Fix test on use of external schema jar (#412)

* Fix test on use of external schema jar

One test breaks if path to external schema is set and
test is run from the sqlIntegrationTest task.

appengine_war.gradle

@@ -81,7 +81,7 @@ appengine {
 }
 
 dependencies {
-    compile project(':core')
+    compile project(path: ':core', configuration: 'deploy_jar')
 }
 
 // The tools.jar file gets pulled in from the java environment and for some

build.gradle

@@ -221,9 +221,18 @@ subprojects {
   }
 
   afterEvaluate {
-    if (rootProject.enableDependencyLocking.toBoolean()) {
-      // Lock application dependencies except for the gradle-license-report
-      // plugin. See dependency_lic.gradle for the reason why.
+    if (rootProject.enableDependencyLocking.toBoolean()
+        && project.name != 'integration') {
+      // The ':integration' project runs server/schema integration tests using
+      // dynamically specified jars with no transitive dependency. Therefore
+      // dependency-locking does not make sense. Furthermore, during
+      // evaluation it resolves the 'testRuntime' configuration, making it
+      // immutable. Locking activation would trigger an invalid operation
+      // exception.
+      //
+      // For all other projects, due to problem with the gradle-license-report
+      // plugin, the dependencyLicenseReport configuration must opt out of
+      // dependency-locking. See dependency_lic.gradle for the reason why.
       //
       // To selectively activate dependency locking without hardcoding them
       // in the 'configurations' block, the following code must run after

buildSrc/gradle/dependency-locks/deploy_jar.lockfile

@@ -0,0 +1,61 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.google.api-client:google-api-client:1.27.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-httpjson:0.52.1
+com.google.api:gax:1.35.1
+com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.cloud:google-cloud-core-http:1.59.0
+com.google.cloud:google-cloud-core:1.59.0
+com.google.cloud:google-cloud-storage:1.59.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.7
+com.google.common.html.types:types:1.0.4
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.0-beta1
+com.google.http-client:google-http-client-appengine:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.oauth-client:google-oauth-client:1.27.0
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.template:soy:2018-03-14
+com.ibm.icu:icu4j:57.1
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+javax.annotation:javax.annotation-api:1.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.validation:validation-api:1.0.0.GA
+joda-time:joda-time:2.9.2
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.json:json:20160212
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.threeten:threetenbp:1.3.3

common/build.gradle

@@ -19,12 +19,21 @@ sourceSets {
       runtimeClasspath += main.output
     }
   }
+  test {
+    java {
+      compileClasspath += testing.output
+      runtimeClasspath += testing.output
+    }
+  }
 }
 
 configurations {
   testingCompile.extendsFrom compile
   testingRuntime.extendsFrom runtime
 
+  testCompile.extendsFrom testingCompile
+  testRuntime.extendsFrom testingRuntime
+
   // All testing util classes. Other projects may declare dependency as:
   // testCompile project(path: 'common', configuration: 'testing')
   testing
@@ -49,4 +58,9 @@ dependencies {
 
   testingCompile deps['com.google.flogger:flogger']
   testingRuntime deps['com.google.flogger:flogger-system-backend']
+  testingCompile deps['com.google.truth:truth']
+  testingCompile deps['io.github.java-diff-utils:java-diff-utils']
+
+  testCompile deps['junit:junit']
+  testCompile project(':third_party')
 }

common/gradle/dependency-locks/deploy_jar.lockfile

@@ -0,0 +1,13 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.google.code.findbugs:jsr305:3.0.2
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18

common/gradle/dependency-locks/testCompile.lockfile

@@ -1,13 +1,22 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -1,13 +1,22 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testRuntime.lockfile

@@ -1,13 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -1,13 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testingCompile.lockfile

@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger:0.1
@@ -8,7 +9,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testingCompileClasspath.lockfile

@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger:0.1
@@ -8,7 +9,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testingRuntime.lockfile

@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger-system-backend:0.1
@@ -9,7 +10,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/gradle/dependency-locks/testingRuntimeClasspath.lockfile

@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger-system-backend:0.1
@@ -9,7 +10,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3

common/src/test/java/google/registry/testing/truth/TextDiffSubjectTest.java

@@ -12,17 +12,17 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.testing;
+package google.registry.testing.truth;
 
 import static com.google.common.io.Resources.getResource;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.testing.JUnitBackports.assertThrows;
-import static google.registry.testing.TextDiffSubject.assertThat;
+import static google.registry.testing.truth.TextDiffSubject.assertThat;
 
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import com.google.common.io.Resources;
-import google.registry.testing.TextDiffSubject.DiffFormat;
+import google.registry.testing.truth.TextDiffSubject.DiffFormat;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import org.junit.Test;
@@ -33,15 +33,15 @@ import org.junit.runners.JUnit4;
 @RunWith(JUnit4.class)
 public class TextDiffSubjectTest {
 
+  private static final String RESOURCE_FOLDER = "google/registry/testing/truth/";
   // Resources for input data.
-  private static final String ACTUAL_RESOURCE = "google/registry/testing/text-diff-actual.txt";
-  private static final String EXPECTED_RESOURCE = "google/registry/testing/text-diff-expected.txt";
+  private static final String ACTUAL_RESOURCE = RESOURCE_FOLDER + "text-diff-actual.txt";
+  private static final String EXPECTED_RESOURCE = RESOURCE_FOLDER + "text-diff-expected.txt";
 
   // Resources for expected diff texts.
-  private static final String UNIFIED_DIFF_RESOURCE =
-      "google/registry/testing/text-unified-diff.txt";
+  private static final String UNIFIED_DIFF_RESOURCE = RESOURCE_FOLDER + "text-unified-diff.txt";
   private static final String SIDE_BY_SIDE_DIFF_RESOURCE =
-      "google/registry/testing/text-sidebyside-diff.txt";
+      RESOURCE_FOLDER + "text-sidebyside-diff.txt";
 
   @Test
   public void unifiedDiff_equal() throws IOException {

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.testing;
+package google.registry.testing.truth;
 
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.truth.Truth.assertAbout;

core/build.gradle

@@ -12,8 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import java.lang.reflect.Constructor
+
 plugins {
   id 'java-library'
+  id 'maven-publish'
 }
 
 // Path to code generated by ad hoc tasks in this project. A separate path is
@@ -110,6 +113,11 @@ configurations {
   soy
   closureCompiler
 
+  // Published jars that are used for server/schema compatibility tests.
+  // See <a href="../integration/README.md">the integration project</a>
+  // for details.
+  nomulus_test
+
   // Exclude non-canonical servlet-api jars. Our AppEngine deployment uses
   // javax.servlet:servlet-api:2.5
   // For reasons we do not understand, marking the following dependencies as
@@ -192,6 +200,7 @@ dependencies {
   testCompile deps['com.thoughtworks.qdox:qdox']
   compile deps['dnsjava:dnsjava']
   testCompile deps['io.github.classgraph:classgraph']
+  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
   testCompile deps['javax.annotation:javax.annotation-api']
   testCompile deps['javax.annotation:jsr250-api']
   compile deps['javax.inject:javax.inject']
@@ -660,6 +669,33 @@ task outcastTest(type: FilteringTest) {
   maxParallelForks 5
 }
 
+// Whitebox test verifying that RegistryTool can be instantiated. Note the
+// use of runtimeClasspath. This test emulates the logic in RegistryCli#run.
+// A to-do is added there to refactor.
+// TODO(weiminyu): Need a similar test for Registry server.
+task registryToolIntegrationTest {
+  dependsOn compileJava
+  doLast {
+    def classLoader =
+        new URLClassLoader(sourceSets.main.runtimeClasspath.collect {
+            it.toURI().toURL()
+        } as URL[])
+    def commandClasses =
+        (classLoader.loadClass('google.registry.tools.RegistryTool')
+            .getDeclaredField('COMMAND_MAP').get(null) as Map).values()
+
+    commandClasses.each {
+      try {
+        Constructor<?> c = ((Class<?>) it).getDeclaredConstructor()
+        c.setAccessible(true)
+        c.newInstance()
+      } catch (Throwable e) {
+        throw new RuntimeException("Failed to instantiate ${it}:\n ${e}")
+      }
+    }
+  }
+}
+
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
   systemProperties project.getProperties().subMap('sql_schema_resource_root')
@@ -779,11 +815,71 @@ test {
   // Don't run any tests from this task, all testing gets done in the
   // FilteringTest tasks.
   exclude "**"
-}.dependsOn(fragileTest, outcastTest, standardTest)
+}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest)
 
 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
 project.nomulus.dependsOn project(':third_party').jar
 
+// A jar with classes and resources from main sourceSet, excluding internal
+// data. See comments on configurations.nomulus_test above for details.
+task nomulusFossJar (type: Jar) {
+  archiveBaseName = 'nomulus'
+  archiveClassifier = 'public'
+  from (project.sourceSets.main.output) {
+    exclude 'google/registry/config/files/**'
+  }
+  from (project.sourceSets.main.output) {
+    include 'google/registry/config/files/default-config.yaml'
+    include 'google/registry/config/files/nomulus-config-unittest.yaml'
+  }
+}
+
+// An UberJar of registry test classes, resources and all dependencies.
+// See comments on configurations.nomulus_test above for details.
+// TODO(weiminyu): extract shareable code with root.ext.createUberJar
+task testUberJar (
+    type: com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
+  mergeServiceFiles()
+  archiveBaseName = 'nomulus-tests'
+  archiveClassifier = 'alldeps'
+  zip64 = true
+  archiveVersion = ''
+  configurations = [project.configurations.testRuntimeClasspath]
+  from project.sourceSets.test.output
+  // Excludes signature files that accompany some dependency jars, like
+  // bonuncycastle. If they are present, only classes from those signed jars are
+  // made available to the class loader.
+  // see https://discuss.gradle.org/t/signing-a-custom-gradle-plugin-thats-downloaded-by-the-build-system-from-github/1365
+  exclude "META-INF/*.SF", "META-INF/*.DSA", "META-INF/*.RSA"
+  // Exclude SQL schema, which is a test dependency.
+  exclude 'sql/flyway/**'
+  // ShadowJar includes java source files when used on sourceSets.test.output.
+  // They are not needed.
+  exclude '**/*.java'
+}
+
+artifacts {
+  nomulus_test nomulusFossJar
+  nomulus_test testUberJar
+}
+
+publishing {
+  repositories {
+    maven {
+      url project.publish_repo
+    }
+  }
+  publications {
+    nomulusTestsPublication(MavenPublication) {
+      groupId 'google.registry'
+      artifactId 'nomulus_test'
+      version project.nomulus_version
+      artifact nomulusFossJar
+      artifact testUberJar
+    }
+  }
+}
+
 task buildToolImage(dependsOn: nomulus, type: Exec) {
   commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }

core/gradle/dependency-locks/compile.lockfile

@@ -10,11 +10,11 @@ com.fasterxml.jackson.core:jackson-annotations:2.9.10
 com.fasterxml.jackson.core:jackson-core:2.9.10
 com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -84,22 +84,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -124,7 +124,7 @@ io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -146,10 +146,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -183,8 +183,8 @@ org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.8.1

core/gradle/dependency-locks/compileClasspath.lockfile

@@ -10,11 +10,11 @@ com.fasterxml.jackson.core:jackson-annotations:2.9.10
 com.fasterxml.jackson.core:jackson-core:2.9.10
 com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -83,22 +83,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -123,7 +123,7 @@ io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
 io.grpc:grpc-netty:1.17.1
@@ -144,10 +144,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -181,8 +181,8 @@ org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.8.1
@@ -205,7 +205,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2

core/gradle/dependency-locks/default.lockfile

@@ -18,11 +18,11 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -95,22 +95,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -135,7 +135,7 @@ io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -157,10 +157,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -194,8 +194,8 @@ org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.8.1

core/gradle/dependency-locks/deploy_jar.lockfile

@@ -0,0 +1,245 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.30.6
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.32.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.6
+com.google.monitoring-client:stackdriver:1.0.6
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.22.1
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.24.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c

core/gradle/dependency-locks/nomulus_test.lockfile

@@ -0,0 +1,3 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.

