Forbid domain creation with label blocked by BSA (#2236 )

* Forbid domain creation with label blocked by BSA Add a BSA label check in the DomainCreation flow.
Create reusable dialog / bottom sheet component (#2237 )
2026-07-08 17:16:54 +00:00 · 2023-12-11 22:14:12 -05:00 · 2023-12-08 17:52:57 -05:00 · 2023-12-08 15:37:30 -05:00 · 2023-12-08 14:35:05 -05:00 · 2023-12-07 19:02:16 -05:00
92 changed files with 5179 additions and 4455 deletions
@@ -36,28 +36,27 @@ import { RegistrarGuard } from './registrar/registrar.guard';
 import SecurityComponent from './settings/security/security.component';
 import { MAT_FORM_FIELD_DEFAULT_OPTIONS } from '@angular/material/form-field';
 import { EmptyRegistrar } from './registrar/emptyRegistrar.component';
-import { RegistrarSelectorComponent } from './registrar/registrar-selector.component';
+import { RegistrarSelectorComponent } from './registrar/registrarSelector.component';
 import { GlobalLoaderService } from './shared/services/globalLoader.service';
-import { ContactWidgetComponent } from './home/widgets/contact-widget.component';
-import { PromotionsWidgetComponent } from './home/widgets/promotions-widget.component';
-import { TldsWidgetComponent } from './home/widgets/tlds-widget.component';
-import { ResourcesWidgetComponent } from './home/widgets/resources-widget.component';
-import { EppWidgetComponent } from './home/widgets/epp-widget.component';
-import { BillingWidgetComponent } from './home/widgets/billing-widget.component';
-import { DomainsWidgetComponent } from './home/widgets/domains-widget.component';
-import { SettingsWidgetComponent } from './home/widgets/settings-widget.component';
+import { ContactWidgetComponent } from './home/widgets/contactWidget.component';
+import { PromotionsWidgetComponent } from './home/widgets/promotionsWidget.component';
+import { TldsWidgetComponent } from './home/widgets/tldsWidget.component';
+import { ResourcesWidgetComponent } from './home/widgets/resourcesWidget.component';
+import { EppWidgetComponent } from './home/widgets/eppWidget.component';
+import { BillingWidgetComponent } from './home/widgets/billingWidget.component';
+import { DomainsWidgetComponent } from './home/widgets/domainsWidget.component';
+import { SettingsWidgetComponent } from './home/widgets/settingsWidget.component';
 import { UserDataService } from './shared/services/userData.service';
 import WhoisComponent from './settings/whois/whois.component';
 import { SnackBarModule } from './snackbar.module';
-import {
-  RegistrarDetailsComponent,
-  RegistrarDetailsWrapperComponent,
-} from './registrar/registrarDetails.component';
+import { RegistrarDetailsComponent } from './registrar/registrarDetails.component';
 import { DomainListComponent } from './domains/domainList.component';
+import { DialogBottomSheetWrapper } from './shared/components/dialogBottomSheet.component';

@NgModule({
  declarations: [
    AppComponent,
+    DialogBottomSheetWrapper,
    BillingWidgetComponent,
    ContactDetailsDialogComponent,
    ContactWidgetComponent,
@@ -70,7 +69,6 @@ import { DomainListComponent } from './domains/domainList.component';
    PromotionsWidgetComponent,
    RegistrarComponent,
    RegistrarDetailsComponent,
-    RegistrarDetailsWrapperComponent,
    RegistrarSelectorComponent,
    ResourcesWidgetComponent,
    SecurityComponent,
@@ -1,7 +1,13 @@
 <div class="console-domains">
  <mat-form-field>
    <mat-label>Filter</mat-label>
-    <input matInput (keyup)="applyFilter($event)" #input />
+    <input
+      type="search"
+      matInput
+      [(ngModel)]="searchTerm"
+      (ngModelChange)="sendInput()"
+      #input
+    />
  </mat-form-field>

  <div *ngIf="isLoading; else domains_content" class="console-domains__loading">
@@ -18,6 +18,7 @@ import { BackendService } from '../shared/services/backend.service';
 import { MatPaginator, PageEvent } from '@angular/material/paginator';
 import { RegistrarService } from '../registrar/registrar.service';
 import { Domain, DomainListService } from './domainList.service';
+import { Subject, debounceTime } from 'rxjs';

@Component({
  selector: 'app-domain-list',
@@ -27,6 +28,7 @@ import { Domain, DomainListService } from './domainList.service';
 })
 export class DomainListComponent {
  public static PATH = 'domain-list';
+  private readonly DEBOUNCE_MS = 500;

  displayedColumns: string[] = [
    'domainName',
@@ -38,6 +40,9 @@ export class DomainListComponent {
  dataSource: MatTableDataSource<Domain> = new MatTableDataSource();
  isLoading = true;

+  searchTermSubject = new Subject<string>();
+  searchTerm?: string;
+
  pageNumber?: number;
  resultsPerPage = 50;
  totalResults?: number;
@@ -52,13 +57,28 @@ export class DomainListComponent {

  ngOnInit() {
    this.dataSource.paginator = this.paginator;
+    // Don't spam the server unnecessarily while the user is typing
+    this.searchTermSubject
+      .pipe(debounceTime(this.DEBOUNCE_MS))
+      .subscribe((searchTermValue) => {
+        this.reloadData();
+      });
    this.reloadData();
  }

+  ngOnDestroy() {
+    this.searchTermSubject.complete();
+  }
+
  reloadData() {
    this.isLoading = true;
    this.domainListService
-      .retrieveDomains(this.pageNumber, this.resultsPerPage, this.totalResults)
+      .retrieveDomains(
+        this.pageNumber,
+        this.resultsPerPage,
+        this.totalResults,
+        this.searchTerm
+      )
      .subscribe((domainListResult) => {
        this.dataSource.data = domainListResult.domains;
        this.totalResults = domainListResult.totalResults;
@@ -66,10 +86,8 @@ export class DomainListComponent {
      });
  }

-  /** TODO: the backend will need to accept a filter string. */
-  applyFilter(event: KeyboardEvent) {
-    // const filterValue = (event.target as HTMLInputElement).value;
-    this.reloadData();
+  sendInput() {
+    this.searchTermSubject.next(this.searchTerm!);
  }

  onPageChange(event: PageEvent) {
@@ -47,7 +47,8 @@ export class DomainListService {
  retrieveDomains(
    pageNumber?: number,
    resultsPerPage?: number,
-    totalResults?: number
+    totalResults?: number,
+    searchTerm?: string
  ) {
    return this.backendService
      .getDomains(
@@ -55,7 +56,8 @@ export class DomainListService {
        this.checkpointTime,
        pageNumber,
        resultsPerPage,
-        totalResults
+        totalResults,
+        searchTerm
      )
      .pipe(
        tap((domainListResult: DomainListResult) => {
@@ -17,7 +17,7 @@ import { RegistrarService } from 'src/app/registrar/registrar.service';

@Component({
  selector: '[app-billing-widget]',
-  templateUrl: './billing-widget.component.html',
+  templateUrl: './billingWidget.component.html',
 })
 export class BillingWidgetComponent {
  constructor(public registrarService: RegistrarService) {}
@@ -17,7 +17,7 @@ import { UserDataService } from 'src/app/shared/services/userData.service';

@Component({
  selector: '[app-contact-widget]',
-  templateUrl: './contact-widget.component.html',
+  templateUrl: './contactWidget.component.html',
 })
 export class ContactWidgetComponent {
  constructor(public userDataService: UserDataService) {}
@@ -18,7 +18,7 @@ import { DomainListComponent } from 'src/app/domains/domainList.component';

@Component({
  selector: '[app-domains-widget]',
-  templateUrl: './domains-widget.component.html',
+  templateUrl: './domainsWidget.component.html',
 })
 export class DomainsWidgetComponent {
  constructor(private router: Router) {}
@@ -16,7 +16,7 @@ import { Component } from '@angular/core';

@Component({
  selector: '[app-epp-widget]',
-  templateUrl: './epp-widget.component.html',
+  templateUrl: './eppWidget.component.html',
 })
 export class EppWidgetComponent {
  constructor() {}
@@ -16,7 +16,7 @@ import { Component } from '@angular/core';

@Component({
  selector: '[app-promotions-widget]',
-  templateUrl: './promotions-widget.component.html',
+  templateUrl: './promotionsWidget.component.html',
 })
 export class PromotionsWidgetComponent {
  constructor() {}
@@ -17,7 +17,7 @@ import { UserDataService } from 'src/app/shared/services/userData.service';

@Component({
  selector: '[app-resources-widget]',
-  templateUrl: './resources-widget.component.html',
+  templateUrl: './resourcesWidget.component.html',
 })
 export class ResourcesWidgetComponent {
  constructor(public userDataService: UserDataService) {}
@@ -21,7 +21,7 @@ import { SettingsComponent } from 'src/app/settings/settings.component';

@Component({
  selector: '[app-settings-widget]',
-  templateUrl: './settings-widget.component.html',
+  templateUrl: './settingsWidget.component.html',
 })
 export class SettingsWidgetComponent {
  constructor(private router: Router) {}
@@ -16,7 +16,7 @@ import { Component } from '@angular/core';

@Component({
  selector: '[app-tlds-widget]',
-  templateUrl: './tlds-widget.component.html',
+  templateUrl: './tldsWidget.component.html',
 })
 export class TldsWidgetComponent {
  constructor() {}
@@ -1,7 +1,7 @@
-<div class="registrarDetails">
+<div class="registrarDetails" *ngIf="registrarInEdit">
  <h3 mat-dialog-title>Edit Registrar: {{ registrarInEdit.registrarId }}</h3>
  <div mat-dialog-content>
-    <form (ngSubmit)="saveAndClose($event)">
+    <form (ngSubmit)="saveAndClose()">
      <mat-form-field class="registrarDetails__input">
        <mat-label>Registry Lock:</mat-label>
        <mat-select
@@ -32,7 +32,7 @@
        />
      </mat-form-field>
      <mat-dialog-actions>
-        <button mat-button (click)="onCancel($event)">Cancel</button>
+        <button mat-button (click)="this.params?.close()">Cancel</button>
        <button type="submit" mat-button color="primary">Save</button>
      </mat-dialog-actions>
    </form>
@@ -12,61 +12,38 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-import { Component, Injector } from '@angular/core';
+import { Component } from '@angular/core';
 import { Registrar, RegistrarService } from './registrar.service';
-import { BreakpointObserver } from '@angular/cdk/layout';
-import {
-  MAT_BOTTOM_SHEET_DATA,
-  MatBottomSheet,
-  MatBottomSheetRef,
-} from '@angular/material/bottom-sheet';
-import {
-  MAT_DIALOG_DATA,
-  MatDialog,
-  MatDialogRef,
-} from '@angular/material/dialog';
 import { MatChipInputEvent } from '@angular/material/chips';
+import { DialogBottomSheetContent } from '../shared/components/dialogBottomSheet.component';

-const MOBILE_LAYOUT_BREAKPOINT = '(max-width: 599px)';
+type RegistrarDetailsParams = {
+  close: Function;
+  data: {
+    registrar: Registrar;
+  };
+};

@Component({
  selector: 'app-registrar-details',
  templateUrl: './registrarDetails.component.html',
  styleUrls: ['./registrarDetails.component.scss'],
 })
-export class RegistrarDetailsComponent {
+export class RegistrarDetailsComponent implements DialogBottomSheetContent {
  registrarInEdit!: Registrar;
-  private elementRef:
-    | MatBottomSheetRef<RegistrarDetailsComponent>
-    | MatDialogRef<RegistrarDetailsComponent>;
+  params?: RegistrarDetailsParams;

-  constructor(
-    protected registrarService: RegistrarService,
-    private injector: Injector
-  ) {
-    // We only inject one, either Dialog or Bottom Sheet data
-    // so one of the injectors is expected to fail
-    try {
-      var params = this.injector.get(MAT_DIALOG_DATA);
-      this.elementRef = this.injector.get(MatDialogRef);
-    } catch (e) {
-      var params = this.injector.get(MAT_BOTTOM_SHEET_DATA);
-      this.elementRef = this.injector.get(MatBottomSheetRef);
-    }
-    this.registrarInEdit = JSON.parse(JSON.stringify(params.registrar));
+  constructor(protected registrarService: RegistrarService) {}
+
+  init(params: RegistrarDetailsParams) {
+    this.params = params;
+    this.registrarInEdit = JSON.parse(
+      JSON.stringify(this.params.data.registrar)
+    );
  }

-  onCancel(e: MouseEvent) {
-    if (this.elementRef instanceof MatBottomSheetRef) {
-      this.elementRef.dismiss();
-    } else if (this.elementRef instanceof MatDialogRef) {
-      this.elementRef.close();
-    }
-  }
-
-  saveAndClose(e: MouseEvent) {
-    // TODO: Implement save call to API
-    this.onCancel(e);
+  saveAndClose() {
+    this.params?.close();
  }

  addTLD(e: MatChipInputEvent) {
@@ -82,24 +59,3 @@ export class RegistrarDetailsComponent {
    );
  }
 }
-
-@Component({
-  selector: 'app-registrar-details-wrapper',
-  template: '',
-})
-export class RegistrarDetailsWrapperComponent {
-  constructor(
-    private dialog: MatDialog,
-    private bottomSheet: MatBottomSheet,
-    protected breakpointObserver: BreakpointObserver
-  ) {}
-
-  open(registrar: Registrar) {
-    const config = { data: { registrar } };
-    if (this.breakpointObserver.isMatched(MOBILE_LAYOUT_BREAKPOINT)) {
-      this.bottomSheet.open(RegistrarDetailsComponent, config);
-    } else {
-      this.dialog.open(RegistrarDetailsComponent, config);
-    }
-  }
-}
@@ -14,7 +14,7 @@

 import { ComponentFixture, TestBed } from '@angular/core/testing';

-import { RegistrarSelectorComponent } from './registrar-selector.component';
+import { RegistrarSelectorComponent } from './registrarSelector.component';

 describe('RegistrarSelectorComponent', () => {
  let component: RegistrarSelectorComponent;
@@ -21,8 +21,8 @@ const MOBILE_LAYOUT_BREAKPOINT = '(max-width: 599px)';

@Component({
  selector: 'app-registrar-selector',
-  templateUrl: './registrar-selector.component.html',
-  styleUrls: ['./registrar-selector.component.scss'],
+  templateUrl: './registrarSelector.component.html',
+  styleUrls: ['./registrarSelector.component.scss'],
 })
 export class RegistrarSelectorComponent implements OnInit {
  protected isMobile: boolean = false;
@@ -48,7 +48,7 @@
    [pageSizeOptions]="[5, 10, 20]"
    showFirstLastButtons
  ></mat-paginator>
-  <app-registrar-details-wrapper
+  <app-dialog-bottom-sheet-wrapper
    #registrarDetailsView
-  ></app-registrar-details-wrapper>
+  ></app-dialog-bottom-sheet-wrapper>
 </div>
@@ -17,7 +17,8 @@ import { Registrar, RegistrarService } from './registrar.service';
 import { MatPaginator } from '@angular/material/paginator';
 import { MatSort } from '@angular/material/sort';
 import { MatTableDataSource } from '@angular/material/table';
-import { RegistrarDetailsWrapperComponent } from './registrarDetails.component';
+import { RegistrarDetailsComponent } from './registrarDetails.component';
+import { DialogBottomSheetWrapper } from '../shared/components/dialogBottomSheet.component';

