Make all contacts nullable in the data model (#2490)

This doesn't yet allow them to be absent in EPP flows, but it should make the
code not break if they happen to be null in the database. This is a follow-up to
PR #2477, which ends up being a bit easier because whereas the registrant is
used in more parts of the codebase, the other contact types (admin, technical,
billing) are really only used in RDE, WHOIS, and RDAP, and because they were
already being used as a collection anyway, the handling for if that collection
contains fewer elements or is empty happened to already be mostly correct.

console-webapp/src/app/domains/domainList.component.ts

@@ -60,8 +60,9 @@ export class DomainListComponent {
     effect(() => {
       this.pageNumber = 0;
       this.totalResults = 0;
-      this.reloadData();
-      this.registrarService.registrarId();
+      if (this.registrarService.registrarId()) {
+        this.reloadData();
+      }
     });
   }
 

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -466,13 +466,10 @@ public class RdePipeline implements Serializable {
                               // Contacts and hosts are only deposited in RDE, not BRDA.
                               if (pendingDeposit.mode() == RdeMode.FULL) {
                                 HashSet<Serializable> contacts = new HashSet<>();
-                                contacts.add(domain.getAdminContact().getKey());
-                                contacts.add(domain.getTechContact().getKey());
-                                contacts.add(domain.getRegistrant().getKey());
-                                // Billing contact is not mandatory.
-                                if (domain.getBillingContact() != null) {
-                                  contacts.add(domain.getBillingContact().getKey());
-                                }
+                                domain.getAdminContact().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getTechContact().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getRegistrant().ifPresent(c -> contacts.add(c.getKey()));
+                                domain.getBillingContact().ifPresent(c -> contacts.add(c.getKey()));
                                 referencedContactCounter.inc(contacts.size());
                                 contacts.forEach(
                                     contactRepoId ->

core/src/main/java/google/registry/env/common/default/WEB-INF/cloud-tasks-queue.xml

@@ -96,6 +96,14 @@
     <max-retry-duration>3600s</max-retry-duration>
   </queue>
 
+  <!-- Queue for tasks that update membership in the console user group. -->
+  <queue>
+    <name>console-user-group-update</name>
+    <max-dispatches-per-second>1</max-dispatches-per-second>
+    <max-concurrent-dispatches>1</max-concurrent-dispatches>
+    <max-retry-duration>3600s</max-retry-duration>
+  </queue>
+
   <!-- Queue for infrequent cron tasks (i.e. hourly or less often) that should retry three times on failure. -->
   <queue>
     <name>retryable-cron-tasks</name>

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -412,11 +412,13 @@ public class DomainFlowUtils {
 
   /** Verify that no linked resources have disallowed statuses. */
   static void verifyNotInPendingDelete(
-      Set<DesignatedContact> contacts, VKey<Contact> registrant, Set<VKey<Host>> nameservers)
+      Set<DesignatedContact> contacts,
+      Optional<VKey<Contact>> registrant,
+      Set<VKey<Host>> nameservers)
       throws EppException {
     ImmutableList.Builder<VKey<? extends EppResource>> keysToLoad = new ImmutableList.Builder<>();
     contacts.stream().map(DesignatedContact::getContactKey).forEach(keysToLoad::add);
-    Optional.ofNullable(registrant).ifPresent(keysToLoad::add);
+    registrant.ifPresent(keysToLoad::add);
     keysToLoad.addAll(nameservers);
     verifyNotInPendingDelete(EppResource.loadCached(keysToLoad.build()).values());
   }
@@ -480,9 +482,10 @@ public class DomainFlowUtils {
   }
 
   static void validateRequiredContactsPresent(
-      @Nullable VKey<Contact> registrant, Set<DesignatedContact> contacts)
+      Optional<VKey<Contact>> registrant, Set<DesignatedContact> contacts)
       throws RequiredParameterMissingException {
-    if (registrant == null) {
+    // TODO: Check minimum reg data set migration schedule here and don't throw when any are empty.
+    if (registrant.isEmpty()) {
       throw new MissingRegistrantException();
     }
 
@@ -498,14 +501,14 @@ public class DomainFlowUtils {
     }
   }
 
-  static void validateRegistrantAllowedOnTld(String tld, String registrantContactId)
+  static void validateRegistrantAllowedOnTld(String tld, Optional<String> registrantContactId)
       throws RegistrantNotAllowedException {
     ImmutableSet<String> allowedRegistrants = Tld.get(tld).getAllowedRegistrantContactIds();
     // Empty allow list or null registrantContactId are ignored.
-    if (registrantContactId != null
+    if (registrantContactId.isPresent()
         && !allowedRegistrants.isEmpty()
-        && !allowedRegistrants.contains(registrantContactId)) {
-      throw new RegistrantNotAllowedException(registrantContactId);
+        && !allowedRegistrants.contains(registrantContactId.get())) {
+      throw new RegistrantNotAllowedException(registrantContactId.get());
     }
   }
 

core/src/main/java/google/registry/flows/domain/DomainInfoFlow.java

@@ -119,8 +119,11 @@ public final class DomainInfoFlow implements TransactionalFlow {
             .setCreationTime(domain.getCreationTime())
             .setLastEppUpdateTime(domain.getLastEppUpdateTime())
             .setRegistrationExpirationTime(domain.getRegistrationExpirationTime())
-            .setLastTransferTime(domain.getLastTransferTime())
-            .setRegistrant(tm().loadByKey(domain.getRegistrant()).getContactId());
+            .setLastTransferTime(domain.getLastTransferTime());
+    domain
+        .getRegistrant()
+        .ifPresent(r -> infoBuilder.setRegistrant(tm().loadByKey(r).getContactId()));
+
     // If authInfo is non-null, then the caller is authorized to see the full information since we
     // will have already verified the authInfo is valid.
     if (registrarId.equals(domain.getCurrentSponsorRegistrarId()) || authInfo.isPresent()) {

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -85,6 +85,15 @@ public final class DomainPricingLogic {
       createFee = Fee.create(zeroInCurrency(currency), FeeType.CREATE, false);
     } else {
       DomainPrices domainPrices = getPricesForDomainName(domainName, dateTime);
+      if (allocationToken.isPresent()
+          && allocationToken
+              .get()
+              .getRegistrationBehavior()
+              .equals(RegistrationBehavior.NONPREMIUM_CREATE)) {
+        domainPrices =
+            DomainPrices.create(
+                false, tld.getCreateBillingCost(dateTime), domainPrices.getRenewCost());
+      }
       Money domainCreateCost =
           getDomainCreateCostWithDiscount(domainPrices, years, allocationToken);
       // Apply a sunrise discount if configured and applicable

core/src/main/java/google/registry/flows/domain/DomainUpdateFlow.java

@@ -278,7 +278,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
             .removeStatusValues(remove.getStatusValues())
             .removeContacts(remove.getContacts())
             .addContacts(add.getContacts())
-            .setRegistrant(firstNonNull(change.getRegistrant(), domain.getRegistrant()))
+            .setRegistrant(change.getRegistrant().or(domain::getRegistrant))
             .setAuthInfo(firstNonNull(change.getAuthInfo(), domain.getAuthInfo()));
 
     if (!add.getNameservers().isEmpty()) {
@@ -301,7 +301,10 @@ public final class DomainUpdateFlow implements MutatingFlow {
   }
 
   private static void validateRegistrantIsntBeingRemoved(Change change) throws EppException {
-    if (change.getRegistrantContactId() != null && change.getRegistrantContactId().isEmpty()) {
+    // TODO(mcilwain): Make this check the minimum registration data set migration schedule
+    //                 and not require presence of a registrant in later stages.
+    if (change.getRegistrantContactId().isPresent()
+        && change.getRegistrantContactId().get().isEmpty()) {
       throw new MissingRegistrantException();
     }
   }

core/src/main/java/google/registry/model/OteAccountBuilder.java

@@ -17,6 +17,7 @@ package google.registry.model;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.toImmutableList;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
@@ -28,19 +29,28 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
+import google.registry.batch.CloudTasksUtils;
+import google.registry.model.console.RegistrarRole;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
+import google.registry.model.console.UserRoles;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
-import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldState;
 import google.registry.model.tld.Tld.TldType;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumListDao;
 import google.registry.persistence.VKey;
+import google.registry.tools.IamClient;
 import google.registry.util.CidrAddressBlock;
 import google.registry.util.RegistryEnvironment;
+import java.util.ArrayList;
 import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.function.Function;
 import java.util.regex.Pattern;
@@ -75,8 +85,8 @@ public final class OteAccountBuilder {
    * Validation regex for registrar base client IDs (3-14 lowercase alphanumeric characters).
    *
    * <p>The base client ID is appended with numbers to create four different test registrar accounts
-   * (e.g. reg-1, reg-3, reg-4, reg-5). Registrar client IDs are of type clIDType in eppcom.xsd
-   * which is limited to 16 characters, hence the limit of 14 here to account for the dash and
+   * (e.g., reg-1, reg-3, reg-4, reg-5). Registrar client IDs are of type clIDType in eppcom.xsd
+   * that is limited to 16 characters, hence the limit of 14 here to account for the dash and
    * numbers.
    *
    * <p>The base client ID is also used to generate the OT&E TLDs, hence the restriction to
@@ -113,7 +123,7 @@ public final class OteAccountBuilder {
    * The default billing account map applied to all OT&amp;E registrars.
    *
    * <p>This contains dummy values for USD and JPY so that OT&amp;E registrars can be granted access
-   * to all existing TLDs in sandbox. Note that OT&amp;E is only on sandbox and thus these dummy
+   * to all existing TLDs in sandbox. Note that OT&amp;E is only on sandbox, and thus these dummy
    * values will never be used in production (the only environment where real invoicing takes
    * place).
    */
@@ -124,7 +134,7 @@ public final class OteAccountBuilder {
   private final Tld sunriseTld;
   private final Tld gaTld;
   private final Tld eapTld;
-  private final ImmutableList.Builder<RegistrarPoc> contactsBuilder = new ImmutableList.Builder<>();
+  private final List<User> users = new ArrayList<>();
 
   private ImmutableList<Registrar> registrars;
   private boolean replaceExisting = false;
@@ -172,16 +182,28 @@ public final class OteAccountBuilder {
   }
 
   /**
-   * Adds a RegistrarContact with Web Console access.
+   * Adds a {@link User} with Web Console access.
    *
-   * <p>NOTE: can be called more than once, adding multiple contacts. Each contact will have access
-   * to all OT&amp;E Registrars.
+   * <p>NOTE: can be called more than once, adding multiple users. Each user will have access to all
+   * OT&amp;E Registrars.
    *
-   * @param email the contact/login email that will have web-console access to all the Registrars.
-   *     Must be from "our G Suite domain".
+   * @param email the login email that will have web-console access to all the Registrars. Must be
+   *     from "our Google Workspace domain".
    */
-  public OteAccountBuilder addContact(String email) {
-    registrars.forEach(registrar -> contactsBuilder.add(createRegistrarContact(email, registrar)));
+  public OteAccountBuilder addUser(String email) {
+    users.add(
+        new User.Builder()
+            .setEmailAddress(email)
+            .setUserRoles(
+                new UserRoles.Builder()
+                    .setRegistrarRoles(
+                        registrars.stream()
+                            .collect(
+                                toImmutableMap(
+                                    Registrar::getRegistrarId,
+                                    registrar -> RegistrarRole.ACCOUNT_MANAGER)))
+                    .build())
+            .build());
     return this;
   }
 
@@ -217,7 +239,7 @@ public final class OteAccountBuilder {
     return transformRegistrars(builder -> builder.setClientCertificate(asciiCert, now));
   }
 
-  /** Sets the IP allow list to all the OT&amp;E Registrars. */
+  /** Sets the IP allowlist to all the OT&amp;E Registrars. */
   public OteAccountBuilder setIpAllowList(Collection<String> ipAllowList) {
     ImmutableList<CidrAddressBlock> ipAddressAllowList =
         ipAllowList.stream().map(CidrAddressBlock::create).collect(toImmutableList());
@@ -237,18 +259,37 @@ public final class OteAccountBuilder {
   }
 
   /**
-   * Return map from the OT&amp;E registrarIds we will create to the new TLDs they will have access
-   * to.
+   * Return the map from the OT&amp;E registrarIds we will create to the new TLDs they will have
+   * access to.
    */
   public ImmutableMap<String, String> getRegistrarIdToTldMap() {
     return registrarIdToTld;
   }
 
+  /** Grants the users permission to pass IAP. */
+  public void grantIapPermission(
+      Optional<String> groupEmailAddress, CloudTasksUtils cloudTasksUtils, IamClient iamClient) {
+    for (User user : users) {
+      User.grantIapPermission(
+          user.getEmailAddress(), groupEmailAddress, cloudTasksUtils, iamClient);
+    }
+  }
+
   /** Saves all the OT&amp;E entities we created. */
   private void saveAllEntities() {
-    // use ImmutableObject instead of Registry so that the Key generation doesn't break
     ImmutableList<Tld> registries = ImmutableList.of(sunriseTld, gaTld, eapTld);
-    ImmutableList<RegistrarPoc> contacts = contactsBuilder.build();
+    Map<String, User> existingUsers = new HashMap<>();
+
+    users.forEach(
+        user ->
+            UserDao.loadUser(user.getEmailAddress())
+                .ifPresent(
+                    existingUser ->
+                        existingUsers.put(existingUser.getEmailAddress(), existingUser)));
+
+    if (!replaceExisting) {
+      checkState(existingUsers.isEmpty(), "Found existing users: %s", existingUsers);
+    }
 
     tm().transact(
             () -> {
@@ -256,8 +297,7 @@ public final class OteAccountBuilder {
                 ImmutableList<VKey<? extends ImmutableObject>> keys =
                     Streams.concat(
                             registries.stream().map(tld -> Tld.createVKey(tld.getTldStr())),
-                            registrars.stream().map(Registrar::createVKey),
-                            contacts.stream().map(RegistrarPoc::createVKey))
+                            registrars.stream().map(Registrar::createVKey))
                         .collect(toImmutableList());
                 ImmutableMap<VKey<? extends ImmutableObject>, ImmutableObject> existingObjects =
                     tm().loadByKeysIfPresent(keys);
@@ -275,8 +315,18 @@ public final class OteAccountBuilder {
               registrars = registrars.stream().map(this::addAllowedTld).collect(toImmutableList());
               // and we can save the registrars and contacts!
               tm().putAll(registrars);
-              tm().putAll(contacts);
             });
+
+    for (User user : users) {
+      String email = user.getEmailAddress();
+      if (existingUsers.containsKey(email)) {
+        // Note that other roles for the existing user are reset. We do this instead of simply
+        // saving the new user is that UserDao does not allow us to save the new user with the same
+        // email as the existing user.
+        user = existingUsers.get(email).asBuilder().setUserRoles(user.getUserRoles()).build();
+      }
+      UserDao.saveUser(user);
+    }
   }
 
   private Registrar addAllowedTld(Registrar registrar) {
@@ -336,15 +386,6 @@ public final class OteAccountBuilder {
         .build();
   }
 
-  private static RegistrarPoc createRegistrarContact(String email, Registrar registrar) {
-    return new RegistrarPoc.Builder()
-        .setRegistrar(registrar)
-        .setName(email)
-        .setEmailAddress(email)
-        .setLoginEmailAddress(email)
-        .build();
-  }
-
   /** Returns the registrar IDs of the OT&amp;E, with the TLDs each has access to. */
   public static ImmutableMap<String, String> createRegistrarIdToTldMap(String baseRegistrarId) {
     checkArgument(

core/src/main/java/google/registry/model/console/User.java

@@ -14,7 +14,19 @@
 
 package google.registry.model.console;
 
+import static google.registry.tools.server.UpdateUserGroupAction.GROUP_UPDATE_QUEUE;
+
+import com.google.cloud.tasks.v2.Task;
+import com.google.common.collect.ImmutableMultimap;
+import com.google.common.flogger.FluentLogger;
+import google.registry.batch.CloudTasksUtils;
 import google.registry.persistence.VKey;
+import google.registry.request.Action.Service;
+import google.registry.tools.IamClient;
+import google.registry.tools.server.UpdateUserGroupAction;
+import google.registry.tools.server.UpdateUserGroupAction.Mode;
+import google.registry.util.RegistryEnvironment;
+import java.util.Optional;
 import javax.persistence.Access;
 import javax.persistence.AccessType;
 import javax.persistence.Embeddable;
@@ -31,6 +43,76 @@ import javax.persistence.Table;
 @Table(indexes = {@Index(columnList = "emailAddress", name = "user_email_address_idx")})
 public class User extends UserBase {
 
+  public static final String IAP_SECURED_WEB_APP_USER_ROLE = "roles/iap.httpsResourceAccessor";
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
+  /**
+   * Grants the user permission to pass IAP.
+   *
+   * <p>Depending on if a console user group is set up, the permission is granted either
+   * individually or via group membership.
+   */
+  public static void grantIapPermission(
+      String emailAddress,
+      Optional<String> groupEmailAddress,
+      CloudTasksUtils cloudTasksUtils,
+      IamClient iamClient) {
+    if (RegistryEnvironment.isInTestServer()) {
+      return;
+    }
+    if (groupEmailAddress.isEmpty()) {
+      logger.atInfo().log("Granting IAP role to user %s", emailAddress);
+      iamClient.addBinding(emailAddress, IAP_SECURED_WEB_APP_USER_ROLE);
+    } else {
+      logger.atInfo().log("Adding %s to group %s", emailAddress, groupEmailAddress.get());
+      modifyGroupMembershipAsync(
+          emailAddress, groupEmailAddress.get(), cloudTasksUtils, UpdateUserGroupAction.Mode.ADD);
+    }
+  }
+
+  /**
+   * Revoke the user's permission to pass IAP.
+   *
+   * <p>Depending on if a console user group is set up, the permission is revoked either
+   * individually or via group membership.
+   */
+  public static void revokeIapPermission(
+      String emailAddress,
+      Optional<String> groupEmailAddress,
+      CloudTasksUtils cloudTasksUtils,
+      IamClient iamClient) {
+    if (RegistryEnvironment.isInTestServer()) {
+      return;
+    }
+    if (groupEmailAddress.isEmpty()) {
+      logger.atInfo().log("Removing IAP role from user %s", emailAddress);
+      iamClient.removeBinding(emailAddress, IAP_SECURED_WEB_APP_USER_ROLE);
+    } else {
+      logger.atInfo().log("Removing %s from group %s", emailAddress, groupEmailAddress.get());
+      modifyGroupMembershipAsync(
+          emailAddress, groupEmailAddress.get(), cloudTasksUtils, Mode.REMOVE);
+    }
+  }
+
+  private static void modifyGroupMembershipAsync(
+      String userEmailAddress,
+      String groupEmailAddress,
+      CloudTasksUtils cloudTasksUtils,
+      Mode mode) {
+    Task task =
+        cloudTasksUtils.createPostTask(
+            UpdateUserGroupAction.PATH,
+            Service.TOOLS,
+            ImmutableMultimap.of(
+                "userEmailAddress",
+                userEmailAddress,
+                "groupEmailAddress",
+                groupEmailAddress,
+                "groupUpdateMode",
+                mode.name()));
+    cloudTasksUtils.enqueue(GROUP_UPDATE_QUEUE, task);
+  }
+
   @Override
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -46,6 +46,7 @@ import google.registry.model.EppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.contact.Contact;
+import google.registry.model.domain.DesignatedContact.Type;
 import google.registry.model.domain.launch.LaunchNotice;
 import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.secdns.DomainDsData;
@@ -131,11 +132,11 @@ public class DomainBase extends EppResource
   @Expose @Transient Set<VKey<Host>> nsHosts;
 
   /** Contacts. */
-  @Expose VKey<Contact> adminContact;
+  @Expose @Nullable VKey<Contact> adminContact;
 
