Fix Console API and Angular XSS security flaws (#3076)

This commit addresses the following security vulnerabilities identified in the recent audit of the Console App and Backend APIs:

1. Angular XSS: Removed unsafe [innerHTML] bindings across all console-webapp templates (Contact, Registrars, Registrar Details, Users List) in favor of standard Angular interpolation.
2. Broken Access Control (IDOR): PasswordResetRequestAction and PasswordResetVerifyAction now explicitly verify that the target user's email belongs to the authorized registrarId.
3. Missing Permission Check: ConsoleEppPasswordAction now explicitly checks for CONFIGURE_EPP_CONNECTION permission before updating the EPP password.
4. Denial of Service (DoS): ConsoleBulkDomainAction now strictly limits the size of bulk domain lists (configurable, default 500) to prevent thread exhaustion.
5. Denial of Service (OOM): ConsoleHistoryDataAction now uses .setMaxResults() (configurable, default 500) on JPA native queries to prevent eager loading of the entire database into memory.

Makes the history query limit and bulk domain action limit configurable via RegistryConfig, allowing smaller limits to be used in tests to avoid heavy resource persistence.

Also removes an outdated Joda-Time migration reference from GEMINI.md.

.gemini/skills/pr-polisher/scripts/check_diff.py

@@ -285,6 +285,25 @@ def check_diff_anti_patterns():
             if 'src/test/' in current_file and clock_now_pattern.search(code_line):
                 log_warning(f"[{current_file}] Prefer using a fixed, static constant Instant over capturing clock.now() in tests to prevent flakiness.")
 
+def check_missing_tests():
+    print("\n--- Checking for Missing Tests ---")
+    diff_files = run_cmd("git diff HEAD^ --name-only").split('\n')
+    main_files_modified = False
+    test_files_modified = False
+
+    for f in diff_files:
+        if f.startswith('core/src/main/') or f.startswith('util/src/main/'):
+            if f.endswith('.java'):
+                main_files_modified = True
+        if f.startswith('core/src/test/') or f.startswith('util/src/test/'):
+            if f.endswith('Test.java'):
+                test_files_modified = True
+
+    if main_files_modified and not test_files_modified:
+        log_warning("Production code (.java files in src/main/) was modified, but no corresponding tests (.java files in src/test/) were added or updated. You MUST proactively write tests for any new logic or bug fixes.")
+    else:
+        log_success("Test coverage check passed (tests were included or no production Java code was changed).")
+
 def main():
     print("========================================")
     print("     NOMULUS PR POLISHER CHECKLIST      ")
@@ -295,6 +314,7 @@ def main():
     check_workspace_clean()
     check_package_lock()
     check_license_headers()
+    check_missing_tests()
     check_formatting()
     check_diff_anti_patterns()
 

GEMINI.md

@@ -46,6 +46,7 @@ This document outlines foundational mandates, architectural patterns, and projec
     - **Transactional Time:** Ensure code that relies on `tm().getTransactionTime()` (or `tm().getTxTime()`) is executed within a transaction context.
 
 ### 5. Testing Best Practices
+- **Mandatory Proactive Testing:** You MUST automatically write and update tests alongside your code changes WITHOUT waiting for the user to prompt you. If you add a new feature, fix a bug, or change core logic, you are explicitly required to identify the corresponding `*Test.java` file and implement comprehensive test coverage for your changes.
 - **FakeClock and Sleeper:** Use `FakeClock` and `Sleeper` for any logic involving timeouts, delays, or expiration.
 - **Empirical Reproduction:** Before fixing a bug, always create a test case that reproduces the failure.
 - **Base Classes:** Leverage `CommandTestCase`, `EppToolCommandTestCase`, etc., to reduce boilerplate and ensure consistent setup (e.g., clock initialization).
@@ -93,7 +94,7 @@ Do not wait for the user to tell you to improve the skills; it is your responsib
 
 # Gemini Engineering Guide: Nomulus Codebase
 
-This document captures high-level architectural patterns, lessons learned from large-scale refactorings (like the Joda-Time to `java.time` migration), and specific instructions to avoid common pitfalls in this environment.
+This document captures high-level architectural patterns, lessons learned from large-scale refactorings, and specific instructions to avoid common pitfalls in this environment.
 
 ## 🏛 Architecture Overview
 

README.md

@@ -12,7 +12,7 @@ Nomulus is an open source, scalable, cloud-based service for operating
 [top-level domains](https://en.wikipedia.org/wiki/Top-level_domain) (TLDs). It
 is the authoritative source for the TLDs that it runs, meaning that it is
 responsible for tracking domain name ownership and handling registrations,
-renewals, availability checks, and WHOIS requests. End-user registrants (i.e.,
+renewals, availability checks, and RDAP requests. End-user registrants (i.e.,
 people or companies that want to register a domain name) use an intermediate
 domain name registrar acting on their behalf to interact with the registry.
 
@@ -97,7 +97,7 @@ Nomulus has the following capabilities:
       for details), and an implementation based on
       [Google Cloud Secret Manager](https://cloud.google.com/security/products/secret-manager) is
       available.
-*   **TPC Proxy**: Nomulus is built on top of the [Jetty](https://jetty.org/)
+*   **TCP Proxy**: Nomulus is built on top of the [Jetty](https://jetty.org/)
     container that implements the [Jakarta Servlet](https://jakarta.ee/specifications/servlet/)
     specification and only serves HTTP/S traffic. A proxy to translate raw TCP traffic (e.g., EPP)
     to and from HTTP is provided.

build.gradle

@@ -609,3 +609,23 @@ gradle.taskGraph.whenReady { graph ->
     }
   }
 }
+
+task fastBuild {
+  group = 'build'
+  description = 'A lightweight build for local dev. Compiles Java, runs standard tests, and checks formatting, but skips Docker images, fragile tests, and the massive Angular console builds. (Do not use this target to verify console changes.)'
+
+  dependsOn build
+  // Remove the heavy default dependencies specifically for fastBuild
+  gradle.taskGraph.whenReady { graph ->
+    if (graph.hasTask(fastBuild)) {
+      project(':console-webapp').tasks.named('buildConsoleForAll').get().enabled = false
+      project(':jetty').tasks.named('buildNomulusImage').get().enabled = false
+      project(':core').tasks.named('buildToolImage').get().enabled = false
+      project(':core').tasks.named('fragileTest').get().enabled = false
+      project(':jetty').tasks.named('stage').get().enabled = false
+      if (project.tasks.findByName('stage') != null) {
+        project.tasks.named('stage').get().enabled = false
+      }
+    }
+  }
+}

console-webapp/README.md

@@ -9,15 +9,14 @@ expected to change.
 
 ## Deployment
 
-The webapp is deployed with the nomulus default service war to GKE.
-During nomulus default service war build task, gradle script triggers the
-following:
+The webapp is deployed as part of the default Nomulus GKE service image.
+During the image build task, the Gradle script triggers the following:
 
 1) Console webapp build script `buildConsoleWebapp`, which installs
    dependencies, assembles a compiled ts -> js, minified, optimized static
    artifact (html, css, js)
-2) Artifact assembled in step 1 then gets copied to core project web artifact
-   location, so that it can be deployed with the rest of the core webapp
+2) Artifact assembled in step 1 then gets copied to the jetty webapp resource
+   location, so that it can be staged inside the default GKE service container.
 
 ## Development server
 

console-webapp/build.gradle

@@ -53,10 +53,17 @@ def createConsoleTask = { env ->
   project.tasks.register("buildConsoleFor${env.capitalize()}", Exec) {
     workingDir "${consoleDir}/"
     executable 'npx'
-    args 'ng', 'build', '--base-href=/console/', "--configuration=${env}", "--output-path=staged/console-${env}"
+    args 'ng', 'build', '--base-href=/console/', "--configuration=${env}"
     doFirst {
       println "Building console for environment: ${env}"
     }
+    doLast {
+      copy {
+        from "${consoleDir}/staged/dist/"
+        into "${consoleDir}/staged/console-${env}"
+      }
+      delete "${consoleDir}/staged/dist"
+    }
     dependsOn(tasks.npmInstallDeps)
   }
   project.tasks.register("deleteConsoleFor${env.capitalize()}", Delete) {
@@ -74,6 +81,14 @@ def createConsoleTask = { env ->
   createConsoleTask(env)
 }
 
+// Force an order so we don't run these tasks in parallel.
+tasks.buildConsoleForCrash.mustRunAfter(tasks.buildConsoleForAlpha)
+tasks.buildConsoleForQa.mustRunAfter(tasks.buildConsoleForCrash)
+tasks.buildConsoleForSandbox.mustRunAfter(tasks.buildConsoleForQa)
+tasks.buildConsoleForProduction.mustRunAfter(tasks.buildConsoleForSandbox)
+// This task must run last, otherwise the previous tasks will have deleted the "dist" folder.
+tasks.buildConsoleWebapp.mustRunAfter(tasks.buildConsoleForProduction)
+
 task applyFormatting(type: Exec) {
   workingDir "${consoleDir}/"
   executable 'npm'
@@ -92,3 +107,4 @@ tasks.applyFormatting.dependsOn(tasks.npmInstallDeps)
 tasks.checkFormatting.dependsOn(tasks.npmInstallDeps)
 tasks.build.dependsOn(tasks.checkFormatting)
 tasks.build.dependsOn(tasks.runConsoleWebappUnitTests)
+tasks.build.dependsOn(tasks.buildConsoleForAll)

console-webapp/src/app/domains/domainList.component.ts

@@ -48,7 +48,11 @@ interface DomainData {
   selector: 'app-response-dialog',
   template: `
     <h2 mat-dialog-title>{{ data.title }}</h2>
-    <mat-dialog-content [innerHTML]="data.content" />
+    <mat-dialog-content>
+      @for (line of data.content; track line) {
+      <div>{{ line }}</div>
+      }
+    </mat-dialog-content>
     <mat-dialog-actions>
       <button mat-button (click)="onClose()">Close</button>
     </mat-dialog-actions>
@@ -59,7 +63,7 @@ export class ResponseDialogComponent {
   constructor(
     public dialogRef: MatDialogRef<ReasonDialogComponent>,
     @Inject(MAT_DIALOG_DATA)
-    public data: { title: string; content: string }
+    public data: { title: string; content: string[] }
   ) {}
 
   onClose(): void {
@@ -312,11 +316,13 @@ export class DomainListComponent {
           this.dialog.open(ResponseDialogComponent, {
             data: {
               title: 'Domain Deletion Results',
-              content: `Successfully deleted - ${successCount} domain(s)<br/>Failed to delete - ${failureCount} domain(s)<br/>${
+              content: [
+                `Successfully deleted - ${successCount} domain(s)`,
+                `Failed to delete - ${failureCount} domain(s)`,
                 failureCount
-                  ? 'Some domains could not be deleted due to ongoing processes or server errors. '
-                  : ''
-              }Please check the table for more information.`,
+                  ? 'Some domains could not be deleted due to ongoing processes or server errors. Please check the table for more information.'
+                  : 'Please check the table for more information.',
+              ],
             },
           });
           this.selection.clear();

console-webapp/src/app/registrar/registrarDetails.component.html

@@ -97,10 +97,9 @@
           @for (column of columns; track column.columnDef) {
           <mat-list-item role="listitem">
             <span class="console-app__list-key">{{ column.header }} </span>
-            <span
-              class="console-app__list-value"
-              [innerHTML]="column.cell(registrarInEdit).replace('<br/>', ' ')"
-            ></span>
+            <span class="console-app__list-value">{{
+              column.cell(registrarInEdit)
+            }}</span>
           </mat-list-item>
           <mat-divider></mat-divider>
           }

console-webapp/src/app/registrar/registrarsTable.component.html

@@ -49,10 +49,9 @@
           <mat-header-cell *matHeaderCellDef>
             {{ column.header }}
           </mat-header-cell>
-          <mat-cell
-            *matCellDef="let row"
-            [innerHTML]="column.cell(row)"
-          ></mat-cell>
+          <mat-cell *matCellDef="let row" style="white-space: pre-wrap">{{
+            column.cell(row)
+          }}</mat-cell>
         </ng-container>
         }
         <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>

