Filter console registrars per user role (#2501 )

Add simple registry-lock-verification page (#2499 )
This is a fairly simple page that solely exists to display the result from the action, and to link the user back to the domain list.
2026-07-06 00:04:50 +00:00 · 2024-07-24 18:31:23 +00:00 · 2024-07-23 19:04:35 +00:00 · 2024-07-18 20:21:49 +00:00 · 2024-07-18 19:33:52 +00:00 · 2024-07-17 22:06:09 +00:00
33 changed files with 728 additions and 229 deletions
@@ -26,6 +26,7 @@ import { SettingsComponent } from './settings/settings.component';
 import UsersComponent from './settings/users/users.component';
 import WhoisComponent from './settings/whois/whois.component';
 import { SupportComponent } from './support/support.component';
+import { RegistryLockVerifyComponent } from './lock/registryLockVerify.component';

 export interface RouteWithIcon extends Route {
  iconName?: string;
@@ -33,6 +34,10 @@ export interface RouteWithIcon extends Route {

 export const routes: RouteWithIcon[] = [
  { path: '', redirectTo: '/home', pathMatch: 'full' },
+  {
+    path: RegistryLockVerifyComponent.PATH,
+    component: RegistryLockVerifyComponent,
+  },
  { path: 'registrars', component: RegistrarComponent },
  {
    path: 'home',
@@ -53,6 +53,7 @@ import { UserDataService } from './shared/services/userData.service';
 import { SnackBarModule } from './snackbar.module';
 import { SupportComponent } from './support/support.component';
 import { TldsComponent } from './tlds/tlds.component';
+import { RegistryLockVerifyComponent } from './lock/registryLockVerify.component';

@NgModule({
  declarations: [
@@ -71,6 +72,7 @@ import { TldsComponent } from './tlds/tlds.component';
    RegistrarComponent,
    RegistrarDetailsComponent,
    RegistrarSelectorComponent,
+    RegistryLockVerifyComponent,
    ResourcesComponent,
    SecurityComponent,
    SecurityEditComponent,
@@ -0,0 +1,28 @@
+@if (isLoading) {
+<div class="console-app__registry-lock-verify-spinner">
+  <mat-spinner />
+</div>
+} @else if (domainName) {
+<h1 class="mat-headline-4">Success!</h1>
+<div class="console-app__registry-lock-content">
+  <div class="console-app__registry-lock-subhead">
+    The domain {{ domainName }} has been successfully {{ action }}ed.
+  </div>
+</div>
+<div>
+  <a
+    class="text-l"
+    routerLink="{{ DOMAIN_LIST_COMPONENT_PATH }}"
+    [queryParams]="{ registrarId: this.registrarService.registrarId() }"
+    >Return to the list of domains</a
+  >
+</div>
+} @else {
+<h1 class="mat-headline-4">Failure</h1>
+<div class="console-app__registry-lock-content">
+  <div class="console-app__registry-lock-subhead">
+    An error occurred: {{ errorMessage }}.<br /><br />Please double-check the
+    verification code and try again.
+  </div>
+</div>
+}
@@ -0,0 +1,9 @@
+.console-app__registry-lock {
+  &-content {
+    margin-top: 30px;
+  }
+  &-subhead {
+    font-size: 20px;
+    margin-bottom: 20px;
+  }
+}
@@ -0,0 +1,65 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Component } from '@angular/core';
+import { RegistrarService } from '../registrar/registrar.service';
+import { ActivatedRoute, ParamMap } from '@angular/router';
+import { RegistryLockVerifyService } from './registryLockVerify.service';
+import { HttpErrorResponse } from '@angular/common/http';
+import { take } from 'rxjs';
+import { DomainListComponent } from '../domains/domainList.component';
+
+@Component({
+  selector: 'app-registry-lock-verify',
+  templateUrl: './registryLockVerify.component.html',
+  styleUrls: ['./registryLockVerify.component.scss'],
+  providers: [RegistryLockVerifyService],
+})
+export class RegistryLockVerifyComponent {
+  public static PATH = 'registry-lock-verify';
+
+  readonly DOMAIN_LIST_COMPONENT_PATH = `/${DomainListComponent.PATH}`;
+
+  isLoading = true;
+  domainName?: string;
+  action?: string;
+  errorMessage?: string;
+
+  constructor(
+    protected registrarService: RegistrarService,
+    protected registryLockVerifyService: RegistryLockVerifyService,
+    private route: ActivatedRoute
+  ) {}
+
+  ngOnInit() {
+    this.route.queryParamMap.pipe(take(1)).subscribe((params: ParamMap) => {
+      this.registryLockVerifyService
+        .verifyRequest(params.get('lockVerificationCode') || '')
+        .subscribe({
+          error: (err: HttpErrorResponse) => {
+            this.isLoading = false;
+            this.errorMessage = err.error;
+          },
+          next: (verificationResponse) => {
+            this.domainName = verificationResponse.domainName;
+            this.action = verificationResponse.action;
+            this.registrarService.registrarId.set(
+              verificationResponse.registrarId
+            );
+            this.isLoading = false;
+          },
+        });
+    });
+  }
+}
@@ -0,0 +1,31 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { Injectable } from '@angular/core';
+import { BackendService } from '../shared/services/backend.service';
+
+export interface RegistryLockVerificationResponse {
+  action: string;
+  domainName: string;
+  registrarId: string;
+}
+
+@Injectable()
+export class RegistryLockVerifyService {
+  constructor(private backendService: BackendService) {}
+
+  verifyRequest(lockVerificationCode: string) {
+    return this.backendService.verifyRegistryLockRequest(lockVerificationCode);
+  }
+}
@@ -25,6 +25,7 @@ import {
 import { Contact } from '../../settings/contact/contact.service';
 import { EppPasswordBackendModel } from '../../settings/security/security.service';
 import { UserData } from './userData.service';
+import { RegistryLockVerificationResponse } from 'src/app/lock/registryLockVerify.service';

@Injectable()
 export class BackendService {
@@ -169,4 +170,12 @@ export class BackendService {
      whoisRegistrarFields
    );
  }
+
+  verifyRegistryLockRequest(
+    lockVerificationCode: string
+  ): Observable<RegistryLockVerificationResponse> {
+    return this.http.get<RegistryLockVerificationResponse>(
+      `/console-api/registry-lock-verify?lockVerificationCode=${lockVerificationCode}`
+    );
+  }
 }
@@ -24,6 +24,8 @@ import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
 import static google.registry.bsa.persistence.BsaLabelUtils.isLabelBlocked;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.isActiveNow;
 import static google.registry.model.domain.Domain.MAX_REGISTRATION_YEARS;
 import static google.registry.model.domain.token.AllocationToken.TokenType.REGISTER_BSA;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
@@ -481,10 +483,14 @@ public class DomainFlowUtils {
    }
  }

