Verify RegistryTool can instantiate (#400)

* Verify RegistryTool can instantiate

Add a task that instantiates all command classes in RegistryTool
with runtimeClasspath.

Also make sure that runtimeClasspath is a superset of
compileClasspath.

core/build.gradle

@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import java.lang.reflect.Constructor
+
 plugins {
   id 'java-library'
 }
@@ -660,6 +662,33 @@ task outcastTest(type: FilteringTest) {
   maxParallelForks 5
 }
 
+// Whitebox test verifying that RegistryTool can be instantiated. Note the
+// use of runtimeClasspath. This test emulates the logic in RegistryCli#run.
+// A to-do is added there to refactor.
+// TODO(weiminyu): Need a similar test for Registry server.
+task registryToolIntegrationTest {
+  dependsOn compileJava
+  doLast {
+    def classLoader =
+        new URLClassLoader(sourceSets.main.runtimeClasspath.collect {
+            it.toURI().toURL()
+        } as URL[])
+    def commandClasses =
+        (classLoader.loadClass('google.registry.tools.RegistryTool')
+            .getDeclaredField('COMMAND_MAP').get(null) as Map).values()
+
+    commandClasses.each {
+      try {
+        Constructor<?> c = ((Class<?>) it).getDeclaredConstructor()
+        c.setAccessible(true)
+        c.newInstance()
+      } catch (Throwable e) {
+        throw new RuntimeException("Failed to instantiate ${it}:\n ${e}")
+      }
+    }
+  }
+}
+
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
   systemProperties project.getProperties().subMap('sql_schema_resource_root')
@@ -779,7 +808,7 @@ test {
   // Don't run any tests from this task, all testing gets done in the
   // FilteringTest tasks.
   exclude "**"
-}.dependsOn(fragileTest, outcastTest, standardTest)
+}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest)
 
 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
 project.nomulus.dependsOn project(':third_party').jar

core/gradle/dependency-locks/compileClasspath.lockfile

@@ -205,7 +205,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2

core/gradle/dependency-locks/deploy_jar.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

core/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java

@@ -47,7 +47,7 @@ import org.joda.time.DateTime;
     path = "/_dr/cron/commitLogCheckpoint",
     method = Action.Method.GET,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogCheckpointAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java

@@ -65,7 +65,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteOldCommitLogs",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class DeleteOldCommitLogsAction implements Runnable {
 
   private static final int NUM_MAP_SHARDS = 20;

core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java

@@ -63,7 +63,7 @@ import org.joda.time.DateTime;
     path = ExportCommitLogDiffAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ExportCommitLogDiffAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -111,7 +111,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteContactsAndHosts",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteContactsAndHostsAction implements Runnable {
 
   static final String KIND_CONTACT = getKind(ContactResource.class);

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -55,7 +55,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteLoadTestData",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteLoadTestDataAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -68,7 +68,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = "/_dr/task/deleteProberData",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteProberDataAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java

@@ -75,7 +75,7 @@ import org.joda.time.DateTime;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/expandRecurringBillingEvents",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExpandRecurringBillingEventsAction implements Runnable {
 
   public static final String PARAM_CURSOR_TIME = "cursorTime";

core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java

@@ -75,7 +75,7 @@ import org.joda.time.Duration;
 @Action(
     service = Action.Service.BACKEND,
     path = "/_dr/task/refreshDnsOnHostRename",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class RefreshDnsOnHostRenameAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/cron/CommitLogFanoutAction.java

@@ -33,7 +33,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/commitLogFanout",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogFanoutAction implements Runnable {
 
   public static final String BUCKET_PARAM = "bucket";

core/src/main/java/google/registry/cron/TldFanoutAction.java

@@ -87,7 +87,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/fanout",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TldFanoutAction implements Runnable {
 
   /** A set of control params to TldFanoutAction that aren't passed down to the executing action. */

core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java

@@ -52,7 +52,7 @@ import org.joda.time.Duration;
     path = PublishDnsUpdatesAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {
 
   public static final String PATH = "/_dr/task/publishDnsUpdates";

core/src/main/java/google/registry/dns/ReadDnsQueueAction.java

@@ -80,7 +80,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = "/_dr/cron/readDnsQueue",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ReadDnsQueueAction implements Runnable {
 
   private static final String PARAM_JITTER_SECONDS = "jitterSeconds";

core/src/main/java/google/registry/dns/RefreshDnsAction.java

@@ -35,7 +35,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/dnsRefresh",
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RefreshDnsAction implements Runnable {
 
   private final Clock clock;

core/src/main/java/google/registry/export/BackupDatastoreAction.java

@@ -45,7 +45,7 @@ import javax.inject.Inject;
     path = BackupDatastoreAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BackupDatastoreAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/BigqueryPollJobAction.java

@@ -51,7 +51,7 @@ import org.joda.time.Duration;
     path = BigqueryPollJobAction.PATH,
     method = {Action.Method.GET, Action.Method.POST},
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BigqueryPollJobAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/CheckBackupAction.java

@@ -59,7 +59,7 @@ import org.joda.time.format.PeriodFormat;
     path = CheckBackupAction.PATH,
     method = {POST, GET},
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class CheckBackupAction implements Runnable {
 
   /** Parameter names for passing parameters into this action. */

core/src/main/java/google/registry/export/ExportDomainListsAction.java

@@ -65,7 +65,7 @@ import org.joda.time.DateTime;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportDomainLists",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportDomainListsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/ExportPremiumTermsAction.java

