Angular v14 -> v15 update (#1903)

We've been using it in production for three weeks now. Everything seems
to be working fine. Removing the code related to checking the migration
state and using the override.

appengine_war.gradle

@@ -47,6 +47,10 @@ war {
 
 if (project.path == ":services:default") {
     war {
+        from("${rootDir}/console-webapp/dist/console-webapp") {
+            include "**/*"
+            into("console")
+        }
         from("${coreResourcesDir}/google/registry/ui") {
             include "registrar_bin.js"
             if (environment != "production") {
@@ -101,6 +105,7 @@ explodeWar.doLast {
 
 rootProject.deploy.dependsOn appengineDeployAll
 rootProject.stage.dependsOn appengineStage
+tasks['war'].dependsOn ':console-webapp:buildConsoleWebappProd'
 tasks['war'].dependsOn ':core:compileProdJS'
 tasks['war'].dependsOn ':core:processResources'
 tasks['war'].dependsOn ':core:jar'

build.gradle

@@ -551,6 +551,7 @@ task coreDev {
   dependsOn 'javadoc'
   dependsOn 'checkDependenciesDotGradle'
   dependsOn 'checkLicense'
+  dependsOn ':console-webapp:runConsoleWebappUnitTests'
   dependsOn ':core:check'
   dependsOn 'assemble'
 }

config/presubmits.py

@@ -25,7 +25,7 @@ import textwrap
 import re
 
 # We should never analyze any generated files
-UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/"}
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/", "/dist/", "karma.conf.js", "polyfills.ts", "test.ts"}
 # We can't rely on CI to have the Enum package installed so we do this instead.
 FORBIDDEN = 1
 REQUIRED = 2
@@ -86,7 +86,7 @@ PRESUBMITS = {
     # License check
     PresubmitCheck(
         r".*Copyright 20\d{2} The Nomulus Authors\. All Rights Reserved\.",
-        ("java", "js", "soy", "sql", "py", "sh", "gradle"), {
+        ("java", "js", "soy", "sql", "py", "sh", "gradle", "ts"), {
             ".git", "/build/", "/generated/", "/generated_tests/",
             "node_modules/", "LoggerConfig.java", "registrar_bin.",
             "registrar_dbg.", "google-java-format-diff.py",
@@ -95,7 +95,7 @@ PRESUBMITS = {
         "File did not include the license header.",
 
     # Files must end in a newline
-    PresubmitCheck(r".*\n$", ("java", "js", "soy", "sql", "py", "sh", "gradle"),
+    PresubmitCheck(r".*\n$", ("java", "js", "soy", "sql", "py", "sh", "gradle", "ts"),
                    {"node_modules/"}, REQUIRED):
         "Source files must end in a newline.",
 

console-webapp/.editorconfig

@@ -0,0 +1,16 @@
+# Editor configuration, see https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.ts]
+quote_type = single
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false

console-webapp/.gitignore

@@ -0,0 +1,42 @@
+# See http://help.github.com/ignore-files/ for more about ignoring files.
+
+# Compiled output
+/dist
+/tmp
+/out-tsc
+/bazel-out
+
+# Node
+/node_modules
+npm-debug.log
+yarn-error.log
+
+# IDEs and editors
+.idea/
+.project
+.classpath
+.c9/
+*.launch
+.settings/
+*.sublime-workspace
+
+# Visual Studio Code
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+.history/*
+
+# Miscellaneous
+/.angular/cache
+.sass-cache/
+/connect.lock
+/coverage
+/libpeerconnection.log
+testem.log
+/typings
+
+# System files
+.DS_Store
+Thumbs.db

console-webapp/README.md

@@ -0,0 +1,27 @@
+# ConsoleWebapp
+
+This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 14.2.3.
+
+## Development server
+
+Run `ng serve` for a dev server. Navigate to `http://localhost:4200/`. The application will automatically reload if you change any of the source files.
+
+## Code scaffolding
+
+Run `ng generate component component-name` to generate a new component. You can also use `ng generate directive|pipe|service|class|guard|interface|enum|module`.
+
+## Build
+
+Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory.
+
+## Running unit tests
+
+Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.io).
+
+## Running end-to-end tests
+
+Run `ng e2e` to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
+
+## Further help
+
+To get more help on the Angular CLI use `ng help` or go check out the [Angular CLI Overview and Command Reference](https://angular.io/cli) page.

console-webapp/angular.json

@@ -0,0 +1,109 @@
+{
+  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
+  "version": 1,
+  "newProjectRoot": "projects",
+  "projects": {
+    "console-webapp": {
+      "projectType": "application",
+      "schematics": {
+        "@schematics/angular:component": {
+          "style": "less"
+        }
+      },
+      "root": "",
+      "sourceRoot": "src",
+      "prefix": "app",
+      "architect": {
+        "build": {
+          "builder": "@angular-devkit/build-angular:browser",
+          "options": {
+            "outputPath": "dist/console-webapp",
+            "index": "src/index.html",
+            "main": "src/main.ts",
+            "polyfills": "src/polyfills.ts",
+            "tsConfig": "tsconfig.app.json",
+            "inlineStyleLanguage": "less",
+            "assets": [
+              "src/favicon.ico",
+              "src/assets"
+            ],
+            "styles": [
+              "./node_modules/@angular/material/prebuilt-themes/indigo-pink.css",
+              "src/styles.less"
+            ],
+            "scripts": []
+          },
+          "configurations": {
+            "production": {
+              "budgets": [
+                {
+                  "type": "initial",
+                  "maximumWarning": "500kb",
+                  "maximumError": "1mb"
+                },
+                {
+                  "type": "anyComponentStyle",
+                  "maximumWarning": "2kb",
+                  "maximumError": "4kb"
+                }
+              ],
+              "fileReplacements": [
+                {
+                  "replace": "src/environments/environment.ts",
+                  "with": "src/environments/environment.prod.ts"
+                }
+              ],
+              "outputHashing": "all"
+            },
+            "development": {
+              "buildOptimizer": false,
+              "optimization": false,
+              "vendorChunk": true,
+              "extractLicenses": false,
+              "sourceMap": true,
+              "namedChunks": true
+            }
+          },
+          "defaultConfiguration": "production"
+        },
+        "serve": {
+          "builder": "@angular-devkit/build-angular:dev-server",
+          "configurations": {
+            "production": {
+              "browserTarget": "console-webapp:build:production"
+            },
+            "development": {
+              "browserTarget": "console-webapp:build:development"
+            }
+          },
+          "defaultConfiguration": "development"
+        },
+        "extract-i18n": {
+          "builder": "@angular-devkit/build-angular:extract-i18n",
+          "options": {
+            "browserTarget": "console-webapp:build"
+          }
+        },
+        "test": {
+          "builder": "@angular-devkit/build-angular:karma",
+          "options": {
+            "main": "src/test.ts",
+            "polyfills": "src/polyfills.ts",
+            "tsConfig": "tsconfig.spec.json",
+            "karmaConfig": "karma.conf.js",
+            "inlineStyleLanguage": "less",
+            "assets": [
+              "src/favicon.ico",
+              "src/assets"
+            ],
+            "styles": [
+              "./node_modules/@angular/material/prebuilt-themes/indigo-pink.css",
+              "src/styles.less"
+            ],
+            "scripts": []
+          }
+        }
+      }
+    }
+  }
+}

console-webapp/build.gradle

@@ -0,0 +1,54 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+def consoleDir = "${rootDir}/console-webapp"
+
+clean {
+  delete "${consoleDir}/node_modules"
+  delete "${consoleDir}/dist"
+}
+
+task npmInstallDeps(type: Exec) {
+  workingDir "${consoleDir}/"
+  executable 'npm'
+  args 'i', '--no-audit', '--no-fund', '--loglevel=error'
+}
+
+task runConsoleWebappLocally(type: Exec) {
+  workingDir "${consoleDir}/"
+  executable 'npm'
+  args 'run', 'start:dev'
+}
+
+task runConsoleWebappUnitTests(type: Exec) {
+  workingDir "${consoleDir}/"
+  executable 'npm'
+  args 'run', 'test'
+}
+
+task buildConsoleWebappNonProd(type: Exec) {
+  workingDir "${consoleDir}/"
+  executable 'npm'
+  args 'run', 'build'
+}
+
+// Keeping the same as non prod for now before we figure out optimization we want to include
+task buildConsoleWebappProd(type: Exec) {
+  workingDir "${consoleDir}/"
+  executable 'npm'
+  args 'run', 'build'
+}
+
+tasks.runConsoleWebappUnitTests.dependsOn(tasks.npmInstallDeps)
+tasks.buildConsoleWebappProd.dependsOn(tasks.npmInstallDeps)

console-webapp/buildscript-gradle.lockfile

@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+empty=classpath

console-webapp/dev-proxy.config.json

@@ -0,0 +1,7 @@
+{
+  "/registrar":
+  {
+    "target": "http://localhost:8080/registrar",
+    "secure": false
+  }
+}

console-webapp/gradle.lockfile

@@ -0,0 +1,48 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7=checkstyle
+com.github.ben-manes.caffeine:caffeine:2.7.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.auto:auto-common:0.10=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.code.findbugs:jFormatString:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotation:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_annotations:2.3.4=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_check_api:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_core:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.errorprone:error_prone_type_annotations:2.3.4=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.guava:failureaccess:1.0.1=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.guava:guava:27.0.1-jre=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.guava:guava:29.0-jre=checkstyle
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,errorprone,testAnnotationProcessor
+com.google.j2objc:j2objc-annotations:1.1=annotationProcessor,errorprone,testAnnotationProcessor
+com.google.j2objc:j2objc-annotations:1.3=checkstyle
+com.google.protobuf:protobuf-java:3.4.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.googlecode.java-diff-utils:diffutils:1.3.0=annotationProcessor,errorprone,testAnnotationProcessor
+com.puppycrawl.tools:checkstyle:8.37=checkstyle
+commons-beanutils:commons-beanutils:1.9.4=checkstyle
+commons-collections:commons-collections:3.2.2=checkstyle
+info.picocli:picocli:4.5.2=checkstyle
+net.sf.saxon:Saxon-HE:10.3=checkstyle
+org.antlr:antlr4-runtime:4.8-1=checkstyle
+org.checkerframework:checker-qual:2.11.1=checkstyle
+org.checkerframework:checker-qual:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.checkerframework:dataflow:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.checkerframework:javacutil:3.0.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor
+org.jacoco:org.jacoco.agent:0.8.6=jacocoAgent,jacocoAnt
+org.jacoco:org.jacoco.ant:0.8.6=jacocoAnt
+org.jacoco:org.jacoco.core:0.8.6=jacocoAnt
+org.jacoco:org.jacoco.report:0.8.6=jacocoAnt
+org.javassist:javassist:3.26.0-GA=checkstyle
+org.ow2.asm:asm-analysis:8.0.1=jacocoAnt
+org.ow2.asm:asm-commons:8.0.1=jacocoAnt
+org.ow2.asm:asm-tree:8.0.1=jacocoAnt
+org.ow2.asm:asm:8.0.1=jacocoAnt
+org.pcollections:pcollections:2.1.2=annotationProcessor,errorprone,testAnnotationProcessor
+org.plumelib:plume-util:1.0.6=annotationProcessor,errorprone,testAnnotationProcessor
+org.plumelib:reflection-util:0.0.2=annotationProcessor,errorprone,testAnnotationProcessor
+org.plumelib:require-javadoc:0.1.0=annotationProcessor,errorprone,testAnnotationProcessor
+org.reflections:reflections:0.9.12=checkstyle
+empty=archives,compileClasspath,default,deploy_jar,errorproneJavac,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

console-webapp/karma.conf.js

@@ -0,0 +1,44 @@
+// Karma configuration file, see link for more information
+// https://karma-runner.github.io/1.0/config/configuration-file.html
+
+module.exports = function (config) {
+  config.set({
+    basePath: '',
+    frameworks: ['jasmine', '@angular-devkit/build-angular'],
+    plugins: [
+      require('karma-jasmine'),
+      require('karma-chrome-launcher'),
+      require('karma-jasmine-html-reporter'),
+      require('karma-coverage'),
+      require('@angular-devkit/build-angular/plugins/karma')
+    ],
+    client: {
+      jasmine: {
+        // you can add configuration options for Jasmine here
+        // the possible options are listed at https://jasmine.github.io/api/edge/Configuration.html
+        // for example, you can disable the random execution with `random: false`
+        // or set a specific seed with `seed: 4321`
+      },
+      clearContext: false // leave Jasmine Spec Runner output visible in browser
+    },
+    jasmineHtmlReporter: {
+      suppressAll: true // removes the duplicated traces
+    },
+    coverageReporter: {
+      dir: require('path').join(__dirname, './coverage/console-webapp'),
+      subdir: '.',
+      reporters: [
+        { type: 'html' },
+        { type: 'text-summary' }
+      ]
+    },
+    reporters: ['progress', 'kjhtml'],
+    port: 9876,
+    colors: true,
+    logLevel: config.LOG_INFO,
+    autoWatch: true,
+    browsers: ['Chrome'],
+    singleRun: false,
+    restartOnFileChange: true
+  });
+};

console-webapp/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "console-webapp",
+  "version": "0.0.0",
+  "scripts": {
+    "ng": "ng",
+    "start": "ng serve",
+    "build": "ng build --base-href=/console/",
+    "build:local": "ng build --base-href=/default/console/",
+    "watch": "ng build --watch --configuration development",
+    "test": "ng test --browsers=ChromeHeadless --watch=false",
+    "run:dev": "",
+    "start:dev": "concurrently \"./../gradlew :core:runTestServer\" \"ng serve --proxy-config dev-proxy.config.json\""
+  },
+  "private": true,
+  "dependencies": {
+    "@angular/animations": "^15.1.0",
+    "@angular/cdk": "^15.0.4",
+    "@angular/common": "^15.1.0",
+    "@angular/compiler": "^15.1.0",
+    "@angular/core": "^15.1.0",
+    "@angular/forms": "^15.1.0",
+    "@angular/material": "^15.0.4",
+    "@angular/platform-browser": "^15.1.0",
+    "@angular/platform-browser-dynamic": "^15.1.0",
+    "@angular/router": "^15.1.0",
+    "rxjs": "~7.5.0",
+    "tslib": "^2.3.0",
+    "zone.js": "~0.11.4"
+  },
+  "devDependencies": {
+    "@angular-devkit/build-angular": "^15.1.0",
+    "@angular/cli": "~15.1.0",
+    "@angular/compiler-cli": "^15.1.0",
+    "@types/jasmine": "~4.0.0",
+    "@types/node": "^18.11.18",
+    "concurrently": "^7.6.0",
+    "jasmine-core": "~4.3.0",
+    "karma": "~6.4.0",
+    "karma-chrome-launcher": "~3.1.0",
+    "karma-coverage": "~2.2.0",
+    "karma-jasmine": "~5.1.0",
+    "karma-jasmine-html-reporter": "~2.0.0",
+    "typescript": "~4.9.4"
+  }
+}

console-webapp/src/app/app-routing.module.ts

@@ -0,0 +1,29 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { NgModule } from '@angular/core';
+import { RouterModule, Routes } from '@angular/router';
+import {TldsComponent} from './tlds/tlds.component';
+import {HomeComponent} from './home/home.component';
+
+const routes: Routes = [
+  { path: 'home', component: HomeComponent },
+  { path: 'tlds', component: TldsComponent },
+];
+
+@NgModule({
+  imports: [RouterModule.forRoot(routes)],
+  exports: [RouterModule]
+})
+export class AppRoutingModule { }

