Add an IDN helper (#2217)

* Add an IDN helper

Add a helper that checks the validity of labels in IDNs.
All organizes TLDs according to the IDNs they support.

core/src/main/java/google/registry/bsa/IdnChecker.java

@@ -0,0 +1,108 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.common.collect.Maps.transformValues;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableMultimap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Sets;
+import com.google.common.collect.Sets.SetView;
+import google.registry.model.tld.Tld;
+import google.registry.model.tld.Tld.TldType;
+import google.registry.model.tld.Tlds;
+import google.registry.tldconfig.idn.IdnLabelValidator;
+import google.registry.tldconfig.idn.IdnTableEnum;
+import google.registry.util.Clock;
+import javax.inject.Inject;
+import org.joda.time.DateTime;
+
+/**
+ * Checks labels' validity wrt Idns in TLDs enrolled with BSA.
+ *
+ * <p>Each instance takes a snapshot of the TLDs at instantiation time, and should be limited to the
+ * Request scope.
+ */
+public class IdnChecker {
+  private static final IdnLabelValidator IDN_LABEL_VALIDATOR = new IdnLabelValidator();
+
+  private final ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> idnToTlds;
+  private final ImmutableSet<Tld> allTlds;
+
+  @Inject
+  IdnChecker(Clock clock) {
+    this.idnToTlds = getIdnToTldMap(clock.nowUtc());
+    allTlds = idnToTlds.values().stream().flatMap(ImmutableSet::stream).collect(toImmutableSet());
+  }
+
+  // TODO(11/30/2023): Remove below when new Tld schema is deployed and the `getBsaEnrollStartTime`
+  // method is no longer hardcoded.
+  @VisibleForTesting
+  IdnChecker(ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> idnToTlds) {
+    this.idnToTlds = idnToTlds;
+    allTlds = idnToTlds.values().stream().flatMap(ImmutableSet::stream).collect(toImmutableSet());
+  }
+
+  /** Returns all IDNs in which the {@code label} is valid. */
+  ImmutableSet<IdnTableEnum> getAllValidIdns(String label) {
+    return idnToTlds.keySet().stream()
+        .filter(idnTable -> idnTable.getTable().isValidLabel(label))
+        .collect(toImmutableSet());
+  }
+
+  /**
+   * Returns the TLDs that support at least one IDN in the {@code idnTables}.
+   *
+   * @param idnTables String names of {@link IdnTableEnum} values
+   */
+  public ImmutableSet<Tld> getSupportingTlds(ImmutableSet<String> idnTables) {
+    return idnTables.stream()
+        .map(IdnTableEnum::valueOf)
+        .filter(idnToTlds::containsKey)
+        .map(idnToTlds::get)
+        .flatMap(ImmutableSet::stream)
+        .collect(toImmutableSet());
+  }
+
+  /**
+   * Returns the TLDs that do not support any IDN in the {@code idnTables}.
+   *
+   * @param idnTables String names of {@link IdnTableEnum} values
+   */
+  public SetView<Tld> getForbiddingTlds(ImmutableSet<String> idnTables) {
+    return Sets.difference(allTlds, getSupportingTlds(idnTables));
+  }
+
+  private static boolean isEnrolledWithBsa(Tld tld, DateTime now) {
+    DateTime enrollTime = tld.getBsaEnrollStartTime();
+    return enrollTime != null && enrollTime.isBefore(now);
+  }
+
+  private static ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> getIdnToTldMap(DateTime now) {
+    ImmutableMultimap.Builder<IdnTableEnum, Tld> idnToTldMap = new ImmutableMultimap.Builder();
+    Tlds.getTldEntitiesOfType(TldType.REAL).stream()
+        .filter(tld -> isEnrolledWithBsa(tld, now))
+        .forEach(
+            tld -> {
+              for (IdnTableEnum idn : IDN_LABEL_VALIDATOR.getIdnTablesForTld(tld)) {
+                idnToTldMap.put(idn, tld);
+              }
+            });
+    return ImmutableMap.copyOf(transformValues(idnToTldMap.build().asMap(), ImmutableSet::copyOf));
+  }
+}

core/src/main/java/google/registry/env/production/backend/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <basic-scaling>