-  static void validateRequiredContactsPresent(
+  static void validateRequiredContactsPresentIfRequiredForDataset(
      Optional<VKey<Contact>> registrant, Set<DesignatedContact> contacts)
      throws RequiredParameterMissingException {
-    // TODO: Check minimum reg data set migration schedule here and don't throw when any are empty.
+    // TODO(b/353347632): Change this flag check to a registry config check.
+    if (isActiveNow(MINIMUM_DATASET_CONTACTS_OPTIONAL)) {
+      // Contacts are not required once we have begun the migration to the minimum dataset
+      return;
+    }
    if (registrant.isEmpty()) {
      throw new MissingRegistrantException();
    }
@@ -1041,7 +1047,8 @@ public class DomainFlowUtils {
    String tldStr = tld.getTldStr();
    validateRegistrantAllowedOnTld(tldStr, command.getRegistrantContactId());
    validateNoDuplicateContacts(command.getContacts());
-    validateRequiredContactsPresent(command.getRegistrant(), command.getContacts());
+    validateRequiredContactsPresentIfRequiredForDataset(
+        command.getRegistrant(), command.getContacts());
    ImmutableSet<String> hostNames = command.getNameserverHostNames();
    validateNameserversCountForTld(tldStr, domainName, hostNames.size());
    validateNameserversAllowedOnTld(tldStr, hostNames);
@@ -38,9 +38,11 @@ import static google.registry.flows.domain.DomainFlowUtils.validateNameserversAl
 import static google.registry.flows.domain.DomainFlowUtils.validateNameserversCountForTld;
 import static google.registry.flows.domain.DomainFlowUtils.validateNoDuplicateContacts;
 import static google.registry.flows.domain.DomainFlowUtils.validateRegistrantAllowedOnTld;
-import static google.registry.flows.domain.DomainFlowUtils.validateRequiredContactsPresent;
+import static google.registry.flows.domain.DomainFlowUtils.validateRequiredContactsPresentIfRequiredForDataset;
 import static google.registry.flows.domain.DomainFlowUtils.verifyClientUpdateNotProhibited;
 import static google.registry.flows.domain.DomainFlowUtils.verifyNotInPendingDelete;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.isActiveNow;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_UPDATE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

@@ -66,6 +68,7 @@ import google.registry.flows.domain.DomainFlowUtils.NameserversNotSpecifiedForTl
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.contact.Contact;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Update;
@@ -87,6 +90,7 @@ import google.registry.model.poll.PendingActionNotificationResponse.DomainPendin
 import google.registry.model.poll.PollMessage;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
 import google.registry.model.tld.Tld;
+import google.registry.persistence.VKey;
 import java.util.Objects;
 import java.util.Optional;
 import javax.inject.Inject;
@@ -248,7 +252,6 @@ public final class DomainUpdateFlow implements MutatingFlow {
    checkSameValuesNotAddedAndRemoved(add.getContacts(), remove.getContacts());
    checkSameValuesNotAddedAndRemoved(add.getStatusValues(), remove.getStatusValues());
    Change change = command.getInnerChange();
-    validateRegistrantIsntBeingRemoved(change);
    Optional<SecDnsUpdateExtension> secDnsUpdate =
        eppInput.getSingleExtension(SecDnsUpdateExtension.class);

@@ -278,7 +281,7 @@ public final class DomainUpdateFlow implements MutatingFlow {
            .removeStatusValues(remove.getStatusValues())
            .removeContacts(remove.getContacts())
            .addContacts(add.getContacts())
-            .setRegistrant(change.getRegistrant().or(domain::getRegistrant))
+            .setRegistrant(determineUpdatedRegistrant(change, domain))
            .setAuthInfo(firstNonNull(change.getAuthInfo(), domain.getAuthInfo()));

    if (!add.getNameservers().isEmpty()) {
@@ -300,13 +303,19 @@ public final class DomainUpdateFlow implements MutatingFlow {
    return domainBuilder.build();
  }

-  private static void validateRegistrantIsntBeingRemoved(Change change) throws EppException {
-    // TODO(mcilwain): Make this check the minimum registration data set migration schedule
-    //                 and not require presence of a registrant in later stages.
+  private Optional<VKey<Contact>> determineUpdatedRegistrant(Change change, Domain domain)
+      throws EppException {
+    // During phase 1 of minimum dataset transition, allow registrant to be removed
    if (change.getRegistrantContactId().isPresent()
        && change.getRegistrantContactId().get().isEmpty()) {
-      throw new MissingRegistrantException();
+      // TODO(b/353347632): Change this flag check to a registry config check.
+      if (isActiveNow(MINIMUM_DATASET_CONTACTS_OPTIONAL)) {
+        return Optional.empty();
+      } else {
+        throw new MissingRegistrantException();
+      }
    }
+    return change.getRegistrant().or(domain::getRegistrant);
  }

  /**
@@ -317,7 +326,8 @@ public final class DomainUpdateFlow implements MutatingFlow {
   * cause Domain update failure.
   */
  private static void validateNewState(Domain newDomain) throws EppException {
-    validateRequiredContactsPresent(newDomain.getRegistrant(), newDomain.getContacts());
+    validateRequiredContactsPresentIfRequiredForDataset(
+        newDomain.getRegistrant(), newDomain.getContacts());
    validateDsData(newDomain.getDsData());
    validateNameserversCountForTld(
        newDomain.getTld(),
@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getSingletonCacheRefreshDuration;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;

 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -150,6 +151,17 @@ public class FeatureFlag extends ImmutableObject implements Buildable {
    return status.getValueAtTime(time);
  }

+  /** Returns if the FeatureFlag with the given FeatureName is active now. */
+  public static boolean isActiveNow(FeatureName featureName) {
+    tm().assertInTransaction();
+    return isActiveAt(featureName, tm().getTransactionTime());
+  }
+
+  /** Returns if the FeatureFlag with the given FeatureName is active at a given time. */
+  public static boolean isActiveAt(FeatureName featureName, DateTime dateTime) {
+    return FeatureFlag.get(featureName).getStatus(dateTime).equals(ACTIVE);
+  }
+
  @Override
  public FeatureFlag.Builder asBuilder() {
    return new FeatureFlag.Builder(clone(this));
@@ -76,7 +76,7 @@ public class RdapEntityAction extends RdapActionBase {
      // they are global, and might have different roles for different domains.
      if (contact.isPresent() && isAuthorized(contact.get())) {
        return rdapJsonFormatter.createRdapContactEntity(
-            contact, ImmutableSet.of(), OutputDataType.FULL);
+            contact.get(), ImmutableSet.of(), OutputDataType.FULL);
      }
    }

