Add a 'Host' parameter to the relock action enqueuer (#699)

* Add a 'Host' parameter to the relock action enqueuer

I believe this is why we are seeing 404s currently -- we should be
specifying the backend host as the target like we do for the
resave-entity async action.

core/src/main/java/google/registry/batch/AsyncTaskEnqueuer.java

@@ -169,10 +169,12 @@ public final class AsyncTaskEnqueuer {
         lock.getRelockDuration().isPresent(),
         "Lock with ID %s not configured for relock",
         lock.getRevisionId());
+    String backendHostname = appEngineServiceUtils.getServiceHostname("backend");
     addTaskToQueueWithRetry(
         asyncActionsPushQueue,
         TaskOptions.Builder.withUrl(RelockDomainAction.PATH)
             .method(Method.POST)
+            .header("Host", backendHostname)
             .param(
                 RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,
                 String.valueOf(lock.getRevisionId()))

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -532,7 +532,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
           resource.getClass().getSimpleName());
       return new AutoValue_DeleteContactsAndHostsAction_DeletionRequest.Builder()
           .setKey(resourceKey)
-          .setLastUpdateTime(resource.getUpdateAutoTimestamp().getTimestamp())
+          .setLastUpdateTime(resource.getUpdateTimestamp().getTimestamp())
           .setRequestingClientId(
               checkNotNull(
                   params.get(PARAM_REQUESTING_CLIENT_ID), "Requesting client id not specified"))

core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java

@@ -319,13 +319,13 @@ public class RefreshDnsOnHostRenameAction implements Runnable {
       HostResource host =
           checkNotNull(ofy().load().key(hostKey).now(), "Host to refresh doesn't exist");
       boolean isHostDeleted =
-          isDeleted(host, latestOf(now, host.getUpdateAutoTimestamp().getTimestamp()));
+          isDeleted(host, latestOf(now, host.getUpdateTimestamp().getTimestamp()));
       if (isHostDeleted) {
         logger.atInfo().log("Host %s is already deleted, not refreshing DNS.", hostKey);
       }
       return new AutoValue_RefreshDnsOnHostRenameAction_DnsRefreshRequest.Builder()
           .setHostKey(hostKey)
-          .setLastUpdateTime(host.getUpdateAutoTimestamp().getTimestamp())
+          .setLastUpdateTime(host.getUpdateTimestamp().getTimestamp())
           .setRequestedTime(
               DateTime.parse(
                   checkNotNull(params.get(PARAM_REQUESTED_TIME), "Requested time not specified")))

core/src/main/java/google/registry/beam/spec11/sql/subdomains.sql

@@ -21,7 +21,7 @@
 SELECT
   domain.fullyQualifiedDomainName AS domainName,
   domain.__key__.name AS domainRepoId,
-  registrar.clientId AS clientId,
+  registrar.clientId AS registrarId,
   COALESCE(registrar.emailAddress, '') AS registrarEmailAddress
 FROM ( (
     SELECT

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/cron.xml

@@ -18,7 +18,14 @@
       and streams it to cloud storage. When this job has finished successfully, it'll
       launch a separate task that uploads the deposit file to Iron Mountain via SFTP.
     </description>
-    <schedule>every day 00:07</schedule>
+    <!--
+      This only needs to run once per day, but we launch additional jobs in case the
+      cursor is lagging behind, so it'll catch up to the current date eventually.
+
+      See <a href="../../../production/default/WEB-INF/cron.xml">production config</a> for an
+      explanation of job starting times.
+    -->
+    <schedule>every 12 hours from 00:07 to 12:07</schedule>
     <target>backend</target>
   </cron>
 

core/src/main/java/google/registry/model/BackupGroupRoot.java

@@ -14,16 +14,21 @@
 
 package google.registry.model;
 
+import com.google.common.annotations.VisibleForTesting;
+import javax.persistence.Access;
+import javax.persistence.AccessType;
+import javax.persistence.MappedSuperclass;
 import javax.xml.bind.annotation.XmlTransient;
 