core/src/main/java/google/registry/env/production/default/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <manual-scaling>

core/src/main/java/google/registry/env/production/pubapi/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <manual-scaling>

core/src/main/java/google/registry/env/production/tools/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <basic-scaling>

core/src/main/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>backend</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4</instance-class>
   <basic-scaling>

core/src/main/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>default</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <manual-scaling>

core/src/main/java/google/registry/env/sandbox/pubapi/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>pubapi</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4_1G</instance-class>
   <manual-scaling>

core/src/main/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
 
-  <runtime>java17</runtime>
+  <runtime>java8</runtime>
   <service>tools</service>
-  <app-engine-apis>true</app-engine-apis>
+  <!--app-engine-apis>true</app-engine-apis-->
+  <threadsafe>true</threadsafe>
   <sessions-enabled>true</sessions-enabled>
   <instance-class>B4</instance-class>
   <basic-scaling>

core/src/main/java/google/registry/request/Response.java

@@ -15,6 +15,7 @@
 package google.registry.request;
 
 import com.google.common.net.MediaType;
+import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletResponse;
 import org.joda.time.DateTime;
 
@@ -51,4 +52,11 @@ public interface Response {
    * @see HttpServletResponse#setDateHeader(String, long)
    */
   void setDateHeader(String header, DateTime timestamp);
+
+  /**
+   * Adds a cookie to the response
+   *
+   * @see HttpServletResponse#addCookie(Cookie)
+   */
+  void addCookie(Cookie cookie);
 }

core/src/main/java/google/registry/request/ResponseImpl.java

@@ -17,6 +17,7 @@ package google.registry.request;
 import com.google.common.net.MediaType;
 import java.io.IOException;
 import javax.inject.Inject;
+import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletResponse;
 import org.joda.time.DateTime;
 
@@ -58,4 +59,9 @@ public final class ResponseImpl implements Response {
   public void setDateHeader(String header, DateTime timestamp) {
     rsp.setDateHeader(header, timestamp.getMillis());
   }
+
+  @Override
+  public void addCookie(Cookie cookie) {
+    rsp.addCookie(cookie);
+  }
 }

core/src/main/java/google/registry/security/XsrfTokenManager.java

@@ -34,7 +34,7 @@ import org.joda.time.Duration;
 /** Helper class for generating and validate XSRF tokens. */
 public final class XsrfTokenManager {
 
-  /** HTTP header used for transmitting XSRF tokens. */
+  /** HTTP header or cookie name used for transmitting XSRF tokens. */
   public static final String X_CSRF_TOKEN = "X-CSRF-Token";
 
   /** POST parameter used for transmitting XSRF tokens. */

core/src/main/java/google/registry/tldconfig/idn/IdnLabelValidator.java

@@ -38,9 +38,7 @@ public final class IdnLabelValidator {
   public Optional<String> findValidIdnTableForTld(String label, String tldStr) {
     String unicodeString = Idn.toUnicode(label);
     Tld tld = Tld.get(tldStr); // uses the cache
-    ImmutableSet<IdnTableEnum> idnTablesForTld = tld.getIdnTables();
-    ImmutableSet<IdnTableEnum> idnTables =
-        idnTablesForTld.isEmpty() ? DEFAULT_IDN_TABLES : idnTablesForTld;
+    ImmutableSet<IdnTableEnum> idnTables = getIdnTablesForTld(tld);
     for (IdnTableEnum idnTable : idnTables) {
       if (idnTable.getTable().isValidLabel(unicodeString)) {
         return Optional.of(idnTable.getTable().getName());
@@ -48,4 +46,10 @@ public final class IdnLabelValidator {
     }
     return Optional.empty();
   }
+
+  /** Returns the names of the IDN tables supported by a {@code tld}. */
+  public ImmutableSet<IdnTableEnum> getIdnTablesForTld(Tld tld) {
+    ImmutableSet<IdnTableEnum> idnTablesForTld = tld.getIdnTables();
+    return idnTablesForTld.isEmpty() ? DEFAULT_IDN_TABLES : idnTablesForTld;
+  }
 }