@@ -461,7 +461,7 @@ public class RdapEntitySearchAction extends RdapSearchActionBase {
          .entitySearchResultsBuilder()
          .add(
              rdapJsonFormatter.createRdapContactEntity(
-                  Optional.of(contact), ImmutableSet.of(), outputDataType));
+                  contact, ImmutableSet.of(), outputDataType));
      newCursor =
          Optional.of(
              CONTACT_CURSOR_PREFIX
@@ -75,7 +75,6 @@ import java.net.InetAddress;
 import java.net.URI;
 import java.nio.file.Paths;
 import java.util.HashMap;
-import java.util.LinkedHashSet;
 import java.util.Locale;
 import java.util.Optional;
 import java.util.Set;
@@ -251,16 +250,6 @@ public class RdapJsonFormatter {
  private static final Ordering<DesignatedContact> DESIGNATED_CONTACT_ORDERING =
      Ordering.natural().onResultOf(DesignatedContact::getType);

-  /**
-   * The list of RDAP contact roles that are required to be present on each domain.
-   *
-   * <p>Per RDAP Response Profile 2.7.3, A domain MUST have the REGISTRANT, ADMIN, TECH roles and
-   * MAY have others. We also have the BILLING role in our system but it isn't required and is only
-   * listed if actually present.
-   */
-  private static final ImmutableSet<Role> REQUIRED_CONTACT_ROLES =
-      ImmutableSet.of(Role.REGISTRANT, Role.ADMIN, Role.TECH);
-
  /** Creates the TOS notice that is added to every reply. */
  Notice createTosNotice() {
    String linkValue = makeRdapServletRelativeUrl("help", RdapHelpAction.TOS_PATH);
@@ -403,7 +392,6 @@ public class RdapJsonFormatter {

    // Convert the contact entities to RDAP output contacts (this also converts the contact types
    // to RDAP roles).
-    Set<RdapContactEntity> rdapContacts = new LinkedHashSet<>();
    for (VKey<Contact> contactKey : contactsToRoles.keySet()) {
      Set<Role> roles =
          contactsToRoles.get(contactKey).stream()
@@ -412,22 +400,13 @@ public class RdapJsonFormatter {
      if (roles.isEmpty()) {
        continue;
      }
-      rdapContacts.add(
-          createRdapContactEntity(
-              Optional.ofNullable(loadedContacts.get(contactKey)), roles, OutputDataType.INTERNAL));
+      builder
+          .entitiesBuilder()
+          .add(
+              createRdapContactEntity(
+                  loadedContacts.get(contactKey), roles, OutputDataType.INTERNAL));
    }

-    // Loop through all required contact roles and fill in placeholder REDACTED info for any
-    // required ones that are missing, i.e. because of minimum registration data set.
-    for (Role role : REQUIRED_CONTACT_ROLES) {
-      if (rdapContacts.stream().noneMatch(c -> c.roles().contains(role))) {
-        rdapContacts.add(
-            createRdapContactEntity(
-                Optional.empty(), ImmutableSet.of(role), OutputDataType.INTERNAL));
-      }
-    }
-    builder.entitiesBuilder().addAll(rdapContacts);
-
    // Add the nameservers to the data; the load was kicked off above for efficiency.
    // RDAP Response Profile 2.9: we MUST have the nameservers
    for (Host host : HOST_RESOURCE_ORDERING.immutableSortedCopy(loadedHosts)) {
@@ -537,28 +516,20 @@ public class RdapJsonFormatter {
   * @param outputDataType whether to generate full or summary data
   */
  RdapContactEntity createRdapContactEntity(
-      Optional<Contact> contact, Iterable<RdapEntity.Role> roles, OutputDataType outputDataType) {
+      Contact contact, Iterable<RdapEntity.Role> roles, OutputDataType outputDataType) {
    RdapContactEntity.Builder contactBuilder = RdapContactEntity.builder();

    // RDAP Response Profile 2.7.1, 2.7.3 - we MUST have the contacts. 2.7.4 discusses censoring of
    // fields we don't want to show (as opposed to not having contacts at all) because of GDPR etc.
    //
    // 2.8 allows for unredacted output for authorized people.
-    // TODO(mcilwain): Once the RDAP profile is fully updated for minimum registration data set,
-    //                 we will want to not include non-existent contacts at all, rather than
-    //                 pretending they exist and just showing REDACTED info. This is especially
-    //                 important for authorized flows, where you wouldn't expect to see redaction
-    //                 (although no one actually has access to authorized flows yet).
    boolean isAuthorized =
-        contact.isPresent()
-            && rdapAuthorization.isAuthorizedForRegistrar(
-                contact.get().getCurrentSponsorRegistrarId());
+        rdapAuthorization.isAuthorizedForRegistrar(contact.getCurrentSponsorRegistrarId());

    VcardArray.Builder vcardBuilder = VcardArray.builder();

    if (isAuthorized) {
-      fillRdapContactEntityWhenAuthorized(
-          contactBuilder, vcardBuilder, contact.get(), outputDataType);
+      fillRdapContactEntityWhenAuthorized(contactBuilder, vcardBuilder, contact, outputDataType);
    } else {
      // GTLD Registration Data Temp Spec 17may18, Appendix A, 2.3, 2.4 and RDAP Response Profile
      // 2.7.4.1, 2.7.4.2 - the following fields must be redacted:
@@ -343,7 +343,7 @@ public final class DomainLockUtils {
        .orElseThrow(
            () ->
                new IllegalArgumentException(
-                    String.format("Invalid verification code %s", verificationCode)));
+                    String.format("Invalid verification code \"%s\"", verificationCode)));
  }

  private void applyLockStatuses(RegistryLock lock, DateTime lockTime, boolean isAdmin) {
@@ -161,7 +161,7 @@ public abstract class ConsoleApiAction implements Runnable {

    Map<String, Object> registrarDiffMap = registrar.toDiffableFieldMap();
    Stream.of("passwordHash", "salt") // fields to remove from final diff
-        .forEach(fieldToBeRemoved -> registrarDiffMap.remove(fieldToBeRemoved));
+        .forEach(registrarDiffMap::remove);

    // Use LinkedHashMap here to preserve ordering; null values mean we can't use ImmutableMap.
    LinkedHashMap<String, Object> result = new LinkedHashMap<>(registrarDiffMap);
@@ -115,6 +115,7 @@ public class ConsoleDomainListAction extends ConsoleApiAction {
            .setFirstResult(numResultsToSkip)
            .setMaxResults(resultsPerPage)
            .getResultList();
+
    consoleApiParams
        .response()
        .setPayload(gson.toJson(new DomainListResult(domains, checkpoint, actualTotalResults)));
@@ -16,6 +16,7 @@ package google.registry.ui.server.console;