core/gradle/dependency-locks/runtime.lockfile

@@ -10,11 +10,11 @@ com.fasterxml.jackson.core:jackson-annotations:2.9.10
 com.fasterxml.jackson.core:jackson-core:2.9.10
 com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -84,22 +84,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -124,7 +124,7 @@ io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -146,10 +146,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -183,8 +183,8 @@ org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.8.1

core/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -18,11 +18,11 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -95,22 +95,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -135,7 +135,7 @@ io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -157,10 +157,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -194,8 +194,8 @@ org.apache.beam:beam-vendor-grpc-1_21_0:0.1
 org.apache.beam:beam-vendor-guava-26_0-jre:0.1
 org.apache.commons:commons-compress:1.19
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.8.1
@@ -218,7 +218,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2

core/gradle/dependency-locks/testCompile.lockfile

@@ -10,11 +10,11 @@ com.fasterxml.jackson.core:jackson-annotations:2.9.10
 com.fasterxml.jackson.core:jackson-core:2.9.10
 com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -86,11 +86,11 @@ com.google.guava:guava-testlib:28.1-jre
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -98,11 +98,11 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.6
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -133,7 +133,7 @@ io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -155,10 +155,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -198,8 +198,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0

core/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -10,11 +10,11 @@ com.fasterxml.jackson.core:jackson-annotations:2.9.10
 com.fasterxml.jackson.core:jackson-core:2.9.10
 com.fasterxml.jackson.core:jackson-databind:2.9.10
 com.fasterxml:classmate:1.3.4
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -85,11 +85,11 @@ com.google.guava:guava-testlib:28.1-jre
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -97,11 +97,11 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.6
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -132,7 +132,7 @@ io.github.classgraph:classgraph:4.8.52
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
 io.grpc:grpc-netty:1.17.1
@@ -153,10 +153,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -196,8 +196,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0

core/gradle/dependency-locks/testRuntime.lockfile

@@ -18,11 +18,11 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -97,11 +97,11 @@ com.google.guava:guava-testlib:28.1-jre
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,11 +109,11 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.6
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -141,10 +141,11 @@ commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.github.classgraph:classgraph:4.8.52
+io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -166,10 +167,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -209,8 +210,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -226,6 +227,7 @@ org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1

core/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -18,11 +18,11 @@ com.github.jnr:jnr-ffi:2.1.9
 com.github.jnr:jnr-posix:3.0.47
 com.github.jnr:jnr-unixsocket:0.21
 com.github.jnr:jnr-x86asm:1.0.2
-com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-appengine:1.30.6
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.29.0
-com.google.api-client:google-api-client:1.29.2
+com.google.api-client:google-api-client-servlet:1.30.6
+com.google.api-client:google-api-client:1.30.6
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
@@ -97,11 +97,11 @@ com.google.guava:guava-testlib:28.1-jre
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-appengine:1.29.2
-com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-appengine:1.32.1
+com.google.http-client:google-http-client-jackson2:1.32.1
 com.google.http-client:google-http-client-jackson:1.20.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.30.1
+com.google.http-client:google-http-client:1.32.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
@@ -109,11 +109,11 @@ com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.6
 com.google.monitoring-client:metrics:1.0.6
 com.google.monitoring-client:stackdriver:1.0.6
-com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-appengine:1.30.4
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.29.0
-com.google.oauth-client:google-oauth-client:1.29.2
+com.google.oauth-client:google-oauth-client-servlet:1.30.4
+com.google.oauth-client:google-oauth-client:1.30.4
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -141,10 +141,11 @@ commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.github.classgraph:classgraph:4.8.52
+io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.19.0
+io.grpc:grpc-context:1.22.1
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -166,10 +167,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-api:0.24.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.24.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -209,8 +210,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.8
-org.apache.httpcomponents:httpcore:4.4.11
+org.apache.httpcomponents:httpclient:4.5.10
+org.apache.httpcomponents:httpcore:4.4.12
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0
@@ -226,6 +227,7 @@ org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1

core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java

@@ -47,7 +47,7 @@ import org.joda.time.DateTime;
     path = "/_dr/cron/commitLogCheckpoint",
     method = Action.Method.GET,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogCheckpointAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java

@@ -65,7 +65,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteOldCommitLogs",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class DeleteOldCommitLogsAction implements Runnable {
 
   private static final int NUM_MAP_SHARDS = 20;

core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java

@@ -63,7 +63,7 @@ import org.joda.time.DateTime;
     path = ExportCommitLogDiffAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ExportCommitLogDiffAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -111,7 +111,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteContactsAndHosts",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteContactsAndHostsAction implements Runnable {
 
   static final String KIND_CONTACT = getKind(ContactResource.class);

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -55,7 +55,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteLoadTestData",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteLoadTestDataAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -68,7 +68,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteProberData",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteProberDataAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java

@@ -75,7 +75,7 @@ import org.joda.time.DateTime;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/expandRecurringBillingEvents",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExpandRecurringBillingEventsAction implements Runnable {
 
   public static final String PARAM_CURSOR_TIME = "cursorTime";

core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java

@@ -75,7 +75,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/refreshDnsOnHostRename",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class RefreshDnsOnHostRenameAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/cron/CommitLogFanoutAction.java

@@ -33,7 +33,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/commitLogFanout",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogFanoutAction implements Runnable {
 
   public static final String BUCKET_PARAM = "bucket";

core/src/main/java/google/registry/cron/TldFanoutAction.java

@@ -87,7 +87,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/fanout",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TldFanoutAction implements Runnable {
 
   /** A set of control params to TldFanoutAction that aren't passed down to the executing action. */

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -52,7 +52,7 @@ import org.joda.time.Duration;
     path = PublishDnsUpdatesAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
 
   public static final String PATH = "/_dr/task/publishDnsUpdates";

core/src/main/java/google/registry/dns/ReadDnsQueueAction.java

@@ -80,7 +80,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/readDnsQueue",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ReadDnsQueueAction implements Runnable {
 
   private static final String PARAM_JITTER_SECONDS = "jitterSeconds";

core/src/main/java/google/registry/dns/RefreshDnsAction.java

@@ -35,7 +35,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/dnsRefresh",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RefreshDnsAction implements Runnable {
 
   private final Clock clock;

core/src/main/java/google/registry/export/BackupDatastoreAction.java

@@ -45,7 +45,7 @@ import javax.inject.Inject;
     path = BackupDatastoreAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BackupDatastoreAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/BigqueryPollJobAction.java

@@ -51,7 +51,7 @@ import org.joda.time.Duration;
     path = BigqueryPollJobAction.PATH,
     method = {Action.Method.GET, Action.Method.POST},
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BigqueryPollJobAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/CheckBackupAction.java

@@ -59,7 +59,7 @@ import org.joda.time.format.PeriodFormat;
     path = CheckBackupAction.PATH,
     method = {POST, GET},
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class CheckBackupAction implements Runnable {
 
   /** Parameter names for passing parameters into this action. */

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -65,7 +65,7 @@ import org.joda.time.DateTime;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportDomainLists",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportDomainListsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -49,7 +49,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportPremiumTerms",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportPremiumTermsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/ExportReservedTermsAction.java

@@ -37,7 +37,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportReservedTerms",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportReservedTermsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/SyncGroupMembersAction.java

@@ -56,7 +56,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/syncGroupMembers",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class SyncGroupMembersAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/UpdateSnapshotViewAction.java

@@ -39,7 +39,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = UpdateSnapshotViewAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UpdateSnapshotViewAction implements Runnable {
 
   /** Headers for passing parameters into the servlet. */

core/src/main/java/google/registry/export/UploadDatastoreBackupAction.java

@@ -52,7 +52,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = UploadDatastoreBackupAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UploadDatastoreBackupAction implements Runnable {
 
   /** Parameter names for passing parameters into the servlet. */

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java

@@ -60,7 +60,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = SyncRegistrarsSheetAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class SyncRegistrarsSheetAction implements Runnable {
 
   private enum Result {

core/src/main/java/google/registry/flows/FlowRunner.java

@@ -109,7 +109,9 @@ public class FlowRunner {
     }
   }
 
-  /** Exception for explicitly propagating an EppException out of the transactional {@code Work}. */
+  /**
+   * Exception for explicitly propagating an EppException out of the transactional {@code Supplier}.
+   */
   private static class EppRuntimeException extends RuntimeException {
     EppRuntimeException(EppException cause) {
       super(cause);

core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java

@@ -30,28 +30,28 @@ import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.ImmutableObject;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
-/** Wrapper for {@link Work} that associates a time with each attempt. */
+/** Wrapper for {@link Supplier} that associates a time with each attempt. */
 class CommitLoggedWork<R> implements Runnable {
 
-  private final Work<R> work;
+  private final Supplier<R> work;
   private final Clock clock;
 
   /**
    * Temporary place to store the result of a non-void work.
    *
    * <p>We don't want to return the result directly because we are going to try to recover from a
-   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify
-   * when it tries to commit the transaction. When an exception is thrown the return value would be
-   * lost, but sometimes we will be able to determine that we actually succeeded despite the
-   * timeout, and we'll want to get the result.
+   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify when
+   * it tries to commit the transaction. When an exception is thrown the return value would be lost,
+   * but sometimes we will be able to determine that we actually succeeded despite the timeout, and
+   * we'll want to get the result.
    */
   private R result;
 
@@ -76,7 +76,7 @@ class CommitLoggedWork<R> implements Runnable {
   /** Lifecycle marker to track whether {@link #run} has been called. */
   private boolean runCalled;
 