-  @Expose VKey<Contact> billingContact;
-  @Expose VKey<Contact> techContact;
-  @Expose VKey<Contact> registrantContact;
+  @Expose @Nullable VKey<Contact> billingContact;
+  @Expose @Nullable VKey<Contact> techContact;
+  @Expose @Nullable VKey<Contact> registrantContact;
 
   /** Authorization info (aka transfer secret) of the domain. */
   @Embedded
@@ -585,32 +586,49 @@ public class DomainBase extends EppResource
   }
 
   /** A key to the registrant who registered this domain. */
-  public VKey<Contact> getRegistrant() {
-    return registrantContact;
+  public Optional<VKey<Contact>> getRegistrant() {
+    return Optional.ofNullable(registrantContact);
   }
 
-  public VKey<Contact> getAdminContact() {
-    return adminContact;
+  public Optional<VKey<Contact>> getAdminContact() {
+    return Optional.ofNullable(adminContact);
   }
 
-  public VKey<Contact> getBillingContact() {
-    return billingContact;
+  public Optional<VKey<Contact>> getBillingContact() {
+    return Optional.ofNullable(billingContact);
   }
 
-  public VKey<Contact> getTechContact() {
-    return techContact;
+  public Optional<VKey<Contact>> getTechContact() {
+    return Optional.ofNullable(techContact);
   }
 
-  /** Associated contacts for the domain (other than registrant). */
+  /**
+   * Associated contacts for the domain (other than registrant).
+   *
+   * <p>Note: This can be an empty set if no contacts are present for the domain.
+   */
   public ImmutableSet<DesignatedContact> getContacts() {
     return getAllContacts(false);
   }
 
+  /**
+   * Gets all associated contacts for the domain, including the registrant.
+   *
+   * <p>Note: This can be an empty set if no contacts are present for the domain.
+   */
+  public ImmutableSet<DesignatedContact> getAllContacts() {
+    return getAllContacts(true);
+  }
+
   public DomainAuthInfo getAuthInfo() {
     return authInfo;
   }
 
-  /** Returns all referenced contacts from this domain. */
+  /**
+   * Returns all referenced contacts from this domain.
+   *
+   * <p>Note: This can be an empty set if no contacts are present for the domain.
+   */
   public ImmutableSet<VKey<Contact>> getReferencedContacts() {
     return nullToEmptyImmutableCopy(getAllContacts(true)).stream()
         .map(DesignatedContact::getContactKey)
@@ -620,18 +638,12 @@ public class DomainBase extends EppResource
 
   private ImmutableSet<DesignatedContact> getAllContacts(boolean includeRegistrant) {
     ImmutableSet.Builder<DesignatedContact> builder = new ImmutableSet.Builder<>();
-    if (includeRegistrant && registrantContact != null) {
-      builder.add(DesignatedContact.create(DesignatedContact.Type.REGISTRANT, registrantContact));
-    }
-    if (adminContact != null) {
-      builder.add(DesignatedContact.create(DesignatedContact.Type.ADMIN, adminContact));
-    }
-    if (billingContact != null) {
-      builder.add(DesignatedContact.create(DesignatedContact.Type.BILLING, billingContact));
-    }
-    if (techContact != null) {
-      builder.add(DesignatedContact.create(DesignatedContact.Type.TECH, techContact));
+    if (includeRegistrant) {
+      getRegistrant().ifPresent(c -> builder.add(DesignatedContact.create(Type.REGISTRANT, c)));
     }
+    getAdminContact().ifPresent(c -> builder.add(DesignatedContact.create(Type.ADMIN, c)));
+    getBillingContact().ifPresent(c -> builder.add(DesignatedContact.create(Type.BILLING, c)));
+    getTechContact().ifPresent(c -> builder.add(DesignatedContact.create(Type.TECH, c)));
     return builder.build();
   }
 
@@ -647,11 +659,13 @@ public class DomainBase extends EppResource
    */
   void setContactFields(Set<DesignatedContact> contacts, boolean includeRegistrant) {
     // Set the individual contact fields.
-    billingContact = techContact = adminContact = null;
+    billingContact = null;
+    techContact = null;
+    adminContact = null;
     if (includeRegistrant) {
       registrantContact = null;
     }
-    HashSet<DesignatedContact.Type> contactsDiscovered = new HashSet<>();
+    HashSet<Type> contactsDiscovered = new HashSet<>();
     for (DesignatedContact contact : contacts) {
       checkArgument(
           !contactsDiscovered.contains(contact.getType()),
@@ -682,7 +696,7 @@ public class DomainBase extends EppResource
 
   /** Predicate to determine if a given {@link DesignatedContact} is the registrant. */
   static final Predicate<DesignatedContact> IS_REGISTRANT =
-      (DesignatedContact contact) -> DesignatedContact.Type.REGISTRANT.equals(contact.type);
+      (DesignatedContact contact) -> Type.REGISTRANT.equals(contact.type);
 
   /** An override of {@link EppResource#asBuilder} with tighter typing. */
   @Override
@@ -717,7 +731,6 @@ public class DomainBase extends EppResource
       instance.autorenewEndTime = firstNonNull(getInstance().autorenewEndTime, END_OF_TIME);
 
       checkArgumentNotNull(emptyToNull(instance.domainName), "Missing domainName");
-      checkArgumentNotNull(instance.getRegistrant(), "Missing registrant");
       instance.tld = getTldFromDomainName(instance.domainName);
 
       T newDomain = super.build();
@@ -749,9 +762,9 @@ public class DomainBase extends EppResource
       return thisCastToDerived();
     }
 
-    public B setRegistrant(VKey<Contact> registrant) {
+    public B setRegistrant(Optional<VKey<Contact>> registrant) {
       // Set the registrant field specifically.
-      getInstance().registrantContact = registrant;
+      getInstance().registrantContact = registrant.orElse(null);
       return thisCastToDerived();
     }
 

core/src/main/java/google/registry/model/domain/DomainCommand.java

@@ -40,6 +40,7 @@ import google.registry.model.eppinput.ResourceCommand.ResourceUpdate;
 import google.registry.model.eppinput.ResourceCommand.SingleResourceCommand;
 import google.registry.model.host.Host;
 import google.registry.persistence.VKey;
+import java.util.Optional;
 import java.util.Set;
 import javax.annotation.Nullable;
 import javax.xml.bind.annotation.XmlAttribute;
@@ -76,21 +77,21 @@ public class DomainCommand {
 
     /** The contactId of the registrant who registered this domain. */
     @XmlElement(name = "registrant")
+    @Nullable
     String registrantContactId;
 
     /** A resolved key to the registrant who registered this domain. */
-    @XmlTransient VKey<Contact> registrant;
+    @Nullable @XmlTransient VKey<Contact> registrant;
 
     /** Authorization info (aka transfer secret) of the domain. */
     DomainAuthInfo authInfo;
 
-    public String getRegistrantContactId() {
-      return registrantContactId;
+    public Optional<String> getRegistrantContactId() {
+      return Optional.ofNullable(registrantContactId);
     }
 
-    @Nullable
-    public VKey<Contact> getRegistrant() {
-      return registrant;
+    public Optional<VKey<Contact>> getRegistrant() {
+      return Optional.ofNullable(registrant);
     }
 
     public DomainAuthInfo getAuthInfo() {

core/src/main/java/google/registry/model/domain/DomainInfoData.java

@@ -63,6 +63,7 @@ public abstract class DomainInfoData implements ResponseData {
   abstract ImmutableSet<StatusValue> getStatusValues();
 
   @XmlElement(name = "registrant")
+  @Nullable
   abstract String getRegistrant();
 
   @XmlElement(name = "contact")

core/src/main/java/google/registry/model/domain/token/AllocationToken.java

@@ -115,7 +115,17 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
      */
     BYPASS_TLD_STATE,
     /** Bypasses most checks and creates the domain as an anchor tenant, with all that implies. */
-    ANCHOR_TENANT
+    ANCHOR_TENANT,
+    /**
+     * Bypasses the premium list to use the standard creation price. Does not affect the renewal
+     * price.
+     *
+     * <p>This cannot be specified along with a discount fraction, and any renewals (automatic or
+     * otherwise) will use the premium price for the domain if one exists.
+     *
+     * <p>Tokens with this behavior must be tied to a single particular domain.
+     */
+    NONPREMIUM_CREATE
   }
 
   /** Type of the token that indicates how and where it should be used. */
@@ -404,6 +414,17 @@ public class AllocationToken extends UpdateAutoTimestampEntity implements Builda
         checkArgumentNotNull(
             getInstance().domainName, "ANCHOR_TENANT tokens must be tied to a domain");
       }
+      if (getInstance().registrationBehavior.equals(RegistrationBehavior.NONPREMIUM_CREATE)) {
+        checkArgument(
+            getInstance().discountFraction == 0.0,
+            "NONPREMIUM_CREATE tokens cannot apply a discount");
+        checkArgumentNotNull(
+            getInstance().domainName, "NONPREMIUM_CREATE tokens must be tied to a domain");
+        checkArgument(
+            getInstance().allowedEppActions == null
+                || getInstance().allowedEppActions.contains(CommandName.CREATE),
+            "NONPREMIUM_CREATE tokens must allow for CREATE actions");
+      }
       if (getInstance().domainName != null) {
         try {
           DomainFlowUtils.validateDomainName(getInstance().domainName);

core/src/main/java/google/registry/model/pricing/PremiumPricingEngine.java

@@ -46,7 +46,7 @@ public interface PremiumPricingEngine {
     private Money createCost;
     private Money renewCost;
 
-    static DomainPrices create(boolean isPremium, Money createCost, Money renewCost) {
+    public static DomainPrices create(boolean isPremium, Money createCost, Money renewCost) {
       DomainPrices instance = new DomainPrices();
       instance.isPremium = isPremium;
       instance.createCost = createCost;

core/src/main/java/google/registry/rdap/RdapEntityAction.java

@@ -76,7 +76,7 @@ public class RdapEntityAction extends RdapActionBase {
       // they are global, and might have different roles for different domains.
       if (contact.isPresent() && isAuthorized(contact.get())) {
         return rdapJsonFormatter.createRdapContactEntity(
-            contact.get(), ImmutableSet.of(), OutputDataType.FULL);
+            contact, ImmutableSet.of(), OutputDataType.FULL);
       }
     }
 

core/src/main/java/google/registry/rdap/RdapEntitySearchAction.java

@@ -461,7 +461,7 @@ public class RdapEntitySearchAction extends RdapSearchActionBase {
           .entitySearchResultsBuilder()
           .add(
               rdapJsonFormatter.createRdapContactEntity(
-                  contact, ImmutableSet.of(), outputDataType));
+                  Optional.of(contact), ImmutableSet.of(), outputDataType));
       newCursor =
           Optional.of(
               CONTACT_CURSOR_PREFIX

core/src/main/java/google/registry/rdap/RdapJsonFormatter.java

@@ -61,6 +61,7 @@ import google.registry.rdap.RdapDataStructures.RdapStatus;
 import google.registry.rdap.RdapObjectClasses.RdapContactEntity;
 import google.registry.rdap.RdapObjectClasses.RdapDomain;
 import google.registry.rdap.RdapObjectClasses.RdapEntity;
+import google.registry.rdap.RdapObjectClasses.RdapEntity.Role;
 import google.registry.rdap.RdapObjectClasses.RdapNameserver;
 import google.registry.rdap.RdapObjectClasses.RdapRegistrarEntity;
 import google.registry.rdap.RdapObjectClasses.SecureDns;
@@ -74,6 +75,7 @@ import java.net.InetAddress;
 import java.net.URI;
 import java.nio.file.Paths;
 import java.util.HashMap;
+import java.util.LinkedHashSet;
 import java.util.Locale;
 import java.util.Optional;
 import java.util.Set;
@@ -249,6 +251,16 @@ public class RdapJsonFormatter {
   private static final Ordering<DesignatedContact> DESIGNATED_CONTACT_ORDERING =
       Ordering.natural().onResultOf(DesignatedContact::getType);
 
+  /**
+   * The list of RDAP contact roles that are required to be present on each domain.
+   *
+   * <p>Per RDAP Response Profile 2.7.3, A domain MUST have the REGISTRANT, ADMIN, TECH roles and
+   * MAY have others. We also have the BILLING role in our system but it isn't required and is only
+   * listed if actually present.
+   */
+  private static final ImmutableSet<Role> REQUIRED_CONTACT_ROLES =
+      ImmutableSet.of(Role.REGISTRANT, Role.ADMIN, Role.TECH);
+
   /** Creates the TOS notice that is added to every reply. */
   Notice createTosNotice() {
     String linkValue = makeRdapServletRelativeUrl("help", RdapHelpAction.TOS_PATH);
@@ -369,38 +381,53 @@ public class RdapJsonFormatter {
                 () ->
                     ImmutableSet.copyOf(replicaTm().loadByKeys(domain.getNameservers()).values()));
     // Load the registrant and other contacts and add them to the data.
+    ImmutableSet<VKey<Contact>> contacts = domain.getReferencedContacts();
     ImmutableMap<VKey<? extends Contact>, Contact> loadedContacts =
-        replicaTm().transact(() -> replicaTm().loadByKeysIfPresent(domain.getReferencedContacts()));
-    // RDAP Response Profile 2.7.3, A domain MUST have the REGISTRANT, ADMIN, TECH roles and MAY
-    // have others. We also add the BILLING.
-    //
+        contacts.isEmpty()
+            ? ImmutableMap.of()
+            : replicaTm().transact(() -> replicaTm().loadByKeysIfPresent(contacts));
+
     // RDAP Response Profile 2.7.1, 2.7.3 - we MUST have the contacts. 2.7.4 discusses redaction of
     // fields we don't want to show (as opposed to not having contacts at all) because of GDPR etc.
     //
-    // the GDPR redaction is handled in createRdapContactEntity
+    // The GDPR redaction is handled in createRdapContactEntity.
+
+    // Load all contacts that are present and group them by type (it is common for a single contact
+    // entity to be used across multiple contact types on domain, e.g. registrant and admin).
     ImmutableSetMultimap<VKey<Contact>, Type> contactsToRoles =
-        Streams.concat(
-                domain.getContacts().stream(),
-                Stream.of(DesignatedContact.create(Type.REGISTRANT, domain.getRegistrant())))
+        domain.getAllContacts().stream()
             .sorted(DESIGNATED_CONTACT_ORDERING)
             .collect(
                 toImmutableSetMultimap(
                     DesignatedContact::getContactKey, DesignatedContact::getType));
 
+    // Convert the contact entities to RDAP output contacts (this also converts the contact types
+    // to RDAP roles).
+    Set<RdapContactEntity> rdapContacts = new LinkedHashSet<>();
     for (VKey<Contact> contactKey : contactsToRoles.keySet()) {
-      Set<RdapEntity.Role> roles =
+      Set<Role> roles =
           contactsToRoles.get(contactKey).stream()
               .map(RdapJsonFormatter::convertContactTypeToRdapRole)
               .collect(toImmutableSet());
       if (roles.isEmpty()) {
         continue;
       }
-      builder
-          .entitiesBuilder()
-          .add(
-              createRdapContactEntity(
-                  loadedContacts.get(contactKey), roles, OutputDataType.INTERNAL));
+      rdapContacts.add(
+          createRdapContactEntity(
+              Optional.ofNullable(loadedContacts.get(contactKey)), roles, OutputDataType.INTERNAL));
     }
+
+    // Loop through all required contact roles and fill in placeholder REDACTED info for any
+    // required ones that are missing, i.e. because of minimum registration data set.
+    for (Role role : REQUIRED_CONTACT_ROLES) {
+      if (rdapContacts.stream().noneMatch(c -> c.roles().contains(role))) {
+        rdapContacts.add(
+            createRdapContactEntity(
+                Optional.empty(), ImmutableSet.of(role), OutputDataType.INTERNAL));
+      }
+    }
+    builder.entitiesBuilder().addAll(rdapContacts);
+
     // Add the nameservers to the data; the load was kicked off above for efficiency.
     // RDAP Response Profile 2.9: we MUST have the nameservers
     for (Host host : HOST_RESOURCE_ORDERING.immutableSortedCopy(loadedHosts)) {
@@ -502,25 +529,36 @@ public class RdapJsonFormatter {
   /**
    * Creates a JSON object for a {@link Contact} and associated contact type.
    *
+   * <p>If the contact isn't present (i.e. because of minimum registration data set), then always
+   * show all of its fields as if they were redacted, and always deny RDAP authorization.
+   *
    * @param contact the contact resource object from which the JSON object should be created
    * @param roles the roles of this contact
    * @param outputDataType whether to generate full or summary data
    */
   RdapContactEntity createRdapContactEntity(
-      Contact contact, Iterable<RdapEntity.Role> roles, OutputDataType outputDataType) {
+      Optional<Contact> contact, Iterable<RdapEntity.Role> roles, OutputDataType outputDataType) {
     RdapContactEntity.Builder contactBuilder = RdapContactEntity.builder();
 
     // RDAP Response Profile 2.7.1, 2.7.3 - we MUST have the contacts. 2.7.4 discusses censoring of
     // fields we don't want to show (as opposed to not having contacts at all) because of GDPR etc.
     //
     // 2.8 allows for unredacted output for authorized people.
+    // TODO(mcilwain): Once the RDAP profile is fully updated for minimum registration data set,
+    //                 we will want to not include non-existent contacts at all, rather than
+    //                 pretending they exist and just showing REDACTED info. This is especially
+    //                 important for authorized flows, where you wouldn't expect to see redaction
+    //                 (although no one actually has access to authorized flows yet).
     boolean isAuthorized =
-        rdapAuthorization.isAuthorizedForRegistrar(contact.getCurrentSponsorRegistrarId());
+        contact.isPresent()
+            && rdapAuthorization.isAuthorizedForRegistrar(
+                contact.get().getCurrentSponsorRegistrarId());
 
     VcardArray.Builder vcardBuilder = VcardArray.builder();
 
     if (isAuthorized) {
-      fillRdapContactEntityWhenAuthorized(contactBuilder, vcardBuilder, contact, outputDataType);
+      fillRdapContactEntityWhenAuthorized(
+          contactBuilder, vcardBuilder, contact.get(), outputDataType);
     } else {
       // GTLD Registration Data Temp Spec 17may18, Appendix A, 2.3, 2.4 and RDAP Response Profile
       // 2.7.4.1, 2.7.4.2 - the following fields must be redacted:

core/src/main/java/google/registry/rde/DomainToXjcConverter.java

@@ -20,7 +20,6 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.
 import com.google.common.base.Ascii;
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableSet;
-import com.google.common.flogger.FluentLogger;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.Domain;
@@ -45,12 +44,11 @@ import google.registry.xjc.rgp.XjcRgpStatusType;
 import google.registry.xjc.rgp.XjcRgpStatusValueType;
 import google.registry.xjc.secdns.XjcSecdnsDsDataType;
 import google.registry.xjc.secdns.XjcSecdnsDsOrKeyType;
+import java.util.Optional;
 
 /** Utility class that turns {@link Domain} as {@link XjcRdeDomainElement}. */
 final class DomainToXjcConverter {
 