@@ -49,7 +49,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportPremiumTerms",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportPremiumTermsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/ExportReservedTermsAction.java

@@ -37,7 +37,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/exportReservedTerms",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportReservedTermsAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/SyncGroupMembersAction.java

@@ -56,7 +56,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = "/_dr/task/syncGroupMembers",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class SyncGroupMembersAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/export/UpdateSnapshotViewAction.java

@@ -39,7 +39,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = UpdateSnapshotViewAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UpdateSnapshotViewAction implements Runnable {
 
   /** Headers for passing parameters into the servlet. */

core/src/main/java/google/registry/export/UploadDatastoreBackupAction.java

@@ -52,7 +52,7 @@ import javax.inject.Inject;
     service = Action.Service.BACKEND,
     path = UploadDatastoreBackupAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UploadDatastoreBackupAction implements Runnable {
 
   /** Parameter names for passing parameters into the servlet. */

core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java

@@ -60,7 +60,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = SyncRegistrarsSheetAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class SyncRegistrarsSheetAction implements Runnable {
 
   private enum Result {

core/src/main/java/google/registry/flows/FlowRunner.java

@@ -109,7 +109,9 @@ public class FlowRunner {
     }
   }
 
-  /** Exception for explicitly propagating an EppException out of the transactional {@code Work}. */
+  /**
+   * Exception for explicitly propagating an EppException out of the transactional {@code Supplier}.
+   */
   private static class EppRuntimeException extends RuntimeException {
     EppRuntimeException(EppException cause) {
       super(cause);

core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java

@@ -30,28 +30,28 @@ import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.ImmutableObject;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
-/** Wrapper for {@link Work} that associates a time with each attempt. */
+/** Wrapper for {@link Supplier} that associates a time with each attempt. */
 class CommitLoggedWork<R> implements Runnable {
 
-  private final Work<R> work;
+  private final Supplier<R> work;
   private final Clock clock;
 
   /**
    * Temporary place to store the result of a non-void work.
    *
    * <p>We don't want to return the result directly because we are going to try to recover from a
-   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify
-   * when it tries to commit the transaction. When an exception is thrown the return value would be
-   * lost, but sometimes we will be able to determine that we actually succeeded despite the
-   * timeout, and we'll want to get the result.
+   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify when
+   * it tries to commit the transaction. When an exception is thrown the return value would be lost,
+   * but sometimes we will be able to determine that we actually succeeded despite the timeout, and
+   * we'll want to get the result.
    */
   private R result;
 
@@ -76,7 +76,7 @@ class CommitLoggedWork<R> implements Runnable {
   /** Lifecycle marker to track whether {@link #run} has been called. */
   private boolean runCalled;
 
-  CommitLoggedWork(Work<R> work, Clock clock) {
+  CommitLoggedWork(Supplier<R> work, Clock clock) {
     this.work = work;
     this.clock = clock;
   }
@@ -111,7 +111,7 @@ class CommitLoggedWork<R> implements Runnable {
     // Set the time to be used for "now" within the transaction.
     try {
       Ofy.TRANSACTION_INFO.set(createNewTransactionInfo());
-      result = work.run();
+      result = work.get();
       saveCommitLog(Ofy.TRANSACTION_INFO.get());
     } finally {
       Ofy.TRANSACTION_INFO.set(previous);

core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java

@@ -17,6 +17,7 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 
 import google.registry.model.transaction.TransactionManager;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
 /** Datastore implementation of {@link TransactionManager}. */
@@ -44,7 +45,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
     return getOfy().transact(work);
   }
 
@@ -54,7 +55,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
     return getOfy().transactNew(work);
   }
 
@@ -64,7 +65,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <R> R transactNewReadOnly(Work<R> work) {
+  public <R> R transactNewReadOnly(Supplier<R> work) {
     return getOfy().transactNewReadOnly(work);
   }
 
@@ -74,7 +75,7 @@ public class DatastoreTransactionManager implements TransactionManager {
   }
 
   @Override
-  public <R> R doTransactionless(Work<R> work) {
+  public <R> R doTransactionless(Supplier<R> work) {
     return getOfy().doTransactionless(work);
   }
 

core/src/main/java/google/registry/model/ofy/Ofy.java

@@ -38,7 +38,6 @@ import com.googlecode.objectify.cmd.Saver;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.VirtualEntity;
 import google.registry.model.ofy.ReadOnlyWork.KillTransactionException;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import google.registry.util.NonFinalForTesting;
 import google.registry.util.Sleeper;
@@ -46,6 +45,7 @@ import google.registry.util.SystemClock;
 import google.registry.util.SystemSleeper;
 import java.lang.annotation.Annotation;
 import java.util.Objects;
+import java.util.function.Supplier;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -194,9 +194,9 @@ public class Ofy {
   }
 
   /** Execute a transaction. */
-  <R> R transact(Work<R> work) {
+  <R> R transact(Supplier<R> work) {
     // If we are already in a transaction, don't wrap in a CommitLoggedWork.
-    return inTransaction() ? work.run() : transactNew(work);
+    return inTransaction() ? work.get() : transactNew(work);
   }
 