 /**
  * Base class for entities that are the root of a Registry 2.0 entity group that gets enrolled in
  * commit logs for backup purposes.
  *
- * <p>The commit log system needs to preserve the ordering of closely timed mutations to entities
- * in a single entity group. We require an {@link UpdateAutoTimestamp} field on the root of a group
- * so that we can enforce strictly increasing timestamps.
+ * <p>The commit log system needs to preserve the ordering of closely timed mutations to entities in
+ * a single entity group. We require an {@link UpdateAutoTimestamp} field on the root of a group so
+ * that we can enforce strictly increasing timestamps.
  */
+@MappedSuperclass
 public abstract class BackupGroupRoot extends ImmutableObject {
   /**
    * An automatically managed timestamp of when this object was last written to Datastore.
@@ -32,10 +37,14 @@ public abstract class BackupGroupRoot extends ImmutableObject {
    * that this is updated on every save, rather than only in response to an {@code <update>} command
    */
   @XmlTransient
+  // Prevents subclasses from unexpectedly accessing as property (e.g., HostResource), which would
+  // require an unnecessary non-private setter method.
+  @Access(AccessType.FIELD)
+  @VisibleForTesting
   UpdateAutoTimestamp updateTimestamp = UpdateAutoTimestamp.create(null);
 
   /** Get the {@link UpdateAutoTimestamp} for this entity. */
-  public final UpdateAutoTimestamp getUpdateAutoTimestamp() {
+  public UpdateAutoTimestamp getUpdateTimestamp() {
     return updateTimestamp;
   }
 }

core/src/main/java/google/registry/model/EppResourceUtils.java

@@ -155,7 +155,7 @@ public final class EppResourceUtils {
     // time for writes.
     return Optional.of(
         cloneProjectedAtTime(
-            resource, latestOf(now, resource.getUpdateAutoTimestamp().getTimestamp())));
+            resource, latestOf(now, resource.getUpdateTimestamp().getTimestamp())));
   }
 
   /**
@@ -298,7 +298,7 @@ public final class EppResourceUtils {
     // and returns it projected forward to exactly the desired timestamp, or null if the resource is
     // deleted at that timestamp.
     final Result<T> loadResult =
-        isAtOrAfter(timestamp, resource.getUpdateAutoTimestamp().getTimestamp())
+        isAtOrAfter(timestamp, resource.getUpdateTimestamp().getTimestamp())
             ? new ResultNow<>(resource)
             : loadMostRecentRevisionAtTime(resource, timestamp);
     return () -> {

core/src/main/java/google/registry/model/contact/ContactBase.java

@@ -224,12 +224,12 @@ public class ContactBase extends EppResource implements ResourceWithTransferData
     return disclose;
   }
 
-  public final String getCurrentSponsorClientId() {
+  public String getCurrentSponsorClientId() {
     return getPersistedCurrentSponsorClientId();
   }
 
   @Override
-  public final ContactTransferData getTransferData() {
+  public ContactTransferData getTransferData() {
     return Optional.ofNullable(transferData).orElse(ContactTransferData.EMPTY);
   }
 

core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java

@@ -168,7 +168,7 @@ class CommitLoggedWork<R> implements Runnable {
       DateTime transactionTime, Set<Entry<Key<BackupGroupRoot>, BackupGroupRoot>> bgrEntries) {
     ImmutableMap.Builder<Key<BackupGroupRoot>, DateTime> builder = new ImmutableMap.Builder<>();
     for (Entry<Key<BackupGroupRoot>, BackupGroupRoot> entry : bgrEntries) {
-      DateTime updateTime = entry.getValue().getUpdateAutoTimestamp().getTimestamp();
+      DateTime updateTime = entry.getValue().getUpdateTimestamp().getTimestamp();
       if (!updateTime.isBefore(transactionTime)) {
         builder.put(entry.getKey(), updateTime);
       }

core/src/main/java/google/registry/rde/RdeModule.java

@@ -89,7 +89,7 @@ public abstract class RdeModule {
   @Provides
   @Parameter(PARAM_LENIENT)
   static boolean provideLenient(HttpServletRequest req) {
-    return extractBooleanParameter(req, PARAM_REVISION);
+    return extractBooleanParameter(req, PARAM_LENIENT);
   }
 