console-webapp/src/app/registrar/registrarsTable.component.ts

@@ -56,7 +56,7 @@ export const columns = [
     cell: (record: Registrar) =>
       `${Object.entries(record.billingAccountMap || {}).reduce(
         (acc, [key, val]) => {
-          return `${acc}${key}=${val}<br/>`;
+          return `${acc}${key}=${val}\n`;
         },
         ''
       )}`,

console-webapp/src/app/settings/contact/contact.component.html

@@ -25,7 +25,18 @@
     @for (column of columns; track column) {
     <ng-container [matColumnDef]="column.columnDef">
       <mat-header-cell *matHeaderCellDef> {{ column.header }} </mat-header-cell>
-      <mat-cell *matCellDef="let row" [innerHTML]="column.cell(row)"></mat-cell>
+      <mat-cell *matCellDef="let row">
+        @if (column.columnDef === 'name') {
+        <div class="contact__name-column">
+          <div class="contact__name-column-title">{{ row.name }}</div>
+          <div class="contact__name-column-roles">
+            {{ row.userFriendlyTypes.join(" • ") }}
+          </div>
+        </div>
+        } @else {
+        {{ column.cell(row) }}
+        }
+      </mat-cell>
     </ng-container>
     }
     <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>

console-webapp/src/app/settings/contact/contact.component.ts

@@ -34,14 +34,7 @@ export default class ContactComponent {
     {
       columnDef: 'name',
       header: 'Name',
-      cell: (contact: ViewReadyContact) => `
-        <div class="contact__name-column">
-          <div class="contact__name-column-title">${contact.name}</div>
-          <div class="contact__name-column-roles">${contact.userFriendlyTypes.join(
-            ' • '
-          )}</div>
-          </div>
-      `,
+      cell: (contact: ViewReadyContact) => `${contact.name}`,
     },
     {
       columnDef: 'emailAddress',

console-webapp/src/app/users/usersList.component.html

@@ -10,7 +10,7 @@
       <mat-header-cell *matHeaderCellDef>
         {{ column.header }}
       </mat-header-cell>
-      <mat-cell *matCellDef="let row" [innerHTML]="column.cell(row)"></mat-cell>
+      <mat-cell *matCellDef="let row">{{ column.cell(row) }}</mat-cell>
     </ng-container>
     }
     <mat-header-row *matHeaderRowDef="displayedColumns"></mat-header-row>

core/build.gradle

@@ -170,7 +170,6 @@ dependencies {
   implementation deps['com.google.oauth-client:google-oauth-client-servlet']
   implementation deps['com.google.re2j:re2j']
   implementation deps['org.freemarker:freemarker']
-  implementation deps['com.googlecode.json-simple:json-simple']
   implementation deps['com.github.mwiede:jsch']
   implementation deps['com.zaxxer:HikariCP']
   implementation deps['com.squareup.okhttp3:okhttp']
@@ -443,7 +442,7 @@ project.tasks.create('generateSqlSchema', JavaExec) {
   mainClass = 'google.registry.tools.DevTool'
   jvmArgs "--sun-misc-unsafe-memory-access=allow"
   args = [
-      '-e', 'alpha',
+      '-e', 'unittest',
       'generate_sql_schema', '--start_postgresql', '-o',
       "${rootProject.projectRootDir}/db/src/main/resources/sql/schema/" +
       "db-schema.sql.generated"
@@ -742,9 +741,9 @@ test {
   // Don't run any tests from this task, all testing gets done in the
   // FilteringTest tasks.
   exclude "**"
-}.dependsOn(standardTest, registryToolIntegrationTest, sqlIntegrationTest)
+}.dependsOn(standardTest, registryToolIntegrationTest, sqlIntegrationTest, fragileTest)
 
 // When we override tests, we also break the cleanTest command.
-cleanTest.dependsOn(cleanStandardTest, cleanRegistryToolIntegrationTest, cleanSqlIntegrationTest)
+cleanTest.dependsOn(cleanStandardTest, cleanRegistryToolIntegrationTest, cleanSqlIntegrationTest, cleanFragileTest)
 
-project.build.dependsOn devtool
+project.build.dependsOn devtool, buildToolImage

core/gradle.lockfile

@@ -192,7 +192,6 @@ com.google.protobuf:protobuf-java:4.33.2=annotationProcessor,nonprodAnnotationPr
 com.google.protobuf:protobuf-java:4.35.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.re2j:re2j:1.8=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.truth:truth:1.4.5=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.googlecode.json-simple:json-simple:1.1.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.ibm.icu:icu4j:73.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.lmax:disruptor:3.4.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.puppycrawl.tools:checkstyle:10.24.0=checkstyle

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -212,17 +212,16 @@ public class RdeIO {
           }
         }
 
-        // Don't write the IDN elements for BRDA.
+        // Don't write the IDN elements or EPP params for BRDA.
         if (mode == RdeMode.FULL) {
           for (IdnTableEnum idn : IdnTableEnum.values()) {
             output.write(marshaller.marshalIdn(idn.getTable()));
             counter.increment(RdeResourceType.IDN);
           }
+          output.write(marshaller.marshalRdeEppParams());
+          counter.increment(RdeResourceType.EPP_PARAMS);
         }
 
-        output.write(marshaller.marshalRdeEppParams());
-        counter.increment(RdeResourceType.EPP_PARAMS);
-
         // Output XML that says how many resources were emitted.
         header = counter.makeHeader(tld, mode);
         output.write(marshaller.marshalOrDie(new XjcRdeHeaderElement(header)));

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -372,7 +372,7 @@ public class RdePipeline implements Serializable {
    * <p>The (repoId, pendingDeposit) pairs denote hosts that are referenced from a domain, that are
    * to be included in the corresponding pending deposit.
    *
-   * <p>The (repoId, revisionId) paris come from the most recent history entry query, which can be
+   * <p>The (repoId, revisionId) pairs come from the most recent history entry query, which can be
    * used to load the embedded resources themselves.
    *
    * @return a pair of (repoId, ([pendingDeposit], [revisionId])) where neither the pendingDeposit

core/src/main/java/google/registry/cache/SimplifiedJedisClient.java

@@ -25,10 +25,20 @@ import com.google.common.flogger.FluentLogger;
 import google.registry.model.EppResource;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
+import io.protostuff.Input;
 import io.protostuff.LinkedBuffer;
+import io.protostuff.Output;
+import io.protostuff.Pipe;
 import io.protostuff.ProtostuffIOUtil;
 import io.protostuff.Schema;
+import io.protostuff.WireFormat;
+import io.protostuff.runtime.DefaultIdStrategy;
+import io.protostuff.runtime.Delegate;
 import io.protostuff.runtime.RuntimeSchema;
+import java.io.IOException;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.net.InetAddress;
 import java.nio.charset.StandardCharsets;
 import java.util.Optional;
 import redis.clients.jedis.AbstractPipeline;
@@ -52,11 +62,20 @@ public class SimplifiedJedisClient {
           Domain.class, "d_",
           Host.class, "h_");
 
+  /** We need to inform Protostuff of the custom {@link InetAddress} delegates. */
+  private static DefaultIdStrategy createIdStrategy() {
+    DefaultIdStrategy strategy = new DefaultIdStrategy();
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(InetAddress.class));
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(Inet4Address.class));
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(Inet6Address.class));
+    return strategy;
+  }
+
   private static final ImmutableMap<Class<? extends EppResource>, Schema<? extends EppResource>>
       VALUE_SCHEMAS =
           ImmutableMap.of(
               Domain.class, RuntimeSchema.getSchema(Domain.class),
-              Host.class, RuntimeSchema.getSchema(Host.class));
+              Host.class, RuntimeSchema.getSchema(Host.class, createIdStrategy()));
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
@@ -151,4 +170,46 @@ public class SimplifiedJedisClient {
     checkArgument(VALUE_SCHEMAS.containsKey(clazz), "Unknown class type %s", clazz);
     return (Schema<V>) VALUE_SCHEMAS.get(clazz);
   }
+
+  /**
+   * A custom Protostuff {@link Delegate} for {@link InetAddress} and its subclasses.
+   *
+   * <p>This is required in Java 17+ because Protostuff's default runtime schema serialization
+   * relies on reflection. Since {@link InetAddress} is part of the encapsulated {@code java.base}
+   * module, reflective access is restricted and throws {@link
+   * java.lang.reflect.InaccessibleObjectException}.
+   *
+   * <p>This delegate serializes the IP address as a raw byte array using {@link
+   * InetAddress#getAddress()} and reconstructs it using {@link InetAddress#getByAddress(byte[])}
+   */
+  private record GenericInetAddressDelegate<T extends InetAddress>(Class<T> clazz)
+      implements Delegate<T> {
+
+    @Override
+    public WireFormat.FieldType getFieldType() {
+      return WireFormat.FieldType.BYTES;
+    }
+
+    @Override
+    public Class<T> typeClass() {
+      return clazz;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public T readFrom(Input input) throws IOException {
+      return (T) InetAddress.getByAddress(input.readByteArray());
+    }
+
+    @Override
+    public void writeTo(Output output, int number, T value, boolean repeated) throws IOException {
+      output.writeByteArray(number, value.getAddress(), repeated);
+    }
+
+    @Override
+    public void transfer(Pipe pipe, Input input, Output output, int number, boolean repeated)
+        throws IOException {
+      output.writeByteArray(number, input.readByteArray(), repeated);
+    }
+  }
 }

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -173,6 +173,18 @@ public final class RegistryConfig {
       return config.registrarConsole.supportEmailAddress;
     }
 
+    @Provides
+    @Config("consoleHistoryQueryLimit")
+    public static int provideConsoleHistoryQueryLimit(RegistryConfigSettings config) {
+      return config.registrarConsole.historyQueryLimit;
+    }
+
+    @Provides
+    @Config("consoleBulkDomainActionLimit")
+    public static int provideConsoleBulkDomainActionLimit(RegistryConfigSettings config) {
+      return config.registrarConsole.bulkDomainActionLimit;
+    }
+
     /**
      * The DUM file name, used as a file name base for DUM csv file
      *

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -181,6 +181,8 @@ public class RegistryConfigSettings {
     public String supportPhoneNumber;
     public String supportEmailAddress;
     public String technicalDocsUrl;
+    public int historyQueryLimit;
+    public int bulkDomainActionLimit;
   }
 
   /** Configuration for monitoring. */

core/src/main/java/google/registry/config/files/cloud-tasks-queue.xml

@@ -19,6 +19,7 @@
   <queue>
     <name>dns-refresh</name>
     <max-dispatches-per-second>100</max-dispatches-per-second>
+    <max-retry-duration>82800s</max-retry-duration>
   </queue>
 
   <!-- Queue for publishing DNS updates in batches. -->
@@ -29,6 +30,7 @@
     <min-backoff>30s</min-backoff>
     <max-backoff>1800s</max-backoff>
     <max-doublings>0</max-doublings>
+    <max-retry-duration>82800s</max-retry-duration>
   </queue>
 
   <!-- Queue for uploading RDE deposits to the escrow provider. -->
@@ -59,6 +61,7 @@
   <queue>
     <name>async-host-rename</name>
     <max-dispatches-per-second>1</max-dispatches-per-second>
+    <max-retry-duration>82800s</max-retry-duration>
   </queue>
 
   <!-- Queue for tasks that wait for a Beam pipeline to complete (i.e. Spec11 and invoicing). -->
@@ -110,11 +113,12 @@
     <max-attempts>3</max-attempts>
   </queue>
 
-  <!--  &lt;!&ndash; Queue for async actions that should be run at some point in the future. &ndash;&gt;-->
+  <!--  Queue for async actions that should be run at some point in the future.-->
   <queue>
     <name>async-actions</name>
     <max-dispatches-per-second>1</max-dispatches-per-second>
     <max-concurrent-dispatches>5</max-concurrent-dispatches>
+    <max-retry-duration>82800s</max-retry-duration>
   </queue>
 
 </entries>

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -380,6 +380,12 @@ registrarConsole:
   # URL linking to directory of technical support docs on the registry.
   technicalDocsUrl: http://example.com/your_support_docs/
 
+  # Maximum number of history records returned in a single query.
+  historyQueryLimit: 500
+
+  # Maximum number of domains allowed in a single bulk action.
+  bulkDomainActionLimit: 500
+
 monitoring:
   # Max queries per second for the Google Cloud Monitoring V3 (aka Stackdriver)
   # API. The limit can be adjusted by contacting Cloud Support.

