReservedEntry> getLabelsToReservations() {
+    return ImmutableMap.copyOf(labelsToReservations);
+  }
+
+  /** Returns true if the reserved list should be published. */
+  public Boolean getShouldPublish() {
+    return shouldPublish;
+  }
+}
@@ -74,7 +74,7 @@ import org.joda.time.Duration;
    path = NordnUploadAction.PATH,
    method = Action.Method.POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnUploadAction implements Runnable {

  static final String PATH = "/_dr/task/nordnUpload";
@@ -56,7 +56,7 @@ import javax.inject.Inject;
    path = NordnVerifyAction.PATH,
    method = Action.Method.POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnVerifyAction implements Runnable {

  static final String PATH = "/_dr/task/nordnVerify";
@@ -32,7 +32,7 @@ import javax.inject.Inject;
    path = "/_dr/task/tmchCrl",
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchCrlAction implements Runnable {

  @Inject Marksdb marksdb;
@@ -36,7 +36,7 @@ import org.bouncycastle.openpgp.PGPException;
    path = "/_dr/task/tmchDnl",
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchDnlAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -34,7 +34,7 @@ import org.bouncycastle.openpgp.PGPException;
    path = "/_dr/task/tmchSmdrl",
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchSmdrlAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
@@ -104,6 +104,8 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
    // Create all command instances. It would be preferrable to do this in the constructor, but
    // JCommander mutates the command instances and doesn't reset them so we have to do it for every
    // run.
+    // TODO(weiminyu): extract this into a standalone static method to simplify
+    //   :core:registryToolIntegrationTest
    try {
      for (Map.Entry<String, ? extends Class<? extends Command>> entry : commands.entrySet()) {
        Command command = entry.getValue().getDeclaredConstructor().newInstance();
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Weimin Yu	bba5aff4b6	Verify RegistryTool can instantiate (#400 ) * Verify RegistryTool can instantiate Add a task that instantiates all command classes in RegistryTool with runtimeClasspath. Also make sure that runtimeClasspath is a superset of compileClasspath.	2019-12-06 12:08:16 -05:00
Michael Muller	df7d272157	Adding junit back into the runtime classpath (#399 ) * Adding junit back into the runtime classpath Unfortunately, GenerateSqlSchemaCommand depends on junit via testcontainers. We should really move GenerateSqlSchemaCommand out of nomulus tool (we only use it during development) but this gets nomulus tool working for the time being. * Removed unnnecessary trace line. * lockfiles generated after update_dependency.sh	2019-12-05 16:01:05 -05:00
Shicong Huang	988f78274e	Check SQL dependency in super class for SqlIntegrationMembershipTest (#398 ) In some cases, we define JpaTransactionManagerRule in a TestCase class which is extended by the concrete test class. So, we need to check if JpaTransactionManagerRule is also defined in the super class.	2019-12-05 13:12:56 -05:00
Lai Jiang	369c1259fb	Remove AUTH_INTERNAL_ONLY (#393 ) Endpoints annotated with AUTH_INTERNAL_ONLY used to be accessible manually with an internal RPC tool that adds App Engine specific HTTP headers to a request to make it look like it comes from App Engine (hence internal). This tool is used by admins to hit such endpoints during debugging, making them effectively AUTH_INTERNAL_OR_ADMIN. This RPC tool has never been made available outside Google so the open source admins do not have such ability. A recent change in the RPC tool made this hack stop working internally as well. This PR replaces all all occurances of AUTH_INTERNAL_ONLY with AUTH_INTERNAL_OR_ADMIN and brings the open source build into feature parity with the internal version. Also fixed a few issues the router tests.	2019-12-04 12:52:18 -05:00
Michael Muller	1e1c8cdd80	Replace TransactionManager.Work with Supplier (#397 ) * Replace TransactionManager.Work with Supplier Replace the "Work" class with the equivalent java.util.function.Supplier.	2019-12-04 12:00:13 -05:00
Weimin Yu	3d3d390a9f	Fix bad dependency lock file (#396 ) * Fix bad dependency lock file	2019-12-03 13:31:57 -05:00
Weimin Yu	f0fc53e035	Allow project dependency to use runtimeClasspath (#395 ) * Allow project dependency to use runtimeClasspath Project dependency should use runtimeClasspath. However, if left unspecified, it uses 'default', which is the same as the legacy 'runtime' configuration. (runtimeOnly dependencies are left out). Since runtimeClasspath cannot be referenced directly, we use a custom config (deploy_jar) as a proxy. By excluding testjars (leaked into 'compile' by third-party dependencies) from runtimeClasspath, we prevent them from getting into release artifacts. Two meaningful changes in appengine_war.gradle and java_common.gradle TESTED=Diffed contents of services/{module}/build/exploded-* Only three jars are removed: hamcrest-core, junit, and mockito-core.	2019-12-02 16:10:13 -05:00
Lai Jiang	c156842844	Upgrade to Gradle 6.0.1 (#394 )	2019-12-02 15:24:18 -05:00
Lai Jiang	c584de9f72	Respect certificate validity period (#391 ) Client SSL handler already performs the necessary validation. Only tests are added. Server SSL handler does not currently check for the validity period of the client certificate as the insecure trust manager is used. This PR added the check but does not actually terminate the connection yet. It will log the expired certificates so that we can contact the registrars to update them. Once we are certain that all certificates are updated, we can turn off dryrun mode. We should also consider checking if the certificate has too long a validity period as it defeats the purpose of using regularly updated certificates to deprecate insecure cipher suites.	2019-11-27 16:08:38 -05:00