 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Strings.isNullOrEmpty;
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.POST;
@@ -23,6 +24,7 @@ import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;

 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
 import com.google.gson.Gson;
 import google.registry.model.console.ConsolePermission;
@@ -36,6 +38,8 @@ import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.ui.server.registrar.ConsoleApiParams;
 import google.registry.util.StringGenerator;
+import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import javax.inject.Inject;
 import javax.inject.Named;
@@ -50,6 +54,11 @@ public class RegistrarsAction extends ConsoleApiAction {
  private static final int PASSCODE_LENGTH = 5;
  private static final ImmutableList<RegistrarBase.Type> allowedRegistrarTypes =
      ImmutableList.of(Registrar.Type.REAL, RegistrarBase.Type.OTE);
+  private static final String SQL_TEMPLATE =
+      """
+            SELECT * FROM "Registrar"
+            WHERE registrar_id in :registrarIds
+      """;
  static final String PATH = "/console-api/registrars";
  private final Gson gson;
  private final Optional<Registrar> registrar;
@@ -72,18 +81,34 @@ public class RegistrarsAction extends ConsoleApiAction {

  @Override
  protected void getHandler(User user) {
-    if (!user.getUserRoles().hasGlobalPermission(ConsolePermission.VIEW_REGISTRARS)) {
+    if (user.getUserRoles().hasGlobalPermission(ConsolePermission.VIEW_REGISTRARS)) {
+      ImmutableList<Registrar> registrars =
+          Streams.stream(Registrar.loadAll())
+              .filter(r -> allowedRegistrarTypes.contains(r.getType()))
+              .collect(ImmutableList.toImmutableList());
+      consoleApiParams.response().setPayload(gson.toJson(registrars));
+      consoleApiParams.response().setStatus(SC_OK);
+    } else if (user.getUserRoles().getRegistrarRoles().values().stream()
+        .anyMatch(role -> role.hasPermission(ConsolePermission.VIEW_REGISTRAR_DETAILS))) {
+      ImmutableSet<String> accessibleRegistrarIds =
+          user.getUserRoles().getRegistrarRoles().entrySet().stream()
+              .filter(e -> e.getValue().hasPermission(ConsolePermission.VIEW_REGISTRAR_DETAILS))
+              .map(Map.Entry::getKey)
+              .collect(toImmutableSet());
+
+      List<Registrar> registrars =
+          tm().transact(
+                  () ->
+                      tm().getEntityManager()
+                          .createNativeQuery(SQL_TEMPLATE, Registrar.class)
+                          .setParameter("registrarIds", accessibleRegistrarIds)
+                          .getResultList());
+
+      consoleApiParams.response().setPayload(gson.toJson(registrars));
+      consoleApiParams.response().setStatus(SC_OK);
+    } else {
      consoleApiParams.response().setStatus(SC_FORBIDDEN);
-      return;
    }
-
-    ImmutableList<Registrar> registrars =
-        Streams.stream(Registrar.loadAll())
-            .filter(r -> allowedRegistrarTypes.contains(r.getType()))
-            .collect(ImmutableList.toImmutableList());
-
-    consoleApiParams.response().setPayload(gson.toJson(registrars));
-    consoleApiParams.response().setStatus(SC_OK);
  }

  @Override
@@ -151,4 +176,5 @@ public class RegistrarsAction extends ConsoleApiAction {
              tm().putAll(registrar, contact);
            });
  }
+
 }
@@ -16,6 +16,8 @@ package google.registry.flows;

 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_AND_CLOSE;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
@@ -40,6 +42,7 @@ import com.google.re2j.Matcher;
 import com.google.re2j.Pattern;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.reporting.HistoryEntry.Type;
@@ -73,6 +76,12 @@ class EppLifecycleDomainTest extends EppTestCase {

  @BeforeEach
  void beforeEach() {
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    createTlds("example", "tld");
  }

@@ -16,13 +16,19 @@ package google.registry.flows;

 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.createTlds;
+import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppMetricSubject.assertThat;
 import static google.registry.testing.HostSubject.assertAboutHosts;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSortedMap;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.persistence.transaction.JpaTestExtensions;
@@ -88,6 +94,12 @@ class EppLifecycleHostTest extends EppTestCase {

  @Test
  void testRenamingHostToExistingHost_fails() throws Exception {
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    createTld("example");
    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
    // Create the fakesite domain.
@@ -138,6 +150,12 @@ class EppLifecycleHostTest extends EppTestCase {

  @Test
  void testSuccess_multipartTldsWithSharedSuffixes() throws Exception {
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    createTlds("bar.foo.tld", "foo.tld", "tld");

    assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
@@ -17,18 +17,24 @@ package google.registry.flows;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadAtPointInTime;
 import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableObjects;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.loadAllOf;
 import static google.registry.testing.DatabaseHelper.loadByEntity;
 import static google.registry.testing.DatabaseHelper.persistActiveContact;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.joda.time.DateTimeZone.UTC;
 import static org.joda.time.Duration.standardDays;

 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.collect.Iterables;
 import google.registry.flows.EppTestComponent.FakesAndMocksModule;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.monitoring.whitebox.EppMetric;
 import google.registry.persistence.transaction.JpaTestExtensions;
@@ -54,6 +60,12 @@ class EppPointInTimeTest {

  @BeforeEach
  void beforeEach() {
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    createTld("tld");
  }

@@ -25,6 +25,9 @@ import static google.registry.model.billing.BillingBase.Flag.SUNRISE;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.DEFAULT;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.NONPREMIUM;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.SPECIFIED;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.model.domain.fee.Fee.FEE_EXTENSION_URIS;
 import static google.registry.model.domain.token.AllocationToken.TokenType.BULK_PRICING;
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
@@ -156,6 +159,7 @@ import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -224,7 +228,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain

  DomainCreateFlowTest() {
    setEppInput("domain_create.xml", ImmutableMap.of("DOMAIN", "example.tld"));
-    clock.setTo(DateTime.parse("1999-04-03T22:00:00.0Z").minus(Duration.millis(1)));
+    clock.setTo(DateTime.parse("1999-04-03T22:00:00.0Z").minus(Duration.millis(2)));
  }

  @BeforeEach
@@ -250,6 +254,12 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                    "badcrash,NAME_COLLISION"),
                persistReservedList("global-list", "resdom,FULLY_BLOCKED"))
            .build());
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    persistClaimsList(ImmutableMap.of("example-one", CLAIMS_KEY, "test-validate", CLAIMS_KEY));
  }