core/src/main/java/google/registry/config/files/tasks/cloud-scheduler-tasks-production.xml

@@ -266,16 +266,6 @@
     <schedule>0 15 * * *</schedule>
   </task>
 
-  <task>
-    <url><![CDATA[/_dr/task/wipeOutContactHistoryPii]]></url>
-    <name>wipeOutContactHistoryPii</name>
-    <description>
-      This job runs weekly to wipe out PII fields of ContactHistory entities
-      that have been in the database for a certain period of time.
-    </description>
-    <schedule>0 15 * * 1</schedule>
-  </task>
-
   <task>
     <url><![CDATA[/_dr/task/bsaDownload]]></url>
     <name>bsaDownload</name>

core/src/main/java/google/registry/config/files/tasks/cloud-scheduler-tasks-sandbox.xml

@@ -155,16 +155,6 @@
     <schedule>*/1 * * * *</schedule>
   </task>
 
-  <task>
-    <url><![CDATA[/_dr/task/wipeOutContactHistoryPii]]></url>
-    <name>wipeOutContactHistoryPii</name>
-    <description>
-      This job runs weekly to wipe out PII fields of ContactHistory entities
-      that have been in the database for a certain period of time.
-    </description>
-    <schedule>0 15 * * 1</schedule>
-  </task>
-
   <task>
     <url><![CDATA[/_dr/task/bsaDownload]]></url>
     <name>bsaDownload</name>

core/src/main/java/google/registry/flows/CheckApiAction.java

@@ -36,13 +36,13 @@ import static google.registry.persistence.PersistenceModule.TransactionIsolation
 import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
 import static google.registry.pricing.PricingEngineProxy.isDomainPremium;
 import static google.registry.util.DomainNameUtils.canonicalizeHostname;
-import static org.json.simple.JSONValue.toJSONString;
 
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.InternetDomainName;
 import com.google.common.net.MediaType;
+import com.google.gson.Gson;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.flows.domain.DomainFlowUtils.BadCommandForRegistryPhaseException;
@@ -83,6 +83,7 @@ public class CheckApiAction implements Runnable {
   @Inject Response response;
   @Inject CheckApiMetric.Builder metricBuilder;
   @Inject CheckApiMetrics checkApiMetrics;
+  @Inject Gson gson;
 
   @Inject
   CheckApiAction() {}
@@ -94,7 +95,7 @@ public class CheckApiAction implements Runnable {
       response.setHeader("X-Content-Type-Options", "nosniff");
       response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, "*");
       response.setContentType(MediaType.JSON_UTF_8);
-      response.setPayload(toJSONString(doCheck()));
+      response.setPayload(gson.toJson(doCheck()));
     } finally {
       CheckApiMetric metric = metricBuilder.build();
       checkApiMetrics.incrementCheckApiRequest(metric);

core/src/main/java/google/registry/flows/EppController.java

@@ -24,6 +24,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.flogger.FluentLogger;
+import com.google.gson.Gson;
 import google.registry.flows.FlowModule.EppExceptionInProviderException;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppinput.EppInput;
@@ -34,7 +35,6 @@ import google.registry.model.eppoutput.Result.Code;
 import google.registry.monitoring.whitebox.EppMetric;
 import jakarta.inject.Inject;
 import java.util.Optional;
-import org.json.simple.JSONValue;
 
 /**
  * An implementation of the EPP command/response protocol.
@@ -50,6 +50,8 @@ public final class EppController {
   @Inject EppMetric.Builder eppMetricBuilder;
   @Inject EppMetrics eppMetrics;
   @Inject ServerTridProvider serverTridProvider;
+  @Inject Gson gson;
+
   @Inject EppController() {}
 
   /** Reads EPP XML, executes the matching flow, and returns an {@link EppOutput}. */
@@ -72,7 +74,7 @@ public final class EppController {
             e.getMessage(),
             lazy(
                 () ->
-                    JSONValue.toJSONString(
+                    gson.toJson(
                         ImmutableMap.<String, Object>of(
                             "clientId",
                             nullToEmpty(sessionMetadata.getRegistrarId()),

core/src/main/java/google/registry/flows/FlowReporter.java

@@ -23,6 +23,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
 import com.google.common.flogger.FluentLogger;
+import com.google.gson.Gson;
 import google.registry.flows.FlowModule.InputXml;
 import google.registry.flows.FlowModule.RegistrarId;
 import google.registry.flows.annotations.ReportingSpec;
@@ -30,7 +31,6 @@ import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppinput.EppInput;
 import jakarta.inject.Inject;
 import java.util.Optional;
-import org.json.simple.JSONValue;
 
 /** Reporter used by {@link FlowRunner} to record flow execution data for reporting. */
 public class FlowReporter {
@@ -49,6 +49,8 @@ public class FlowReporter {
   @Inject @InputXml byte[] inputXmlBytes;
   @Inject EppInput eppInput;
   @Inject Class<? extends Flow> flowClass;
+  @Inject Gson gson;
+
   @Inject FlowReporter() {}
 
   /** Records information about the current flow execution in the request logs. */
@@ -61,7 +63,7 @@ public class FlowReporter {
     logger.atInfo().log(
         "%s: %s",
         METADATA_LOG_SIGNATURE,
-        JSONValue.toJSONString(
+        gson.toJson(
             new ImmutableMap.Builder<String, Object>()
                 .put("serverTrid", trid.getServerTransactionId())
                 .put("clientId", registrarId)

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -44,6 +44,8 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.Host;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.time.Instant;
 import java.util.List;
 import java.util.Objects;
@@ -134,7 +136,9 @@ public final class ResourceFlowUtils {
     }
     String authPassword = authInfo.getPw().getValue();
     String domainPassword = domain.getAuthInfo().getPw().getValue();
-    if (!domainPassword.equals(authPassword)) {
+    if (!MessageDigest.isEqual(
+        authPassword.getBytes(StandardCharsets.UTF_8),
+        domainPassword.getBytes(StandardCharsets.UTF_8))) {
       throw new BadAuthInfoForResourceException();
     }
   }

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -23,6 +23,7 @@ import static com.google.common.collect.Sets.difference;
 import static com.google.common.collect.Sets.intersection;
 import static com.google.common.collect.Sets.union;
 import static google.registry.bsa.persistence.BsaLabelUtils.isLabelBlocked;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.model.domain.Domain.MAX_REGISTRATION_YEARS;
 import static google.registry.model.domain.token.AllocationToken.TokenType.REGISTER_BSA;
 import static google.registry.model.tld.Tld.TldState.GENERAL_AVAILABILITY;
@@ -73,6 +74,7 @@ import google.registry.model.EppResource;
 import google.registry.model.billing.BillingBase.Flag;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainCommand.Create;
 import google.registry.model.domain.DomainCommand.CreateOrUpdate;
@@ -341,7 +343,7 @@ public class DomainFlowUtils {
       }
       ImmutableList<DomainDsData> invalidAlgorithms =
           dsData.stream()
-              .filter(ds -> !validateAlgorithm(ds.getAlgorithm()))
+              .filter(ds -> algorithmIsInvalid(ds.getAlgorithm()))
               .collect(toImmutableList());
       if (!invalidAlgorithms.isEmpty()) {
         throw new InvalidDsRecordException(
@@ -349,9 +351,16 @@ public class DomainFlowUtils {
                 "Domain contains DS record(s) with an invalid algorithm wire value: %s",
                 invalidAlgorithms));
       }
+      boolean forbidInsecureTypes = FeatureFlag.isActiveNow(FORBID_INSECURE_ALGORITHMS_RFC_9904);
       ImmutableList<DomainDsData> invalidDigestTypes =
           dsData.stream()
-              .filter(ds -> DigestType.fromWireValue(ds.getDigestType()).isEmpty())
+              .filter(
+                  ds -> {
+                    Optional<DigestType> digestType = DigestType.fromWireValue(ds.getDigestType());
+                    return digestType
+                        .map(type -> forbidInsecureTypes && !type.isAllowedInRfc9904())
+                        .orElse(true);
+                  })
               .collect(toImmutableList());
       if (!invalidDigestTypes.isEmpty()) {
         throw new InvalidDsRecordException(
@@ -376,14 +385,18 @@ public class DomainFlowUtils {
     }
   }
 
-  public static boolean validateAlgorithm(int alg) {
+  public static boolean algorithmIsInvalid(int alg) {
     if (alg > 255 || alg < 0) {
-      return false;
+      return true;
+    }
+    if (DomainDsData.FORBIDDEN_ALGORITHMS.contains(alg)
+        && FeatureFlag.isActiveNow(FORBID_INSECURE_ALGORITHMS_RFC_9904)) {
+      return true;
     }
     // Algorithms that are reserved or unassigned will just return a string representation of their
     // integer wire value.
     String algorithm = Algorithm.string(alg);
-    return !algorithm.equals(Integer.toString(alg));
+    return algorithm.equals(Integer.toString(alg));
   }
 
   /** We only allow specifying years in a period. */

core/src/main/java/google/registry/flows/domain/DomainPricingLogic.java

@@ -283,7 +283,7 @@ public final class DomainPricingLogic {
         return tld.getStandardRenewCost(dateTime).multipliedBy(years);
       }
       if (token.getRenewalPriceBehavior().equals(RenewalPriceBehavior.SPECIFIED)) {
-        return token.getRenewalPrice().get();
+        return token.getRenewalPrice().get().multipliedBy(years);
       }
     }
     return getDomainCostWithDiscount(
@@ -328,12 +328,13 @@ public final class DomainPricingLogic {
     // Apply the allocation token discount, if applicable.
     if (token.getDiscountPrice().isPresent()
         && tld.getCurrency().equals(token.getDiscountPrice().get().getCurrencyUnit())) {
-      int nonDiscountedYears = Math.max(0, years - token.getDiscountYears());
+      int discountedYears = Math.min(years, token.getDiscountYears());
+      int nonDiscountedYears = years - discountedYears;
       totalDomainFlowCost =
           token
               .getDiscountPrice()
               .get()
-              .multipliedBy(token.getDiscountYears())
+              .multipliedBy(discountedYears)
               .plus(subsequentYearCost.orElse(firstYearCost).multipliedBy(nonDiscountedYears));
     } else if (token.getDiscountFraction() > 0) {
       int discountedYears = Math.min(years, token.getDiscountYears());

core/src/main/java/google/registry/model/common/FeatureFlag.java

@@ -84,7 +84,10 @@ public class FeatureFlag extends ImmutableObject implements Buildable {
     INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS(FeatureStatus.INACTIVE),
 
     /** If we're prohibiting the inclusion of the contact object URI on login. */
-    PROHIBIT_CONTACT_OBJECTS_ON_LOGIN(FeatureStatus.INACTIVE);
+    PROHIBIT_CONTACT_OBJECTS_ON_LOGIN(FeatureStatus.INACTIVE),
+
+    /** If we're prohibiting insecure algorithms as detailed by RFC 9904. */
+    FORBID_INSECURE_ALGORITHMS_RFC_9904(FeatureStatus.INACTIVE);
 
     private final FeatureStatus defaultStatus;
 

core/src/main/java/google/registry/model/console/PasswordResetRequest.java

@@ -118,7 +118,9 @@ public class PasswordResetRequest extends ImmutableObject implements Buildable {
       checkArgumentNotNull(getInstance().requester, "Requester must be specified");
       checkArgumentNotNull(getInstance().destinationEmail, "Destination email must be specified");
       checkArgumentNotNull(getInstance().registrarId, "Registrar ID must be specified");
-      getInstance().verificationCode = UUID.randomUUID().toString();
+      if (getInstance().verificationCode == null) {
+        getInstance().verificationCode = UUID.randomUUID().toString();
+      }
       return super.build();
     }
 

core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java

@@ -14,6 +14,7 @@
 
 package google.registry.model.domain.secdns;
 
+import com.google.common.collect.ImmutableSet;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import jakarta.persistence.Access;
@@ -26,6 +27,7 @@ import jakarta.xml.bind.annotation.XmlTransient;
 import jakarta.xml.bind.annotation.XmlType;
 import jakarta.xml.bind.annotation.adapters.HexBinaryAdapter;
 import jakarta.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
+import org.xbill.DNS.DNSSEC.Algorithm;
 