core/src/main/java/google/registry/tldconfig/idn/IdnTable.java

@@ -84,7 +84,7 @@ public final class IdnTable {
    * Returns true if the given label is valid for this IDN table. A label is considered valid if all
    * of its codepoints are in the IDN table.
    */
-  boolean isValidLabel(String label) {
+  public boolean isValidLabel(String label) {
     final int length = label.length();
     for (int i = 0; i < length; ) {
       int codepoint = label.codePointAt(i);

core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java

@@ -0,0 +1,72 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server.console;
+
+import static google.registry.request.Action.Method.GET;
+
+import com.google.api.client.http.HttpStatusCodes;
+import google.registry.model.console.User;
+import google.registry.security.XsrfTokenManager;
+import google.registry.ui.server.registrar.ConsoleApiParams;
+import java.util.Arrays;
+import java.util.Optional;
+import javax.servlet.http.Cookie;
+
+/** Base class for handling Console API requests */
+public abstract class ConsoleApiAction implements Runnable {
+  protected ConsoleApiParams consoleApiParams;
+
+  public ConsoleApiAction(ConsoleApiParams consoleApiParams) {
+    this.consoleApiParams = consoleApiParams;
+  }
+
+  @Override
+  public final void run() {
+    // Shouldn't be even possible because of Auth annotations on the various implementing classes
+    if (!consoleApiParams.authResult().userAuthInfo().get().consoleUser().isPresent()) {
+      consoleApiParams.response().setStatus(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED);
+      return;
+    }
+    User user = consoleApiParams.authResult().userAuthInfo().get().consoleUser().get();
+    if (consoleApiParams.request().getMethod().equals(GET.toString())) {
+      getHandler(user);
+    } else {
+      if (verifyXSRF()) {
+        postHandler(user);
+      }
+    }
+  }
+
+  protected void postHandler(User user) {
+    throw new UnsupportedOperationException("Console API POST handler not implemented");
+  }
+
+  protected void getHandler(User user) {
+    throw new UnsupportedOperationException("Console API GET handler not implemented");
+  }
+
+  private boolean verifyXSRF() {
+    Optional<Cookie> maybeCookie =
+        Arrays.stream(consoleApiParams.request().getCookies())
+            .filter(c -> XsrfTokenManager.X_CSRF_TOKEN.equals(c.getName()))
+            .findFirst();
+    if (!maybeCookie.isPresent()
+        || !consoleApiParams.xsrfTokenManager().validateToken(maybeCookie.get().getValue())) {
+      consoleApiParams.response().setStatus(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED);
+      return false;
+    }
+    return true;
+  }
+}

core/src/main/java/google/registry/ui/server/console/ConsoleUserDataAction.java

@@ -21,12 +21,10 @@ import com.google.common.collect.ImmutableMap;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.User;
 import google.registry.request.Action;
-import google.registry.request.Response;
 import google.registry.request.auth.Auth;
-import google.registry.request.auth.AuthResult;
-import google.registry.request.auth.UserAuthInfo;
-import google.registry.ui.server.registrar.JsonGetAction;
+import google.registry.ui.server.registrar.ConsoleApiParams;
 import javax.inject.Inject;
+import javax.servlet.http.Cookie;
 import org.json.JSONObject;
 
 @Action(
@@ -34,12 +32,10 @@ import org.json.JSONObject;
     path = ConsoleUserDataAction.PATH,
     method = {GET},
     auth = Auth.AUTH_PUBLIC_LOGGED_IN)
-public class ConsoleUserDataAction implements JsonGetAction {
+public class ConsoleUserDataAction extends ConsoleApiAction {
 
   public static final String PATH = "/console-api/userdata";
 
-  private final AuthResult authResult;
-  private final Response response;
   private final String productName;
   private final String supportPhoneNumber;
   private final String supportEmail;
@@ -47,14 +43,12 @@ public class ConsoleUserDataAction implements JsonGetAction {
 
   @Inject
   public ConsoleUserDataAction(
-      AuthResult authResult,
-      Response response,
+      ConsoleApiParams consoleApiParams,
       @Config("productName") String productName,
       @Config("supportEmail") String supportEmail,
       @Config("supportPhoneNumber") String supportPhoneNumber,
       @Config("technicalDocsUrl") String technicalDocsUrl) {
-    this.response = response;
-    this.authResult = authResult;
+    super(consoleApiParams);
     this.productName = productName;
     this.supportEmail = supportEmail;
     this.supportPhoneNumber = supportPhoneNumber;
@@ -62,13 +56,15 @@ public class ConsoleUserDataAction implements JsonGetAction {
   }
 