   /**
@@ -214,7 +214,7 @@ public class Ofy {
   }
 
   /** Pause the current transaction (if any) and complete this one before returning to it. */
-  <R> R transactNew(Work<R> work) {
+  <R> R transactNew(Supplier<R> work) {
     // Wrap the Work in a CommitLoggedWork so that we can give transactions a frozen view of time
     // and maintain commit logs for them.
     return transactCommitLoggedWork(new CommitLoggedWork<>(work, getClock()));
@@ -298,7 +298,7 @@ public class Ofy {
   }
 
   /** A read-only transaction is useful to get strongly consistent reads at a shared timestamp. */
-  <R> R transactNewReadOnly(Work<R> work) {
+  <R> R transactNewReadOnly(Supplier<R> work) {
     ReadOnlyWork<R> readOnlyWork = new ReadOnlyWork<>(work, getClock());
     try {
       ofy().transactNew(() -> {
@@ -324,11 +324,11 @@ public class Ofy {
   }
 
   /** Execute some work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work) {
+  <R> R doTransactionless(Supplier<R> work) {
     try {
       com.googlecode.objectify.ObjectifyService.push(
           com.googlecode.objectify.ObjectifyService.ofy().transactionless());
-      return work.run();
+      return work.get();
     } finally {
       com.googlecode.objectify.ObjectifyService.pop();
     }
@@ -342,11 +342,11 @@ public class Ofy {
    * Note that unlike a transaction's fresh session cache, the contents of this cache will be
    * discarded once the work completes, rather than being propagated into the enclosing session.
    */
-  public <R> R doWithFreshSessionCache(Work<R> work) {
+  public <R> R doWithFreshSessionCache(Supplier<R> work) {
     try {
       com.googlecode.objectify.ObjectifyService.push(
           com.googlecode.objectify.ObjectifyService.factory().begin());
-      return work.run();
+      return work.get();
     } finally {
       com.googlecode.objectify.ObjectifyService.pop();
     }

core/src/main/java/google/registry/model/ofy/ReadOnlyWork.java

@@ -14,13 +14,13 @@
 
 package google.registry.model.ofy;
 
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 
-/** Wrapper for {@link Work} that disallows mutations and fails the transaction at the end. */
+/** Wrapper for {@link Supplier} that disallows mutations and fails the transaction at the end. */
 class ReadOnlyWork<R> extends CommitLoggedWork<R> {
 
-  ReadOnlyWork(Work<R> work, Clock clock) {
+  ReadOnlyWork(Supplier<R> work, Clock clock) {
     super(work, clock);
   }
 

core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java

@@ -16,6 +16,7 @@ package google.registry.model.transaction;
 
 import com.google.common.flogger.FluentLogger;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 import javax.persistence.EntityManager;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.EntityTransaction;
@@ -63,11 +64,11 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
     // TODO(shicong): Investigate removing transactNew functionality after migration as it may
     //  be same as this one.
     if (inTransaction()) {
-      return work.run();
+      return work.get();
     }
     TransactionInfo txnInfo = transactionInfo.get();
     txnInfo.entityManager = emf.createEntityManager();
@@ -76,7 +77,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       txn.begin();
       txnInfo.inTransaction = true;
       txnInfo.transactionTime = clock.nowUtc();
-      T result = work.run();
+      T result = work.get();
       txn.commit();
       return result;
     } catch (RuntimeException e) {
@@ -102,7 +103,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
     // TODO(shicong): Implements the functionality to start a new transaction.
     throw new UnsupportedOperationException();
   }
@@ -114,7 +115,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T transactNewReadOnly(Work<T> work) {
+  public <T> T transactNewReadOnly(Supplier<T> work) {
     // TODO(shicong): Implements read only transaction.
     throw new UnsupportedOperationException();
   }
@@ -126,7 +127,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
   }
 
   @Override
-  public <T> T doTransactionless(Work<T> work) {
+  public <T> T doTransactionless(Supplier<T> work) {
     // TODO(shicong): Implements doTransactionless.
     throw new UnsupportedOperationException();
   }

core/src/main/java/google/registry/model/transaction/TransactionManager.java

@@ -14,6 +14,7 @@
 
 package google.registry.model.transaction;
 
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 
 /**
@@ -21,12 +22,6 @@ import org.joda.time.DateTime;
  */
 public interface TransactionManager {
 
-  /** This functional interface defines a method to execute a work and return the result. */
-  @FunctionalInterface
-  interface Work<R> {
-    R run();
-  }
-
   /** Returns {@code true} if the caller is in a transaction.
    *
    *  <p>Note that this function is kept for backward compatibility. We will review the use case
@@ -42,18 +37,19 @@ public interface TransactionManager {
   void assertInTransaction();
 
   /** Executes the work in a transaction and returns the result. */
-  <T> T transact(Work<T> work);
+  <T> T transact(Supplier<T> work);
 
   /** Executes the work in a transaction. */
   void transact(Runnable work);
 
-  /** Pauses the current transaction (if any), executes the work in a new transaction
-   *  and returns the result.
+  /**
+   * Pauses the current transaction (if any), executes the work in a new transaction and returns the
+   * result.
    *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
    */
-  <T> T transactNew(Work<T> work);
+  <T> T transactNew(Supplier<T> work);
 
   /** Pauses the current transaction (if any) and executes the work in a new transaction.
    *
@@ -62,12 +58,13 @@ public interface TransactionManager {
    */
   void transactNew(Runnable work);
 