@Component({
  selector: 'app-registrar',
@@ -82,7 +83,7 @@ export class RegistrarComponent {
  @ViewChild(MatPaginator) paginator!: MatPaginator;
  @ViewChild(MatSort) sort!: MatSort;
  @ViewChild('registrarDetailsView')
-  detailsComponentWrapper!: RegistrarDetailsWrapperComponent;
+  detailsComponentWrapper!: DialogBottomSheetWrapper;

  constructor(protected registrarService: RegistrarService) {
    this.dataSource = new MatTableDataSource<Registrar>(
@@ -97,7 +98,10 @@ export class RegistrarComponent {

  openDetails(event: MouseEvent, registrar: Registrar) {
    event.stopPropagation();
-    this.detailsComponentWrapper.open(registrar);
+    this.detailsComponentWrapper.open<RegistrarDetailsComponent>(
+      RegistrarDetailsComponent,
+      { registrar }
+    );
  }

  applyFilter(event: Event) {
@@ -41,4 +41,7 @@
      <mat-icon>add</mat-icon>Create a Contact
    </button>
  </div>
+  <app-dialog-bottom-sheet-wrapper
+    #contactDetailsWrapper
+  ></app-dialog-bottom-sheet-wrapper>
 </div>
@@ -12,21 +12,14 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-import { Component, Inject } from '@angular/core';
-import {
-  MatDialog,
-  MAT_DIALOG_DATA,
-  MatDialogRef,
-} from '@angular/material/dialog';
-import {
-  MatBottomSheet,
-  MAT_BOTTOM_SHEET_DATA,
-  MatBottomSheetRef,
-} from '@angular/material/bottom-sheet';
+import { Component, ViewChild } from '@angular/core';
 import { Contact, ContactService } from './contact.service';
-import { BreakpointObserver } from '@angular/cdk/layout';
 import { HttpErrorResponse } from '@angular/common/http';
 import { MatSnackBar } from '@angular/material/snack-bar';
+import {
+  DialogBottomSheetContent,
+  DialogBottomSheetWrapper,
+} from 'src/app/shared/components/dialogBottomSheet.component';

 enum Operations {
  DELETE,
@@ -40,7 +33,13 @@ interface GroupedContacts {
  contacts: Array<Contact>;
 }

-let isMobile: boolean;
+type ContactDetailsParams = {
+  close: Function;
+  data: {
+    contact: Contact;
+    operation: Operations;
+  };
+};

 const contactTypes: Array<GroupedContacts> = [
  { value: 'ADMIN', label: 'Primary contact', contacts: [] },
@@ -52,72 +51,46 @@ const contactTypes: Array<GroupedContacts> = [
  { value: 'WHOIS', label: 'WHOIS-Inquiry contact', contacts: [] },
 ];

-class ContactDetailsEventsResponder {
-  private ref?: MatDialogRef<any> | MatBottomSheetRef;
-  constructor() {
-    this.onClose = this.onClose.bind(this);
-  }
-
-  setRef(ref: MatDialogRef<any> | MatBottomSheetRef) {
-    this.ref = ref;
-  }
-
-  onClose() {
-    if (this.ref == undefined) {
-      throw "Reference to ContactDetailsDialogComponent hasn't been set. ";
-    }
-    if (this.ref instanceof MatBottomSheetRef) {
-      this.ref.dismiss();
-    } else if (this.ref instanceof MatDialogRef) {
-      this.ref.close();
-    }
-  }
-}
-
@Component({
  selector: 'app-contact-details-dialog',
-  templateUrl: 'contact-details.component.html',
+  templateUrl: 'contactDetails.component.html',
  styleUrls: ['./contact.component.scss'],
 })
-export class ContactDetailsDialogComponent {
-  contact: Contact;
+export class ContactDetailsDialogComponent implements DialogBottomSheetContent {
+  contact?: Contact;
  contactTypes = contactTypes;
-  operation: Operations;
-  contactIndex: number;
-  onCloseCallback: Function;
+  contactIndex?: number;
+
+  params?: ContactDetailsParams;

  constructor(
    public contactService: ContactService,
-    private _snackBar: MatSnackBar,
-    @Inject(isMobile ? MAT_BOTTOM_SHEET_DATA : MAT_DIALOG_DATA)
-    public data: {
-      onClose: Function;
-      contact: Contact;
-      operation: Operations;
-    }
-  ) {
-    this.onCloseCallback = data.onClose;
-    this.contactIndex = contactService.contacts.findIndex(
-      (c) => c === data.contact
+    private _snackBar: MatSnackBar
+  ) {}
+
+  init(params: ContactDetailsParams) {
+    this.params = params;
+    this.contactIndex = this.contactService.contacts.findIndex(
+      (c) => c === params.data.contact
    );
-    this.contact = JSON.parse(JSON.stringify(data.contact));
-    this.operation = data.operation;
+    this.contact = JSON.parse(JSON.stringify(params.data.contact));
  }

-  onClose(e: MouseEvent) {
-    e.preventDefault();
-    this.onCloseCallback.call(this);
+  close() {
+    this.params?.close();
  }

  saveAndClose(e: SubmitEvent) {
    e.preventDefault();
+    if (!this.contact || this.contactIndex === undefined) return;
    if (!(e.target as HTMLFormElement).checkValidity()) {
      return;
    }
+    const operation = this.params?.data.operation;
    let operationObservable;
-    if (this.operation === Operations.ADD) {
+    if (operation === Operations.ADD) {
      operationObservable = this.contactService.addContact(this.contact);
-    } else if (this.operation === Operations.UPDATE) {
+    } else if (operation === Operations.UPDATE) {
      operationObservable = this.contactService.updateContact(
        this.contactIndex,
        this.contact
@@ -127,7 +100,7 @@ export class ContactDetailsDialogComponent {
    }

    operationObservable.subscribe({
-      complete: this.onCloseCallback.bind(this),
+      complete: () => this.close(),
      error: (err: HttpErrorResponse) => {
        this._snackBar.open(err.error);
      },
@@ -143,11 +116,11 @@ export class ContactDetailsDialogComponent {
 export default class ContactComponent {
  public static PATH = 'contact';

+  @ViewChild('contactDetailsWrapper')
+  detailsComponentWrapper!: DialogBottomSheetWrapper;
+
  loading: boolean = false;
  constructor(
-    private dialog: MatDialog,
-    private bottomSheet: MatBottomSheet,
-    private breakpointObserver: BreakpointObserver,
    public contactService: ContactService,
    private _snackBar: MatSnackBar
  ) {
@@ -195,20 +168,9 @@ export default class ContactComponent {
    operation: Operations = Operations.UPDATE
  ) {
    e.preventDefault();
-    // TODO: handle orientation change
-    isMobile = this.breakpointObserver.isMatched('(max-width: 599px)');
-    const responder = new ContactDetailsEventsResponder();
-    const config = { data: { onClose: responder.onClose, contact, operation } };
-
-    if (isMobile) {
-      const bottomSheetRef = this.bottomSheet.open(
-        ContactDetailsDialogComponent,
-        config
-      );
-      responder.setRef(bottomSheetRef);
-    } else {
-      const dialogRef = this.dialog.open(ContactDetailsDialogComponent, config);
-      responder.setRef(dialogRef);
-    }
+    this.detailsComponentWrapper.open<ContactDetailsDialogComponent>(
+      ContactDetailsDialogComponent,
+      { contact, operation }
+    );
  }
 }
@@ -45,7 +45,7 @@ export class ContactService {
    return this.backend
      .getContacts(this.registrarService.activeRegistrarId)
      .pipe(
-        tap((contacts) => {
+        tap((contacts = []) => {
          this.contacts = contacts;
        })
      );
@@ -1,5 +1,5 @@
 <h3 mat-dialog-title>Contact details</h3>
-<div mat-dialog-content>
+<div mat-dialog-content *ngIf="contact">
  <form (ngSubmit)="saveAndClose($event)">
    <p>
      <mat-form-field class="contact-details__input">
@@ -97,7 +97,7 @@
      >
    </section>
    <mat-dialog-actions>
-      <button mat-button (click)="onClose($event)">Cancel</button>
+      <button mat-button (click)="close()">Cancel</button>
      <button type="submit" mat-button>Save</button>
    </mat-dialog-actions>
  </form>
@@ -0,0 +1,69 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { BreakpointObserver } from '@angular/cdk/layout';
+import { ComponentType } from '@angular/cdk/portal';
+import { Component } from '@angular/core';
+import {
+  MatBottomSheet,
+  MatBottomSheetRef,
+} from '@angular/material/bottom-sheet';
+import { MatDialog, MatDialogRef } from '@angular/material/dialog';
+
+const MOBILE_LAYOUT_BREAKPOINT = '(max-width: 599px)';
+
+export interface DialogBottomSheetContent {
+  init(data: Object): void;
+}
+
+/**
+ * Wraps up a child component in an Angular Material Dalog for desktop or a Bottom Sheet
+ * component for mobile depending on a screen resolution, with Breaking Point being 599px.
+ * Child component is required to implement @see DialogBottomSheetContent interface
+ */
+@Component({
+  selector: 'app-dialog-bottom-sheet-wrapper',
+  template: '',
+})
+export class DialogBottomSheetWrapper {
+  private elementRef?: MatBottomSheetRef | MatDialogRef<any>;
+
+  constructor(
+    private dialog: MatDialog,
+    private bottomSheet: MatBottomSheet,
+    protected breakpointObserver: BreakpointObserver
+  ) {}
+
+  open<T extends DialogBottomSheetContent>(
+    component: ComponentType<T>,
+    data: any
+  ) {
+    const config = { data, close: () => this.close() };
+    if (this.breakpointObserver.isMatched(MOBILE_LAYOUT_BREAKPOINT)) {
+      this.elementRef = this.bottomSheet.open(component);
+      this.elementRef.instance.init(config);
+    } else {
+      this.elementRef = this.dialog.open(component);
+      this.elementRef.componentInstance.init(config);
+    }
+  }
+
+  close() {
+    if (this.elementRef instanceof MatBottomSheetRef) {
+      this.elementRef.dismiss();
+    } else if (this.elementRef instanceof MatDialogRef) {
+      this.elementRef.close();
+    }
+  }
+}
@@ -69,7 +69,8 @@ export class BackendService {
    checkpointTime?: string,
    pageNumber?: number,
    resultsPerPage?: number,
-    totalResults?: number
+    totalResults?: number,
+    searchTerm?: string
  ): Observable<DomainListResult> {
    var url = `/console-api/domain-list?registrarId=${registrarId}`;
    if (checkpointTime) {
@@ -84,6 +85,9 @@ export class BackendService {
    if (totalResults) {
      url += `&totalResults=${totalResults}`;
    }
+    if (searchTerm) {
+      url += `&searchTerm=${searchTerm}`;
+    }
    return this.http
      .get<DomainListResult>(url)
      .pipe(catchError((err) => this.errorCatcher<DomainListResult>(err)));
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
@use "@angular/material" as mat;
-@import "app/registrar/registrar-selector.component.scss";
+@import "app/registrar/registrarSelector.component.scss";

 html,
 body {
@@ -16,8 +16,8 @@ package google.registry.bsa;

 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Maps.transformValues;
+import static google.registry.model.tld.Tld.isEnrolledWithBsa;

-import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableMultimap;
 import com.google.common.collect.ImmutableSet;
@@ -50,14 +50,6 @@ public class IdnChecker {
    allTlds = idnToTlds.values().stream().flatMap(ImmutableSet::stream).collect(toImmutableSet());
  }

-  // TODO(11/30/2023): Remove below when new Tld schema is deployed and the `getBsaEnrollStartTime`
-  // method is no longer hardcoded.
-  @VisibleForTesting
-  IdnChecker(ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> idnToTlds) {
-    this.idnToTlds = idnToTlds;
-    allTlds = idnToTlds.values().stream().flatMap(ImmutableSet::stream).collect(toImmutableSet());
-  }
-
  /** Returns all IDNs in which the {@code label} is valid. */
  ImmutableSet<IdnTableEnum> getAllValidIdns(String label) {
    return idnToTlds.keySet().stream()
@@ -88,11 +80,6 @@ public class IdnChecker {
    return Sets.difference(allTlds, getSupportingTlds(idnTables));
  }

-  private static boolean isEnrolledWithBsa(Tld tld, DateTime now) {
-    DateTime enrollTime = tld.getBsaEnrollStartTime();
-    return enrollTime != null && enrollTime.isBefore(now);
-  }
-
  private static ImmutableMap<IdnTableEnum, ImmutableSet<Tld>> getIdnToTldMap(DateTime now) {
    ImmutableMultimap.Builder<IdnTableEnum, Tld> idnToTldMap = new ImmutableMultimap.Builder();
    Tlds.getTldEntitiesOfType(TldType.REAL).stream()
@@ -28,7 +28,7 @@ import org.joda.time.DateTime;
 * <p>The label is valid (wrt IDN) in at least one TLD.
 */
@Entity
-public final class BsaLabel {
+final class BsaLabel {

  @Id String label;

@@ -52,7 +52,7 @@ public final class BsaLabel {
  }

  /** Returns the label to be blocked. */
-  public String getLabel() {
+  String getLabel() {
    return label;
  }