   @Provides

core/src/main/java/google/registry/ui/server/registrar/RegistryLockPostAction.java

@@ -30,6 +30,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.flogger.FluentLogger;
 import com.google.gson.Gson;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarContact;
 import google.registry.request.Action;
@@ -118,6 +119,7 @@ public class RegistryLockPostAction implements Runnable, JsonActionRunner.JsonAc
       String registrarId = postInput.registrarId;
       checkArgument(!Strings.isNullOrEmpty(registrarId), "Missing key for registrarId");
       checkArgument(!Strings.isNullOrEmpty(postInput.domainName), "Missing key for domainName");
+      DomainFlowUtils.validateDomainName(postInput.domainName);
       checkNotNull(postInput.isLock, "Missing key for isLock");
       UserAuthInfo userAuthInfo =
           authResult

core/src/test/java/google/registry/batch/AsyncTaskEnqueuerTest.java

@@ -168,6 +168,7 @@ public class AsyncTaskEnqueuerTest {
         new TaskMatcher()
             .url(RelockDomainAction.PATH)
             .method("POST")
+            .header("Host", "backend.hostname.fake")
             .param(
                 RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,
                 String.valueOf(lock.getRevisionId()))

core/src/test/java/google/registry/batch/ResaveAllEppResourcesActionTest.java

@@ -50,12 +50,12 @@ public class ResaveAllEppResourcesActionTest
   @Test
   public void test_mapreduceSuccessfullyResavesEntity() throws Exception {
     ContactResource contact = persistActiveContact("test123");
-    DateTime creationTime = contact.getUpdateAutoTimestamp().getTimestamp();
-    assertThat(ofy().load().entity(contact).now().getUpdateAutoTimestamp().getTimestamp())
+    DateTime creationTime = contact.getUpdateTimestamp().getTimestamp();
+    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isEqualTo(creationTime);
     ofy().clearSessionCache();
     runMapreduce();
-    assertThat(ofy().load().entity(contact).now().getUpdateAutoTimestamp().getTimestamp())
+    assertThat(ofy().load().entity(contact).now().getUpdateTimestamp().getTimestamp())
         .isGreaterThan(creationTime);
   }
 

core/src/test/java/google/registry/beam/initsql/WriteToSqlTest.java

@@ -26,6 +26,7 @@ import google.registry.model.registrar.Registrar;
 import google.registry.persistence.transaction.JpaTestRules;
 import google.registry.persistence.transaction.JpaTestRules.JpaIntegrationTestRule;
 import google.registry.testing.AppEngineRule;
+import google.registry.testing.DatastoreEntityExtension;
 import google.registry.testing.DatastoreHelper;
 import google.registry.testing.FakeClock;
 import google.registry.testing.InjectRule;
@@ -41,6 +42,7 @@ import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.experimental.categories.Category;
+import org.junit.rules.RuleChain;
 import org.junit.rules.TemporaryFolder;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
@@ -54,10 +56,14 @@ public class WriteToSqlTest implements Serializable {
 
   @Rule public final transient InjectRule injectRule = new InjectRule();
 
-  @Rule
-  public transient JpaIntegrationTestRule jpaRule =
+  // For use in the RuleChain below. Saves a reference to retrieve Database connection config.
+  public final transient JpaIntegrationTestRule database =
       new JpaTestRules.Builder().withClock(fakeClock).buildIntegrationTestRule();
 
+  @Rule
+  public final transient RuleChain jpaRules =
+      RuleChain.outerRule(new DatastoreEntityExtension()).around(database);
+
   @Rule public transient TemporaryFolder temporaryFolder = new TemporaryFolder();
 