-  /** Executes the work in a read-only transaction and returns the result.
+  /**
+   * Executes the work in a read-only transaction and returns the result.
    *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
    */
-  <R> R transactNewReadOnly(Work<R> work);
+  <R> R transactNewReadOnly(Supplier<R> work);
 
   /** Executes the work in a read-only transaction.
    *
@@ -77,7 +74,7 @@ public interface TransactionManager {
   void transactNewReadOnly(Runnable work);
 
   /** Executes the work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work);
+  <R> R doTransactionless(Supplier<R> work);
 
   /** Returns the time associated with the start of this particular transaction attempt. */
   DateTime getTransactionTime();

core/src/main/java/google/registry/rde/BrdaCopyAction.java

@@ -58,7 +58,7 @@ import org.joda.time.DateTime;
     path = BrdaCopyAction.PATH,
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class BrdaCopyAction implements Runnable {
 
   static final String PATH = "/_dr/task/brdaCopy";

core/src/main/java/google/registry/rde/RdeReportAction.java

@@ -53,7 +53,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeReportAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeReportAction implements Runnable, EscrowTask {
 
   static final String PATH = "/_dr/task/rdeReport";

core/src/main/java/google/registry/rde/RdeStagingAction.java

@@ -195,7 +195,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeStagingAction.PATH,
     method = {GET, POST},
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeStagingAction implements Runnable {
 
   public static final String PATH = "/_dr/task/rdeStaging";

core/src/main/java/google/registry/rde/RdeUploadAction.java

@@ -84,7 +84,7 @@ import org.joda.time.Duration;
     service = Action.Service.BACKEND,
     path = RdeUploadAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RdeUploadAction implements Runnable, EscrowTask {
 
   static final String PATH = "/_dr/task/rdeUpload";

core/src/main/java/google/registry/reporting/billing/GenerateInvoicesAction.java

@@ -50,7 +50,7 @@ import org.joda.time.YearMonth;
     service = Action.Service.BACKEND,
     path = GenerateInvoicesAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateInvoicesAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/reporting/icann/IcannReportingStagingAction.java

@@ -68,7 +68,7 @@ import org.joda.time.format.DateTimeFormat;
     service = Action.Service.BACKEND,
     path = IcannReportingStagingAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class IcannReportingStagingAction implements Runnable {
 
   static final String PATH = "/_dr/task/icannReportingStaging";

core/src/main/java/google/registry/reporting/spec11/GenerateSpec11ReportAction.java

@@ -49,7 +49,7 @@ import org.joda.time.LocalDate;
     service = Action.Service.BACKEND,
     path = GenerateSpec11ReportAction.PATH,
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class GenerateSpec11ReportAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/request/auth/Auth.java

@@ -73,15 +73,7 @@ public enum Auth {
   AUTH_INTERNAL_OR_ADMIN(
       ImmutableList.of(AuthMethod.INTERNAL, AuthMethod.API),
       AuthLevel.APP,
-      UserPolicy.ADMIN),
-
-  /**
-   * Allows only internal (App Engine task-queue) access.
-   */
-  AUTH_INTERNAL_ONLY(
-      ImmutableList.of(AuthMethod.INTERNAL),
-      AuthLevel.APP,
-      UserPolicy.IGNORED);
+      UserPolicy.ADMIN);
 
   private final AuthSettings authSettings;
 

core/src/main/java/google/registry/tmch/NordnUploadAction.java

@@ -74,7 +74,7 @@ import org.joda.time.Duration;
     path = NordnUploadAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnUploadAction implements Runnable {
 
   static final String PATH = "/_dr/task/nordnUpload";

core/src/main/java/google/registry/tmch/NordnVerifyAction.java

@@ -56,7 +56,7 @@ import javax.inject.Inject;
     path = NordnVerifyAction.PATH,
     method = Action.Method.POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class NordnVerifyAction implements Runnable {
 
   static final String PATH = "/_dr/task/nordnVerify";

core/src/main/java/google/registry/tmch/TmchCrlAction.java

@@ -32,7 +32,7 @@ import javax.inject.Inject;
     path = "/_dr/task/tmchCrl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchCrlAction implements Runnable {
 
   @Inject Marksdb marksdb;

core/src/main/java/google/registry/tmch/TmchDnlAction.java

@@ -36,7 +36,7 @@ import org.bouncycastle.openpgp.PGPException;
     path = "/_dr/task/tmchDnl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchDnlAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/tmch/TmchSmdrlAction.java

@@ -34,7 +34,7 @@ import org.bouncycastle.openpgp.PGPException;
     path = "/_dr/task/tmchSmdrl",
     method = POST,
     automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TmchSmdrlAction implements Runnable {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -104,6 +104,8 @@ final class RegistryCli implements AutoCloseable, CommandRunner {
     // Create all command instances. It would be preferrable to do this in the constructor, but
     // JCommander mutates the command instances and doesn't reset them so we have to do it for every
     // run.
+    // TODO(weiminyu): extract this into a standalone static method to simplify
+    //   :core:registryToolIntegrationTest
     try {
       for (Map.Entry<String, ? extends Class<? extends Command>> entry : commands.entrySet()) {
         Command command = entry.getValue().getDeclaredConstructor().newInstance();

core/src/main/java/google/registry/tools/server/KillAllCommitLogsAction.java

@@ -48,7 +48,7 @@ import javax.inject.Inject;
     service = Action.Service.TOOLS,
     path = "/_dr/task/killAllCommitLogs",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class KillAllCommitLogsAction implements Runnable {
 