-  CommitLoggedWork(Work<R> work, Clock clock) {
+  CommitLoggedWork(Supplier<R> work, Clock clock) {
     this.work = work;
     this.clock = clock;
   }
@@ -111,7 +111,7 @@ class CommitLoggedWork<R> implements Runnable {
     // Set the time to be used for "now" within the transaction.
     try {
       Ofy.TRANSACTION_INFO.set(createNewTransactionInfo());
-      result = work.run();
+      result = work.get();
       saveCommitLog(Ofy.TRANSACTION_INFO.get());
     } finally {
       Ofy.TRANSACTION_INFO.set(previous);

core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java

@@ -17,6 +17,7 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 
 import google.registry.model.transaction.TransactionManager;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
 /** Datastore implementation of {@link TransactionManager}. */
@@ -44,7 +45,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
     return getOfy().transact(work);
   }
 
@@ -54,7 +55,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
     return getOfy().transactNew(work);
   }
 
@@ -64,7 +65,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <R> R transactNewReadOnly(Work<R> work) {
+  public <R> R transactNewReadOnly(Supplier<R> work) {
     return getOfy().transactNewReadOnly(work);
   }
 
@@ -74,7 +75,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <R> R doTransactionless(Work<R> work) {
+  public <R> R doTransactionless(Supplier<R> work) {
     return getOfy().doTransactionless(work);
   }
 

core/src/main/java/google/registry/model/ofy/Ofy.java

@@ -38,7 +38,6 @@ import com.googlecode.objectify.cmd.Saver;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.VirtualEntity;
 import google.registry.model.ofy.ReadOnlyWork.KillTransactionException;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import google.registry.util.NonFinalForTesting;
 import google.registry.util.Sleeper;
@@ -46,6 +45,7 @@ import google.registry.util.SystemClock;
 import google.registry.util.SystemSleeper;
 import java.lang.annotation.Annotation;
 import java.util.Objects;
+import java.util.function.Supplier;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -194,9 +194,9 @@ public class Ofy {
   }
 
   /** Execute a transaction. */
-  <R> R transact(Work<R> work) {
+  <R> R transact(Supplier<R> work) {
     // If we are already in a transaction, don't wrap in a CommitLoggedWork.
-    return inTransaction() ? work.run() : transactNew(work);
+    return inTransaction() ? work.get() : transactNew(work);
   }
 
   /**
@@ -214,7 +214,7 @@ public class Ofy {
   }
 
   /** Pause the current transaction (if any) and complete this one before returning to it. */
-  <R> R transactNew(Work<R> work) {
+  <R> R transactNew(Supplier<R> work) {
     // Wrap the Work in a CommitLoggedWork so that we can give transactions a frozen view of time
     // and maintain commit logs for them.
     return transactCommitLoggedWork(new CommitLoggedWork<>(work, getClock()));
@@ -298,7 +298,7 @@ public class Ofy {
   }
 
   /** A read-only transaction is useful to get strongly consistent reads at a shared timestamp. */
-  <R> R transactNewReadOnly(Work<R> work) {
+  <R> R transactNewReadOnly(Supplier<R> work) {
     ReadOnlyWork<R> readOnlyWork = new ReadOnlyWork<>(work, getClock());
     try {
       ofy().transactNew(() -> {
@@ -324,11 +324,11 @@ public class Ofy {
   }
 
   /** Execute some work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work) {
+  <R> R doTransactionless(Supplier<R> work) {
     try {
       com.googlecode.objectify.ObjectifyService.push(
           com.googlecode.objectify.ObjectifyService.ofy().transactionless());
-      return work.run();
+      return work.get();
     } finally {
       com.googlecode.objectify.ObjectifyService.pop();
     }
@@ -342,11 +342,11 @@ public class Ofy {
    * Note that unlike a transaction's fresh session cache, the contents of this cache will be
    * discarded once the work completes, rather than being propagated into the enclosing session.
    */
-  public <R> R doWithFreshSessionCache(Work<R> work) {
+  public <R> R doWithFreshSessionCache(Supplier<R> work) {
     try {
       com.googlecode.objectify.ObjectifyService.push(
           com.googlecode.objectify.ObjectifyService.factory().begin());
-      return work.run();
+      return work.get();
     } finally {
       com.googlecode.objectify.ObjectifyService.pop();
     }

core/src/main/java/google/registry/model/ofy/ReadOnlyWork.java

@@ -14,13 +14,13 @@
 
 package google.registry.model.ofy;
 
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 
-/** Wrapper for {@link Work} that disallows mutations and fails the transaction at the end. */
+/** Wrapper for {@link Supplier} that disallows mutations and fails the transaction at the end. */
 class ReadOnlyWork<R> extends CommitLoggedWork<R> {
 
-  ReadOnlyWork(Work<R> work, Clock clock) {
+  ReadOnlyWork(Supplier<R> work, Clock clock) {
     super(work, clock);
   }
 

core/src/main/java/google/registry/model/registry/Registry.java

@@ -791,6 +791,12 @@ public class Registry extends ImmutableObject implements Buildable {
       return this;
     }
 
+    @VisibleForTesting
+    public Builder setPremiumListKey(@Nullable Key<PremiumList> premiumList) {
+      getInstance().premiumList = premiumList;
+      return this;
+    }
+
     public Builder setRestoreBillingCost(Money amount) {
       checkArgument(amount.isPositiveOrZero(), "restoreBillingCost cannot be negative");
       getInstance().restoreBillingCost = amount;

core/src/main/java/google/registry/model/registry/label/PremiumListUtils.java

@@ -36,11 +36,13 @@ import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
+import com.google.common.flogger.FluentLogger;
 import com.googlecode.objectify.Key;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome;
 import google.registry.model.registry.label.PremiumList.PremiumListEntry;
 import google.registry.model.registry.label.PremiumList.PremiumListRevision;
+import google.registry.schema.tld.PremiumListDao;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
@@ -52,7 +54,9 @@ import org.joda.time.DateTime;
 public final class PremiumListUtils {
 
   /** The number of premium list entry entities that are created and deleted per batch. */
-  static final int TRANSACTION_BATCH_SIZE = 200;
+  private static final int TRANSACTION_BATCH_SIZE = 200;
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
   /** Value type class used by {@link #checkStatus} to return the results of a premiumness check. */
   @AutoValue
@@ -97,6 +101,19 @@ public final class PremiumListUtils {
         listName,
         checkResults.checkOutcome(),
         DateTime.now(UTC).getMillis() - startTime.getMillis());
+
+    // Also load the value from Cloud SQL, compare the two results, and log if different.
+    try {
+      Optional<Money> priceFromSql = PremiumListDao.getPremiumPrice(label, registry);
+      if (!priceFromSql.equals(checkResults.premiumPrice())) {
+        logger.atWarning().log(
+            "Unequal prices for domain %s.%s from Datastore (%s) and Cloud SQL (%s).",
+            label, registry.getTldStr(), checkResults.premiumPrice(), priceFromSql);
+      }
+    } catch (Throwable t) {
+      logger.atSevere().withCause(t).log(
+          "Error loading price of domain %s.%s from Cloud SQL.", label, registry.getTldStr());
+    }
     return checkResults.premiumPrice();
   }
 

core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java

@@ -16,6 +16,7 @@ package google.registry.model.transaction;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 import javax.persistence.EntityManager;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.EntityTransaction;
@@ -63,11 +64,11 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
     // TODO(shicong): Investigate removing transactNew functionality after migration as it may
     //  be same as this one.
     if (inTransaction()) {
-      return work.run();
+      return work.get();
     }
     TransactionInfo txnInfo = transactionInfo.get();
     txnInfo.entityManager = emf.createEntityManager();
@@ -76,7 +77,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       txn.begin();
       txnInfo.inTransaction = true;
       txnInfo.transactionTime = clock.nowUtc();
-      T result = work.run();
+      T result = work.get();
       txn.commit();
       return result;
     } catch (RuntimeException e) {
@@ -102,7 +103,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
     // TODO(shicong): Implements the functionality to start a new transaction.
     throw new UnsupportedOperationException();
   }
@@ -114,7 +115,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transactNewReadOnly(Work<T> work) {
+  public <T> T transactNewReadOnly(Supplier<T> work) {
     // TODO(shicong): Implements read only transaction.
     throw new UnsupportedOperationException();
   }
@@ -126,7 +127,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T doTransactionless(Work<T> work) {
+  public <T> T doTransactionless(Supplier<T> work) {
     // TODO(shicong): Implements doTransactionless.
     throw new UnsupportedOperationException();
   }

core/src/main/java/google/registry/model/transaction/TransactionManager.java

@@ -14,6 +14,7 @@
 
 package google.registry.model.transaction;
 
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
 /**
@@ -21,12 +22,6 @@ import org.joda.time.DateTime;
  */
 public interface TransactionManager {
 
-  /** This functional interface defines a method to execute a work and return the result. */
-  @FunctionalInterface
-  interface Work<R> {
-    R run();
-  }
-
   /** Returns {@code true} if the caller is in a transaction.
    *
    *  <p>Note that this function is kept for backward compatibility. We will review the use case
@@ -42,18 +37,19 @@ public interface TransactionManager {
   void assertInTransaction();
 
   /** Executes the work in a transaction and returns the result. */
-  <T> T transact(Work<T> work);
+  <T> T transact(Supplier<T> work);
 
   /** Executes the work in a transaction. */
   void transact(Runnable work);
 
-  /** Pauses the current transaction (if any), executes the work in a new transaction
-   *  and returns the result.
+  /**
+   * Pauses the current transaction (if any), executes the work in a new transaction and returns the
+   * result.
    *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
    */
-  <T> T transactNew(Work<T> work);
+  <T> T transactNew(Supplier<T> work);
 
   /** Pauses the current transaction (if any) and executes the work in a new transaction.
    *
@@ -62,12 +58,13 @@ public interface TransactionManager {
    */
   void transactNew(Runnable work);
 
-  /** Executes the work in a read-only transaction and returns the result.
+  /**
+   * Executes the work in a read-only transaction and returns the result.
    *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
    */
-  <R> R transactNewReadOnly(Work<R> work);
+  <R> R transactNewReadOnly(Supplier<R> work);
 
   /** Executes the work in a read-only transaction.
    *
@@ -77,7 +74,7 @@ public interface TransactionManager {
   void transactNewReadOnly(Runnable work);
 
   /** Executes the work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work);
+  <R> R doTransactionless(Supplier<R> work);
 
   /** Returns the time associated with the start of this particular transaction attempt. */
   DateTime getTransactionTime();

core/src/main/java/google/registry/rde/BrdaCopyAction.java

@@ -58,7 +58,7 @@ import org.joda.time.DateTime;
     path = BrdaCopyAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class BrdaCopyAction implements Runnable {
 
   static final String PATH = "/_dr/task/brdaCopy";

core/src/main/java/google/registry/rde/RdeReportAction.java

@@ -53,7 +53,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeReportAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeReportAction implements Runnable, EscrowTask {
 
   static final String PATH = "/_dr/task/rdeReport";

core/src/main/java/google/registry/rde/RdeStagingAction.java

@@ -195,7 +195,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeStagingAction.PATH,
     method = {GET, POST},
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeStagingAction implements Runnable {
 
   public static final String PATH = "/_dr/task/rdeStaging";

core/src/main/java/google/registry/rde/RdeUploadAction.java

@@ -84,7 +84,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeUploadAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeUploadAction implements Runnable, EscrowTask {
 
   static final String PATH = "/_dr/task/rdeUpload";

core/src/main/java/google/registry/reporting/billing/GenerateInvoicesAction.java

@@ -50,7 +50,7 @@ import org.joda.time.YearMonth;
     service = Action.Service.BACKEND,
     path = GenerateInvoicesAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateInvoicesAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java