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
   /** Converts {@link Domain} to {@link XjcRdeDomainElement}. */
   static XjcRdeDomainElement convert(Domain domain, RdeMode mode) {
     return new XjcRdeDomainElement(convertDomain(domain, mode));
@@ -168,11 +166,9 @@ final class DomainToXjcConverter {
         // o  An OPTIONAL <registrant> element that contain the identifier for
         //    the human or organizational social information object associated
         //    as the holder of the domain name object.
-        VKey<Contact> registrant = model.getRegistrant();
-        if (registrant == null) {
-          logger.atWarning().log("Domain %s has no registrant contact.", domainName);
-        } else {
-          Contact registrantContact = tm().transact(() -> tm().loadByKey(registrant));
+        Optional<VKey<Contact>> registrant = model.getRegistrant();
+        if (registrant.isPresent()) {
+          Contact registrantContact = tm().transact(() -> tm().loadByKey(registrant.get()));
           checkState(
               registrantContact != null,
               "Registrant contact %s on domain %s does not exist",

core/src/main/java/google/registry/tools/CreateUserCommand.java

@@ -15,30 +15,25 @@
 package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.model.console.User.grantIapPermission;
 
 import com.beust.jcommander.Parameters;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.flogger.FluentLogger;
-import com.google.common.net.MediaType;
+import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
-import google.registry.tools.server.UpdateUserGroupAction;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 /** Command to create a new User. */
 @Parameters(separators = " =", commandDescription = "Update a user account")
-public class CreateUserCommand extends CreateOrUpdateUserCommand implements CommandWithConnection {
-
-  static final String IAP_SECURED_WEB_APP_USER_ROLE = "roles/iap.httpsResourceAccessor";
-  static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private ServiceConnection connection;
+public class CreateUserCommand extends CreateOrUpdateUserCommand {
 
   @Inject IamClient iamClient;
 
+  @Inject CloudTasksUtils cloudTasksUtils;
+
   @Inject
   @Config("gSuiteConsoleUserGroupEmailAddress")
   Optional<String> maybeGroupEmailAddress;
@@ -53,29 +48,7 @@ public class CreateUserCommand extends CreateOrUpdateUserCommand implements Comm
   @Override
   protected String execute() throws Exception {
     String ret = super.execute();
-    String groupEmailAddress = maybeGroupEmailAddress.orElse(null);
-    if (groupEmailAddress != null) {
-      logger.atInfo().log("Adding %s to group %s", email, groupEmailAddress);
-      connection.sendPostRequest(
-          UpdateUserGroupAction.PATH,
-          ImmutableMap.of(
-              "userEmailAddress",
-              email,
-              "groupEmailAddress",
-              groupEmailAddress,
-              "groupUpdateMode",
-              "ADD"),
-          MediaType.PLAIN_TEXT_UTF_8,
-          new byte[0]);
-    } else {
-      logger.atInfo().log("Granting IAP role to user %s", email);
-      iamClient.addBinding(email, IAP_SECURED_WEB_APP_USER_ROLE);
-    }
+    grantIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, iamClient);
     return ret;
   }
-
-  @Override
-  public void setConnection(ServiceConnection connection) {
-    this.connection = connection;
-  }
 }

core/src/main/java/google/registry/tools/DeleteUserCommand.java

@@ -15,32 +15,27 @@
 package google.registry.tools;
 
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;
 
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
-import com.google.common.collect.ImmutableMap;
-import com.google.common.flogger.FluentLogger;
-import com.google.common.net.MediaType;
+import google.registry.batch.CloudTasksUtils;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
-import google.registry.tools.server.UpdateUserGroupAction;
 import java.util.Optional;
 import javax.annotation.Nullable;
 import javax.inject.Inject;
 
 /** Deletes a {@link User}. */
 @Parameters(separators = " =", commandDescription = "Delete a user account")
-public class DeleteUserCommand extends ConfirmingCommand implements CommandWithConnection {
+public class DeleteUserCommand extends ConfirmingCommand {
 
-  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
-
-  private ServiceConnection connection;
   @Inject IamClient iamClient;
 
+  @Inject CloudTasksUtils cloudTasksUtils;
+
   @Inject
   @Config("gSuiteConsoleUserGroupEmailAddress")
   Optional<String> maybeGroupEmailAddress;
@@ -49,11 +44,6 @@ public class DeleteUserCommand extends ConfirmingCommand implements CommandWithC
   @Parameter(names = "--email", description = "Email address of the user", required = true)
   String email;
 
-  @Override
-  public void setConnection(ServiceConnection connection) {
-    this.connection = connection;
-  }
-
   @Override
   protected String prompt() {
     checkArgumentNotNull(email, "Email must be provided");
@@ -69,24 +59,7 @@ public class DeleteUserCommand extends ConfirmingCommand implements CommandWithC
               checkArgumentPresent(optionalUser, "Email no longer corresponds to a valid user");
               tm().delete(optionalUser.get());
             });
-    String groupEmailAddress = maybeGroupEmailAddress.orElse(null);
-    if (groupEmailAddress != null) {
-      logger.atInfo().log("Removing %s from group %s", email, groupEmailAddress);
-      connection.sendPostRequest(
-          UpdateUserGroupAction.PATH,
-          ImmutableMap.of(
-              "userEmailAddress",
-              email,
-              "groupEmailAddress",
-              groupEmailAddress,
-              "groupUpdateMode",
-              "REMOVE"),
-          MediaType.PLAIN_TEXT_UTF_8,
-          new byte[0]);
-    } else {
-      logger.atInfo().log("Removing IAP role from user %s", email);
-      iamClient.removeBinding(email, IAP_SECURED_WEB_APP_USER_ROLE);
-    }
+    User.revokeIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, iamClient);
     return String.format("Deleted user with email %s", email);
   }
 }

core/src/main/java/google/registry/tools/IamClient.java

@@ -20,7 +20,7 @@ import com.google.api.services.cloudresourcemanager.model.GetIamPolicyRequest;
 import com.google.api.services.cloudresourcemanager.model.Policy;
 import com.google.api.services.cloudresourcemanager.model.SetIamPolicyRequest;
 import com.google.common.base.Ascii;
-import google.registry.config.CredentialModule.LocalCredential;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
 import java.io.IOException;
@@ -38,7 +38,7 @@ public class IamClient {
 
   @Inject
   public IamClient(
-      @LocalCredential GoogleCredentialsBundle credentialsBundle,
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
       @Config("projectId") String projectId) {
     this(
         new CloudResourceManager.Builder(

core/src/main/java/google/registry/tools/RegistryToolDataflowModule.java

@@ -17,7 +17,7 @@ package google.registry.tools;
 import com.google.api.services.dataflow.Dataflow;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.config.CredentialModule.LocalCredential;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.util.GoogleCredentialsBundle;
 
@@ -27,7 +27,7 @@ public class RegistryToolDataflowModule {
 
   @Provides
   static Dataflow provideDataflow(
-      @LocalCredential GoogleCredentialsBundle credentialsBundle,
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle,
       @Config("projectId") String projectId) {
     return new Dataflow.Builder(
             credentialsBundle.getHttpTransport(),

core/src/main/java/google/registry/tools/SetupOteCommand.java

@@ -22,6 +22,8 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.io.MoreFiles;
+import google.registry.batch.CloudTasksUtils;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.model.OteAccountBuilder;
 import google.registry.tools.params.PathParameter;
 import google.registry.util.Clock;
@@ -30,6 +32,7 @@ import google.registry.util.StringGenerator;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 import javax.inject.Inject;
 import javax.inject.Named;
 
@@ -47,7 +50,7 @@ final class SetupOteCommand extends ConfirmingCommand {
 
   @Parameter(
       names = {"-a", "--ip_allow_list"},
-      description = "Comma-separated list of IP addreses or CIDR ranges.",
+      description = "Comma-separated list of IP addresses or CIDR ranges.",
       required = true)
   private List<String> ipAllowList = new ArrayList<>();
 
@@ -55,7 +58,7 @@ final class SetupOteCommand extends ConfirmingCommand {
       names = {"--email"},
       description =
           "The registrar's account to use for console access. "
-              + "Must be on the registry's G Suite domain.",
+              + "Must be on the registry's Google Workspace domain.",
       required = true)
   private String email;
 
@@ -76,6 +79,14 @@ final class SetupOteCommand extends ConfirmingCommand {
 
   @Inject Clock clock;
 
+  @Inject CloudTasksUtils cloudTasksUtils;
+
+  @Inject IamClient iamClient;
+
+  @Inject
+  @Config("gSuiteConsoleUserGroupEmailAddress")
+  Optional<String> maybeGroupEmailAddress;
+
   OteAccountBuilder oteAccountBuilder;
   String password;
 
@@ -87,7 +98,7 @@ final class SetupOteCommand extends ConfirmingCommand {
     password = passwordGenerator.createString(PASSWORD_LENGTH);
     oteAccountBuilder =
         OteAccountBuilder.forRegistrarId(registrar)
-            .addContact(email)
+            .addUser(email)
             .setPassword(password)
             .setIpAllowList(ipAllowList)
             .setReplaceExisting(overwrite);
@@ -114,8 +125,11 @@ final class SetupOteCommand extends ConfirmingCommand {
         && RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
       builder.append(
           String.format(
-              "\n\nWARNING: Running against %s environment. Are "
-                  + "you sure you didn\'t mean to run this against sandbox (e.g. \"-e SANDBOX\")?",
+              """
+
+
+                  WARNING: Running against %s environment. Are \
+                  you sure you didn't mean to run this against sandbox (e.g. "-e SANDBOX")?""",
               RegistryEnvironment.get()));
     }
 
@@ -125,15 +139,15 @@ final class SetupOteCommand extends ConfirmingCommand {
   @Override
   public String execute() {
     ImmutableMap<String, String> clientIdToTld = oteAccountBuilder.buildAndPersist();
+    oteAccountBuilder.grantIapPermission(maybeGroupEmailAddress, cloudTasksUtils, iamClient);
 
     StringBuilder output = new StringBuilder();
 
     output.append("Copy these usernames/passwords back into the onboarding bug:\n\n");
     clientIdToTld.forEach(
-        (clientId, tld) -> {
-          output.append(
-              String.format("Login: %s\nPassword: %s\nTLD: %s\n\n", clientId, password, tld));
-        });
+        (clientId, tld) ->
+            output.append(
+                String.format("Login: %s\nPassword: %s\nTLD: %s\n\n", clientId, password, tld)));
 
     return output.toString();
   }

core/src/main/java/google/registry/tools/server/UpdateUserGroupAction.java

@@ -34,6 +34,7 @@ import javax.inject.Inject;
 public class UpdateUserGroupAction implements Runnable {
 
   public static final String PATH = "/_dr/admin/updateUserGroup";
+  public static final String GROUP_UPDATE_QUEUE = "console-user-group-update";
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
@@ -53,7 +54,7 @@ public class UpdateUserGroupAction implements Runnable {
   @Inject
   UpdateUserGroupAction() {}
 
-  enum Mode {
+  public enum Mode {
     ADD,
     REMOVE
   }

core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java

@@ -254,5 +254,4 @@ public abstract class ConsoleApiAction implements Runnable {
       super(message);
     }
   }
-
 }

core/src/main/java/google/registry/ui/server/console/ConsoleUpdateRegistrarAction.java

@@ -47,8 +47,7 @@ public class ConsoleUpdateRegistrarAction extends ConsoleApiAction {
 
   @Inject
   ConsoleUpdateRegistrarAction(
-      ConsoleApiParams consoleApiParams,
-      @Parameter("registrar") Optional<Registrar> registrar) {
+      ConsoleApiParams consoleApiParams, @Parameter("registrar") Optional<Registrar> registrar) {
     super(consoleApiParams);
     this.registrar = registrar;
   }
@@ -108,5 +107,4 @@ public class ConsoleUpdateRegistrarAction extends ConsoleApiAction {
 
     consoleApiParams.response().setStatus(SC_OK);
   }
-
 }

core/src/main/java/google/registry/ui/server/registrar/ConsoleOteSetupAction.java

@@ -24,6 +24,8 @@ import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
 import com.google.template.soy.tofu.SoyTofu;
+import google.registry.batch.CloudTasksUtils;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.model.OteAccountBuilder;
 import google.registry.request.Action;
 import google.registry.request.Action.Method;
@@ -31,6 +33,7 @@ import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;
+import google.registry.tools.IamClient;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.ui.server.SoyTemplateUtils;
 import google.registry.ui.soy.registrar.OteSetupConsoleSoyInfo;
@@ -87,6 +90,14 @@ public final class ConsoleOteSetupAction extends HtmlAction {
   @Parameter("password")
   Optional<String> optionalPassword;
 
+  @Inject CloudTasksUtils cloudTasksUtils;
+
+  @Inject IamClient iamClient;
+
+  @Inject
+  @Config("gSuiteConsoleUserGroupEmailAddress")
+  Optional<String> maybeGroupEmailAddress;
+
   @Inject
   ConsoleOteSetupAction() {}
 
@@ -107,16 +118,11 @@ public final class ConsoleOteSetupAction extends HtmlAction {
       return;
     }
     switch (method) {
-      case POST -> {
-        runPost(data);
-      }
-      case GET -> {
-        runGet(data);
-      }
-      default -> {
-        throw new BadRequestException(
-            String.format("Action cannot be called with method %s", method));
-      }
+      case POST -> runPost(data);
+      case GET -> runGet(data);
+      default ->
+          throw new BadRequestException(
+              String.format("Action cannot be called with method %s", method));
     }
   }
 
@@ -133,11 +139,13 @@ public final class ConsoleOteSetupAction extends HtmlAction {
       data.put("contactEmail", email.get());
 
       String password = optionalPassword.orElse(passwordGenerator.createString(PASSWORD_LENGTH));
-      ImmutableMap<String, String> clientIdToTld =
+      OteAccountBuilder oteAccountBuilder =
           OteAccountBuilder.forRegistrarId(clientId.get())
-              .addContact(email.get())
-              .setPassword(password)
-              .buildAndPersist();
+              .addUser(email.get())
+              .setPassword(password);
+      ImmutableMap<String, String> clientIdToTld = oteAccountBuilder.buildAndPersist();
+
+      oteAccountBuilder.grantIapPermission(maybeGroupEmailAddress, cloudTasksUtils, iamClient);
 
       sendExternalUpdates(clientIdToTld);
 

core/src/main/java/google/registry/ui/server/registrar/ConsoleRegistrarCreatorAction.java

@@ -26,10 +26,15 @@ import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
 import com.google.template.soy.tofu.SoyTofu;
+import google.registry.batch.CloudTasksUtils;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.model.console.RegistrarRole;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
+import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
 import google.registry.model.registrar.RegistrarBase.State;
-import google.registry.model.registrar.RegistrarPoc;
 import google.registry.request.Action;
 import google.registry.request.Action.Method;
 import google.registry.request.Action.Service;
@@ -37,6 +42,7 @@ import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;
+import google.registry.tools.IamClient;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.ui.server.SoyTemplateUtils;
 import google.registry.ui.soy.registrar.AnalyticsSoyInfo;
@@ -95,6 +101,14 @@ public final class ConsoleRegistrarCreatorAction extends HtmlAction {
   @Parameter("consoleName")
   Optional<String> name;
 
+  @Inject CloudTasksUtils cloudTasksUtils;
+
+  @Inject IamClient iamClient;
+
+  @Inject
+  @Config("gSuiteConsoleUserGroupEmailAddress")
+  Optional<String> maybeGroupEmailAddress;
+
   @Inject @Parameter("billingAccount") Optional<String> billingAccount;
   @Inject @Parameter("ianaId") Optional<Integer> ianaId;
   @Inject @Parameter("referralEmail") Optional<String> referralEmail;
@@ -129,16 +143,11 @@ public final class ConsoleRegistrarCreatorAction extends HtmlAction {
       return;
     }
     switch (method) {
-      case POST -> {
-        runPost(data);
-      }
-      case GET -> {
-        runGet(data);
-      }
-      default -> {
-        throw new BadRequestException(
-            String.format("Action cannot be called with method %s", method));
-      }
+      case POST -> runPost(data);
+      case GET -> runGet(data);
+      default ->
+          throw new BadRequestException(
+              String.format("Action cannot be called with method %s", method));
     }
   }
 
@@ -169,7 +178,8 @@ public final class ConsoleRegistrarCreatorAction extends HtmlAction {
                       list))
           .collect(
               toImmutableMap(
-                  list -> CurrencyUnit.of(Ascii.toUpperCase(list.get(0))), list -> list.get(1)));
+                  list -> CurrencyUnit.of(Ascii.toUpperCase(list.getFirst())),
+                  list -> list.get(1)));
     } catch (Throwable e) {
       throw new RuntimeException("Error parsing billing accounts - " + e.getMessage(), e);
     }
@@ -233,12 +243,15 @@ public final class ConsoleRegistrarCreatorAction extends HtmlAction {
                       .setZip(optionalZip.orElse(null))
                       .build())
               .build();
-      RegistrarPoc contact =
-          new RegistrarPoc.Builder()
-              .setRegistrar(registrar)
-              .setName(consoleUserEmail.get())
+      User user =
+          new User.Builder()
               .setEmailAddress(consoleUserEmail.get())
-              .setLoginEmailAddress(consoleUserEmail.get())
+              .setUserRoles(
+                  new UserRoles.Builder()
+                      .setRegistrarRoles(
+                          ImmutableMap.of(
+                              registrar.getRegistrarId(), RegistrarRole.ACCOUNT_MANAGER))
+                      .build())
               .build();
       tm().transact(
               () -> {
@@ -246,8 +259,11 @@ public final class ConsoleRegistrarCreatorAction extends HtmlAction {
                     Registrar.loadByRegistrarId(registrar.getRegistrarId()).isEmpty(),
                     "Registrar with client ID %s already exists",
                     registrar.getRegistrarId());
-                tm().putAll(registrar, contact);
+                tm().put(registrar);
               });
+      UserDao.saveUser(user);
+      User.grantIapPermission(
+          user.getEmailAddress(), maybeGroupEmailAddress, cloudTasksUtils, iamClient);
       data.put("password", password);
       data.put("passcode", phonePasscode);
 

core/src/main/java/google/registry/ui/server/registrar/RegistrarSettingsAction.java

@@ -88,22 +88,6 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
   static final String ARGS_PARAM = "args";
   static final String ID_PARAM = "id";
 
-  /**
-   * Allows task enqueueing to be disabled when executing registrar console test cases.
-   *
-   * <p>The existing workflow in UI test cases triggers task enqueueing, which was not an issue with
-   * Task Queue since it's a native App Engine feature simulated by the App Engine SDK's
-   * environment. However, with Cloud Tasks, the server enqueues and fails to deliver to the actual
-   * Cloud Tasks endpoint due to lack of permission.
-   *
-   * <p>One way to allow enqueuing in backend test and avoid enqueuing in UI test is to disable
-   * enqueuing when the test server starts and enable enqueueing once the test server stops. This
-   * can be done by utilizing a ThreadLocal<Boolean> variable isInTestDriver, which is set to false
-   * by default. Enqueuing is allowed only if the value of isInTestDriver is false. It's set to true
-   * in start() and set to false in stop() inside TestDriver.java, a class used in testing.
-   */
-  private static final ThreadLocal<Boolean> isInTestDriver = ThreadLocal.withInitial(() -> false);
-
   @Inject JsonActionRunner jsonActionRunner;
   @Inject RegistrarConsoleMetrics registrarConsoleMetrics;
   @Inject SendEmailUtils sendEmailUtils;
@@ -118,14 +102,6 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
     return contact.getPhoneNumber() != null;
   }
 