@@ -0,0 +1,87 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa.persistence;
+
+import static google.registry.config.RegistryConfig.getEppResourceCachingDuration;
+import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntries;
+import static google.registry.model.CacheUtils.newCacheBuilder;
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
+
+import com.github.benmanes.caffeine.cache.CacheLoader;
+import com.github.benmanes.caffeine.cache.LoadingCache;
+import com.google.common.annotations.VisibleForTesting;
+import google.registry.persistence.VKey;
+import java.time.Duration;
+import java.util.Map;
+import java.util.Optional;
+
+/** Helpers for {@link BsaLabel}. */
+public final class BsaLabelUtils {
+
+  private BsaLabelUtils() {}
+
+  static final CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>> CACHE_LOADER =
+      new CacheLoader<VKey<BsaLabel>, Optional<BsaLabel>>() {
+
+        @Override
+        public Optional<BsaLabel> load(VKey<BsaLabel> key) {
+          return replicaTm().reTransact(() -> replicaTm().loadByKeyIfPresent(key));
+        }
+
+        @Override
+        public Map<VKey<BsaLabel>, Optional<BsaLabel>> loadAll(
+            Iterable<? extends VKey<BsaLabel>> keys) {
+          // TODO(b/309173359): need this for DomainCheckFlow
+          throw new UnsupportedOperationException(
+              "LoadAll not supported by the BsaLabel cache loader.");
+        }
+      };
+
+  /**
+   * A limited size, limited expiry cache of BSA labels.
+   *
+   * <p>BSA labels are used by the domain creation flow to verify that the requested domain name is
+   * not blocked by the BSA program. Label caching is mainly a defense against two scenarios, the
+   * initial rush and drop-catching, when clients run back-to-back domain creation requests around
+   * the time when a domain becomes available.
+   *
+   * <p>Because of caching and the use of the replica database, new BSA labels installed in the
+   * database will not take effect immediately. A blocked domain may be created due to race
+   * condition. A `refresh` job will detect such domains and report them to BSA as unblockable
+   * domains.
+   *
+   * <p>Since the cached BSA labels have the same usage pattern as the cached EppResources, the
+   * cache configuration for the latter are reused here.
+   */
+  private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> cacheBsaLabels =
+      createBsaLabelsCache(getEppResourceCachingDuration());
+
+  private static LoadingCache<VKey<BsaLabel>, Optional<BsaLabel>> createBsaLabelsCache(
+      Duration expiry) {
+    return newCacheBuilder(expiry)
+        .maximumSize(getEppResourceMaxCachedEntries())
+        .build(CACHE_LOADER);
+  }
+
+  @VisibleForTesting
+  void clearCache() {
+    cacheBsaLabels.invalidateAll();
+  }
+
+  /** Checks if the {@code domainLabel} (the leading `part` of a domain name) is blocked by BSA. */
+  public static boolean isLabelBlocked(String domainLabel) {
+    return cacheBsaLabels.get(BsaLabel.vKey(domainLabel)).isPresent();
+  }
+}
@@ -1397,6 +1397,47 @@ public final class RegistryConfig {
      return config.bulkPricingPackageMonitoring.bulkPricingPackageDomainLimitUpgradeEmailBody;
    }

+    @Provides
+    @Config("bsaGcsBucket")
+    public static String provideBsaGcsBucket(@Config("projectId") String projectId) {
+      return projectId + "-bsa";
+    }
+
+    @Provides
+    @Config("bsaChecksumAlgorithm")
+    public static String provideBsaChecksumAlgorithm(RegistryConfigSettings config) {
+      return config.bsa.bsaChecksumAlgorithm;
+    }
+
+    @Provides
+    @Config("bsaLockLeaseExpiry")
+    public static Duration provideBsaLockLeaseExpiry(RegistryConfigSettings config) {
+      return Duration.standardMinutes(config.bsa.bsaLockLeaseExpiryMinutes);
+    }
+
+    /** Returns the desired interval between successive BSA downloads. */
+    @Provides
+    @Config("bsaDownloadInterval")
+    public static Duration provideBsaDownloadInterval(RegistryConfigSettings config) {
+      return Duration.standardMinutes(config.bsa.bsaDownloadIntervalMinutes);
+    }
+
+    /**
+     * Returns the maximum period when a BSA download can be skipped due to the checksum-based
+     * equality check with the previous download.
+     */
+    @Provides
+    @Config("bsaMaxNopInterval")
+    public static Duration provideBsaMaxNopInterval(RegistryConfigSettings config) {
+      return Duration.standardHours(config.bsa.bsaMaxNopIntervalHours);
+    }
+
+    @Provides
+    @Config("bsaLabelTxnBatchSize")
+    public static int provideBsaLabelTxnBatchSize(RegistryConfigSettings config) {
+      return config.bsa.bsaLabelTxnBatchSize;
+    }
+
    @Provides
    @Config("bsaAuthUrl")
    public static String provideBsaAuthUrl(RegistryConfigSettings config) {
@@ -1415,6 +1456,27 @@ public final class RegistryConfig {
      return ImmutableMap.copyOf(config.bsa.dataUrls);
    }

+    /** Provides the BSA Http endpoint for reporting order processing status. */
+    @Provides
+    @Config("bsaOrderStatusUrl")
+    public static String provideBsaOrderStatusUrls(RegistryConfigSettings config) {
+      return config.bsa.orderStatusUrl;
+    }
+
+    /** Provides the BSA Http endpoint for reporting new unblockable domains. */
+    @Provides
+    @Config("bsaAddUnblockableDomainsUrl")
+    public static String provideBsaAddUnblockableDomainsUrls(RegistryConfigSettings config) {
+      return String.format("%s?%s", config.bsa.unblockableDomainsUrl, "action=add");
+    }
+
+    /** Provides the BSA Http endpoint for reporting domains that have become blockable. */
+    @Provides
+    @Config("bsaRemoveUnblockableDomainsUrl")
+    public static String provideBsaRemoveUnblockableDomainsUrls(RegistryConfigSettings config) {
+      return String.format("%s?%s", config.bsa.unblockableDomainsUrl, "action=remove");
+    }
+
    private static String formatComments(String text) {
      return Splitter.on('\n').omitEmptyStrings().trimResults().splitToList(text).stream()
          .map(s -> "# " + s)
@@ -267,8 +267,15 @@ public class RegistryConfigSettings {

  /** Configurations for integration with Brand Safety Alliance (BSA) API. */
  public static class Bsa {
+    public String bsaChecksumAlgorithm;
+    public int bsaLockLeaseExpiryMinutes;
+    public int bsaDownloadIntervalMinutes;
+    public int bsaMaxNopIntervalHours;
+    public int bsaLabelTxnBatchSize;
    public String authUrl;
    public int authTokenExpirySeconds;
    public Map<String, String> dataUrls;
+    public String orderStatusUrl;
+    public String unblockableDomainsUrl;
  }
 }
@@ -617,3 +617,7 @@ bsa:
  dataUrls:
    "BLOCK": "https://"
    "BLOCK_PLUS": "https://"
+  # Http endpoint for reporting order processing status
+  orderStatusUrl: "https://"
+  # Http endpoint for reporting changes in the set of unblockable domains.
+  unblockableDomainsUrl: "https://"
@@ -19,6 +19,12 @@
              value="production"/>
  </system-properties>

+  <!-- Enable external traffic to go through VPC, required for static ip -->
+  <vpc-access-connector>
+    <name>projects/domain-registry/locations/us-central1/connectors/appengine-connector</name>
+    <egress-setting>all-traffic</egress-setting>
+  </vpc-access-connector>
+
  <static-files>
    <include path="/*.html" expiration="1d"/>
  </static-files>
@@ -40,6 +40,7 @@ import static google.registry.flows.domain.DomainFlowUtils.verifyClaimsNoticeIfA
 import static google.registry.flows.domain.DomainFlowUtils.verifyClaimsPeriodNotEnded;
 import static google.registry.flows.domain.DomainFlowUtils.verifyLaunchPhaseMatchesRegistryPhase;
 import static google.registry.flows.domain.DomainFlowUtils.verifyNoCodeMarks;
+import static google.registry.flows.domain.DomainFlowUtils.verifyNotBlockedByBsa;
 import static google.registry.flows.domain.DomainFlowUtils.verifyNotReserved;
 import static google.registry.flows.domain.DomainFlowUtils.verifyPremiumNameIsNotBlocked;
 import static google.registry.flows.domain.DomainFlowUtils.verifyRegistrarIsActive;
@@ -168,6 +169,7 @@ import org.joda.time.Duration;
 * @error {@link DomainFlowUtils.CurrencyUnitMismatchException}
 * @error {@link DomainFlowUtils.CurrencyValueScaleException}
 * @error {@link DomainFlowUtils.DashesInThirdAndFourthException}
+ * @error {@link DomainFlowUtils.DomainLabelBlockedByBsaException}
 * @error {@link DomainFlowUtils.DomainLabelTooLongException}
 * @error {@link DomainFlowUtils.DomainReservedException}
 * @error {@link DomainFlowUtils.DuplicateContactForRoleException}
@@ -328,6 +330,7 @@ public final class DomainCreateFlow implements MutatingFlow {
              .verifySignedMarks(launchCreate.get().getSignedMarks(), domainLabel, now)
              .getId();
    }
+    verifyNotBlockedByBsa(domainLabel, tld, now);
    flowCustomLogic.afterValidation(
        DomainCreateFlowCustomLogic.AfterValidationParameters.newBuilder()
            .setDomainName(domainName)
@@ -25,11 +25,13 @@ import static com.google.common.collect.Iterables.any;
 import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
+import static google.registry.bsa.persistence.BsaLabelUtils.isLabelBlocked;
 import static google.registry.model.domain.Domain.MAX_REGISTRATION_YEARS;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
 import static google.registry.model.tld.Tld.TldState.PREDELEGATION;
 import static google.registry.model.tld.Tld.TldState.QUIET_PERIOD;
 import static google.registry.model.tld.Tld.TldState.START_DATE_SUNRISE;
+import static google.registry.model.tld.Tld.isEnrolledWithBsa;
 import static google.registry.model.tld.Tlds.findTldForName;
 import static google.registry.model.tld.Tlds.getTlds;
 import static google.registry.model.tld.label.ReservationType.ALLOWED_IN_SUNRISE;
@@ -259,6 +261,19 @@ public class DomainFlowUtils {
    return idnTableName.get();
  }

+  /**
+   * Verifies that the {@code domainLabel} is not blocked by any BSA block label for the given
+   * {@code tld} at the specified time.
+   *
+   * @throws DomainLabelBlockedByBsaException
+   */
+  public static void verifyNotBlockedByBsa(String domainLabel, Tld tld, DateTime now)
+      throws DomainLabelBlockedByBsaException {
+    if (isEnrolledWithBsa(tld, now) && isLabelBlocked(domainLabel)) {
+      throw new DomainLabelBlockedByBsaException();
+    }
+  }
+
  /** Returns whether a given domain create request is for a valid anchor tenant. */
  public static boolean isAnchorTenant(
      InternetDomainName domainName,
@@ -1742,4 +1757,12 @@ public class DomainFlowUtils {
      super("Registrar must be active in order to perform this operation");
    }
  }
+
+  /** Domain label is blocked by the Brand Safety Alliance. */
+  static class DomainLabelBlockedByBsaException extends ParameterValuePolicyErrorException {
+    public DomainLabelBlockedByBsaException() {
+      // TODO(b/309174065): finalize the exception message.
+      super("Domain label is blocked by the Brand Safety Alliance");
+    }
+  }
 }
@@ -18,7 +18,6 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.flows.domain.DomainFlowUtils.zeroInCurrency;
 import static google.registry.flows.domain.token.AllocationTokenFlowUtils.validateTokenForPossiblePremiumName;
 import static google.registry.pricing.PricingEngineProxy.getPricesForDomainName;
-import static google.registry.util.DomainNameUtils.getTldFromDomainName;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;

 import com.google.common.net.InternetDomainName;
@@ -31,11 +30,13 @@ import google.registry.flows.custom.DomainPricingCustomLogic.RenewPriceParameter
 import google.registry.flows.custom.DomainPricingCustomLogic.RestorePriceParameters;
 import google.registry.flows.custom.DomainPricingCustomLogic.TransferPriceParameters;
 import google.registry.flows.custom.DomainPricingCustomLogic.UpdatePriceParameters;
+import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.domain.fee.BaseFee;
 import google.registry.model.domain.fee.BaseFee.FeeType;
 import google.registry.model.domain.fee.Fee;
 import google.registry.model.domain.token.AllocationToken;
+import google.registry.model.domain.token.AllocationToken.RegistrationBehavior;
 import google.registry.model.domain.token.AllocationToken.TokenBehavior;
 import google.registry.model.pricing.PremiumPricingEngine.DomainPrices;
 import google.registry.model.tld.Tld;
@@ -132,12 +133,14 @@ public final class DomainPricingLogic {
    // recurrence is null if the domain is still available. Billing events are created
    // in the process of domain creation.
    if (billingRecurrence == null) {
-      renewCost = getDomainRenewCostWithDiscount(domainPrices, years, allocationToken);
+      renewCost =
+          getDomainRenewCostWithDiscount(tld, domainPrices, dateTime, years, allocationToken);
      isRenewCostPremiumPrice = domainPrices.isPremium();
    } else {
      switch (billingRecurrence.getRenewalPriceBehavior()) {
        case DEFAULT:
-          renewCost = getDomainRenewCostWithDiscount(domainPrices, years, allocationToken);
+          renewCost =
+              getDomainRenewCostWithDiscount(tld, domainPrices, dateTime, years, allocationToken);
          isRenewCostPremiumPrice = domainPrices.isPremium();
          break;
          // if the renewal price behavior is specified, then the renewal price should be the same
@@ -156,10 +159,7 @@ public final class DomainPricingLogic {
        case NONPREMIUM:
          renewCost =
              getDomainCostWithDiscount(
-                  false,
-                  years,
-                  allocationToken,
-                  Tld.get(getTldFromDomainName(domainName)).getStandardRenewCost(dateTime));
+                  false, years, allocationToken, tld.getStandardRenewCost(dateTime));
          isRenewCostPremiumPrice = false;
          break;
        default:
@@ -257,8 +257,20 @@ public final class DomainPricingLogic {

  /** Returns the domain renew cost with allocation-token-related discounts applied. */
  private Money getDomainRenewCostWithDiscount(
-      DomainPrices domainPrices, int years, Optional<AllocationToken> allocationToken)
+      Tld tld,
+      DomainPrices domainPrices,
+      DateTime dateTime,
+      int years,
+      Optional<AllocationToken> allocationToken)
      throws AllocationTokenInvalidForPremiumNameException {
+    // Short-circuit if the user sent an anchor-tenant or otherwise NONPREMIUM-renewal token
+    if (allocationToken.isPresent()) {
+      AllocationToken token = allocationToken.get();
+      if (token.getRegistrationBehavior().equals(RegistrationBehavior.ANCHOR_TENANT)
+          || token.getRenewalPriceBehavior().equals(RenewalPriceBehavior.NONPREMIUM)) {
+        return tld.getStandardRenewCost(dateTime).multipliedBy(years);
+      }
+    }
    return getDomainCostWithDiscount(
        domainPrices.isPremium(), years, allocationToken, domainPrices.getRenewCost());
  }
@@ -20,6 +20,7 @@ import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.union;
 import static google.registry.config.RegistryConfig.getEppResourceCachingDuration;
 import static google.registry.config.RegistryConfig.getEppResourceMaxCachedEntries;
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
@@ -357,13 +358,13 @@ public abstract class EppResource extends UpdateAutoTimestampEntity implements B

        @Override
        public EppResource load(VKey<? extends EppResource> key) {
-          return tm().reTransact(() -> tm().loadByKey(key));
+          return replicaTm().reTransact(() -> replicaTm().loadByKey(key));
        }