console-webapp/src/app/app.component.html

@@ -0,0 +1,14 @@
+<div class="toolbar" role="banner">
+  Nomulus Console
+</div>
+
+<div class="content" role="main">
+  <nav>
+    <ul>
+      <li><a routerLink="/home" routerLinkActive="active" ariaCurrentWhenActive="page">Home page</a></li>
+      <li><a routerLink="/tlds" routerLinkActive="active" ariaCurrentWhenActive="page">TLDs</a></li>
+    </ul>
+  </nav>
+</div>
+
+<router-outlet></router-outlet>

console-webapp/src/app/app.component.less

@@ -0,0 +1,35 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+:host {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
+  font-size: 14px;
+  color: #333;
+  box-sizing: border-box;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  margin: 8px 0;
+}
+
+p {
+  margin: 0;
+}

console-webapp/src/app/app.component.spec.ts

@@ -0,0 +1,37 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { TestBed } from '@angular/core/testing';
+import { RouterTestingModule } from '@angular/router/testing';
+import { AppComponent } from './app.component';
+
+describe('AppComponent', () => {
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [
+        RouterTestingModule
+      ],
+      declarations: [
+        AppComponent
+      ],
+    }).compileComponents();
+  });
+
+  it('should create the app', () => {
+    const fixture = TestBed.createComponent(AppComponent);
+    const app = fixture.componentInstance;
+    expect(app).toBeTruthy();
+  });
+
+});

console-webapp/src/app/app.component.ts

@@ -0,0 +1,24 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Component } from '@angular/core';
+
+@Component({
+  selector: 'app-root',
+  templateUrl: './app.component.html',
+  styleUrls: ['./app.component.less']
+})
+export class AppComponent {
+
+}

console-webapp/src/app/app.module.ts

@@ -0,0 +1,41 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { NgModule } from '@angular/core';
+import { BrowserModule } from '@angular/platform-browser';
+
+import { AppRoutingModule } from './app-routing.module';
+import { AppComponent } from './app.component';
+import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
+import {MaterialModule} from './material.module';
+
+import { HomeComponent } from './home/home.component';
+import { TldsComponent } from './tlds/tlds.component';
+
+@NgModule({
+  declarations: [
+    AppComponent,
+    HomeComponent,
+    TldsComponent,
+  ],
+  imports: [
+    MaterialModule,
+    BrowserModule,
+    AppRoutingModule,
+    BrowserAnimationsModule
+  ],
+  providers: [],
+  bootstrap: [AppComponent]
+})
+export class AppModule { }

console-webapp/src/app/home/home.component.html

@@ -0,0 +1,14 @@
+<h3>Recent Activity</h3>
+<table mat-table [dataSource]="dataSource" class="mat-elevation-z8 console-home__activity">
+  <ng-container *ngFor="let column of columns" [matColumnDef]="column.columnDef">
+    <th mat-header-cell *matHeaderCellDef>
+      {{column.header}}
+    </th>
+    <td mat-cell *matCellDef="let row">
+      {{column.cell(row)}}
+    </td>
+  </ng-container>
+
+  <tr mat-header-row *matHeaderRowDef="displayedColumns"></tr>
+  <tr mat-row *matRowDef="let row; columns: displayedColumns;"></tr>
+</table>

console-webapp/src/app/home/home.component.less

@@ -0,0 +1,14 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+

console-webapp/src/app/home/home.component.spec.ts

@@ -0,0 +1,39 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { HomeComponent } from './home.component';
+import {MaterialModule} from '../material.module';
+
+describe('HomeComponent', () => {
+  let component: HomeComponent;
+  let fixture: ComponentFixture<HomeComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [MaterialModule],
+      declarations: [ HomeComponent ]
+    })
+    .compileComponents();
+
+    fixture = TestBed.createComponent(HomeComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});

console-webapp/src/app/home/home.component.ts

@@ -0,0 +1,94 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Component } from '@angular/core';
+
+export interface ActivityRecord {
+  eventType: string;
+  userName: string;
+  registrarName: string;
+  timestamp: string;
+  details: string
+}
+
+const MOCK_DATA: ActivityRecord[] = [
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Export DUMS", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Update Contact", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+  {eventType: "Delete Domain", userName:"user3", registrarName: "registrar1", timestamp: "2022-03-15T19:46:39.007", details: "All Domains under management exported as .csv file" },
+];
+
+
+@Component({
+  selector: 'app-home',
+  templateUrl: './home.component.html',
+  styleUrls: ['./home.component.less']
+})
+export class HomeComponent {
+
+  columns = [
+    {
+      columnDef: 'eventType',
+      header: 'Event Type',
+      cell:(record: ActivityRecord) => `${record.eventType}`,
+    },
+    {
+      columnDef: 'userName',
+      header: 'User',
+      cell: (record: ActivityRecord)  => `${record.userName}`,
+    },
+    {
+      columnDef: 'registrarName',
+      header: 'Registrar',
+      cell: (record: ActivityRecord)  => `${record.registrarName}`,
+    },
+    {
+      columnDef: 'timestamp',
+      header: 'Timestamp',
+      cell: (record: ActivityRecord)  => `${record.timestamp}`,
+    },
+    {
+      columnDef: 'details',
+      header: 'Details',
+      cell: (record: ActivityRecord)  => `${record.details}`,
+    },
+  ];
+  dataSource = MOCK_DATA;
+  displayedColumns = this.columns.map(c => c.columnDef);
+
+  constructor() {
+
+
+  }
+}

console-webapp/src/app/material.module.ts

@@ -0,0 +1,26 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import {NgModule} from '@angular/core';
+import {MatCardModule} from '@angular/material/card';
+import {MatTableModule} from '@angular/material/table';
+
+const MATERIAL_MODULES = [
+  MatCardModule,
+  MatTableModule,
+];
+
+@NgModule({imports: MATERIAL_MODULES, exports: MATERIAL_MODULES})
+export class MaterialModule {
+}

console-webapp/src/app/tlds/tlds.component.html

@@ -0,0 +1,24 @@
+
+<div class="console-tlds__cards">
+  <mat-card class="console-tlds__card">
+    <mat-card-title>.how</mat-card-title>
+    <mat-card-subtitle>A place for thinkers, tinkerers, and knowledge seekers</mat-card-subtitle>
+    <mat-card-actions class="console-tlds__card-links">
+      <a title="Onboarding Now" href="#" target="_blank" rel="noopener">Onboarding Now</a>
+      <a title="Marketing Materials" href="#" target="_blank" rel="noopener">Marketing Materials</a>
+      <a title="Visit get.how for more information" href="#" target="_blank" rel="noopener">Visit get.how for more information</a>
+    </mat-card-actions>
+  </mat-card>
+</div>
+
+<div class="console-tlds__cards">
+  <mat-card class="console-tlds__card">
+    <mat-card-title>.soy</mat-card-title>
+    <mat-card-subtitle>A place for thinkers, tinkerers, and knowledge seekers</mat-card-subtitle>
+    <mat-card-actions class="console-tlds__card-links">
+      <a title="Onboarding Now" href="#" target="_blank" rel="noopener">Onboarding Now</a>
+      <a title="Marketing Materials" href="#" target="_blank" rel="noopener">Marketing Materials</a>
+      <a title="Visit get.how for more information" href="#" target="_blank" rel="noopener">Visit iam.soy for more information</a>
+    </mat-card-actions>
+  </mat-card>
+</div>

console-webapp/src/app/tlds/tlds.component.less

@@ -0,0 +1,28 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+.console-tlds {
+  &__cards {
+    display: flex;
+    border-top: 1px solid #ddd;
+    padding: 1rem;
+  }
+  &__card {
+    max-width: 300px;
+  }
+  &__card-links {
+    display: flex;
+    flex-direction: column;
+  }
+}

console-webapp/src/app/tlds/tlds.component.spec.ts

@@ -0,0 +1,39 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { TldsComponent } from './tlds.component';
+import {MaterialModule} from '../material.module';
+
+describe('TldsComponent', () => {
+  let component: TldsComponent;
+  let fixture: ComponentFixture<TldsComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [MaterialModule],
+      declarations: [ TldsComponent ]
+    })
+    .compileComponents();
+
+    fixture = TestBed.createComponent(TldsComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+});

console-webapp/src/app/tlds/tlds.component.ts

@@ -0,0 +1,29 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Component, OnInit } from '@angular/core';
+
+@Component({
+  selector: 'app-tlds',
+  templateUrl: './tlds.component.html',
+  styleUrls: ['./tlds.component.less']
+})
+export class TldsComponent implements OnInit {
+
+  constructor() { }
+
+  ngOnInit(): void {
+  }
+
+}

console-webapp/src/environments/environment.prod.ts

@@ -0,0 +1,17 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+export const environment = {
+  production: true
+};

console-webapp/src/environments/environment.ts

@@ -0,0 +1,30 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This file can be replaced during build by using the `fileReplacements` array.
+// `ng build` replaces `environment.ts` with `environment.prod.ts`.
+// The list of file replacements can be found in `angular.json`.
+
+export const environment = {
+  production: false
+};
+
+/*
+ * For easier debugging in development mode, you can import the following file
+ * to ignore zone related error stack frames such as `zone.run`, `zoneDelegate.invokeTask`.
+ *
+ * This import should be commented out in production mode because it will have a negative impact
+ * on performance if an error is thrown.
+ */
+// import 'zone.js/plugins/zone-error';  // Included with Angular CLI.

console-webapp/src/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Nomulus Console</title>
+  <base href="/">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <link rel="icon" type="image/x-icon" href="favicon.ico">
+  <link rel="preconnect" href="https://fonts.gstatic.com">
+  <link href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap" rel="stylesheet">
+  <link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel="stylesheet">
+</head>
+<body class="mat-typography">
+  <app-root></app-root>
+</body>
+</html>

console-webapp/src/main.ts

@@ -0,0 +1,26 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { enableProdMode } from '@angular/core';
+import { platformBrowserDynamic } from '@angular/platform-browser-dynamic';
+
+import { AppModule } from './app/app.module';
+import { environment } from './environments/environment';
+
+if (environment.production) {
+  enableProdMode();
+}
+
+platformBrowserDynamic().bootstrapModule(AppModule)
+  .catch(err => console.error(err));

console-webapp/src/polyfills.ts

@@ -0,0 +1,53 @@
+/**
+ * This file includes polyfills needed by Angular and is loaded before the app.
+ * You can add your own extra polyfills to this file.
+ *
+ * This file is divided into 2 sections:
+ *   1. Browser polyfills. These are applied before loading ZoneJS and are sorted by browsers.
+ *   2. Application imports. Files imported after ZoneJS that should be loaded before your main
+ *      file.
+ *
+ * The current setup is for so-called "evergreen" browsers; the last versions of browsers that
+ * automatically update themselves. This includes recent versions of Safari, Chrome (including
+ * Opera), Edge on the desktop, and iOS and Chrome on mobile.
+ *
+ * Learn more in https://angular.io/guide/browser-support
+ */
+
+/***************************************************************************************************
+ * BROWSER POLYFILLS
+ */
+
+/**
+ * By default, zone.js will patch all possible macroTask and DomEvents
+ * user can disable parts of macroTask/DomEvents patch by setting following flags
+ * because those flags need to be set before `zone.js` being loaded, and webpack
+ * will put import in the top of bundle, so user need to create a separate file
+ * in this directory (for example: zone-flags.ts), and put the following flags
+ * into that file, and then add the following code before importing zone.js.
+ * import './zone-flags';
+ *
+ * The flags allowed in zone-flags.ts are listed here.
+ *
+ * The following flags will work for all browsers.
+ *
+ * (window as any).__Zone_disable_requestAnimationFrame = true; // disable patch requestAnimationFrame
+ * (window as any).__Zone_disable_on_property = true; // disable patch onProperty such as onclick
+ * (window as any).__zone_symbol__UNPATCHED_EVENTS = ['scroll', 'mousemove']; // disable patch specified eventNames
+ *
+ *  in IE/Edge developer tools, the addEventListener will also be wrapped by zone.js
+ *  with the following flag, it will bypass `zone.js` patch for IE/Edge
+ *
+ *  (window as any).__Zone_enable_cross_context_check = true;
+ *
+ */
+
+/***************************************************************************************************
+ * Zone JS is required by default for Angular itself.
+ */
+import 'zone.js';  // Included with Angular CLI.
+
+
+/***************************************************************************************************
+ * APPLICATION IMPORTS
+ */

console-webapp/src/styles.less

@@ -0,0 +1,18 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+
+html, body { height: 100%; }
+body { margin: 0; font-family: Roboto, "Helvetica Neue", sans-serif; }

console-webapp/src/test.ts

@@ -0,0 +1,14 @@
+// This file is required by karma.conf.js and loads recursively all the .spec and framework files
+
+import 'zone.js/testing';
+import { getTestBed } from '@angular/core/testing';
+import {
+  BrowserDynamicTestingModule,
+  platformBrowserDynamicTesting
+} from '@angular/platform-browser-dynamic/testing';
+
+// First, initialize the Angular testing environment.
+getTestBed().initTestEnvironment(
+  BrowserDynamicTestingModule,
+  platformBrowserDynamicTesting(),
+);

console-webapp/tsconfig.app.json

@@ -0,0 +1,15 @@
+/* To learn more about this file see: https://angular.io/config/tsconfig. */
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./out-tsc/app",
+    "types": []
+  },
+  "files": [
+    "src/main.ts",
+    "src/polyfills.ts"
+  ],
+  "include": [
+    "src/**/*.d.ts"
+  ]
+}

console-webapp/tsconfig.json

@@ -0,0 +1,33 @@
+/* To learn more about this file see: https://angular.io/config/tsconfig. */
+{
+  "compileOnSave": false,
+  "compilerOptions": {
+    "baseUrl": "./",
+    "outDir": "./dist/out-tsc",
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "noImplicitOverride": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "sourceMap": true,
+    "declaration": false,
+    "downlevelIteration": true,
+    "experimentalDecorators": true,
+    "moduleResolution": "node",
+    "importHelpers": true,
+    "target": "ES2022",
+    "module": "es2020",
+    "lib": [
+      "es2020",
+      "dom"
+    ],
+    "useDefineForClassFields": false
+  },
+  "angularCompilerOptions": {
+    "enableI18nLegacyMessageIdFormat": false,
+    "strictInjectionParameters": true,
+    "strictInputAccessModifiers": true,
+    "strictTemplates": true
+  }
+}

console-webapp/tsconfig.spec.json

@@ -0,0 +1,18 @@
+/* To learn more about this file see: https://angular.io/config/tsconfig. */
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./out-tsc/spec",
+    "types": [
+      "jasmine"
+    ]
+  },
+  "files": [
+    "src/test.ts",
+    "src/polyfills.ts"
+  ],
+  "include": [
+    "src/**/*.spec.ts",
+    "src/**/*.d.ts"
+  ]
+}

core/build.gradle

@@ -270,6 +270,8 @@ dependencies {
   implementation deps['org.jsoup:jsoup']
   testImplementation deps['org.mortbay.jetty:jetty']
   implementation deps['org.postgresql:postgresql']
+  implementation "org.eclipse.jetty:jetty-server:9.4.49.v20220914"
+  implementation "org.eclipse.jetty:jetty-servlet:9.4.49.v20220914"
   testImplementation deps['org.seleniumhq.selenium:selenium-api']
   testImplementation deps['org.seleniumhq.selenium:selenium-chrome-driver']
   testImplementation deps['org.seleniumhq.selenium:selenium-java']
@@ -750,9 +752,14 @@ if (environment == 'alpha') {
           ],
       invoicing          :
           [
-              mainClass: 'google.registry.beam.invoicing.InvoicingPipeline',
+              mainClass: 'google.registry.beam.billing.InvoicingPipeline',
               metaData : 'google/registry/beam/invoicing_pipeline_metadata.json'
           ],
+      expandBilling      :
+          [
+              mainClass: 'google.registry.beam.billing.ExpandRecurringBillingEventsPipeline',
+              metaData : 'google/registry/beam/expand_recurring_billing_events_pipeline_metadata.json'
+          ],
       rde                :
           [
               mainClass: 'google.registry.beam.rde.RdePipeline',

core/gradle.lockfile

@@ -367,6 +367,13 @@ org.codehaus.mojo:animal-sniffer-annotations:1.22=default,deploy_jar,nonprodRunt
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.easymock:easymock:3.0=css
 org.eclipse.angus:angus-activation:1.0.0=nonprodRuntime,runtime
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-core:4.0.1=nonprodRuntime,runtime
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

core/src/main/java/google/registry/beam/billing/BillingEvent.java

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.beam.invoicing;
+package google.registry.beam.billing;
 
 import com.google.auto.value.AutoValue;
 import com.google.common.base.Joiner;

core/src/main/java/google/registry/beam/billing/ExpandRecurringBillingEventsPipeline.java