 /** Base class for {@link DomainDsData} and {@link DomainDsDataHistory}. */
 @MappedSuperclass
@@ -33,6 +35,16 @@ import jakarta.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 @XmlType(propOrder = {"keyTag", "algorithm", "digestType", "digest"})
 public abstract class DomainDsDataBase extends ImmutableObject implements UnsafeSerializable {
 
+  // A set of algorithms that we do not allow. See RFC 9904 for more details.
+  public static final ImmutableSet<Integer> FORBIDDEN_ALGORITHMS =
+      ImmutableSet.of(
+          Algorithm.RSAMD5,
+          Algorithm.RSASHA1,
+          Algorithm.RSA_NSEC3_SHA1,
+          Algorithm.DSA,
+          Algorithm.DSA_NSEC3_SHA1,
+          Algorithm.ECC_GOST);
+
   @XmlTransient @Transient @Insignificant String domainRepoId;
 
   /** The identifier for this particular key in the domain. */

core/src/main/java/google/registry/rde/RdeResourceType.java

@@ -30,7 +30,7 @@ public enum RdeResourceType {
   REGISTRAR("urn:ietf:params:xml:ns:rdeRegistrar-1.0", EnumSet.of(FULL, THIN)),
   IDN("urn:ietf:params:xml:ns:rdeIDN-1.0", EnumSet.of(FULL)),
   HEADER("urn:ietf:params:xml:ns:rdeHeader-1.0", EnumSet.of(FULL, THIN)),
-  EPP_PARAMS("urn:ietf:params:xml:ns:rdeEppParams-1.0", EnumSet.of(FULL, THIN));
+  EPP_PARAMS("urn:ietf:params:xml:ns:rdeEppParams-1.0", EnumSet.of(FULL));
 
   private final String uri;
   private final ImmutableSet<RdeMode> modes;

core/src/main/java/google/registry/request/JsonResponse.java

@@ -18,8 +18,8 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.net.HttpHeaders.CONTENT_DISPOSITION;
 import static com.google.common.net.HttpHeaders.X_CONTENT_TYPE_OPTIONS;
 import static com.google.common.net.MediaType.JSON_UTF_8;
-import static org.json.simple.JSONValue.toJSONString;
 
+import com.google.gson.Gson;
 import jakarta.inject.Inject;
 import java.time.Instant;
 import java.util.Map;
@@ -31,10 +31,12 @@ public class JsonResponse {
   public static final String JSON_SAFETY_PREFIX = ")]}'\n";
 
   protected final Response response;
+  protected final Gson gson;
 
   @Inject
-  public JsonResponse(Response rsp) {
+  public JsonResponse(Response rsp, Gson gson) {
     this.response = rsp;
+    this.gson = gson;
   }
 
   /**
@@ -55,7 +57,7 @@ public class JsonResponse {
     // response, even if all else fails. It's basically another anti-sniffing mechanism in the sense
     // that if you hit this url directly, it would try to download the file instead of showing it.
     response.setHeader(CONTENT_DISPOSITION, "attachment");
-    response.setPayload(JSON_SAFETY_PREFIX + toJSONString(checkNotNull(responseMap)));
+    response.setPayload(JSON_SAFETY_PREFIX + gson.toJson(checkNotNull(responseMap)));
   }
 
   /**

core/src/main/java/google/registry/request/RequestModule.java

@@ -14,6 +14,7 @@
 
 package google.registry.request;
 
+import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.net.MediaType.JSON_UTF_8;
 import static google.registry.dns.PublishDnsUpdatesAction.CLOUD_TASKS_RETRY_HEADER;
 import static google.registry.model.tld.Tlds.assertTldExists;
@@ -28,7 +29,6 @@ import static google.registry.request.RequestParameters.extractSetOfParameters;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.base.VerifyException;
 import com.google.common.collect.ImmutableListMultimap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.io.ByteStreams;
@@ -36,6 +36,8 @@ import com.google.common.io.CharStreams;
 import com.google.common.net.MediaType;
 import com.google.gson.Gson;
 import com.google.gson.JsonElement;
+import com.google.gson.JsonSyntaxException;
+import com.google.gson.reflect.TypeToken;
 import com.google.protobuf.ByteString;
 import dagger.Module;
 import dagger.Provides;
@@ -50,8 +52,6 @@ import jakarta.servlet.http.HttpSession;
 import java.io.IOException;
 import java.util.Map;
 import java.util.Optional;
-import org.json.simple.JSONValue;
-import org.json.simple.parser.ParseException;
 
 /** Dagger module for servlets. */
 @Module
@@ -202,18 +202,16 @@ public final class RequestModule {
 
   @Provides
   @JsonPayload
-  @SuppressWarnings("unchecked")
   static Map<String, Object> provideJsonPayload(
-      @Header("Content-Type") MediaType contentType, @Payload String payload) {
+      @Header("Content-Type") MediaType contentType, @Payload String payload, Gson gson) {
     if (!JSON_UTF_8.is(contentType.withCharset(UTF_8))) {
       throw new UnsupportedMediaTypeException(
           String.format("Expected %s Content-Type", JSON_UTF_8.withoutParameters()));
     }
     try {
-      return (Map<String, Object>) JSONValue.parseWithException(payload);
-    } catch (ParseException e) {
-      throw new BadRequestException(
-          "Malformed JSON", new VerifyException("Malformed JSON:\n" + payload, e));
+      return checkNotNull(gson.fromJson(payload, new TypeToken<>() {}));
+    } catch (JsonSyntaxException | NullPointerException e) {
+      throw new BadRequestException("Malformed JSON:\n" + payload);
     }
   }
 

core/src/main/java/google/registry/request/auth/AuthModule.java

@@ -43,6 +43,7 @@ import jakarta.inject.Qualifier;
 import jakarta.inject.Singleton;
 import java.io.IOException;
 import java.time.Duration;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Supplier;
 import javax.annotation.Nullable;
 
@@ -88,8 +89,8 @@ public class AuthModule {
   TokenVerifier provideIapTokenVerifier(
       @Config("projectIdNumber") long projectIdNumber,
       @Named("backendServiceIdMap") Supplier<ImmutableMap<String, Long>> backendServiceIdMap) {
-    com.google.auth.oauth2.TokenVerifier.Builder tokenVerifierBuilder =
-        com.google.auth.oauth2.TokenVerifier.newBuilder().setIssuer(IAP_ISSUER_URL);
+    ConcurrentHashMap<String, com.google.auth.oauth2.TokenVerifier> tokenVerifiers =
+        new ConcurrentHashMap<>();
     return (String service, String token) -> {
       Long backendServiceId = backendServiceIdMap.get().get(service);
       checkNotNull(
@@ -98,7 +99,15 @@ public class AuthModule {
           service,
           backendServiceIdMap);
       String audience = String.format(IAP_AUDIENCE_FORMAT, projectIdNumber, backendServiceId);
-      return tokenVerifierBuilder.setAudience(audience).build().verify(token);
+      com.google.auth.oauth2.TokenVerifier verifier =
+          tokenVerifiers.computeIfAbsent(
+              audience,
+              aud ->
+                  com.google.auth.oauth2.TokenVerifier.newBuilder()
+                      .setIssuer(IAP_ISSUER_URL)
+                      .setAudience(aud)
+                      .build());
+      return verifier.verify(token);
     };
   }
 

core/src/main/java/google/registry/security/JsonHttp.java

@@ -18,10 +18,13 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.net.HttpHeaders.CONTENT_DISPOSITION;
 import static com.google.common.net.HttpHeaders.X_CONTENT_TYPE_OPTIONS;
 import static com.google.common.net.MediaType.JSON_UTF_8;
-import static org.json.simple.JSONValue.writeJSONString;
 
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
+import com.google.gson.Gson;
+import com.google.gson.JsonSyntaxException;
+import com.google.gson.reflect.TypeToken;
+import google.registry.tools.GsonUtils;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
@@ -29,8 +32,6 @@ import java.io.Reader;
 import java.io.Writer;
 import java.util.Map;
 import javax.annotation.Nullable;
-import org.json.simple.JSONValue;
-import org.json.simple.parser.ParseException;
 
 /**
  * Helper class for servlets that read or write JSON.
@@ -41,6 +42,8 @@ public final class JsonHttp {
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   /** String prefixed to all JSON-like responses. */
   public static final String JSON_SAFETY_PREFIX = ")]}'\n";
 
@@ -51,7 +54,6 @@ public final class JsonHttp {
    * @throws IOException if we failed to read from {@code req}.
    */
   @Nullable
-  @SuppressWarnings("unchecked")
   public static Map<String, ?> read(HttpServletRequest req) throws IOException {
     if (!"POST".equals(req.getMethod())
         && !"PUT".equals(req.getMethod())) {
@@ -64,8 +66,8 @@ public final class JsonHttp {
     }
     try (Reader jsonReader = req.getReader()) {
       try {
-        return checkNotNull((Map<String, ?>) JSONValue.parseWithException(jsonReader));
-      } catch (ParseException | NullPointerException | ClassCastException e) {
+        return checkNotNull(GSON.fromJson(jsonReader, new TypeToken<>() {}));
+      } catch (JsonSyntaxException | NullPointerException | ClassCastException e) {
         logger.atWarning().withCause(e).log("Malformed JSON.");
         return null;
       }
@@ -88,7 +90,7 @@ public final class JsonHttp {
     rsp.setHeader(CONTENT_DISPOSITION, "attachment");
     try (Writer writer = rsp.getWriter()) {
       writer.write(JSON_SAFETY_PREFIX);
-      writeJSONString(jsonObject, writer);
+      GSON.toJson(jsonObject, writer);
     }
   }
 }

core/src/main/java/google/registry/security/XsrfTokenManager.java

@@ -25,6 +25,7 @@ import com.google.common.hash.Hashing;
 import google.registry.model.server.ServerSecret;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.security.MessageDigest;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.List;
@@ -102,7 +103,7 @@ public final class XsrfTokenManager {
     }
     // Reconstruct the token to verify validity.
     String reconstructedToken = encodeToken(ServerSecret.get().asBytes(), email, timestampMillis);
-    if (!token.equals(reconstructedToken)) {
+    if (!MessageDigest.isEqual(token.getBytes(UTF_8), reconstructedToken.getBytes(UTF_8))) {
       logger.atWarning().log(
           "Reconstructed XSRF mismatch (got != expected): %s != %s", token, reconstructedToken);
       return false;

core/src/main/java/google/registry/tools/DigestType.java

@@ -29,21 +29,26 @@ import java.util.Optional;
  * https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml
  */
 public enum DigestType {
-  SHA1(1, 20),
-  SHA256(2, 32),
+  // Algorithm number 1 is SHA-1 and will be is deliberately NOT SUPPORTED.
+  // RFC 9904 specifies that this algorithm MUST NOT be used for DNSSEC delegations.
+  // This prohibition is gated behind a feature flag.
+  SHA1(1, 20, false),
+  SHA256(2, 32, true),
   // Algorithm number 3 is GOST R 34.11-94 and is deliberately NOT SUPPORTED.
   // This algorithm was reviewed by ise-crypto and deemed academically broken (b/207029800).
   // In addition, RFC 8624 specifies that this algorithm MUST NOT be used for DNSSEC delegations.
   // TODO(sarhabot@): Add note in Cloud DNS code to notify the Registry of any new changes to
   // supported digest types.
-  SHA384(4, 48);
+  SHA384(4, 48, true);
 
   private final int wireValue;
   private final int bytes;
+  private final boolean allowedInRfc9904;
 
-  DigestType(int wireValue, int bytes) {
+  DigestType(int wireValue, int bytes, boolean allowedInRfc9904) {
     this.wireValue = wireValue;
     this.bytes = bytes;
+    this.allowedInRfc9904 = allowedInRfc9904;
   }
 
   private static final ImmutableMap<Integer, DigestType> WIRE_VALUE_TO_DIGEST_TYPE =
@@ -63,4 +68,9 @@ public enum DigestType {
   public int getBytes() {
     return bytes;
   }
+
+  /** Whether this digest type is supported as of RFC 9904. */
+  public boolean isAllowedInRfc9904() {
+    return allowedInRfc9904;
+  }
 }

core/src/main/java/google/registry/tools/DsRecord.java

@@ -15,6 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;
 
 import com.beust.jcommander.IStringConverter;
@@ -46,7 +47,7 @@ record DsRecord(int keyTag, int alg, int digestType, String digest) {
           String.format("DS record has an invalid digest length: %s", digest));
     }
 