@@ -68,7 +68,7 @@ import org.joda.time.format.DateTimeFormat;
     service = Action.Service.BACKEND,
     path = IcannReportingStagingAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class IcannReportingStagingAction implements Runnable {
 
   static final String PATH = "/_dr/task/icannReportingStaging";

core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java

@@ -49,7 +49,7 @@ import org.joda.time.LocalDate;
     service = Action.Service.BACKEND,
     path = GenerateSpec11ReportAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateSpec11ReportAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/request/auth/Auth.java

@@ -73,15 +73,7 @@ public enum Auth {
   AUTH_INTERNAL_OR_ADMIN(
       ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API),
       AuthLevel.APP,
-      UserPolicy.ADMIN),
-
-  /**
-   * Allows only internal (App Engine task-queue) access.
-   */
-  AUTH_INTERNAL_ONLY(
-      ImmutableList.of(AuthMethod.INTERNAL),
-      AuthLevel.APP,
-      UserPolicy.IGNORED);
+      UserPolicy.ADMIN);
 
   private final AuthSettings authSettings;
 

core/src/main/java/google/registry/schema/cursor/Cursor.java

@@ -0,0 +1,116 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.cursor;
+
+import static com.google.appengine.api.search.checkers.Preconditions.checkNotNull;
+
+import google.registry.model.ImmutableObject;
+import google.registry.model.UpdateAutoTimestamp;
+import google.registry.model.common.Cursor.CursorType;
+import google.registry.schema.cursor.Cursor.CursorId;
+import google.registry.util.DateTimeUtils;
+import java.io.Serializable;
+import java.time.ZonedDateTime;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.Table;
+import org.joda.time.DateTime;
+
+/**
+ * Shared entity for date cursors. This uses a compound primary key as defined in {@link CursorId}.
+ */
+@Entity
+@Table
+@IdClass(CursorId.class)
+public class Cursor {
+
+  @Enumerated(EnumType.STRING)
+  @Column(nullable = false)
+  @Id
+  private CursorType type;
+
+  @Column @Id private String scope;
+
+  @Column(nullable = false)
+  private ZonedDateTime cursorTime;
+
+  @Column(nullable = false)
+  private UpdateAutoTimestamp lastUpdateTime = UpdateAutoTimestamp.create(null);
+
+  /** The scope of a global cursor. A global cursor is a cursor that is not specific to one tld. */
+  public static final String GLOBAL = "GLOBAL";
+
+  private Cursor(CursorType type, String scope, DateTime cursorTime) {
+    this.type = type;
+    this.scope = scope;
+    this.cursorTime = DateTimeUtils.toZonedDateTime(cursorTime);
+  }
+
+  // Hibernate requires a default constructor.
+  private Cursor() {}
+
+  /** Constructs a {@link Cursor} object. */
+  public static Cursor create(CursorType type, String scope, DateTime cursorTime) {
+    checkNotNull(
+        scope, "Scope cannot be null. To create a global cursor, use the createGlobal method");
+    return new Cursor(type, scope, cursorTime);
+  }
+
+  /** Constructs a {@link Cursor} object with a {@link GLOBAL} scope. */
+  public static Cursor createGlobal(CursorType type, DateTime cursorTime) {
+    return new Cursor(type, GLOBAL, cursorTime);
+  }
+
+  /** Returns the type of the cursor. */
+  public CursorType getType() {
+    return type;
+  }
+
+  /**
+   * Returns the scope of the cursor. The scope will typically be the tld the cursor is referring
+   * to. If the cursor is a global cursor, the scope will be {@link GLOBAL}.
+   */
+  public String getScope() {
+    return scope;
+  }
+
+  /** Returns the time the cursor is set to. */
+  public DateTime getCursorTime() {
+    return DateTimeUtils.toJodaDateTime(cursorTime);
+  }
+
+  /** Returns the last time the cursor was updated. */
+  public DateTime getLastUpdateTime() {
+    return lastUpdateTime.getTimestamp();
+  }
+
+  static class CursorId extends ImmutableObject implements Serializable {
+
+    public CursorType type;
+
+    public String scope;
+
+    private CursorId() {}
+
+    public CursorId(CursorType type, String scope) {
+      this.type = type;
+      this.scope = scope;
+    }
+  }
+}

core/src/main/java/google/registry/schema/cursor/CursorDao.java

@@ -0,0 +1,70 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.cursor;
+
+import static com.google.appengine.api.search.checkers.Preconditions.checkNotNull;
+import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+
+import google.registry.model.common.Cursor.CursorType;
+import google.registry.schema.cursor.Cursor.CursorId;
+import java.util.List;
+
+/** Data access object class for {@link Cursor}. */
+public class CursorDao {
+
+  public static void save(Cursor cursor) {
+    jpaTm()
+        .transact(
+            () -> {
+              jpaTm().getEntityManager().merge(cursor);
+            });
+  }
+
+  public static Cursor load(CursorType type, String scope) {
+    checkNotNull(scope, "The scope of the cursor to load cannot be null");
+    checkNotNull(type, "The type of the cursor to load must be specified");
+    return jpaTm()
+        .transact(() -> jpaTm().getEntityManager().find(Cursor.class, new CursorId(type, scope)));
+  }
+
+  /** If no scope is given, use {@link Cursor.GLOBAL} as the scope. */
+  public static Cursor load(CursorType type) {
+    checkNotNull(type, "The type of the cursor to load must be specified");
+    return load(type, Cursor.GLOBAL);
+  }
+
+  public static List<Cursor> loadAll() {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createQuery("SELECT cursor FROM Cursor cursor", Cursor.class)
+                    .getResultList());
+  }
+
+  public static List<Cursor> loadByType(CursorType type) {
+    checkNotNull(type, "The type of the cursors to load must be specified");
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createQuery(
+                        "SELECT cursor FROM Cursor cursor WHERE cursor.type = :type", Cursor.class)
+                    .setParameter("type", type)
+                    .getResultList());
+  }
+}

core/src/main/java/google/registry/schema/tld/PremiumEntry.java

@@ -0,0 +1,43 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/**
+ * Entity class for the premium price of an individual domain label.
+ *
+ * <p>These are not persisted directly, but rather, using {@link PremiumList#getLabelsToPrices()}.
+ */
+@Entity
+public class PremiumEntry implements Serializable {
+
+  @Id
+  @Column(nullable = false)
+  Long revisionId;
+
+  @Column(nullable = false)
+  BigDecimal price;
+
+  @Id
+  @Column(nullable = false)
+  String domainLabel;
+
+  private PremiumEntry() {}
+}

core/src/main/java/google/registry/schema/tld/PremiumList.java

@@ -23,6 +23,7 @@ import com.google.common.hash.BloomFilter;
 import google.registry.model.CreateAutoTimestamp;
 import java.math.BigDecimal;
 import java.util.Map;
+import javax.annotation.Nullable;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
@@ -34,6 +35,7 @@ import javax.persistence.Index;
 import javax.persistence.JoinColumn;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
+import org.hibernate.LazyInitializationException;
 import org.joda.money.CurrencyUnit;
 import org.joda.time.DateTime;
 
@@ -97,10 +99,16 @@ public class PremiumList {
     return name;
   }
 
+  /** Returns the {@link CurrencyUnit} used for this list. */
+  public CurrencyUnit getCurrency() {
+    return currency;
+  }
+
   /** Returns the ID of this revision, or throws if null. */
   public Long getRevisionId() {
     checkState(
-        revisionId != null, "revisionId is null because it is not persisted in the database");
+        revisionId != null,
+        "revisionId is null because this object has not yet been persisted to the DB");
     return revisionId;
   }
 
@@ -109,9 +117,17 @@ public class PremiumList {
     return creationTimestamp.getTimestamp();
   }
 
-  /** Returns a {@link Map} of domain labels to prices. */
+  /**
+   * Returns a {@link Map} of domain labels to prices.
+   *
+   * <p>Note that this is lazily loaded and thus will throw a {@link LazyInitializationException} if
+   * used outside the transaction in which the given entity was loaded. You generally should not be
+   * using this anyway as it's inefficient to load all of the PremiumEntry rows if you don't need
+   * them. To check prices, use {@link PremiumListDao#getPremiumPrice} instead.
+   */
+  @Nullable
   public ImmutableMap<String, BigDecimal> getLabelsToPrices() {
-    return ImmutableMap.copyOf(labelsToPrices);
+    return labelsToPrices == null ? null : ImmutableMap.copyOf(labelsToPrices);
   }
 
   /**

core/src/main/java/google/registry/schema/tld/PremiumListCache.java

@@ -0,0 +1,106 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.tld;
+
+import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
+import static google.registry.config.RegistryConfig.getSingletonCachePersistDuration;
+import static google.registry.config.RegistryConfig.getStaticPremiumListMaxCachedEntries;
+import static google.registry.schema.tld.PremiumListDao.getPriceForLabel;
+import static java.util.concurrent.TimeUnit.MILLISECONDS;
+
+import com.google.auto.value.AutoValue;
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.LoadingCache;
+import google.registry.util.NonFinalForTesting;
+import java.math.BigDecimal;
+import java.util.Optional;
+import org.joda.time.Duration;
+
+/** Caching utils for {@link PremiumList}s. */
+class PremiumListCache {
+
+  /**
+   * In-memory cache for premium lists.
+   *
+   * <p>This is cached for a shorter duration because we need to periodically reload from the DB to
+   * check if a new revision has been published, and if so, then use that.
+   */
+  @NonFinalForTesting
+  static LoadingCache<String, Optional<PremiumList>> cachePremiumLists =
+      createCachePremiumLists(getDomainLabelListCacheDuration());
+
+  @VisibleForTesting
+  static LoadingCache<String, Optional<PremiumList>> createCachePremiumLists(
+      Duration cachePersistDuration) {
+    return CacheBuilder.newBuilder()
+        .expireAfterWrite(cachePersistDuration.getMillis(), MILLISECONDS)
+        .build(
+            new CacheLoader<String, Optional<PremiumList>>() {
+              @Override
+              public Optional<PremiumList> load(String premiumListName) {
+                return PremiumListDao.getLatestRevision(premiumListName);
+              }
+            });
+  }
+
+  /**
+   * In-memory price cache for for a given premium list revision and domain label.
+   *
+   * <p>Note that premium list revision ids are globally unique, so this cache is specific to a
+   * given premium list. Premium list entries might not be present, as indicated by the Optional
+   * wrapper, and we want to cache that as well.
+   *
+   * <p>This is cached for a long duration (essentially indefinitely) because premium list revisions
+   * are immutable and cannot ever be changed once created, so the cache need not ever expire.
+   *
+   * <p>A maximum size is set here on the cache because it can potentially grow too big to fit in
+   * memory if there are a large number of distinct premium list entries being queried (both those
+   * that exist, as well as those that might exist according to the Bloom filter, must be cached).
+   * The entries judged least likely to be accessed again will be evicted first.
+   */
+  @NonFinalForTesting
+  static LoadingCache<RevisionIdAndLabel, Optional<BigDecimal>> cachePremiumEntries =
+      createCachePremiumEntries(getSingletonCachePersistDuration());
+
+  @VisibleForTesting
+  static LoadingCache<RevisionIdAndLabel, Optional<BigDecimal>> createCachePremiumEntries(
+      Duration cachePersistDuration) {
+    return CacheBuilder.newBuilder()
+        .expireAfterWrite(cachePersistDuration.getMillis(), MILLISECONDS)
+        .maximumSize(getStaticPremiumListMaxCachedEntries())
+        .build(
+            new CacheLoader<RevisionIdAndLabel, Optional<BigDecimal>>() {
+              @Override
+              public Optional<BigDecimal> load(RevisionIdAndLabel revisionIdAndLabel) {
+                return getPriceForLabel(revisionIdAndLabel);
+              }
+            });
+  }
+
+  @AutoValue
+  abstract static class RevisionIdAndLabel {
+    abstract long revisionId();
+
+    abstract String label();
+
+    static RevisionIdAndLabel create(long revisionId, String label) {
+      return new AutoValue_PremiumListCache_RevisionIdAndLabel(revisionId, label);
+    }
+  }
+
+  private PremiumListCache() {}
+}