   @Rule
@@ -91,7 +97,9 @@ public class WriteToSqlTest implements Serializable {
     new PrintStream(credentialFile)
         .printf(
             "%s %s %s",
-            jpaRule.getDatabaseUrl(), jpaRule.getDatabaseUsername(), jpaRule.getDatabasePassword())
+            database.getDatabaseUrl(),
+            database.getDatabaseUsername(),
+            database.getDatabasePassword())
         .close();
   }
 

core/src/test/java/google/registry/model/EppResourceTestUtils.java

@@ -0,0 +1,35 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.model;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import java.util.Objects;
+
+/** Test helpers for {@link EppResource}. */
+public final class EppResourceTestUtils {
+
+  private EppResourceTestUtils() {}
+
+  public static <E extends EppResource> void assertEqualsIgnoreLastUpdateTime(
+      E actual, E expected) {
+    if (Objects.equals(actual, expected)) {
+      return;
+    }
+    actual = (E) actual.asBuilder().build();
+    actual.updateTimestamp = expected.getUpdateTimestamp();
+    assertThat(actual).isEqualTo(expected);
+  }
+}

core/src/test/java/google/registry/model/EppResourceUtilsTest.java

@@ -165,8 +165,10 @@ public class EppResourceUtilsTest {
     assertThat(host.getRevisions()).hasSize(2);
     // Even though there is no revision, make a best effort guess to use the oldest revision.
     assertThat(
-        loadAtPointInTime(host, clock.nowUtc().minus(Duration.standardDays(32)))
-          .now().getUpdateAutoTimestamp().getTimestamp())
-              .isEqualTo(host.getRevisions().firstKey());
+            loadAtPointInTime(host, clock.nowUtc().minus(Duration.standardDays(32)))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(host.getRevisions().firstKey());
   }
 }

core/src/test/java/google/registry/model/contact/ContactResourceTest.java

@@ -16,6 +16,7 @@ package google.registry.model.contact;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.EppResourceTestUtils.assertEqualsIgnoreLastUpdateTime;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.testing.ContactResourceSubject.assertAboutContacts;
@@ -154,7 +155,7 @@ public class ContactResourceTest extends EntityTestCase {
                     .setServerApproveEntities(null)
                     .build())
             .build();
-    assertThat(persisted).isEqualTo(fixed);
+    assertEqualsIgnoreLastUpdateTime(persisted, fixed);
   }
 
   @Test

core/src/test/java/google/registry/model/domain/DomainBaseSqlTest.java

@@ -14,7 +14,7 @@
 
 package google.registry.model.domain;
 
-import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.EppResourceTestUtils.assertEqualsIgnoreLastUpdateTime;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 import static google.registry.testing.SqlHelper.assertThrowForeignKeyViolation;
 import static google.registry.testing.SqlHelper.saveRegistrar;
@@ -154,7 +154,7 @@ public class DomainBaseSqlTest {
               DomainBase org = domain.asBuilder().setCreationTime(result.getCreationTime()).build();
 
               // Note that the equality comparison forces a lazy load of all fields.
-              assertThat(result).isEqualTo(org);
+              assertEqualsIgnoreLastUpdateTime(result, org);
             });
   }
 

core/src/test/java/google/registry/model/ofy/OfyCommitLogTest.java

@@ -247,8 +247,14 @@ public class OfyCommitLogTest {
   void testSavingRootAndChild_updatesTimestampOnBackupGroupRoot() {
     tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     tm()
         .transact(
@@ -257,43 +263,79 @@ public class OfyCommitLogTest {
               ofy().save().entity(new Child());
             });
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
   }
 
   @Test
   void testSavingOnlyChild_updatesTimestampOnBackupGroupRoot() {
     tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     tm().transact(() -> ofy().save().entity(new Child()));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
   }
 
   @Test
   void testDeletingChild_updatesTimestampOnBackupGroupRoot() {
     tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     // The fact that the child was never persisted is irrelevant.
     tm().transact(() -> ofy().delete().entity(new Child()));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
   }
 
   @Test
   void testReadingRoot_doesntUpdateTimestamp() {
     tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     tm()
         .transact(
@@ -304,16 +346,28 @@ public class OfyCommitLogTest {
               ofy().load().entity(Root.create(1, getCrossTldKey()));
             });
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc().minusMillis(1));
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc().minusMillis(1));
   }
 
   @Test
   void testReadingChild_doesntUpdateTimestampOnBackupGroupRoot() {
     tm().transact(() -> ofy().save().entity(Root.create(1, getCrossTldKey())));
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     clock.advanceOneMilli();
     tm()
         .transact(
@@ -324,8 +378,14 @@ public class OfyCommitLogTest {
               ofy().load().entity(new Child()); // All Child objects are under Root(1).
             });
     ofy().clearSessionCache();
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc().minusMillis(1));
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc().minusMillis(1));
   }
 