-    if (!DomainFlowUtils.validateAlgorithm(alg)) {
+    if (tm().reTransact(() -> DomainFlowUtils.algorithmIsInvalid(alg))) {
       throw new IllegalArgumentException(
           String.format("DS record uses an unrecognized algorithm: %d", alg));
     }

core/src/main/java/google/registry/tools/GenerateDnsReportCommand.java

@@ -25,6 +25,7 @@ import com.beust.jcommander.Parameter;
 import com.beust.jcommander.Parameters;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.gson.Gson;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
 import google.registry.persistence.transaction.QueryComposer.Comparator;
@@ -38,7 +39,6 @@ import java.nio.file.Paths;
 import java.time.Instant;
 import java.util.List;
 import java.util.Map;
-import org.json.simple.JSONValue;
 
 /** Command to generate a report of all DNS data. */
 @Parameters(separators = " =", commandDescription = "Generate report of all DNS data in a TLD.")
@@ -57,6 +57,7 @@ final class GenerateDnsReportCommand implements Command {
   private Path output = Paths.get("/dev/stdout");
 
   @Inject Clock clock;
+  @Inject Gson gson;
 
   @Override
   public void run() throws Exception {
@@ -144,7 +145,7 @@ final class GenerateDnsReportCommand implements Command {
       } else {
         result.append(",\n");
       }
-      result.append(JSONValue.toJSONString(map));
+      result.append(gson.toJson(map));
     }
   }
 }

core/src/main/java/google/registry/tools/GsonUtils.java

@@ -16,6 +16,7 @@ package google.registry.tools;
 
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
+import com.google.gson.ToNumberPolicy;
 import com.google.gson.TypeAdapter;
 import com.google.gson.TypeAdapterFactory;
 import com.google.gson.reflect.TypeToken;
@@ -82,6 +83,7 @@ public class GsonUtils {
         .registerTypeAdapter(Serializable.class, new SerializableJsonTypeAdapter())
         .registerTypeAdapterFactory(new ClassProcessingTypeAdapterFactory())
         .registerTypeAdapterFactory(new GsonPostProcessableTypeAdapterFactory())
+        .setObjectToNumberStrategy(ToNumberPolicy.LONG_OR_DOUBLE)
         .excludeFieldsWithoutExposeAnnotation()
         .create();
   }

core/src/main/java/google/registry/tools/ListObjectsCommand.java

@@ -23,10 +23,13 @@ import com.beust.jcommander.Parameter;
 import com.google.common.base.VerifyException;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.net.MediaType;
+import com.google.gson.Gson;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParser;
+import com.google.gson.reflect.TypeToken;
 import java.util.List;
 import java.util.Map;
 import javax.annotation.Nullable;
-import org.json.simple.JSONValue;
 
 /**
  * Abstract base class for commands that list objects by calling a server task.
@@ -35,6 +38,8 @@ import org.json.simple.JSONValue;
  */
 abstract class ListObjectsCommand implements CommandWithConnection {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   @Nullable
   @Parameter(
       names = {"-f", "--fields"},
@@ -87,14 +92,13 @@ abstract class ListObjectsCommand implements CommandWithConnection {
         connection.sendPostRequest(
             getCommandPath(), params.build(), MediaType.PLAIN_TEXT_UTF_8, new byte[0]);
     // Parse the returned JSON and make sure it's a map.
-    Object obj = JSONValue.parse(response.substring(JSON_SAFETY_PREFIX.length()));
-    if (!(obj instanceof Map<?, ?>)) {
+    JsonElement element = JsonParser.parseString(response.substring(JSON_SAFETY_PREFIX.length()));
+    if (!element.isJsonObject()) {
       throw new VerifyException("Server returned unexpected JSON: " + response);
     }
-    @SuppressWarnings("unchecked")
-    Map<String, Object> responseMap = (Map<String, Object>) obj;
+    Map<String, Object> responseMap = GSON.fromJson(element, new TypeToken<>() {});
     // Get the status.
-    obj = responseMap.get("status");
+    Object obj = responseMap.get("status");
     if (obj == null) {
       throw new VerifyException("Server returned no status");
     }

core/src/main/java/google/registry/tools/ServiceConnection.java

@@ -34,6 +34,8 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.io.CharStreams;
 import com.google.common.net.MediaType;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.Action.Service;
 import jakarta.inject.Inject;
@@ -42,7 +44,6 @@ import java.io.InputStreamReader;
 import java.net.URL;
 import java.util.Map;
 import javax.annotation.Nullable;
-import org.json.simple.JSONValue;
 
 /**
  * An HTTP connection to a service.
@@ -55,23 +56,25 @@ public class ServiceConnection {
   private final Service service;
   private final boolean useCanary;
   private final HttpRequestFactory requestFactory;
+  private final Gson gson;
 
   @Inject
   ServiceConnection(
-      @Config("useCanary") boolean useCanary,
-      HttpRequestFactory requestFactory) {
-    this(Service.BACKEND, requestFactory, useCanary);
+      @Config("useCanary") boolean useCanary, HttpRequestFactory requestFactory, Gson gson) {
+    this(Service.BACKEND, requestFactory, useCanary, gson);
   }
 
-  private ServiceConnection(Service service, HttpRequestFactory requestFactory, boolean useCanary) {
+  private ServiceConnection(
+      Service service, HttpRequestFactory requestFactory, boolean useCanary, Gson gson) {
     this.service = service;
     this.requestFactory = requestFactory;
     this.useCanary = useCanary;
+    this.gson = gson;
   }
 
   /** Returns a copy of this connection that talks to a different service endpoint. */
   public ServiceConnection withService(Service service, boolean useCanary) {
-    return new ServiceConnection(service, requestFactory, useCanary);
+    return new ServiceConnection(service, requestFactory, useCanary, gson);
   }
 
   /** Returns the HTML from the connection error stream, if any, otherwise the empty string. */
@@ -99,7 +102,7 @@ public class ServiceConnection {
     request.setFollowRedirects(false);
     request.setThrowExceptionOnExecuteError(false);
     request.setUnsuccessfulResponseHandler(
-        (request1, response, supportsRetry) -> {
+        (request1, response, _) -> {
           String error = getErrorHtmlAsString(response);
           throw new IOException(
               String.format(
@@ -137,14 +140,10 @@ public class ServiceConnection {
     return internalSend(endpoint, params, MediaType.PLAIN_TEXT_UTF_8, null);
   }
 
-  @SuppressWarnings("unchecked")
   public Map<String, Object> sendJson(String endpoint, Map<String, ?> object) throws IOException {
     String response =
         sendPostRequest(
-            endpoint,
-            ImmutableMap.of(),
-            JSON_UTF_8,
-            JSONValue.toJSONString(object).getBytes(UTF_8));
-    return (Map<String, Object>) JSONValue.parse(response.substring(JSON_SAFETY_PREFIX.length()));
+            endpoint, ImmutableMap.of(), JSON_UTF_8, gson.toJson(object).getBytes(UTF_8));
+    return gson.fromJson(response.substring(JSON_SAFETY_PREFIX.length()), new TypeToken<>() {});
   }
 }

core/src/main/java/google/registry/ui/server/console/ConsoleEppPasswordAction.java

@@ -27,6 +27,7 @@ import com.google.common.collect.ImmutableSet;
 import com.google.gson.annotations.Expose;
 import google.registry.flows.EppException.AuthenticationErrorException;
 import google.registry.flows.PasswordOnlyTransportCredentials;
+import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.ConsoleUpdateHistory;
 import google.registry.model.console.User;
 import google.registry.model.registrar.Registrar;
@@ -84,6 +85,8 @@ public class ConsoleEppPasswordAction extends ConsoleApiAction {
         eppRequestBody.newPassword().equals(eppRequestBody.newPasswordRepeat()),
         "New password fields don't match");
 
+    checkPermission(user, eppRequestBody.registrarId(), ConsolePermission.CONFIGURE_EPP_CONNECTION);
+
     Registrar registrar;
     try {
       registrar = registrarAccessor.getRegistrar(eppRequestBody.registrarId());

core/src/main/java/google/registry/ui/server/console/ConsoleHistoryDataAction.java

@@ -62,17 +62,20 @@ public class ConsoleHistoryDataAction extends ConsoleApiAction {
   private final Optional<String> consoleUserEmail;
 
   private final String supportEmail;
+  private final int historyQueryLimit;
 
   @Inject
   public ConsoleHistoryDataAction(
       ConsoleApiParams consoleApiParams,
       @Config("supportEmail") String supportEmail,
+      @Config("consoleHistoryQueryLimit") int historyQueryLimit,
       @Parameter("registrarId") String registrarId,
       @Parameter("consoleUserEmail") Optional<String> consoleUserEmail) {
     super(consoleApiParams);
     this.registrarId = registrarId;
     this.consoleUserEmail = consoleUserEmail;
     this.supportEmail = supportEmail;
+    this.historyQueryLimit = historyQueryLimit;
   }
 
   @Override
@@ -117,6 +120,7 @@ public class ConsoleHistoryDataAction extends ConsoleApiAction {
                         .createNativeQuery(SQL_REGISTRAR_HISTORY, ConsoleUpdateHistory.class)
                         .setParameter("registrarId", registrarId)
                         .setHint("org.hibernate.fetchSize", 1000)
+                        .setMaxResults(historyQueryLimit)
                         .getResultList());
 
     List<ConsoleUpdateHistory> formattedHistoryList =

core/src/main/java/google/registry/ui/server/console/PasswordResetRequestAction.java

@@ -86,7 +86,7 @@ public class PasswordResetRequestAction extends ConsoleApiAction {
             "Must provide registry lock email to reset");
         requiredPermission = ConsolePermission.MANAGE_USERS;
         destinationEmail = passwordResetRequestData.registryLockEmail;
-        checkUserExistsWithRegistryLockEmail(destinationEmail);
+        checkUserExistsWithRegistryLockEmail(destinationEmail, registrarId);
         emailSubject = "Registry lock password reset request";
       }
       default -> throw new IllegalArgumentException("Unknown type " + type);
@@ -121,12 +121,24 @@ public class PasswordResetRequestAction extends ConsoleApiAction {
         .sendEmail(EmailMessage.create(emailSubject, body, destinationAddress));
   }
 
-  static User checkUserExistsWithRegistryLockEmail(String destinationEmail) {
-    return tm().createQueryComposer(User.class)
-        .where("registryLockEmailAddress", QueryComposer.Comparator.EQ, destinationEmail)
-        .first()
-        .orElseThrow(
-            () -> new IllegalArgumentException("Unknown user with lock email " + destinationEmail));
+  static User checkUserExistsWithRegistryLockEmail(String destinationEmail, String registrarId) {
+    User targetUser =
+        tm().createQueryComposer(User.class)
+            .where("registryLockEmailAddress", QueryComposer.Comparator.EQ, destinationEmail)
+            .first()
+            .orElseThrow(
+                () ->
+                    new IllegalArgumentException(
+                        "Unknown user with lock email " + destinationEmail));
+
+    // Prevent IDOR: Ensure the resolved user actually belongs to the registrar the requester
+    // has permissions for, or is a global admin.
+    if (!targetUser.getUserRoles().isAdmin()
+        && !targetUser.getUserRoles().getRegistrarRoles().containsKey(registrarId)) {
+      throw new IllegalArgumentException(
+          "User with lock email " + destinationEmail + " is not associated with " + registrarId);
+    }
+    return targetUser;
   }
 
   private String getAdminPocEmail(String registrarId) {

core/src/main/java/google/registry/ui/server/console/PasswordResetVerifyAction.java

@@ -98,7 +98,9 @@ public class PasswordResetVerifyAction extends ConsoleApiAction {
   }
 
   private void handleRegistryLockPasswordReset(PasswordResetRequest request) {
-    User affectedUser = checkUserExistsWithRegistryLockEmail(request.getDestinationEmail());
+    User affectedUser =
+        checkUserExistsWithRegistryLockEmail(
+            request.getDestinationEmail(), request.getRegistrarId());
     tm().put(
             affectedUser
                 .asBuilder()

core/src/main/java/google/registry/ui/server/console/domains/ConsoleBulkDomainAction.java

@@ -14,6 +14,7 @@
 
 package google.registry.ui.server.console.domains;
 