   @Inject MapreduceRunner mrRunner;

core/src/main/java/google/registry/tools/server/KillAllEppResourcesAction.java

@@ -44,7 +44,7 @@ import javax.inject.Inject;
     service = Action.Service.TOOLS,
     path = "/_dr/task/killAllEppResources",
     method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class KillAllEppResourcesAction implements Runnable {
 
   @Inject MapreduceRunner mrRunner;

core/src/test/java/google/registry/model/ofy/OfyTest.java

@@ -45,12 +45,12 @@ import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.reporting.HistoryEntry;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.testing.AppEngineRule;
 import google.registry.testing.DatastoreHelper;
 import google.registry.testing.FakeClock;
 import google.registry.util.SystemClock;
 import java.util.ConcurrentModificationException;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;
 import org.junit.Before;
 import org.junit.Rule;
@@ -239,72 +239,88 @@ public class OfyTest {
 
   @Test
   public void testTransact_transientFailureException_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new TransientFailureException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new TransientFailureException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_noManifest_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        // We don't write anything in this transaction, so there is no commit log manifest.
-        // Therefore it's always safe to retry since nothing got written.
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new DatastoreTimeoutException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        // We don't write anything in this transaction, so there is no commit log
+                        // manifest.
+                        // Therefore it's always safe to retry since nothing got written.
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new DatastoreTimeoutException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_manifestNotWrittenToDatastore_retries() {
-    assertThat(tm().transact(new Work<Integer>() {
+    assertThat(
+            tm().transact(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        // There will be something in the manifest now, but it won't be committed if we throw.
-        ofy().save().entity(someObject);
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw new DatastoreTimeoutException("");
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        // There will be something in the manifest now, but it won't be committed if
+                        // we throw.
+                        ofy().save().entity(someObject);
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new DatastoreTimeoutException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test
   public void testTransact_datastoreTimeoutException_manifestWrittenToDatastore_returnsSuccess() {
     // A work unit that throws if it is ever retried.
-    Work work = new Work<Void>() {
-      boolean firstCallToVrun = true;
+    Supplier work =
+        new Supplier<Void>() {
+          boolean firstCallToVrun = true;
 
-      @Override
-      public Void run() {
-        if (firstCallToVrun) {
-          firstCallToVrun = false;
-          ofy().save().entity(someObject);
-          return null;
-        }
-        fail("Shouldn't have retried.");
-        return null;
-      }};
+          @Override
+          public Void get() {
+            if (firstCallToVrun) {
+              firstCallToVrun = false;
+              ofy().save().entity(someObject);
+              return null;
+            }
+            fail("Shouldn't have retried.");
+            return null;
+          }
+        };
     // A commit logged work that throws on the first attempt to get its result.
     CommitLoggedWork<Void> commitLoggedWork = new CommitLoggedWork<Void>(work, new SystemClock()) {
       boolean firstCallToGetResult = true;
@@ -323,18 +339,22 @@ public class OfyTest {
   }
 
   void doReadOnlyRetryTest(final RuntimeException e) {
-    assertThat(tm().transactNewReadOnly(new Work<Integer>() {
+    assertThat(
+            tm().transactNewReadOnly(
+                    new Supplier<Integer>() {
 
-      int count = 0;
+                      int count = 0;
 
-      @Override
-      public Integer run() {
-        count++;
-        if (count == 3) {
-          return count;
-        }
-        throw e;
-      }})).isEqualTo(3);
+                      @Override
+                      public Integer get() {
+                        count++;
+                        if (count == 3) {
+                          return count;
+                        }
+                        throw new TransientFailureException("");
+                      }
+                    }))
+        .isEqualTo(3);
   }
 
   @Test

core/src/test/java/google/registry/request/RouterTest.java

@@ -16,7 +16,7 @@ package google.registry.request;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
-import static google.registry.request.auth.Auth.AUTH_INTERNAL_ONLY;
+import static google.registry.request.auth.Auth.AUTH_INTERNAL_OR_ADMIN;
 import static google.registry.testing.JUnitBackports.assertThrows;
 
 import java.util.Optional;
@@ -45,7 +45,7 @@ public final class RouterTest {
 
   ////////////////////////////////////////////////////////////////////////////////////////////////
 
-  @Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_ONLY)
+  @Action(service = Action.Service.DEFAULT, path = "/sloth", auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class SlothTask implements Runnable {
     @Override
     public void run() {}
@@ -79,7 +79,7 @@ public final class RouterTest {
       service = Action.Service.DEFAULT,
       path = "/prefix",
       isPrefix = true,
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class PrefixTask implements Runnable {
     @Override
     public void run() {}
@@ -109,7 +109,7 @@ public final class RouterTest {
       service = Action.Service.DEFAULT,
       path = "/prefix/long",
       isPrefix = true,
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class LongTask implements Runnable {
     @Override
     public void run() {}
@@ -164,7 +164,7 @@ public final class RouterTest {
   @Action(
       service = Action.Service.DEFAULT,
       path = "/samePathAsOtherTask",
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class DuplicateTask1 implements Runnable {
     @Override
     public void run() {}
@@ -173,7 +173,7 @@ public final class RouterTest {
   @Action(
       service = Action.Service.DEFAULT,
       path = "/samePathAsOtherTask",
-      auth = AUTH_INTERNAL_ONLY)
+      auth = AUTH_INTERNAL_OR_ADMIN)
   public static final class DuplicateTask2 implements Runnable {
     @Override
     public void run() {}

core/src/test/java/google/registry/request/auth/RequestAuthenticatorTest.java

@@ -53,7 +53,7 @@ public class RequestAuthenticatorTest {
       AuthLevel.NONE,
       UserPolicy.IGNORED);
 