   @Test
@@ -340,8 +400,14 @@ public class OfyCommitLogTest {
             });
     ofy().clearSessionCache();
     for (int i = 1; i <= 3; i++) {
-      assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, i)).now()
-          .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+      assertThat(
+              ofy()
+                  .load()
+                  .key(Key.create(getCrossTldKey(), Root.class, i))
+                  .now()
+                  .getUpdateTimestamp()
+                  .getTimestamp())
+          .isEqualTo(clock.nowUtc());
     }
     clock.advanceOneMilli();
     // Mutate one root, and a child of a second, ignoring the third.
@@ -353,14 +419,32 @@ public class OfyCommitLogTest {
             });
     ofy().clearSessionCache();
     // Child was touched.
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 1)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 1))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     // Directly touched.
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 2)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc());
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 2))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc());
     // Wasn't touched.
-    assertThat(ofy().load().key(Key.create(getCrossTldKey(), Root.class, 3)).now()
-        .getUpdateAutoTimestamp().getTimestamp()).isEqualTo(clock.nowUtc().minusMillis(1));
+    assertThat(
+            ofy()
+                .load()
+                .key(Key.create(getCrossTldKey(), Root.class, 3))
+                .now()
+                .getUpdateTimestamp()
+                .getTimestamp())
+        .isEqualTo(clock.nowUtc().minusMillis(1));
   }
 
   @Entity

core/src/test/java/google/registry/model/ofy/OfyTest.java

@@ -79,8 +79,8 @@ public class OfyTest {
   }
 
   private void doBackupGroupRootTimestampInversionTest(Runnable runnable) {
-    DateTime groupTimestamp = ofy().load().key(someObject.getParent()).now()
-        .getUpdateAutoTimestamp().getTimestamp();
+    DateTime groupTimestamp =
+        ofy().load().key(someObject.getParent()).now().getUpdateTimestamp().getTimestamp();
     // Set the clock in Ofy to the same time as the backup group root's save time.
     Ofy ofy = new Ofy(new FakeClock(groupTimestamp));
     TimestampInversionException thrown =

core/src/test/java/google/registry/model/registry/label/ReservedListSqlDaoTest.java

@@ -41,31 +41,31 @@ public class ReservedListSqlDaoTest {
   JpaIntegrationWithCoverageExtension jpa =
       new JpaTestRules.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();
 
-  private ImmutableMap<String, ReservedListEntry> test_reservations;
+  private ImmutableMap<String, ReservedListEntry> testReservations;
 
-  private ReservedList test_reserved_list;
+  private ReservedList testReservedList;
 
   @BeforeEach
   void setUp() {
-    test_reservations =
+    testReservations =
         ImmutableMap.of(
             "food",
             ReservedListEntry.create("food", ReservationType.RESERVED_FOR_SPECIFIC_USE, null),
             "music",
             ReservedListEntry.create("music", ReservationType.FULLY_BLOCKED, "fully blocked"));
 
-    test_reserved_list =
+    testReservedList =
         new ReservedList.Builder()
             .setName("testlist")
             .setLastUpdateTime(fakeClock.nowUtc())
             .setShouldPublish(false)
-            .setReservedListMap(test_reservations)
+            .setReservedListMap(testReservations)
             .build();
   }
 
   @Test
   public void save_worksSuccessfully() {
-    ReservedListSqlDao.save(test_reserved_list);
+    ReservedListSqlDao.save(testReservedList);
     jpaTm()
         .transact(
             () -> {
@@ -76,7 +76,7 @@ public class ReservedListSqlDaoTest {
                       .setParameter("name", "testlist")
                       .getSingleResult();
               assertThat(persistedList.getReservedListEntries())
-                  .containsExactlyEntriesIn(test_reservations);
+                  .containsExactlyEntriesIn(testReservations);
               assertThat(persistedList.getLastUpdateTime()).isEqualTo(fakeClock.nowUtc());
             });
   }
@@ -84,20 +84,20 @@ public class ReservedListSqlDaoTest {
   @Test
   public void checkExists_worksSuccessfully() {
     assertThat(ReservedListSqlDao.checkExists("testlist")).isFalse();
-    ReservedListSqlDao.save(test_reserved_list);
+    ReservedListSqlDao.save(testReservedList);
     assertThat(ReservedListSqlDao.checkExists("testlist")).isTrue();
   }
 