core/src/main/java/google/registry/schema/tld/PremiumListDao.java

@@ -17,9 +17,37 @@ package google.registry.schema.tld;
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
 
+import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
+import com.google.common.util.concurrent.UncheckedExecutionException;
+import google.registry.model.registry.Registry;
+import google.registry.schema.tld.PremiumListCache.RevisionIdAndLabel;
+import java.math.BigDecimal;
+import java.util.Optional;
+import java.util.concurrent.ExecutionException;
+import org.joda.money.Money;
+
 /** Data access object class for {@link PremiumList}. */
 public class PremiumListDao {
 
+  /**
+   * Returns the premium price for the specified label and registry, or absent if the label is not
+   * premium.
+   */
+  public static Optional<Money> getPremiumPrice(String label, Registry registry) {
+    // If the registry has no configured premium list, then no labels are premium.
+    if (registry.getPremiumList() == null) {
+      return Optional.empty();
+    }
+    String premiumListName = registry.getPremiumList().getName();
+    PremiumList premiumList =
+        getLatestRevisionCached(premiumListName)
+            .orElseThrow(
+                () ->
+                    new IllegalStateException(
+                        String.format("Could not load premium list '%s'", premiumListName)));
+    return getPremiumPriceFromList(label, premiumList);
+  }
+
   /** Persist a new premium list to Cloud SQL. */
   public static void saveNew(PremiumList premiumList) {
     jpaTm()
@@ -27,18 +55,80 @@ public class PremiumListDao {
             () -> {
               checkArgument(
                   !checkExists(premiumList.getName()),
-                  "A premium list of this name already exists: %s.",
+                  "Premium list '%s' already exists",
                   premiumList.getName());
               jpaTm().getEntityManager().persist(premiumList);
             });
   }
 
+  /** Persist a new revision of an existing premium list to Cloud SQL. */
+  public static void update(PremiumList premiumList) {
+    jpaTm()
+        .transact(
+            () -> {
+              checkArgument(
+                  checkExists(premiumList.getName()),
+                  "Can't update non-existent premium list '%s'",
+                  premiumList.getName());
+              jpaTm().getEntityManager().persist(premiumList);
+            });
+  }
+
+  /**
+   * Returns the most recent revision of the PremiumList with the specified name, if it exists.
+   *
+   * <p>Note that this does not load <code>PremiumList.labelsToPrices</code>! If you need to check
+   * prices, use {@link #getPremiumPrice}.
+   */
+  static Optional<PremiumList> getLatestRevision(String premiumListName) {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createQuery(
+                        "SELECT pl FROM PremiumList pl WHERE pl.name = :name ORDER BY"
+                            + " pl.revisionId DESC",
+                        PremiumList.class)
+                    .setParameter("name", premiumListName)
+                    .setMaxResults(1)
+                    .getResultStream()
+                    .findFirst());
+  }
+
+  static Optional<BigDecimal> getPriceForLabel(RevisionIdAndLabel revisionIdAndLabel) {
+    return jpaTm()
+        .transact(
+            () ->
+                jpaTm()
+                    .getEntityManager()
+                    .createQuery(
+                        "SELECT pe.price FROM PremiumEntry pe WHERE pe.revisionId = :revisionId"
+                            + " AND pe.domainLabel = :label",
+                        BigDecimal.class)
+                    .setParameter("revisionId", revisionIdAndLabel.revisionId())
+                    .setParameter("label", revisionIdAndLabel.label())
+                    .setMaxResults(1)
+                    .getResultStream()
+                    .findFirst());
+  }
+
+  /** Returns the most recent revision of the PremiumList with the specified name, from cache. */
+  static Optional<PremiumList> getLatestRevisionCached(String premiumListName) {
+    try {
+      return PremiumListCache.cachePremiumLists.get(premiumListName);
+    } catch (ExecutionException e) {
+      throw new UncheckedExecutionException(
+          "Could not retrieve premium list named " + premiumListName, e);
+    }
+  }
+
   /**
    * Returns whether the premium list of the given name exists.
    *
    * <p>This means that at least one premium list revision must exist for the given name.
    */
-  public static boolean checkExists(String premiumListName) {
+  static boolean checkExists(String premiumListName) {
     return jpaTm()
         .transact(
             () ->
@@ -52,5 +142,24 @@ public class PremiumListDao {
                     > 0);
   }
 
+  private static Optional<Money> getPremiumPriceFromList(String label, PremiumList premiumList) {
+    // Consult the bloom filter and immediately return if the label definitely isn't premium.
+    if (!premiumList.getBloomFilter().mightContain(label)) {
+      return Optional.empty();
+    }
+    RevisionIdAndLabel revisionIdAndLabel =
+        RevisionIdAndLabel.create(premiumList.getRevisionId(), label);
+    try {
+      Optional<BigDecimal> price = PremiumListCache.cachePremiumEntries.get(revisionIdAndLabel);
+      return price.map(p -> Money.of(premiumList.getCurrency(), p));
+    } catch (InvalidCacheLoadException | ExecutionException e) {
+      throw new RuntimeException(
+          String.format(
+              "Could not load premium entry %s for list %s",
+              revisionIdAndLabel, premiumList.getName()),
+          e);
+    }
+  }
+
   private PremiumListDao() {}
 }

core/src/main/java/google/registry/tmch/NordnUploadAction.java

@@ -74,7 +74,7 @@ import org.joda.time.Duration;
     path = NordnUploadAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnUploadAction implements Runnable {
 
   static final String PATH = "/_dr/task/nordnUpload";

core/src/main/java/google/registry/tmch/NordnVerifyAction.java

@@ -56,7 +56,7 @@ import javax.inject.Inject;
     path = NordnVerifyAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnVerifyAction implements Runnable {
 
   static final String PATH = "/_dr/task/nordnVerify";

core/src/main/java/google/registry/tmch/TmchCrlAction.java

@@ -32,7 +32,7 @@ import javax.inject.Inject;
     path = "/_dr/task/tmchCrl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchCrlAction implements Runnable {
 
   @Inject Marksdb marksdb;

core/src/main/java/google/registry/tmch/TmchDnlAction.java

@@ -36,7 +36,7 @@ import org.bouncycastle.openpgp.PGPException;
     path = "/_dr/task/tmchDnl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchDnlAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/tmch/TmchSmdrlAction.java

@@ -34,7 +34,7 @@ import org.bouncycastle.openpgp.PGPException;
     path = "/_dr/task/tmchSmdrl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchSmdrlAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -104,6 +104,8 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
     // Create all command instances. It would be preferrable to do this in the constructor, but
     // JCommander mutates the command instances and doesn't reset them so we have to do it for every
     // run.
+    // TODO(weiminyu): extract this into a standalone static method to simplify
+    //   :core:registryToolIntegrationTest
     try {
       for (Map.Entry<String, ? extends Class<? extends Command>> entry : commands.entrySet()) {
         Command command = entry.getValue().getDeclaredConstructor().newInstance();

core/src/main/java/google/registry/tools/server/KillAllCommitLogsAction.java

@@ -48,7 +48,7 @@ import javax.inject.Inject;
     service = Action.Service.TOOLS,
     path = "/_dr/task/killAllCommitLogs",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class KillAllCommitLogsAction implements Runnable {
 
   @Inject MapreduceRunner mrRunner;

core/src/main/java/google/registry/tools/server/KillAllEppResourcesAction.java

@@ -44,7 +44,7 @@ import javax.inject.Inject;
     service = Action.Service.TOOLS,
     path = "/_dr/task/killAllEppResources",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class KillAllEppResourcesAction implements Runnable {
 
   @Inject MapreduceRunner mrRunner;

core/src/main/resources/META-INF/persistence.xml

@@ -22,8 +22,10 @@
     <class>google.registry.model.domain.DomainBase</class>
     <class>google.registry.schema.domain.RegistryLock</class>
     <class>google.registry.schema.tmch.ClaimsList</class>
+    <class>google.registry.schema.cursor.Cursor</class>
     <class>google.registry.model.transfer.BaseTransferObject</class>
     <class>google.registry.schema.tld.PremiumList</class>
+    <class>google.registry.schema.tld.PremiumEntry</class>
     <class>google.registry.schema.tld.ReservedList</class>
     <class>google.registry.model.domain.secdns.DelegationSignerData</class>
     <class>google.registry.model.domain.DesignatedContact</class>

core/src/test/java/google/registry/model/ofy/OfyTest.java

@@ -45,12 +45,12 @@ import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.testing.AppEngineRule;
 import google.registry.testing.DatastoreHelper;
 import google.registry.testing.FakeClock;
 import google.registry.util.SystemClock;
 import java.util.ConcurrentModificationException;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 import org.junit.Before;
 import org.junit.Rule;
@@ -239,72 +239,88 @@ public class OfyTest {
 
   @Test
   public void testTransact_transientFailureException_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new TransientFailureException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new TransientFailureException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_noManifest_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        // We don't write anything in this transaction, so there is no commit log manifest.
-        // Therefore it's always safe to retry since nothing got written.
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new DatastoreTimeoutException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        // We don't write anything in this transaction, so there is no commit log
+                        // manifest.
+                        // Therefore it's always safe to retry since nothing got written.
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new DatastoreTimeoutException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_manifestNotWrittenToDatastore_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        // There will be something in the manifest now, but it won't be committed if we throw.
-        ofy().save().entity(someObject);
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new DatastoreTimeoutException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        // There will be something in the manifest now, but it won't be committed if
+                        // we throw.
+                        ofy().save().entity(someObject);
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new DatastoreTimeoutException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_manifestWrittenToDatastore_returnsSuccess() {
     // A work unit that throws if it is ever retried.
-    Work work = new Work<Void>() {
-      boolean firstCallToVrun = true;
+    Supplier work =
+        new Supplier<Void>() {
+          boolean firstCallToVrun = true;
 