-  private static final AuthSettings AUTH_INTERNAL_ONLY = AuthSettings.create(
+  private static final AuthSettings AUTH_INTERNAL_OR_ADMIN = AuthSettings.create(
       ImmutableList.of(AuthMethod.INTERNAL),
       AuthLevel.APP,
       UserPolicy.IGNORED);
@@ -157,7 +157,7 @@ public class RequestAuthenticatorTest {
 
   @Test
   public void testInternalAuth_notInvokedInternally() {
-    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
+    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
 
     verifyZeroInteractions(mockUserService);
     assertThat(authResult).isEmpty();
@@ -167,7 +167,7 @@ public class RequestAuthenticatorTest {
   public void testInternalAuth_success() {
     when(req.getHeader("X-AppEngine-QueueName")).thenReturn("__cron");
 
-    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_ONLY);
+    Optional<AuthResult> authResult = runTest(mockUserService, AUTH_INTERNAL_OR_ADMIN);
 
     verifyZeroInteractions(mockUserService);
     assertThat(authResult).isPresent();

core/src/test/java/google/registry/schema/integration/SqlIntegrationMembershipTest.java

@@ -71,8 +71,13 @@ public class SqlIntegrationMembershipTest {
   }
 
   private static boolean isSqlDependent(Class<?> testClass) {
-    return Stream.of(testClass.getDeclaredFields())
-        .map(Field::getType)
-        .anyMatch(JpaTransactionManagerRule.class::equals);
+    for (Class<?> clazz = testClass; clazz != null; clazz = clazz.getSuperclass()) {
+      if (Stream.of(clazz.getDeclaredFields())
+          .map(Field::getType)
+          .anyMatch(JpaTransactionManagerRule.class::equals)) {
+        return true;
+      }
+    }
+    return false;
   }
 }

core/src/test/java/google/registry/testing/GoldenFileTestHelper.java

@@ -37,18 +37,18 @@ public class GoldenFileTestHelper {
   String goldenFileDescription = null;
 
   private static final String UPDATE_COMMAND =
-      "nomulus -e localhost %1$s > %2$s";
+      "../gradlew nomulus && java -jar build/libs/nomulus.jar -e localhost %s > %s";
 
   private static final String UPDATE_INSTRUCTIONS =
       Joiner.on('\n')
           .join(
               "",
               "-------------------------------------------------------------------------------",
-              "Your changes affect the %3$s. To update the checked-in version, run:",
+              "Your changes affect the %s. To update the checked-in version, run the following"
+                  + " command in the core project:",
               UPDATE_COMMAND,
               "");
 
-
   public static GoldenFileTestHelper assertThat(String actualValue) {
     return new GoldenFileTestHelper().setActualValue(actualValue);
   }
@@ -82,9 +82,9 @@ public class GoldenFileTestHelper {
           actualValue, expectedValue);
       assertWithMessage(
               UPDATE_INSTRUCTIONS,
+              goldenFileDescription,
               nomulusCommand,
-              filePath(context, filename),
-              goldenFileDescription)
+              filePath(context, filename))
           .fail();
     }
   }

