Allow superuser ext to override client/server transfer prohibited (#2890)

The superuser can remove/add those statuses anyway, so there's not
really any point. This also saves us trouble if we need to do a BTAPPA
transfer.

core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java

@@ -133,10 +133,9 @@ import org.joda.time.DateTime;
 @ReportingSpec(ActivityReportField.DOMAIN_TRANSFER_REQUEST)
 public final class DomainTransferRequestFlow implements MutatingFlow {
 
-  private static final ImmutableSet<StatusValue> DISALLOWED_STATUSES = ImmutableSet.of(
-      StatusValue.CLIENT_TRANSFER_PROHIBITED,
-      StatusValue.PENDING_DELETE,
-      StatusValue.SERVER_TRANSFER_PROHIBITED);
+  private static final ImmutableSet<StatusValue> NON_SUPERUSER_DISALLOWED_STATUSES =
+      ImmutableSet.of(
+          StatusValue.CLIENT_TRANSFER_PROHIBITED, StatusValue.SERVER_TRANSFER_PROHIBITED);
 
   @Inject ResourceCommand resourceCommand;
   @Inject ExtensionManager extensionManager;
@@ -299,8 +298,9 @@ public final class DomainTransferRequestFlow implements MutatingFlow {
       DateTime now,
       Optional<DomainTransferRequestSuperuserExtension> superuserExtension)
       throws EppException {
-    verifyNoDisallowedStatuses(existingDomain, DISALLOWED_STATUSES);
+    verifyNoDisallowedStatuses(existingDomain, ImmutableSet.of(StatusValue.PENDING_DELETE));
     if (!isSuperuser) {
+      verifyNoDisallowedStatuses(existingDomain, NON_SUPERUSER_DISALLOWED_STATUSES);
       verifyAuthInfoPresentForResourceTransfer(authInfo);
       verifyAuthInfo(authInfo.get(), existingDomain);
     }

core/src/test/java/google/registry/flows/domain/DomainTransferRequestFlowTest.java

@@ -1004,6 +1004,40 @@ class DomainTransferRequestFlowTest
                 ImmutableMap.of("PERIOD", "0", "AUTOMATIC_TRANSFER_LENGTH", "5")));
   }
 
+  @Test
+  void testSuccess_superuserExtension_clientTransferProhibited() throws Exception {
+    setupDomain("example", "tld");
+    eppRequestSource = EppRequestSource.TOOL;
+    domain =
+        persistResource(
+            domain.asBuilder().addStatusValue(StatusValue.CLIENT_TRANSFER_PROHIBITED).build());
+    doSuccessfulSuperuserExtensionTest(
+        "domain_transfer_request_superuser_extension.xml",
+        "domain_transfer_request_response_su_ext_zero_period_zero_transfer_length.xml",
+        domain.getRegistrationExpirationTime().plusYears(0),
+        ImmutableMap.of("PERIOD", "0", "AUTOMATIC_TRANSFER_LENGTH", "0"),
+        Optional.empty(),
+        Period.create(0, Unit.YEARS),
+        Duration.ZERO);
+  }
+
+  @Test
+  void testSuccess_superuserExtension_serverTransferProhibited() throws Exception {
+    setupDomain("example", "tld");
+    eppRequestSource = EppRequestSource.TOOL;
+    domain =
+        persistResource(
+            domain.asBuilder().addStatusValue(StatusValue.SERVER_TRANSFER_PROHIBITED).build());
+    doSuccessfulSuperuserExtensionTest(
+        "domain_transfer_request_superuser_extension.xml",
+        "domain_transfer_request_response_su_ext_zero_period_zero_transfer_length.xml",
+        domain.getRegistrationExpirationTime().plusYears(0),
+        ImmutableMap.of("PERIOD", "0", "AUTOMATIC_TRANSFER_LENGTH", "0"),
+        Optional.empty(),
+        Period.create(0, Unit.YEARS),
+        Duration.ZERO);
+  }
+
   @Test
   void testSuccess_cappedExpiration() throws Exception {
     setupDomain("example", "tld");
@@ -1809,6 +1843,22 @@ class DomainTransferRequestFlowTest
     assertThat(thrown).hasMessageThat().contains("pendingDelete");
   }
 