        @Override
        public Map<VKey<? extends EppResource>, EppResource> loadAll(
            Iterable<? extends VKey<? extends EppResource>> keys) {
-          return tm().reTransact(() -> tm().loadByKeys(keys));
+          return replicaTm().reTransact(() -> replicaTm().loadByKeys(keys));
        }
      };

@@ -165,10 +165,11 @@ public final class ForeignKeyUtils {
   * foreign keys should not use this cache.
   *
   * <p>Note that here the key of the {@link LoadingCache} is of type {@code VKey<? extends
-   * EppResource>}, but they are not legal {VKey}s to {@link EppResource}s, whose keys are the SQL
-   * primary keys, i.e. the {@code repoId}s. Instead, their keys are the foreign keys used to query
-   * the database. We use {@link VKey} here because it is a convenient composite class that contains
-   * both the resource type and the foreign key, which are needed to for the query and caching.
+   * EppResource>}, but they are not legal {@link VKey}s to {@link EppResource}s, whose keys are the
+   * SQL primary keys, i.e. the {@code repoId}s. Instead, their keys are the foreign keys used to
+   * query the database. We use {@link VKey} here because it is a convenient composite class that
+   * contains both the resource type and the foreign key, which are needed to for the query and
+   * caching.
   *
   * <p>Also note that the value type of this cache is {@link Optional} because the foreign keys in
   * question are coming from external commands, and thus don't necessarily represent entities in
@@ -256,6 +256,11 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
    return VKey.create(Tld.class, tldStr);
  }

+  /** Checks if {@code tld} is enrolled with BSA. */
+  public static boolean isEnrolledWithBsa(Tld tld, DateTime now) {
+    return tld.getBsaEnrollStartTime().orElse(END_OF_TIME).isBefore(now);
+  }
+
  /**
   * The name of the pricing engine that this TLD uses.
   *
@@ -550,9 +555,15 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  @JsonSerialize(using = SortedEnumSetSerializer.class)
  Set<IdnTableEnum> idnTables;

-  // TODO(11/30/2023): uncomment below two lines
-  // /** The start time of this TLD's enrollment in the BSA program, if applicable. */
-  // @JsonIgnore @Nullable DateTime bsaEnrollStartTime;
+  /**
+   * The start time of this TLD's enrollment in the BSA program, if applicable.
+   *
+   * <p>This property is excluded from source-based configuration and is managed directly in the
+   * database.
+   */
+  // TODO(b/309175410): implement setup and cleanup procedure for joining or leaving BSA, and see
+  // if it can be integrated with the ConfigTldCommand.
+  @JsonIgnore @Nullable DateTime bsaEnrollStartTime;

  public String getTldStr() {
    return tldStr;
@@ -574,12 +585,9 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
  }

  /** Returns the time when this TLD was enrolled in the Brand Safety Alliance (BSA) program. */
-  @JsonIgnore // Annotation can be removed once we add the field and annotate it.
-  @Nullable
-  public DateTime getBsaEnrollStartTime() {
-    // TODO(11/30/2023): uncomment below.
-    // return this.bsaEnrollStartTime;
-    return null;
+  @JsonIgnore
+  public Optional<DateTime> getBsaEnrollStartTime() {
+    return Optional.ofNullable(this.bsaEnrollStartTime);
  }

  /** Retrieve whether invoicing is enabled. */
@@ -1101,10 +1109,9 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
      return this;
    }

-    public Builder setBsaEnrollStartTime(DateTime enrollTime) {
+    public Builder setBsaEnrollStartTime(Optional<DateTime> enrollTime) {
      // TODO(b/309175133): forbid if enrolled with BSA
-      // TODO(11/30/2023): uncomment below line
-      // getInstance().bsaEnrollStartTime = enrollTime;
+      getInstance().bsaEnrollStartTime = enrollTime.orElse(null);
      return this;
    }

@@ -45,7 +45,7 @@ import org.joda.money.Money;
 * {@link PremiumList} object in SQL, and caching these entries so that future lookups can be
 * quicker.
 */
-public class PremiumListDao {
+public final class PremiumListDao {

  /**
   * In-memory cache for premium lists.
@@ -102,7 +102,7 @@ public class PremiumListDao {
  /**
   * Returns the most recent revision of the PremiumList with the specified name, if it exists.
   *
-   * <p>Note that this does not load <code>PremiumList.labelsToPrices</code>! If you need to check
+   * <p>Note that this does not load {@code PremiumList.labelsToPrices}! If you need to check
   * prices, use {@link #getPremiumPrice}.
   */
  public static Optional<PremiumList> getLatestRevision(String premiumListName) {
@@ -169,7 +169,7 @@ public class PremiumListDao {
  }

  private static Optional<PremiumList> getLatestRevisionUncached(String premiumListName) {
-    return tm().transact(
+    return tm().reTransact(
            () ->
                tm().query(
                        "FROM PremiumList WHERE name = :name ORDER BY revisionId DESC",
@@ -197,10 +197,10 @@ public class PremiumListDao {

  /**
   * Loads the price for the given revisionId + label combination. Note that this does a database
-   * retrieval so it should only be done in a cached context.
+   * retrieval, so it should only be done in a cached context.
   */
  static Optional<BigDecimal> getPriceForLabelUncached(RevisionIdAndLabel revisionIdAndLabel) {
-    return tm().transact(
+    return tm().reTransact(
            () ->
                tm().query(
                        "SELECT pe.price FROM PremiumEntry pe WHERE pe.revisionId = :revisionId"
@@ -199,7 +199,7 @@ public final class ReservedList
  public synchronized ImmutableMap<String, ReservedListEntry> getReservedListEntries() {
    if (reservedListMap == null) {
      reservedListMap =
-          tm().transact(
+          tm().reTransact(
                  () ->
                      tm()
                          .createQueryComposer(ReservedListEntry.class)
@@ -47,7 +47,7 @@ public class ReservedListDao {
   * exists.
   */
  public static Optional<ReservedList> getLatestRevision(String reservedListName) {
-    return tm().transact(
+    return tm().reTransact(
            () ->
                tm().query(
                        "FROM ReservedList WHERE revisionId IN "
@@ -65,7 +65,7 @@ public class ClaimsListDao {
   * doesn't exist.
   */
  private static ClaimsList getUncached() {
-    return tm().transact(
+    return tm().reTransact(
            () -> {
              Long revisionId =
                  tm().query("SELECT MAX(revisionId) FROM ClaimsList", Long.class)
@@ -267,7 +267,7 @@ public abstract class PersistenceModule {
        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
    overrides.put(
        Environment.ISOLATION, TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ.name());
-    return new JpaTransactionManagerImpl(create(overrides), clock);
+    return new JpaTransactionManagerImpl(create(overrides), clock, true);
  }

  @Provides
@@ -283,7 +283,7 @@ public abstract class PersistenceModule {
        name -> overrides.put(HIKARI_DS_CLOUD_SQL_INSTANCE, name));
    overrides.put(
        Environment.ISOLATION, TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ.name());
-    return new JpaTransactionManagerImpl(create(overrides), clock);
+    return new JpaTransactionManagerImpl(create(overrides), clock, true);
  }

  /** Constructs the {@link EntityManagerFactory} instance. */
@@ -33,6 +33,7 @@ import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.flogger.StackSize;
+import google.registry.config.RegistryEnvironment;
 import google.registry.model.ImmutableObject;
 import google.registry.persistence.JpaRetries;
 import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
@@ -85,13 +86,19 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  // EntityManagerFactory is thread safe.
  private final EntityManagerFactory emf;
  private final Clock clock;
+  private final boolean readOnly;

  private static final ThreadLocal<TransactionInfo> transactionInfo =
      ThreadLocal.withInitial(TransactionInfo::new);

-  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock) {
+  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock, boolean readOnly) {
    this.emf = emf;
    this.clock = clock;
+    this.readOnly = readOnly;
+  }
+
+  public JpaTransactionManagerImpl(EntityManagerFactory emf, Clock clock) {
+    this(emf, clock, false);
  }

  @Override
@@ -158,7 +165,10 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
      if (!getHibernateAllowNestedTransactions()) {
        throw new IllegalStateException(NESTED_TRANSACTION_MESSAGE);
      }
-      logger.atWarning().withStackTrace(StackSize.MEDIUM).log(NESTED_TRANSACTION_MESSAGE);
+      if (RegistryEnvironment.get() != RegistryEnvironment.PRODUCTION
+          && RegistryEnvironment.get() != RegistryEnvironment.UNITTEST) {
+        logger.atWarning().withStackTrace(StackSize.MEDIUM).log(NESTED_TRANSACTION_MESSAGE);
+      }
      // This prevents inner transaction from retrying, thus avoiding a cascade retry effect.
      return transactNoRetry(work, isolationLevel);
    }
@@ -200,6 +210,10 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
    try {
      txn.begin();
      txnInfo.start(clock);
+      if (readOnly) {
+        getEntityManager().createNativeQuery("SET TRANSACTION READ ONLY").executeUpdate();
+        logger.atInfo().log("Using read-only SQL replica");
+      }
      if (isolationLevel != null && isolationLevel != getDefaultTransactionIsolationLevel()) {
        getEntityManager()
            .createNativeQuery(
@@ -28,6 +28,7 @@ import com.google.common.net.MediaType;
 import java.io.DataOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.HttpURLConnection;
 import java.net.URLConnection;
 import java.util.Random;

@@ -36,26 +37,37 @@ public final class UrlConnectionUtils {

  private UrlConnectionUtils() {}

-  /** Retrieves the response from the given connection as a byte array. */
-  public static byte[] getResponseBytes(URLConnection connection) throws IOException {
-    try (InputStream is = connection.getInputStream()) {
+  /**
+   * Retrieves the response from the given connection as a byte array.
+   *
+   * <p>Note that in the event the response code is 4XX or 5XX, we use the error stream as any
+   * payload is included there.
+   *
+   * @see HttpURLConnection#getErrorStream()
+   */
+  public static byte[] getResponseBytes(HttpURLConnection connection) throws IOException {
+    int responseCode = connection.getResponseCode();
+    try (InputStream is =
+        responseCode < 400 ? connection.getInputStream() : connection.getErrorStream()) {
      return ByteStreams.toByteArray(is);
+    } catch (NullPointerException e) {
+      return new byte[] {};
    }
  }

  /** Sets auth on the given connection with the given username/password. */
-  public static void setBasicAuth(URLConnection connection, String username, String password) {
+  public static void setBasicAuth(HttpURLConnection connection, String username, String password) {
    setBasicAuth(connection, String.format("%s:%s", username, password));
  }

  /** Sets auth on the given connection with the given string, formatted "username:password". */
-  public static void setBasicAuth(URLConnection connection, String usernameAndPassword) {
+  public static void setBasicAuth(HttpURLConnection connection, String usernameAndPassword) {
    String token = base64().encode(usernameAndPassword.getBytes(UTF_8));
    connection.setRequestProperty(AUTHORIZATION, "Basic " + token);
  }

  /** Sets the given byte[] payload on the given connection with a particular content type. */
-  public static void setPayload(URLConnection connection, byte[] bytes, String contentType)
+  public static void setPayload(HttpURLConnection connection, byte[] bytes, String contentType)
      throws IOException {
    connection.setRequestProperty(CONTENT_TYPE, contentType);
    connection.setDoOutput(true);
@@ -72,7 +84,7 @@ public final class UrlConnectionUtils {
   * @see <a href="http://www.ietf.org/rfc/rfc2388.txt">RFC2388 - Returning Values from Forms</a>
   */
  public static void setPayloadMultipart(
-      URLConnection connection,
+      HttpURLConnection connection,
      String name,
      String filename,
      MediaType contentType,
@@ -72,9 +72,9 @@ public class ConfigureTldCommand extends MutatingCommand {
  boolean breakglass;

  @Parameter(
-      names = {"-d", "--dryrun"},
+      names = {"-d", "--dry_run"},
      description = "Does not execute the entity mutation")
-  boolean dryrun;
+  boolean dryRun;

  @Inject ObjectMapper mapper;

@@ -122,6 +122,13 @@ public class ConfigureTldCommand extends MutatingCommand {
    checkPremiumList(newTld);
    checkDnsWriters(newTld);
    checkCurrency(newTld);
+    // bsaEnrollStartTime only exists in DB. Need to carry it over to the updated copy. See Tld.java
+    // for more information.
+    Optional<DateTime> bsaEnrollTime =
+        Optional.ofNullable(oldTld).flatMap(Tld::getBsaEnrollStartTime);
+    if (bsaEnrollTime.isPresent()) {
+      newTld = newTld.asBuilder().setBsaEnrollStartTime(bsaEnrollTime).build();
+    }
    // Set the new TLD to breakglass mode if breakglass flag was used
    if (breakglass) {
      newTld = newTld.asBuilder().setBreakglassMode(true).build();
@@ -131,7 +138,7 @@ public class ConfigureTldCommand extends MutatingCommand {

  @Override
  protected boolean dontRunCommand() {
-    if (dryrun) {
+    if (dryRun) {
      return true;
    }
    if (!newDiff) {
@@ -463,8 +463,7 @@ abstract class CreateOrUpdateTldCommand extends MutatingCommand {
    }
  }

-  private void checkReservedListValidityForTld(String tld, Set<String> reservedListNames)
-      throws UnsupportedEncodingException {
+  private void checkReservedListValidityForTld(String tld, Set<String> reservedListNames) {
    ImmutableList.Builder<String> builder = new ImmutableList.Builder<>();
    for (String reservedListName : reservedListNames) {
      if (!reservedListName.startsWith("common_") && !reservedListName.startsWith(tld + "_")) {
@@ -67,9 +67,12 @@ abstract class UpdateOrDeleteAllocationTokensCommand extends ConfirmingCommand {
      checkArgument(!prefix.isEmpty(), "Provided prefix should not be blank");
      return tm().transact(
              () ->
-                  tm().loadAllOf(AllocationToken.class).stream()
-                      .filter(token -> token.getToken().startsWith(prefix))
-                      .map(AllocationToken::createVKey)
+                  tm().query(
+                          "SELECT token FROM AllocationToken WHERE token LIKE :prefix",
+                          String.class)
+                      .setParameter("prefix", String.format("%s%%", prefix))
+                      .getResultStream()
+                      .map(token -> VKey.create(AllocationToken.class, token))
                      .collect(toImmutableList()));
    }
  }
@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
 import static java.nio.charset.StandardCharsets.UTF_8;

+import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.base.Strings;
 import google.registry.model.tld.label.PremiumList;
@@ -29,6 +30,14 @@ import java.nio.file.Files;
@Parameters(separators = " =", commandDescription = "Update a PremiumList in Database.")
 class UpdatePremiumListCommand extends CreateOrUpdatePremiumListCommand {