@@ -2153,6 +2163,20 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_missingRegistrant() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_create_missing_registrant.xml");
+    persistContactsAndHosts();
+    runFlowAssertResponse(
+        loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "example.tld")));
+  }
+
  @Test
  void testFailure_missingAdmin() {
    setEppInput("domain_create_missing_admin.xml");
@@ -2161,6 +2185,20 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_missingAdmin() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_create_missing_admin.xml");
+    persistContactsAndHosts();
+    runFlowAssertResponse(
+        loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "example.tld")));
+  }
+
  @Test
  void testFailure_missingTech() {
    setEppInput("domain_create_missing_tech.xml");
@@ -2169,6 +2207,20 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_missingTech() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_create_missing_tech.xml");
+    persistContactsAndHosts();
+    runFlowAssertResponse(
+        loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "example.tld")));
+  }
+
  @Test
  void testFailure_missingNonRegistrantContacts() {
    setEppInput("domain_create_missing_non_registrant_contacts.xml");
@@ -2177,6 +2229,20 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_missingNonRegistrantContacts() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_create_missing_non_registrant_contacts.xml");
+    persistContactsAndHosts();
+    runFlowAssertResponse(
+        loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "example.tld")));
+  }
+
  @Test
  void testFailure_badIdn() {
    createTld("xn--q9jyb4c");
@@ -19,6 +19,9 @@ import static com.google.common.collect.Sets.union;
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_DELETE_PROHIBITED;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_HOLD;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_RENEW_PROHIBITED;
@@ -96,6 +99,7 @@ import google.registry.flows.exceptions.ResourceStatusProhibitsOperationExceptio
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.contact.Contact;
 import google.registry.model.domain.DesignatedContact;
 import google.registry.model.domain.DesignatedContact.Type;
@@ -140,6 +144,12 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
    createTld("tld");
    // Note that "domain_update.xml" tests adding and removing the same contact type.
    setEppInput("domain_update.xml");
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
  }

  private void persistReferencedEntities() {
@@ -289,6 +299,21 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_emptyRegistrant() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_update_empty_registrant.xml");
+    persistReferencedEntities();
+    persistDomain();
+    runFlowAssertResponse(loadFile("generic_success_response.xml"));
+    assertThat(reloadResourceByForeignKey().getRegistrant()).isEmpty();
+  }
+
  private void modifyDomainToHave13Nameservers() throws Exception {
    ImmutableSet.Builder<VKey<Host>> nameservers = new ImmutableSet.Builder<>();
    for (int i = 1; i < 15; i++) {
@@ -1478,6 +1503,27 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_removeAdmin() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_update_remove_admin.xml");
+    persistReferencedEntities();
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setContacts(
+                ImmutableSet.of(
+                    DesignatedContact.create(Type.ADMIN, sh8013Contact.createVKey()),
+                    DesignatedContact.create(Type.TECH, sh8013Contact.createVKey())))
+            .build());
+    runFlowAssertResponse(loadFile("generic_success_response.xml"));
+  }
+
  @Test
  void testFailure_removeTech() throws Exception {
    setEppInput("domain_update_remove_tech.xml");
@@ -1494,6 +1540,27 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_minimumDatasetPhase1_removeTech() throws Exception {
+    persistResource(
+        FeatureFlag.get(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .asBuilder()
+            .setStatusMap(
+                ImmutableSortedMap.of(START_OF_TIME, INACTIVE, clock.nowUtc().minusDays(5), ACTIVE))
+            .build());
+    setEppInput("domain_update_remove_tech.xml");
+    persistReferencedEntities();
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setContacts(
+                ImmutableSet.of(
+                    DesignatedContact.create(Type.ADMIN, sh8013Contact.createVKey()),
+                    DesignatedContact.create(Type.TECH, sh8013Contact.createVKey())))
+            .build());
+    runFlowAssertResponse(loadFile("generic_success_response.xml"));
+  }
+
  @Test
  void testFailure_addPendingDeleteContact() throws Exception {
    persistReferencedEntities();
@@ -20,6 +20,7 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.loadByEntity;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
@@ -185,4 +186,21 @@ public class FeatureFlagTest extends EntityTestCase {
        .hasMessageThat()
        .isEqualTo("Must provide transition entry for the start of time (Unix Epoch)");
  }
+
+  @Test
+  void testSuccess_isActiveNow() {
+    fakeClock.setTo(DateTime.parse("2010-10-17TZ"));
+    persistResource(
+        new FeatureFlag.Builder()
+            .setFeatureName(TEST_FEATURE)
+            .setStatusMap(
+                ImmutableSortedMap.<DateTime, FeatureStatus>naturalOrder()
+                    .put(START_OF_TIME, INACTIVE)
+                    .put(fakeClock.nowUtc().plusWeeks(8), ACTIVE)
+                    .build())
+            .build());
+    assertThat(tm().transact(() -> FeatureFlag.isActiveNow(TEST_FEATURE))).isFalse();
+    fakeClock.setTo(DateTime.parse("2011-10-17TZ"));
+    assertThat(tm().transact(() -> FeatureFlag.isActiveNow(TEST_FEATURE))).isTrue();
+  }
 }
@@ -276,27 +276,23 @@ class RdapDomainActionTest extends RdapActionBaseTestCase<RdapDomainAction> {
  }

  @Test
-  void testValidDomain_notLoggedIn_noContacts() {
-    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_with_remark.json");
+  void testValidDomain_notLoggedIn_redactsAllContactInfo() {
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_redacted_contacts_with_remark.json");
  }

  @Test
-  void testValidDomain_notLoggedIn_contactsShowRedacted_evenWhenRegistrantDoesntExist() {
-    // Even though the registrant is empty on this domain, it still shows a full set of REDACTED
-    // fields through RDAP.
+  void testValidDomain_notLoggedIn_showsNoRegistrant_whenRegistrantDoesntExist() {
    persistResource(
        loadByForeignKey(Domain.class, "cat.lol", clock.nowUtc())
            .get()
            .asBuilder()
            .setRegistrant(Optional.empty())
            .build());
-    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_with_remark.json");
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_registrant_with_remark.json");
  }

  @Test
-  void testValidDomain_notLoggedIn_contactsShowRedacted_whenNoContactsExist() {
-    // Even though the domain has no contacts, it still shows a full set of REDACTED fields through
-    // RDAP.
+  void testValidDomain_notLoggedIn_containsNoContactEntities_whenNoContactsExist() {
    persistResource(
        loadByForeignKey(Domain.class, "cat.lol", clock.nowUtc())
            .get()
@@ -308,24 +304,38 @@ class RdapDomainActionTest extends RdapActionBaseTestCase<RdapDomainAction> {
  }