   @Test
   public void getLatestRevision_worksSuccessfully() {
     assertThat(ReservedListSqlDao.getLatestRevision("testlist").isPresent()).isFalse();
-    ReservedListSqlDao.save(test_reserved_list);
+    ReservedListSqlDao.save(testReservedList);
     ReservedList persistedList = ReservedListSqlDao.getLatestRevision("testlist").get();
     assertThat(persistedList.getRevisionId()).isNotNull();
     assertThat(persistedList.getLastUpdateTime()).isEqualTo(fakeClock.nowUtc());
     assertThat(persistedList.getName()).isEqualTo("testlist");
     assertThat(persistedList.getShouldPublish()).isFalse();
-    assertThat(persistedList.getReservedListEntries()).containsExactlyEntriesIn(test_reservations);
+    assertThat(persistedList.getReservedListEntries()).containsExactlyEntriesIn(testReservations);
   }
 
   @Test
@@ -113,12 +113,12 @@ public class ReservedListSqlDaoTest {
                     ReservedListEntry.create(
                         "old", ReservationType.RESERVED_FOR_SPECIFIC_USE, null)))
             .build());
-    ReservedListSqlDao.save(test_reserved_list);
+    ReservedListSqlDao.save(testReservedList);
     ReservedList persistedList = ReservedListSqlDao.getLatestRevision("testlist").get();
     assertThat(persistedList.getRevisionId()).isNotNull();
     assertThat(persistedList.getLastUpdateTime()).isEqualTo(fakeClock.nowUtc());
     assertThat(persistedList.getName()).isEqualTo("testlist");
     assertThat(persistedList.getShouldPublish()).isFalse();
-    assertThat(persistedList.getReservedListEntries()).containsExactlyEntriesIn(test_reservations);
+    assertThat(persistedList.getReservedListEntries()).containsExactlyEntriesIn(testReservations);
   }
 }

core/src/test/java/google/registry/testing/DatastoreEntityExtension.java

@@ -20,6 +20,7 @@ import java.util.Map;
 import org.junit.jupiter.api.extension.AfterEachCallback;
 import org.junit.jupiter.api.extension.BeforeEachCallback;
 import org.junit.jupiter.api.extension.ExtensionContext;
+import org.junit.rules.ExternalResource;
 import org.testcontainers.shaded.com.google.common.collect.ImmutableMap;
 
 /**
@@ -33,7 +34,8 @@ import org.testcontainers.shaded.com.google.common.collect.ImmutableMap;
  * href="https://junit.org/junit5/docs/current/user-guide/#extensions-registration-programmatic">
  * JUnit 5 User Guide</a> for details of extension ordering.
  */
-public class DatastoreEntityExtension implements BeforeEachCallback, AfterEachCallback {
+public class DatastoreEntityExtension extends ExternalResource
+    implements BeforeEachCallback, AfterEachCallback {
 
   private static final Environment PLACEHOLDER_ENV = new PlaceholderEnvironment();
 
@@ -48,6 +50,16 @@ public class DatastoreEntityExtension implements BeforeEachCallback, AfterEachCa
     ApiProxy.setEnvironmentForCurrentThread(null);
   }
 
+  @Override
+  protected void before() {
+    beforeEach(null);
+  }
+
+  @Override
+  protected void after() {
+    afterEach(null);
+  }
+
   private static final class PlaceholderEnvironment implements Environment {
 