+  @Parameter(
+      names = {"-d", "--dry_run"},
+      description = "Does not execute the entity mutation")
+  boolean dryRun;
+
+  // indicates if there is a new change made by this command
+  private boolean newChange = false;
+
  @Override
  protected String prompt() throws Exception {
    name = Strings.isNullOrEmpty(name) ? convertFilePathToName(inputFile) : name;
@@ -43,8 +52,23 @@ class UpdatePremiumListCommand extends CreateOrUpdatePremiumListCommand {
    checkArgument(!inputData.isEmpty(), "New premium list data cannot be empty");
    currency = existingList.getCurrency();
    PremiumList updatedPremiumList = PremiumListUtils.parseToPremiumList(name, currency, inputData);
-    return String.format(
-        "Update premium list for %s?\n Old List: %s\n New List: %s",
-        name, existingList, updatedPremiumList);
+    if (!existingList
+        .getLabelsToPrices()
+        .entrySet()
+        .equals(updatedPremiumList.getLabelsToPrices().entrySet())) {
+      newChange = true;
+      return String.format(
+          "Update premium list for %s?\n Old List: %s\n New List: %s",
+          name, existingList, updatedPremiumList);
+    } else {
+      return String.format(
+          "This update contains no changes to the premium list for %s.\n List Contents: %s",
+          name, existingList);
+    }
+  }
+
+  @Override
+  protected boolean dontRunCommand() {
+    return dryRun || !newChange;
  }
 }
@@ -14,6 +14,7 @@

 package google.registry.tools;

+import static google.registry.util.DiffUtils.prettyPrintEntityDeepDiff;
 import static google.registry.util.ListNamingUtils.convertFilePathToName;
 import static java.nio.charset.StandardCharsets.UTF_8;

@@ -46,17 +47,27 @@ final class UpdateReservedListCommand extends CreateOrUpdateReservedListCommand
            .setReservedListMapFromLines(allLines)
            .setShouldPublish(shouldPublish);
    reservedList = updated.build();
-    // only call stageEntityChange if there are changes in entries
-
-    if (!existingReservedList
-        .getReservedListEntries()
-        .equals(reservedList.getReservedListEntries())) {
-      return String.format(
-          "Update reserved list for %s?\nOld list: %s\n New list: %s",
-          name,
-          outputReservedListEntries(existingReservedList),
-          outputReservedListEntries(reservedList));
+    boolean shouldPublishChanged =
+        existingReservedList.getShouldPublish() != reservedList.getShouldPublish();
+    boolean reservedListEntriesChanged =
+        !existingReservedList
+            .getReservedListEntries()
+            .equals(reservedList.getReservedListEntries());
+    if (!shouldPublishChanged && !reservedListEntriesChanged) {
+      return "No entity changes to apply.";
    }
-    return "No entity changes to apply.";
+    String result = String.format("Update reserved list for %s?\n", name);
+    if (shouldPublishChanged) {
+      result +=
+          String.format(
+              "shouldPublish: %s -> %s\n",
+              existingReservedList.getShouldPublish(), reservedList.getShouldPublish());
+    }
+    if (reservedListEntriesChanged) {
+      result +=
+          prettyPrintEntityDeepDiff(
+              existingReservedList.getReservedListEntries(), reservedList.getReservedListEntries());
+    }
+    return result;
  }
 }
@@ -19,6 +19,7 @@ import static google.registry.persistence.transaction.TransactionManagerFactory.

 import com.google.api.client.http.HttpStatusCodes;
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Ascii;
 import com.google.gson.Gson;
 import com.google.gson.annotations.Expose;
 import google.registry.model.CreateAutoTimestamp;
@@ -33,6 +34,7 @@ import google.registry.ui.server.registrar.JsonGetAction;
 import java.util.List;
 import java.util.Optional;
 import javax.inject.Inject;
+import javax.persistence.TypedQuery;
 import org.joda.time.DateTime;

 /** Returns a (paginated) list of domains for a particular registrar. */
@@ -49,6 +51,8 @@ public class ConsoleDomainListAction implements JsonGetAction {
  private static final String DOMAIN_QUERY_TEMPLATE =
      "FROM Domain WHERE currentSponsorRegistrarId = :registrarId AND deletionTime >"
          + " :deletedAfterTime AND creationTime <= :createdBeforeTime";
+  private static final String SEARCH_TERM_QUERY = " AND LOWER(domainName) LIKE :searchTerm";
+  private static final String ORDER_BY_STATEMENT = " ORDER BY creationTime DESC";

  private final AuthResult authResult;
  private final Response response;
@@ -58,6 +62,7 @@ public class ConsoleDomainListAction implements JsonGetAction {
  private final int pageNumber;
  private final int resultsPerPage;
  private final Optional<Long> totalResults;
+  private final Optional<String> searchTerm;

  @Inject
  public ConsoleDomainListAction(
@@ -68,7 +73,8 @@ public class ConsoleDomainListAction implements JsonGetAction {
      @Parameter("checkpointTime") Optional<DateTime> checkpointTime,
      @Parameter("pageNumber") Optional<Integer> pageNumber,
      @Parameter("resultsPerPage") Optional<Integer> resultsPerPage,
-      @Parameter("totalResults") Optional<Long> totalResults) {
+      @Parameter("totalResults") Optional<Long> totalResults,
+      @Parameter("searchTerm") Optional<String> searchTerm) {
    this.authResult = authResult;
    this.response = response;
    this.gson = gson;
@@ -77,6 +83,7 @@ public class ConsoleDomainListAction implements JsonGetAction {
    this.pageNumber = pageNumber.orElse(0);
    this.resultsPerPage = resultsPerPage.orElse(DEFAULT_RESULTS_PER_PAGE);
    this.totalResults = totalResults;
+    this.searchTerm = searchTerm;
  }

  @Override
@@ -110,13 +117,13 @@ public class ConsoleDomainListAction implements JsonGetAction {
    long actualTotalResults =
        totalResults.orElseGet(
            () ->
-                tm().query("SELECT COUNT(*) " + DOMAIN_QUERY_TEMPLATE, Long.class)
+                createCountQuery()
                    .setParameter("registrarId", registrarId)
                    .setParameter("createdBeforeTime", checkpointTimestamp)
                    .setParameter("deletedAfterTime", checkpoint)
                    .getSingleResult());
    List<Domain> domains =
-        tm().query(DOMAIN_QUERY_TEMPLATE + " ORDER BY creationTime DESC", Domain.class)
+        createDomainQuery()
            .setParameter("registrarId", registrarId)
            .setParameter("createdBeforeTime", checkpointTimestamp)
            .setParameter("deletedAfterTime", checkpoint)
@@ -127,6 +134,26 @@ public class ConsoleDomainListAction implements JsonGetAction {
    response.setStatus(HttpStatusCodes.STATUS_CODE_OK);
  }

+  /** Creates the query to get the total number of matching domains, interpolating as necessary. */
+  private TypedQuery<Long> createCountQuery() {
+    String queryString = "SELECT COUNT(*) " + DOMAIN_QUERY_TEMPLATE;
+    if (searchTerm.isPresent() && !searchTerm.get().isEmpty()) {
+      return tm().query(queryString + SEARCH_TERM_QUERY, Long.class)
+          .setParameter("searchTerm", String.format("%%%s%%", Ascii.toLowerCase(searchTerm.get())));
+    }
+    return tm().query(queryString, Long.class);
+  }
+
+  /** Creates the query to retrieve the matching domains themselves, interpolating as necessary. */
+  private TypedQuery<Domain> createDomainQuery() {
+    if (searchTerm.isPresent() && !searchTerm.get().isEmpty()) {
+      return tm().query(
+              DOMAIN_QUERY_TEMPLATE + SEARCH_TERM_QUERY + ORDER_BY_STATEMENT, Domain.class)
+          .setParameter("searchTerm", String.format("%%%s%%", Ascii.toLowerCase(searchTerm.get())));
+    }
+    return tm().query(DOMAIN_QUERY_TEMPLATE + ORDER_BY_STATEMENT, Domain.class);
+  }
+
  private void writeBadRequest(String message) {
    response.setPayload(message);
    response.setStatus(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
@@ -226,4 +226,10 @@ public final class RegistrarConsoleModule {
  public static Optional<Long> provideTotalResults(HttpServletRequest req) {
    return extractOptionalParameter(req, "totalResults").map(Long::valueOf);
  }
+
+  @Provides
+  @Parameter("searchTerm")
+  public static Optional<String> provideSearchTerm(HttpServletRequest req) {
+    return extractOptionalParameter(req, "searchTerm");
+  }
 }
@@ -15,38 +15,65 @@
 package google.registry.bsa;

 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.tldconfig.idn.IdnTableEnum.EXTENDED_LATIN;
 import static google.registry.tldconfig.idn.IdnTableEnum.JA;
 import static google.registry.tldconfig.idn.IdnTableEnum.UNCONFUSABLE_LATIN;

-import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import google.registry.model.tld.Tld;
+import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationWithCoverageExtension;
+import google.registry.testing.FakeClock;
+import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
+import org.junit.jupiter.api.extension.RegisterExtension;

-@ExtendWith(MockitoExtension.class)
+/** Unit tests for {@link IdnChecker}. */
 public class IdnCheckerTest {

-  @Mock Tld jaonly;
-  @Mock Tld jandelatin;
-  @Mock Tld strictlatin;
+  FakeClock fakeClock = new FakeClock();
+
+  @RegisterExtension
+  final JpaIntegrationWithCoverageExtension jpa =
+      new JpaTestExtensions.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();
+
+  Tld jaonly;
+  Tld jandelatin;
+  Tld strictlatin;
  IdnChecker idnChecker;

  @BeforeEach
  void setup() {
-    idnChecker =
-        new IdnChecker(
-            ImmutableMap.of(
-                JA,
-                ImmutableSet.of(jandelatin, jaonly),
-                EXTENDED_LATIN,
-                ImmutableSet.of(jandelatin),
-                UNCONFUSABLE_LATIN,
-                ImmutableSet.of(strictlatin)));
+    jaonly = createTld("jaonly");
+    jandelatin = createTld("jandelatin");
+    strictlatin = createTld("strictlatin");
+
+    jaonly =
+        persistResource(
+            jaonly
+                .asBuilder()
+                .setBsaEnrollStartTime(Optional.of(fakeClock.nowUtc()))
+                .setIdnTables(ImmutableSet.of(JA))
+                .build());
+    jandelatin =
+        persistResource(
+            jandelatin
+                .asBuilder()
+                .setBsaEnrollStartTime(Optional.of(fakeClock.nowUtc()))
+                .setIdnTables(ImmutableSet.of(JA, EXTENDED_LATIN))
+                .build());
+    strictlatin =
+        persistResource(
+            strictlatin
+                .asBuilder()
+                .setBsaEnrollStartTime(Optional.of(fakeClock.nowUtc()))
+                .setIdnTables(ImmutableSet.of(UNCONFUSABLE_LATIN))
+                .build());
+    fakeClock.advanceOneMilli();
+    idnChecker = new IdnChecker(fakeClock);
  }