-  public static void setIsInTestDriverToFalse() {
-    isInTestDriver.set(false);
-  }
-
-  public static void setIsInTestDriverToTrue() {
-    isInTestDriver.set(true);
-  }
-
   @Override
   public void run() {
     jsonActionRunner.run(this);
@@ -623,7 +599,7 @@ public class RegistrarSettingsAction implements Runnable, JsonActionRunner.JsonA
     if (CollectionUtils.difference(changedKeys, "lastUpdateTime").isEmpty()) {
       return;
     }
-    if (!isInTestDriver.get()) {
+    if (!RegistryEnvironment.isInTestServer()) {
       // Enqueues a sync registrar sheet task if enqueuing is not triggered by console tests and
       // there's an update besides the lastUpdateTime
       cloudTasksUtils.enqueue(

core/src/main/java/google/registry/whois/DomainWhoisResponse.java

@@ -105,7 +105,9 @@ final class DomainWhoisResponse extends WhoisResponseImpl {
                 "Registrar Abuse Contact Phone",
                 abuseContact.map(RegistrarPoc::getPhoneNumber).orElse(""))
             .emitStatusValues(domain.getStatusValues(), domain.getGracePeriods())
-            .emitContact("Registrant", Optional.of(domain.getRegistrant()), preferUnicode)
+            // TODO(mcilwain): Investigate if the WHOIS spec requires us to always output REDACTED
+            //                 text in WHOIS even if the contact is not present, and if so, do so.
+            .emitContact("Registrant", domain.getRegistrant(), preferUnicode)
             .emitContact("Admin", getContactReference(Type.ADMIN), preferUnicode)
             .emitContact("Tech", getContactReference(Type.TECH), preferUnicode)
             .emitContact("Billing", getContactReference(Type.BILLING), preferUnicode)

core/src/test/java/google/registry/beam/common/RegistryJpaReadTest.java

@@ -43,6 +43,7 @@ import google.registry.persistence.transaction.CriteriaQueryBuilder;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
+import java.util.Optional;
 import org.apache.beam.sdk.coders.StringUtf8Coder;
 import org.apache.beam.sdk.testing.PAssert;
 import org.apache.beam.sdk.values.PCollection;
@@ -191,7 +192,7 @@ public class RegistryJpaReadTest {
                     StatusValue.SERVER_UPDATE_PROHIBITED,
                     StatusValue.SERVER_RENEW_PROHIBITED,
                     StatusValue.SERVER_HOLD))
-            .setRegistrant(contact.createVKey())
+            .setRegistrant(Optional.of(contact.createVKey()))
             .setContacts(ImmutableSet.of())
             .setSubordinateHosts(ImmutableSet.of("ns1.example.com"))
             .setPersistedCurrentSponsorRegistrarId(registrar.getRegistrarId())

core/src/test/java/google/registry/beam/rde/RdePipelineTest.java

@@ -31,6 +31,7 @@ import static google.registry.rde.RdeResourceType.HOST;
 import static google.registry.rde.RdeResourceType.REGISTRAR;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.insertSimpleResources;
+import static google.registry.testing.DatabaseHelper.newDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
@@ -83,10 +84,10 @@ import google.registry.rde.PendingDeposit;
 import google.registry.rde.RdeResourceType;
 import google.registry.testing.CloudTasksHelper;
 import google.registry.testing.CloudTasksHelper.TaskMatcher;
-import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeKeyringModule;
 import java.io.IOException;
+import java.util.Optional;
 import java.util.function.Function;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -266,23 +267,23 @@ public class RdePipelineTest {
     persistHostHistory(host1);
     Domain helloDomain =
         persistEppResource(
-            DatabaseHelper.newDomain("hello.soy", contact1)
-                .asBuilder()
-                .addNameserver(host1.createVKey())
-                .build());
+            newDomain("hello.soy", contact1).asBuilder().addNameserver(host1.createVKey()).build());
     persistDomainHistory(helloDomain);
     persistHostHistory(persistActiveHost("not-used-subordinate.hello.soy"));
     Host host2 = persistActiveHost("ns1.hello.soy");
     persistHostHistory(host2);
+
+    // This domain has no registrant.
     Domain kittyDomain =
         persistEppResource(
-            DatabaseHelper.newDomain("kitty.fun", contact2)
+            newDomain("kitty.fun", contact2)
                 .asBuilder()
                 .addNameservers(ImmutableSet.of(host1.createVKey(), host2.createVKey()))
+                .setRegistrant(Optional.empty())
                 .build());
     persistDomainHistory(kittyDomain);
     // Should not appear because the TLD is not included in a pending deposit.
-    persistDomainHistory(persistEppResource(DatabaseHelper.newDomain("lol.cat", contact1)));
+    persistDomainHistory(persistEppResource(newDomain("lol.cat", contact1)));
     // To be deleted.
     Domain deletedDomain = persistActiveDomain("deleted.soy");
     persistDomainHistory(deletedDomain);
@@ -325,7 +326,7 @@ public class RdePipelineTest {
     persistHostHistory(futureHost);
     persistDomainHistory(
         persistEppResource(
-            DatabaseHelper.newDomain("future.soy", futureContact)
+            newDomain("future.soy", futureContact)
                 .asBuilder()
                 .setNameservers(futureHost.createVKey())
                 .build()));
@@ -379,18 +380,30 @@ public class RdePipelineTest {
                         // The same registrars are attached to all the pending deposits.
                         .containsExactly("New Registrar", "The Registrar", "external_monitoring");
                     // Domain fragments.
-                    if ("soy".equals(kv.getKey().tld())) {
-                      assertThat(
-                              getFragmentForType(kv, DOMAIN)
-                                  .map(getXmlElement(DOMAIN_NAME_PATTERN))
-                                  .collect(toImmutableSet()))
-                          .containsExactly("hello.soy");
-                    } else {
-                      assertThat(
-                              getFragmentForType(kv, DOMAIN)
-                                  .map(getXmlElement(DOMAIN_NAME_PATTERN))
-                                  .collect(toImmutableSet()))
-                          .containsExactly("cat.fun");
+                    ImmutableSet<DepositFragment> domainFrags =
+                        getFragmentForType(kv, DOMAIN).collect(toImmutableSet());
+                    assertThat(domainFrags).hasSize(1);
+                    if ("fun".equals(kv.getKey().tld())) {
+                      // Note that this fragment contains no registrant (which is valid).
+                      assertThat(domainFrags.stream().findFirst().get().xml().strip())
+                          .isEqualTo(
+                              """
+                          <rdeDomain:domain>
+                              <rdeDomain:name>cat.fun</rdeDomain:name>
+                              <rdeDomain:roid>15-FUN</rdeDomain:roid>
+                              <rdeDomain:uName>cat.fun</rdeDomain:uName>
+                              <rdeDomain:status s="ok"/>
+                              <rdeDomain:contact type="admin">contact456</rdeDomain:contact>
+                              <rdeDomain:contact type="tech">contact456</rdeDomain:contact>
+                              <rdeDomain:ns>
+                                  <domain:hostObj>ns1.external.tld</domain:hostObj>
+                                  <domain:hostObj>ns1.hello.soy</domain:hostObj>
+                              </rdeDomain:ns>
+                              <rdeDomain:clID>TheRegistrar</rdeDomain:clID>
+                              <rdeDomain:crRr>TheRegistrar</rdeDomain:crRr>
+                              <rdeDomain:crDate>1970-01-01T00:00:00Z</rdeDomain:crDate>
+                              <rdeDomain:exDate>294247-01-10T04:00:54Z</rdeDomain:exDate>
+                          </rdeDomain:domain>""");
                     }
                     if (kv.getKey().mode().equals(FULL)) {
                       // Contact fragments for hello.soy.
@@ -400,12 +413,35 @@ public class RdePipelineTest {
                                     .map(getXmlElement(CONTACT_ID_PATTERN))
                                     .collect(toImmutableSet()))
                             .containsExactly("contact1234", "contact789");
+
                         // Host fragments for hello.soy.
                         assertThat(
                                 getFragmentForType(kv, HOST)
                                     .map(getXmlElement(HOST_NAME_PATTERN))
                                     .collect(toImmutableSet()))
                             .containsExactly("ns1.external.tld", "ns1.lol.cat");
+
+                        // Domain fragments for hello.soy: Note that this contains a registrant.
+                        assertThat(domainFrags.stream().findFirst().get().xml().strip())
+                            .isEqualTo(
+                                """
+                          <rdeDomain:domain>
+                              <rdeDomain:name>hello.soy</rdeDomain:name>
+                              <rdeDomain:roid>E-SOY</rdeDomain:roid>
+                              <rdeDomain:uName>hello.soy</rdeDomain:uName>
+                              <rdeDomain:status s="ok"/>
+                              <rdeDomain:registrant>contact1234</rdeDomain:registrant>
+                              <rdeDomain:contact type="admin">contact789</rdeDomain:contact>
+                              <rdeDomain:contact type="tech">contact1234</rdeDomain:contact>
+                              <rdeDomain:ns>
+                                  <domain:hostObj>ns1.external.tld</domain:hostObj>
+                                  <domain:hostObj>ns1.lol.cat</domain:hostObj>
+                              </rdeDomain:ns>
+                              <rdeDomain:clID>TheRegistrar</rdeDomain:clID>
+                              <rdeDomain:crRr>TheRegistrar</rdeDomain:crRr>
+                              <rdeDomain:crDate>1970-01-01T00:00:00Z</rdeDomain:crDate>
+                              <rdeDomain:exDate>294247-01-10T04:00:54Z</rdeDomain:exDate>
+                          </rdeDomain:domain>""");
                       } else {
                         // Contact fragments for cat.fun.
                         assertThat(
@@ -413,6 +449,7 @@ public class RdePipelineTest {
                                     .map(getXmlElement(CONTACT_ID_PATTERN))
                                     .collect(toImmutableSet()))
                             .containsExactly("contactABC");
+
                         // Host fragments for cat.soy.
                         assertThat(
                                 getFragmentForType(kv, HOST)
@@ -429,6 +466,25 @@ public class RdePipelineTest {
                                           fragment.type().equals(CONTACT)
                                               || fragment.type().equals(HOST)))
                           .isFalse();
+
+                      // Domain fragments for hello.soy: Note that this contains no contact info.
+                      assertThat(domainFrags.stream().findFirst().get().xml().strip())
+                          .isEqualTo(
+                              """
+                          <rdeDomain:domain>
+                              <rdeDomain:name>hello.soy</rdeDomain:name>
+                              <rdeDomain:roid>E-SOY</rdeDomain:roid>
+                              <rdeDomain:uName>hello.soy</rdeDomain:uName>
+                              <rdeDomain:status s="ok"/>
+                              <rdeDomain:ns>
+                                  <domain:hostObj>ns1.external.tld</domain:hostObj>
+                                  <domain:hostObj>ns1.lol.cat</domain:hostObj>
+                              </rdeDomain:ns>
+                              <rdeDomain:clID>TheRegistrar</rdeDomain:clID>
+                              <rdeDomain:crRr>TheRegistrar</rdeDomain:crRr>
+                              <rdeDomain:crDate>1970-01-01T00:00:00Z</rdeDomain:crDate>
+                              <rdeDomain:exDate>294247-01-10T04:00:54Z</rdeDomain:exDate>
+                          </rdeDomain:domain>""");
                     }
                   });
               return null;

core/src/test/java/google/registry/beam/spec11/Spec11PipelineTest.java

@@ -54,6 +54,7 @@ import google.registry.util.Retrier;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Optional;
 import org.apache.beam.sdk.coders.KvCoder;
 import org.apache.beam.sdk.coders.SerializableCoder;
 import org.apache.beam.sdk.options.PipelineOptionsFactory;
@@ -297,7 +298,7 @@ class Spec11PipelineTest {
         .setLastEppUpdateTime(fakeClock.nowUtc())
         .setLastEppUpdateRegistrarId(registrar.getRegistrarId())
         .setLastTransferTime(fakeClock.nowUtc())
-        .setRegistrant(contact.createVKey())
+        .setRegistrant(Optional.of(contact.createVKey()))
         .setPersistedCurrentSponsorRegistrarId(registrar.getRegistrarId())
         .setRegistrationExpirationTime(fakeClock.nowUtc().plusYears(1))
         .setAuthInfo(DomainAuthInfo.create(PasswordAuth.create("password")))

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -3519,6 +3519,22 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     assertSuccessfulCreate("tld", ImmutableSet.of(), token);
   }
 
+  @Test
+  void testSuccess_nonpremiumCreateToken() throws Exception {
+    createTld("example");
+    persistContactsAndHosts();
+    persistResource(
+        new AllocationToken.Builder()
+            .setToken("abc123")
+            .setTokenType(SINGLE_USE)
+            .setRegistrationBehavior(RegistrationBehavior.NONPREMIUM_CREATE)
+            .setDomainName("rich.example")
+            .build());
+    setEppInput(
+        "domain_create_premium_allocationtoken.xml", ImmutableMap.of("YEARS", "1", "FEE", "13.00"));
+    runFlowAssertResponse(loadFile("domain_create_nonpremium_token_response.xml"));
+  }
+
   @Test
   void testFailure_quietPeriod_defaultTokenPresent() throws Exception {
     persistResource(

core/src/test/java/google/registry/flows/domain/DomainDeleteFlowTest.java

@@ -103,6 +103,7 @@ import google.registry.model.transfer.TransferStatus;
 import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.DatabaseHelper;
 import java.util.Map;
+import java.util.Optional;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -162,7 +163,7 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
             DatabaseHelper.newDomain(getUniqueIdFromCommand())
                 .asBuilder()
                 .setCreationTimeForTest(TIME_BEFORE_FLOW)
-                .setRegistrant(contact.createVKey())
+                .setRegistrant(Optional.of(contact.createVKey()))
                 .setRegistrationExpirationTime(expirationTime)
                 .build());
     earlierHistoryEntry =
@@ -738,7 +739,8 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
         DatabaseHelper.newDomain("example1.tld")
             .asBuilder()
             .setRegistrant(
-                loadByForeignKey(Contact.class, "sh8013", clock.nowUtc()).get().createVKey())
+                Optional.of(
+                    loadByForeignKey(Contact.class, "sh8013", clock.nowUtc()).get().createVKey()))
             .setNameservers(ImmutableSet.of(host.createVKey()))
             .setDeletionTime(START_OF_TIME)
             .build());

core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java

@@ -78,6 +78,7 @@ import google.registry.persistence.VKey;
 import google.registry.persistence.transaction.JpaTransactionManagerExtension;
 import google.registry.testing.DatabaseHelper;
 import google.registry.xml.ValidationMode;
+import java.util.Optional;
 import java.util.regex.Pattern;
 import javax.annotation.Nullable;
 import org.joda.money.Money;
@@ -139,7 +140,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
                 .setLastEppUpdateTime(DateTime.parse("1999-12-03T09:00:00.0Z"))
                 .setLastTransferTime(DateTime.parse("2000-04-08T09:00:00.0Z"))
                 .setRegistrationExpirationTime(DateTime.parse("2005-04-03T22:00:00.0Z"))
-                .setRegistrant(registrant.createVKey())
+                .setRegistrant(Optional.of(registrant.createVKey()))
                 .setContacts(
                     ImmutableSet.of(
                         DesignatedContact.create(Type.ADMIN, contact.createVKey()),
@@ -227,6 +228,26 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
     doSuccessfulTest("domain_info_response.xml");
   }
 
+  @Test
+  void testSuccess_noRegistrant() throws Exception {
+    persistTestEntities(false);
+    domain = persistResource(domain.asBuilder().setRegistrant(Optional.empty()).build());
+    doSuccessfulTest("domain_info_response_no_registrant.xml", false);
+  }
+
+  @Test
+  void testSuccess_noContacts() throws Exception {
+    persistTestEntities(false);
+    domain =
+        persistResource(
+            domain
+                .asBuilder()
+                .setRegistrant(Optional.empty())
+                .setContacts(ImmutableSet.of())
+                .build());
+    doSuccessfulTest("domain_info_response_no_contacts.xml", false);
+  }
+
   @Test
   void testSuccess_clTridNotSpecified() throws Exception {
     setEppInput("domain_info_no_cltrid.xml");

core/src/test/java/google/registry/flows/domain/DomainPricingLogicTest.java

@@ -55,6 +55,7 @@ import google.registry.testing.DatabaseHelper;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeHttpSession;
 import google.registry.util.Clock;
+import java.math.BigDecimal;
 import java.util.Optional;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
@@ -146,7 +147,7 @@ public class DomainPricingLogicTest {
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
                 // (13 + 11) * 0.85 == 20.40
-                .addFeeOrCredit(Fee.create(Money.of(USD, 20.4).getAmount(), CREATE, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("20.40"), CREATE, false))
                 .build());
   }
 
@@ -159,7 +160,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -172,7 +173,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 50).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("50.00"), RENEW, false))
                 .build());
   }
 
@@ -185,7 +186,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 100).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
 
@@ -198,7 +199,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 500).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("500.00"), RENEW, true))
                 .build());
   }
 
@@ -215,7 +216,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 100).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
 
@@ -241,7 +242,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 50).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("50.00"), RENEW, true))
                 .build());
   }
 
@@ -281,7 +282,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 500).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("500.00"), RENEW, true))
                 .build());
   }
 
@@ -308,7 +309,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 400).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("400.00"), RENEW, true))
                 .build());
   }
 
@@ -350,7 +351,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -376,7 +377,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 5).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("5.00"), RENEW, false))
                 .build());
   }
 
@@ -394,7 +395,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 50).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("50.00"), RENEW, false))
                 .build());
   }
 
@@ -421,7 +422,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 40).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("40.00"), RENEW, false))
                 .build());
   }
 
@@ -439,7 +440,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -466,7 +467,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 5).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("5.00"), RENEW, false))
                 .build());
   }
 
@@ -484,7 +485,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 50).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("50.00"), RENEW, false))
                 .build());
   }
 
@@ -512,7 +513,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 40).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("40.00"), RENEW, false))
                 .build());
   }
 
@@ -530,7 +531,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -548,7 +549,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 50).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("50.00"), RENEW, false))
                 .build());
   }
 
@@ -567,7 +568,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 1).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("1.00"), RENEW, false))
                 .build());
   }
 
@@ -597,7 +598,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 1).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("1.00"), RENEW, false))
                 .build());
   }
 
@@ -628,7 +629,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 1).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("1.00"), RENEW, false))
                 .build());
     assertThat(
             Iterables.getLast(DatabaseHelper.loadAllOf(BillingRecurrence.class))
@@ -651,7 +652,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 5).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("5.00"), RENEW, false))
                 .build());
   }
 
@@ -679,7 +680,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 5).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("5.00"), RENEW, false))
                 .build());
   }
 
@@ -698,7 +699,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 17).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("17.00"), RENEW, false))
                 .build());
   }
 
@@ -717,7 +718,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 85).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("85.00"), RENEW, false))
                 .build());
   }
 
@@ -739,7 +740,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -750,7 +751,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 100).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
 
@@ -765,7 +766,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -780,7 +781,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 100).getAmount(), RENEW, true))
+                .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
 
@@ -796,7 +797,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -812,7 +813,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 10).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("10.00"), RENEW, false))
                 .build());
   }
 
@@ -829,7 +830,7 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 1.23).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("1.23"), RENEW, false))
                 .build());
   }
 