@@ -0,0 +1,460 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.billing;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.collect.Sets.difference;
+import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
+import static google.registry.model.domain.Period.Unit.YEARS;
+import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.util.CollectionUtils.union;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+import static google.registry.util.DateTimeUtils.earliestOf;
+import static google.registry.util.DateTimeUtils.latestOf;
+import static org.apache.beam.sdk.values.TypeDescriptors.voids;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Range;
+import dagger.Component;
+import google.registry.beam.common.RegistryJpaIO;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.config.RegistryConfig.ConfigModule;
+import google.registry.flows.custom.CustomLogicFactoryModule;
+import google.registry.flows.custom.CustomLogicModule;
+import google.registry.flows.domain.DomainPricingLogic;
+import google.registry.model.ImmutableObject;
+import google.registry.model.billing.BillingEvent.Cancellation;
+import google.registry.model.billing.BillingEvent.Flag;
+import google.registry.model.billing.BillingEvent.OneTime;
+import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.common.Cursor;
+import google.registry.model.domain.Domain;
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.domain.Period;
+import google.registry.model.reporting.DomainTransactionRecord;
+import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
+import google.registry.model.tld.Registry;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import google.registry.util.Clock;
+import google.registry.util.SystemClock;
+import java.io.Serializable;
+import java.math.BigInteger;
+import java.util.Set;
+import javax.inject.Singleton;
+import org.apache.beam.sdk.Pipeline;
+import org.apache.beam.sdk.PipelineResult;
+import org.apache.beam.sdk.coders.KvCoder;
+import org.apache.beam.sdk.coders.VarIntCoder;
+import org.apache.beam.sdk.coders.VarLongCoder;
+import org.apache.beam.sdk.metrics.Counter;
+import org.apache.beam.sdk.metrics.Metrics;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.apache.beam.sdk.transforms.Create;
+import org.apache.beam.sdk.transforms.DoFn;
+import org.apache.beam.sdk.transforms.GroupIntoBatches;
+import org.apache.beam.sdk.transforms.MapElements;
+import org.apache.beam.sdk.transforms.ParDo;
+import org.apache.beam.sdk.transforms.Wait;
+import org.apache.beam.sdk.values.KV;
+import org.apache.beam.sdk.values.PCollection;
+import org.apache.beam.sdk.values.PDone;
+import org.joda.time.DateTime;
+
+/**
+ * Definition of a Dataflow Flex pipeline template, which expands {@link Recurring} to {@link
+ * OneTime} when an autorenew occurs within the given time frame.
+ *
+ * <p>This pipeline works in three stages:
+ *
+ * <ul>
+ *   <li>Gather the {@link Recurring}s that are in scope for expansion. The exact condition of
+ *       {@link Recurring}s to include can be found in {@link #getRecurringsInScope(Pipeline)}.
+ *   <li>Expand the {@link Recurring}s to {@link OneTime} (and corresponding {@link DomainHistory})
+ *       that fall within the [{@link #startTime}, {@link #endTime}) window, excluding those that
+ *       are already present (to make this pipeline idempotent when running with the same parameters
+ *       multiple times, either in parallel or in sequence). The {@link Recurring} is also updated
+ *       with the information on when it was last expanded, so it would not be in scope for
+ *       expansion until at least a year later.
+ *   <li>If the cursor for billing events should be advanced, advance it to {@link #endTime} after
+ *       all of the expansions in the previous step is done, only when it is currently at {@link
+ *       #startTime}.
+ * </ul>
+ *
+ * <p>Note that the creation of new {@link OneTime} and {@link DomainHistory} is done speculatively
+ * as soon as its event time is in scope for expansion (i.e. within the window of operation). If a
+ * domain is subsequently cancelled during the autorenew grace period, a {@link Cancellation} would
+ * have been created to cancel the {@link OneTime} out. Similarly, a {@link DomainHistory} for the
+ * delete will be created which negates the effect of the speculatively created {@link
+ * DomainHistory}, specifically for the transaction records. Both the {@link OneTime} and {@link
+ * DomainHistory} will only be used (and cancelled out) when the billing time becomes effective,
+ * which is after the grace period, when the cancellations would have been written, if need be. This
+ * is no different from what we do with manual renewals or normal creates, where entities are always
+ * created for the action regardless of whether their effects will be negated later due to
+ * subsequent actions within respective grace periods.
+ *
+ * <p>To stage this template locally, run {@code ./nom_build :core:sBP --environment=alpha \
+ * --pipeline=expandBilling}.
+ *
+ * <p>Then, you can run the staged template via the API client library, gCloud or a raw REST call.
+ *
+ * @see Cancellation#forGracePeriod
+ * @see google.registry.flows.domain.DomainFlowUtils#createCancelingRecords
+ * @see <a href="https://cloud.google.com/dataflow/docs/guides/templates/using-flex-templates">Using
+ *     Flex Templates</a>
+ */
+public class ExpandRecurringBillingEventsPipeline implements Serializable {
+
+  private static final long serialVersionUID = -5827984301386630194L;
+
+  private static final DomainPricingLogic domainPricingLogic;
+
+  private static final int batchSize;
+
+  static {
+    PipelineComponent pipelineComponent =
+        DaggerExpandRecurringBillingEventsPipeline_PipelineComponent.create();
+    domainPricingLogic = pipelineComponent.domainPricingLogic();
+    batchSize = pipelineComponent.batchSize();
+  }
+
+  // Inclusive lower bound of the expansion window.
+  private final DateTime startTime;
+  // Exclusive lower bound of the expansion window.
+  private final DateTime endTime;
+  private final boolean isDryRun;
+  private final boolean advanceCursor;
+  private final Counter recurringsInScopeCounter =
+      Metrics.counter("ExpandBilling", "RecurringsInScope");
+  private final Counter expandedOneTimeCounter =
+      Metrics.counter("ExpandBilling", "ExpandedOneTime");
+
+  ExpandRecurringBillingEventsPipeline(
+      ExpandRecurringBillingEventsPipelineOptions options, Clock clock) {
+    startTime = DateTime.parse(options.getStartTime());
+    endTime = DateTime.parse(options.getEndTime());
+    checkArgument(
+        !endTime.isAfter(clock.nowUtc()),
+        String.format("End time %s must be on or before now.", endTime));
+    checkArgument(
+        startTime.isBefore(endTime),
+        String.format("[%s, %s) is not a valid window of operation.", startTime, endTime));
+    isDryRun = options.getIsDryRun();
+    advanceCursor = options.getAdvanceCursor();
+  }
+
+  private PipelineResult run(Pipeline pipeline) {
+    setupPipeline(pipeline);
+    return pipeline.run();
+  }
+
+  void setupPipeline(Pipeline pipeline) {
+    PCollection<KV<Integer, Long>> recurringIds = getRecurringsInScope(pipeline);
+    PCollection<Void> expanded = expandRecurrings(recurringIds);
+    if (!isDryRun && advanceCursor) {
+      advanceCursor(expanded);
+    }
+  }
+
+  PCollection<KV<Integer, Long>> getRecurringsInScope(Pipeline pipeline) {
+    return pipeline.apply(
+        "Read all Recurrings in scope",
+        // Use native query because JPQL does not support timestamp arithmetics.
+        RegistryJpaIO.read(
+                "SELECT billing_recurrence_id "
+                    + "FROM \"BillingRecurrence\" "
+                    // Recurrence should not close before the first event time.
+                    + "WHERE event_time < recurrence_end_time "
+                    // First event time should be before end time.
+                    + "AND event_Time < :endTime "
+                    // Recurrence should not close before start time.
+                    + "AND :startTime < recurrence_end_time "
+                    // Last expansion should happen at least one year before start time.
+                    + "AND recurrence_last_expansion < :oneYearAgo "
+                    // The recurrence should not close before next expansion time.
+                    + "AND recurrence_last_expansion + INTERVAL '1 YEAR' < recurrence_end_time",
+                ImmutableMap.of(
+                    "endTime",
+                    endTime,
+                    "startTime",
+                    startTime,
+                    "oneYearAgo",
+                    endTime.minusYears(1)),
+                true,
+                (BigInteger id) -> {
+                  // Note that because all elements are mapped to the same dummy key, the next
+                  // batching transform will effectively be serial. This however does not matter for
+                  // our use case because the elements were obtained from a SQL read query, which
+                  // are returned sequentially already. Therefore, having a sequential step to group
+                  // them does not reduce overall parallelism of the pipeline, and the batches can
+                  // then be distributed to all available workers for further processing, where the
+                  // main benefit of parallelism shows. In benchmarking, turning the distribution
+                  // of elements in this step resulted in marginal improvement in overall
+                  // performance at best without clear indication on why or to which degree. If the
+                  // runtime becomes a concern later on, we could consider fine-tuning the sharding
+                  // of output elements in this step.
+                  //
+                  // See: https://stackoverflow.com/a/44956702/791306
+                  return KV.of(0, id.longValue());
+                })
+            .withCoder(KvCoder.of(VarIntCoder.of(), VarLongCoder.of())));
+  }
+
+  private PCollection<Void> expandRecurrings(PCollection<KV<Integer, Long>> recurringIds) {
+    return recurringIds
+        .apply(
+            "Group into batches",
+            GroupIntoBatches.<Integer, Long>ofSize(batchSize).withShardedKey())
+        .apply(
+            "Expand and save Recurrings into OneTimes and corresponding DomainHistories",
+            MapElements.into(voids())
+                .via(
+                    element -> {
+                      Iterable<Long> ids = element.getValue();
+                      tm().transact(
+                              () -> {
+                                ImmutableSet.Builder<ImmutableObject> results =
+                                    new ImmutableSet.Builder<>();
+                                ids.forEach(id -> expandOneRecurring(id, results));
+                                if (!isDryRun) {
+                                  tm().putAll(results.build());
+                                }
+                              });
+                      return null;
+                    }));
+  }
+
+  private void expandOneRecurring(Long recurringId, ImmutableSet.Builder<ImmutableObject> results) {
+    Recurring recurring = tm().loadByKey(Recurring.createVKey(recurringId));
+    recurringsInScopeCounter.inc();
+    Domain domain = tm().loadByKey(Domain.createVKey(recurring.getDomainRepoId()));
+    Registry tld = Registry.get(domain.getTld());
+
+    // Determine the complete set of EventTimes this recurring event should expand to within
+    // [max(recurrenceLastExpansion + 1 yr, startTime), min(recurrenceEndTime, endTime)).
+    ImmutableSet<DateTime> eventTimes =
+        ImmutableSet.copyOf(
+            recurring
+                .getRecurrenceTimeOfYear()
+                .getInstancesInRange(
+                    Range.closedOpen(
+                        latestOf(recurring.getRecurrenceLastExpansion().plusYears(1), startTime),
+                        earliestOf(recurring.getRecurrenceEndTime(), endTime))));
+
+    // Find the times for which the OneTime billing event are already created, making this expansion
+    // idempotent. There is no need to match to the domain repo ID as the cancellation matching
+    // billing event itself can only be for a single domain.
+    ImmutableSet<DateTime> existingEventTimes =
+        ImmutableSet.copyOf(
+            tm().query(
+                    "SELECT eventTime FROM BillingEvent WHERE cancellationMatchingBillingEvent ="
+                        + " :key",
+                    DateTime.class)
+                .setParameter("key", recurring.createVKey())
+                .getResultList());
+
+    Set<DateTime> eventTimesToExpand = difference(eventTimes, existingEventTimes);
+
+    if (eventTimesToExpand.isEmpty()) {
+      return;
+    }
+
+    DateTime recurrenceLastExpansionTime = recurring.getRecurrenceLastExpansion();
+
+    // Create new OneTime and DomainHistory for EventTimes that needs to be expanded.
+    for (DateTime eventTime : eventTimesToExpand) {
+      recurrenceLastExpansionTime = latestOf(recurrenceLastExpansionTime, eventTime);
+      expandedOneTimeCounter.inc();
+      DateTime billingTime = eventTime.plus(tld.getAutoRenewGracePeriodLength());
+      // Note that the DomainHistory is created as of transaction time, as opposed to event time.
+      // This might be counterintuitive because other DomainHistories are created at the time
+      // mutation events occur, such as in DomainDeleteFlow or DomainRenewFlow. Therefore, it is
+      // possible to have a DomainHistory for a delete during the autorenew grace period with a
+      // modification time before that of the DomainHistory for the autorenew itself. This is not
+      // ideal, but necessary because we save the **current** state of the domain (as of transaction
+      // time) to the DomainHistory , instead of the state of the domain as of event time (which
+      // would required loading the domain from DomainHistory at event time).
+      //
+      // Even though doing the loading is seemly possible, it generally is a bad idea to create
+      // DomainHistories retroactively and in all instances that we create a HistoryEntry we always
+      // set the modification time to the transaction time. It would also violate the invariance
+      // that a DomainHistory with a higher revision ID (which is always allocated with monotonic
+      // increase) always has a later modification time.
+      //
+      // Lastly because the domain entity itself did not change as part of the expansion, we should
+      // not project it to transaction time before saving it in the history, which would require us
+      // to save the projected domain as well. Any changes to the domain itself are handled when
+      // the domain is actually used or explicitly projected and saved. The DomainHistory created
+      // here does not actually affect anything materially (e.g. RDE). We can understand it in such
+      // a way that this history represents not when the domain is autorenewed (at event time), but
+      // when its autorenew billing event is created (at transaction time).
+      DomainHistory historyEntry =
+          new DomainHistory.Builder()
+              .setBySuperuser(false)
+              .setRegistrarId(recurring.getRegistrarId())
+              .setModificationTime(tm().getTransactionTime())
+              .setDomain(domain)
+              .setPeriod(Period.create(1, YEARS))
+              .setReason("Domain autorenewal by ExpandRecurringBillingEventsPipeline")
+              .setRequestedByRegistrar(false)
+              .setType(DOMAIN_AUTORENEW)
+              .setDomainTransactionRecords(
+                  // Don't write a domain transaction record if the domain is deleted before billing
+                  // time (i.e. within the autorenew grace period). We cannot rely on a negating
+                  // DomainHistory created by DomainDeleteFlow because it only cancels transaction
+                  // records already present. In this case the domain was deleted before this
+                  // pipeline runs to expand the OneTime (which should be rare because this pipeline
+                  // should run every day), and no negating transaction records would have been
+                  // created when the deletion occurred. Again, there is no need to project the
+                  // domain, because if it were deleted before this transaction, its updated delete
+                  // time would have already been loaded here.
+                  //
+                  // We don't compare recurrence end time with billing time because the recurrence
+                  // could be caused for other reasons during the grace period, like a manual
+                  // renewal, in which case we still want to write the transaction record. Also,
+                  // the expansion happens when event time is in scope, which means the billing time
+                  // is still 45 days in the future, and the recurrence could have been closed
+                  // between now and then.
+                  //
+                  // A side effect of this logic is that if a transfer occurs within the ARGP, it
+                  // would have recorded both a TRANSFER_SUCCESSFUL and a NET_RENEWS_1_YEAR, even
+                  // though the transfer would have subsumed the autorenew. There is no perfect
+                  // solution for this because even if we expand the recurrence when the billing
+                  // event is in scope (as was the case in the old action), we still cannot use
+                  // recurrence end time < billing time as an indicator for if a transfer had
+                  // occurred during ARGP (see last paragraph, renewals during ARGP also close the
+                  // recurrence),therefore we still cannot always be correct when constructing the
+                  // transaction records that way (either we miss transfers, or we miss renewals
+                  // during ARGP).
+                  //
+                  // See: DomainFlowUtils#createCancellingRecords
+                  domain.getDeletionTime().isBefore(billingTime)
+                      ? ImmutableSet.of()
+                      : ImmutableSet.of(
+                          DomainTransactionRecord.create(
+                              tld.getTldStr(),
+                              // We report this when the autorenew grace period ends.
+                              billingTime,
+                              TransactionReportField.netRenewsFieldFromYears(1),
+                              1)))
+              .build();
+      results.add(historyEntry);
+
+      // It is OK to always create a OneTime, even though the domain might be deleted or transferred
+      // later during autorenew grace period, as a cancellation will always be written out in those
+      // instances.
+      OneTime oneTime =
+          new OneTime.Builder()
+              .setBillingTime(billingTime)
+              .setRegistrarId(recurring.getRegistrarId())
+              // Determine the cost for a one-year renewal.
+              .setCost(
+                  domainPricingLogic
+                      .getRenewPrice(tld, recurring.getTargetId(), eventTime, 1, recurring)
+                      .getRenewCost())
+              .setEventTime(eventTime)
+              .setFlags(union(recurring.getFlags(), Flag.SYNTHETIC))
+              .setDomainHistory(historyEntry)
+              .setPeriodYears(1)
+              .setReason(recurring.getReason())
+              .setSyntheticCreationTime(endTime)
+              .setCancellationMatchingBillingEvent(recurring)
+              .setTargetId(recurring.getTargetId())
+              .build();
+      results.add(oneTime);
+    }
+    results.add(
+        recurring.asBuilder().setRecurrenceLastExpansion(recurrenceLastExpansionTime).build());
+  }
+
+  private PDone advanceCursor(PCollection<Void> persisted) {
+    return PDone.in(
+        persisted
+            .getPipeline()
+            .apply("Create one dummy element", Create.of((Void) null))
+            .apply("Wait for all saves to finish", Wait.on(persisted))
+            // Because only one dummy element is created in the start PCollection, this
+            // transform is guaranteed to only process one element and therefore only run once.
+            // Because the previous step waits for all emissions of voids from the expansion step to
+            // finish, this transform is guaranteed to run only after all expansions are done and
+            // persisted.
+            .apply(
+                "Advance cursor",
+                ParDo.of(
+                    new DoFn<Void, Void>() {
+                      @ProcessElement
+                      public void processElement() {
+                        tm().transact(
+                                () -> {
+                                  DateTime currentCursorTime =
+                                      tm().loadByKeyIfPresent(
+                                              Cursor.createGlobalVKey(RECURRING_BILLING))
+                                          .orElse(
+                                              Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
+                                          .getCursorTime();
+                                  if (!currentCursorTime.equals(startTime)) {
+                                    throw new IllegalStateException(
+                                        String.format(
+                                            "Current cursor position %s does not match start time"
+                                                + " %s.",
+                                            currentCursorTime, startTime));
+                                  }
+                                  tm().put(Cursor.createGlobal(RECURRING_BILLING, endTime));
+                                });
+                      }
+                    }))
+            .getPipeline());
+  }
+
+  public static void main(String[] args) {
+    PipelineOptionsFactory.register(ExpandRecurringBillingEventsPipelineOptions.class);
+    ExpandRecurringBillingEventsPipelineOptions options =
+        PipelineOptionsFactory.fromArgs(args)
+            .withValidation()
+            .as(ExpandRecurringBillingEventsPipelineOptions.class);
+    // Hardcode the transaction level to be at serializable we do not want concurrent runs of the
+    // pipeline for the same window to create duplicate OneTimes. This ensures that the set of
+    // existing OneTimes do not change by the time new OneTimes are inserted within a transaction.
+    //
+    // Per PostgreSQL, serializable isolation level does not introduce any blocking beyond that
+    // present in  repeatable read other than some overhead related to monitoring possible
+    // serializable anomalies. Therefore, in most cases, since each worker of the same job works on
+    // a different set of recurrings, it is not possible for their execution order to affect
+    // serialization outcome, and the performance penalty should be minimum when using serializable
+    // compared to using repeatable read.
+    //
+    // We should pay some attention to the runtime of the job and logs when we run this job daily on
+    // production to check the actual performance impact for using this isolation level (i.e. check
+    // the frequency of occurrence of retried transactions due to serialization errors) to assess
+    // the actual parallelism of the job.
+    //
+    // See: https://www.postgresql.org/docs/current/transaction-iso.html
+    options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_SERIALIZABLE);
+    Pipeline pipeline = Pipeline.create(options);
+    new ExpandRecurringBillingEventsPipeline(options, new SystemClock()).run(pipeline);
+  }
+
+  @Singleton
+  @Component(
+      modules = {CustomLogicModule.class, CustomLogicFactoryModule.class, ConfigModule.class})
+  interface PipelineComponent {
+
+    DomainPricingLogic domainPricingLogic();
+
+    @Config("jdbcBatchSize")
+    int batchSize();
+  }
+}