  @Test
@@ -41,4 +41,15 @@ public class BsaLabelTest {
    assertThat(persisted.getLabel()).isEqualTo("label");
    assertThat(persisted.creationTime).isEqualTo(fakeClock.nowUtc());
  }
+
+  @Test
+  void isLabelBlocked_no() {
+    assertThat(tm().transact(() -> BsaLabelUtils.isLabelBlocked("abc"))).isFalse();
+  }
+
+  @Test
+  void isLabelBlocked_yes() {
+    tm().transact(() -> tm().put(new BsaLabel("abc", fakeClock.nowUtc())));
+    assertThat(tm().transact(() -> BsaLabelUtils.isLabelBlocked("abc"))).isTrue();
+  }
 }
@@ -0,0 +1,29 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa.persistence;
+
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+
+import org.joda.time.DateTime;
+
+/** Testing utils for users of {@link BsaLabel}. */
+public final class BsaLabelTestingUtils {
+
+  private BsaLabelTestingUtils() {}
+
+  public static void persistBsaLabel(String domainLabel, DateTime creationTime) {
+    tm().transact(() -> tm().put(new BsaLabel(domainLabel, creationTime)));
+  }
+}
@@ -0,0 +1,102 @@
+// Copyright 2023 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.bsa.persistence;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.bsa.persistence.BsaLabelTestingUtils.persistBsaLabel;
+import static google.registry.bsa.persistence.BsaLabelUtils.isLabelBlocked;
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.setJpaTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.setReplicaJpaTm;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static org.joda.time.DateTimeZone.UTC;
+import static org.joda.time.Duration.millis;
+import static org.joda.time.Duration.standardMinutes;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import google.registry.persistence.transaction.JpaTestExtensions;
+import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationWithCoverageExtension;
+import google.registry.persistence.transaction.JpaTransactionManager;
+import google.registry.testing.FakeClock;
+import org.joda.time.DateTime;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+/** Unit tests for {@link BsaLabelUtils}. */
+public class BsaLabelUtilsTest {
+
+  protected FakeClock fakeClock = new FakeClock(DateTime.now(UTC));
+
+  @RegisterExtension
+  final JpaIntegrationWithCoverageExtension jpa =
+      new JpaTestExtensions.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();
+
+  @Test
+  void isLabelBlocked_yes() {
+    persistBsaLabel("abc", fakeClock.nowUtc());
+    assertThat(isLabelBlocked("abc")).isTrue();
+  }
+
+  @Test
+  void isLabelBlocked_no() {
+    assertThat(isLabelBlocked("abc")).isFalse();
+  }
+
+  @Test
+  void isLabelBlocked_isCacheUsed_withReplica() throws Throwable {
+    JpaTransactionManager primaryTmSave = tm();
+    JpaTransactionManager replicaTmSave = replicaTm();
+
+    JpaTransactionManager primaryTm = mock(JpaTransactionManager.class);
+    JpaTransactionManager replicaTm = mock(JpaTransactionManager.class);
+    setJpaTm(() -> primaryTm);
+    setReplicaJpaTm(() -> replicaTm);
+    when(replicaTm.loadByKey(any())).thenReturn(new BsaLabel("abc", fakeClock.nowUtc()));
+    try {
+      assertThat(isLabelBlocked("abc")).isTrue();
+      assertThat(isLabelBlocked("abc")).isTrue();
+      verify(replicaTm, times(1)).loadByKey(any());
+      verify(primaryTm, never()).loadByKey(any());
+    } catch (Throwable e) {
+      setJpaTm(() -> primaryTmSave);
+      setReplicaJpaTm(() -> replicaTmSave);
+    }
+  }
+
+  @Test
+  void isLabelBlocked_isCacheUsed_withOneMinuteExpiry() throws Throwable {
+    JpaTransactionManager replicaTmSave = replicaTm();
+    JpaTransactionManager replicaTm = mock(JpaTransactionManager.class);
+    setReplicaJpaTm(() -> replicaTm);
+    when(replicaTm.loadByKey(any())).thenReturn(new BsaLabel("abc", fakeClock.nowUtc()));
+    try {
+      assertThat(isLabelBlocked("abc")).isTrue();
+      /**
+       * If test fails, check and fix cache expiry in the config file. Do not increase the duration
+       * on the line below without proper discussion.
+       */
+      fakeClock.advanceBy(standardMinutes(1).plus(millis(1)));
+      assertThat(isLabelBlocked("abc")).isTrue();
+      verify(replicaTm, times(2)).loadByKey(any());
+    } catch (Throwable e) {
+      setReplicaJpaTm(() -> replicaTmSave);
+    }
+  }
+}
@@ -340,6 +340,7 @@ class DomainCheckFlowTest extends ResourceCheckFlowTestCase<DomainCheckFlow, Dom
        new AllocationToken.Builder()
            .setToken("abc123")
            .setTokenType(UNLIMITED_USE)
+            .setAllowedEppActions(ImmutableSet.of(CommandName.CREATE))
            .setDiscountFraction(0.5)
            .setDiscountYears(2)
            .setTokenStatusTransitions(
@@ -364,6 +365,7 @@ class DomainCheckFlowTest extends ResourceCheckFlowTestCase<DomainCheckFlow, Dom
            .setTokenType(UNLIMITED_USE)
            .setDiscountFraction(0.5)
            .setDiscountYears(2)
+            .setAllowedEppActions(ImmutableSet.of(CommandName.CREATE))
            .setTokenStatusTransitions(
                ImmutableSortedMap.<DateTime, TokenStatus>naturalOrder()
                    .put(START_OF_TIME, TokenStatus.NOT_STARTED)
@@ -18,6 +18,7 @@ import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth8.assertThat;
+import static google.registry.bsa.persistence.BsaLabelTestingUtils.persistBsaLabel;
 import static google.registry.flows.FlowTestCase.UserPrivileges.SUPERUSER;
 import static google.registry.model.billing.BillingBase.Flag.ANCHOR_TENANT;
 import static google.registry.model.billing.BillingBase.Flag.RESERVED;
@@ -30,6 +31,7 @@ import static google.registry.model.domain.token.AllocationToken.TokenType.BULK_
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
 import static google.registry.model.domain.token.AllocationToken.TokenType.SINGLE_USE;
 import static google.registry.model.domain.token.AllocationToken.TokenType.UNLIMITED_USE;
+import static google.registry.model.eppcommon.EppXmlTransformer.marshal;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
 import static google.registry.model.eppcommon.StatusValue.SERVER_HOLD;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
@@ -96,6 +98,7 @@ import google.registry.flows.domain.DomainFlowUtils.ClaimsPeriodEndedException;
 import google.registry.flows.domain.DomainFlowUtils.CurrencyUnitMismatchException;
 import google.registry.flows.domain.DomainFlowUtils.CurrencyValueScaleException;
 import google.registry.flows.domain.DomainFlowUtils.DashesInThirdAndFourthException;
+import google.registry.flows.domain.DomainFlowUtils.DomainLabelBlockedByBsaException;
 import google.registry.flows.domain.DomainFlowUtils.DomainLabelTooLongException;
 import google.registry.flows.domain.DomainFlowUtils.DomainNameExistsAsTldException;
 import google.registry.flows.domain.DomainFlowUtils.DomainReservedException;
@@ -165,6 +168,9 @@ import google.registry.model.domain.secdns.DomainDsData;
 import google.registry.model.domain.token.AllocationToken;
 import google.registry.model.domain.token.AllocationToken.RegistrationBehavior;
 import google.registry.model.domain.token.AllocationToken.TokenStatus;
+import google.registry.model.eppcommon.Trid;
+import google.registry.model.eppoutput.EppOutput;
+import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.poll.PendingActionNotificationResponse.DomainPendingActionNotificationResponse;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registrar.Registrar;
@@ -183,7 +189,9 @@ import google.registry.tmch.LordnTaskUtils.LordnPhase;
 import google.registry.tmch.SmdrlCsvParser;
 import google.registry.tmch.TmchData;
 import google.registry.tmch.TmchTestData;
+import google.registry.xml.ValidationMode;
 import java.math.BigDecimal;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.Optional;
 import javax.annotation.Nullable;
@@ -2562,6 +2570,53 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
    assertAboutEppExceptions().that(thrown).marshalsToXml();
  }

+  @Test
+  void testSuccess_bsaLabelMatch_notEnrolled() throws Exception {
+    persistResource(Tld.get("tld").asBuilder().setBsaEnrollStartTime(Optional.empty()).build());
+    persistBsaLabel("example", clock.nowUtc());
+    persistContactsAndHosts();
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testSuccess_bsaLabelMatch_notEnrolledYet() throws Exception {
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setBsaEnrollStartTime(Optional.of(clock.nowUtc().plusSeconds(1)))
+            .build());
+    persistBsaLabel("example", clock.nowUtc());
+    persistContactsAndHosts();
+    doSuccessfulTest();
+  }
+
+  @Test
+  void testFailure_blockedByBsa() throws Exception {
+    persistResource(
+        Tld.get("tld")
+            .asBuilder()
+            .setBsaEnrollStartTime(Optional.of(clock.nowUtc().minusSeconds(1)))
+            .build());
+    persistBsaLabel("example", clock.nowUtc());
+    persistContactsAndHosts();
+    EppException thrown = assertThrows(DomainLabelBlockedByBsaException.class, this::runFlow);
+    assertAboutEppExceptions()
+        .that(thrown)
+        .marshalsToXml()
+        .and()
+        .hasMessage("Domain label is blocked by the Brand Safety Alliance");
+    byte[] responseXmlBytes =
+        marshal(
+            EppOutput.create(
+                new EppResponse.Builder()
+                    .setTrid(Trid.create(null, "server-trid"))
+                    .setResult(thrown.getResult())
+                    .build()),
+            ValidationMode.STRICT);
+    assertThat(new String(responseXmlBytes, StandardCharsets.UTF_8))
+        .isEqualTo(loadFile("domain_create_blocked_by_bsa.xml"));
+  }
+
  @Test
  void testFailure_uppercase() {
    doFailingDomainNameTest("Example.tld", BadDomainNameCharacterException.class);
@@ -219,10 +219,10 @@ public abstract class JpaTransactionManagerExtension
      recreateSchema();
    }
    JpaTransactionManagerImpl txnManager = new JpaTransactionManagerImpl(emf, clock);
+    JpaTransactionManagerImpl readOnlyTxnManager = new JpaTransactionManagerImpl(emf, clock, true);
    cachedTm = TransactionManagerFactory.tm();
    TransactionManagerFactory.setJpaTm(Suppliers.ofInstance(txnManager));
-    TransactionManagerFactory.setReplicaJpaTm(
-        Suppliers.ofInstance(new ReplicaSimulatingJpaTransactionManager(txnManager)));
+    TransactionManagerFactory.setReplicaJpaTm(Suppliers.ofInstance(readOnlyTxnManager));
    // Reset SQL Sequence based id allocation so that ids are deterministic in tests.
    TransactionManagerFactory.tm()
        .transact(
@@ -20,6 +20,7 @@ import static com.google.common.truth.Truth.assertThat;
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_READ_COMMITTED;
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_READ_UNCOMMITTED;
 import static google.registry.persistence.PersistenceModule.TransactionIsolationLevel.TRANSACTION_REPEATABLE_READ;
+import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.assertDetachedFromEntityManager;
 import static google.registry.testing.DatabaseHelper.existsInDb;
@@ -107,6 +108,44 @@ class JpaTransactionManagerImplTest {
    assertCompanyExist("Bar");
  }

+  @Test
+  void transact_replica_failureOnWrite() {
+    assertPersonEmpty();
+    assertCompanyEmpty();
+    DatabaseException thrown =
+        assertThrows(
+            DatabaseException.class,
+            () ->
+                replicaTm()
+                    .transact(
+                        () -> {
+                          insertPerson(10);
+                        }));
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("cannot execute INSERT in a read-only transaction");
+  }
+
+  @Test
+  void transact_replica_successOnRead() {
+    assertPersonEmpty();
+    assertCompanyEmpty();
+    tm().transact(
+            () -> {
+              insertPerson(10);
+            });
+    replicaTm()
+        .transact(
+            () -> {
+              EntityManager em = replicaTm().getEntityManager();
+              Integer maybeAge =
+                  (Integer)
+                      em.createNativeQuery("SELECT age FROM Person WHERE age = 10")
+                          .getSingleResult();
+              assertThat(maybeAge).isEqualTo(10);
+            });
+  }
+
  @Test
  void transact_setIsolationLevel() {
    // If not specified, run at the default isolation level.
@@ -1,289 +0,0 @@
-// Copyright 2022 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.persistence.transaction;
-
-import static com.google.common.base.Throwables.throwIfUnchecked;
-import static google.registry.persistence.transaction.DatabaseException.throwIfSqlException;
-
-import com.google.common.collect.ImmutableCollection;
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableMap;
-import google.registry.model.ImmutableObject;
-import google.registry.persistence.PersistenceModule.TransactionIsolationLevel;
-import google.registry.persistence.VKey;
-import java.util.Optional;
-import java.util.concurrent.Callable;
-import java.util.stream.Stream;
-import javax.persistence.EntityManager;
-import javax.persistence.Query;
-import javax.persistence.TypedQuery;
-import javax.persistence.criteria.CriteriaQuery;
-import org.joda.time.DateTime;
-
-/**
- * A {@link JpaTransactionManager} that simulates a read-only replica SQL instance.
- *
- * <p>We accomplish this by delegating all calls to the standard transaction manager except for
- * calls that start transactions. For these, we create a transaction like normal but set it to READ
- * ONLY mode before doing any work. This is similar to how the read-only Postgres replica works; it
- * treats all transactions as read-only transactions.
- */
-public class ReplicaSimulatingJpaTransactionManager implements JpaTransactionManager {
-
-  private final JpaTransactionManager delegate;
-
-  public ReplicaSimulatingJpaTransactionManager(JpaTransactionManager delegate) {
-    this.delegate = delegate;
-  }
-
-  @Override
-  public void teardown() {
-    delegate.teardown();
-  }
-
-  @Override
-  public TransactionIsolationLevel getDefaultTransactionIsolationLevel() {
-    return delegate.getDefaultTransactionIsolationLevel();
-  }
-
-  @Override
-  public TransactionIsolationLevel getCurrentTransactionIsolationLevel() {
-    return delegate.getCurrentTransactionIsolationLevel();
-  }
-
-  @Override
-  public EntityManager getStandaloneEntityManager() {
-    return delegate.getStandaloneEntityManager();
-  }
-
-  @Override
-  public EntityManager getEntityManager() {
-    return delegate.getEntityManager();
-  }
-
-  @Override
-  public <T> TypedQuery<T> query(String sqlString, Class<T> resultClass) {
-    return delegate.query(sqlString, resultClass);
-  }
-
-  @Override
-  public <T> TypedQuery<T> criteriaQuery(CriteriaQuery<T> criteriaQuery) {
-    return delegate.criteriaQuery(criteriaQuery);
-  }
-
-  @Override
-  public Query query(String sqlString) {
-    return delegate.query(sqlString);
-  }
-
-  @Override
-  public boolean inTransaction() {
-    return delegate.inTransaction();
-  }
-
-  @Override
-  public void assertInTransaction() {
-    delegate.assertInTransaction();
-  }
-
-  @Override
-  public <T> T transact(Callable<T> work, TransactionIsolationLevel isolationLevel) {
-    if (inTransaction()) {
-      try {
-        return work.call();
-      } catch (Exception e) {
-        throwIfSqlException(e);
-        throwIfUnchecked(e);
-        throw new RuntimeException(e);
-      }
-    }
-    return delegate.transact(
-        () -> {
-          delegate
-              .getEntityManager()
-              .createNativeQuery("SET TRANSACTION READ ONLY")
-              .executeUpdate();
-          return work.call();
-        },
-        isolationLevel);
-  }
-
-  @Override
-  public <T> T reTransact(Callable<T> work) {
-    return transact(work);
-  }
-
-  @Override
-  public <T> T transact(Callable<T> work) {
-    return transact(work, null);
-  }
-
-  @Override
-  public void transact(ThrowingRunnable work, TransactionIsolationLevel isolationLevel) {
-    transact(
-        () -> {
-          work.run();
-          return null;
-        },
-        isolationLevel);
-  }
-
-  @Override
-  public void reTransact(ThrowingRunnable work) {
-    transact(work);
-  }
-
-  @Override
-  public void transact(ThrowingRunnable work) {
-    transact(work, null);
-  }
-
-  @Override
-  public DateTime getTransactionTime() {
-    return delegate.getTransactionTime();
-  }
-
-  @Override
-  public void insert(Object entity) {
-    delegate.insert(entity);
-  }
-
-  @Override
-  public void insertAll(ImmutableCollection<?> entities) {
-    delegate.insertAll(entities);
-  }
-
-  @Override
-  public void insertAll(ImmutableObject... entities) {
-    delegate.insertAll(entities);
-  }
-
-  @Override
-  public void put(Object entity) {
-    delegate.put(entity);
-  }
-
-  @Override
-  public void putAll(ImmutableObject... entities) {
-    delegate.putAll(entities);
-  }
-
-  @Override
-  public void putAll(ImmutableCollection<?> entities) {
-    delegate.putAll(entities);
-  }
-
-  @Override
-  public void update(Object entity) {
-    delegate.update(entity);
-  }
-
-  @Override
-  public void updateAll(ImmutableCollection<?> entities) {
-    delegate.updateAll(entities);
-  }
-
-  @Override
-  public void updateAll(ImmutableObject... entities) {
-    delegate.updateAll(entities);
-  }
-
-  @Override
-  public <T> boolean exists(VKey<T> key) {
-    return delegate.exists(key);
-  }
-
-  @Override
-  public boolean exists(Object entity) {
-    return delegate.exists(entity);
-  }
-
-  @Override
-  public <T> Optional<T> loadByKeyIfPresent(VKey<T> key) {
-    return delegate.loadByKeyIfPresent(key);
-  }
-
-  @Override
-  public <T> ImmutableMap<VKey<? extends T>, T> loadByKeysIfPresent(
-      Iterable<? extends VKey<? extends T>> vKeys) {
-    return delegate.loadByKeysIfPresent(vKeys);
-  }
-
-  @Override
-  public <T> ImmutableList<T> loadByEntitiesIfPresent(Iterable<T> entities) {
-    return delegate.loadByEntitiesIfPresent(entities);
-  }
-
-  @Override
-  public <T> T loadByKey(VKey<T> key) {
-    return delegate.loadByKey(key);
-  }
-
-  @Override
-  public <T> ImmutableMap<VKey<? extends T>, T> loadByKeys(
-      Iterable<? extends VKey<? extends T>> vKeys) {
-    return delegate.loadByKeys(vKeys);
-  }
-
-  @Override
-  public <T> T loadByEntity(T entity) {
-    return delegate.loadByEntity(entity);
-  }
-
-  @Override
-  public <T> ImmutableList<T> loadByEntities(Iterable<T> entities) {
-    return delegate.loadByEntities(entities);
-  }
-
-  @Override
-  public <T> ImmutableList<T> loadAllOf(Class<T> clazz) {
-    return delegate.loadAllOf(clazz);
-  }
-
-  @Override
-  public <T> Stream<T> loadAllOfStream(Class<T> clazz) {
-    return delegate.loadAllOfStream(clazz);
-  }
-
-  @Override
-  public <T> Optional<T> loadSingleton(Class<T> clazz) {
-    return delegate.loadSingleton(clazz);
-  }
-
-  @Override
-  public void delete(VKey<?> key) {
-    delegate.delete(key);
-  }
-
-  @Override
-  public void delete(Iterable<? extends VKey<?>> vKeys) {
-    delegate.delete(vKeys);
-  }
-
-  @Override
-  public <T> T delete(T entity) {
-    return delegate.delete(entity);
-  }
-
-  @Override
-  public <T> QueryComposer<T> createQueryComposer(Class<T> entity) {
-    return delegate.createQueryComposer(entity);
-  }
-
-  @Override
-  public <T> void assertDelete(VKey<T> key) {
-    delegate.assertDelete(key);
-  }
-}
@@ -263,7 +263,7 @@ public class RdeReportActionTest {
  @Test
  void testRunWithLock_badRequest_throws500WithErrorInfo() throws Exception {
    when(httpUrlConnection.getResponseCode()).thenReturn(STATUS_CODE_BAD_REQUEST);
-    when(httpUrlConnection.getInputStream()).thenReturn(IIRDEA_BAD_XML.openBufferedStream());
+    when(httpUrlConnection.getErrorStream()).thenReturn(IIRDEA_BAD_XML.openBufferedStream());
    InternalServerErrorException thrown =
        assertThrows(
            InternalServerErrorException.class,
@@ -99,10 +99,10 @@ class IcannHttpReporterTest {