  @Test
-  void testValidDomain_loggedInAsOtherRegistrar_noContacts() {
+  void testValidDomain_loggedIn_containsNoContactEntities_whenNoContactsExist() {
+    login("evilregistrar");
+    persistResource(
+        loadByForeignKey(Domain.class, "cat.lol", clock.nowUtc())
+            .get()
+            .asBuilder()
+            .setRegistrant(Optional.empty())
+            .setContacts(ImmutableSet.of())
+            .build());
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_exist_with_remark.json");
+  }
+
+  @Test
+  void testValidDomain_loggedInAsOtherRegistrar_redactsAllContactInfo() {
    login("idnregistrar");
-    assertProperResponseForCatLol("cat.lol", "rdap_domain_no_contacts_with_remark.json");
+    assertProperResponseForCatLol("cat.lol", "rdap_domain_redacted_contacts_with_remark.json");
  }

  @Test
  void testUpperCase_ignored() {
-    assertProperResponseForCatLol("CaT.lOl", "rdap_domain_no_contacts_with_remark.json");
+    assertProperResponseForCatLol("CaT.lOl", "rdap_domain_redacted_contacts_with_remark.json");
  }

  @Test
  void testTrailingDot_ignored() {
-    assertProperResponseForCatLol("cat.lol.", "rdap_domain_no_contacts_with_remark.json");
+    assertProperResponseForCatLol("cat.lol.", "rdap_domain_redacted_contacts_with_remark.json");
  }

  @Test
  void testQueryParameter_ignored() {
-    assertProperResponseForCatLol("cat.lol?key=value", "rdap_domain_no_contacts_with_remark.json");
+    assertProperResponseForCatLol(
+        "cat.lol?key=value", "rdap_domain_redacted_contacts_with_remark.json");
  }

  @Test
@@ -750,7 +750,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
  void testDomainMatch_found_loggedInAsOtherRegistrar() {
    login("otherregistrar");
    runSuccessfulTestWithCatLol(
-        RequestType.NAME, "cat.lol", "rdap_domain_no_contacts_with_remark.json");
+        RequestType.NAME, "cat.lol", "rdap_domain_redacted_contacts_with_remark.json");
    verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
  }

@@ -782,7 +782,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
            .addRegistrar("St. John Chrysostom")
            .addNameserver("ns1.cat.lol", "8-ROID")
            .addNameserver("ns2.external.tld", "1F-ROID")
-            .load("rdap_domain_no_contacts_with_remark.json"));
+            .load("rdap_domain_redacted_contacts_with_remark.json"));
    verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
  }

@@ -826,7 +826,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "35-ROID")
            .addNameserver("ns2.cat.2.test", "37-ROID")
-            .load("rdap_domain_no_contacts_with_remark.json"));
+            .load("rdap_domain_redacted_contacts_with_remark.json"));
    verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
  }

@@ -840,7 +840,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "35-ROID")
            .addNameserver("ns2.cat.2.test", "37-ROID")
-            .load("rdap_domain_no_contacts_with_remark.json"));
+            .load("rdap_domain_redacted_contacts_with_remark.json"));
    verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
  }

@@ -1378,7 +1378,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "35-ROID")
            .addNameserver("ns2.cat.2.test", "37-ROID")
-            .load("rdap_domain_no_contacts_with_remark.json"));
+            .load("rdap_domain_redacted_contacts_with_remark.json"));
    verifyMetrics(SearchType.BY_NAMESERVER_NAME, 1, 1);
  }

@@ -1392,7 +1392,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
            .addRegistrar("1.test")
            .addNameserver("ns1.cat.1.test", "35-ROID")
            .addNameserver("ns2.cat.2.test", "37-ROID")
-            .load("rdap_domain_no_contacts_with_remark.json"));
+            .load("rdap_domain_redacted_contacts_with_remark.json"));
    verifyMetrics(SearchType.BY_NAMESERVER_NAME, 1, 1);
  }

@@ -1675,7 +1675,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
    runSuccessfulTestWithCatLol(
        RequestType.NS_IP,
        "bad:f00d:cafe:0:0:0:15:beef",
-        "rdap_domain_no_contacts_with_remark.json");
+        "rdap_domain_redacted_contacts_with_remark.json");
    verifyMetrics(SearchType.BY_NAMESERVER_ADDRESS, 1, 1);
  }

@@ -52,7 +52,6 @@ import google.registry.rdap.RdapObjectClasses.ReplyPayloadBase;
 import google.registry.rdap.RdapObjectClasses.TopLevelReplyObject;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FullFieldsTestEntityHelper;
-import java.util.Optional;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
 import org.junit.jupiter.api.BeforeEach;
@@ -373,7 +372,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactRegistrant),
+                    contactRegistrant,
                    ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                    OutputDataType.FULL)
                .toJson())
@@ -386,7 +385,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactRegistrant),
+                    contactRegistrant,
                    ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                    OutputDataType.SUMMARY)
                .toJson())
@@ -400,7 +399,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactRegistrant),
+                    contactRegistrant,
                    ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                    OutputDataType.FULL)
                .toJson())
@@ -420,7 +419,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactRegistrant),
+                    contactRegistrant,
                    ImmutableSet.of(RdapEntity.Role.REGISTRANT),
                    OutputDataType.FULL)
                .toJson())
@@ -433,9 +432,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactAdmin),
-                    ImmutableSet.of(RdapEntity.Role.ADMIN),
-                    OutputDataType.FULL)
+                    contactAdmin, ImmutableSet.of(RdapEntity.Role.ADMIN), OutputDataType.FULL)
                .toJson())
        .isEqualTo(loadJson("rdapjson_admincontact.json"));
  }
@@ -446,9 +443,7 @@ class RdapJsonFormatterTest {
        .that(
            rdapJsonFormatter
                .createRdapContactEntity(
-                    Optional.of(contactTech),
-                    ImmutableSet.of(RdapEntity.Role.TECH),
-                    OutputDataType.FULL)
+                    contactTech, ImmutableSet.of(RdapEntity.Role.TECH), OutputDataType.FULL)
                .toJson())
        .isEqualTo(loadJson("rdapjson_techcontact.json"));
  }
@@ -458,8 +453,7 @@ class RdapJsonFormatterTest {
    assertAboutJson()
        .that(
            rdapJsonFormatter
-                .createRdapContactEntity(
-                    Optional.of(contactTech), ImmutableSet.of(), OutputDataType.FULL)
+                .createRdapContactEntity(contactTech, ImmutableSet.of(), OutputDataType.FULL)
                .toJson())
        .isEqualTo(loadJson("rdapjson_rolelesscontact.json"));
  }
@@ -469,8 +463,7 @@ class RdapJsonFormatterTest {
    assertAboutJson()
        .that(
            rdapJsonFormatter
-                .createRdapContactEntity(
-                    Optional.of(contactNotLinked), ImmutableSet.of(), OutputDataType.FULL)
+                .createRdapContactEntity(contactNotLinked, ImmutableSet.of(), OutputDataType.FULL)
                .toJson())
        .isEqualTo(loadJson("rdapjson_unlinkedcontact.json"));
  }
@@ -15,16 +15,22 @@
 package google.registry.tools;

 import static google.registry.model.EppResourceUtils.loadByForeignKey;
+import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATASET_CONTACTS_OPTIONAL;
+import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.testing.DatabaseHelper.assertBillingEventsForResource;
 import static google.registry.testing.DatabaseHelper.createTlds;
 import static google.registry.testing.DatabaseHelper.getOnlyHistoryEntryOfType;
+import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;