-      @Override
-      public Void run() {
-        if (firstCallToVrun) {
-          firstCallToVrun = false;
-          ofy().save().entity(someObject);
-          return null;
-        }
-        fail("Shouldn't have retried.");
-        return null;
-      }};
+          @Override
+          public Void get() {
+            if (firstCallToVrun) {
+              firstCallToVrun = false;
+              ofy().save().entity(someObject);
+              return null;
+            }
+            fail("Shouldn't have retried.");
+            return null;
+          }
+        };
     // A commit logged work that throws on the first attempt to get its result.
     CommitLoggedWork<Void> commitLoggedWork = new CommitLoggedWork<Void>(work, new SystemClock()) {
       boolean firstCallToGetResult = true;
@@ -323,18 +339,22 @@ public class OfyTest {
   }
 
   void doReadOnlyRetryTest(final RuntimeException e) {
-    assertThat(tm().transactNewReadOnly(new Work<Integer>() {
+    assertThat(
+            tm().transactNewReadOnly(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw e;
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new TransientFailureException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test

core/src/test/java/google/registry/model/transaction/JpaTransactionManagerRule.java

@@ -85,6 +85,7 @@ public class JpaTransactionManagerRule extends ExternalResource {
   private static final String POSTGRES_DB_NAME = "postgres";
 
   // Name of the optional property that specifies the root path of the golden schema.
+  // TODO(weiminyu): revert this. The :integration project offers a better solution.
   @VisibleForTesting
   static final String GOLDEN_SCHEMA_RESOURCE_ROOT_PROP = "sql_schema_resource_root";
 

core/src/test/java/google/registry/model/transaction/JpaTransactionManagerRuleTest.java

@@ -80,6 +80,7 @@ public class JpaTransactionManagerRuleTest {
 
   @Test
   public void testInitScriptUrl_noOverride() {
+    systemPropertyRule.setProperty(GOLDEN_SCHEMA_RESOURCE_ROOT_PROP, null);
     assertThat(jpaTmRule.getInitScriptUrlOverride()).isEmpty();
   }
 

core/src/test/java/google/registry/request/RouterTest.java

@@ -16,7 +16,7 @@ package google.registry.request;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
-import static google.registry.request.auth.Auth.AUTH_INTERNAL_ONLY;
+import static google.registry.request.auth.Auth.AUTH_INTERNAL_OR_ADMIN;
 import static google.registry.testing.JUnitBackports.assertThrows;
 
 import java.util.Optional;
@@ -45,7 +45,7 @@ public final class RouterTest {
 
   ////////////////////////////////////////////////////////////////////////////////////////////////
 
-  @Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_ONLY)
+  @Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class SlothTask implements Runnable {
     @Override
     public void run() {}
@@ -79,7 +79,7 @@ public final class RouterTest {
       service = Action.Service.DEFAULT,
       path = "/prefix",
       isPrefix = true,
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class PrefixTask implements Runnable {
     @Override
     public void run() {}
@@ -109,7 +109,7 @@ public final class RouterTest {
       service = Action.Service.DEFAULT,
       path = "/prefix/long",
       isPrefix = true,
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class LongTask implements Runnable {
     @Override
     public void run() {}
@@ -164,7 +164,7 @@ public final class RouterTest {
   @Action(
       service = Action.Service.DEFAULT,
       path = "/samePathAsOtherTask",
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class DuplicateTask1 implements Runnable {
     @Override
     public void run() {}
@@ -173,7 +173,7 @@ public final class RouterTest {
   @Action(
       service = Action.Service.DEFAULT,
       path = "/samePathAsOtherTask",
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class DuplicateTask2 implements Runnable {
     @Override
     public void run() {}

core/src/test/java/google/registry/request/auth/RequestAuthenticatorTest.java

@@ -53,7 +53,7 @@ public class RequestAuthenticatorTest {
       AuthLevel.NONE,
       UserPolicy.IGNORED);
 
-  private static final AuthSettings AUTH_INTERNAL_ONLY = AuthSettings.create(
+  private static final AuthSettings AUTH_INTERNAL_OR_ADMIN = AuthSettings.create(
       ImmutableList.of(AuthMethod.INTERNAL),
       AuthLevel.APP,
       UserPolicy.IGNORED);
@@ -157,7 +157,7 @@ public class RequestAuthenticatorTest {
 
   @Test
   public void testInternalAuth_notInvokedInternally() {
-    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
+    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
 
     verifyZeroInteractions(mockUserService);
     assertThat(authResult).isEmpty();
@@ -167,7 +167,7 @@ public class RequestAuthenticatorTest {
   public void testInternalAuth_success() {
     when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
 
-    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
+    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
 
     verifyZeroInteractions(mockUserService);
     assertThat(authResult).isPresent();

core/src/test/java/google/registry/schema/cursor/CursorDaoTest.java

@@ -0,0 +1,132 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.schema.cursor;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import google.registry.model.common.Cursor.CursorType;
+import google.registry.model.transaction.JpaTransactionManagerRule;
+import google.registry.testing.FakeClock;
+import java.util.List;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Unit tests for {@link Cursor}. */
+@RunWith(JUnit4.class)
+public class CursorDaoTest {
+
+  private FakeClock fakeClock = new FakeClock();
+
+  @Rule
+  public final JpaTransactionManagerRule jpaTmRule =
+      new JpaTransactionManagerRule.Builder().build();
+
+  @Test
+  public void save_worksSuccessfullyOnNewCursor() {
+    Cursor cursor = Cursor.create(CursorType.BRDA, "tld", fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    Cursor returnedCursor = CursorDao.load(CursorType.BRDA, "tld");
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor.getCursorTime());
+  }
+
+  @Test
+  public void save_worksSuccessfullyOnExistingCursor() {
+    Cursor cursor = Cursor.create(CursorType.RDE_REPORT, "tld", fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    Cursor cursor2 = Cursor.create(CursorType.RDE_REPORT, "tld", fakeClock.nowUtc().plusDays(3));
+    CursorDao.save(cursor2);
+    Cursor returnedCursor = CursorDao.load(CursorType.RDE_REPORT, "tld");
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor2.getCursorTime());
+  }
+
+  @Test
+  public void save_worksSuccessfullyOnNewGlobalCursor() {
+    Cursor cursor = Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    Cursor returnedCursor = CursorDao.load(CursorType.RECURRING_BILLING);
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor.getCursorTime());
+  }
+
+  @Test
+  public void save_worksSuccessfullyOnExistingGlobalCursor() {
+    Cursor cursor = Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    Cursor cursor2 =
+        Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc().plusDays(3));
+    CursorDao.save(cursor2);
+    Cursor returnedCursor = CursorDao.load(CursorType.RECURRING_BILLING);
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor2.getCursorTime());
+  }
+
+  @Test
+  public void load_worksSuccessfully() {
+    Cursor cursor = Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc());
+    Cursor cursor2 = Cursor.create(CursorType.RDE_REPORT, "tld", fakeClock.nowUtc());
+    Cursor cursor3 = Cursor.create(CursorType.RDE_REPORT, "foo", fakeClock.nowUtc());
+    Cursor cursor4 = Cursor.create(CursorType.BRDA, "foo", fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    CursorDao.save(cursor2);
+    CursorDao.save(cursor3);
+    CursorDao.save(cursor4);
+    Cursor returnedCursor = CursorDao.load(CursorType.RDE_REPORT, "tld");
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor2.getCursorTime());
+    returnedCursor = CursorDao.load(CursorType.BRDA, "foo");
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor4.getCursorTime());
+    returnedCursor = CursorDao.load(CursorType.RECURRING_BILLING);
+    assertThat(returnedCursor.getCursorTime()).isEqualTo(cursor.getCursorTime());
+  }
+
+  @Test
+  public void loadAll_worksSuccessfully() {
+    Cursor cursor = Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc());
+    Cursor cursor2 = Cursor.create(CursorType.RDE_REPORT, "tld", fakeClock.nowUtc());
+    Cursor cursor3 = Cursor.create(CursorType.RDE_REPORT, "foo", fakeClock.nowUtc());
+    Cursor cursor4 = Cursor.create(CursorType.BRDA, "foo", fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    CursorDao.save(cursor2);
+    CursorDao.save(cursor3);
+    CursorDao.save(cursor4);
+    List<Cursor> returnedCursors = CursorDao.loadAll();
+    assertThat(returnedCursors.size()).isEqualTo(4);
+  }
+
+  @Test
+  public void loadAll_worksSuccessfullyEmptyTable() {
+    List<Cursor> returnedCursors = CursorDao.loadAll();
+    assertThat(returnedCursors.size()).isEqualTo(0);
+  }
+
+  @Test
+  public void loadByType_worksSuccessfully() {
+    Cursor cursor = Cursor.createGlobal(CursorType.RECURRING_BILLING, fakeClock.nowUtc());
+    Cursor cursor2 = Cursor.create(CursorType.RDE_REPORT, "tld", fakeClock.nowUtc());
+    Cursor cursor3 = Cursor.create(CursorType.RDE_REPORT, "foo", fakeClock.nowUtc());
+    Cursor cursor4 = Cursor.create(CursorType.BRDA, "foo", fakeClock.nowUtc());
+    CursorDao.save(cursor);
+    CursorDao.save(cursor2);
+    CursorDao.save(cursor3);
+    CursorDao.save(cursor4);
+    List<Cursor> returnedCursors = CursorDao.loadByType(CursorType.RDE_REPORT);
+    assertThat(returnedCursors.size()).isEqualTo(2);
+  }
+
+  @Test
+  public void loadByType_worksSuccessfullyNoneOfType() {
+    List<Cursor> returnedCursors = CursorDao.loadByType(CursorType.RDE_REPORT);
+    assertThat(returnedCursors.size()).isEqualTo(0);
+  }
+}

core/src/test/java/google/registry/schema/integration/SqlIntegrationMembershipTest.java

@@ -71,8 +71,13 @@ public class SqlIntegrationMembershipTest {
   }
 
   private static boolean isSqlDependent(Class<?> testClass) {
-    return Stream.of(testClass.getDeclaredFields())
-        .map(Field::getType)
-        .anyMatch(JpaTransactionManagerRule.class::equals);
+    for (Class<?> clazz = testClass; clazz != null; clazz = clazz.getSuperclass()) {
+      if (Stream.of(clazz.getDeclaredFields())
+          .map(Field::getType)
+          .anyMatch(JpaTransactionManagerRule.class::equals)) {
+        return true;
+      }
+    }
+    return false;
   }
 }

core/src/test/java/google/registry/schema/integration/SqlIntegrationTestSuite.java