+import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
@@ -22,6 +23,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import com.google.common.collect.ImmutableMap;
 import com.google.gson.JsonElement;
 import com.google.gson.annotations.Expose;
+import google.registry.config.RegistryConfig.Config;
 import google.registry.flows.EppController;
 import google.registry.flows.EppRequestSource;
 import google.registry.flows.PasswordOnlyTransportCredentials;
@@ -64,11 +66,13 @@ public class ConsoleBulkDomainAction extends ConsoleApiAction {
   private final String registrarId;
   private final String bulkDomainAction;
   private final Optional<JsonElement> optionalJsonPayload;
+  private final int bulkDomainActionLimit;
 
   @Inject
   public ConsoleBulkDomainAction(
       ConsoleApiParams consoleApiParams,
       EppController eppController,
+      @Config("consoleBulkDomainActionLimit") int bulkDomainActionLimit,
       @Parameter("registrarId") String registrarId,
       @Parameter("bulkDomainAction") String bulkDomainAction,
       @OptionalJsonPayload Optional<JsonElement> optionalJsonPayload) {
@@ -77,6 +81,7 @@ public class ConsoleBulkDomainAction extends ConsoleApiAction {
     this.registrarId = registrarId;
     this.bulkDomainAction = bulkDomainAction;
     this.optionalJsonPayload = optionalJsonPayload;
+    this.bulkDomainActionLimit = bulkDomainActionLimit;
   }
 
   @Override
@@ -85,6 +90,13 @@ public class ConsoleBulkDomainAction extends ConsoleApiAction {
         optionalJsonPayload.orElseThrow(
             () -> new IllegalArgumentException("Bulk action payload must be present"));
     BulkDomainList domainList = consoleApiParams.gson().fromJson(jsonPayload, BulkDomainList.class);
+    checkArgument(
+        domainList.domainList != null && !domainList.domainList.isEmpty(),
+        "Domain list cannot be empty");
+    checkArgument(
+        domainList.domainList.size() <= bulkDomainActionLimit,
+        "Cannot process more than %s domains in a single bulk action",
+        bulkDomainActionLimit);
     ConsoleDomainActionType actionType =
         ConsoleDomainActionType.parseActionType(bulkDomainAction, jsonPayload);
 

core/src/test/java/google/registry/cache/SimplifiedJedisClientTest.java

@@ -19,6 +19,7 @@ import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableO
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistActiveSubordinateHost;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
 
 import com.google.common.collect.ImmutableList;
@@ -67,7 +68,8 @@ public class SimplifiedJedisClientTest {
 
   @Test
   void testClient_roundTrip_host() {
-    Host host = persistActiveHost("ns1.example.tld");
+    Domain domain = persistActiveDomain("example.tld");
+    Host host = persistActiveSubordinateHost("ns1.example.tld", domain);
     SimplifiedJedisClient client = createJedisClient();
     client.set(new SimplifiedJedisClient.JedisResource<>("repoId1", host));
     assertThat(client.get(Host.class, "repoId1")).hasValue(host);

core/src/test/java/google/registry/export/ExportDomainListsActionTest.java

@@ -21,8 +21,8 @@ import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusDays;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -35,10 +35,8 @@ import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.StorageException;
 import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.net.MediaType;
 import google.registry.gcs.GcsUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -80,7 +78,7 @@ class ExportDomainListsActionTest {
     action.gcsUtils = gcsUtils;
     action.clock = clock;
     action.driveConnection = driveConnection;
-    persistFeatureFlag(INACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, INACTIVE);
   }
 
   private void verifyExportedToDrive(String folderId, String filename, String domains)
@@ -110,7 +108,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsOnlyActiveDomains_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     persistActiveDomain("onetwo.tld");
     persistActiveDomain("rudnitzky.tld");
     persistDeletedDomain("mortuary.tld", Instant.parse("2001-03-14T10:11:12Z"));
@@ -144,7 +142,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsOnlyDomainsOnRealTlds_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     persistActiveDomain("onetwo.tld");
     persistActiveDomain("rudnitzky.tld");
     persistActiveDomain("wontgo.testtld");
@@ -164,7 +162,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputIncludesDeletionTimes_forPendingDeletes_notRdemption() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     // Domains pending delete (meaning the 5 day period, not counting the 30 day redemption period)
     // should include their pending deletion date
     persistActiveDomain("active.tld");
@@ -227,7 +225,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsDomainsFromDifferentTldsToMultipleFiles_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     createTld("tldtwo");
     persistResource(Tld.get("tldtwo").asBuilder().setDriveFolderId("hooray").build());
 
@@ -255,13 +253,4 @@ class ExportDomainListsActionTest {
     // tldthree does not have a drive id, so no export to drive is performed.
     verifyNoMoreInteractions(driveConnection);
   }
-
-  private void persistFeatureFlag(FeatureFlag.FeatureStatus status) {
-    persistResource(
-        new FeatureFlag()
-            .asBuilder()
-            .setFeatureName(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, status))
-            .build());
-  }
 }

core/src/test/java/google/registry/flows/CheckApiActionTest.java

@@ -29,6 +29,7 @@ import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static org.mockito.Mockito.verify;
 
+import com.google.gson.reflect.TypeToken;
 import google.registry.bsa.persistence.BsaTestingUtils;
 import google.registry.model.tld.Tld;
 import google.registry.monitoring.whitebox.CheckApiMetric;
@@ -39,10 +40,10 @@ import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeResponse;
+import google.registry.tools.GsonUtils;
 import java.time.Instant;
 import java.util.Map;
 import java.util.Optional;
-import org.json.simple.JSONValue;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -83,9 +84,9 @@ class CheckApiActionTest {
             .build());
   }
 
-  @SuppressWarnings("unchecked")
   private Map<String, Object> getCheckResponse(String domain) {
     CheckApiAction action = new CheckApiAction();
+    action.gson = GsonUtils.provideGson();
     action.domain = domain;
     action.response = new FakeResponse();
     action.metricBuilder = CheckApiMetric.builder(fakeClock);
@@ -94,7 +95,8 @@ class CheckApiActionTest {
     endTime = fakeClock.now();
 
     action.run();
-    return (Map<String, Object>) JSONValue.parse(((FakeResponse) action.response).getPayload());
+    return action.gson.fromJson(
+        ((FakeResponse) action.response).getPayload(), new TypeToken<>() {});
   }
 
   @Test

core/src/test/java/google/registry/flows/EppControllerTest.java

@@ -31,6 +31,8 @@ import static org.mockito.Mockito.when;
 
 import com.google.common.base.Splitter;
 import com.google.common.testing.TestLogHandler;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppTestComponent.FakeServerTridProvider;
 import google.registry.flows.FlowModule.EppExceptionInProviderException;
@@ -43,6 +45,7 @@ import google.registry.monitoring.whitebox.EppMetric;
 import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.persistence.transaction.JpaTestExtensions.JpaIntegrationTestExtension;
 import google.registry.testing.FakeClock;
+import google.registry.tools.GsonUtils;
 import google.registry.util.Clock;
 import google.registry.xml.ValidationMode;
 import java.time.Instant;
@@ -50,7 +53,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.logging.LogRecord;
 import java.util.logging.Logger;
-import org.json.simple.JSONValue;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -82,6 +84,7 @@ class EppControllerTest {
   @Mock Result result;
 
   private static final Instant START_TIME = Instant.parse("2016-09-01T00:00:00Z");
+  private static final Gson GSON = GsonUtils.provideGson();
 
   private final Clock clock = new FakeClock(START_TIME);
   private final TestLogHandler logHandler = new TestLogHandler();
@@ -110,6 +113,7 @@ class EppControllerTest {
     when(result.getCode()).thenReturn(Code.SUCCESS_WITH_NO_MESSAGES);
 
     eppController = new EppController();
+    eppController.gson = GSON;
     eppController.eppMetricBuilder = EppMetric.builderForRequest(clock);
     when(flowRunner.run(eppController.eppMetricBuilder)).thenReturn(eppOutput);
     eppController.flowComponentBuilder = flowComponentBuilder;
@@ -247,8 +251,7 @@ class EppControllerTest {
     assertThat(logRecord.getThrown()).isInstanceOf(IllegalStateException.class);
   }
 
-  @SuppressWarnings("unchecked")
   private static Map<String, Object> parseJsonMap(String json) throws Exception {
-    return (Map<String, Object>) JSONValue.parseWithException(json);
+    return GSON.fromJson(json, new TypeToken<>() {});
   }
 }

core/src/test/java/google/registry/flows/EppTestComponent.java

@@ -28,6 +28,7 @@ import google.registry.flows.custom.TestCustomLogicFactory;
 import google.registry.flows.domain.DomainDeletionTimeCache;
 import google.registry.flows.domain.DomainFlowTmchUtils;
 import google.registry.monitoring.whitebox.EppMetric;
+import google.registry.request.Modules.GsonModule;
 import google.registry.request.RequestScope;
 import google.registry.request.lock.LockHandler;
 import google.registry.testing.CloudTasksHelper;
@@ -42,7 +43,8 @@ import jakarta.inject.Singleton;
 
 /** Dagger component for running EPP tests. */
 @Singleton
-@Component(modules = {ConfigModule.class, EppTestComponent.FakesAndMocksModule.class})
+@Component(
+    modules = {ConfigModule.class, GsonModule.class, EppTestComponent.FakesAndMocksModule.class})
 public interface EppTestComponent {
 
   RequestComponent startRequest();

core/src/test/java/google/registry/flows/FlowReporterTest.java

@@ -22,22 +22,26 @@ import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.testing.TestLogHandler;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.model.eppcommon.Trid;
 import google.registry.model.eppinput.EppInput;
 import google.registry.model.eppoutput.EppOutput.ResponseOrGreeting;
 import google.registry.model.eppoutput.EppResponse;
 import google.registry.model.reporting.IcannReportingTypes.ActivityReportField;
+import google.registry.tools.GsonUtils;
 import google.registry.util.JdkLoggerConfig;
 import java.util.Map;
 import java.util.Optional;
-import org.json.simple.JSONValue;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 /** Unit tests for {@link FlowReporter}. */
 class FlowReporterTest {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   static class TestCommandFlow implements Flow {
     @Override
     public ResponseOrGreeting run() {
@@ -60,6 +64,7 @@ class FlowReporterTest {
   void beforeEach() {
     JdkLoggerConfig.getConfig(FlowReporter.class).addHandler(handler);
     flowReporter.trid = Trid.create("client-123", "server-456");
+    flowReporter.gson = GSON;
     flowReporter.registrarId = "TheRegistrar";
     flowReporter.inputXmlBytes = "<xml/>".getBytes(UTF_8);
     flowReporter.flowClass = TestCommandFlow.class;
@@ -205,8 +210,7 @@ class FlowReporterTest {
     assertThat(json).containsEntry("tlds", ImmutableList.of());
   }
 
-  @SuppressWarnings("unchecked")
   private static Map<String, Object> parseJsonMap(String json) throws Exception {
-    return (Map<String, Object>) JSONValue.parseWithException(json);
+    return GSON.fromJson(json, new TypeToken<>() {});
   }
 }

core/src/test/java/google/registry/flows/ResourceFlowTestCase.java

@@ -22,6 +22,7 @@ import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
 import com.google.common.testing.TestLogHandler;
+import com.google.gson.Gson;
 import google.registry.model.EppResource;
 import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.DomainBase;
@@ -34,13 +35,13 @@ import google.registry.model.tmch.ClaimsList;
 import google.registry.model.tmch.ClaimsListDao;
 import google.registry.testing.DatabaseHelper;
 import google.registry.testing.TestCacheExtension;
+import google.registry.tools.GsonUtils;
 import google.registry.util.JdkLoggerConfig;
 import google.registry.util.TypeUtils.TypeInstantiator;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.logging.Level;
 import javax.annotation.Nullable;
-import org.json.simple.JSONValue;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.extension.RegisterExtension;
 
@@ -53,6 +54,8 @@ import org.junit.jupiter.api.extension.RegisterExtension;
 public abstract class ResourceFlowTestCase<F extends Flow, R extends EppResource>
     extends FlowTestCase<F> {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   protected final TestLogHandler logHandler = new TestLogHandler();
 