     @Override

core/src/test/java/google/registry/tools/DomainLockUtilsTest.java

@@ -33,6 +33,7 @@ import static org.joda.time.Duration.standardHours;
 import static org.joda.time.Duration.standardSeconds;
 import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
 import google.registry.batch.AsyncTaskEnqueuerTest;
@@ -71,12 +72,7 @@ public final class DomainLockUtilsTest {
   private static final String POC_ID = "marla.singer@example.com";
 
   private final FakeClock clock = new FakeClock(DateTime.now(DateTimeZone.UTC));
-  private final DomainLockUtils domainLockUtils =
-      new DomainLockUtils(
-          new DeterministicStringGenerator(Alphabets.BASE_58),
-          "adminreg",
-          AsyncTaskEnqueuerTest.createForTesting(
-              mock(AppEngineServiceUtils.class), clock, standardSeconds(90)));
+  private DomainLockUtils domainLockUtils;
 
   @Rule
   public final AppEngineRule appEngineRule =
@@ -94,6 +90,14 @@ public final class DomainLockUtilsTest {
     createTlds("tld", "net");
     HostResource host = persistActiveHost("ns1.example.net");
     domain = persistResource(newDomainBase(DOMAIN_NAME, host));
+
+    AppEngineServiceUtils appEngineServiceUtils = mock(AppEngineServiceUtils.class);
+    when(appEngineServiceUtils.getServiceHostname("backend")).thenReturn("backend.hostname.fake");
+    domainLockUtils = new DomainLockUtils(
+        new DeterministicStringGenerator(Alphabets.BASE_58),
+        "adminreg",
+        AsyncTaskEnqueuerTest.createForTesting(
+            appEngineServiceUtils, clock, standardSeconds(90)));
   }
 
   @Test
@@ -264,6 +268,7 @@ public final class DomainLockUtilsTest {
         new TaskMatcher()
             .url(RelockDomainAction.PATH)
             .method("POST")
+            .header("Host", "backend.hostname.fake")
             .param(
                 RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,
                 String.valueOf(lock.getRevisionId()))

core/src/test/java/google/registry/ui/server/registrar/RegistryLockPostActionTest.java

@@ -280,6 +280,16 @@ public final class RegistryLockPostActionTest {
     assertFailureWithMessage(response, "Missing key for domainName");
   }
 
+  @Test
+  public void testFailure_nonPunycodeDomainName() {
+    Map<String, ?> response = action.handleJsonRequest(ImmutableMap.of(
+        "isLock", true,
+        "registrarId", "TheRegistrar",
+        "domainName", "example.みんな",
+        "password", "hi"));
+    assertFailureWithMessage(response, "Domain names can only contain a-z, 0-9, '.' and '-'");
+  }
+
   @Test
   public void testFailure_noLockParam() {
     Map<String, ?> response =

db/src/main/resources/sql/flyway/V39__add_updatetime_column.sql

@@ -0,0 +1,23 @@
+-- Copyright 2020 The Nomulus Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+ALTER TABLE "Contact" ADD COLUMN update_timestamp timestamptz;
+
+ALTER TABLE "ContactHistory" ADD COLUMN update_timestamp timestamptz;
+
+ALTER TABLE "Domain" ADD COLUMN update_timestamp timestamptz;
+
+ALTER TABLE "HostHistory" ADD COLUMN update_timestamp timestamptz;
+
+ALTER TABLE "HostResource" ADD COLUMN update_timestamp timestamptz;

db/src/main/resources/sql/schema/db-schema.sql.generated

@@ -77,6 +77,7 @@ create sequence history_id_sequence start 1 increment 1;
 
     create table "Contact" (
        repo_id text not null,
+        update_timestamp timestamptz,
         creation_registrar_id text not null,
         creation_time timestamptz not null,
         current_sponsor_registrar_id text not null,
@@ -197,6 +198,7 @@ create sequence history_id_sequence start 1 increment 1;
         last_epp_update_registrar_id text,
         last_epp_update_time timestamptz,
         statuses text[],
+        update_timestamp timestamptz,
         contact_repo_id text not null,
         primary key (history_revision_id)
     );
@@ -219,6 +221,7 @@ create sequence history_id_sequence start 1 increment 1;
 
     create table "Domain" (
        repo_id text not null,
+        update_timestamp timestamptz,
         creation_registrar_id text not null,
         creation_time timestamptz not null,
         current_sponsor_registrar_id text not null,
@@ -300,12 +303,14 @@ create sequence history_id_sequence start 1 increment 1;
         last_epp_update_registrar_id text,
         last_epp_update_time timestamptz,
         statuses text[],
+        update_timestamp timestamptz,
         host_repo_id text not null,
         primary key (history_revision_id)
     );
 