@@ -25,6 +25,7 @@ import google.registry.persistence.DateTimeConverterTest;
 import google.registry.persistence.JodaMoneyConverterTest;
 import google.registry.persistence.UpdateAutoTimestampConverterTest;
 import google.registry.persistence.ZonedDateTimeConverterTest;
+import google.registry.schema.cursor.CursorDaoTest;
 import google.registry.schema.tld.PremiumListDaoTest;
 import google.registry.ui.server.registrar.RegistryLockGetActionTest;
 import org.junit.runner.RunWith;
@@ -47,6 +48,7 @@ import org.junit.runners.Suite.SuiteClasses;
   ClaimsListDaoTest.class,
   CreateAutoTimestampConverterTest.class,
   CurrencyUnitConverterTest.class,
+  CursorDaoTest.class,
   DateTimeConverterTest.class,
   JodaMoneyConverterTest.class,
   JpaTransactionManagerImplTest.class,

core/src/test/java/google/registry/schema/tld/PremiumListDaoTest.java

@@ -15,13 +15,25 @@
 package google.registry.schema.tld;
 
 import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
 import static google.registry.model.transaction.TransactionManagerFactory.jpaTm;
+import static google.registry.testing.DatastoreHelper.createTld;
+import static google.registry.testing.DatastoreHelper.newRegistry;
+import static google.registry.testing.DatastoreHelper.persistResource;
 import static google.registry.testing.JUnitBackports.assertThrows;
+import static org.joda.money.CurrencyUnit.JPY;
+import static org.joda.money.CurrencyUnit.USD;
 
 import com.google.common.collect.ImmutableMap;
+import com.googlecode.objectify.Key;
+import google.registry.model.registry.Registry;
 import google.registry.model.transaction.JpaTransactionManagerRule;
+import google.registry.testing.AppEngineRule;
 import java.math.BigDecimal;
-import org.joda.money.CurrencyUnit;
+import java.util.List;
+import java.util.Optional;
+import org.joda.money.Money;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -35,6 +47,8 @@ public class PremiumListDaoTest {
   public final JpaTransactionManagerRule jpaTmRule =
       new JpaTransactionManagerRule.Builder().build();
 
+  @Rule public final AppEngineRule appEngine = AppEngineRule.builder().withDatastore().build();
+
   private static final ImmutableMap<String, BigDecimal> TEST_PRICES =
       ImmutableMap.of(
           "silver",
@@ -46,7 +60,7 @@ public class PremiumListDaoTest {
 
   @Test
   public void saveNew_worksSuccessfully() {
-    PremiumList premiumList = PremiumList.create("testname", CurrencyUnit.USD, TEST_PRICES);
+    PremiumList premiumList = PremiumList.create("testname", USD, TEST_PRICES);
     PremiumListDao.saveNew(premiumList);
     jpaTm()
         .transact(
@@ -64,22 +78,114 @@ public class PremiumListDaoTest {
             });
   }
 
+  @Test
+  public void update_worksSuccessfully() {
+    PremiumListDao.saveNew(
+        PremiumList.create(
+            "testname", USD, ImmutableMap.of("firstversion", BigDecimal.valueOf(123.45))));
+    PremiumListDao.update(PremiumList.create("testname", USD, TEST_PRICES));
+    jpaTm()
+        .transact(
+            () -> {
+              List<PremiumList> persistedLists =
+                  jpaTm()
+                      .getEntityManager()
+                      .createQuery(
+                          "SELECT pl FROM PremiumList pl WHERE pl.name = :name ORDER BY"
+                              + " pl.revisionId",
+                          PremiumList.class)
+                      .setParameter("name", "testname")
+                      .getResultList();
+              assertThat(persistedLists).hasSize(2);
+              assertThat(persistedLists.get(1).getLabelsToPrices())
+                  .containsExactlyEntriesIn(TEST_PRICES);
+              assertThat(persistedLists.get(1).getCreationTimestamp())
+                  .isEqualTo(jpaTmRule.getTxnClock().nowUtc());
+            });
+  }
+
   @Test
   public void saveNew_throwsWhenPremiumListAlreadyExists() {
-    PremiumListDao.saveNew(PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES));
+    PremiumListDao.saveNew(PremiumList.create("testlist", USD, TEST_PRICES));
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
-            () ->
-                PremiumListDao.saveNew(
-                    PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES)));
-    assertThat(thrown).hasMessageThat().contains("A premium list of this name already exists");
+            () -> PremiumListDao.saveNew(PremiumList.create("testlist", USD, TEST_PRICES)));
+    assertThat(thrown).hasMessageThat().isEqualTo("Premium list 'testlist' already exists");
+  }
+
+  @Test
+  public void update_throwsWhenPremiumListDoesntExist() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> PremiumListDao.update(PremiumList.create("testlist", USD, TEST_PRICES)));
+    assertThat(thrown)
+        .hasMessageThat()
+        .isEqualTo("Can't update non-existent premium list 'testlist'");
   }
 
   @Test
   public void checkExists_worksSuccessfully() {
     assertThat(PremiumListDao.checkExists("testlist")).isFalse();
-    PremiumListDao.saveNew(PremiumList.create("testlist", CurrencyUnit.USD, TEST_PRICES));
+    PremiumListDao.saveNew(PremiumList.create("testlist", USD, TEST_PRICES));
     assertThat(PremiumListDao.checkExists("testlist")).isTrue();
   }
+
+  @Test
+  public void getLatestRevision_returnsEmptyForNonexistentList() {
+    assertThat(PremiumListDao.getLatestRevision("nonexistentlist")).isEmpty();
+  }
+
+  @Test
+  public void getLatestRevision_worksSuccessfully() {
+    PremiumListDao.saveNew(
+        PremiumList.create("list1", JPY, ImmutableMap.of("wrong", BigDecimal.valueOf(1000.50))));
+    PremiumListDao.update(PremiumList.create("list1", JPY, TEST_PRICES));
+    jpaTm()
+        .transact(
+            () -> {
+              Optional<PremiumList> persistedList = PremiumListDao.getLatestRevision("list1");
+              assertThat(persistedList).isPresent();
+              assertThat(persistedList.get().getName()).isEqualTo("list1");
+              assertThat(persistedList.get().getCurrency()).isEqualTo(JPY);
+              assertThat(persistedList.get().getLabelsToPrices())
+                  .containsExactlyEntriesIn(TEST_PRICES);
+            });
+  }
+
+  @Test
+  public void getPremiumPrice_returnsNoneWhenNoPremiumListConfigured() {
+    persistResource(newRegistry("foobar", "FOOBAR").asBuilder().setPremiumList(null).build());
+    assertThat(PremiumListDao.getPremiumPrice("rich", Registry.get("foobar"))).isEmpty();
+  }
+
+  @Test
+  public void getPremiumPrice_worksSuccessfully() {
+    persistResource(
+        newRegistry("foobar", "FOOBAR")
+            .asBuilder()
+            .setPremiumListKey(
+                Key.create(
+                    getCrossTldKey(),
+                    google.registry.model.registry.label.PremiumList.class,
+                    "premlist"))
+            .build());
+    PremiumListDao.saveNew(PremiumList.create("premlist", USD, TEST_PRICES));
+    assertThat(PremiumListDao.getPremiumPrice("silver", Registry.get("foobar")))
+        .hasValue(Money.of(USD, 10.23));
+    assertThat(PremiumListDao.getPremiumPrice("gold", Registry.get("foobar")))
+        .hasValue(Money.of(USD, 1305.47));
+    assertThat(PremiumListDao.getPremiumPrice("zirconium", Registry.get("foobar"))).isEmpty();
+  }
+
+  @Test
+  public void testGetPremiumPrice_throwsWhenPremiumListCantBeLoaded() {
+    createTld("tld");
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class,
+            () -> PremiumListDao.getPremiumPrice("foobar", Registry.get("tld")));
+    assertThat(thrown).hasMessageThat().isEqualTo("Could not load premium list 'tld'");
+  }
 }

core/src/test/java/google/registry/testing/GoldenFileTestHelper.java

@@ -37,18 +37,18 @@ public class GoldenFileTestHelper {
   String goldenFileDescription = null;
 
   private static final String UPDATE_COMMAND =
-      "nomulus -e localhost %1$s > %2$s";
+      "../gradlew nomulus && java -jar build/libs/nomulus.jar -e localhost %s > %s";
 
   private static final String UPDATE_INSTRUCTIONS =
       Joiner.on('\n')
           .join(
               "",
               "-------------------------------------------------------------------------------",
-              "Your changes affect the %3$s. To update the checked-in version, run:",
+              "Your changes affect the %s. To update the checked-in version, run the following"
+                  + " command in the core project:",
               UPDATE_COMMAND,
               "");
 
-
   public static GoldenFileTestHelper assertThat(String actualValue) {
     return new GoldenFileTestHelper().setActualValue(actualValue);
   }
@@ -82,9 +82,9 @@ public class GoldenFileTestHelper {
           actualValue, expectedValue);
       assertWithMessage(
               UPDATE_INSTRUCTIONS,
+              goldenFileDescription,
               nomulusCommand,
-              filePath(context, filename),
-              goldenFileDescription)
+              filePath(context, filename))
           .fail();
     }
   }

core/src/test/java/google/registry/tools/GenerateSqlSchemaCommandTest.java

@@ -15,9 +15,9 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.truth.TextDiffSubject.assertThat;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
-import com.google.common.base.Charsets;
 import com.google.common.io.Files;
 import com.google.common.io.Resources;
 import google.registry.persistence.NomulusPostgreSql;
@@ -93,9 +93,7 @@ public class GenerateSqlSchemaCommandTest extends CommandTestCase<GenerateSqlSch
   public void validateGeneratedSchemaIsSameAsSchemaInFile() throws Exception {
     runCommand(
         "--start_postgresql", "--out_file=" + tmp.getRoot() + File.separatorChar + "schema.sql");
-    assertThat(Files.readLines(new File(tmp.getRoot(), "schema.sql"), Charsets.UTF_8))
-        .isEqualTo(
-            Resources.readLines(
-                Resources.getResource("sql/schema/db-schema.sql.generated"), Charsets.UTF_8));
+    assertThat(new File(tmp.getRoot(), "schema.sql").toURI().toURL())
+        .hasSameContentAs(Resources.getResource("sql/schema/db-schema.sql.generated"));
   }
 }