core/src/main/java/google/registry/beam/billing/ExpandRecurringBillingEventsPipelineOptions.java

@@ -0,0 +1,49 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.billing;
+
+import google.registry.beam.common.RegistryPipelineOptions;
+import org.apache.beam.sdk.options.Default;
+import org.apache.beam.sdk.options.Description;
+
+public interface ExpandRecurringBillingEventsPipelineOptions extends RegistryPipelineOptions {
+  @Description(
+      "The inclusive lower bound of on the range of event times that will be expanded, in ISO 8601"
+          + " format")
+  String getStartTime();
+
+  void setStartTime(String startTime);
+
+  @Description(
+      "The exclusive upper bound of on the range of event times that will be expanded, in ISO 8601"
+          + " format")
+  String getEndTime();
+
+  void setEndTime(String endTime);
+
+  @Description("If true, the expanded billing events and history entries will not be saved.")
+  @Default.Boolean(false)
+  boolean getIsDryRun();
+
+  void setIsDryRun(boolean isDryRun);
+
+  @Description(
+      "If true, set the RECURRING_BILLING global cursor to endTime after saving all expanded"
+          + " billing events and history entries.")
+  @Default.Boolean(true)
+  boolean getAdvanceCursor();
+
+  void setAdvanceCursor(boolean advanceCursor);
+}

core/src/main/java/google/registry/beam/billing/InvoicingPipeline.java

@@ -12,16 +12,16 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.beam.invoicing;
+package google.registry.beam.billing;
 
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static org.apache.beam.sdk.values.TypeDescriptors.strings;
 
 import com.google.common.flogger.FluentLogger;
+import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey;
+import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
 import google.registry.beam.common.RegistryJpaIO;
 import google.registry.beam.common.RegistryJpaIO.Read;
-import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey;
-import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
 import google.registry.model.billing.BillingEvent.Flag;
 import google.registry.model.billing.BillingEvent.OneTime;
 import google.registry.model.registrar.Registrar;

core/src/main/java/google/registry/beam/billing/InvoicingPipelineOptions.java

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.beam.invoicing;
+package google.registry.beam.billing;
 
 import google.registry.beam.common.RegistryPipelineOptions;
 import org.apache.beam.sdk.options.Description;

core/src/main/java/google/registry/beam/common/RegistryJpaIO.java

@@ -71,7 +71,7 @@ public final class RegistryJpaIO {
   }
 
   /**
-   * Returns a {@link Read} connector based on the given {@code jpql} query string.
+   * Returns a {@link Read} connector based on the given native or {@code jpql} query string.
    *
    * <p>User should take care to prevent sql-injection attacks.
    */

core/src/main/java/google/registry/beam/common/RegistryPipelineOptions.java

@@ -15,7 +15,6 @@
 package google.registry.beam.common;
 
 import google.registry.config.RegistryEnvironment;
-import google.registry.model.annotations.DeleteAfterMigration;
 import google.registry.persistence.PersistenceModule.JpaTransactionManagerType;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import java.util.Objects;
@@ -57,17 +56,6 @@ public interface RegistryPipelineOptions extends GcpOptions {
 
   void setSqlWriteBatchSize(int sqlWriteBatchSize);
 
-  @DeleteAfterMigration
-  @Description(
-      "Whether to use self allocated primary IDs when building entities. This should only be used"
-          + " when the IDs are not significant and the resulting entities are not persisted back to"
-          + " the database. Use with caution as self allocated IDs are not unique across workers,"
-          + " and persisting entities with these IDs can be dangerous.")
-  @Default.Boolean(false)
-  boolean getUseSelfAllocatedId();
-
-  void setUseSelfAllocatedId(boolean useSelfAllocatedId);
-
   static RegistryPipelineComponent toRegistryPipelineComponent(RegistryPipelineOptions options) {
     return DaggerRegistryPipelineComponent.builder()
         .isolationOverride(options.getIsolationOverride())

core/src/main/java/google/registry/beam/common/RegistryPipelineWorkerInitializer.java

@@ -21,7 +21,6 @@ import com.google.common.flogger.FluentLogger;
 import dagger.Lazy;
 import google.registry.config.RegistryEnvironment;
 import google.registry.config.SystemPropertySetter;
-import google.registry.model.IdService;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
 import org.apache.beam.sdk.harness.JvmInitializer;
@@ -63,15 +62,5 @@ public class RegistryPipelineWorkerInitializer implements JvmInitializer {
     }
     TransactionManagerFactory.setJpaTmOnBeamWorker(transactionManagerLazy::get);
     SystemPropertySetter.PRODUCTION_IMPL.setProperty(PROPERTY, "true");
-    // Use self-allocated IDs if requested. Note that this inevitably results in duplicate IDs from
-    // multiple workers, which can also collide with existing IDs in the database. So they cannot be
-    // dependent upon for comparison or anything significant. The resulting entities can never be
-    // persisted back into the database. This is a stop-gap measure that should only be used when
-    // you need to create Buildables in Beam, but do not have control over how the IDs are
-    // allocated, and you don't care about the generated IDs as long
-    // as you can build the entities.
-    if (registryOptions.getUseSelfAllocatedId()) {
-      IdService.setForceUseSelfAllocatedId();
-    }
   }
 }

core/src/main/java/google/registry/beam/common/RegistryQuery.java

@@ -24,8 +24,10 @@ import java.util.stream.Stream;
 import javax.annotation.Nullable;
 import javax.persistence.EntityManager;
 import javax.persistence.Query;
+import javax.persistence.TemporalType;
 import javax.persistence.TypedQuery;
 import javax.persistence.criteria.CriteriaQuery;
+import org.joda.time.DateTime;
 
 /** Interface for query instances used by {@link RegistryJpaIO.Read}. */
 public interface RegistryQuery<T> extends Serializable {
@@ -57,7 +59,14 @@ public interface RegistryQuery<T> extends Serializable {
       Query query =
           nativeQuery ? entityManager.createNativeQuery(sql) : entityManager.createQuery(sql);
       if (parameters != null) {
-        parameters.forEach(query::setParameter);
+        parameters.forEach(
+            (key, value) -> {
+              if (value instanceof DateTime) {
+                query.setParameter(key, ((DateTime) value).toDate(), TemporalType.TIMESTAMP);
+              } else {
+                query.setParameter(key, value);
+              }
+            });
       }
       JpaTransactionManager.setQueryFetchSize(query, QUERY_FETCH_SIZE);
       @SuppressWarnings("unchecked")

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -170,7 +170,6 @@ import org.joda.time.DateTime;
  * @see <a href="https://cloud.google.com/dataflow/docs/guides/templates/using-flex-templates">Using
  *     Flex Templates</a>
  */
-@SuppressWarnings("ALL")
 @Singleton
 public class RdePipeline implements Serializable {
 
@@ -688,13 +687,6 @@ public class RdePipeline implements Serializable {
     RdePipelineOptions options =
         PipelineOptionsFactory.fromArgs(args).withValidation().as(RdePipelineOptions.class);
 
-    // We need to self allocate the IDs because the pipeline creates EPP resources from history
-    // entries and projects them to watermark. These buildable entities would otherwise request an
-    // ID from datastore, which Beam does not have access to. The IDs are not included in the
-    // deposits or are these entities persisted back to the database, so it is OK to use a self
-    // allocated ID to get around the limitations of beam.
-    options.setUseSelfAllocatedId(true);
-
     RegistryPipelineOptions.validateRegistryPipelineOptions(options);
     options.setIsolationOverride(TransactionIsolationLevel.TRANSACTION_READ_COMMITTED);
     DaggerRdePipeline_RdePipelineComponent.builder().options(options).build().rdePipeline().run();

core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java

@@ -26,7 +26,6 @@ import google.registry.beam.common.RegistryJpaIO;
 import google.registry.beam.common.RegistryJpaIO.Read;
 import google.registry.beam.spec11.SafeBrowsingTransforms.EvaluateSafeBrowsingFn;
 import google.registry.config.RegistryConfig.ConfigModule;
-import google.registry.model.IdService;
 import google.registry.model.domain.Domain;
 import google.registry.model.reporting.Spec11ThreatMatch;
 import google.registry.model.reporting.Spec11ThreatMatch.ThreatType;
@@ -175,7 +174,7 @@ public class Spec11Pipeline implements Serializable {
                             .setDomainName(input.getKey().domainName())
                             .setDomainRepoId(input.getKey().domainRepoId())
                             .setRegistrarId(input.getKey().registrarId())
-                            .setId(IdService.allocateId())
+                            // TODO(b/264416932) Assign id to prevent duplicate inserts.
                             .build();
                     output.output(spec11ThreatMatch);
                   }

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -575,9 +575,9 @@ public final class RegistryConfig {
     /**
      * Returns the default job region to run Apache Beam (Cloud Dataflow) jobs in.
      *
-     * @see google.registry.beam.invoicing.InvoicingPipeline
+     * @see google.registry.beam.billing.InvoicingPipeline
      * @see google.registry.beam.spec11.Spec11Pipeline
-     * @see google.registry.beam.invoicing.InvoicingPipeline
+     * @see google.registry.beam.billing.InvoicingPipeline
      */
     @Provides
     @Config("defaultJobRegion")
@@ -655,7 +655,7 @@ public final class RegistryConfig {
     /**
      * Returns the URL of the GCS bucket we store invoices and detail reports in.
      *
-     * @see google.registry.beam.invoicing.InvoicingPipeline
+     * @see google.registry.beam.billing.InvoicingPipeline
      */
     @Provides
     @Config("billingBucketUrl")
@@ -691,7 +691,7 @@ public final class RegistryConfig {
     /**
      * Returns the file prefix for the invoice CSV file.
      *
-     * @see google.registry.beam.invoicing.InvoicingPipeline
+     * @see google.registry.beam.billing.InvoicingPipeline
      * @see google.registry.reporting.billing.BillingEmailUtils
      */
     @Provides
@@ -1153,6 +1153,12 @@ public final class RegistryConfig {
       return ImmutableSet.copyOf(config.oAuth.allowedOauthClientIds);
     }
 