 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSortedMap;
 import google.registry.flows.EppTestCase;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.reporting.HistoryEntry.Type;
@@ -53,6 +59,12 @@ class EppLifecycleToolsTest extends EppTestCase {

  @BeforeEach
  void beforeEach() {
+    persistResource(
+        new FeatureFlag()
+            .asBuilder()
+            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
+            .setStatusMap(ImmutableSortedMap.of(START_OF_TIME, INACTIVE))
+            .build());
    createTlds("example", "tld");
  }

@@ -156,7 +156,7 @@ public class ConsoleRegistryLockVerifyActionTest {
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_BAD_REQUEST);
    assertThat(response.getPayload())
-        .isEqualTo("Invalid verification code 123456789ABCDEFGHJKLMNPQRSTUUUUU");
+        .isEqualTo("Invalid verification code \"123456789ABCDEFGHJKLMNPQRSTUUUUU\"");
    assertThat(loadByEntity(defaultDomain).getStatusValues()).containsExactly(StatusValue.INACTIVE);
  }

@@ -21,7 +21,6 @@ import static google.registry.testing.DatabaseHelper.persistNewRegistrar;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.SqlHelper.saveRegistrar;
 import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
-import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.when;
@@ -148,6 +147,28 @@ class RegistrarsActionTest {
        .isTrue();
  }

+  @Test
+  void testSuccess_getOnlyAllowedRegistrars() {
+    saveRegistrar("registrarId");
+
+    RegistrarsAction action =
+        createAction(
+            Action.Method.GET,
+            AuthResult.createUser(
+                createUser(
+                    new UserRoles.Builder()
+                        .setRegistrarRoles(
+                            ImmutableMap.of("registrarId", RegistrarRole.ACCOUNT_MANAGER))
+                        .build())));
+
+    action.run();
+    assertThat(((FakeResponse) consoleApiParams.response()).getStatus()).isEqualTo(SC_OK);
+    String payload = ((FakeResponse) consoleApiParams.response()).getPayload();
+    Registrar[] registrars = GSON.fromJson(payload, Registrar[].class);
+    assertThat(registrars).hasLength(1);
+    assertThat(registrars[0].getRegistrarId()).isEqualTo("registrarId");
+  }
+
  @Test
  void testSuccess_createRegistrar() {
    RegistrarsAction action =
@@ -205,23 +226,6 @@ class RegistrarsActionTest {
        .isEqualTo("Registrar with registrarId regIdTest already exists");
  }