core/src/test/resources/google/registry/module/backend/backend_routing.txt

@@ -1,43 +1,43 @@
 PATH                                   CLASS                              METHODS  OK AUTH_METHODS MIN USER_POLICY
-/_dr/cron/commitLogCheckpoint          CommitLogCheckpointAction          GET      y  INTERNAL     APP IGNORED
-/_dr/cron/commitLogFanout              CommitLogFanoutAction              GET      y  INTERNAL     APP IGNORED
-/_dr/cron/fanout                       TldFanoutAction                    GET      y  INTERNAL     APP IGNORED
-/_dr/cron/readDnsQueue                 ReadDnsQueueAction                 GET      y  INTERNAL     APP IGNORED
-/_dr/dnsRefresh                        RefreshDnsAction                   GET      y  INTERNAL     APP IGNORED
-/_dr/task/backupDatastore              BackupDatastoreAction              POST     y  INTERNAL     APP IGNORED
-/_dr/task/brdaCopy                     BrdaCopyAction                     POST     y  INTERNAL     APP IGNORED
-/_dr/task/checkDatastoreBackup         CheckBackupAction                  POST,GET y  INTERNAL     APP IGNORED
+/_dr/cron/commitLogCheckpoint          CommitLogCheckpointAction          GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/commitLogFanout              CommitLogFanoutAction              GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/fanout                       TldFanoutAction                    GET      y  INTERNAL,API APP ADMIN
+/_dr/cron/readDnsQueue                 ReadDnsQueueAction                 GET      y  INTERNAL,API APP ADMIN
+/_dr/dnsRefresh                        RefreshDnsAction                   GET      y  INTERNAL,API APP ADMIN
+/_dr/task/backupDatastore              BackupDatastoreAction              POST     y  INTERNAL,API APP ADMIN
+/_dr/task/brdaCopy                     BrdaCopyAction                     POST     y  INTERNAL,API APP ADMIN
+/_dr/task/checkDatastoreBackup         CheckBackupAction                  POST,GET y  INTERNAL,API APP ADMIN
 /_dr/task/copyDetailReports            CopyDetailReportsAction            POST     n  INTERNAL,API APP ADMIN
-/_dr/task/deleteContactsAndHosts       DeleteContactsAndHostsAction       GET      n  INTERNAL     APP IGNORED
-/_dr/task/deleteLoadTestData           DeleteLoadTestDataAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/deleteOldCommitLogs          DeleteOldCommitLogsAction          GET      n  INTERNAL     APP IGNORED
-/_dr/task/deleteProberData             DeleteProberDataAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET      n  INTERNAL     APP IGNORED
-/_dr/task/exportCommitLogDiff          ExportCommitLogDiffAction          POST     y  INTERNAL     APP IGNORED
-/_dr/task/exportDomainLists            ExportDomainListsAction            POST     n  INTERNAL     APP IGNORED
-/_dr/task/exportPremiumTerms           ExportPremiumTermsAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/exportReservedTerms          ExportReservedTermsAction          POST     n  INTERNAL     APP IGNORED
-/_dr/task/generateInvoices             GenerateInvoicesAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/generateSpec11               GenerateSpec11ReportAction         POST     n  INTERNAL     APP IGNORED
-/_dr/task/icannReportingStaging        IcannReportingStagingAction        POST     n  INTERNAL     APP IGNORED
+/_dr/task/deleteContactsAndHosts       DeleteContactsAndHostsAction       GET      n  INTERNAL,API APP ADMIN
+/_dr/task/deleteLoadTestData           DeleteLoadTestDataAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/deleteOldCommitLogs          DeleteOldCommitLogsAction          GET      n  INTERNAL,API APP ADMIN
+/_dr/task/deleteProberData             DeleteProberDataAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET      n  INTERNAL,API APP ADMIN
+/_dr/task/exportCommitLogDiff          ExportCommitLogDiffAction          POST     y  INTERNAL,API APP ADMIN
+/_dr/task/exportDomainLists            ExportDomainListsAction            POST     n  INTERNAL,API APP ADMIN
+/_dr/task/exportPremiumTerms           ExportPremiumTermsAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/exportReservedTerms          ExportReservedTermsAction          POST     n  INTERNAL,API APP ADMIN
+/_dr/task/generateInvoices             GenerateInvoicesAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/generateSpec11               GenerateSpec11ReportAction         POST     n  INTERNAL,API APP ADMIN
+/_dr/task/icannReportingStaging        IcannReportingStagingAction        POST     n  INTERNAL,API APP ADMIN
 /_dr/task/icannReportingUpload         IcannReportingUploadAction         POST     n  INTERNAL,API APP ADMIN
-/_dr/task/nordnUpload                  NordnUploadAction                  POST     y  INTERNAL     APP IGNORED
-/_dr/task/nordnVerify                  NordnVerifyAction                  POST     y  INTERNAL     APP IGNORED
-/_dr/task/pollBigqueryJob              BigqueryPollJobAction              GET,POST y  INTERNAL     APP IGNORED
-/_dr/task/publishDnsUpdates            PublishDnsUpdatesAction            POST     y  INTERNAL     APP IGNORED
+/_dr/task/nordnUpload                  NordnUploadAction                  POST     y  INTERNAL,API APP ADMIN
+/_dr/task/nordnVerify                  NordnVerifyAction                  POST     y  INTERNAL,API APP ADMIN
+/_dr/task/pollBigqueryJob              BigqueryPollJobAction              GET,POST y  INTERNAL,API APP ADMIN
+/_dr/task/publishDnsUpdates            PublishDnsUpdatesAction            POST     y  INTERNAL,API APP ADMIN
 /_dr/task/publishInvoices              PublishInvoicesAction              POST     n  INTERNAL,API APP ADMIN
 /_dr/task/publishSpec11                PublishSpec11ReportAction          POST     n  INTERNAL,API APP ADMIN
-/_dr/task/rdeReport                    RdeReportAction                    POST     n  INTERNAL     APP IGNORED
-/_dr/task/rdeStaging                   RdeStagingAction                   GET,POST n  INTERNAL     APP IGNORED
-/_dr/task/rdeUpload                    RdeUploadAction                    POST     n  INTERNAL     APP IGNORED
-/_dr/task/refreshDnsOnHostRename       RefreshDnsOnHostRenameAction       GET      n  INTERNAL     APP IGNORED
+/_dr/task/rdeReport                    RdeReportAction                    POST     n  INTERNAL,API APP ADMIN
+/_dr/task/rdeStaging                   RdeStagingAction                   GET,POST n  INTERNAL,API APP ADMIN
+/_dr/task/rdeUpload                    RdeUploadAction                    POST     n  INTERNAL,API APP ADMIN
+/_dr/task/refreshDnsOnHostRename       RefreshDnsOnHostRenameAction       GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveAllEppResources        ResaveAllEppResourcesAction        GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveEntity                 ResaveEntityAction                 POST     n  INTERNAL,API APP ADMIN
-/_dr/task/syncGroupMembers             SyncGroupMembersAction             POST     n  INTERNAL     APP IGNORED
-/_dr/task/syncRegistrarsSheet          SyncRegistrarsSheetAction          POST     n  INTERNAL     APP IGNORED
-/_dr/task/tmchCrl                      TmchCrlAction                      POST     y  INTERNAL     APP IGNORED
-/_dr/task/tmchDnl                      TmchDnlAction                      POST     y  INTERNAL     APP IGNORED
-/_dr/task/tmchSmdrl                    TmchSmdrlAction                    POST     y  INTERNAL     APP IGNORED
+/_dr/task/syncGroupMembers             SyncGroupMembersAction             POST     n  INTERNAL,API APP ADMIN
+/_dr/task/syncRegistrarsSheet          SyncRegistrarsSheetAction          POST     n  INTERNAL,API APP ADMIN
+/_dr/task/tmchCrl                      TmchCrlAction                      POST     y  INTERNAL,API APP ADMIN
+/_dr/task/tmchDnl                      TmchDnlAction                      POST     y  INTERNAL,API APP ADMIN
+/_dr/task/tmchSmdrl                    TmchSmdrlAction                    POST     y  INTERNAL,API APP ADMIN
 /_dr/task/updateRegistrarRdapBaseUrls  UpdateRegistrarRdapBaseUrlsAction  GET      y  INTERNAL,API APP ADMIN
-/_dr/task/updateSnapshotView           UpdateSnapshotViewAction           POST     n  INTERNAL     APP IGNORED
-/_dr/task/uploadDatastoreBackup        UploadDatastoreBackupAction        POST     n  INTERNAL     APP IGNORED
+/_dr/task/updateSnapshotView           UpdateSnapshotViewAction           POST     n  INTERNAL,API APP ADMIN
+/_dr/task/uploadDatastoreBackup        UploadDatastoreBackupAction        POST     n  INTERNAL,API APP ADMIN