+    @Provides
+    @Config("iapClientId")
+    public static Optional<String> provideIapClientId(RegistryConfigSettings config) {
+      return Optional.ofNullable(config.oAuth.iapClientId);
+    }
+
     /**
      * Provides the OAuth scopes required for accessing Google APIs using the default credential.
      */

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -61,6 +61,7 @@ public class RegistryConfigSettings {
     public List<String> availableOauthScopes;
     public List<String> requiredOauthScopes;
     public List<String> allowedOauthClientIds;
+    public String iapClientId;
   }
 
   /** Configuration options for accessing Google APIs. */

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -306,6 +306,9 @@ oAuth:
   # in this list. Client IDs are typically of the format
   # numbers-alphanumerics.apps.googleusercontent.com
   allowedOauthClientIds: []
+  # GCP Identity-Aware Proxy client ID, if set up (note: this requires manual setup
+  # of User objects in the database for Nomulus tool users)
+  iapClientId: null
 
 credentialOAuth:
   # OAuth scopes required for accessing Google APIs using the default

core/src/main/java/google/registry/env/common/default/WEB-INF/web.xml

@@ -13,6 +13,29 @@
     <load-on-startup>1</load-on-startup>
   </servlet>
 
+  <!-- Dedicated servlet for static content with cache control -->
+  <servlet>
+    <servlet-name>default</servlet-name>
+    <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
+    <init-param>
+      <param-name>cacheControl</param-name>
+      <param-value>max-age=18000,public</param-value>
+    </init-param>
+    <init-param>
+      <param-name>precompressed</param-name>
+      <param-value>true</param-value>
+    </init-param>
+    <init-param>
+      <param-name>dirAllowed</param-name>
+      <param-value>false</param-value>
+    </init-param>
+    <load-on-startup>1</load-on-startup>
+  </servlet>
+  <servlet-mapping>
+    <servlet-name>default</servlet-name>
+    <url-pattern>/console/*</url-pattern>
+  </servlet-mapping>
+
   <!-- The primary EPP endpoint for the Registry, which accepts EPP requests from our TLS proxy. -->
   <servlet-mapping>
     <servlet-name>frontend-servlet</servlet-name>

core/src/main/java/google/registry/env/production/default/WEB-INF/cron.xml

@@ -258,7 +258,7 @@
   <cron>
     <url><![CDATA[/_dr/cron/fanout?queue=retryable-cron-tasks&endpoint=/_dr/task/generateInvoices?shouldPublish=true&runInEmpty]]></url>
     <description>
-      Starts the beam/invoicing/InvoicingPipeline Dataflow template, which creates the overall invoice and
+      Starts the beam/billing/InvoicingPipeline Dataflow template, which creates the overall invoice and
       detail report CSVs for last month, storing them in gs://[PROJECT-ID]-billing/invoices/yyyy-MM.
       Upon success, sends an e-mail copy of the invoice to billing personnel, and copies detail
       reports to the associated registrars' drive folders.

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -1131,7 +1131,7 @@ public class DomainFlowUtils {
    * hasn't been reported yet and b) matches the predicate 3. Return the transactionRecords under
    * the most recent HistoryEntry that fits the above criteria, with negated reportAmounts.
    */
-  static ImmutableSet<DomainTransactionRecord> createCancelingRecords(
+  public static ImmutableSet<DomainTransactionRecord> createCancelingRecords(
       Domain domain,
       final DateTime now,
       Duration maxSearchPeriod,

core/src/main/java/google/registry/model/IdService.java

@@ -14,62 +14,25 @@
 //
 package google.registry.model;
 
-import static com.google.common.base.Preconditions.checkState;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static org.joda.time.DateTimeZone.UTC;
 
-import com.google.appengine.api.datastore.DatastoreServiceFactory;
-import com.google.common.flogger.FluentLogger;
-import google.registry.beam.common.RegistryPipelineWorkerInitializer;
-import google.registry.config.RegistryEnvironment;
-import google.registry.model.common.DatabaseMigrationStateSchedule;
-import google.registry.model.common.DatabaseMigrationStateSchedule.MigrationState;
 import java.math.BigInteger;
 import java.util.concurrent.atomic.AtomicLong;
-import java.util.function.Supplier;
-import org.joda.time.DateTime;
 
 /**
  * Allocates a {@link long} to use as a {@code @Id}, (part) of the primary SQL key for an entity.
  */
 public final class IdService {
 
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+  private IdService() {}
 
-  // TODO(ptkach): remove once the Cloud SQL sequence-based method is live in production
-  private static boolean forceUseSelfAllocateId = false;
-
-  public static void setForceUseSelfAllocatedId() {
-    checkState(
-        "true".equals(System.getProperty(RegistryPipelineWorkerInitializer.PROPERTY, "false")),
-        "Can only set ID supplier in a Beam pipeline");
-    logger.atWarning().log("Using ID supplier override!");
-    IdService.forceUseSelfAllocateId = true;
-  }
-
-  private static class SelfAllocatedIdSupplier implements Supplier<Long> {
-
-    private static final SelfAllocatedIdSupplier INSTANCE = new SelfAllocatedIdSupplier();
-
-    /** Counts of used ids for self allocating IDs. */
-    private static final AtomicLong nextSelfAllocatedId = new AtomicLong(1); // ids cannot be zero
-
-    private static SelfAllocatedIdSupplier getInstance() {
-      return INSTANCE;
-    }
-
-    @Override
-    public Long get() {
-      return nextSelfAllocatedId.getAndIncrement();
-    }
-  }
   /**
-   * A SQL Sequence based ID allocator that generates an ID from a monotonically increasing atomic
-   * {@link long}
+   * A SQL Sequence based ID allocator that generates an ID from a monotonically increasing {@link
+   * AtomicLong}
    *
-   * <p>The generated IDs are project-wide unique
+   * <p>The generated IDs are project-wide unique.
    */
-  private static Long getSequenceBasedId() {
+  public static long allocateId() {
     return tm().transact(
             () ->
                 (BigInteger)
@@ -78,32 +41,4 @@ public final class IdService {
                         .getSingleResult())
         .longValue();
   }
-
-  // TODO(ptkach): Remove once all instances switch to sequenceBasedId
-  /**
-   * A Datastore based ID allocator that generates an ID from a monotonically increasing atomic
-   * {@link long}
-   *
-   * <p>The generated IDs are project-wide unique
-   */
-  private static Long getDatastoreBasedId() {
-    return DatastoreServiceFactory.getDatastoreService()
-        .allocateIds("common", 1)
-        .iterator()
-        .next()
-        .getId();
-  }
-
-  private IdService() {}
-
-  public static long allocateId() {
-    if (DatabaseMigrationStateSchedule.getValueAtTime(DateTime.now(UTC))
-            .equals(MigrationState.SEQUENCE_BASED_ALLOCATE_ID)
-        || RegistryEnvironment.UNITTEST.equals(RegistryEnvironment.get())) {
-      return getSequenceBasedId();
-    } else if (IdService.forceUseSelfAllocateId) {
-      return SelfAllocatedIdSupplier.getInstance().get();
-    }
-    return getDatastoreBasedId();
-  }
 }

core/src/main/java/google/registry/model/billing/BillingEvent.java

@@ -469,6 +469,7 @@ public abstract class BillingEvent extends ImmutableObject
         @Index(columnList = "eventTime"),
         @Index(columnList = "domainRepoId"),
         @Index(columnList = "recurrenceEndTime"),
+        @Index(columnList = "recurrenceLastExpansion"),
         @Index(columnList = "recurrence_time_of_year")
       })
   @AttributeOverride(name = "id", column = @Column(name = "billing_recurrence_id"))
@@ -481,6 +482,16 @@ public abstract class BillingEvent extends ImmutableObject
      */
     DateTime recurrenceEndTime;
 
+    /**
+     * The most recent {@link DateTime} when this recurrence was expanded.
+     *
+     * <p>We only bother checking recurrences for potential expansion if this is at least one year
+     * in the past. If it's more recent than that, it means that the recurrence was already expanded
+     * too recently to need to be checked again (as domains autorenew each year).
+     */
+    @Column(nullable = false)
+    DateTime recurrenceLastExpansion;
+
     /**
      * The eventTime recurs every year on this [month, day, time] between {@link #eventTime} and
      * {@link #recurrenceEndTime}, inclusive of the start but not of the end.
@@ -519,6 +530,10 @@ public abstract class BillingEvent extends ImmutableObject
       return recurrenceEndTime;
     }
 
+    public DateTime getRecurrenceLastExpansion() {
+      return recurrenceLastExpansion;
+    }
+
     public TimeOfYear getRecurrenceTimeOfYear() {
       return recurrenceTimeOfYear;
     }
@@ -559,6 +574,11 @@ public abstract class BillingEvent extends ImmutableObject
         return this;
       }
 
+      public Builder setRecurrenceLastExpansion(DateTime recurrenceLastExpansion) {
+        getInstance().recurrenceLastExpansion = recurrenceLastExpansion;
+        return this;
+      }
+
       public Builder setRenewalPriceBehavior(RenewalPriceBehavior renewalPriceBehavior) {
         getInstance().renewalPriceBehavior = renewalPriceBehavior;
         return this;
@@ -574,6 +594,12 @@ public abstract class BillingEvent extends ImmutableObject
         Recurring instance = getInstance();
         checkNotNull(instance.eventTime);
         checkNotNull(instance.reason);
+        // Don't require recurrenceLastExpansion to be individually set on every new Recurrence.
+        // The correct default value if not otherwise set is the event time of the recurrence minus
+        // 1 year.
+        instance.recurrenceLastExpansion =
+            Optional.ofNullable(instance.recurrenceLastExpansion)
+                .orElse(instance.eventTime.minusYears(1));
         checkArgument(
             instance.renewalPriceBehavior == RenewalPriceBehavior.SPECIFIED
                 ^ instance.renewalPrice == null,

core/src/main/java/google/registry/model/reporting/Spec11ThreatMatch.java

@@ -133,16 +133,6 @@ public class Spec11ThreatMatch extends ImmutableObject implements Buildable, Ser
       return super.build();
     }
 
-    /**
-     * Manually set the ID for testing or other special circumstances.
-     *
-     * <p>In general the ID is generated by SQL and there should be no need to set it manually.
-     */
-    public Builder setId(Long id) {
-      getInstance().id = id;
-      return this;
-    }
-
     public Builder setDomainName(String domainName) {
       getInstance().domainName = domainName;
       getInstance().tld = DomainNameUtils.getTldFromDomainName(domainName);

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -602,7 +602,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
     DateTime transactionTime;
 
     // The set of entity objects that have been either persisted (via insert()) or merged (via
-    // put()/update()).  If the entity manager returns these as a result of a find() or query
+    // put()/update()). If the entity manager returns these as a result of a find() or query
     // operation, we can not detach them -- detaching removes them from the transaction and causes
     // them to not be saved to the database -- so we throw an exception instead.
     Set<Object> objectsToSave = Collections.newSetFromMap(new IdentityHashMap<>());

core/src/main/java/google/registry/reporting/billing/GenerateInvoicesAction.java

@@ -52,7 +52,7 @@ import org.joda.time.YearMonth;
  * Invokes the {@code InvoicingPipeline} beam template via the REST api, and enqueues the {@link
  * PublishInvoicesAction} to publish the subsequent output.
  *
- * <p>This action runs the {@link google.registry.beam.invoicing.InvoicingPipeline} beam flex
+ * <p>This action runs the {@link google.registry.beam.billing.InvoicingPipeline} beam flex
  * template. The pipeline then generates invoices for the month and stores them on GCS.
  */
 @Action(
@@ -120,7 +120,7 @@ public class GenerateInvoicesAction implements Runnable {
                           .orElse(Cursor.createGlobal(RECURRING_BILLING, START_OF_TIME))
                           .getCursorTime());
 
-      if (yearMonth.getMonthOfYear() >= currentCursorTime.getMonthOfYear()) {
+      if (!YearMonth.fromDateFields(currentCursorTime.toDate()).isAfter(yearMonth)) {
         throw new IllegalStateException(
             "Latest billing events expansion cycle hasn't finished yet, terminating invoicing"
                 + " pipeline");

core/src/main/java/google/registry/reporting/billing/PublishInvoicesAction.java

@@ -39,7 +39,7 @@ import javax.inject.Inject;
 import org.joda.time.YearMonth;
 
 /**
- * Uploads the results of the {@link google.registry.beam.invoicing.InvoicingPipeline}.
+ * Uploads the results of the {@link google.registry.beam.billing.InvoicingPipeline}.
  *
  * <p>This relies on the retry semantics in {@code queue.xml} to ensure proper upload, in spite of
  * fluctuations in generation timing.

core/src/main/java/google/registry/tools/CreateOrUpdateTldCommand.java

@@ -15,7 +15,9 @@
 package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.tools.UpdateOrDeleteAllocationTokensCommand.getTokenKeys;
 import static google.registry.util.CollectionUtils.findDuplicates;
+import static google.registry.util.CollectionUtils.isNullOrEmpty;
 import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 
 import com.beust.jcommander.Parameter;
@@ -232,6 +234,16 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
   )
   Integer numDnsPublishShards;
 
+  @Nullable
+  @Parameter(
+      names = "--default_tokens",
+      description =
+          "A comma-separated list of default allocation tokens to be applied to the TLD. The"
+              + " ordering of this list will determine which token is used in the case where"
+              + " multiple tokens are valid for a registration. Use an empty string to clear all"
+              + " present default tokens.")
+  List<String> defaultTokens;
+
   /** Returns the existing registry (for update) or null (for creates). */
   @Nullable
   abstract Registry getOldRegistry(String tld);
@@ -373,6 +385,13 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
 
       builder.setAllowedFullyQualifiedHostNames(getAllowedNameservers(oldRegistry));
 
+      if (!isNullOrEmpty(defaultTokens)) {
+        if (defaultTokens.equals(ImmutableList.of(""))) {
+          builder.setDefaultPromoTokens(ImmutableList.of());
+        } else {
+          builder.setDefaultPromoTokens(getTokenKeys(defaultTokens, null));
+        }
+      }
       // Update the Registry object.
       setCommandSpecificProperties(builder);
       stageEntityChange(oldRegistry, builder.build());

core/src/main/java/google/registry/tools/DeleteAllocationTokensCommand.java

@@ -24,6 +24,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.persistence.VKey;
@@ -48,11 +49,11 @@ final class DeleteAllocationTokensCommand extends UpdateOrDeleteAllocationTokens
   private static final int BATCH_SIZE = 20;
   private static final Joiner JOINER = Joiner.on(", ");
 
-  private ImmutableSet<VKey<AllocationToken>> tokensToDelete;
+  private ImmutableList<VKey<AllocationToken>> tokensToDelete;
 
   @Override
   public void init() {
-    tokensToDelete = getTokenKeys();
+    tokensToDelete = getTokenKeys(tokens, prefix);
   }
 
   @Override

core/src/main/java/google/registry/tools/RequestFactoryModule.java

@@ -14,13 +14,23 @@
 
 package google.registry.tools;
 