   @Override
-  public void run() {
-    UserAuthInfo authInfo = authResult.userAuthInfo().get();
-    if (!authInfo.consoleUser().isPresent()) {
-      response.setStatus(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED);
-      return;
-    }
-    User user = authInfo.consoleUser().get();
+  protected void getHandler(User user) {
+    // As this is a first GET request we use it as an opportunity to set a XSRF cookie
+    // for angular to read - https://angular.io/guide/http-security-xsrf-protection
+    Cookie xsrfCookie =
+        new Cookie(
+            consoleApiParams.xsrfTokenManager().X_CSRF_TOKEN,
+            consoleApiParams.xsrfTokenManager().generateToken(user.getEmailAddress()));
+    xsrfCookie.setSecure(true);
+    consoleApiParams.response().addCookie(xsrfCookie);
 
     JSONObject json =
         new JSONObject(
@@ -90,7 +86,7 @@ public class ConsoleUserDataAction implements JsonGetAction {
                 // Is used by UI to construct a link to registry resources
                 "technicalDocsUrl", technicalDocsUrl));
 
-    response.setPayload(json.toString());
-    response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
+    consoleApiParams.response().setPayload(json.toString());
+    consoleApiParams.response().setStatus(HttpStatusCodes.STATUS_CODE_OK);
   }
 }

core/src/main/java/google/registry/ui/server/registrar/ConsoleApiParams.java

@@ -0,0 +1,41 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server.registrar;
+
+import com.google.auto.value.AutoValue;
+import google.registry.request.Response;
+import google.registry.request.auth.AuthResult;
+import google.registry.security.XsrfTokenManager;
+import javax.servlet.http.HttpServletRequest;
+
+/** Groups necessary dependencies for Console API actions * */
+@AutoValue
+public abstract class ConsoleApiParams {
+  public static ConsoleApiParams create(
+      HttpServletRequest request,
+      Response response,
+      AuthResult authResult,
+      XsrfTokenManager xsrfTokenManager) {
+    return new AutoValue_ConsoleApiParams(request, response, authResult, xsrfTokenManager);
+  }
+
+  public abstract HttpServletRequest request();
+
+  public abstract Response response();
+
+  public abstract AuthResult authResult();
+
+  public abstract XsrfTokenManager xsrfTokenManager();
+}

core/src/main/java/google/registry/ui/server/registrar/RegistrarConsoleModule.java

@@ -28,6 +28,10 @@ import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.OptionalJsonPayload;
 import google.registry.request.Parameter;
+import google.registry.request.RequestScope;
+import google.registry.request.Response;
+import google.registry.request.auth.AuthResult;
+import google.registry.security.XsrfTokenManager;
 import java.util.Optional;
 import javax.servlet.http.HttpServletRequest;
 import org.joda.time.DateTime;
@@ -35,9 +39,18 @@ import org.joda.time.DateTime;
 /** Dagger module for the Registrar Console parameters. */
 @Module
 public final class RegistrarConsoleModule {
-
   static final String PARAM_CLIENT_ID = "clientId";
 
+  @Provides
+  @RequestScope
+  ConsoleApiParams provideConsoleApiParams(
+      HttpServletRequest request,
+      Response response,
+      AuthResult authResult,
+      XsrfTokenManager xsrfTokenManager) {
+    return ConsoleApiParams.create(request, response, authResult, xsrfTokenManager);
+  }
+
   @Provides
   @Parameter(PARAM_CLIENT_ID)
   static Optional<String> provideOptionalClientId(HttpServletRequest req) {