   @RegisterExtension
@@ -108,21 +111,23 @@ public abstract class ResourceFlowTestCase<F extends Flow, R extends EppResource
         .that(logHandler)
         .hasLogAtLevelWithMessage(Level.INFO, "FLOW-LOG-SIGNATURE-METADATA")
         .which()
-        .contains("\"clientId\":" + JSONValue.toJSONString(registrarId));
+        .contains("\"clientId\":" + GSON.toJson(registrarId));
   }
 
   protected void assertTldsFieldLogged(String... tlds) {
-    assertAboutLogs().that(logHandler)
+    assertAboutLogs()
+        .that(logHandler)
         .hasLogAtLevelWithMessage(Level.INFO, "FLOW-LOG-SIGNATURE-METADATA")
         .which()
-        .contains("\"tlds\":" + JSONValue.toJSONString(ImmutableList.copyOf(tlds)));
+        .contains("\"tlds\":" + GSON.toJson(ImmutableList.copyOf(tlds)));
   }
 
   protected void assertIcannReportingActivityFieldLogged(String fieldName) {
-    assertAboutLogs().that(logHandler)
+    assertAboutLogs()
+        .that(logHandler)
         .hasLogAtLevelWithMessage(Level.INFO, "FLOW-LOG-SIGNATURE-METADATA")
         .which()
-        .contains("\"icannActivityReportField\":" + JSONValue.toJSONString(fieldName));
+        .contains("\"icannActivityReportField\":" + GSON.toJson(fieldName));
   }
 
   protected void assertLastHistoryContainsResource(EppResource resource) {

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -24,6 +24,7 @@ import static google.registry.model.billing.BillingBase.Flag.RESERVED;
 import static google.registry.model.billing.BillingBase.Flag.SUNRISE;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.NONPREMIUM;
 import static google.registry.model.billing.BillingBase.RenewalPriceBehavior.SPECIFIED;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.model.domain.fee.Fee.FEE_EXTENSION_URIS;
 import static google.registry.model.domain.token.AllocationToken.TokenType.BULK_PRICING;
 import static google.registry.model.domain.token.AllocationToken.TokenType.DEFAULT_PROMO;
@@ -52,6 +53,7 @@ import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.newHost;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistReservedList;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DomainSubject.assertAboutDomains;
@@ -150,6 +152,7 @@ import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -794,7 +797,11 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         .that(domain)
         .hasExactlyDsData(
             DomainDsData.create(
-                    12345, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))
+                    12345,
+                    8,
+                    2,
+                    base16()
+                        .decode("D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A"))
                 .cloneWithDomainRepoId(domain.getRepoId()));
   }
 
@@ -957,6 +964,30 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsSha1DigestType() throws Exception {
+    setEppInput("domain_create_dsdata_sha1.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsSha1_flagInactive() throws Exception {
+    setEppInput("domain_create_dsdata_sha1.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    doSuccessfulTest("tld");
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(
+                    12345, 8, 1, base16().decode("49FD46E6C4B45C55D4AC49FD46E6C4B45C55D4AC"))
+                .cloneWithDomainRepoId(domain.getRepoId()));
+  }
+
   @Test
   void testFailure_secDnsInvalidAlgorithm() throws Exception {
     setEppInput("domain_create_dsdata_bad_algorithms.xml");
@@ -965,6 +996,34 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsForbiddenAlgorithm() throws Exception {
+    setEppInput("domain_create_dsdata_forbidden_algorithm.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsForbiddenAlgorithm_flagInactive() throws Exception {
+    setEppInput("domain_create_dsdata_forbidden_algorithm.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    doSuccessfulTest("tld");
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(
+                    12345,
+                    1,
+                    2,
+                    base16()
+                        .decode("D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A"))
+                .cloneWithDomainRepoId(domain.getRepoId()));
+  }
+
   @Test
   void testFailure_wrongExtension() {
     setEppInput("domain_create_wrong_extension.xml");

core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java

@@ -98,6 +98,8 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
           "UNIT", "y");
 
   private static final Pattern OK_PATTERN = Pattern.compile("\"ok\"");
+  private static final String SHA_256_DIGEST =
+      "D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A";
 
   private Host host1;
   private Host host2;
@@ -314,8 +316,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
         domain
             .asBuilder()
             .setDsData(
-                ImmutableSet.of(
-                    DomainDsData.create(12345, 3, 1, base16().decode("49FD46E6C4B45C55D4AC"))))
+                ImmutableSet.of(DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))
             .setNameservers(ImmutableSet.of(host1.createVKey(), host3.createVKey()))
             .build());
     doSuccessfulTest("domain_info_response_dsdata.xml", false);
@@ -519,8 +520,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
                     "TheRegistrar",
                     null))
             .setDsData(
-                ImmutableSet.of(
-                    DomainDsData.create(12345, 3, 1, base16().decode("49FD46E6C4B45C55D4AC"))))
+                ImmutableSet.of(DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))
             .build());
     doSuccessfulTest("domain_info_response_dsdata_addperiod.xml", false);
   }

core/src/test/java/google/registry/flows/domain/DomainPricingLogicTest.java

@@ -203,6 +203,29 @@ public class DomainPricingLogicTest {
                 .build());
   }
 
+  @Test
+  void testGetDomainCreatePrice_discountPriceAllocationToken_oneYearCreate_moreDiscountYears()
+      throws EppException {
+    AllocationToken allocationToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123_more_discount")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("default.example")
+                .setDiscountPrice(Money.of(USD, 5))
+                .setDiscountYears(2)
+                .setRegistrationBehavior(RegistrationBehavior.DEFAULT)
+                .build());
+    assertThat(
+            domainPricingLogic.getCreatePrice(
+                tld, "default.example", clock.now(), 1, false, false, Optional.of(allocationToken)))
+        .isEqualTo(
+            new FeesAndCredits.Builder()
+                .setCurrency(USD)
+                .addFeeOrCredit(Fee.create(new BigDecimal("5.00"), CREATE, false))
+                .build());
+  }
+
   @Test
   void testGetDomainRenewPrice_oneYear_standardDomain_noBilling_isStandardPrice()
       throws EppException {
@@ -1093,4 +1116,23 @@ public class DomainPricingLogicTest {
                 .getRenewCost())
         .isEqualTo(Money.of(USD, 5));
   }
+
+  @Test
+  void testDomainRenewPrice_specifiedToken_multiYear() throws Exception {
+    AllocationToken allocationToken =
+        persistResource(
+            new AllocationToken.Builder()
+                .setToken("abc123_multi")
+                .setTokenType(SINGLE_USE)
+                .setDomainName("premium.example")
+                .setRenewalPriceBehavior(SPECIFIED)
+                .setRenewalPrice(Money.of(USD, 5))
+                .build());
+    assertThat(
+            domainPricingLogic
+                .getRenewPrice(
+                    tld, "premium.example", clock.now(), 5, null, Optional.of(allocationToken))
+                .getRenewCost())
+        .isEqualTo(Money.of(USD, 25));
+  }
 }

core/src/test/java/google/registry/flows/domain/DomainUpdateFlowTest.java

@@ -19,6 +19,7 @@ import static com.google.common.collect.Sets.union;
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.ForeignKeyUtils.loadResource;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_DELETE_PROHIBITED;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_HOLD;
 import static google.registry.model.eppcommon.StatusValue.CLIENT_RENEW_PROHIBITED;
@@ -46,6 +47,7 @@ import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
 import static google.registry.testing.DatabaseHelper.persistActiveSubordinateHost;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DomainSubject.assertAboutDomains;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
@@ -94,6 +96,7 @@ import google.registry.flows.exceptions.ResourceStatusProhibitsOperationExceptio
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainAuthInfo;
 import google.registry.model.domain.DomainHistory;
@@ -115,6 +118,9 @@ import org.junit.jupiter.api.Test;
 /** Unit tests for {@link DomainUpdateFlow}. */
 class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain> {
 
+  private static final String SHA_256_DIGEST =
+      "D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A";
+
   private static final DomainDsData SOME_DSDATA =
       DomainDsData.create(
           1,
@@ -124,9 +130,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
   private static final ImmutableMap<String, String> OTHER_DSDATA_TEMPLATE_MAP =
       ImmutableMap.of(
           "KEY_TAG", "12346",
-          "ALG", "3",
-          "DIGEST_TYPE", "1",
-          "DIGEST", "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3");
+          "ALG", "8",
+          "DIGEST_TYPE", "2",
+          "DIGEST", SHA_256_DIGEST);
 
   @BeforeEach
   void beforeEach() {
@@ -453,18 +459,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_add.xml",
         null,
-        ImmutableSet.of(
-            DomainDsData.create(
-                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+        ImmutableSet.of(DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableMap.of(
-            "KEY_TAG",
-            "12346",
-            "ALG",
-            "3",
-            "DIGEST_TYPE",
-            "1",
-            "DIGEST",
-            "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"),
+            "KEY_TAG", "12346", "ALG", "8", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
         true);
   }
 
@@ -474,18 +471,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
         "domain_update_dsdata_add.xml",
         ImmutableSet.of(SOME_DSDATA),
         ImmutableSet.of(
-            SOME_DSDATA,
-            DomainDsData.create(
-                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableMap.of(
-            "KEY_TAG",
-            "12346",
-            "ALG",
-            "3",
-            "DIGEST_TYPE",
-            "1",
-            "DIGEST",
-            "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"),
+            "KEY_TAG", "12346", "ALG", "8", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
         true);
   }
 
@@ -660,11 +648,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(
-                        12346,
-                        3,
-                        1,
-                        base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))))),
+                    DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))))),
         true);
   }
 
@@ -673,9 +657,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_rem.xml",
         ImmutableSet.of(
-            SOME_DSDATA,
-            DomainDsData.create(
-                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(SOME_DSDATA),
         true);
   }
@@ -686,9 +668,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_rem_all.xml",
         ImmutableSet.of(
-            SOME_DSDATA,
-            DomainDsData.create(
-                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(),
         true);
   }
@@ -698,13 +678,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_add_rem.xml",
         ImmutableSet.of(
-            SOME_DSDATA,
-            DomainDsData.create(
-                12345, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+            SOME_DSDATA, DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(
-            SOME_DSDATA,
-            DomainDsData.create(
-                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         true);
   }
 
@@ -727,20 +703,12 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(
-                        12345,
-                        3,
-                        1,
-                        base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))))),
+                    DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))),
         ImmutableSet.copyOf(
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(
-                        12346,
-                        3,
-                        1,
-                        base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"))))),
+                    DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))))),
         true);
   }
 
@@ -915,6 +883,41 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsSha1DigestType() throws Exception {
+    setEppInput(
+        "domain_update_dsdata_add.xml",
+        ImmutableMap.of(
+            "KEY_TAG", "12346",
+            "ALG", "3",
+            "DIGEST_TYPE", "1",
+            "DIGEST", "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"));
+    persistResource(DatabaseHelper.newDomain(getUniqueIdFromCommand()));
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsSha1_flagInactive() throws Exception {
+    setEppInput(
+        "domain_update_dsdata_add.xml",
+        ImmutableMap.of(
+            "KEY_TAG", "12346",
+            "ALG", "3",
+            "DIGEST_TYPE", "1",
+            "DIGEST", "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"));
+    persistResource(DatabaseHelper.newDomain(getUniqueIdFromCommand()));
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    runFlow();
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(
+                12346, 3, 1, base16().decode("A94A8FE5CCB19BA61C4C0873D391E987982FBBD3")));
+  }
+
   @Test
   void testFailure_secDnsMultipleInvalidDigestTypes() throws Exception {
     setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
@@ -938,7 +941,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     persistResource(
         DatabaseHelper.newDomain(getUniqueIdFromCommand())
             .asBuilder()
-            .setDsData(ImmutableSet.of(DomainDsData.create(1, 2, 1, new byte[] {0, 1, 2})))
+            .setDsData(ImmutableSet.of(DomainDsData.create(1, 2, 2, new byte[] {0, 1, 2})))
             .build());
     EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
@@ -955,7 +958,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             .asBuilder()
             .setDsData(
                 ImmutableSet.of(
-                    DomainDsData.create(1, 2, 1, new byte[] {0, 1, 2, 3, 4}),
+                    DomainDsData.create(1, 2, 2, new byte[] {0, 1, 2, 3, 4}),
                     DomainDsData.create(2, 2, 2, new byte[] {5, 6, 7})))
             .build());
     EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
@@ -979,6 +982,70 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsForbiddenAlgorithm() throws Exception {
+    setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsForbiddenAlgorithm_flagInactive() throws Exception {
+    setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    runFlow();
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST)),
+            DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST)));
+  }
+
+  @Test
+  void testFailure_unrelatedUpdate_existingForbiddenAlgorithm() throws Exception {
+    persistReferencedEntities();
+    persistResource(
+        persistDomain()
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    assertAboutEppExceptions()
+        .that(assertThrows(InvalidDsRecordException.class, this::runFlow))
+        .marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_unrelatedUpdate_existingForbiddenAlgorithm_flagInactive() throws Exception {
+    persistReferencedEntities();
+    persistResource(
+        persistDomain()
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    runFlow();
+    Domain updatedDomain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(updatedDomain)
+        .hasExactlyDsData(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST)));
+  }
+
   @Test
   void testFailure_secDnsMultipleInvalidAlgorithms() throws Exception {
     setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);