+import com.google.api.client.http.GenericUrl;
+import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpRequestFactory;
+import com.google.api.client.http.HttpResponse;
+import com.google.api.client.http.UrlEncodedContent;
 import com.google.api.client.http.javanet.NetHttpTransport;
+import com.google.api.client.util.GenericData;
+import com.google.auth.oauth2.UserCredentials;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.CredentialModule.DefaultCredential;
 import google.registry.config.RegistryConfig;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
+import java.io.IOException;
+import java.net.URI;
+import java.util.Optional;
 
 /**
  * Module for providing the HttpRequestFactory.
@@ -33,9 +43,21 @@ class RequestFactoryModule {
 
   static final int REQUEST_TIMEOUT_MS = 10 * 60 * 1000;
 
+  /**
+   * Server to use if we want to manually request an IAP ID token
+   *
+   * <p>If we need to have an IAP-enabled audience, we can use the existing refresh token and the
+   * IAP client ID audience to request an IAP-enabled ID token. This token is read and used by
+   * {@link google.registry.request.auth.IapHeaderAuthenticationMechanism}, and it requires that the
+   * user have a {@link google.registry.model.console.User} object present in the database.
+   */
+  private static final GenericUrl TOKEN_SERVER_URL =
+      new GenericUrl(URI.create("https://oauth2.googleapis.com/token"));
+
   @Provides
   static HttpRequestFactory provideHttpRequestFactory(
-      @DefaultCredential GoogleCredentialsBundle credentialsBundle) {
+      @DefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("iapClientId") Optional<String> iapClientId) {
     if (RegistryConfig.areServersLocal()) {
       return new NetHttpTransport()
           .createRequestFactory(
@@ -47,7 +69,15 @@ class RequestFactoryModule {
       return new NetHttpTransport()
           .createRequestFactory(
               request -> {
-                credentialsBundle.getHttpRequestInitializer().initialize(request);
+                // If using IAP, use the refresh token to acquire an IAP-enabled ID token and use
+                // that for authentication.
+                if (iapClientId.isPresent()) {
+                  String idToken = getIdToken(credentialsBundle, iapClientId.get());
+                  request.getHeaders().setAuthorization("Bearer " + idToken);
+                } else {
+                  // Otherwise, use the standard credential HTTP initializer
+                  credentialsBundle.getHttpRequestInitializer().initialize(request);
+                }
                 // GAE request times out after 10 min, so here we set the timeout to 10 min. This is
                 // needed to support some nomulus commands like updating premium lists that take
                 // a lot of time to complete.
@@ -58,4 +88,32 @@ class RequestFactoryModule {
               });
     }
   }
+
+  /**
+   * Uses the saved desktop-app refresh token to acquire an IAP ID token.
+   *
+   * <p>This is lifted mostly from the Google Auth Library's {@link UserCredentials}
+   * "doRefreshAccessToken" method (which is private and thus inaccessible) while adding in the
+   * audience of the IAP client ID. That addition of the audience is what allows us to satisfy IAP
+   * auth. See
+   * https://cloud.google.com/iap/docs/authentication-howto#authenticating_from_a_desktop_app for
+   * more details.
+   */
+  private static String getIdToken(GoogleCredentialsBundle credentialsBundle, String iapClientId)
+      throws IOException {
+    UserCredentials credentials = (UserCredentials) credentialsBundle.getGoogleCredentials();
+    GenericData tokenRequest = new GenericData();
+    tokenRequest.set("client_id", credentials.getClientId());
+    tokenRequest.set("client_secret", credentials.getClientSecret());
+    tokenRequest.set("refresh_token", credentials.getRefreshToken());
+    tokenRequest.set("audience", iapClientId);
+    tokenRequest.set("grant_type", "refresh_token");
+    UrlEncodedContent content = new UrlEncodedContent(tokenRequest);
+
+    HttpRequestFactory requestFactory = credentialsBundle.getHttpTransport().createRequestFactory();
+    HttpRequest request = requestFactory.buildPostRequest(TOKEN_SERVER_URL, content);
+    request.setParser(credentialsBundle.getJsonFactory().createJsonObjectParser());
+    HttpResponse response = request.execute();
+    return response.parseAs(GenericData.class).get("id_token").toString();
+  }
 }

core/src/main/java/google/registry/tools/UpdateAllocationTokensCommand.java

@@ -129,7 +129,7 @@ final class UpdateAllocationTokensCommand extends UpdateOrDeleteAllocationTokens
     tokensToSave =
         tm().transact(
                 () ->
-                    tm().loadByKeys(getTokenKeys()).values().stream()
+                    tm().loadByKeys(getTokenKeys(tokens, prefix)).values().stream()
                         .collect(toImmutableMap(Function.identity(), this::updateToken))
                         .entrySet()
                         .stream()

core/src/main/java/google/registry/tools/UpdateOrDeleteAllocationTokensCommand.java

@@ -16,14 +16,15 @@ package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
-import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 
 import com.beust.jcommander.Parameter;
-import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableList;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.persistence.VKey;
 import java.util.List;
+import javax.annotation.Nullable;
 
 /** Shared base class for commands to update or delete allocation tokens. */
 abstract class UpdateOrDeleteAllocationTokensCommand extends ConfirmingCommand {
@@ -47,19 +48,20 @@ abstract class UpdateOrDeleteAllocationTokensCommand extends ConfirmingCommand {
       description = "Do not actually update or delete the tokens; defaults to false")
   protected boolean dryRun;
 
-  protected ImmutableSet<VKey<AllocationToken>> getTokenKeys() {
+  public static ImmutableList<VKey<AllocationToken>> getTokenKeys(
+      @Nullable List<String> tokens, @Nullable String prefix) {
     checkArgument(
         tokens == null ^ prefix == null,
         "Must provide one of --tokens or --prefix, not both / neither");
     if (tokens != null) {
-      ImmutableSet<VKey<AllocationToken>> keys =
+      ImmutableList<VKey<AllocationToken>> keys =
           tokens.stream()
               .map(token -> VKey.create(AllocationToken.class, token))
-              .collect(toImmutableSet());
-      ImmutableSet<VKey<AllocationToken>> nonexistentKeys =
+              .collect(toImmutableList());
+      ImmutableList<VKey<AllocationToken>> nonexistentKeys =
           tm().transact(
-                  () -> keys.stream().filter(key -> !tm().exists(key)).collect(toImmutableSet()));
-      checkState(nonexistentKeys.isEmpty(), "Tokens with keys %s did not exist.", nonexistentKeys);
+                  () -> keys.stream().filter(key -> !tm().exists(key)).collect(toImmutableList()));
+      checkState(nonexistentKeys.isEmpty(), "Tokens with keys %s did not exist", nonexistentKeys);
       return keys;
     } else {
       checkArgument(!prefix.isEmpty(), "Provided prefix should not be blank");
@@ -68,7 +70,7 @@ abstract class UpdateOrDeleteAllocationTokensCommand extends ConfirmingCommand {
                   tm().loadAllOf(AllocationToken.class).stream()
                       .filter(token -> token.getToken().startsWith(prefix))
                       .map(AllocationToken::createVKey)
-                      .collect(toImmutableSet()));
+                      .collect(toImmutableList()));
     }
   }
 }

core/src/main/resources/google/registry/beam/expand_recurring_billing_events_pipeline_metadata.json

@@ -0,0 +1,51 @@
+{
+  "name": "Expand Recurring Billings Events for Implicit Auto-Renewals",
+  "description": "An Apache Beam batch pipeline that finds all auto-renewals that have implicitly occurred between the given window and creates the corresponding billing events and hisotry entries.",
+  "parameters": [
+    {
+      "name": "registryEnvironment",
+      "label": "The Registry environment.",
+      "helpText": "The Registry environment.",
+      "is_optional": false,
+      "regexes": [
+        "^PRODUCTION|SANDBOX|CRASH|QA|ALPHA$"
+      ]
+    },
+    {
+      "name": "startTime",
+      "label": "The inclusive lower bound of the operation window.",
+      "helpText": "The inclusive lower bound of the operation window, in ISO 8601 format.",
+      "is_optional": false
+    },
+    {
+      "name": "endTime",
+      "label": "The exclusive upper bound of the operation window.",
+      "helpText": "The exclusive upper bound of the operation window, in ISO 8601 format.",
+      "is_optional": false
+    },
+    {
+      "name": "shard",
+      "label": "The exclusive upper bound of the operation window.",
+      "helpText": "The exclusive upper bound of the operation window, in ISO 8601 format.",
+      "is_optional": true
+    },
+    {
+      "name": "isDryRun",
+      "label": "Whether this job is a dry run.",
+      "helpText": "If true, no changes will be saved to the database.",
+      "is_optional": true,
+      "regexes": [
+        "^true|false$"
+      ]
+    },
+    {
+      "name": "advanceCursor",
+      "label": "Whether the BILLING_TIME global cursor should be advanced.",
+      "helpText": "If true, after all expansions are persisted, the cursor will be changed from startTime to endTime.",
+      "is_optional": true,
+      "regexes": [
+        "^true|false$"
+      ]
+    }
+  ]
+}

core/src/test/java/google/registry/beam/billing/BillingEventTest.java

@@ -12,12 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.beam.invoicing;
+package google.registry.beam.billing;
 
 import static com.google.common.truth.Truth.assertThat;
 
-import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey;
-import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
+import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey;
+import google.registry.beam.billing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;

core/src/test/java/google/registry/beam/billing/ExpandRecurringBillingEventsPipelineTest.java