core/src/test/java/google/registry/bsa/IdnCheckerTest.java

@@ -0,0 +1,94 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.tldconfig.idn.IdnTableEnum.EXTENDED_LATIN;
+import static google.registry.tldconfig.idn.IdnTableEnum.JA;
+import static google.registry.tldconfig.idn.IdnTableEnum.UNCONFUSABLE_LATIN;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import google.registry.model.tld.Tld;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+public class IdnCheckerTest {
+
+  @Mock Tld jaonly;
+  @Mock Tld jandelatin;
+  @Mock Tld strictlatin;
+  IdnChecker idnChecker;
+
+  @BeforeEach
+  void setup() {
+    idnChecker =
+        new IdnChecker(
+            ImmutableMap.of(
+                JA,
+                ImmutableSet.of(jandelatin, jaonly),
+                EXTENDED_LATIN,
+                ImmutableSet.of(jandelatin),
+                UNCONFUSABLE_LATIN,
+                ImmutableSet.of(strictlatin)));
+  }
+
+  @Test
+  void getAllValidIdns_allTlds() {
+    assertThat(idnChecker.getAllValidIdns("all"))
+        .containsExactly(EXTENDED_LATIN, JA, UNCONFUSABLE_LATIN);
+  }
+
+  @Test
+  void getAllValidIdns_notJa() {
+    assertThat(idnChecker.getAllValidIdns("à")).containsExactly(EXTENDED_LATIN, UNCONFUSABLE_LATIN);
+  }
+
+  @Test
+  void getAllValidIdns_extendedLatinOnly() {
+    assertThat(idnChecker.getAllValidIdns("á")).containsExactly(EXTENDED_LATIN);
+  }
+
+  @Test
+  void getAllValidIdns_jaOnly() {
+    assertThat(idnChecker.getAllValidIdns("っ")).containsExactly(JA);
+  }
+
+  @Test
+  void getAllValidIdns_none() {
+    assertThat(idnChecker.getAllValidIdns("д")).isEmpty();
+  }
+
+  @Test
+  void getSupportingTlds_singleTld_success() {
+    assertThat(idnChecker.getSupportingTlds(ImmutableSet.of("EXTENDED_LATIN")))
+        .containsExactly(jandelatin);
+  }
+
+  @Test
+  void getSupportingTlds_multiTld_success() {
+    assertThat(idnChecker.getSupportingTlds(ImmutableSet.of("JA")))
+        .containsExactly(jandelatin, jaonly);
+  }
+
+  @Test
+  void getForbiddingTlds_success() {
+    assertThat(idnChecker.getForbiddingTlds(ImmutableSet.of("JA"))).containsExactly(strictlatin);
+  }
+}

core/src/test/java/google/registry/testing/FakeConsoleApiParams.java

@@ -0,0 +1,46 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.testing;
+
+import static org.mockito.Mockito.mock;
+
+import com.google.appengine.api.users.UserService;
+import google.registry.request.auth.AuthResult;
+import google.registry.request.auth.UserAuthInfo;
+import google.registry.security.XsrfTokenManager;
+import google.registry.ui.server.registrar.ConsoleApiParams;
+import java.util.Optional;
+import javax.servlet.http.HttpServletRequest;
+import org.joda.time.DateTime;
+
+public final class FakeConsoleApiParams {
+
+  public static ConsoleApiParams get(Optional<AuthResult> maybeAuthResult) {
+    AuthResult authResult =
+        maybeAuthResult.orElseGet(
+            () ->
+                AuthResult.createUser(
+                    UserAuthInfo.create(
+                        new com.google.appengine.api.users.User(
+                            "JohnDoe@theregistrar.com", "theregistrar.com"),
+                        false)));
+    return ConsoleApiParams.create(
+        mock(HttpServletRequest.class),
+        new FakeResponse(),
+        authResult,
+        new XsrfTokenManager(
+            new FakeClock(DateTime.parse("2020-02-02T01:23:45Z")), mock(UserService.class)));
+  }
+}

core/src/test/java/google/registry/testing/FakeResponse.java

@@ -22,8 +22,10 @@ import static java.util.Collections.unmodifiableMap;
 import com.google.common.base.Throwables;
 import com.google.common.net.MediaType;
 import google.registry.request.Response;
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Map;
+import javax.servlet.http.Cookie;
 import org.joda.time.DateTime;
 
 /** Fake implementation of {@link Response} for testing. */
@@ -36,6 +38,8 @@ public final class FakeResponse implements Response {
   private boolean wasMutuallyExclusiveResponseSet;
   private String lastResponseStackTrace;
 