-  @Test
-  void testFailure_getRegistrarIds() {
-    saveRegistrar("registrarId");
-    RegistrarsAction action =
-        createAction(
-            Action.Method.GET,
-            AuthResult.createUser(
-                createUser(
-                    new UserRoles.Builder()
-                        .setRegistrarRoles(
-                            ImmutableMap.of(
-                                "registrarId", RegistrarRole.ACCOUNT_MANAGER_WITH_REGISTRY_LOCK))
-                        .build())));
-    action.run();
-    assertThat(((FakeResponse) consoleApiParams.response()).getStatus()).isEqualTo(SC_FORBIDDEN);
-  }
-
  private User createUser(UserRoles userRoles) {
    return new User.Builder()
        .setEmailAddress("email@email.com")
@@ -147,117 +147,6 @@
          "type": "object truncated due to unexplainable reasons"
        }
      ]
-    },
-
-    {
-      "objectClassName":"entity",
-      "handle":"",
-      "remarks":[
-        {
-          "title":"REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization",
-          "description":[
-            "Some of the data in this object has been removed.",
-            "Contact personal data is visible only to the owning registrar."
-          ],
-          "links":[
-            {
-              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
-              "rel":"alternate",
-              "type":"text/html"
-            }
-          ]
-        },
-        {
-          "title":"EMAIL REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization",
-          "description":[
-            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
-          ]
-        }
-      ],
-      "roles":["registrant"],
-      "vcardArray":[
-        "vcard",
-        [
-          ["version", {}, "text", "4.0"],
-          ["fn", {}, "text", ""]
-        ]
-      ]
-    },
-
-    {
-      "objectClassName": "entity",
-      "handle": "",
-      "roles":["administrative"],
-      "remarks": [
-        {
-          "title":"REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization",
-          "description": [
-            "Some of the data in this object has been removed.",
-            "Contact personal data is visible only to the owning registrar."
-          ],
-          "links":[
-            {
-              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
-              "rel":"alternate",
-              "type":"text/html"
-            }
-          ]
-        },
-        {
-          "title":"EMAIL REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization",
-          "description": [
-            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
-          ]
-        }
-      ],
-      "vcardArray":[
-        "vcard",
-        [
-          ["version", {}, "text", "4.0"],
-          ["fn", {}, "text", ""]
-        ]
-      ]
-    },
-
-    {
-      "objectClassName":"entity",
-      "handle":"",
-      "remarks":[
-        {
-          "title":"REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization",
-          "description":[
-            "Some of the data in this object has been removed.",
-            "Contact personal data is visible only to the owning registrar."
-          ],
-          "links":[
-            {
-              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
-              "rel":"alternate",
-              "type":"text/html"
-            }
-          ]
-        },
-        {
-          "description":[
-            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
-          ],
-          "title":"EMAIL REDACTED FOR PRIVACY",
-          "type":"object redacted due to authorization"
-        }
-      ],
-      "roles": ["technical"],
-      "vcardArray": [
-        "vcard",
-        [
-          ["version", {}, "text", "4.0"],
-          ["fn", {}, "text", ""]
-        ]
-      ]
    }
  ]
 }
@@ -0,0 +1,225 @@
+{
+  "rdapConformance": [
+    "rdap_level_0",
+    "icann_rdap_response_profile_0",
+    "icann_rdap_technical_implementation_guide_0"
+  ],
+  "objectClassName": "domain",
+  "handle": "%DOMAIN_HANDLE_1%",
+  "ldhName": "%DOMAIN_PUNYCODE_NAME_1%",
+  "status": [
+    "client delete prohibited",
+    "client renew prohibited",
+    "client transfer prohibited",
+    "server update prohibited"
+  ],
+  "links": [
+    {
+      "href": "https://example.tld/rdap/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "self"
+    },
+    {
+      "href": "https://rdap.example.com/withSlash/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "related"
+    },
+    {
+      "href": "https://rdap.example.com/withoutSlash/domain/%DOMAIN_PUNYCODE_NAME_1%",
+      "type": "application/rdap+json",
+      "rel": "related"
+    }
+  ],
+  "events": [
+    {
+      "eventAction": "registration",
+      "eventActor": "TheRegistrar",
+      "eventDate": "1997-01-01T00:00:00.000Z"
+    },
+    {
+      "eventAction": "expiration",
+      "eventDate": "2110-10-08T00:44:59.000Z"
+    },
+    {
+      "eventAction": "last update of RDAP database",
+      "eventDate": "2000-01-01T00:00:00.000Z"
+    },
+    {
+      "eventAction": "last changed",
+      "eventDate": "2009-05-29T20:13:00.000Z"
+    }
+  ],
+  "nameservers": [
+    {
+      "objectClassName": "nameserver",
+      "handle": "%NAMESERVER_HANDLE_1%",
+      "ldhName": "%NAMESERVER_NAME_1%",
+      "links": [
+        {
+          "href": "https://example.tld/rdap/nameserver/%NAMESERVER_NAME_1%",
+          "type": "application/rdap+json",
+          "rel": "self"
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "type": "object truncated due to unexplainable reasons",
+          "description": ["Summary data only. For complete data, send a specific query for the object."]
+        }
+      ]
+    },
+    {
+      "objectClassName": "nameserver",
+      "handle": "%NAMESERVER_HANDLE_2%",
+      "ldhName": "%NAMESERVER_NAME_2%",
+      "links": [
+        {
+          "href": "https://example.tld/rdap/nameserver/%NAMESERVER_NAME_2%",
+          "type": "application/rdap+json",
+          "rel": "self"
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "type": "object truncated due to unexplainable reasons",
+          "description": ["Summary data only. For complete data, send a specific query for the object."]
+        }
+      ]
+    }
+  ],
+  "secureDNS" : {
+    "delegationSigned": true,
+    "zoneSigned":true,
+    "dsData":[
+      {"algorithm":2,"digest":"DEADFACE","digestType":3,"keyTag":1}
+    ]
+  },
+  "entities": [
+    {
+      "objectClassName" : "entity",
+      "handle" : "1",
+      "roles" : ["registrar"],
+      "links" : [
+        {
+          "rel" : "self",
+          "href" : "https://example.tld/rdap/entity/1",
+          "type" : "application/rdap+json"
+        }
+      ],
+      "publicIds" : [
+        {
+          "type" : "IANA Registrar ID",
+          "identifier" : "1"
+        }
+      ],
+      "vcardArray" : [
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", "%REGISTRAR_FULL_NAME_1%"]
+        ]
+      ],
+      "entities" : [
+        {
+          "objectClassName":"entity",
+          "roles":["abuse"],
+          "status":["active"],
+          "vcardArray": [
+            "vcard",
+            [
+              ["version",{},"text","4.0"],
+              ["fn",{},"text","Jake Doe"],
+              ["tel",{"type":["voice"]},"uri","tel:+1.2125551216"],
+              ["tel",{"type":["fax"]},"uri","tel:+1.2125551216"],
+              ["email",{},"text","jakedoe@example.com"]
+            ]
+          ]
+        }
+      ],
+      "remarks": [
+        {
+          "title": "Incomplete Data",
+          "description": [
+            "Summary data only. For complete data, send a specific query for the object."
+          ],
+          "type": "object truncated due to unexplainable reasons"
+        }
+      ]
+    },
+    {
+      "objectClassName": "entity",
+      "handle": "",
+      "roles":["administrative"],
+      "remarks": [
+        {
+          "title":"REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description": [
+            "Some of the data in this object has been removed.",
+            "Contact personal data is visible only to the owning registrar."
+          ],
+          "links":[
+            {
+              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
+              "rel":"alternate",
+              "type":"text/html"
+            }
+          ]
+        },
+        {
+          "title":"EMAIL REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description": [
+            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
+          ]
+        }
+      ],
+      "vcardArray":[
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", ""]
+        ]
+      ]
+    },
+
+    {
+      "objectClassName":"entity",
+      "handle":"",
+      "remarks":[
+        {
+          "title":"REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization",
+          "description":[
+            "Some of the data in this object has been removed.",
+            "Contact personal data is visible only to the owning registrar."
+          ],
+          "links":[
+            {
+              "href":"https://github.com/google/nomulus/blob/master/docs/rdap.md#authentication",
+              "rel":"alternate",
+              "type":"text/html"
+            }
+          ]
+        },
+        {
+          "description":[
+            "Please query the RDDS service of the Registrar of Record identifies in this output for information on how to contact the Registrant of the queried domain name."
+          ],
+          "title":"EMAIL REDACTED FOR PRIVACY",
+          "type":"object redacted due to authorization"
+        }
+      ],
+      "roles": ["technical"],
+      "vcardArray": [
+        "vcard",
+        [
+          ["version", {}, "text", "4.0"],
+          ["fn", {}, "text", ""]
+        ]
+      ]
+    }
+  ]
+}
Author	SHA1	Message	Date
Pavlo Tkach	1a8f133d54	Filter console registrars per user role (#2501 )	2024-07-24 18:31:23 +00:00
gbrodman	233ee09efe	Add simple registry-lock-verification page (#2499 ) This is a fairly simple page that solely exists to display the result from the action, and to link the user back to the domain list.	2024-07-23 19:04:35 +00:00
sarahcaseybot	35ff768176	Fix bug with removing registrant on update command (#2498 ) * Fix bug with removing registrant on update command * fix comment * Change method name	2024-07-18 20:21:49 +00:00
Ben McIlwain	c4e5bc913e	Remove contact entities from RDAP entirely when they don't exist in DB (#2497 ) This is consistent with how other registries are handling RDAP and is also consistent with overall behavior in WHOIS and domain info flows as implemented in my previous PRs #2477 and #2490.	2024-07-18 19:33:52 +00:00
sarahcaseybot	0241937dee	Use feature flag for minimum dataset in domain flows to decide when to check for required contacts (#2486 ) * Check FeatureFlag in domain flows before checking contacts Check if phase 1 has begun of the transition to the minimum registry dataset, and if it has, do not require the presence of contacts in domain flows. * Add tests * Small test fixes * rename flag * Fix merge conflicts * Change todo * Add isActive methods * Add javadocs * small fix	2024-07-17 22:06:09 +00:00