@@ -846,7 +847,61 @@ public class DomainPricingLogicTest {
         .isEqualTo(
             new FeesAndCredits.Builder()
                 .setCurrency(USD)
-                .addFeeOrCredit(Fee.create(Money.of(USD, 1.23).getAmount(), RENEW, false))
+                .addFeeOrCredit(Fee.create(new BigDecimal("1.23"), RENEW, false))
+                .build());
+  }
+
+  @Test
+  void testGetDomainCreatePrice_nonPremiumCreate_unaffectedRenewal() throws EppException {
+    AllocationToken allocationToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("premium.example")
+                .setRegistrationBehavior(AllocationToken.RegistrationBehavior.NONPREMIUM_CREATE)
+                .build());
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                1,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("13.00"), CREATE, false))
+                .build());
+    // Two-year create should be 13 (standard price) + 100 (premium price)
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                2,
+                false,
+                false,
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("113.00"), CREATE, false))
+                .build());
+    assertThat(
+            domainPricingLogic.getRenewPrice(
+                tld,
+                "premium.example",
+                clock.nowUtc(),
+                1,
+                persistDomainAndSetRecurrence("premium.example", DEFAULT, Optional.empty()),
+                Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("100.00"), RENEW, true))
                 .build());
   }
 }

core/src/test/java/google/registry/flows/domain/DomainUpdateFlowTest.java

@@ -162,7 +162,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
                         DesignatedContact.create(Type.TECH, mak21Contact.createVKey()),
                         DesignatedContact.create(Type.ADMIN, mak21Contact.createVKey()),
                         DesignatedContact.create(Type.BILLING, mak21Contact.createVKey())))
-                .setRegistrant(mak21Contact.createVKey())
+                .setRegistrant(Optional.of(mak21Contact.createVKey()))
                 .setNameservers(ImmutableSet.of(host.createVKey()))
                 .build());
     persistResource(
@@ -338,7 +338,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             .asBuilder()
             .setNameservers(nameservers.build())
             .setContacts(ImmutableSet.copyOf(contacts.subList(0, 3)))
-            .setRegistrant(contacts.get(3).getContactKey())
+            .setRegistrant(Optional.of(contacts.get(3).getContactKey()))
             .build());
     clock.advanceOneMilli();
     assertMutatingFlow(true);
@@ -348,7 +348,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     assertThat(domain.getNameservers()).hasSize(13);
     // getContacts does not return contacts of type REGISTRANT, so check these separately.
     assertThat(domain.getContacts()).hasSize(3);
-    assertThat(loadByKey(domain.getRegistrant()).getContactId()).isEqualTo("max_test_7");
+    assertThat(loadByKey(domain.getRegistrant().get()).getContactId()).isEqualTo("max_test_7");
     assertNoBillingEvents();
     assertDomainDnsRequests("example.tld");
   }
@@ -426,7 +426,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     persistResource(
         DatabaseHelper.newDomain(getUniqueIdFromCommand())
             .asBuilder()
-            .setRegistrant(sh8013.createVKey())
+            .setRegistrant(Optional.of(sh8013.createVKey()))
             .build());
     clock.advanceOneMilli();
     runFlowAssertResponse(loadFile("generic_success_response.xml"));
@@ -441,7 +441,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     persistResource(
         DatabaseHelper.newDomain(getUniqueIdFromCommand())
             .asBuilder()
-            .setRegistrant(sh8013Key)
+            .setRegistrant(Optional.of(sh8013Key))
             .setContacts(
                 ImmutableSet.of(
                     DesignatedContact.create(Type.ADMIN, sh8013Key),
@@ -1590,7 +1590,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             .setAllowedFullyQualifiedHostNames(ImmutableSet.of("ns1.example.foo"))
             .build());
     runFlow();
-    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant()).getContactId())
+    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant().get()).getContactId())
         .isEqualTo("sh8013");
   }
 
@@ -1605,7 +1605,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
         .forEach(
             contact ->
                 assertThat(loadByKey(contact.getContactKey()).getContactId()).isEqualTo("mak21"));
-    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant()).getContactId())
+    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant().get()).getContactId())
         .isEqualTo("mak21");
 
     runFlow();
@@ -1615,7 +1615,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
         .forEach(
             contact ->
                 assertThat(loadByKey(contact.getContactKey()).getContactId()).isEqualTo("sh8013"));
-    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant()).getContactId())
+    assertThat(loadByKey(reloadResourceByForeignKey().getRegistrant().get()).getContactId())
         .isEqualTo("sh8013");
   }
 

core/src/test/java/google/registry/model/OteAccountBuilderTest.java

@@ -15,6 +15,7 @@
 package google.registry.model;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.console.User.IAP_SECURED_WEB_APP_USER_ROLE;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
 import static google.registry.persistence.transaction.JpaTransactionManagerExtension.makeRegistrar1;
@@ -26,16 +27,28 @@ import static google.registry.testing.DatabaseHelper.persistSimpleResource;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
+import com.google.cloud.tasks.v2.HttpMethod;
 import com.google.common.collect.ImmutableList;
+import google.registry.batch.CloudTasksUtils;
+import google.registry.model.console.RegistrarRole;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldState;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
+import google.registry.tools.IamClient;
 import google.registry.util.CidrAddressBlock;
 import google.registry.util.SystemClock;
+import java.util.Optional;
+import javax.annotation.Nullable;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
@@ -50,6 +63,9 @@ public final class OteAccountBuilderTest {
   final JpaIntegrationTestExtension jpa =
       new JpaTestExtensions.Builder().buildIntegrationTestExtension();
 
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+  private final IamClient iamClient = mock(IamClient.class);
+
   @Test
   void testGetRegistrarToTldMap() {
     assertThat(OteAccountBuilder.forRegistrarId("myclientid").getRegistrarIdToTldMap())
@@ -89,23 +105,63 @@ public final class OteAccountBuilderTest {
     assertThat(registrar.getAllowedTlds()).containsExactly(tld);
   }
 
-  private static void assertContactExists(String registrarId, String email) {
-    Registrar registrar = Registrar.loadByRegistrarId(registrarId).get();
-    assertThat(registrar.getContacts().stream().map(RegistrarPoc::getEmailAddress)).contains(email);
-    RegistrarPoc contact =
-        registrar.getContacts().stream()
-            .filter(c -> email.equals(c.getEmailAddress()))
-            .findAny()
-            .get();
-    assertThat(contact.getEmailAddress()).isEqualTo(email);
-    assertThat(contact.getLoginEmailAddress()).isEqualTo(email);
+  public static void verifyUser(String registrarId, String email) {
+    Optional<User> maybeUser = UserDao.loadUser(email);
+    assertThat(maybeUser).isPresent();
+    assertThat(maybeUser.get().getUserRoles().getRegistrarRoles().get(registrarId))
+        .isEqualTo(RegistrarRole.ACCOUNT_MANAGER);
+  }
+
+  public static void verifyIapPermission(
+      @Nullable String emailAddress,
+      Optional<String> maybeGroupEmailAddress,
+      CloudTasksHelper cloudTasksHelper,
+      IamClient iamClient) {
+    if (emailAddress == null) {
+      cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
+      verifyNoInteractions(iamClient);
+    } else {
+      String groupEmailAddress = maybeGroupEmailAddress.orElse(null);
+      if (groupEmailAddress == null) {
+        cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
+        verify(iamClient).addBinding(emailAddress, IAP_SECURED_WEB_APP_USER_ROLE);
+      } else {
+        cloudTasksHelper.assertTasksEnqueued(
+            "console-user-group-update",
+            new TaskMatcher()
+                .service("TOOLS")
+                .method(HttpMethod.POST)
+                .path("/_dr/admin/updateUserGroup")
+                .param("userEmailAddress", emailAddress)
+                .param("groupEmailAddress", groupEmailAddress)
+                .param("groupUpdateMode", "ADD"));
+        verifyNoInteractions(iamClient);
+      }
+    }
+  }
+
+  @Test
+  void testUpdateUserGroup() {
+    CloudTasksUtils cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    OteAccountBuilder.forRegistrarId("myclientid")
+        .addUser("email@example.com")
+        .grantIapPermission(Optional.of("console@example.com"), cloudTasksUtils, iamClient);
+    verifyIapPermission(
+        "email@example.com", Optional.of("console@example.com"), cloudTasksHelper, iamClient);
+  }
+
+  @Test
+  void testGrantIndividualPermission() {
+    CloudTasksUtils cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    OteAccountBuilder.forRegistrarId("myclientid")
+        .addUser("email@example.com")
+        .grantIapPermission(Optional.empty(), cloudTasksUtils, iamClient);
+    verifyIapPermission("email@example.com", Optional.empty(), cloudTasksHelper, iamClient);
   }
 
   @Test
   void testCreateOteEntities_success() {
-    OteAccountBuilder.forRegistrarId("myclientid")
-        .addContact("email@example.com")
-        .buildAndPersist();
+    OteAccountBuilder.forRegistrarId("myclientid").addUser("email@example.com").buildAndPersist();
 
     assertTldExists("myclientid-sunrise", START_DATE_SUNRISE, Money.zero(USD));
     assertTldExists("myclientid-ga", GENERAL_AVAILABILITY, Money.zero(USD));
@@ -114,18 +170,18 @@ public final class OteAccountBuilderTest {
     assertRegistrarExists("myclientid-3", "myclientid-ga");
     assertRegistrarExists("myclientid-4", "myclientid-ga");
     assertRegistrarExists("myclientid-5", "myclientid-eap");
-    assertContactExists("myclientid-1", "email@example.com");
-    assertContactExists("myclientid-3", "email@example.com");
-    assertContactExists("myclientid-4", "email@example.com");
-    assertContactExists("myclientid-5", "email@example.com");
+    verifyUser("myclientid-1", "email@example.com");
+    verifyUser("myclientid-3", "email@example.com");
+    verifyUser("myclientid-4", "email@example.com");
+    verifyUser("myclientid-5", "email@example.com");
   }
 
   @Test
   void testCreateOteEntities_multipleContacts_success() {
     OteAccountBuilder.forRegistrarId("myclientid")
-        .addContact("email@example.com")
-        .addContact("other@example.com")
-        .addContact("someone@example.com")
+        .addUser("email@example.com")
+        .addUser("other@example.com")
+        .addUser("someone@example.com")
         .buildAndPersist();
 
     assertTldExists("myclientid-sunrise", START_DATE_SUNRISE, Money.zero(USD));
@@ -135,18 +191,18 @@ public final class OteAccountBuilderTest {
     assertRegistrarExists("myclientid-3", "myclientid-ga");
     assertRegistrarExists("myclientid-4", "myclientid-ga");
     assertRegistrarExists("myclientid-5", "myclientid-eap");
-    assertContactExists("myclientid-1", "email@example.com");
-    assertContactExists("myclientid-3", "email@example.com");
-    assertContactExists("myclientid-4", "email@example.com");
-    assertContactExists("myclientid-5", "email@example.com");
-    assertContactExists("myclientid-1", "other@example.com");
-    assertContactExists("myclientid-3", "other@example.com");
-    assertContactExists("myclientid-4", "other@example.com");
-    assertContactExists("myclientid-5", "other@example.com");
-    assertContactExists("myclientid-1", "someone@example.com");
-    assertContactExists("myclientid-3", "someone@example.com");
-    assertContactExists("myclientid-4", "someone@example.com");
-    assertContactExists("myclientid-5", "someone@example.com");
+    verifyUser("myclientid-1", "email@example.com");
+    verifyUser("myclientid-3", "email@example.com");
+    verifyUser("myclientid-4", "email@example.com");
+    verifyUser("myclientid-5", "email@example.com");
+    verifyUser("myclientid-1", "other@example.com");
+    verifyUser("myclientid-3", "other@example.com");
+    verifyUser("myclientid-4", "other@example.com");
+    verifyUser("myclientid-5", "other@example.com");
+    verifyUser("myclientid-1", "someone@example.com");
+    verifyUser("myclientid-3", "someone@example.com");
+    verifyUser("myclientid-4", "someone@example.com");
+    verifyUser("myclientid-5", "someone@example.com");
   }
 
   @Test
@@ -223,7 +279,7 @@ public final class OteAccountBuilderTest {
     OteAccountBuilder oteSetupHelper = OteAccountBuilder.forRegistrarId("myclientid");
 
     IllegalStateException thrown =
-        assertThrows(IllegalStateException.class, () -> oteSetupHelper.buildAndPersist());
+        assertThrows(IllegalStateException.class, oteSetupHelper::buildAndPersist);
     assertThat(thrown)
         .hasMessageThat()
         .contains("Found existing object(s) conflicting with OT&E objects");
@@ -236,7 +292,7 @@ public final class OteAccountBuilderTest {
     OteAccountBuilder oteSetupHelper = OteAccountBuilder.forRegistrarId("myclientid");
 
     IllegalStateException thrown =
-        assertThrows(IllegalStateException.class, () -> oteSetupHelper.buildAndPersist());
+        assertThrows(IllegalStateException.class, oteSetupHelper::buildAndPersist);
     assertThat(thrown)
         .hasMessageThat()
         .contains("Found existing object(s) conflicting with OT&E objects");
@@ -261,7 +317,7 @@ public final class OteAccountBuilderTest {
   void testCreateOteEntities_doubleCreation_actuallyReplaces() {
     OteAccountBuilder.forRegistrarId("myclientid")
         .setPassword("oldPassword")
-        .addContact("email@example.com")
+        .addUser("email@example.com")
         .buildAndPersist();
 
     assertThat(Registrar.loadByRegistrarId("myclientid-3").get().verifyPassword("oldPassword"))
@@ -269,7 +325,7 @@ public final class OteAccountBuilderTest {
 
     OteAccountBuilder.forRegistrarId("myclientid")
         .setPassword("newPassword")
-        .addContact("email@example.com")
+        .addUser("email@example.com")
         .setReplaceExisting(true)
         .buildAndPersist();
 
@@ -281,19 +337,17 @@ public final class OteAccountBuilderTest {
 
   @Test
   void testCreateOteEntities_doubleCreation_keepsOldContacts() {
-    OteAccountBuilder.forRegistrarId("myclientid")
-        .addContact("email@example.com")
-        .buildAndPersist();
+    OteAccountBuilder.forRegistrarId("myclientid").addUser("email@example.com").buildAndPersist();
 
-    assertContactExists("myclientid-3", "email@example.com");
+    verifyUser("myclientid-3", "email@example.com");
 
     OteAccountBuilder.forRegistrarId("myclientid")
-        .addContact("other@example.com")
+        .addUser("other@example.com")
         .setReplaceExisting(true)
         .buildAndPersist();
 
-    assertContactExists("myclientid-3", "other@example.com");
-    assertContactExists("myclientid-3", "email@example.com");
+    verifyUser("myclientid-3", "other@example.com");
+    verifyUser("myclientid-3", "email@example.com");
   }
 
   @Test

core/src/test/java/google/registry/model/OteStatsTestHelper.java

@@ -79,9 +79,7 @@ public final class OteStatsTestHelper {
   public static void setupIncompleteOte(String baseClientId) throws IOException {
     createTld("tld");
     persistPremiumList("default_sandbox_list", USD, "sandbox,USD 1000");
-    OteAccountBuilder.forRegistrarId(baseClientId)
-        .addContact("email@example.com")
-        .buildAndPersist();
+    OteAccountBuilder.forRegistrarId(baseClientId).buildAndPersist();
     String oteAccount1 = String.format("%s-1", baseClientId);
     DateTime now = DateTime.now(DateTimeZone.UTC);
     persistResource(

core/src/test/java/google/registry/model/console/UserTest.java

@@ -16,11 +16,21 @@ package google.registry.model.console;
 
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
+import static google.registry.model.console.User.IAP_SECURED_WEB_APP_USER_ROLE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
 
+import com.google.cloud.tasks.v2.HttpMethod;
+import google.registry.batch.CloudTasksUtils;
 import google.registry.model.EntityTestCase;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.DatabaseHelper;
+import google.registry.tools.IamClient;
+import java.util.Optional;
 import org.junit.jupiter.api.Test;
 
 /** Tests for {@link User}. */
@@ -104,4 +114,56 @@ public class UserTest extends EntityTestCase {
     assertThat(user.hasRegistryLockPassword()).isFalse();
     assertThat(user.verifyRegistryLockPassword("foobar")).isFalse();
   }
+
+  @Test
+  void testGrantIapPermission() {
+    CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+    IamClient iamClient = mock(IamClient.class);
+    CloudTasksUtils cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+
+    // Individual permission.
+    User.grantIapPermission("email@example.com", Optional.empty(), cloudTasksUtils, iamClient);
+    cloudTasksHelper.assertNoTasksEnqueued();
+    verify(iamClient).addBinding("email@example.com", IAP_SECURED_WEB_APP_USER_ROLE);
+
+    // Group membership.
+    User.grantIapPermission(
+        "email@example.com", Optional.of("console@example.com"), cloudTasksUtils, iamClient);
+    cloudTasksHelper.assertTasksEnqueued(
+        "console-user-group-update",
+        new TaskMatcher()
+            .service("TOOLS")
+            .method(HttpMethod.POST)
+            .path("/_dr/admin/updateUserGroup")
+            .param("userEmailAddress", "email@example.com")
+            .param("groupEmailAddress", "console@example.com")
+            .param("groupUpdateMode", "ADD"));
+    verifyNoMoreInteractions(iamClient);
+  }
+
+  @Test
+  void testRevokeIapPermission() {
+    CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+    IamClient iamClient = mock(IamClient.class);
+    CloudTasksUtils cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+
+    // Individual permission.
+    User.revokeIapPermission("email@example.com", Optional.empty(), cloudTasksUtils, iamClient);
+    cloudTasksHelper.assertNoTasksEnqueued();
+    verify(iamClient).removeBinding("email@example.com", IAP_SECURED_WEB_APP_USER_ROLE);
+
+    // Group membership.
+    User.revokeIapPermission(
+        "email@example.com", Optional.of("console@example.com"), cloudTasksUtils, iamClient);
+    cloudTasksHelper.assertTasksEnqueued(
+        "console-user-group-update",
+        new TaskMatcher()
+            .service("TOOLS")
+            .method(HttpMethod.POST)
+            .path("/_dr/admin/updateUserGroup")
+            .param("userEmailAddress", "email@example.com")
+            .param("groupEmailAddress", "console@example.com")
+            .param("groupUpdateMode", "REMOVE"));
+    verifyNoMoreInteractions(iamClient);
+  }
 }

core/src/test/java/google/registry/model/domain/DomainSqlTest.java

@@ -54,6 +54,7 @@ import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationW
 import google.registry.testing.FakeClock;
 import google.registry.util.SerializeUtils;
 import java.util.Arrays;
+import java.util.Optional;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -69,7 +70,7 @@ public class DomainSqlTest {
       new JpaTestExtensions.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();
 
   private Domain domain;
-  private VKey<Contact> contactKey;
+  private Optional<VKey<Contact>> contactKey;
   private VKey<Contact> contact2Key;
   private VKey<Host> host1VKey;
   private Host host;
@@ -82,7 +83,7 @@ public class DomainSqlTest {
     saveRegistrar("registrar1");
     saveRegistrar("registrar2");
     saveRegistrar("registrar3");
-    contactKey = createKey(Contact.class, "contact_id1");
+    contactKey = Optional.of(createKey(Contact.class, "contact_id1"));
     contact2Key = createKey(Contact.class, "contact_id2");
 
     host1VKey = createKey(Host.class, "host1");

core/src/test/java/google/registry/model/domain/DomainTest.java

@@ -185,7 +185,7 @@ public class DomainTest {
                             StatusValue.SERVER_UPDATE_PROHIBITED,
                             StatusValue.SERVER_RENEW_PROHIBITED,
                             StatusValue.SERVER_HOLD))
-                    .setRegistrant(contact1Key)
+                    .setRegistrant(Optional.of(contact1Key))
                     .setNameservers(ImmutableSet.of(hostKey))
                     .setSubordinateHosts(ImmutableSet.of("ns1.example.com"))
                     .setPersistedCurrentSponsorRegistrarId("NewRegistrar")
@@ -242,6 +242,16 @@ public class DomainTest {
         .hasValue(domain);
   }
 
+  @Test
+  void testRegistrantNotRequired() {
+    persistResource(domain.asBuilder().setRegistrant(Optional.empty()).build());
+    assertThat(
+            loadByForeignKey(Domain.class, domain.getForeignKey(), fakeClock.nowUtc())
+                .get()
+                .getRegistrant())
+        .isEmpty();
+  }
+
   @Test
   void testEmptyStringsBecomeNull() {
     assertThat(
@@ -1012,17 +1022,17 @@ public class DomainTest {
             DesignatedContact.create(Type.BILLING, contact3Key),
             DesignatedContact.create(Type.TECH, contact4Key)),
         true);
-    assertThat(domain.getRegistrant()).isEqualTo(contact1Key);
-    assertThat(domain.getAdminContact()).isEqualTo(contact2Key);
-    assertThat(domain.getBillingContact()).isEqualTo(contact3Key);
-    assertThat(domain.getTechContact()).isEqualTo(contact4Key);
+    assertThat(domain.getRegistrant()).hasValue(contact1Key);
+    assertThat(domain.getAdminContact()).hasValue(contact2Key);
+    assertThat(domain.getBillingContact()).hasValue(contact3Key);
+    assertThat(domain.getTechContact()).hasValue(contact4Key);
 