@@ -0,0 +1,549 @@
+// Copyright 2022 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.beam.billing;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.EppResourceUtils.loadByForeignKey;
+import static google.registry.model.ImmutableObjectSubject.immutableObjectCorrespondence;
+import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
+import static google.registry.model.domain.Period.Unit.YEARS;
+import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
+import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_CREATE;
+import static google.registry.model.reporting.HistoryEntryDao.loadHistoryObjectsForResource;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.testing.DatabaseHelper.assertBillingEventsForResource;
+import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.getOnlyHistoryEntryOfType;
+import static google.registry.testing.DatabaseHelper.persistActiveDomain;
+import static google.registry.testing.DatabaseHelper.persistPremiumList;
+import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static org.joda.money.CurrencyUnit.USD;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import google.registry.beam.TestPipelineExtension;
+import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingEvent.Flag;
+import google.registry.model.billing.BillingEvent.OneTime;
+import google.registry.model.billing.BillingEvent.Reason;
+import google.registry.model.billing.BillingEvent.Recurring;
+import google.registry.model.common.Cursor;
+import google.registry.model.domain.Domain;
+import google.registry.model.domain.DomainHistory;
+import google.registry.model.domain.Period;
+import google.registry.model.reporting.DomainTransactionRecord;
+import google.registry.model.reporting.DomainTransactionRecord.TransactionReportField;
+import google.registry.model.tld.Registry;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
+import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
+import google.registry.testing.FakeClock;
+import java.util.Arrays;
+import java.util.Comparator;
+import java.util.List;
+import org.apache.beam.runners.direct.DirectOptions;
+import org.apache.beam.sdk.Pipeline.PipelineExecutionException;
+import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.hibernate.cfg.AvailableSettings;
+import org.joda.money.Money;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+import org.joda.time.format.DateTimeFormat;
+import org.joda.time.format.DateTimeFormatter;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+/** Unit tests for {@link ExpandRecurringBillingEventsPipeline}. */
+public class ExpandRecurringBillingEventsPipelineTest {
+
+  private static final DateTimeFormatter DATE_TIME_FORMATTER =
+      DateTimeFormat.forPattern("yyyy-MM-dd'T'HH:mm:ss.SSSZ");
+
+  private final FakeClock clock = new FakeClock(DateTime.parse("2021-02-02T00:00:05Z"));
+
+  private final DateTime startTime = DateTime.parse("2021-02-01TZ");
+
+  private DateTime endTime = DateTime.parse("2021-02-02TZ");
+
+  private final Cursor cursor = Cursor.createGlobal(RECURRING_BILLING, startTime);
+
+  private Domain domain;
+
+  private Recurring recurring;
+
+  private final TestOptions options = PipelineOptionsFactory.create().as(TestOptions.class);
+
+  @RegisterExtension
+  final JpaIntegrationTestExtension jpa =
+      new JpaTestExtensions.Builder()
+          .withClock(clock)
+          .withProperty(
+              AvailableSettings.ISOLATION,
+              TransactionIsolationLevel.TRANSACTION_SERIALIZABLE.name())
+          .buildIntegrationTestExtension();
+
+  @RegisterExtension
+  final TestPipelineExtension pipeline =
+      TestPipelineExtension.create().enableAbandonedNodeEnforcement(true);
+
+  @BeforeEach
+  void beforeEach() {
+    // Set up the pipeline.
+    options.setStartTime(DATE_TIME_FORMATTER.print(startTime));
+    options.setEndTime(DATE_TIME_FORMATTER.print(endTime));
+    options.setIsDryRun(false);
+    options.setAdvanceCursor(true);
+    tm().transact(() -> tm().put(cursor));
+
+    // Set up the database.
+    createTld("tld");
+    recurring = createDomainAtTime("example.tld", startTime.minusYears(1).plusHours(12));
+    domain = loadByForeignKey(Domain.class, "example.tld", clock.nowUtc()).get();
+  }
+
+  @Test
+  void testFailure_endTimeAfterNow() {
+    options.setEndTime(DATE_TIME_FORMATTER.print(clock.nowUtc().plusMillis(1)));
+    IllegalArgumentException thrown =
+        assertThrows(IllegalArgumentException.class, this::runPipeline);
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("End time 2021-02-02T00:00:05.001Z must be on or before now");
+  }
+
+  @Test
+  void testFailure_endTimeBeforeStartTime() {
+    options.setEndTime(DATE_TIME_FORMATTER.print(startTime.minusMillis(1)));
+    IllegalArgumentException thrown =
+        assertThrows(IllegalArgumentException.class, this::runPipeline);
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("[2021-02-01T00:00:00.000Z, 2021-01-31T23:59:59.999Z)");
+  }
+
+  @Test
+  void testSuccess_expandSingleEvent() {
+    runPipeline();
+
+    // Assert about DomainHistory.
+    assertAutoRenewDomainHistories(defaultDomainHistory());
+
+    // Assert about BillingEvents.
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(getOnlyAutoRenewHistory()),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(1))
+            .build());
+
+    // Assert about Cursor.
+    assertCursorAt(endTime);
+  }
+
+  @Test
+  void testSuccess_expandSingleEvent_deletedDuringGracePeriod() {
+    domain = persistResource(domain.asBuilder().setDeletionTime(endTime.minusHours(2)).build());
+    recurring =
+        persistResource(recurring.asBuilder().setRecurrenceEndTime(endTime.minusHours(2)).build());
+    runPipeline();
+
+    // Assert about DomainHistory, no transaction record should have been written.
+    assertAutoRenewDomainHistories(
+        defaultDomainHistory().asBuilder().setDomainTransactionRecords(ImmutableSet.of()).build());
+
+    // Assert about BillingEvents.
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(getOnlyAutoRenewHistory()),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(1))
+            .build());
+
+    // Assert about Cursor.
+    assertCursorAt(endTime);
+  }
+
+  @Test
+  void testFailure_expandSingleEvent_cursorNotAtStartTime() {
+    tm().transact(() -> tm().put(Cursor.createGlobal(RECURRING_BILLING, startTime.plusMillis(1))));
+
+    PipelineExecutionException thrown =
+        assertThrows(PipelineExecutionException.class, this::runPipeline);
+
+    assertThat(thrown).hasCauseThat().hasMessageThat().contains("Current cursor position");
+
+    // Assert about DomainHistory.
+    assertAutoRenewDomainHistories(defaultDomainHistory());
+
+    // Assert about BillingEvents.
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(getOnlyAutoRenewHistory()),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(1))
+            .build());
+
+    // Assert that the cursor did not change.
+    assertCursorAt(startTime.plusMillis(1));
+  }
+
+  @Test
+  void testSuccess_noExpansion_recurrenceClosedBeforeEventTime() {
+    recurring =
+        persistResource(
+            recurring
+                .asBuilder()
+                .setRecurrenceEndTime(recurring.getEventTime().minusDays(1))
+                .build());
+    runPipeline();
+    assertNoExpansionsHappened();
+  }
+
+  @Test
+  void testSuccess_noExpansion_recurrenceClosedBeforeStartTime() {
+    recurring =
+        persistResource(recurring.asBuilder().setRecurrenceEndTime(startTime.minusDays(1)).build());
+    runPipeline();
+    assertNoExpansionsHappened();
+  }
+
+  @Test
+  void testSuccess_noExpansion_recurrenceClosedBeforeNextExpansion() {
+    recurring =
+        persistResource(
+            recurring
+                .asBuilder()
+                .setEventTime(recurring.getEventTime().minusYears(1))
+                .setRecurrenceEndTime(startTime.plusHours(6))
+                .build());
+    runPipeline();
+    assertNoExpansionsHappened();
+  }
+
+  @Test
+  void testSuccess_noExpansion_eventTimeAfterEndTime() {
+    recurring = persistResource(recurring.asBuilder().setEventTime(endTime.plusDays(1)).build());
+    runPipeline();
+    assertNoExpansionsHappened();
+  }
+
+  @Test
+  void testSuccess_noExpansion_LastExpansionLessThanAYearAgo() {
+    recurring =
+        persistResource(
+            recurring
+                .asBuilder()
+                .setRecurrenceLastExpansion(startTime.minusYears(1).plusDays(1))
+                .build());
+    runPipeline();
+    assertNoExpansionsHappened();
+  }
+
+  @Test
+  void testSuccess_noExpansion_oneTimeAlreadyExists() {
+    DomainHistory history = persistResource(defaultDomainHistory());
+    OneTime oneTime = persistResource(defaultOneTime(history));
+    runPipeline();
+
+    // Assert about DomainHistory.
+    assertAutoRenewDomainHistories(history);
+
+    // Assert about BillingEvents. No expansion happened, so last recurrence expansion time is
+    // unchanged.
+    assertBillingEventsForResource(domain, oneTime, recurring);
+
+    // Assert about Cursor.
+    assertCursorAt(endTime);
+  }
+
+  @Test
+  void testSuccess_expandSingleEvent_dryRun() {
+    options.setIsDryRun(true);
+    runPipeline();
+    assertNoExpansionsHappened(true);
+  }
+
+  @Test
+  void testSuccess_expandSingleEvent_doesNotAdvanceCursor() {
+    options.setAdvanceCursor(false);
+
+    runPipeline();
+    // Assert about DomainHistory.
+    assertAutoRenewDomainHistories(defaultDomainHistory());
+
+    // Assert about BillingEvents.
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(getOnlyAutoRenewHistory()),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(1))
+            .build());
+
+    // Assert that the cursor did not move.
+    assertCursorAt(startTime);
+  }
+
+  // We control the number of threads used in the pipeline to test if the batching behavior works
+  // properly. When two threads are used, the two recurrings are processed in different workers and
+  // should be processed in parallel.
+  @ParameterizedTest
+  @ValueSource(ints = {1, 2})
+  void testSuccess_expandMultipleEvents_multipleDomains(int numOfThreads) {
+    createTld("test");
+    persistResource(
+        Registry.get("test")
+            .asBuilder()
+            .setPremiumList(persistPremiumList("premium", USD, "other,USD 100"))
+            .build());
+    DateTime otherCreateTime = startTime.minusYears(1).plusHours(5);
+    Recurring otherRecurring = createDomainAtTime("other.test", otherCreateTime);
+    Domain otherDomain = loadByForeignKey(Domain.class, "other.test", clock.nowUtc()).get();
+
+    options.setTargetParallelism(numOfThreads);
+    runPipeline();
+
+    // Assert about DomainHistory.
+    DomainHistory history = defaultDomainHistory();
+    DomainHistory otherHistory = defaultDomainHistory(otherDomain);
+    assertAutoRenewDomainHistories(domain, history);
+    assertAutoRenewDomainHistories(otherDomain, otherHistory);
+
+    // Assert about BillingEvents.
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(getOnlyAutoRenewHistory()),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(1))
+            .build());
+    assertBillingEventsForResource(
+        otherDomain,
+        defaultOneTime(otherDomain, getOnlyAutoRenewHistory(otherDomain), otherRecurring, 100),
+        otherRecurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(otherDomain.getCreationTime().plusYears(1))
+            .build());
+
+    // Assert about Cursor.
+    assertCursorAt(endTime);
+  }
+
+  @Test
+  void testSuccess_expandMultipleEvents_multipleEventTime() {
+    clock.advanceBy(Duration.standardDays(365));
+    endTime = endTime.plusYears(1);
+    options.setEndTime(DATE_TIME_FORMATTER.print(endTime));
+
+    runPipeline();
+    // Assert about DomainHistory.
+    assertAutoRenewDomainHistories(
+        defaultDomainHistory(),
+        defaultDomainHistory()
+            .asBuilder()
+            .setDomainTransactionRecords(
+                ImmutableSet.of(
+                    DomainTransactionRecord.create(
+                        domain.getTld(),
+                        // We report this when the autorenew grace period ends.
+                        domain
+                            .getCreationTime()
+                            .plusYears(2)
+                            .plus(Registry.DEFAULT_AUTO_RENEW_GRACE_PERIOD),
+                        TransactionReportField.netRenewsFieldFromYears(1),
+                        1)))
+            .build());
+
+    // Assert about BillingEvents.
+    ImmutableList<DomainHistory> histories =
+        loadHistoryObjectsForResource(domain.createVKey(), DomainHistory.class).stream()
+            .filter(domainHistory -> DOMAIN_AUTORENEW.equals(domainHistory.getType()))
+            .sorted(
+                Comparator.comparing(
+                    h ->
+                        h.getDomainTransactionRecords().stream()
+                            .findFirst()
+                            .get()
+                            .getReportingTime()))
+            .collect(toImmutableList());
+    assertBillingEventsForResource(
+        domain,
+        defaultOneTime(histories.get(0)),
+        defaultOneTime(histories.get(1))
+            .asBuilder()
+            .setEventTime(domain.getCreationTime().plusYears(2))
+            .setBillingTime(
+                domain
+                    .getCreationTime()
+                    .plusYears(2)
+                    .plus(Registry.DEFAULT_AUTO_RENEW_GRACE_PERIOD))
+            .build(),
+        recurring
+            .asBuilder()
+            .setRecurrenceLastExpansion(domain.getCreationTime().plusYears(2))
+            .build());
+
+    // Assert about Cursor.
+    assertCursorAt(endTime);
+  }
+
+  private void runPipeline() {
+    ExpandRecurringBillingEventsPipeline expandRecurringBillingEventsPipeline =
+        new ExpandRecurringBillingEventsPipeline(options, clock);
+    expandRecurringBillingEventsPipeline.setupPipeline(pipeline);
+    pipeline.run(options).waitUntilFinish();
+  }
+
+  void assertNoExpansionsHappened() {
+    assertNoExpansionsHappened(false);
+  }
+
+  void assertNoExpansionsHappened(boolean dryRun) {
+    // Only the original domain create history entry is present.
+    List<DomainHistory> persistedHistory =
+        loadHistoryObjectsForResource(domain.createVKey(), DomainHistory.class);
+    assertThat(persistedHistory.size()).isEqualTo(1);
+    assertThat(persistedHistory.get(0).getType()).isEqualTo(DOMAIN_CREATE);
+
+    // Only the original recurrence is present.
+    assertBillingEventsForResource(domain, recurring);
+
+    // If this is not a dry run, the cursor should still be moved even though expansions happened,
+    // because we still successfully processed all the needed expansions (none in this case) in the
+    // window. Therefore,
+    // the cursor should be up-to-date as of end time.
+    assertCursorAt(dryRun ? startTime : endTime);
+  }
+
+  private DomainHistory defaultDomainHistory() {
+    return defaultDomainHistory(domain);
+  }
+
+  private DomainHistory defaultDomainHistory(Domain domain) {
+    return new DomainHistory.Builder()
+        .setBySuperuser(false)
+        .setRegistrarId("TheRegistrar")
+        .setModificationTime(clock.nowUtc())
+        .setDomain(domain)
+        .setPeriod(Period.create(1, YEARS))
+        .setReason("Domain autorenewal by ExpandRecurringBillingEventsPipeline")
+        .setRequestedByRegistrar(false)
+        .setType(DOMAIN_AUTORENEW)
+        .setDomainTransactionRecords(
+            ImmutableSet.of(
+                DomainTransactionRecord.create(
+                    domain.getTld(),
+                    // We report this when the autorenew grace period ends.
+                    domain
+                        .getCreationTime()
+                        .plusYears(1)
+                        .plus(Registry.DEFAULT_AUTO_RENEW_GRACE_PERIOD),
+                    TransactionReportField.netRenewsFieldFromYears(1),
+                    1)))
+        .build();
+  }
+
+  private OneTime defaultOneTime(DomainHistory history) {
+    return defaultOneTime(domain, history, recurring, 11);
+  }
+
+  private OneTime defaultOneTime(
+      Domain domain, DomainHistory history, Recurring recurring, int cost) {
+    return new BillingEvent.OneTime.Builder()
+        .setBillingTime(
+            domain.getCreationTime().plusYears(1).plus(Registry.DEFAULT_AUTO_RENEW_GRACE_PERIOD))
+        .setRegistrarId("TheRegistrar")
+        .setCost(Money.of(USD, cost))
+        .setEventTime(domain.getCreationTime().plusYears(1))
+        .setFlags(ImmutableSet.of(Flag.AUTO_RENEW, Flag.SYNTHETIC))
+        .setPeriodYears(1)
+        .setReason(Reason.RENEW)
+        .setSyntheticCreationTime(endTime)
+        .setCancellationMatchingBillingEvent(recurring)
+        .setTargetId(domain.getDomainName())
+        .setDomainHistory(history)
+        .build();
+  }
+
+  private void assertAutoRenewDomainHistories(DomainHistory... expected) {
+    assertAutoRenewDomainHistories(domain, expected);
+  }
+
+  private static void assertAutoRenewDomainHistories(Domain domain, DomainHistory... expected) {
+    ImmutableList<DomainHistory> actuals =
+        loadHistoryObjectsForResource(domain.createVKey(), DomainHistory.class).stream()
+            .filter(domainHistory -> DOMAIN_AUTORENEW.equals(domainHistory.getType()))
+            .collect(toImmutableList());
+    assertThat(actuals)
+        .comparingElementsUsing(immutableObjectCorrespondence("resource", "revisionId"))
+        .containsExactlyElementsIn(Arrays.asList(expected));
+    assertThat(
+            actuals.stream()
+                .map(history -> history.getDomainBase().get())
+                .collect(toImmutableList()))
+        .comparingElementsUsing(immutableObjectCorrespondence("nsHosts", "updateTimestamp"))
+        .containsExactlyElementsIn(
+            Arrays.stream(expected)
+                .map(history -> history.getDomainBase().get())
+                .collect(toImmutableList()));
+  }
+
+  private static DomainHistory getOnlyAutoRenewHistory(Domain domain) {
+    return getOnlyHistoryEntryOfType(domain, DOMAIN_AUTORENEW, DomainHistory.class);
+  }
+
+  private DomainHistory getOnlyAutoRenewHistory() {
+    return getOnlyAutoRenewHistory(domain);
+  }
+
+  private static void assertCursorAt(DateTime expectedCursorTime) {
+    Cursor cursor = tm().transact(() -> tm().loadByKey(Cursor.createGlobalVKey(RECURRING_BILLING)));
+    assertThat(cursor).isNotNull();
+    assertThat(cursor.getCursorTime()).isEqualTo(expectedCursorTime);
+  }
+
+  private static Recurring createDomainAtTime(String domainName, DateTime createTime) {
+    Domain domain = persistActiveDomain(domainName, createTime);
+    DomainHistory domainHistory =
+        persistResource(
+            new DomainHistory.Builder()
+                .setRegistrarId(domain.getCreationRegistrarId())
+                .setType(DOMAIN_CREATE)
+                .setModificationTime(createTime)
+                .setDomain(domain)
+                .build());
+    return persistResource(
+        new Recurring.Builder()
+            .setDomainHistory(domainHistory)
+            .setRegistrarId(domain.getCreationRegistrarId())
+            .setEventTime(createTime.plusYears(1))
+            .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+            .setReason(Reason.RENEW)
+            .setRecurrenceEndTime(END_OF_TIME)
+            .setTargetId(domain.getDomainName())
+            .build());
+  }
+
+  public interface TestOptions extends ExpandRecurringBillingEventsPipelineOptions, DirectOptions {}
+}

core/src/test/java/google/registry/beam/billing/InvoicingPipelineTest.java

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package google.registry.beam.invoicing;
+package google.registry.beam.billing;
 
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.truth.Truth.assertThat;

core/src/test/java/google/registry/beam/resave/ResaveAllEppResourcesPipelineTest.java

@@ -36,12 +36,14 @@ import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.eppcommon.StatusValue;
+import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
 import google.registry.testing.FakeClock;
 import org.apache.beam.sdk.options.PipelineOptionsFactory;
+import org.hibernate.cfg.Environment;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
 import org.junit.jupiter.api.BeforeEach;
@@ -60,7 +62,11 @@ public class ResaveAllEppResourcesPipelineTest {
 
   @RegisterExtension
   final JpaIntegrationTestExtension database =
-      new JpaTestExtensions.Builder().withClock(fakeClock).buildIntegrationTestExtension();
+      new JpaTestExtensions.Builder()
+          .withClock(fakeClock)
+          .withProperty(
+              Environment.ISOLATION, TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ.name())
+          .buildIntegrationTestExtension();
 
   private final ResaveAllEppResourcesPipelineOptions options =
       PipelineOptionsFactory.create().as(ResaveAllEppResourcesPipelineOptions.class);

core/src/test/java/google/registry/flows/domain/DomainTransferApproveFlowTest.java

@@ -302,6 +302,8 @@ class DomainTransferApproveFlowTest
                     getGainingClientAutorenewEvent()
                         .asBuilder()
                         .setEventTime(domain.getRegistrationExpirationTime())
+                        .setRecurrenceLastExpansion(
+                            domain.getRegistrationExpirationTime().minusYears(1))
                         .setDomainHistory(historyEntryTransferApproved)
                         .build()))
             .toArray(BillingEvent[]::new));
@@ -338,6 +340,8 @@ class DomainTransferApproveFlowTest
                     getGainingClientAutorenewEvent()
                         .asBuilder()
                         .setEventTime(domain.getRegistrationExpirationTime())
+                        .setRecurrenceLastExpansion(
+                            domain.getRegistrationExpirationTime().minusYears(1))
                         .setDomainHistory(historyEntryTransferApproved)
                         .build()))
             .toArray(BillingEvent[]::new));
@@ -835,7 +839,7 @@ class DomainTransferApproveFlowTest
         "tld",
         "domain_transfer_approve.xml",
         "domain_transfer_approve_response_zero_period.xml",
-        domain.getRegistrationExpirationTime().plusYears(0));
+        domain.getRegistrationExpirationTime());
     assertHistoryEntriesDoNotContainTransferBillingEventsOrGracePeriods();
   }
 

core/src/test/java/google/registry/flows/domain/DomainTransferRequestFlowTest.java