+  private ArrayList<Cookie> cookies = new ArrayList<>();
+
   public int getStatus() {
     return status;
   }
@@ -83,6 +87,15 @@ public final class FakeResponse implements Response {
     headers.put(checkNotNull(header), checkNotNull(timestamp));
   }
 
+  @Override
+  public void addCookie(Cookie cookie) {
+    cookies.add(cookie);
+  }
+
+  public ArrayList<Cookie> getCookies() {
+    return cookies;
+  }
+
   private void checkResponsePerformedOnce() {
     checkState(
         !wasMutuallyExclusiveResponseSet,

core/src/test/java/google/registry/tldconfig/idn/IdnLabelValidatorTest.java

@@ -14,11 +14,14 @@
 
 package google.registry.tldconfig.idn;
 
+import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistResource;
 
 import com.google.common.collect.ImmutableSet;
+import google.registry.model.tld.Tld;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import org.junit.jupiter.api.Test;
@@ -118,4 +121,24 @@ class IdnLabelValidatorTest {
     // Extended Latin shouldn't include Japanese characters
     assertThat(idnLabelValidator.findValidIdnTableForTld("みんな", "tld")).isEmpty();
   }
+
+  @Test
+  void testGetIdnTablesForTld_custom() {
+    persistResource(
+        createTld("tld")
+            .asBuilder()
+            .setIdnTables(ImmutableSet.of(IdnTableEnum.EXTENDED_LATIN))
+            .build());
+    Tld tld = tm().transact(() -> tm().loadByKey(Tld.createVKey("tld")));
+    assertThat(idnLabelValidator.getIdnTablesForTld(tld))
+        .containsExactly(IdnTableEnum.EXTENDED_LATIN);
+  }
+
+  @Test
+  void testGetIdnTablesForTld_default() {
+    persistResource(createTld("tld").asBuilder().build());
+    Tld tld = tm().transact(() -> tm().loadByKey(Tld.createVKey("tld")));
+    assertThat(idnLabelValidator.getIdnTablesForTld(tld))
+        .containsExactly(IdnTableEnum.EXTENDED_LATIN, IdnTableEnum.JA);
+  }
 }

core/src/test/java/google/registry/ui/server/ActionMembershipTest.java

@@ -19,6 +19,7 @@ import static com.google.common.truth.Truth.assertWithMessage;
 import com.google.common.collect.ImmutableSet;
 import google.registry.request.Action;
 import google.registry.request.JsonActionRunner;
+import google.registry.ui.server.console.ConsoleApiAction;
 import google.registry.ui.server.registrar.HtmlAction;
 import google.registry.ui.server.registrar.JsonGetAction;
 import io.github.classgraph.ClassGraph;
@@ -34,6 +35,7 @@ final class ActionMembershipTest {
     // 1. Extending HtmlAction to signal that we are serving an HTML page
     // 2. Extending JsonAction to show that we are serving JSON POST requests
     // 3. Extending JsonGetAction to serve JSON GET requests
+    // 4. Extending ConsoleApiAction to serve JSON requests
     ImmutableSet.Builder<String> failingClasses = new ImmutableSet.Builder<>();
     try (ScanResult scanResult =
         new ClassGraph().enableAnnotationInfo().whitelistPackages("google.registry.ui").scan()) {
@@ -41,7 +43,8 @@ final class ActionMembershipTest {
           .getClassesWithAnnotation(Action.class.getName())
           .forEach(
               classInfo -> {
-                if (!classInfo.extendsSuperclass(HtmlAction.class.getName())
+                if (!classInfo.extendsSuperclass(ConsoleApiAction.class.getName())
+                    && !classInfo.extendsSuperclass(HtmlAction.class.getName())
                     && !classInfo.implementsInterface(JsonActionRunner.JsonAction.class.getName())
                     && !classInfo.implementsInterface(JsonGetAction.class.getName())) {
                   failingClasses.add(classInfo.getName());

core/src/test/java/google/registry/ui/server/console/ConsoleUserDataActionTest.java

@@ -14,7 +14,9 @@
 
 package google.registry.ui.server.console;
 