     // Make sure everything gets nulled out.
     domain.setContactFields(ImmutableSet.of(), true);
-    assertThat(domain.getRegistrant()).isNull();
-    assertThat(domain.getAdminContact()).isNull();
-    assertThat(domain.getBillingContact()).isNull();
-    assertThat(domain.getTechContact()).isNull();
+    assertThat(domain.getRegistrant()).isEmpty();
+    assertThat(domain.getAdminContact()).isEmpty();
+    assertThat(domain.getBillingContact()).isEmpty();
+    assertThat(domain.getTechContact()).isEmpty();
 
     // Make sure that changes don't affect the registrant unless requested.
     domain.setContactFields(
@@ -1032,16 +1042,16 @@ public class DomainTest {
             DesignatedContact.create(Type.BILLING, contact3Key),
             DesignatedContact.create(Type.TECH, contact4Key)),
         false);
-    assertThat(domain.getRegistrant()).isNull();
-    assertThat(domain.getAdminContact()).isEqualTo(contact2Key);
-    assertThat(domain.getBillingContact()).isEqualTo(contact3Key);
-    assertThat(domain.getTechContact()).isEqualTo(contact4Key);
-    domain = domain.asBuilder().setRegistrant(contact1Key).build();
+    assertThat(domain.getRegistrant()).isEmpty();
+    assertThat(domain.getAdminContact()).hasValue(contact2Key);
+    assertThat(domain.getBillingContact()).hasValue(contact3Key);
+    assertThat(domain.getTechContact()).hasValue(contact4Key);
+    domain = domain.asBuilder().setRegistrant(Optional.of(contact1Key)).build();
     domain.setContactFields(ImmutableSet.of(), false);
-    assertThat(domain.getRegistrant()).isEqualTo(contact1Key);
-    assertThat(domain.getAdminContact()).isNull();
-    assertThat(domain.getBillingContact()).isNull();
-    assertThat(domain.getTechContact()).isNull();
+    assertThat(domain.getRegistrant()).hasValue(contact1Key);
+    assertThat(domain.getAdminContact()).isEmpty();
+    assertThat(domain.getBillingContact()).isEmpty();
+    assertThat(domain.getTechContact()).isEmpty();
   }
 
   @Test

core/src/test/java/google/registry/model/domain/token/AllocationTokenTest.java

@@ -564,6 +564,35 @@ public class AllocationTokenTest extends EntityTestCase {
         .build();
   }
 
+  @Test
+  void testFailures_badNonpremiumCreate() {
+    createTld("tld");
+    AllocationToken validToken =
+        new AllocationToken.Builder()
+            .setToken("abc")
+            .setTokenType(SINGLE_USE)
+            .setRegistrationBehavior(RegistrationBehavior.NONPREMIUM_CREATE)
+            .setDomainName("example.tld")
+            .build();
+    assertThrows(
+        IllegalArgumentException.class, () -> validToken.asBuilder().setDomainName(null).build());
+    assertThrows(
+        IllegalArgumentException.class,
+        () -> validToken.asBuilder().setDiscountFraction(0.5).build());
+    assertThrows(
+        IllegalArgumentException.class,
+        () ->
+            validToken
+                .asBuilder()
+                .setAllowedEppActions(
+                    ImmutableSet.of(
+                        CommandName.RENEW,
+                        CommandName.TRANSFER,
+                        CommandName.RESTORE,
+                        CommandName.UPDATE))
+                .build());
+  }
+
   private void assertBadInitialTransition(TokenStatus status) {
     assertBadTransition(
         ImmutableSortedMap.<DateTime, TokenStatus>naturalOrder()

core/src/test/java/google/registry/model/reporting/Spec11ThreatMatchTest.java

@@ -31,6 +31,7 @@ import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.model.transfer.ContactTransferData;
 import google.registry.persistence.VKey;
+import java.util.Optional;
 import org.joda.time.LocalDate;
 import org.joda.time.format.ISODateTimeFormat;
 import org.junit.jupiter.api.BeforeEach;
@@ -68,7 +69,7 @@ public final class Spec11ThreatMatchTest extends EntityTestCase {
             .setDomainName("foo.tld")
             .setRepoId(domainRepoId)
             .setNameservers(hostVKey)
-            .setRegistrant(registrantContactVKey)
+            .setRegistrant(Optional.of(registrantContactVKey))
             .setContacts(ImmutableSet.of())
             .build();
 

core/src/test/java/google/registry/rdap/RdapDomainActionTest.java

@@ -15,6 +15,7 @@
 package google.registry.rdap;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DatabaseHelper.persistSimpleResources;
@@ -26,6 +27,7 @@ import static google.registry.testing.FullFieldsTestEntityHelper.makeRegistrarPo
 import static google.registry.testing.GsonSubject.assertAboutJson;
 import static org.mockito.Mockito.verify;
 
+import com.google.common.collect.ImmutableSet;
 import com.google.gson.JsonObject;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.Domain;
@@ -278,6 +280,33 @@ class RdapDomainActionTest extends RdapActionBaseTestCase<RdapDomainAction> {
     assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_with_remark.json");
   }
 
+  @Test
+  void testValidDomain_notLoggedIn_contactsShowRedacted_evenWhenRegistrantDoesntExist() {
+    // Even though the registrant is empty on this domain, it still shows a full set of REDACTED
+    // fields through RDAP.
+    persistResource(
+        loadByForeignKey(Domain.class, "cat.lol", clock.nowUtc())
+            .get()
+            .asBuilder()
+            .setRegistrant(Optional.empty())
+            .build());
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_with_remark.json");
+  }
+
+  @Test
+  void testValidDomain_notLoggedIn_contactsShowRedacted_whenNoContactsExist() {
+    // Even though the domain has no contacts, it still shows a full set of REDACTED fields through
+    // RDAP.
+    persistResource(
+        loadByForeignKey(Domain.class, "cat.lol", clock.nowUtc())
+            .get()
+            .asBuilder()
+            .setRegistrant(Optional.empty())
+            .setContacts(ImmutableSet.of())
+            .build());
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_exist_with_remark.json");
+  }
+
   @Test
   void testValidDomain_loggedInAsOtherRegistrar_noContacts() {
     login("idnregistrar");

core/src/test/java/google/registry/rdap/RdapJsonFormatterTest.java

@@ -52,6 +52,8 @@ import google.registry.rdap.RdapObjectClasses.ReplyPayloadBase;
 import google.registry.rdap.RdapObjectClasses.TopLevelReplyObject;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FullFieldsTestEntityHelper;
+import java.util.Optional;
+import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -77,7 +79,7 @@ class RdapJsonFormatterTest {
   private Host hostNoAddresses;
   private Host hostNotLinked;
   private Host hostSuperordinatePendingTransfer;
-  private Contact contactRegistrant;
+  @Nullable private Contact contactRegistrant;
   private Contact contactAdmin;
   private Contact contactTech;
   private Contact contactNotLinked;
@@ -371,7 +373,7 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactRegistrant,
+                    Optional.of(contactRegistrant),
                     ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                     OutputDataType.FULL)
                 .toJson())
@@ -384,7 +386,7 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactRegistrant,
+                    Optional.of(contactRegistrant),
                     ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                     OutputDataType.SUMMARY)
                 .toJson())
@@ -398,7 +400,7 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactRegistrant,
+                    Optional.of(contactRegistrant),
                     ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                     OutputDataType.FULL)
                 .toJson())
@@ -418,7 +420,7 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactRegistrant,
+                    Optional.of(contactRegistrant),
                     ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                     OutputDataType.FULL)
                 .toJson())
@@ -431,7 +433,9 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactAdmin, ImmutableSet.of(RdapEntity.Role.ADMIN), OutputDataType.FULL)
+                    Optional.of(contactAdmin),
+                    ImmutableSet.of(RdapEntity.Role.ADMIN),
+                    OutputDataType.FULL)
                 .toJson())
         .isEqualTo(loadJson("rdapjson_admincontact.json"));
   }
@@ -442,7 +446,9 @@ class RdapJsonFormatterTest {
         .that(
             rdapJsonFormatter
                 .createRdapContactEntity(
-                    contactTech, ImmutableSet.of(RdapEntity.Role.TECH), OutputDataType.FULL)
+                    Optional.of(contactTech),
+                    ImmutableSet.of(RdapEntity.Role.TECH),
+                    OutputDataType.FULL)
                 .toJson())
         .isEqualTo(loadJson("rdapjson_techcontact.json"));
   }
@@ -452,7 +458,8 @@ class RdapJsonFormatterTest {
     assertAboutJson()
         .that(
             rdapJsonFormatter
-                .createRdapContactEntity(contactTech, ImmutableSet.of(), OutputDataType.FULL)
+                .createRdapContactEntity(
+                    Optional.of(contactTech), ImmutableSet.of(), OutputDataType.FULL)
                 .toJson())
         .isEqualTo(loadJson("rdapjson_rolelesscontact.json"));
   }
@@ -462,7 +469,8 @@ class RdapJsonFormatterTest {
     assertAboutJson()
         .that(
             rdapJsonFormatter
-                .createRdapContactEntity(contactNotLinked, ImmutableSet.of(), OutputDataType.FULL)
+                .createRdapContactEntity(
+                    Optional.of(contactNotLinked), ImmutableSet.of(), OutputDataType.FULL)
                 .toJson())
         .isEqualTo(loadJson("rdapjson_unlinkedcontact.json"));
   }

core/src/test/java/google/registry/rde/DomainToXjcConverterTest.java

@@ -70,6 +70,7 @@ import google.registry.xjc.rdedomain.XjcRdeDomainElement;
 import google.registry.xjc.rgp.XjcRgpStatusType;
 import google.registry.xjc.secdns.XjcSecdnsDsDataType;
 import java.io.ByteArrayOutputStream;
+import java.util.Optional;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
@@ -280,9 +281,14 @@ public class DomainToXjcConverterTest {
                     makeHost(clock, "4-Q9JYB4C", "ns2.cat.みんな", "bad:f00d:cafe::15:beef")
                         .createVKey()))
             .setRegistrant(
-                makeContact(
-                        clock, "12-Q9JYB4C", "5372808-ERL", "(◕‿◕) nevermore", "prophet@evil.みんな")
-                    .createVKey())
+                Optional.of(
+                    makeContact(
+                            clock,
+                            "12-Q9JYB4C",
+                            "5372808-ERL",
+                            "(◕‿◕) nevermore",
+                            "prophet@evil.みんな")
+                        .createVKey()))
             .setRegistrationExpirationTime(DateTime.parse("1930-01-01T00:00:00Z"))
             .setGracePeriods(
                 ImmutableSet.of(

core/src/test/java/google/registry/rde/RdeFixtures.java

@@ -51,6 +51,7 @@ import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.testing.FakeClock;
 import google.registry.util.Idn;
+import java.util.Optional;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 
@@ -63,8 +64,9 @@ final class RdeFixtures {
             .setDomainName("example." + tld)
             .setRepoId(generateNewDomainRoid(tld))
             .setRegistrant(
-                makeContact(clock, "5372808-ERL", "(◕‿◕) nevermore", "prophet@evil.みんな")
-                    .createVKey())
+                Optional.of(
+                    makeContact(clock, "5372808-ERL", "(◕‿◕) nevermore", "prophet@evil.みんな")
+                        .createVKey()))
             .build();
     DomainHistory historyEntry =
         persistResource(

core/src/test/java/google/registry/server/RegistryTestServerMain.java

@@ -135,7 +135,7 @@ public final class RegistryTestServerMain {
 
     final RegistryTestServer server = new RegistryTestServer(address);
 
-    System.out.printf("%sLoading SQL fixtures and User service...%s\n", BLUE, RESET);
+    System.out.printf("%sLoading SQL fixtures setting User for authentication...%s\n", BLUE, RESET);
     UserRoles userRoles =
         new UserRoles.Builder().setIsAdmin(loginIsAdmin).setGlobalRole(GlobalRole.FTE).build();
     User user =
@@ -151,7 +151,7 @@ public final class RegistryTestServerMain {
     for (Fixture fixture : fixtures) {
       fixture.load();
     }
-    System.out.printf("%sStarting Jetty6 HTTP Server...%s\n", BLUE, RESET);
+    System.out.printf("%sStarting Jetty HTTP Server...%s\n", BLUE, RESET);
     server.start();
     System.out.printf("%sListening on: %s%s\n", PURPLE, server.getUrl("/"), RESET);
     try {

core/src/test/java/google/registry/server/TestServer.java

@@ -24,7 +24,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.net.HostAndPort;
 import com.google.common.util.concurrent.SimpleTimeLimiter;
-import google.registry.ui.server.registrar.RegistrarSettingsAction;
+import google.registry.util.RegistryEnvironment;
 import google.registry.util.UrlChecker;
 import jakarta.servlet.http.HttpServlet;
 import java.net.MalformedURLException;
@@ -91,7 +91,7 @@ public final class TestServer {
   /** Starts the HTTP server in a new thread and returns once it's online. */
   public void start() {
     try {
-      RegistrarSettingsAction.setIsInTestDriverToTrue();
+      RegistryEnvironment.setIsInTestDriver(true);
       server.start();
     } catch (Exception e) {
       throwIfUnchecked(e);
@@ -129,7 +129,7 @@ public final class TestServer {
               .callWithTimeout(
                   () -> {
                     server.stop();
-                    RegistrarSettingsAction.setIsInTestDriverToFalse();
+                    RegistryEnvironment.setIsInTestDriver(false);
                     return null;
                   },
                   SHUTDOWN_TIMEOUT_MS,

core/src/test/java/google/registry/testing/CloudTasksHelper.java

@@ -80,12 +80,12 @@ import org.joda.time.DateTime;
  * to the same test task container that the original instance pushes to, so that we can make
  * assertions on them by accessing the original instance. We cannot make the test task container
  * itself static because we do not want tasks enqueued in previous tests to interfere with latter
- * tests, when they run on the same JVM (and therefore share the same static class members). To
- * solve this we put the test container in a static map whose keys are the instance IDs. An
- * explicitly created new {@link CloudTasksHelper} (as would be created for a new test method) would
- * have a new ID allocated to it, and therefore stores its tasks in a distinct container. A
- * deserialized {@link CloudTasksHelper}, on the other hand, will have the same instance ID and
- * share the same test class container with its progenitor.
+ * tests when they run on the same JVM (and therefore share the same static class members). To solve
+ * this, we put the test container in a static map whose keys are the instance IDs. An explicitly
+ * created new {@link CloudTasksHelper} (as would be created for a new test method) would have a new
+ * ID allocated to it, and therefore stores its tasks in a distinct container. A deserialized {@link
+ * CloudTasksHelper}, on the other hand, will have the same instance ID and share the same test
+ * class container with its progenitor.
  */
 public class CloudTasksHelper implements Serializable {
 
@@ -131,7 +131,7 @@ public class CloudTasksHelper implements Serializable {
    */
   public void assertTasksEnqueuedWithProperty(
       String queueName, Function<Task, String> propertyGetter, String... expectedTaskProperties) {
-    // Ordering is irrelevant but duplicates should be considered independently.
+    // Ordering is irrelevant, but duplicates should be considered independently.
     assertThat(getTestTasksFor(queueName).stream().map(propertyGetter))
         .containsExactly((Object[]) expectedTaskProperties);
   }
@@ -285,7 +285,7 @@ public class CloudTasksHelper implements Serializable {
               });
       headers = headerBuilder.build();
       ImmutableMultimap.Builder<String, String> paramBuilder = new ImmutableMultimap.Builder<>();
-      // Note that UriParameters.parse() does not throw an IAE on a bad query string (e.g. one
+      // Note that UriParameters.parse() does not throw an IAE on a bad query string (e.g., one
       // where parameters are not properly URL-encoded); it always does a best-effort parse.
       if (method == HttpMethod.GET && uri.getQuery() != null) {
         paramBuilder.putAll(UriParameters.parse(uri.getQuery()));
@@ -382,7 +382,7 @@ public class CloudTasksHelper implements Serializable {
      * the same contract as {@link #equals}, since it will ignore null fields.
      *
      * <p>Match fails if any headers or params expected on the TaskMatcher are not found on the
-     * Task. Note that the inverse is not true (i.e. there may be extra headers on the Task).
+     * Task. Note that the inverse is not true (i.e., there may be extra headers on the Task).
      *
      * <p>Schedule time by default is Timestamp.getDefaultInstance() or null.
      */

core/src/test/java/google/registry/testing/DatabaseHelper.java

@@ -190,7 +190,7 @@ public final class DatabaseHelper {
         .setPersistedCurrentSponsorRegistrarId("TheRegistrar")
         .setCreationTimeForTest(START_OF_TIME)
         .setAuthInfo(DomainAuthInfo.create(PasswordAuth.create("2fooBAR")))
-        .setRegistrant(contactKey)
+        .setRegistrant(Optional.of(contactKey))
         .setContacts(
             ImmutableSet.of(
                 DesignatedContact.create(Type.ADMIN, contactKey),
@@ -603,7 +603,7 @@ public final class DatabaseHelper {
                 .setCreationRegistrarId("TheRegistrar")
                 .setCreationTimeForTest(creationTime)
                 .setRegistrationExpirationTime(expirationTime)
-                .setRegistrant(contact.createVKey())
+                .setRegistrant(Optional.of(contact.createVKey()))
                 .setContacts(
                     ImmutableSet.of(
                         DesignatedContact.create(Type.ADMIN, contact.createVKey()),

core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java

@@ -46,6 +46,7 @@ import google.registry.persistence.VKey;
 import google.registry.util.Idn;
 import java.net.InetAddress;
 import java.util.List;
+import java.util.Optional;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 
@@ -351,7 +352,7 @@ public final class FullFieldsTestEntityHelper {
                     StatusValue.SERVER_UPDATE_PROHIBITED))
             .setDsData(ImmutableSet.of(DomainDsData.create(1, 2, 3, "deadface")));
     if (registrant != null) {
-      builder.setRegistrant(registrant.createVKey());
+      builder.setRegistrant(Optional.of(registrant.createVKey()));
     }
     if ((admin != null) || (tech != null)) {
       ImmutableSet.Builder<DesignatedContact> contactsBuilder = new ImmutableSet.Builder<>();

core/src/test/java/google/registry/tools/CreateUserCommandTest.java

@@ -15,20 +15,22 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
+import static google.registry.model.console.User.IAP_SECURED_WEB_APP_USER_ROLE;
 import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
+import com.google.cloud.tasks.v2.HttpMethod;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
-import com.google.common.net.MediaType;
 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.DatabaseHelper;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
@@ -38,13 +40,13 @@ import org.junit.jupiter.api.Test;
 public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
 
   private final IamClient iamClient = mock(IamClient.class);
-  private final ServiceConnection connection = mock(ServiceConnection.class);
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
 
   @BeforeEach
   void beforeEach() {
     command.iamClient = iamClient;
     command.maybeGroupEmailAddress = Optional.empty();
-    command.setConnection(connection);
+    command.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
   }
 