core/src/test/resources/google/registry/module/backend/backend_routing.txt

@@ -1,43 +1,43 @@
 PATH                                   CLASS                              METHODS  OK AUTH_METHODS MIN USER_POLICY
-/_dr/cron/commitLogCheckpoint          CommitLogCheckpointAction          GET      y  INTERNAL     APP IGNORED
-/_dr/cron/commitLogFanout              CommitLogFanoutAction              GET      y  INTERNAL     APP IGNORED
-/_dr/cron/fanout                       TldFanoutAction                    GET      y  INTERNAL     APP IGNORED
-/_dr/cron/readDnsQueue                 ReadDnsQueueAction                 GET      y  INTERNAL     APP IGNORED
-/_dr/dnsRefresh                        RefreshDnsAction                   GET      y  INTERNAL     APP IGNORED
-/_dr/task/backupDatastore              BackupDatastoreAction              POST     y  INTERNAL     APP IGNORED
-/_dr/task/brdaCopy                     BrdaCopyAction                     POST     y  INTERNAL     APP IGNORED
-/_dr/task/checkDatastoreBackup         CheckBackupAction                  POST,GET y  INTERNAL     APP IGNORED
+/_dr/cron/commitLogCheckpoint          CommitLogCheckpointAction          GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/commitLogFanout              CommitLogFanoutAction              GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/fanout                       TldFanoutAction                    GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/readDnsQueue                 ReadDnsQueueAction                 GET      y  INTERNAL,API APP ADMIN
+/_dr/dnsRefresh                        RefreshDnsAction                   GET      y  INTERNAL,API APP ADMIN
+/_dr/task/backupDatastore              BackupDatastoreAction              POST     y  INTERNAL,API APP ADMIN
+/_dr/task/brdaCopy                     BrdaCopyAction                     POST     y  INTERNAL,API APP ADMIN
+/_dr/task/checkDatastoreBackup         CheckBackupAction                  POST,GET y  INTERNAL,API APP ADMIN
 /_dr/task/copyDetailReports            CopyDetailReportsAction            POST     n  INTERNAL,API APP ADMIN
-/_dr/task/deleteContactsAndHosts       DeleteContactsAndHostsAction       GET      n  INTERNAL     APP IGNORED
-/_dr/task/deleteLoadTestData           DeleteLoadTestDataAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/deleteOldCommitLogs          DeleteOldCommitLogsAction          GET      n  INTERNAL     APP IGNORED
-/_dr/task/deleteProberData             DeleteProberDataAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET      n  INTERNAL     APP IGNORED
-/_dr/task/exportCommitLogDiff          ExportCommitLogDiffAction          POST     y  INTERNAL     APP IGNORED
-/_dr/task/exportDomainLists            ExportDomainListsAction            POST     n  INTERNAL     APP IGNORED
-/_dr/task/exportPremiumTerms           ExportPremiumTermsAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/exportReservedTerms          ExportReservedTermsAction          POST     n  INTERNAL     APP IGNORED
-/_dr/task/generateInvoices             GenerateInvoicesAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/generateSpec11               GenerateSpec11ReportAction         POST     n  INTERNAL     APP IGNORED
-/_dr/task/icannReportingStaging        IcannReportingStagingAction        POST     n  INTERNAL     APP IGNORED
+/_dr/task/deleteContactsAndHosts       DeleteContactsAndHostsAction       GET      n  INTERNAL,API APP ADMIN
+/_dr/task/deleteLoadTestData           DeleteLoadTestDataAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/deleteOldCommitLogs          DeleteOldCommitLogsAction          GET      n  INTERNAL,API APP ADMIN
+/_dr/task/deleteProberData             DeleteProberDataAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET      n  INTERNAL,API APP ADMIN
+/_dr/task/exportCommitLogDiff          ExportCommitLogDiffAction          POST     y  INTERNAL,API APP ADMIN
+/_dr/task/exportDomainLists            ExportDomainListsAction            POST     n  INTERNAL,API APP ADMIN
+/_dr/task/exportPremiumTerms           ExportPremiumTermsAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/exportReservedTerms          ExportReservedTermsAction          POST     n  INTERNAL,API APP ADMIN
+/_dr/task/generateInvoices             GenerateInvoicesAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/generateSpec11               GenerateSpec11ReportAction         POST     n  INTERNAL,API APP ADMIN
+/_dr/task/icannReportingStaging        IcannReportingStagingAction        POST     n  INTERNAL,API APP ADMIN
 /_dr/task/icannReportingUpload         IcannReportingUploadAction         POST     n  INTERNAL,API APP ADMIN
-/_dr/task/nordnUpload                  NordnUploadAction                  POST     y  INTERNAL     APP IGNORED
-/_dr/task/nordnVerify                  NordnVerifyAction                  POST     y  INTERNAL     APP IGNORED
-/_dr/task/pollBigqueryJob              BigqueryPollJobAction              GET,POST y  INTERNAL     APP IGNORED
-/_dr/task/publishDnsUpdates            PublishDnsUpdatesAction            POST     y  INTERNAL     APP IGNORED
+/_dr/task/nordnUpload                  NordnUploadAction                  POST     y  INTERNAL,API APP ADMIN
+/_dr/task/nordnVerify                  NordnVerifyAction                  POST     y  INTERNAL,API APP ADMIN
+/_dr/task/pollBigqueryJob              BigqueryPollJobAction              GET,POST y  INTERNAL,API APP ADMIN
+/_dr/task/publishDnsUpdates            PublishDnsUpdatesAction            POST     y  INTERNAL,API APP ADMIN
 /_dr/task/publishInvoices              PublishInvoicesAction              POST     n  INTERNAL,API APP ADMIN
 /_dr/task/publishSpec11                PublishSpec11ReportAction          POST     n  INTERNAL,API APP ADMIN
-/_dr/task/rdeReport                    RdeReportAction                    POST     n  INTERNAL     APP IGNORED
-/_dr/task/rdeStaging                   RdeStagingAction                   GET,POST n  INTERNAL     APP IGNORED
-/_dr/task/rdeUpload                    RdeUploadAction                    POST     n  INTERNAL     APP IGNORED
-/_dr/task/refreshDnsOnHostRename       RefreshDnsOnHostRenameAction       GET      n  INTERNAL     APP IGNORED
+/_dr/task/rdeReport                    RdeReportAction                    POST     n  INTERNAL,API APP ADMIN
+/_dr/task/rdeStaging                   RdeStagingAction                   GET,POST n  INTERNAL,API APP ADMIN
+/_dr/task/rdeUpload                    RdeUploadAction                    POST     n  INTERNAL,API APP ADMIN
+/_dr/task/refreshDnsOnHostRename       RefreshDnsOnHostRenameAction       GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveAllEppResources        ResaveAllEppResourcesAction        GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveEntity                 ResaveEntityAction                 POST     n  INTERNAL,API APP ADMIN
-/_dr/task/syncGroupMembers             SyncGroupMembersAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/syncRegistrarsSheet          SyncRegistrarsSheetAction          POST     n  INTERNAL     APP IGNORED
-/_dr/task/tmchCrl                      TmchCrlAction                      POST     y  INTERNAL     APP IGNORED
-/_dr/task/tmchDnl                      TmchDnlAction                      POST     y  INTERNAL     APP IGNORED
-/_dr/task/tmchSmdrl                    TmchSmdrlAction                    POST     y  INTERNAL     APP IGNORED
+/_dr/task/syncGroupMembers             SyncGroupMembersAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/syncRegistrarsSheet          SyncRegistrarsSheetAction          POST     n  INTERNAL,API APP ADMIN
+/_dr/task/tmchCrl                      TmchCrlAction                      POST     y  INTERNAL,API APP ADMIN
+/_dr/task/tmchDnl                      TmchDnlAction                      POST     y  INTERNAL,API APP ADMIN
+/_dr/task/tmchSmdrl                    TmchSmdrlAction                    POST     y  INTERNAL,API APP ADMIN
 /_dr/task/updateRegistrarRdapBaseUrls  UpdateRegistrarRdapBaseUrlsAction  GET      y  INTERNAL,API APP ADMIN
-/_dr/task/updateSnapshotView           UpdateSnapshotViewAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/uploadDatastoreBackup        UploadDatastoreBackupAction        POST     n  INTERNAL     APP IGNORED
+/_dr/task/updateSnapshotView           UpdateSnapshotViewAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/uploadDatastoreBackup        UploadDatastoreBackupAction        POST     n  INTERNAL,API APP ADMIN

core/src/test/resources/google/registry/module/tools/tools_routing.txt

@@ -13,8 +13,8 @@ PATH                              CLASS                         METHODS  OK AUTH
 /_dr/epptool                      EppToolAction                 POST     n  INTERNAL,API APP ADMIN
 /_dr/loadtest                     LoadTestAction                POST     y  INTERNAL,API APP ADMIN
 /_dr/task/generateZoneFiles       GenerateZoneFilesAction       POST     n  INTERNAL,API APP ADMIN
-/_dr/task/killAllCommitLogs       KillAllCommitLogsAction       POST     n  INTERNAL     APP IGNORED
-/_dr/task/killAllEppResources     KillAllEppResourcesAction     POST     n  INTERNAL     APP IGNORED
+/_dr/task/killAllCommitLogs       KillAllCommitLogsAction       POST     n  INTERNAL,API APP ADMIN
+/_dr/task/killAllEppResources     KillAllEppResourcesAction     POST     n  INTERNAL,API APP ADMIN
 /_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveAllHistoryEntries ResaveAllHistoryEntriesAction GET      n  INTERNAL,API APP ADMIN
 /_dr/task/restoreCommitLogs       RestoreCommitLogsAction       POST     y  INTERNAL,API APP ADMIN

db/build.gradle

@@ -71,14 +71,16 @@ ext {
   // production. The role parameter may be superuser. (More roles will be added
   // later).
   getCloudSqlCredential = { env, role ->
+    def devProject = project.hasProperty('devProject')
+        ? project.getProperty('devProject') : rootProject.devProject
     def command =
         """gsutil cp \
-           gs://${rootProject.devProject}-deploy/cloudsql-credentials/${env}/${role}_credential.enc - | \
+           gs://${devProject}-deploy/cloudsql-credentials/${env}/${role}_credential.enc - | \
            base64 -d | \
            gcloud kms decrypt --location global --keyring nomulus-tool-keyring \
            --key nomulus-tool-key --plaintext-file=- \
            --ciphertext-file=- \
-           --project=${rootProject.devProject}"""
+           --project=${devProject}"""
 
     return execInBash(command, '/tmp')
   }
@@ -104,17 +106,18 @@ task compileApiJar(type: Jar) {
 
 configurations {
   compileApi
+  schema
 }
 
 artifacts {
-  archives schemaJar
   compileApi compileApiJar
+  schema schemaJar
 }
 
 publishing {
   repositories {
     maven {
-      url project.schema_publish_repo
+      url project.publish_repo
     }
   }
   publications {
@@ -150,13 +153,15 @@ dependencies {
   testRuntime deps['com.google.flogger:flogger-system-backend']
   testCompile deps['com.google.guava:guava']
   testCompile deps['com.google.truth:truth']
-  testCompile deps['io.github.java-diff-utils:java-diff-utils']
+  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
   testCompile deps['junit:junit']
   testCompile deps['org.testcontainers:postgresql']
   testCompile deps['org.testcontainers:testcontainers']
+  testCompile project(path: ':common', configuration: 'testing')
   testCompile project(':third_party')
 }
 
+flywayInfo.dependsOn('buildNeeded')
 flywayValidate.dependsOn('buildNeeded')
 
 if (ext.isCloudSql()) {