  @Test
  void testFail_BadIirdeaResponse() throws Exception {
-    when(connection.getInputStream()).thenReturn(IIRDEA_BAD_XML.openBufferedStream());
    when(connection.getResponseCode()).thenReturn(STATUS_CODE_BAD_REQUEST);
+    when(connection.getErrorStream()).thenReturn(IIRDEA_BAD_XML.openBufferedStream());
    assertThat(reporter.send(FAKE_PAYLOAD, "test-transactions-201706.csv")).isFalse();
-    verify(connection).getInputStream();
+    verify(connection).getErrorStream();
  }

  @Test
@@ -29,6 +29,7 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 import static org.mockito.Mockito.when;

+import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.util.Arrays;
 import java.util.List;
@@ -104,4 +105,21 @@ public class UrlConnectionUtilsTest {
            "Multipart data contains autogenerated boundary: "
                + "------------------------------AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
  }
+
+  @Test
+  void testErrorStream() throws Exception {
+    HttpsURLConnection connection = mock(HttpsURLConnection.class);
+    when(connection.getResponseCode()).thenReturn(400);
+    when(connection.getErrorStream())
+        .thenReturn(new ByteArrayInputStream("Failure".getBytes(UTF_8)));
+    assertThat(UrlConnectionUtils.getResponseBytes(connection))
+        .isEqualTo("Failure".getBytes(UTF_8));
+  }
+
+  @Test
+  void testErrorStream_null() throws Exception {
+    HttpsURLConnection connection = mock(HttpsURLConnection.class);
+    when(connection.getResponseCode()).thenReturn(400);
+    assertThat(UrlConnectionUtils.getResponseBytes(connection)).isEmpty();
+  }
 }
@@ -108,6 +108,8 @@ class NordnUploadActionTest {
  void beforeEach() throws Exception {
    when(httpUrlConnection.getInputStream())
        .thenReturn(new ByteArrayInputStream("Success".getBytes(UTF_8)));
+    when(httpUrlConnection.getErrorStream())
+        .thenReturn(new ByteArrayInputStream("Failure".getBytes(UTF_8)));
    when(httpUrlConnection.getResponseCode()).thenReturn(SC_ACCEPTED);
    when(httpUrlConnection.getHeaderField(LOCATION)).thenReturn("http://trololol");
    when(httpUrlConnection.getOutputStream()).thenReturn(connectionOutputStream);
@@ -14,9 +14,9 @@
 package google.registry.tools;

 import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth8.assertThat;
 import static google.registry.model.EntityYamlUtils.createObjectMapper;
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
-import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistResource;
@@ -46,6 +46,7 @@ import google.registry.model.tld.Tld.TldNotFoundException;
 import google.registry.model.tld.label.PremiumList;
 import google.registry.model.tld.label.PremiumListDao;
 import java.io.File;
+import java.util.Optional;
 import java.util.logging.Logger;
 import org.joda.money.Money;
 import org.joda.time.DateTime;
@@ -101,20 +102,19 @@ public class ConfigureTldCommandTest extends CommandTestCase<ConfigureTldCommand
    assertThat(updatedTld.getCreateBillingCost()).isEqualTo(Money.of(USD, 25));
    testTldConfiguredSuccessfully(updatedTld, "tld.yaml");
    assertThat(updatedTld.getBreakglassMode()).isFalse();
-    assertThat(tld.getBsaEnrollStartTime()).isNull();
+    assertThat(tld.getBsaEnrollStartTime()).isEmpty();
  }

  @Test
-  void testSuccess_updateTld_bsaTimeUnaffected() throws Exception {
+  void testSuccess_updateTld_existingBsaTimeCarriedOver() throws Exception {
    Tld tld = createTld("tld");
    DateTime bsaStartTime = DateTime.now(DateTimeZone.UTC);
-    tm().transact(() -> tm().put(tld.asBuilder().setBsaEnrollStartTime(bsaStartTime).build()));
+    persistResource(tld.asBuilder().setBsaEnrollStartTime(Optional.of(bsaStartTime)).build());
    File tldFile = tmpDir.resolve("tld.yaml").toFile();
    Files.asCharSink(tldFile, UTF_8).write(loadFile(getClass(), "tld.yaml"));
    runCommandForced("--input=" + tldFile);
-    // TODO(11/30/2023): uncomment below two lines
-    // Tld updatedTld = Tld.get("tld");
-    // assertThat(tld.getBsaEnrollStartTime()).isEqualTo(bsaStartTime);
+    Tld updatedTld = Tld.get("tld");
+    assertThat(updatedTld.getBsaEnrollStartTime()).hasValue(bsaStartTime);
  }

  @Test
@@ -593,7 +593,7 @@ public class ConfigureTldCommandTest extends CommandTestCase<ConfigureTldCommand
  void testSuccess_dryRunOnCreate_noChanges() throws Exception {
    File tldFile = tmpDir.resolve("tld.yaml").toFile();
    Files.asCharSink(tldFile, UTF_8).write(loadFile(getClass(), "tld.yaml"));
-    runCommandForced("--input=" + tldFile, "--dryrun");
+    runCommandForced("--input=" + tldFile, "--dry_run");
    assertThrows(TldNotFoundException.class, () -> Tld.get("tld"));
  }

@@ -53,6 +53,7 @@ abstract class CreateOrUpdateReservedListCommandTestCase<
        .write("sdfgagmsdgs,sdfgsd\nasdf234tafgs,asdfaw\n\n");
    reservedTermsPath = reservedTermsFile.getPath();
    invalidReservedTermsPath = invalidReservedTermsFile.getPath();
+    command.printStream = System.out;
  }

  @Test
@@ -63,10 +63,19 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
    UpdatePremiumListCommand command = new UpdatePremiumListCommand();
    command.inputFile = Paths.get(tmpFile.getPath());
    command.name = TLD_TEST;
-    command.prompt();
    assertThat(command.prompt()).contains("Update premium list for prime?");
  }

+  @Test
+  void commandPrompt_successStageNoChange() throws Exception {
+    File tmpFile = tmpDir.resolve(String.format("%s.txt", TLD_TEST)).toFile();
+    UpdatePremiumListCommand command = new UpdatePremiumListCommand();
+    command.inputFile = Paths.get(tmpFile.getPath());
+    command.name = TLD_TEST;
+    assertThat(command.prompt())
+        .contains("This update contains no changes to the premium list for prime.");
+  }
+
  @Test
  void commandRun_successUpdateList() throws Exception {
    File tmpFile = tmpDir.resolve(String.format("%s.txt", TLD_TEST)).toFile();
@@ -83,6 +92,18 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9999.00"), "eth"));
  }

+  @Test
+  void commandRun_successNoChange() throws Exception {
+    File tmpFile = tmpDir.resolve(String.format("%s.txt", TLD_TEST)).toFile();
+
+    UpdatePremiumListCommand command = new UpdatePremiumListCommand();
+    command.inputFile = Paths.get(tmpFile.getPath());
+    runCommandForced("--name=" + TLD_TEST, "--input=" + command.inputFile);
+
+    assertThat(PremiumListDao.loadAllPremiumEntries(TLD_TEST))
+        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9090.00"), "doge"));
+  }
+
  @Test
  void commandRun_successUpdateList_whenExistingListIsEmpty() throws Exception {
    File existingPremiumFile = tmpDir.resolve(TLD_TEST + ".txt").toFile();
@@ -169,4 +190,19 @@ class UpdatePremiumListCommandTest<C extends UpdatePremiumListCommand>
        .hasMessageThat()
        .isEqualTo("Could not update premium list random3 because it doesn't exist");
  }
+
+  @Test
+  void commandDryRun_noChangesMade() throws Exception {
+    File tmpFile = tmpDir.resolve(String.format("%s.txt", TLD_TEST)).toFile();
+    String newPremiumListData = "eth,USD 9999";
+    Files.asCharSink(tmpFile, UTF_8).write(newPremiumListData);
+
+    UpdatePremiumListCommand command = new UpdatePremiumListCommand();
+    command.inputFile = Paths.get(tmpFile.getPath());
+    runCommandForced("--name=" + TLD_TEST, "--input=" + command.inputFile, "--dry_run");
+
+    assertThat(PremiumListDao.loadAllPremiumEntries(TLD_TEST))
+        .comparingElementsUsing(immutableObjectCorrespondence("revisionId"))
+        .containsExactly(PremiumEntry.create(0L, new BigDecimal("9090.00"), "doge"));
+  }
 }
@@ -66,6 +66,8 @@ class UpdateReservedListCommandTest
    assertThat(ReservedList.get("xn--q9jyb4c_common-reserved")).isPresent();
    ReservedList reservedList = ReservedList.get("xn--q9jyb4c_common-reserved").get();
    assertThat(reservedList.getShouldPublish()).isFalse();
+    assertInStdout("Update reserved list for xn--q9jyb4c_common-reserved?");
+    assertInStdout("shouldPublish: true -> false");
  }

  @Test
@@ -85,6 +87,10 @@ class UpdateReservedListCommandTest
    assertThat(reservedList.getReservationInList("baddies")).hasValue(FULLY_BLOCKED);
    assertThat(reservedList.getReservationInList("ford")).hasValue(FULLY_BLOCKED);
    assertThat(reservedList.getReservationInList("helicopter")).isEmpty();
+    assertInStdout("Update reserved list for xn--q9jyb4c_common-reserved?");
+    assertInStdout("helicopter: helicopter,FULLY_BLOCKED -> null");
+    assertInStdout("baddies: null -> baddies,FULLY_BLOCKED");
+    assertInStdout("ford: null -> ford,FULLY_BLOCKED # random comment");
  }

  @Test
@@ -127,11 +133,13 @@ class UpdateReservedListCommandTest
    // CreateOrUpdateReservedListCommandTestCases.java
    UpdateReservedListCommand command = new UpdateReservedListCommand();
    command.input = Paths.get(reservedTermsPath);
+    command.shouldPublish = false;
    command.init();

    assertThat(command.prompt()).contains("Update reserved list for xn--q9jyb4c_common-reserved?");
-    assertThat(command.prompt()).contains("Old list: [(helicopter,FULLY_BLOCKED)]");
-    assertThat(command.prompt())
-        .contains("New list: [(baddies,FULLY_BLOCKED), (ford,FULLY_BLOCKED # random comment)]");
+    assertThat(command.prompt()).contains("shouldPublish: true -> false");
+    assertThat(command.prompt()).contains("helicopter: helicopter,FULLY_BLOCKED -> null");
+    assertThat(command.prompt()).contains("baddies: null -> baddies,FULLY_BLOCKED");
+    assertThat(command.prompt()).contains("ford: null -> ford,FULLY_BLOCKED # random comment");
  }
 }
@@ -21,6 +21,7 @@ import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistDomainAsDeleted;

 import com.google.api.client.http.HttpStatusCodes;
+import com.google.common.collect.Iterables;
 import com.google.gson.Gson;
 import google.registry.model.EppResourceUtils;
 import google.registry.model.console.GlobalRole;
@@ -90,7 +91,7 @@ public class ConsoleDomainListActionTest {
  @Test
  void testSuccess_pages() {
    // Two pages of results should go in reverse chronological order
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, null);
    action.run();
    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains.stream().map(Domain::getDomainName).collect(toImmutableList()))
@@ -98,7 +99,7 @@ public class ConsoleDomainListActionTest {
    assertThat(result.totalResults).isEqualTo(10);

    // Now do the second page
-    action = createAction("TheRegistrar", result.checkpointTime, 1, 5, 10L);
+    action = createAction("TheRegistrar", result.checkpointTime, 1, 5, 10L, null);
    action.run();
    result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains.stream().map(Domain::getDomainName).collect(toImmutableList()))
@@ -107,7 +108,7 @@ public class ConsoleDomainListActionTest {

  @Test
  void testSuccess_partialPage() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 1, 8, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 1, 8, null, null);
    action.run();
    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains.stream().map(Domain::getDomainName).collect(toImmutableList()))
@@ -116,7 +117,7 @@ public class ConsoleDomainListActionTest {

  @Test
  void testSuccess_checkpointTime_createdBefore() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 10, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 10, null, null);
    action.run();

    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
@@ -127,7 +128,7 @@ public class ConsoleDomainListActionTest {
    persistActiveDomain("newdomain.tld", clock.nowUtc());

    // Even though we persisted a new domain, the old checkpoint should return no more results
-    action = createAction("TheRegistrar", result.checkpointTime, 1, 10, null);
+    action = createAction("TheRegistrar", result.checkpointTime, 1, 10, null, null);
    action.run();
    result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains).isEmpty();
@@ -136,7 +137,7 @@ public class ConsoleDomainListActionTest {

  @Test
  void testSuccess_checkpointTime_deletion() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, null);
    action.run();
    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);

@@ -146,16 +147,50 @@ public class ConsoleDomainListActionTest {
    persistDomainAsDeleted(toDelete, clock.nowUtc());