   @Test
@@ -57,7 +59,7 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
     assertThat(onlyUser.getUserRoles().getRegistrarRoles()).isEmpty();
     verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test
@@ -69,20 +71,16 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
     assertThat(onlyUser.getUserRoles().isAdmin()).isFalse();
     assertThat(onlyUser.getUserRoles().getGlobalRole()).isEqualTo(GlobalRole.NONE);
     assertThat(onlyUser.getUserRoles().getRegistrarRoles()).isEmpty();
-    verify(connection)
-        .sendPostRequest(
-            "/_dr/admin/updateUserGroup",
-            ImmutableMap.of(
-                "userEmailAddress",
-                "user@example.test",
-                "groupEmailAddress",
-                "group@example.test",
-                "groupUpdateMode",
-                "ADD"),
-            MediaType.PLAIN_TEXT_UTF_8,
-            new byte[0]);
+    cloudTasksHelper.assertTasksEnqueued(
+        "console-user-group-update",
+        new TaskMatcher()
+            .method(HttpMethod.POST)
+            .service("TOOLS")
+            .path("/_dr/admin/updateUserGroup")
+            .param("userEmailAddress", "user@example.test")
+            .param("groupEmailAddress", "group@example.test")
+            .param("groupUpdateMode", "ADD"));
     verifyNoInteractions(iamClient);
-    verifyNoMoreInteractions(connection);
   }
 
   @Test
@@ -102,7 +100,7 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
     assertThat(UserDao.loadUser("user@example.test").get().getUserRoles().isAdmin()).isTrue();
     verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test
@@ -112,7 +110,7 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
         .isEqualTo(GlobalRole.FTE);
     verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test
@@ -131,7 +129,7 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
                 RegistrarRole.PRIMARY_CONTACT));
     verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test
@@ -146,7 +144,7 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
         .hasMessageThat()
         .isEqualTo("A user with email user@example.test already exists");
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test

core/src/test/java/google/registry/tools/DeleteUserCommandTest.java

@@ -15,16 +15,17 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
+import static google.registry.model.console.User.IAP_SECURED_WEB_APP_USER_ROLE;
 import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
-import com.google.common.collect.ImmutableMap;
-import com.google.common.net.MediaType;
+import com.google.cloud.tasks.v2.HttpMethod;
 import google.registry.model.console.UserDao;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.DatabaseHelper;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
@@ -34,13 +35,13 @@ import org.junit.jupiter.api.Test;
 public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
 
   private final IamClient iamClient = mock(IamClient.class);
-  private final ServiceConnection connection = mock(ServiceConnection.class);
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
 
   @BeforeEach
   void beforeEach() {
     command.iamClient = iamClient;
-    command.setConnection(connection);
     command.maybeGroupEmailAddress = Optional.empty();
+    command.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
   }
 
   @Test
@@ -51,7 +52,7 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
     assertThat(UserDao.loadUser("email@example.test")).isEmpty();
     verify(iamClient).removeBinding("email@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
     verifyNoMoreInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 
   @Test
@@ -61,20 +62,16 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
     assertThat(UserDao.loadUser("email@example.test")).isPresent();
     runCommandForced("--email", "email@example.test");
     assertThat(UserDao.loadUser("email@example.test")).isEmpty();
-    verify(connection)
-        .sendPostRequest(
-            "/_dr/admin/updateUserGroup",
-            ImmutableMap.of(
-                "userEmailAddress",
-                "email@example.test",
-                "groupEmailAddress",
-                "group@example.test",
-                "groupUpdateMode",
-                "REMOVE"),
-            MediaType.PLAIN_TEXT_UTF_8,
-            new byte[0]);
+    cloudTasksHelper.assertTasksEnqueued(
+        "console-user-group-update",
+        new TaskMatcher()
+            .method(HttpMethod.POST)
+            .service("TOOLS")
+            .path("/_dr/admin/updateUserGroup")
+            .param("userEmailAddress", "email@example.test")
+            .param("groupEmailAddress", "group@example.test")
+            .param("groupUpdateMode", "REMOVE"));
     verifyNoInteractions(iamClient);
-    verifyNoMoreInteractions(connection);
   }
 
   @Test
@@ -86,6 +83,6 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
         .hasMessageThat()
         .isEqualTo("Email does not correspond to a valid user");
     verifyNoInteractions(iamClient);
-    verifyNoInteractions(connection);
+    cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
   }
 }

core/src/test/java/google/registry/tools/SetupOteCommandTest.java

@@ -15,6 +15,8 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.OteAccountBuilderTest.verifyUser;
+import static google.registry.model.console.User.IAP_SECURED_WEB_APP_USER_ROLE;
 import static google.registry.model.registrar.RegistrarBase.State.ACTIVE;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
@@ -26,19 +28,30 @@ import static google.registry.testing.DatabaseHelper.persistResource;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.joda.time.DateTimeZone.UTC;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 import com.beust.jcommander.ParameterException;
+import com.google.cloud.tasks.v2.HttpMethod;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
+import google.registry.model.console.GlobalRole;
+import google.registry.model.console.User;
+import google.registry.model.console.UserDao;
+import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
-import google.registry.model.registrar.RegistrarPoc;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.Tld.TldState;
+import google.registry.testing.CloudTasksHelper;
+import google.registry.testing.CloudTasksHelper.TaskMatcher;
 import google.registry.testing.DeterministicStringGenerator;
 import google.registry.testing.FakeClock;
 import google.registry.util.CidrAddressBlock;
 import java.security.cert.CertificateParsingException;
+import java.util.Optional;
+import javax.annotation.Nullable;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -50,22 +63,24 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
 
   private static final String PASSWORD = "abcdefghijklmnop";
 
-  private DeterministicStringGenerator passwordGenerator =
+  private final IamClient iamClient = mock(IamClient.class);
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+  private final DeterministicStringGenerator passwordGenerator =
       new DeterministicStringGenerator("abcdefghijklmnopqrstuvwxyz");
 
   @BeforeEach
   void beforeEach() {
     command.passwordGenerator = passwordGenerator;
     command.clock = new FakeClock(DateTime.parse("2018-07-07TZ"));
+    command.maybeGroupEmailAddress = Optional.of("group@example.com");
+    command.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    command.iamClient = iamClient;
     persistPremiumList("default_sandbox_list", USD, "sandbox,USD 1000");
   }
 
   /** Verify TLD creation. */
   private void verifyTldCreation(
-      String tldName,
-      String roidSuffix,
-      TldState tldState,
-      boolean isEarlyAccess) {
+      String tldName, String roidSuffix, TldState tldState, boolean isEarlyAccess) {
     Tld registry = Tld.get(tldName);
     assertThat(registry).isNotNull();
     assertThat(registry.getRoidSuffix()).isEqualTo(roidSuffix);
@@ -107,13 +122,28 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
     assertThat(registrar.getClientCertificateHash()).hasValue(SAMPLE_CERT_HASH);
   }
 
-  private void verifyRegistrarContactCreation(String registrarName, String email) {
-    ImmutableSet<RegistrarPoc> registrarPocs = loadRegistrar(registrarName).getContacts();
-    assertThat(registrarPocs).hasSize(1);
-    RegistrarPoc registrarPoc = registrarPocs.stream().findAny().get();
-    assertThat(registrarPoc.getEmailAddress()).isEqualTo(email);
-    assertThat(registrarPoc.getName()).isEqualTo(email);
-    assertThat(registrarPoc.getLoginEmailAddress()).isEqualTo(email);
+  private void verifyIapPermission(@Nullable String emailAddress) {
+    if (emailAddress == null) {
+      cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
+      verifyNoInteractions(iamClient);
+    } else {
+      String groupEmailAddress = command.maybeGroupEmailAddress.orElse(null);
+      if (groupEmailAddress == null) {
+        cloudTasksHelper.assertNoTasksEnqueued("console-user-group-update");
+        verify(iamClient).addBinding(emailAddress, IAP_SECURED_WEB_APP_USER_ROLE);
+      } else {
+        cloudTasksHelper.assertTasksEnqueued(
+            "console-user-group-update",
+            new TaskMatcher()
+                .service("TOOLS")
+                .method(HttpMethod.POST)
+                .path("/_dr/admin/updateUserGroup")
+                .param("userEmailAddress", emailAddress)
+                .param("groupEmailAddress", groupEmailAddress)
+                .param("groupUpdateMode", "ADD"));
+        verifyNoInteractions(iamClient);
+      }
+    }
   }
 
   @Test
@@ -136,10 +166,12 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
     verifyRegistrarCreation("blobio-4", "blobio-ga", PASSWORD, ipAddress);
     verifyRegistrarCreation("blobio-5", "blobio-eap", PASSWORD, ipAddress);
 
-    verifyRegistrarContactCreation("blobio-1", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-3", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-4", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-5", "contact@email.com");
+    verifyUser("blobio-1", "contact@email.com");
+    verifyUser("blobio-3", "contact@email.com");
+    verifyUser("blobio-4", "contact@email.com");
+    verifyUser("blobio-5", "contact@email.com");
+
+    verifyIapPermission("contact@email.com");
   }
 
   @Test
@@ -162,10 +194,12 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
     verifyRegistrarCreation("abc-4", "abc-ga", PASSWORD, ipAddress);
     verifyRegistrarCreation("abc-5", "abc-eap", PASSWORD, ipAddress);
 
-    verifyRegistrarContactCreation("abc-1", "abc@email.com");
-    verifyRegistrarContactCreation("abc-3", "abc@email.com");
-    verifyRegistrarContactCreation("abc-4", "abc@email.com");
-    verifyRegistrarContactCreation("abc-5", "abc@email.com");
+    verifyUser("abc-1", "abc@email.com");
+    verifyUser("abc-3", "abc@email.com");
+    verifyUser("abc-4", "abc@email.com");
+    verifyUser("abc-5", "abc@email.com");
+
+    verifyIapPermission("abc@email.com");
   }
 
   @Test
@@ -180,19 +214,20 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
     verifyTldCreation("blobio-ga", "BLOBIOG2", GENERAL_AVAILABILITY, false);
     verifyTldCreation("blobio-eap", "BLOBIOE3", GENERAL_AVAILABILITY, true);
 
-    ImmutableList<CidrAddressBlock> ipAddresses = ImmutableList.of(
-        CidrAddressBlock.create("1.1.1.1"),
-        CidrAddressBlock.create("2.2.2.2"));
+    ImmutableList<CidrAddressBlock> ipAddresses =
+        ImmutableList.of(CidrAddressBlock.create("1.1.1.1"), CidrAddressBlock.create("2.2.2.2"));
 
     verifyRegistrarCreation("blobio-1", "blobio-sunrise", PASSWORD, ipAddresses);
     verifyRegistrarCreation("blobio-3", "blobio-ga", PASSWORD, ipAddresses);
     verifyRegistrarCreation("blobio-4", "blobio-ga", PASSWORD, ipAddresses);
     verifyRegistrarCreation("blobio-5", "blobio-eap", PASSWORD, ipAddresses);
 
-    verifyRegistrarContactCreation("blobio-1", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-3", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-4", "contact@email.com");
-    verifyRegistrarContactCreation("blobio-5", "contact@email.com");
+    verifyUser("blobio-1", "contact@email.com");
+    verifyUser("blobio-3", "contact@email.com");
+    verifyUser("blobio-4", "contact@email.com");
+    verifyUser("blobio-5", "contact@email.com");
+
+    verifyIapPermission("contact@email.com");
   }
 
   @Test
@@ -206,6 +241,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("option is required: [-a | --ip_allow_list]");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -219,6 +255,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("option is required: [-r | --registrar]");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -232,6 +269,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
     assertThat(thrown)
         .hasMessageThat()
         .contains("Must specify exactly one client certificate file.");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -245,6 +283,36 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--certfile=" + getCertFilename(),
                     "--registrar=blobio"));
     assertThat(thrown).hasMessageThat().contains("option is required: [--email]");
+    verifyIapPermission(null);
+  }
+
+  @Test
+  void testSuccess_noConsoleUserGroup() throws Exception {
+    command.maybeGroupEmailAddress = Optional.empty();
+    runCommandForced(
+        "--ip_allow_list=1.1.1.1",
+        "--registrar=blobio",
+        "--email=contact@email.com",
+        "--certfile=" + getCertFilename());
+
+    verifyTldCreation("blobio-sunrise", "BLOBIOS0", START_DATE_SUNRISE, false);
+    verifyTldCreation("blobio-ga", "BLOBIOG2", GENERAL_AVAILABILITY, false);
+    verifyTldCreation("blobio-eap", "BLOBIOE3", GENERAL_AVAILABILITY, true);
+
+    ImmutableList<CidrAddressBlock> ipAddress =
+        ImmutableList.of(CidrAddressBlock.create("1.1.1.1"));
+
+    verifyRegistrarCreation("blobio-1", "blobio-sunrise", PASSWORD, ipAddress);
+    verifyRegistrarCreation("blobio-3", "blobio-ga", PASSWORD, ipAddress);
+    verifyRegistrarCreation("blobio-4", "blobio-ga", PASSWORD, ipAddress);
+    verifyRegistrarCreation("blobio-5", "blobio-eap", PASSWORD, ipAddress);
+
+    verifyUser("blobio-1", "contact@email.com");
+    verifyUser("blobio-3", "contact@email.com");
+    verifyUser("blobio-4", "contact@email.com");
+    verifyUser("blobio-5", "contact@email.com");
+
+    verifyIapPermission("contact@email.com");
   }
 
   @Test
@@ -259,6 +327,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=/dev/null"));
     assertThat(thrown).hasMessageThat().contains("No X509Certificate found");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -273,6 +342,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("Invalid registrar name: 3blo-bio");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -287,6 +357,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("Invalid registrar name: bl");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -301,6 +372,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("Invalid registrar name: blobiotoooolong");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -315,6 +387,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("Invalid registrar name: blo#bio");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -330,6 +403,7 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("VKey<Tld>(sql:blobio-sunrise)");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -345,6 +419,8 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
 
     verifyTldCreation("blobio-sunrise", "BLOBIOS0", START_DATE_SUNRISE, false);
     verifyTldCreation("blobio-ga", "BLOBIOG2", GENERAL_AVAILABILITY, false);
+
+    verifyIapPermission("contact@email.com");
   }
 
   @Test
@@ -366,6 +442,28 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
                     "--email=contact@email.com",
                     "--certfile=" + getCertFilename()));
     assertThat(thrown).hasMessageThat().contains("VKey<Registrar>(sql:blobio-1)");
+    verifyIapPermission(null);
+  }
+
+  @Test
+  void testFailure_userExists() {
+    User user =
+        new User.Builder()
+            .setEmailAddress("contact@email.com")
+            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
+            .build();
+    UserDao.saveUser(user);
+    IllegalStateException thrown =
+        assertThrows(
+            IllegalStateException.class,
+            () ->
+                runCommandForced(
+                    "--ip_allow_list=1.1.1.1",
+                    "--registrar=blobio",
+                    "--email=contact@email.com",
+                    "--certfile=" + getCertFilename()));
+    assertThat(thrown).hasMessageThat().contains("Found existing users: {contact@email.com");
+    verifyIapPermission(null);
   }
 
   @Test
@@ -385,10 +483,46 @@ class SetupOteCommandTest extends CommandTestCase<SetupOteCommand> {
         "--email=contact@email.com",
         "--certfile=" + getCertFilename());
 
-    ImmutableList<CidrAddressBlock> ipAddress = ImmutableList.of(
-        CidrAddressBlock.create("1.1.1.1"));
+    ImmutableList<CidrAddressBlock> ipAddress =
+        ImmutableList.of(CidrAddressBlock.create("1.1.1.1"));
 
     verifyRegistrarCreation("blobio-1", "blobio-sunrise", PASSWORD, ipAddress);
     verifyRegistrarCreation("blobio-3", "blobio-ga", PASSWORD, ipAddress);
+
+    verifyIapPermission("contact@email.com");
+  }
+
+  @Test
+  void testSuccess_userExists_replaceExisting() throws Exception {
+    User user =
+        new User.Builder()
+            .setEmailAddress("contact@email.com")
+            .setUserRoles(new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).build())
+            .build();
+    UserDao.saveUser(user);
+
+    runCommandForced(
+        "--overwrite",
+        "--ip_allow_list=1.1.1.1",
+        "--registrar=blobio",
+        "--email=contact@email.com",
+        "--certfile=" + getCertFilename());
+
+    ImmutableList<CidrAddressBlock> ipAddress =
+        ImmutableList.of(CidrAddressBlock.create("1.1.1.1"));
+
+    verifyRegistrarCreation("blobio-1", "blobio-sunrise", PASSWORD, ipAddress);
+    verifyRegistrarCreation("blobio-3", "blobio-ga", PASSWORD, ipAddress);
+
+    verifyUser("blobio-1", "contact@email.com");
+    verifyUser("blobio-3", "contact@email.com");
+    verifyUser("blobio-4", "contact@email.com");
+    verifyUser("blobio-5", "contact@email.com");
+
+    // verify that the role is completely replaced, e.g., the global role is gone.
+    assertThat(UserDao.loadUser("contact@email.com").get().getUserRoles().getGlobalRole())
+        .isEqualTo(GlobalRole.NONE);
+
+    verifyIapPermission("contact@email.com");
   }
 }

core/src/test/java/google/registry/ui/server/registrar/ConsoleOteSetupActionTest.java

@@ -15,11 +15,14 @@
 package google.registry.ui.server.registrar;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.OteAccountBuilderTest.verifyIapPermission;
+import static google.registry.model.OteAccountBuilderTest.verifyUser;
 import static google.registry.model.registrar.Registrar.loadByRegistrarId;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static jakarta.servlet.http.HttpServletResponse.SC_UNAUTHORIZED;
 import static org.joda.money.CurrencyUnit.USD;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 
 import com.google.common.collect.ImmutableList;
@@ -35,10 +38,12 @@ import google.registry.request.Action.Method;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;
 import google.registry.security.XsrfTokenManager;
+import google.registry.testing.CloudTasksHelper;
 import google.registry.testing.DeterministicStringGenerator;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
 import google.registry.testing.SystemPropertyExtension;
+import google.registry.tools.IamClient;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.EmailMessage;
 import google.registry.util.RegistryEnvironment;
@@ -65,6 +70,8 @@ public final class ConsoleOteSetupActionTest {
   @Order(value = Integer.MAX_VALUE)
   final SystemPropertyExtension systemPropertyExtension = new SystemPropertyExtension();
 
+  private final IamClient iamClient = mock(IamClient.class);
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
   private final FakeResponse response = new FakeResponse();
   private final ConsoleOteSetupAction action = new ConsoleOteSetupAction();
   private final User user =
@@ -100,6 +107,9 @@ public final class ConsoleOteSetupActionTest {
 
     action.optionalPassword = Optional.empty();
     action.passwordGenerator = new DeterministicStringGenerator("abcdefghijklmnopqrstuvwxyz");
+    action.maybeGroupEmailAddress = Optional.of("group@example.com");
+    action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    action.iamClient = iamClient;
   }
 
   @Test
@@ -142,9 +152,7 @@ public final class ConsoleOteSetupActionTest {
     // checking that all the entities are there or that they have the correct values.
     assertThat(loadByRegistrarId("myclientid-3")).isPresent();
     assertThat(Tld.get("myclientid-ga")).isNotNull();
-    assertThat(
-            loadByRegistrarId("myclientid-5").get().getContacts().asList().get(0).getEmailAddress())
-        .isEqualTo("contact@registry.example");
+    verifyUser("myclientid-5", "contact@registry.example");
     assertThat(response.getPayload())
         .contains("<h1>OT&E successfully created for registrar myclientid!</h1>");
     ArgumentCaptor<EmailMessage> contentCaptor = ArgumentCaptor.forClass(EmailMessage.class);
@@ -163,6 +171,14 @@ public final class ConsoleOteSetupActionTest {
                 Gave user contact@registry.example web access to these Registrars
                 """);
     assertThat(response.getPayload()).contains("gtag('config', 'sampleId')");
+    verifyIapPermission(
+        "contact@registry.example", action.maybeGroupEmailAddress, cloudTasksHelper, iamClient);
+  }
+
+  @Test
+  void testPost_authorized_noConsoleGroup() {
+    action.maybeGroupEmailAddress = Optional.empty();
+    testPost_authorized();
   }
 
   @Test

core/src/test/java/google/registry/ui/server/registrar/ConsoleRegistrarCreatorActionTest.java