Shicong Huang	9be5091c84	Add entity for reserved list (#381 ) This PR added the Cloud SQL entity for reserved list.	2019-11-26 16:51:41 -05:00
Michael Muller	28499d23a0	Print filenames that need to be reformatted (#386 ) * Print filenames that need to be reformatted Print the names of all java files that need reformatting during the check and reformat operations.	2019-11-26 13:20:27 -05:00
Ben McIlwain	961d7e88f4	Use Maps.transformEntries() utility method to improve Map composition (#387 ) * Use Maps.transformEntries() utility method to improve Map composition	2019-11-26 12:20:00 -05:00
Weimin Yu	215de62fa7	Stop publish Cloud SQL schema jar to maven repo (#383 ) * Stop publish Cloud SQL schema jar to maven repo The original purpose of the maven publication is for use in server/schema compatibility tests. A commandline flag can direct a test run to use different versions of the schema jar. However, this won't work due to dependency locking.	2019-11-25 18:23:02 -05:00
Lai Jiang	05d56fe1a2	Remove SSL initializer from the prober (#378 ) The prober now uses the common SSL initializer in the networking subproject. Also changed both initializers to take an ImmutableList of certificates other than an array of those, for better immutability. I have no idea where these lockfile changes are coming from. They seem to be pure noise as far as code review is concerned.	2019-11-22 17:46:06 -05:00
sarahcaseybot	e318f47fc6	Add a cursor for tracking monthly uploads of ICANN report (#343 ) * Add a cursor for tracking monthly uploads of the transaction report to ICANN * Add cursors to track activity, transaction, and manifest report uploads. * Address comments * Add @Nullable annotation to manifestCursor * Add lock and batch load cursors. * Add string formatting, autovalue CursorInfo object, and handling for null cursors * Add some helper functions for loadCursors and restructure to require less round trips to the database * Switch new cursors to be created with cursorTime at first of next month	2019-11-22 17:40:31 -05:00
Lai Jiang	cc5f62587e	Make dev project configurable (#371 ) * Make dev project configurable We should not hardcode our dev project in the public config file. * Remove the use of .ext when using external properties They are only needed when defining properties.	2019-11-22 16:20:07 -05:00
Lai Jiang	02846bcbdd	No-op: Use nicer HCL2 syntax. (#384 ) Generated with perl -pi -e 's/\"\$\{([a-zA-Z0-9._-])\}\"/$1/g' $(find ./ -name '.tf') Copied from cl/282012376.	2019-11-22 16:08:56 -05:00
Ben McIlwain	c920f709ef	Update the Registries cache to leverage/populate the Registry cache (#382 ) * Update the Registries cache to leverage/populate the Registry cache This is accomplished by also providing a loadAll() method on the Registry cache that can be used to load an entire batch of Registry objects at once. This improves efficiency, because now, any operation on Registries that loads all the Registry entities (getTlds(), getTldsOfType(), and getTldEntities()), is plumbed through the Registry cache, therefore loading it from that cache if it exists and only hitting the DB if not. If not, this populates the Registry cache upon loading, so that subsequent calls to Registry.get() will now hit the cache instead of the DB. To give a concrete example, the following code: for (String tld : Registries.getTlds()) { // ... doSomethingWith(Registry.get(tld)); // ... } is now much more efficient, because the initial call to Registries.getTlds() populates all the entities in cache, and the subsequent individual calls to Registry.get(tld) now retrieve them from the cache. Prior to this change, Registries.getTlds() did not populate the Registry cache, and each subsequent Registry.get(tld) had the potential to trigger an individual round-trip to the DB, which is obviously bad for performance.	2019-11-22 14:47:09 -05:00
Ben McIlwain	ad9daac1ab	Update premium and reserved list management docs (#380 ) * Update premium and reserved list management docs They were a little bit out of date.	2019-11-21 16:44:45 -05:00
Weimin Yu	9f0e24132a	Break circular dependency between core and util (#379 ) * Break circular dependency between core and util Created a new :common project and moved a minimum number of classes to break the circular dependency between the two projects. This gets rid of the gradle lint dependency warnings. Also separated api classes and testing helpers into separate source sets in :common so that testing classes may be restricted to test configurations.	2019-11-21 15:36:55 -05:00
Shicong Huang	98414cb7cb	Add a test to verify generated schema (#377 )	2019-11-21 13:37:37 -05:00
Lai Jiang	6af1896362	Refactor common code used by the proxy and the prober (#375 )	2019-11-20 12:42:44 -05:00
Weimin Yu	68887d427f	Allow schema-loading from arbitrary url in tests (#374 ) * Allow schema-loading from arbitrary url in tests Server/Schema compatibility tests must be able to load different versions of the SQL schema. This change allows test runners to override the schema location using a system property. Note: due to dependency-locking, we cannot manipulate the dependencies closure in the build script to load different schema jars. The jars must not be on the classpath.	2019-11-20 12:22:48 -05:00