core/src/test/resources/google/registry/module/tools/tools_routing.txt

@@ -13,8 +13,8 @@ PATH                              CLASS                         METHODS  OK AUTH
 /_dr/epptool                      EppToolAction                 POST     n  INTERNAL,API APP ADMIN
 /_dr/loadtest                     LoadTestAction                POST     y  INTERNAL,API APP ADMIN
 /_dr/task/generateZoneFiles       GenerateZoneFilesAction       POST     n  INTERNAL,API APP ADMIN
-/_dr/task/killAllCommitLogs       KillAllCommitLogsAction       POST     n  INTERNAL     APP IGNORED
-/_dr/task/killAllEppResources     KillAllEppResourcesAction     POST     n  INTERNAL     APP IGNORED
+/_dr/task/killAllCommitLogs       KillAllCommitLogsAction       POST     n  INTERNAL,API APP ADMIN
+/_dr/task/killAllEppResources     KillAllEppResourcesAction     POST     n  INTERNAL,API APP ADMIN
 /_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET      n  INTERNAL,API APP ADMIN
 /_dr/task/resaveAllHistoryEntries ResaveAllHistoryEntriesAction GET      n  INTERNAL,API APP ADMIN
 /_dr/task/restoreCommitLogs       RestoreCommitLogsAction       POST     y  INTERNAL,API APP ADMIN

docs/authentication-framework.md

@@ -117,11 +117,6 @@ make sense. A master enumeration lists all the valid triplets. They are:
     because we don't require a user for internal requests, but the user policy
     is `ADMIN`, meaning that if there *is* a user, it needs to be an admin.
 
-* `AUTH_INTERNAL_ONLY`: Only internal requests are allowed. This is appropriate
-    for actions which are only executed by cron jobs, and therefore have no
-    authenticated user. The method is `INTERNAL`, the minimum level is `APP`,
-    and the user policy is `IGNORED`.
-
 *  `AUTH_PUBLIC_OR_INTERNAL`: Allows anyone access, as long as they use OAuth to
     authenticate. Also allows access from App Engine task-queue. Note that OAuth
     client ID still needs to be whitelisted in the config file for OAuth-based

java_common.gradle

@@ -54,13 +54,17 @@ tasks.test.finalizedBy jacocoTestReport
 configurations {
   deploy_jar.extendsFrom runtimeClasspath
 
-  runtimeClasspath {
+  all.findAll {
+    it.name in ['runtimeClasspath', 'compileClasspath']
+  }.each {
     // JUnit is from org.apache.beam:beam-runners-google-cloud-dataflow-java,
     // testcontainer (which we use in the nomulus tool), and json-simple.
-    exclude group: 'junit'
+    // We should really be excluding this, however GenerateSqlCommand in
+    // nomulus-tool currently uses testcontainers which, in turn, needs junit.
+    //exclude group: 'junit'
     // Mockito is from org.apache.beam:beam-runners-google-cloud-dataflow-java
     // See https://issues.apache.org/jira/browse/BEAM-8862
-    exclude group: 'org.mockito', module: 'mockito-core'
+    it.exclude group: 'org.mockito', module: 'mockito-core'
   }
 }
 

services/backend/gradle/dependency-locks/compile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/compileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/default.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/runtime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/testCompile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/testRuntime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/backend/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/compile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/compileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/default.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/runtime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/testCompile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/testRuntime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/default/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/compile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/compileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/default.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/runtime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/testCompile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/testRuntime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/pubapi/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/compile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/compileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/default.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/runtime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/testCompile.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -175,6 +175,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -204,6 +205,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/testRuntime.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final

services/tools/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -176,6 +176,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
+junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -205,6 +206,7 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final