@@ -15,10 +15,13 @@
 package google.registry.ui.server.registrar;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.OteAccountBuilderTest.verifyIapPermission;
+import static google.registry.model.OteAccountBuilderTest.verifyUser;
 import static google.registry.model.registrar.Registrar.loadByRegistrarId;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static jakarta.servlet.http.HttpServletResponse.SC_UNAUTHORIZED;
 import static org.joda.money.CurrencyUnit.USD;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 
 import com.google.common.collect.ImmutableList;
@@ -29,17 +32,18 @@ import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
 import google.registry.model.registrar.Registrar;
 import google.registry.model.registrar.RegistrarAddress;
-import google.registry.model.registrar.RegistrarPoc;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.request.Action.Method;
 import google.registry.request.auth.AuthResult;
 import google.registry.request.auth.AuthenticatedRegistrarAccessor;
 import google.registry.security.XsrfTokenManager;
+import google.registry.testing.CloudTasksHelper;
 import google.registry.testing.DeterministicStringGenerator;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
 import google.registry.testing.SystemPropertyExtension;
+import google.registry.tools.IamClient;
 import google.registry.ui.server.SendEmailUtils;
 import google.registry.util.EmailMessage;
 import google.registry.util.RegistryEnvironment;
@@ -73,6 +77,8 @@ final class ConsoleRegistrarCreatorActionTest {
           .setEmailAddress("marla.singer@example.com")
           .setUserRoles(new UserRoles())
           .build();
+  private final CloudTasksHelper cloudTasksHelper = new CloudTasksHelper();
+  private final IamClient iamClient = mock(IamClient.class);
 
   @Mock HttpServletRequest request;
   @Mock GmailClient gmailClient;
@@ -119,6 +125,10 @@ final class ConsoleRegistrarCreatorActionTest {
     action.passcodeGenerator = new DeterministicStringGenerator("314159265");
 
     action.analyticsConfig = ImmutableMap.of("googleAnalyticsId", "sampleId");
+
+    action.maybeGroupEmailAddress = Optional.of("group@example.com");
+    action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    action.iamClient = iamClient;
   }
 
   @Test
@@ -152,8 +162,7 @@ final class ConsoleRegistrarCreatorActionTest {
     assertThat(response.getPayload()).contains("gtag('config', 'sampleId')");
   }
 
-  @Test
-  void testPost_authorized_minimalAddress() {
+  void runTestPost_authorized_minimalAddress() {
     action.clientId = Optional.of("myclientid");
     action.name = Optional.of("registrar name");
     action.billingAccount = Optional.of("USD=billing-account");
@@ -209,14 +218,22 @@ final class ConsoleRegistrarCreatorActionTest {
         .setCountryCode("CC")
         .build());
 
-    assertThat(registrar.getContacts())
-        .containsExactly(
-            new RegistrarPoc.Builder()
-                .setRegistrar(registrar)
-                .setName("myclientid@registry.example")
-                .setEmailAddress("myclientid@registry.example")
-                .setLoginEmailAddress("myclientid@registry.example")
-                .build());
+    verifyUser("myclientid", "myclientid@registry.example");
+  }
+
+  @Test
+  void testPost_authorized_minimalAddress_consoleUserGroup() {
+    runTestPost_authorized_minimalAddress();
+    verifyIapPermission(
+        "myclientid@registry.example", action.maybeGroupEmailAddress, cloudTasksHelper, iamClient);
+  }
+
+  @Test
+  void testPost_authorized_minimalAddress_NoConsoleUserGroup() {
+    action.maybeGroupEmailAddress = Optional.empty();
+    runTestPost_authorized_minimalAddress();
+    verifyIapPermission(
+        "myclientid@registry.example", action.maybeGroupEmailAddress, cloudTasksHelper, iamClient);
   }
 
   @Test

core/src/test/java/google/registry/whois/DomainWhoisResponseTest.java

@@ -41,6 +41,7 @@ import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
 import google.registry.whois.WhoisResponse.WhoisResponseResults;
+import java.util.Optional;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -264,7 +265,7 @@ class DomainWhoisResponseTest {
                         StatusValue.CLIENT_RENEW_PROHIBITED,
                         StatusValue.CLIENT_TRANSFER_PROHIBITED,
                         StatusValue.SERVER_UPDATE_PROHIBITED))
-                .setRegistrant(registrantResourceKey)
+                .setRegistrant(Optional.of(registrantResourceKey))
                 .setContacts(
                     ImmutableSet.of(
                         DesignatedContact.create(DesignatedContact.Type.ADMIN, adminResourceKey),
@@ -291,6 +292,40 @@ class DomainWhoisResponseTest {
         .isEqualTo(WhoisResponseResults.create(loadFile("whois_domain.txt"), 1));
   }
 
+  @Test
+  void getPlainTextOutputTest_noRegistrant() {
+    DomainWhoisResponse domainWhoisResponse =
+        new DomainWhoisResponse(
+            domain.asBuilder().setRegistrant(Optional.empty()).build(),
+            false,
+            "Please contact registrar",
+            clock.nowUtc());
+    assertThat(
+            domainWhoisResponse.getResponse(
+                false,
+                "Doodle Disclaimer\nI exist so that carriage return\nin disclaimer can be tested."))
+        .isEqualTo(WhoisResponseResults.create(loadFile("whois_domain_no_registrant.txt"), 1));
+  }
+
+  @Test
+  void getPlainTextOutputTest_noContacts() {
+    DomainWhoisResponse domainWhoisResponse =
+        new DomainWhoisResponse(
+            domain
+                .asBuilder()
+                .setRegistrant(Optional.empty())
+                .setContacts(ImmutableSet.of())
+                .build(),
+            false,
+            "Please contact registrar",
+            clock.nowUtc());
+    assertThat(
+            domainWhoisResponse.getResponse(
+                false,
+                "Doodle Disclaimer\nI exist so that carriage return\nin disclaimer can be tested."))
+        .isEqualTo(WhoisResponseResults.create(loadFile("whois_domain_no_contacts.txt"), 1));
+  }
+
   @Test
   void getPlainTextOutputTest_registrarAbuseInfoMissing() {
     persistResource(abuseContact.asBuilder().setVisibleInDomainWhoisAsAbuse(false).build());

core/src/test/resources/google/registry/flows/domain/domain_create_nonpremium_token_response.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp xmlns:domain="urn:ietf:params:xml:ns:domain-1.0" xmlns="urn:ietf:params:xml:ns:epp-1.0"
+     xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12"
+>
+    <response>
+        <result code="1000">
+            <msg>Command completed successfully</msg>
+        </result>
+        <resData>
+            <domain:creData>
+                <domain:name>rich.example</domain:name>
+                <domain:crDate>1999-04-03T22:00:00Z</domain:crDate>
+                <domain:exDate>2000-04-03T22:00:00Z</domain:exDate>
+            </domain:creData>
+        </resData>
+        <extension>
+            <fee12:creData>
+                <fee12:currency>USD</fee12:currency>
+                <fee12:fee description="create">13.00</fee12:fee>
+            </fee12:creData>
+        </extension>
+        <trID>
+            <clTRID>ABC-12345</clTRID>
+            <svTRID>server-trid</svTRID>
+        </trID>
+    </response>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_info_response_no_contacts.xml

@@ -0,0 +1,35 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <domain:infData
+       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:roid>%ROID%</domain:roid>
+        <domain:status s="ok"/>
+        <domain:ns>
+          <domain:hostObj>ns1.example.tld</domain:hostObj>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:host>ns1.example.tld</domain:host>
+        <domain:host>ns2.example.tld</domain:host>
+        <domain:clID>NewRegistrar</domain:clID>
+        <domain:crID>TheRegistrar</domain:crID>
+        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
+        <domain:upID>NewRegistrar</domain:upID>
+        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
+        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
+        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:infData>
+    </resData>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_info_response_no_registrant.xml

@@ -0,0 +1,37 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <domain:infData
+       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:roid>%ROID%</domain:roid>
+        <domain:status s="ok"/>
+        <domain:contact type="admin">sh8013</domain:contact>
+        <domain:contact type="tech">sh8013</domain:contact>
+        <domain:ns>
+          <domain:hostObj>ns1.example.tld</domain:hostObj>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:host>ns1.example.tld</domain:host>
+        <domain:host>ns2.example.tld</domain:host>
+        <domain:clID>NewRegistrar</domain:clID>
+        <domain:crID>TheRegistrar</domain:crID>
+        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
+        <domain:upID>NewRegistrar</domain:upID>
+        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
+        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
+        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:infData>
+    </resData>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>

core/src/test/resources/google/registry/rdap/rdap_domain_no_contacts_exist_with_remark.json

@@ -0,0 +1,263 @@
+{
+  "rdapConformance": [
+    "rdap_level_0",
+    "icann_rdap_response_profile_0",
+    "icann_rdap_technical_implementation_guide_0"
+  ],
+  "objectClassName": "domain",
+  "handle": "%DOMAIN_HANDLE_1%",
+  "ldhName": "%DOMAIN_PUNYCODE_NAME_1%",
+  "status": [
+    "client delete prohibited",
+    "client renew prohibited",
+    "client transfer prohibited",
+    "server update prohibited"
+  ],
+  "links": [
+    {
+      "href": "https://example.tld/rdap/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "self"
+    },
+    {
+      "href": "https://rdap.example.com/withSlash/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "related"
+    },
+    {
+      "href": "https://rdap.example.com/withoutSlash/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "related"
+    }
+  ],
+  "events": [
+    {
+      "eventAction": "registration",
+      "eventActor": "TheRegistrar",
+      "eventDate": "1997-01-01T00:00:00.000Z"
+    },
+    {
+      "eventAction": "expiration",
+      "eventDate": "2110-10-08T00:44:59.000Z"
+    },
+    {
+      "eventAction": "last update of RDAP database",
+      "eventDate": "2000-01-01T00:00:00.000Z"
+    },
+    {
+      "eventAction": "last changed",
+      "eventDate": "2009-05-29T20:13:00.000Z"
+    }
+  ],
+  "nameservers": [
+    {
+      "objectClassName": "nameserver",
+      "handle": "%NAMESERVER_HANDLE_1%",
+      "ldhName": "%NAMESERVER_NAME_1%",
+      "links": [
+        {
+          "href": "https://example.tld/rdap/nameserver/%NAMESERVER_NAME_1%",
+          "type": "application/rdap+json",
+          "rel": "self"
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "type": "object truncated due to unexplainable reasons",
+          "description": ["Summary data only. For complete data, send a specific query for the object."]
+        }
+      ]
+    },
+    {
+      "objectClassName": "nameserver",
+      "handle": "%NAMESERVER_HANDLE_2%",
+      "ldhName": "%NAMESERVER_NAME_2%",
+      "links": [
+        {
+          "href": "https://example.tld/rdap/nameserver/%NAMESERVER_NAME_2%",
+          "type": "application/rdap+json",
+          "rel": "self"
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "type": "object truncated due to unexplainable reasons",
+          "description": ["Summary data only. For complete data, send a specific query for the object."]
+        }
+      ]
+    }
+  ],
+  "secureDNS" : {
+    "delegationSigned": true,
+    "zoneSigned":true,
+    "dsData":[
+      {"algorithm":2,"digest":"DEADFACE","digestType":3,"keyTag":1}
+    ]
+  },
+  "entities": [
+    {
+      "objectClassName" : "entity",
+      "handle" : "1",
+      "roles" : ["registrar"],
+      "links" : [
+        {
+          "rel" : "self",
+          "href" : "https://example.tld/rdap/entity/1",
+          "type" : "application/rdap+json"
+        }
+      ],
+      "publicIds" : [
+        {
+          "type" : "IANA Registrar ID",
+          "identifier" : "1"
+        }
+      ],
+      "vcardArray" : [
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", "%REGISTRAR_FULL_NAME_1%"]
+        ]
+      ],
+      "entities" : [
+        {
+          "objectClassName":"entity",
+          "roles":["abuse"],
+          "status":["active"],
+          "vcardArray": [
+            "vcard",
+            [
+              ["version",{},"text","4.0"],
+              ["fn",{},"text","Jake Doe"],
+              ["tel",{"type":["voice"]},"uri","tel:+1.2125551216"],
+              ["tel",{"type":["fax"]},"uri","tel:+1.2125551216"],
+              ["email",{},"text","jakedoe@example.com"]
+            ]
+          ]
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "description": [
+            "Summary data only. For complete data, send a specific query for the object."
+          ],
+          "type": "object truncated due to unexplainable reasons"
+        }
+      ]
+    },
+
+    {
+      "objectClassName":"entity",
+      "handle":"",
+      "remarks":[
+        {
+          "title":"REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description":[
+            "Some of the data in this object has been removed.",
+            "Contact personal data is visible only to the owning registrar."
+          ],
+          "links":[
+            {
+              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
+              "rel":"alternate",
+              "type":"text/html"
+            }
+          ]
+        },
+        {
+          "title":"EMAIL REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description":[
+            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
+          ]
+        }
+      ],
+      "roles":["registrant"],
+      "vcardArray":[
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", ""]
+        ]
+      ]
+    },
+
+    {
+      "objectClassName": "entity",
+      "handle": "",
+      "roles":["administrative"],
+      "remarks": [
+        {
+          "title":"REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description": [
+            "Some of the data in this object has been removed.",
+            "Contact personal data is visible only to the owning registrar."
+          ],
+          "links":[
+            {
+              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
+              "rel":"alternate",
+              "type":"text/html"
+            }
+          ]
+        },
+        {
+          "title":"EMAIL REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description": [
+            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
+          ]
+        }
+      ],
+      "vcardArray":[
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", ""]
+        ]
+      ]
+    },
+
+    {
+      "objectClassName":"entity",
+      "handle":"",
+      "remarks":[
+        {
+          "title":"REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description":[
+            "Some of the data in this object has been removed.",
+            "Contact personal data is visible only to the owning registrar."
+          ],
+          "links":[
+            {
+              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
+              "rel":"alternate",
+              "type":"text/html"
+            }
+          ]
+        },
+        {
+          "description":[
+            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
+          ],
+          "title":"EMAIL REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization"
+        }
+      ],
+      "roles": ["technical"],
+      "vcardArray": [
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", ""]
+        ]
+      ]
+    }
+  ]
+}

core/src/test/resources/google/registry/whois/whois_domain_no_contacts.txt

@@ -0,0 +1,28 @@
+Domain Name: example.tld
+Registry Domain ID: 3-TLD
+Registrar WHOIS Server: whois.nic.fakewhois.example
+Registrar URL: http://my.fake.url
+Updated Date: 2009-05-29T20:13:00Z
+Creation Date: 2000-10-08T00:45:00Z
+Registry Expiry Date: 2010-10-08T00:44:59Z
+Registrar: New Registrar
+Registrar IANA ID: 5555555
+Registrar Abuse Contact Email: jakedoe@theregistrar.com
+Registrar Abuse Contact Phone: +1.2125551216
+Domain Status: addPeriod https://icann.org/epp#addPeriod
+Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
+Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
+Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
+Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
+Domain Status: transferPeriod https://icann.org/epp#transferPeriod
+Name Server: ns01.exampleregistrar.tld
+Name Server: ns02.exampleregistrar.tld
+DNSSEC: signedDelegation
+URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
+>>> Last update of WHOIS database: 2009-05-29T20:15:00Z <<<
+
+For more information on Whois status codes, please visit https://icann.org/epp
+
+Doodle Disclaimer
+I exist so that carriage return
+in disclaimer can be tested.

core/src/test/resources/google/registry/whois/whois_domain_no_registrant.txt

@@ -0,0 +1,53 @@
+Domain Name: example.tld
+Registry Domain ID: 3-TLD
+Registrar WHOIS Server: whois.nic.fakewhois.example
+Registrar URL: http://my.fake.url
+Updated Date: 2009-05-29T20:13:00Z
+Creation Date: 2000-10-08T00:45:00Z
+Registry Expiry Date: 2010-10-08T00:44:59Z
+Registrar: New Registrar
+Registrar IANA ID: 5555555
+Registrar Abuse Contact Email: jakedoe@theregistrar.com
+Registrar Abuse Contact Phone: +1.2125551216
+Domain Status: addPeriod https://icann.org/epp#addPeriod
+Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
+Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
+Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
+Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
+Domain Status: transferPeriod https://icann.org/epp#transferPeriod
+Registry Admin ID: REDACTED FOR PRIVACY
+Admin Name: REDACTED FOR PRIVACY
+Admin Organization: REDACTED FOR PRIVACY
+Admin Street: REDACTED FOR PRIVACY
+Admin City: REDACTED FOR PRIVACY
+Admin State/Province: REDACTED FOR PRIVACY
+Admin Postal Code: REDACTED FOR PRIVACY
+Admin Country: REDACTED FOR PRIVACY
+Admin Phone: REDACTED FOR PRIVACY
+Admin Phone Ext: REDACTED FOR PRIVACY
+Admin Fax: REDACTED FOR PRIVACY
+Admin Email: Please contact registrar
+Registry Tech ID: REDACTED FOR PRIVACY
+Tech Name: REDACTED FOR PRIVACY
+Tech Organization: REDACTED FOR PRIVACY
+Tech Street: REDACTED FOR PRIVACY
+Tech City: REDACTED FOR PRIVACY
+Tech State/Province: REDACTED FOR PRIVACY
+Tech Postal Code: REDACTED FOR PRIVACY
+Tech Country: REDACTED FOR PRIVACY
+Tech Phone: REDACTED FOR PRIVACY
+Tech Phone Ext: REDACTED FOR PRIVACY
+Tech Fax: REDACTED FOR PRIVACY
+Tech Fax Ext: REDACTED FOR PRIVACY
+Tech Email: Please contact registrar
+Name Server: ns01.exampleregistrar.tld
+Name Server: ns02.exampleregistrar.tld
+DNSSEC: signedDelegation
+URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
+>>> Last update of WHOIS database: 2009-05-29T20:15:00Z <<<
+
+For more information on Whois status codes, please visit https://icann.org/epp
+
+Doodle Disclaimer
+I exist so that carriage return
+in disclaimer can be tested.

util/src/main/java/google/registry/util/RegistryEnvironment.java

@@ -14,6 +14,8 @@
 
 package google.registry.util;
 
+import static com.google.common.base.Preconditions.checkState;
+
 import com.google.common.base.Ascii;
 
 /** Registry environments. */
@@ -59,6 +61,20 @@ public enum RegistryEnvironment {
   private static final boolean ON_JETTY =
       Boolean.parseBoolean(System.getProperty(JETTY_PROPERTY, "false"));
 
+  /**
+   * A thread local boolean that can be set in tests to indicate some code is running in a local
+   * test server.
+   *
+   * <p>Certain API calls (like calls to Cloud Tasks) are hard to stub when they run in the test
+   * server because the test server does not allow arbitrary injection of dependencies. Instead,
+   * code running in the server can check this value and decide whether to skip these API calls.
+   *
+   * <p>The value is set to false by default and can only be set to true in unit test environment.
+   * It is set to {@code true} in {@code start()} and {@code false} in {@code stop()} in {@code
+   * TestServer}.
+   */
+  private static final ThreadLocal<Boolean> IN_TEST_SERVER = ThreadLocal.withInitial(() -> false);
+
   /** Sets this enum as the name of the registry environment. */
   public RegistryEnvironment setup() {
     return setup(SystemPropertySetter.PRODUCTION_IMPL);
@@ -81,4 +97,13 @@ public enum RegistryEnvironment {
   public static boolean isOnJetty() {
     return ON_JETTY;
   }
+
+  public static void setIsInTestDriver(boolean value) {
+    checkState(RegistryEnvironment.get() == RegistryEnvironment.UNITTEST);
+    IN_TEST_SERVER.set(value);
+  }
+
+  public static boolean isInTestServer() {
+    return IN_TEST_SERVER.get();
+  }
 }