     create table "HostResource" (
        repo_id text not null,
+        update_timestamp timestamptz,
         creation_registrar_id text not null,
         creation_time timestamptz not null,
         current_sponsor_registrar_id text not null,

db/src/main/resources/sql/schema/nomulus.golden.sql

@@ -250,7 +250,8 @@ CREATE TABLE public."Contact" (
     transfer_losing_registrar_id text,
     transfer_pending_expiration_time timestamp with time zone,
     transfer_request_time timestamp with time zone,
-    transfer_status text
+    transfer_status text,
+    update_timestamp timestamp with time zone
 );
 
 
@@ -334,7 +335,8 @@ CREATE TABLE public."ContactHistory" (
     last_epp_update_registrar_id text,
     last_epp_update_time timestamp with time zone,
     statuses text[],
-    contact_repo_id text NOT NULL
+    contact_repo_id text NOT NULL,
+    update_timestamp timestamp with time zone
 );
 
 
@@ -395,7 +397,8 @@ CREATE TABLE public."Domain" (
     transfer_losing_registrar_id text,
     transfer_pending_expiration_time timestamp with time zone,
     transfer_request_time timestamp with time zone,
-    transfer_status text
+    transfer_status text,
+    update_timestamp timestamp with time zone
 );
 
 
@@ -436,7 +439,8 @@ CREATE TABLE public."HostHistory" (
     last_epp_update_registrar_id text,
     last_epp_update_time timestamp with time zone,
     statuses text[],
-    host_repo_id text NOT NULL
+    host_repo_id text NOT NULL,
+    update_timestamp timestamp with time zone
 );
 
 
@@ -457,7 +461,8 @@ CREATE TABLE public."HostResource" (
     last_superordinate_change timestamp with time zone,
     last_transfer_time timestamp with time zone,
     superordinate_domain text,
-    inet_addresses text[]
+    inet_addresses text[],
+    update_timestamp timestamp with time zone
 );
 
 

networking/src/main/java/google/registry/networking/module/CertificateSupplierModule.java

@@ -40,6 +40,7 @@ import javax.inject.Named;
 import javax.inject.Provider;
 import javax.inject.Qualifier;
 import javax.inject.Singleton;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
@@ -215,17 +216,29 @@ public final class CertificateSupplierModule {
   @PemFile
   static PrivateKey providePemPrivateKey(@PemFile ImmutableList<Object> pemObjects) {
     JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
-    Function<PEMKeyPair, PrivateKey> privateKeyConverter =
+    Function<PEMKeyPair, PrivateKey> pkcs1PrivateKeyConverter =
         pemKeyPair -> {
           try {
             return converter.getKeyPair(pemKeyPair).getPrivate();
           } catch (PEMException e) {
             throw new RuntimeException(
-                String.format("Error converting private key: %s", pemKeyPair), e);
+                String.format("Error converting PKCS#1 private key: %s", pemKeyPair), e);
+          }
+        };
+    Function<PrivateKeyInfo, PrivateKey> pkcs8PrivateKeyConverter =
+        privateKeyInfo -> {
+          try {
+            return converter.getPrivateKey(privateKeyInfo);
+          } catch (PEMException e) {
+            throw new RuntimeException(
+                String.format("Error converting PKCS#8 private key: %s", privateKeyInfo), e);
           }
         };
     ImmutableList<PrivateKey> privateKeys =
-        filterAndConvert(pemObjects, PEMKeyPair.class, privateKeyConverter);
+        ImmutableList.<PrivateKey>builder()
+            .addAll(filterAndConvert(pemObjects, PEMKeyPair.class, pkcs1PrivateKeyConverter))
+            .addAll(filterAndConvert(pemObjects, PrivateKeyInfo.class, pkcs8PrivateKeyConverter))
+            .build();
     checkState(
         privateKeys.size() == 1,
         "The pem file must contain exactly one private key, but %s keys are found",