    // Second page should include the domain that is now deleted due to the checkpoint time
-    action = createAction("TheRegistrar", result.checkpointTime, 1, 5, null);
+    action = createAction("TheRegistrar", result.checkpointTime, 1, 5, null, null);
    action.run();
    result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains.stream().map(Domain::getDomainName).collect(toImmutableList()))
        .containsExactly("4exists.tld", "3exists.tld", "2exists.tld", "1exists.tld", "0exists.tld");
  }

+  @Test
+  void testSuccess_searchTerm_oneMatch() {
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, "0");
+    action.run();
+    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
+    assertThat(Iterables.getOnlyElement(result.domains).getDomainName()).isEqualTo("0exists.tld");
+  }
+
+  @Test
+  void testSuccess_searchTerm_returnsNone() {
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, "deleted");
+    action.run();
+    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
+    assertThat(result.domains).isEmpty();
+  }
+
+  @Test
+  void testSuccess_searchTerm_caseInsensitive() {
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, "eXiStS");
+    action.run();
+    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
+    assertThat(result.domains).hasSize(5);
+    assertThat(result.totalResults).isEqualTo(10);
+  }
+
+  @Test
+  void testSuccess_searchTerm_tld() {
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 5, null, "tld");
+    action.run();
+    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
+    assertThat(result.domains).hasSize(5);
+    assertThat(result.totalResults).isEqualTo(10);
+  }
+
  @Test
  void testPartialSuccess_pastEnd() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 5, 5, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 5, 5, null, null);
    action.run();
    DomainListResult result = GSON.fromJson(response.getPayload(), DomainListResult.class);
    assertThat(result.domains).isEmpty();
@@ -163,13 +198,13 @@ public class ConsoleDomainListActionTest {

  @Test
  void testFailure_invalidResultsPerPage() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 0, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, 0, 0, null, null);
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
    assertThat(response.getPayload())
        .isEqualTo("Results per page must be between 1 and 500 inclusive");

-    action = createAction("TheRegistrar", null, 0, 501, null);
+    action = createAction("TheRegistrar", null, 0, 501, null, null);
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
    assertThat(response.getPayload())
@@ -178,14 +213,14 @@ public class ConsoleDomainListActionTest {

  @Test
  void testFailure_invalidPageNumber() {
-    ConsoleDomainListAction action = createAction("TheRegistrar", null, -1, 10, null);
+    ConsoleDomainListAction action = createAction("TheRegistrar", null, -1, 10, null, null);
    action.run();
    assertThat(response.getStatus()).isEqualTo(HttpStatusCodes.STATUS_CODE_BAD_REQUEST);
    assertThat(response.getPayload()).isEqualTo("Page number must be non-negative");
  }

  private ConsoleDomainListAction createAction(String registrarId) {
-    return createAction(registrarId, null, null, null, null);
+    return createAction(registrarId, null, null, null, null, null);
  }

  private ConsoleDomainListAction createAction(
@@ -193,7 +228,8 @@ public class ConsoleDomainListActionTest {
      @Nullable DateTime checkpointTime,
      @Nullable Integer pageNumber,
      @Nullable Integer resultsPerPage,
-      @Nullable Long totalResults) {
+      @Nullable Long totalResults,
+      @Nullable String searchTerm) {
    response = new FakeResponse();
    AuthResult authResult =
        AuthResult.createUser(
@@ -210,6 +246,7 @@ public class ConsoleDomainListActionTest {
        Optional.ofNullable(checkpointTime),
        Optional.ofNullable(pageNumber),
        Optional.ofNullable(resultsPerPage),
-        Optional.ofNullable(totalResults));
+        Optional.ofNullable(totalResults),
+        Optional.ofNullable(searchTerm));
  }
 }
@@ -34,6 +34,24 @@
          <fee:command>create</fee:command>
          <fee:period unit="y">1</fee:period>
        </fee:domain>
+        <fee:domain>
+          <fee:name>example1.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+        </fee:domain>
+        <fee:domain>
+          <fee:name>example2.example</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+        </fee:domain>
+        <fee:domain>
+          <fee:name>reserved.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+        </fee:domain>
      </fee:check>
    </extension>
    <clTRID>ABC-12345</clTRID>
@@ -42,6 +42,28 @@
          <fee:period unit="y">1</fee:period>
          <fee:class>token-not-supported</fee:class>
        </fee:cd>
+        <fee:cd>
+          <fee:name>example1.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:fee description="renew">11.00</fee:fee>
+          <fee:class>premium</fee:class>
+        </fee:cd>
+        <fee:cd>
+          <fee:name>example2.example</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:class>token-not-supported</fee:class>
+        </fee:cd>
+        <fee:cd>
+          <fee:name>reserved.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:class>token-not-supported</fee:class>
+        </fee:cd>
      </fee:chkData>
    </extension>
    <trID>
@@ -41,6 +41,27 @@
          <fee:period unit="y">1</fee:period>
          <fee:class>reserved</fee:class>
        </fee:cd>
+        <fee:cd>
+          <fee:name>example1.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:class>token-not-supported</fee:class>
+        </fee:cd>
+        <fee:cd>
+          <fee:name>example2.example</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:class>token-not-supported</fee:class>
+        </fee:cd>
+        <fee:cd>
+          <fee:name>reserved.tld</fee:name>
+          <fee:currency>USD</fee:currency>
+          <fee:command>renew</fee:command>
+          <fee:period unit="y">1</fee:period>
+          <fee:class>token-not-supported</fee:class>
+        </fee:cd>
      </fee:chkData>
    </extension>
    <trID>
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp xmlns:domain="urn:ietf:params:xml:ns:domain-1.0" xmlns:contact="urn:ietf:params:xml:ns:contact-1.0" xmlns:fee="urn:ietf:params:xml:ns:fee-0.6" xmlns="urn:ietf:params:xml:ns:epp-1.0" xmlns:rgp="urn:ietf:params:xml:ns:rgp-1.0" xmlns:bulkToken="urn:google:params:xml:ns:bulkToken-1.0" xmlns:fee11="urn:ietf:params:xml:ns:fee-0.11" xmlns:fee12="urn:ietf:params:xml:ns:fee-0.12" xmlns:launch="urn:ietf:params:xml:ns:launch-1.0" xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1" xmlns:host="urn:ietf:params:xml:ns:host-1.0">
+    <response>
+        <result code="2306">
+            <msg>Domain label is blocked by the Brand Safety Alliance</msg>
+        </result>
+        <trID>
+            <svTRID>server-trid</svTRID>
+        </trID>
+    </response>
+</epp>
@@ -149,3 +149,4 @@ V148__add_bsa_download_and_label_tables.sql
 V149__add_bsa_domain_in_use_table.sql
 V150__add_tld_bsa_enroll_date.sql
 V151__add_bsa_unblockable_domain_table.sql
+V152__add_bsa_domain_refresh_table.sql
@@ -0,0 +1,21 @@
+-- Copyright 2023 The Nomulus Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE TABLE "BsaDomainRefresh" (
+   job_id  bigserial not null,
+   creation_time timestamptz not null,
+   stage text not null,
+   update_timestamp timestamptz,
+   primary key (job_id)
+);
@@ -728,6 +728,7 @@
        auto_renew_grace_period_length interval not null,
        automatic_transfer_length interval not null,
        breakglass_mode boolean not null,
+        bsa_enroll_start_time timestamptz,
        claims_period_end timestamptz not null,
        create_billing_cost_amount numeric(19, 2),
        create_billing_cost_currency text,
@@ -135,6 +135,37 @@ CREATE TABLE public."BsaDomainInUse" (
 );


+--
+-- Name: BsaDomainRefresh; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public."BsaDomainRefresh" (
+    job_id bigint NOT NULL,
+    creation_time timestamp with time zone NOT NULL,
+    stage text NOT NULL,
+    update_timestamp timestamp with time zone
+);
+
+
+--
+-- Name: BsaDomainRefresh_job_id_seq; Type: SEQUENCE; Schema: public; Owner: -
+--
+
+CREATE SEQUENCE public."BsaDomainRefresh_job_id_seq"
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+--
+-- Name: BsaDomainRefresh_job_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
+--
+
+ALTER SEQUENCE public."BsaDomainRefresh_job_id_seq" OWNED BY public."BsaDomainRefresh".job_id;
+
+
 --
 -- Name: BsaDownload; Type: TABLE; Schema: public; Owner: -
 --
@@ -1222,6 +1253,13 @@ CREATE SEQUENCE public.project_wide_unique_id_seq
    CACHE 10;


+--
+-- Name: BsaDomainRefresh job_id; Type: DEFAULT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public."BsaDomainRefresh" ALTER COLUMN job_id SET DEFAULT nextval('public."BsaDomainRefresh_job_id_seq"'::regclass);
+
+
 --
 -- Name: BsaDownload job_id; Type: DEFAULT; Schema: public; Owner: -
 --
@@ -1339,6 +1377,14 @@ ALTER TABLE ONLY public."BsaDomainInUse"
    ADD CONSTRAINT "BsaDomainInUse_pkey" PRIMARY KEY (label, tld);


+--
+-- Name: BsaDomainRefresh BsaDomainRefresh_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public."BsaDomainRefresh"
+    ADD CONSTRAINT "BsaDomainRefresh_pkey" PRIMARY KEY (job_id);
+
+
 --
 -- Name: BsaDownload BsaDownload_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -384,6 +384,7 @@ An EPP flow that creates a new domain resource.
    *   The requested fees cannot be provided in the requested currency.
    *   Non-IDN domain names cannot contain hyphens in the third or fourth
        position.
+    *   Domain label is blocked by the Brand Safety Alliance.
    *   Domain labels cannot be longer than 63 characters.
    *   More than one contact for a given role is not allowed.
    *   No part of a domain name can be empty.
@@ -78,8 +78,8 @@ steps:
      grep -e "^backend\|^default\|^bsa\|^pubapi\|^tools" |\
      while read line; do echo "${TAG_NAME},$line"; done | tee "$local_map"
    num_versions=$(cat "$local_map" | wc -l)
-    if [ "$num_versions" -ne 4 ]; then
-      echo "Expecting exactly four active services. Found $num_versions"
+    if [ "$num_versions" -ne 5 ]; then
+      echo "Expecting exactly five active services. Found $num_versions"
      exit 1
    fi
    gsutil cp "$local_map" gs://$PROJECT_ID-deployed-tags/nomulus.${_ENV}.tmp
Author	SHA1	Message	Date
Weimin Yu	55d5f8c6f8	Forbid domain creation with label blocked by BSA (#2236 ) * Forbid domain creation with label blocked by BSA Add a BSA label check in the DomainCreation flow.	2023-12-11 22:14:12 -05:00
Pavlo Tkach	9006312253	Create reusable dialog / bottom sheet component (#2237 )	2023-12-08 17:52:57 -05:00
gbrodman	e5e2370923	Debouncedly use a search term in console domain list (#2242 )	2023-12-08 15:37:30 -05:00
sarahcaseybot	b3b0efd47e	Add a dryrun tag to UpdatePremiumListCommand and early exit command if no new changes to the list (#2246 ) * Add a dryrun tag to UpdatePremiumListCommand and early exit command if no new changes to the list * Change prompt string when no change to list to reflect that there is no actual prompted user input * Add camelCase and correct flag name	2023-12-08 14:35:05 -05:00
Lai Jiang	e82cbe60a9	Do not log nested transactions in production (#2251 ) This might be the cause of the SQL performance degradation that we are observing during the recent launch. The change went in a month ago but there hasn't been enough increase in mutating traffic to make it problematic until the launch. Note that presubmits should run faster too with this chance, which serves as an evidence that excessive logging is the culprit.	2023-12-07 19:02:16 -05:00
Weimin Yu	923bc13e3a	Start using Tld's bsaEnrollStartTime field (#2239 ) * Start using Tld's bsaEnrollStartTime field Longer-term change is tracked in b/309175410	2023-12-06 17:11:36 -05:00
Lai Jiang	4893ea307b	Check for null error stream (#2249 )	2023-12-06 13:30:37 -05:00
Pavlo Tkach	01f868cefc	Increase number of service to 5 in cloudbuild-deploy (#2248 )	2023-12-06 13:21:17 -05:00
Weimin Yu	1b0919eaff	Add the BsaDomainRefresh table (#2247 ) Add the BsaDomainRefresh table which tracks the refresh actions. The refresh actions checks for changes in the set of registered and reserved domains, which are called unblockables to BSA.	2023-12-06 11:55:42 -05:00
Lai Jiang	92b23bac16	Use the error stream when HTTP response code is non-200 (#2245 )	2023-12-06 10:42:19 -05:00
gbrodman	cc9b3f5965	Filter in SQL when updating/deleting alloc tokens (#2244 ) This doesn't fix any issues with dead/livelocks when deleting or updating allocation tokens, but it at least will significantly reduce the time to load the tokens that we'll want to update/delete.	2023-12-04 19:24:17 -05:00
gbrodman	dd86c56ddc	Return the correct renewal fee for anchor tenants in domain checks (#2238 ) The code as previously written assumed that creation fees would be the same as renewal fees -- this is not the case for anchor tenants, where the renewal fee is always the standard cost for the TLD (instead of any premium cost). This was already handled properly in the actual billing implementation, but we didn't tell the user the right renewal cost in domain checks. This also removes some warning logs related to nested transactions	2023-12-01 15:37:05 -05:00
Pavlo Tkach	08551f7bc7	Enable static ip for bsa service production (#2240 )	2023-12-01 14:25:38 -05:00
Lai Jiang	e7171a326b	Use reTransact when loading caches (#2234 ) Similar to #2179, but adds a few calls missed in that PR.	2023-11-30 15:13:36 -05:00
gbrodman	c3eae7b76f	Add an optional search term for ConsoleDomainListAction (#2225 ) It's a case-insensitive query and it can appear anywhere (including TLDs)	2023-11-30 11:42:50 -05:00
Pavlo Tkach	2687181045	Update console file naming to be camelCase like (#2235 )	2023-11-30 11:42:36 -05:00
gbrodman	68750569db	Pretty-print reserved list updates in the CLI (#2226 ) We shouldn't have to parse through every single entry to see what changed Note: we don't do this for premium lists because those can be HUGE and we don't want/need to load and display every entry. This was an explicit choice made in https://github.com/google/nomulus/pull/1482	2023-11-30 11:32:12 -05:00
Lai Jiang	028e5cc958	Make read-only transactions more performant (#2233 ) Since the replica SQL instance is read-only, any transaction performed on it should be explicitly read-only, which would allow PostgreSQL to optimize away (some) use of predicate locks. Also changed the EPP cache to read from the replica. The foreign key cache already behaves this way. See: https://www.postgresql.org/docs/current/transaction-iso.html	2023-11-29 15:55:50 -05:00
Weimin Yu	853e571d01	Add more BSA configs (#2230 ) * Add more BSA configs Added urls for reporting order and domains to BSA. Also added operational configs.	2023-11-28 16:40:36 -05:00