+  @Test
+  void testFailure_pendingDelete_evenWhenSuperuser() {
+    setupDomain("example", "tld");
+    eppRequestSource = EppRequestSource.TOOL;
+    domain = persistResource(domain.asBuilder().addStatusValue(StatusValue.PENDING_DELETE).build());
+    ResourceStatusProhibitsOperationException thrown =
+        assertThrows(
+            ResourceStatusProhibitsOperationException.class,
+            () ->
+                runTest(
+                    "domain_transfer_request_superuser_extension.xml",
+                    UserPrivileges.SUPERUSER,
+                    ImmutableMap.of("PERIOD", "0", "AUTOMATIC_TRANSFER_LENGTH", "0")));
+    assertThat(thrown).hasMessageThat().contains("pendingDelete");
+  }
+
   @Test
   void testIcannActivityReportField_getsLogged() throws Exception {
     setupDomain("example", "tld");

release/cloudbuild-deploy-gke.yaml

@@ -43,7 +43,9 @@ steps:
     deployCloudSchedulerAndQueue nomulus-config-${_ENV}.yaml cloud-scheduler-tasks-${_ENV}.xml $project_id --gke
     deployCloudSchedulerAndQueue nomulus-config-${_ENV}.yaml cloud-tasks-queue.xml $project_id --gke
 # Save the deployed tag for the current environment on GCS, and update the
-# mappings from Nomulus releases to deployment timestamp.
+# mappings from Nomulus releases to deployment timestamp. Also copy the
+# artifacts for schema tests to here. They will be mapped into Kokoro for
+# presubmit tests.
 - name: 'gcr.io/$PROJECT_ID/builder:latest'
   entrypoint: /bin/bash
   args:
@@ -60,6 +62,11 @@ steps:
       gs://$PROJECT_ID-deployed-tags/nomulus-gke.${_ENV}.versions \
       gs://$PROJECT_ID-deployed-tags/nomulus-gke.${_ENV}.tmp \
       gs://$PROJECT_ID-deployed-tags/nomulus-gke.${_ENV}.versions
+    # Copy the nomulus artifacts for schema test: nomulus foss jars and the uberjar of nomulus test classes.
+    gcloud storage cp gs://$PROJECT_ID-deploy/${TAG_NAME}/nomulus-public.jar \
+          gs://$PROJECT_ID-deployed-tags/schema-test-artifacts/nomulus-public.${_ENV}.jar
+    gcloud storage cp gs://$PROJECT_ID-deploy/${TAG_NAME}/nomulus-tests-alldeps.jar \
+          gs://$PROJECT_ID-deployed-tags/schema-test-artifacts/nomulus-tests-alldeps.${_ENV}.jar
 timeout: 3600s
 options:
   machineType: 'E2_HIGHCPU_32'

release/cloudbuild-schema-deploy.yaml

@@ -75,7 +75,7 @@ steps:
 # Save the deployed tag for the current environment on GCS to a well-known.
 # location. Do not use the 'artifacts' section for this since it will
 # upload an extra metadata file every time and pollute the folder.
-# TODO(weiminyu): modify this step so that TAG_NAME may be 'live'.
+# Also copy the schema jar here. It will be mapped into Kokoro for presubmit tests.
 - name: 'gcr.io/$PROJECT_ID/builder:latest'
   entrypoint: /bin/bash
   args:
@@ -84,6 +84,9 @@ steps:
     set -e
     echo ${TAG_NAME} | \
       gcloud storage cp - gs://$PROJECT_ID-deployed-tags/sql.${_ENV}.tag\
+    # Copy the schema jar here
+    gcloud storage cp gs://$PROJECT_ID-deploy/${TAG_NAME}/schema.jar \
+      gs://$PROJECT_ID-deployed-tags/schema-test-artifacts/schema.${_ENV}.jar
 timeout: 3600s
 options:
   machineType: 'E2_HIGHCPU_32'