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.truth.Truth.assertThat;
+import static org.mockito.Mockito.when;
 
 import com.google.api.client.http.HttpStatusCodes;
 import com.google.gson.Gson;
@@ -22,12 +24,18 @@ import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.request.Action;
 import google.registry.request.RequestModule;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.UserAuthInfo;
+import google.registry.testing.FakeConsoleApiParams;
 import google.registry.testing.FakeResponse;
+import google.registry.ui.server.registrar.ConsoleApiParams;
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.Map;
+import java.util.Optional;
+import javax.servlet.http.Cookie;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 
@@ -35,12 +43,31 @@ import org.junit.jupiter.api.extension.RegisterExtension;
 class ConsoleUserDataActionTest {
 
   private static final Gson GSON = RequestModule.provideGson();
-  private FakeResponse response = new FakeResponse();
+
+  private ConsoleApiParams consoleApiParams;
 
   @RegisterExtension
   final JpaTestExtensions.JpaIntegrationTestExtension jpa =
       new JpaTestExtensions.Builder().buildIntegrationTestExtension();
 
+  @Test
+  void testSuccess_hasXSRFCookie() throws IOException {
+    User user =
+        new User.Builder()
+            .setEmailAddress("email@email.com")
+            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
+            .build();
+
+    AuthResult authResult = AuthResult.createUser(UserAuthInfo.create(user));
+    ConsoleUserDataAction action =
+        createAction(
+            Optional.of(FakeConsoleApiParams.get(Optional.of(authResult))), Action.Method.GET);
+    action.run();
+    ArrayList<Cookie> cookies = ((FakeResponse) consoleApiParams.response()).getCookies();
+    assertThat(cookies.stream().map(cookie -> cookie.getName()).collect(toImmutableList()))
+        .containsExactly("X-CSRF-Token");
+  }
+
   @Test
   void testSuccess_getContactInfo() throws IOException {
     User user =
@@ -49,10 +76,15 @@ class ConsoleUserDataActionTest {
             .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
             .build();
 
-    ConsoleUserDataAction action = createAction(AuthResult.createUser(UserAuthInfo.create(user)));
+    AuthResult authResult = AuthResult.createUser(UserAuthInfo.create(user));
+    ConsoleUserDataAction action =
+        createAction(
+            Optional.of(FakeConsoleApiParams.get(Optional.of(authResult))), Action.Method.GET);
     action.run();
-    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
-    Map jsonObject = GSON.fromJson(response.getPayload(), Map.class);
+    assertThat(((FakeResponse) consoleApiParams.response()).getStatus())
+        .isEqualTo(HttpStatusCodes.STATUS_CODE_OK);
+    Map jsonObject =
+        GSON.fromJson(((FakeResponse) consoleApiParams.response()).getPayload(), Map.class);
     assertThat(jsonObject)
         .containsExactly(
             "isAdmin",
@@ -71,19 +103,18 @@ class ConsoleUserDataActionTest {
 
   @Test
   void testFailure_notAConsoleUser() throws IOException {
-    ConsoleUserDataAction action =
-        createAction(
-            AuthResult.createUser(
-                UserAuthInfo.create(
-                    new com.google.appengine.api.users.User(
-                        "JohnDoe@theregistrar.com", "theregistrar.com"),
-                    false)));
+    ConsoleUserDataAction action = createAction(Optional.empty(), Action.Method.GET);
     action.run();
-    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED);
+    assertThat(((FakeResponse) consoleApiParams.response()).getStatus())
+        .isEqualTo(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED);
   }
 
-  private ConsoleUserDataAction createAction(AuthResult authResult) throws IOException {
+  private ConsoleUserDataAction createAction(
+      Optional<ConsoleApiParams> maybeConsoleApiParams, Action.Method method) throws IOException {
+    consoleApiParams =
+        maybeConsoleApiParams.orElseGet(() -> FakeConsoleApiParams.get(Optional.empty()));
+    when(consoleApiParams.request().getMethod()).thenReturn(method.toString());
     return new ConsoleUserDataAction(
-        authResult, response, "Nomulus", "support@example.com", "+1 (212) 867 5309", "test");
+        consoleApiParams, "Nomulus", "support@example.com", "+1 (212) 867 5309", "test");
   }
 }