@@ -296,7 +296,11 @@ class DomainTransferRequestFlowTest
             .setRecurrenceEndTime(implicitTransferTime)
             .build();
     BillingEvent.Recurring gainingClientAutorenew =
-        getGainingClientAutorenewEvent().asBuilder().setEventTime(expectedExpirationTime).build();
+        getGainingClientAutorenewEvent()
+            .asBuilder()
+            .setEventTime(expectedExpirationTime)
+            .setRecurrenceLastExpansion(expectedExpirationTime.minusYears(1))
+            .build();
     // Construct extra billing events expected by the specific test.
     ImmutableSet<BillingEvent> extraBillingEvents =
         Stream.of(extraExpectedBillingEvents)

core/src/test/java/google/registry/model/billing/BillingEventTest.java

@@ -774,6 +774,7 @@ public class BillingEventTest extends EntityTestCase {
                     .setRecurrenceEndTime(END_OF_TIME)));
     assertThat(recurringEvent.getRenewalPriceBehavior()).isEqualTo(RenewalPriceBehavior.SPECIFIED);
     assertThat(recurringEvent.getRenewalPrice()).hasValue(Money.of(USD, 100));
+    assertThat(recurringEvent.getRecurrenceLastExpansion()).isEqualTo(now);
   }
 
   @Test

core/src/test/java/google/registry/persistence/transaction/JpaTestExtensions.java

@@ -147,7 +147,7 @@ public class JpaTestExtensions {
     }
 
     /** Adds the specified property to those used to initialize the transaction manager. */
-    Builder withProperty(String name, String value) {
+    public Builder withProperty(String name, String value) {
       this.userProperties.put(name, value);
       return this;
     }

core/src/test/java/google/registry/reporting/billing/GenerateInvoicesActionTest.java

@@ -168,4 +168,28 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
                 + " terminating invoicing pipeline");
     cloudTasksHelper.assertNoTasksEnqueued("beam-reporting");
   }
+
+  @Test
+  void testSucceedsToGenerateInvoicesFirstDayOfTheYear() throws Exception {
+    persistResource(Cursor.createGlobal(RECURRING_BILLING, DateTime.parse("2017-01-01T13:15:00Z")));
+    action =
+        new GenerateInvoicesAction(
+            "test-project",
+            "test-region",
+            "staging_bucket",
+            "billing_bucket",
+            "REG-INV",
+            false,
+            new YearMonth(2016, 12),
+            emailUtils,
+            cloudTasksUtils,
+            clock,
+            response,
+            dataflow);
+    action.run();
+    assertThat(response.getContentType()).isEqualTo(MediaType.PLAIN_TEXT_UTF_8);
+    assertThat(response.getStatus()).isEqualTo(SC_OK);
+    assertThat(response.getPayload()).isEqualTo("Launched invoicing pipeline: jobid");
+    cloudTasksHelper.assertNoTasksEnqueued("beam-reporting");
+  }
 }

core/src/test/java/google/registry/tools/CreateTldCommandTest.java

@@ -16,11 +16,13 @@ package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Registry.TldState.PREDELEGATION;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistReservedList;
+import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static java.math.BigDecimal.ROUND_UNNECESSARY;
 import static org.joda.money.CurrencyUnit.JPY;
@@ -32,6 +34,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Range;
+import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.tld.Registry;
 import java.math.BigDecimal;
 import org.joda.money.Money;
@@ -568,6 +571,68 @@ class CreateTldCommandTest extends CommandTestCase<CreateTldCommand> {
         .contains("Invalid DNS writer name(s) specified: [Deadbeef, Invalid]");
   }
 
+  @Test
+  void testSuccess_defaultToken() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    runCommandForced(
+        "--default_tokens=abc123",
+        "--roid_suffix=Q9JYB4C",
+        "--dns_writers=FooDnsWriter",
+        "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey());
+  }
+
+  @Test
+  void testSuccess_multipleDefaultTokens() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    AllocationToken token2 =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("token")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    runCommandForced(
+        "--default_tokens=abc123,token",
+        "--roid_suffix=Q9JYB4C",
+        "--dns_writers=FooDnsWriter",
+        "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey(), token2.createVKey());
+  }
+
+  @Test
+  void testFailure_specifiedDefaultToken_doesntExist() {
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class,
+            () ->
+                runCommandForced(
+                    "xn--q9jyb4c",
+                    "--default_tokens=InvalidToken",
+                    "--roid_suffix=Q9JYB4C",
+                    "--dns_writers=FooDnsWriter"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("Tokens with keys [VKey<AllocationToken>(sql:InvalidToken)] did not exist");
+  }
+
   private void runSuccessfulReservedListsTest(String reservedLists) throws Exception {
     runCommandForced(
         "--reserved_lists",

core/src/test/java/google/registry/tools/RequestFactoryModuleTest.java

@@ -16,6 +16,8 @@ package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.tools.RequestFactoryModule.REQUEST_TIMEOUT_MS;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
@@ -25,9 +27,15 @@ import com.google.api.client.http.GenericUrl;
 import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpRequestFactory;
 import com.google.api.client.http.HttpRequestInitializer;
+import com.google.api.client.http.HttpResponse;
+import com.google.api.client.http.HttpTransport;
+import com.google.api.client.json.gson.GsonFactory;
+import com.google.api.client.util.GenericData;
+import com.google.auth.oauth2.UserCredentials;
 import google.registry.config.RegistryConfig;
 import google.registry.testing.SystemPropertyExtension;
 import google.registry.util.GoogleCredentialsBundle;
+import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -57,7 +65,7 @@ public class RequestFactoryModuleTest {
     RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = true;
     try {
       HttpRequestFactory factory =
-          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle);
+          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, Optional.empty());
       HttpRequestInitializer initializer = factory.getInitializer();
       assertThat(initializer).isNotNull();
       HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
@@ -76,7 +84,7 @@ public class RequestFactoryModuleTest {
     RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = false;
     try {
       HttpRequestFactory factory =
-          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle);
+          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, Optional.empty());
       HttpRequestInitializer initializer = factory.getInitializer();
       assertThat(initializer).isNotNull();
       // HttpRequestFactory#buildGetRequest() calls initialize() once.
@@ -89,4 +97,38 @@ public class RequestFactoryModuleTest {
       RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = origIsLocal;
     }
   }
+
+  @Test
+  void test_provideHttpRequestFactory_remote_withIap() throws Exception {
+    // Mock the request/response to/from the IAP server requesting an ID token
+    UserCredentials mockUserCredentials = mock(UserCredentials.class);
+    when(credentialsBundle.getGoogleCredentials()).thenReturn(mockUserCredentials);
+    HttpTransport mockTransport = mock(HttpTransport.class);
+    when(credentialsBundle.getHttpTransport()).thenReturn(mockTransport);
+    when(credentialsBundle.getJsonFactory()).thenReturn(GsonFactory.getDefaultInstance());
+    HttpRequestFactory mockRequestFactory = mock(HttpRequestFactory.class);
+    when(mockTransport.createRequestFactory()).thenReturn(mockRequestFactory);
+    HttpRequest mockPostRequest = mock(HttpRequest.class);
+    when(mockRequestFactory.buildPostRequest(any(), any())).thenReturn(mockPostRequest);
+    HttpResponse mockResponse = mock(HttpResponse.class);
+    when(mockPostRequest.execute()).thenReturn(mockResponse);
+    GenericData genericDataResponse = new GenericData();
+    genericDataResponse.set("id_token", "iapIdToken");
+    when(mockResponse.parseAs(GenericData.class)).thenReturn(genericDataResponse);
+
+    boolean origIsLocal = RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal;
+    RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = false;
+    try {
+      HttpRequestFactory factory =
+          RequestFactoryModule.provideHttpRequestFactory(
+              credentialsBundle, Optional.of("iapClientId"));
+      HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
+      assertThat(request.getHeaders().getAuthorization()).isEqualTo("Bearer iapIdToken");
+      assertThat(request.getConnectTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
+      assertThat(request.getReadTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
+      verifyNoMoreInteractions(httpRequestInitializer);
+    } finally {
+      RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = origIsLocal;
+    }
+  }
 }

core/src/test/java/google/registry/tools/UpdateTldCommandTest.java

@@ -16,6 +16,7 @@ package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.tld.Registry.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Registry.TldState.PREDELEGATION;
 import static google.registry.model.tld.Registry.TldState.QUIET_PERIOD;
@@ -33,8 +34,10 @@ import static org.joda.time.Duration.standardMinutes;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.beust.jcommander.ParameterException;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
+import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.tld.Registry;
 import java.util.Optional;
 import org.joda.money.Money;
@@ -174,6 +177,118 @@ class UpdateTldCommandTest extends CommandTestCase<UpdateTldCommand> {
         .containsExactly("FooDnsWriter", "VoidDnsWriter");
   }
 
+  @Test
+  void testSuccess_defaultToken() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens()).isEmpty();
+    runCommandForced("--default_tokens=abc123", "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey());
+  }
+
+  @Test
+  void testSuccess_multipleDefaultTokens() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    AllocationToken token2 =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("token")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens()).isEmpty();
+    runCommandForced("--default_tokens=abc123,token", "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey(), token2.createVKey());
+  }
+
+  @Test
+  void testSuccess_emptyTokenList() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens()).isEmpty();
+    persistResource(
+        Registry.get("xn--q9jyb4c")
+            .asBuilder()
+            .setDefaultPromoTokens(ImmutableList.of(token.createVKey()))
+            .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey());
+    runCommandForced("--default_tokens=", "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens()).isEmpty();
+  }
+
+  @Test
+  void testSuccess_replaceExistingDefaultTokensListOrder() throws Exception {
+    AllocationToken token =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("abc123")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    AllocationToken token2 =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("token")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    AllocationToken token3 =
+        persistResource(
+            new AllocationToken()
+                .asBuilder()
+                .setToken("othertoken")
+                .setTokenType(DEFAULT_PROMO)
+                .setAllowedTlds(ImmutableSet.of("xn--q9jyb4c"))
+                .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens()).isEmpty();
+    persistResource(
+        Registry.get("xn--q9jyb4c")
+            .asBuilder()
+            .setDefaultPromoTokens(ImmutableList.of(token.createVKey(), token2.createVKey()))
+            .build());
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token.createVKey(), token2.createVKey());
+    runCommandForced("--default_tokens=token,othertoken", "xn--q9jyb4c");
+    assertThat(Registry.get("xn--q9jyb4c").getDefaultPromoTokens())
+        .containsExactly(token2.createVKey(), token3.createVKey());
+  }
+
+  @Test
+  void testFailure_specifiedDefaultToken_doesntExist() {
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class,
+            () -> runCommandForced("xn--q9jyb4c", "--default_tokens=InvalidToken"));
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("Tokens with keys [VKey<AllocationToken>(sql:InvalidToken)] did not exist");
+  }
+
   @Test
   void testSuccess_escrow() throws Exception {
     runCommandForced("--escrow=true", "xn--q9jyb4c");

db/src/main/resources/sql/schema/db-schema.sql.generated

@@ -76,6 +76,7 @@
         reason text not null,
         domain_name text not null,
         recurrence_end_time timestamptz,
+        recurrence_last_expansion timestamptz not null,
         recurrence_time_of_year text,
         renewal_price_amount numeric(19, 2),
         renewal_price_currency text,
@@ -774,6 +775,7 @@ create index IDXd3gxhkh0jk694pjvh9pyn7wjc on "BillingRecurrence" (registrar_id);
 create index IDX6syykou4nkc7hqa5p8r92cpch on "BillingRecurrence" (event_time);
 create index IDXoqttafcywwdn41um6kwlt0n8b on "BillingRecurrence" (domain_repo_id);
 create index IDXp3usbtvk0v1m14i5tdp4xnxgc on "BillingRecurrence" (recurrence_end_time);
+create index IDXp0pxi708hlu4n40qhbtihge8x on "BillingRecurrence" (recurrence_last_expansion);
 create index IDXjny8wuot75b5e6p38r47wdawu on "BillingRecurrence" (recurrence_time_of_year);
 create index IDX3y752kr9uh4kh6uig54vemx0l on "Contact" (creation_time);
 create index IDXtm415d6fe1rr35stm33s5mg18 on "Contact" (current_sponsor_registrar_id);

dependencies.gradle

@@ -225,6 +225,8 @@ ext {
       'org.mockito:mockito-junit-jupiter:[3.7.7,)',
       'org.mortbay.jetty:jetty:[6.1.26,)',
       'org.postgresql:postgresql:[42.2.18,)',
+      'org.eclipse.jetty:jetty-server:[9.4.49.v20220914,)',
+      'org.eclipse.jetty:jetty-servlet:[9.4.49.v20220914,)',
       'org.slf4j:slf4j-jdk14:[1.7.28,)',
       'org.testcontainers:jdbc:[1.15.2,)',
       'org.testcontainers:junit-jupiter:[1.15.2,)',

docs/gradle.lockfile

@@ -298,6 +298,13 @@ org.codehaus.jackson:jackson-mapper-asl:1.9.13=default,deploy_jar,runtimeClasspa
 org.codehaus.mojo:animal-sniffer-annotations:1.17=annotationProcessor,errorprone,testAnnotationProcessor
 org.codehaus.mojo:animal-sniffer-annotations:1.22=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=default,deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=default,deploy_jar,runtimeClasspath,testRuntimeClasspath

release/cloudbuild-nomulus.yaml

@@ -90,8 +90,10 @@ steps:
       ${PROJECT_ID} \
       google.registry.beam.spec11.Spec11Pipeline \
       google/registry/beam/spec11_pipeline_metadata.json \
-      google.registry.beam.invoicing.InvoicingPipeline \
+      google.registry.beam.billing.InvoicingPipeline \
       google/registry/beam/invoicing_pipeline_metadata.json \
+      google.registry.beam.billing.ExpandRecurringBillingEventsPipeline \
+      google/registry/beam/expand_recurring_billing_events_pipeline_metadata.json \
       google.registry.beam.rde.RdePipeline \
       google/registry/beam/rde_pipeline_metadata.json \
       google.registry.beam.resave.ResaveAllEppResourcesPipeline \

services/backend/gradle.lockfile

@@ -268,6 +268,13 @@ org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,default,runtimeCla
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.22=default,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

services/default/gradle.lockfile

@@ -268,6 +268,13 @@ org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,default,runtimeCla
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.22=default,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

services/pubapi/gradle.lockfile

@@ -268,6 +268,13 @@ org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,default,runtimeCla
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.22=default,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

services/tools/gradle.lockfile

@@ -268,6 +268,13 @@ org.codehaus.jackson:jackson-core-asl:1.9.13=compileClasspath,default,runtimeCla
 org.codehaus.jackson:jackson-mapper-asl:1.9.13=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.codehaus.mojo:animal-sniffer-annotations:1.22=default,runtimeClasspath,testRuntimeClasspath
 org.conscrypt:conscrypt-openjdk-uber:2.5.2=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-security:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-server:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-servlet:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util-ajax:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:9.4.49.v20220914=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.flywaydb:flyway-core:9.10.0=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:jaxb-runtime:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.glassfish.jaxb:txw2:2.3.1=compileClasspath,default,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

settings.gradle

@@ -46,3 +46,4 @@ include 'services:backend'
 include 'services:tools'
 include 'services:pubapi'
 include 'java8compatibility'
+include "console-webapp"