core/src/test/java/google/registry/flows/session/LoginFlowTestCase.java

@@ -20,13 +20,12 @@ import static google.registry.model.common.FeatureFlag.FeatureName.PROHIBIT_CONT
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.deleteResource;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSortedMap;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppException.UnimplementedObjectServiceException;
@@ -39,7 +38,6 @@ import google.registry.flows.session.LoginFlow.BadRegistrarIdException;
 import google.registry.flows.session.LoginFlow.RegistrarAccountNotActiveException;
 import google.registry.flows.session.LoginFlow.TooManyFailedLoginsException;
 import google.registry.flows.session.LoginFlow.UnsupportedLanguageException;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.model.registrar.Registrar;
@@ -61,11 +59,7 @@ public abstract class LoginFlowTestCase extends FlowTestCase<LoginFlow> {
     sessionMetadata.setRegistrarId(null); // Don't implicitly log in (all other flows need to).
     registrar = loadRegistrar("NewRegistrar");
     registrarBuilder = registrar.asBuilder();
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(PROHIBIT_CONTACT_OBJECTS_ON_LOGIN)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.ACTIVE))
-            .build());
+    persistFeatureFlag(PROHIBIT_CONTACT_OBJECTS_ON_LOGIN, FeatureStatus.ACTIVE);
   }
 
   // Can't inline this since it may be overridden in subclasses.

core/src/test/java/google/registry/rdap/RdapDomainSearchActionTest.java

@@ -283,15 +283,15 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   private JsonObject generateExpectedJsonForTwoDomainsNsReply() {
     return jsonFileBuilder()
-        .addDomain("cat.example", "F-EXAMPLE")
-        .addDomain("cat.lol", "6-LOL")
+        .addDomain("cat.example", domainCatExample.getRepoId())
+        .addDomain("cat.lol", domainCatLol.getRepoId())
         .load("rdap_domains_two.json");
   }
 
   private JsonObject generateExpectedJsonForTwoDomainsCatStarReplySql() {
     return jsonFileBuilder()
-        .addDomain("cat.lol", "6-LOL")
-        .addDomain("cat2.lol", "B-LOL")
+        .addDomain("cat.lol", domainCatLol.getRepoId())
+        .addDomain("cat2.lol", domainCatLol2.getRepoId())
         .load("rdap_domains_two.json");
   }
 
@@ -306,7 +306,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
             minusMonths(clock.now(), 6)));
   }
 
-  private void createManyDomainsAndHosts(
+  private ImmutableList<Domain> createManyDomainsAndHosts(
       int numActiveDomains, int numTotalDomainsPerActiveDomain, int numHosts) {
     ImmutableSet.Builder<VKey<Host>> hostKeysBuilder = new ImmutableSet.Builder<>();
     ImmutableSet.Builder<String> subordinateHostnamesBuilder = new ImmutableSet.Builder<>();
@@ -340,7 +340,7 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
       }
       domainsBuilder.add(builder.build());
     }
-    persistResources(domainsBuilder.build());
+    return persistResources(domainsBuilder.build());
   }
 
   private void checkNumberOfDomainsInResult(JsonObject obj, int expected) {
@@ -353,10 +353,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         requestType,
         queryString,
         jsonFileBuilder()
-            .addDomain("cat.lol", "6-LOL")
+            .addDomain("cat.lol", domainCatLol.getRepoId())
             .addRegistrar("Yes Virginia <script>")
-            .addNameserver("ns1.cat.lol", "2-ROID")
-            .addNameserver("ns2.cat.lol", "4-ROID")
+            .addNameserver("ns1.cat.lol", hostNs1CatLol.getRepoId())
+            .addNameserver("ns2.cat.lol", hostNs2CatLol.getRepoId())
             .setNextQuery(queryString)
             .load(filename));
   }
@@ -367,10 +367,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         requestType,
         queryString,
         jsonFileBuilder()
-            .addDomain("cat2.lol", "B-LOL")
+            .addDomain("cat2.lol", domainCatLol2.getRepoId())
             .addRegistrar("Yes Virginia <script>")
-            .addNameserver("ns1.cat.example", "7-ROID")
-            .addNameserver("ns2.dog.lol", "9-ROID")
+            .addNameserver("ns1.cat.example", hostNameToHostMap.get("ns1.cat.example").getRepoId())
+            .addNameserver("ns2.dog.lol", hostNameToHostMap.get("ns2.dog.lol").getRepoId())
             .setNextQuery(queryString)
             .load(filename));
   }
@@ -679,10 +679,11 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NAME,
         "cat.example",
         jsonFileBuilder()
-            .addDomain("cat.example", "F-EXAMPLE")
+            .addDomain("cat.example", domainCatExample.getRepoId())
             .addRegistrar("St. John Chrysostom")
-            .addNameserver("ns1.cat.lol", "2-ROID")
-            .addNameserver("ns2.external.tld", "D-ROID")
+            .addNameserver("ns1.cat.lol", hostNs1CatLol.getRepoId())
+            .addNameserver(
+                "ns2.external.tld", hostNameToHostMap.get("ns2.external.tld").getRepoId())
             .load("rdap_domain.json"));
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
   }
@@ -693,10 +694,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NAME,
         "cat.みんな",
         jsonFileBuilder()
-            .addDomain("cat.みんな", "15-Q9JYB4C")
+            .addDomain("cat.みんな", domainIdn.getRepoId())
             .addRegistrar("みんな")
-            .addNameserver("ns1.cat.みんな", "11-ROID")
-            .addNameserver("ns2.cat.みんな", "13-ROID")
+            .addNameserver("ns1.cat.みんな", hostNameToHostMap.get("ns1.cat.xn--q9jyb4c").getRepoId())
+            .addNameserver("ns2.cat.みんな", hostNameToHostMap.get("ns2.cat.xn--q9jyb4c").getRepoId())
             .load("rdap_domain_unicode_with_unicode_nameservers.json"));
     // The unicode gets translated to ASCII before getting parsed into a search pattern.
     metricPrefixLength = 15;
@@ -709,10 +710,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NAME,
         "cat.xn--q9jyb4c",
         jsonFileBuilder()
-            .addDomain("cat.みんな", "15-Q9JYB4C")
+            .addDomain("cat.みんな", domainIdn.getRepoId())
             .addRegistrar("みんな")
-            .addNameserver("ns1.cat.みんな", "11-ROID")
-            .addNameserver("ns2.cat.みんな", "13-ROID")
+            .addNameserver("ns1.cat.みんな", hostNameToHostMap.get("ns1.cat.xn--q9jyb4c").getRepoId())
+            .addNameserver("ns2.cat.みんな", hostNameToHostMap.get("ns2.cat.xn--q9jyb4c").getRepoId())
             .load("rdap_domain_unicode_with_unicode_nameservers.json"));
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
   }
@@ -723,10 +724,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NAME,
         "cat.1.test",
         jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1TEST")
+            .addDomain("cat.1.test", domainMultipart.getRepoId())
             .addRegistrar("1.test")
-            .addNameserver("ns1.cat.1.test", "17-ROID")
-            .addNameserver("ns2.cat.2.test", "19-ROID")
+            .addNameserver("ns1.cat.1.test", hostNameToHostMap.get("ns1.cat.1.test").getRepoId())
+            .addNameserver("ns2.cat.2.test", hostNameToHostMap.get("ns2.cat.2.test").getRepoId())
             .load("rdap_domain.json"));
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
   }
@@ -737,10 +738,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NAME,
         "ca*.1.test",
         jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1TEST")
+            .addDomain("cat.1.test", domainMultipart.getRepoId())
             .addRegistrar("1.test")
-            .addNameserver("ns1.cat.1.test", "17-ROID")
-            .addNameserver("ns2.cat.2.test", "19-ROID")
+            .addNameserver("ns1.cat.1.test", hostNameToHostMap.get("ns1.cat.1.test").getRepoId())
+            .addNameserver("ns2.cat.2.test", hostNameToHostMap.get("ns2.cat.2.test").getRepoId())
             .load("rdap_domain.json"));
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(1L));
   }
@@ -813,10 +814,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         .that(generateActualJson(RequestType.NAME, "cat.*"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("cat.1.test", "1B-1TEST")
-                .addDomain("cat.example", "F-EXAMPLE")
-                .addDomain("cat.lol", "6-LOL")
-                .addDomain("cat.みんな", "15-Q9JYB4C")
+                .addDomain("cat.1.test", domainMultipart.getRepoId())
+                .addDomain("cat.example", domainCatExample.getRepoId())
+                .addDomain("cat.lol", domainCatLol.getRepoId())
+                .addDomain("cat.みんな", domainIdn.getRepoId())
                 .load("rdap_domains_four_with_one_unicode.json"));
     assertThat(response.getStatus()).isEqualTo(200);
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(4L));
@@ -851,10 +852,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         .that(generateActualJson(RequestType.NAME, "cat*"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("cat.1.test", "1B-1TEST")
-                .addDomain("cat.example", "F-EXAMPLE")
-                .addDomain("cat.lol", "6-LOL")
-                .addDomain("cat.みんな", "15-Q9JYB4C")
+                .addDomain("cat.1.test", domainMultipart.getRepoId())
+                .addDomain("cat.example", domainCatExample.getRepoId())
+                .addDomain("cat.lol", domainCatLol.getRepoId())
+                .addDomain("cat.みんな", domainIdn.getRepoId())
                 .setNextQuery("name=cat*&cursor=Y2F0LnhuLS1xOWp5YjRj")
                 .load("rdap_domains_four_with_one_unicode_truncated.json"));
     assertThat(response.getStatus()).isEqualTo(200);
@@ -970,15 +971,15 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
     // This is not exactly desired behavior, but expected: There are enough domains to fill a full
     // result set, but there are so many deleted domains that we run out of patience before we work
     // our way through all of them.
-    createManyDomainsAndHosts(4, 50, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 50, 2);
     rememberWildcardType("domain*.lol");
     assertAboutJson()
         .that(generateActualJson(RequestType.NAME, "domain*.lol"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("domain100.lol", "8E-LOL")
-                .addDomain("domain150.lol", "5C-LOL")
-                .addDomain("domain200.lol", "2A-LOL")
+                .addDomain("domain100.lol", domains.get(100).getRepoId())
+                .addDomain("domain150.lol", domains.get(50).getRepoId())
+                .addDomain("domain200.lol", domains.get(0).getRepoId())
                 .addDomain("domainunused.lol", "unused-LOL")
                 .load("rdap_incomplete_domain_result_set.json"));
     assertThat(response.getStatus()).isEqualTo(200);
@@ -990,28 +991,28 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testDomainMatch_nontruncatedResultsSet() {
-    createManyDomainsAndHosts(4, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NAME,
         "domain*.lol",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
-        "2A-LOL",
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
+        domains.get(0).getRepoId(),
         "rdap_nontruncated_domains.json");
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(4L));
   }
 
   @Test
   void testDomainMatch_truncatedResultsSet() {
-    createManyDomainsAndHosts(5, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(5, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NAME,
         "domain*.lol",
-        "2E-LOL",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
+        domains.get(4).getRepoId(),
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
         "name=domain*.lol&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(5L), IncompletenessWarningType.TRUNCATED);
@@ -1019,16 +1020,16 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testDomainMatch_tldSearchOrderedProperly_sql() {
-    createManyDomainsAndHosts(4, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 1, 2);
     rememberWildcardType("*.lol");
     assertAboutJson()
         .that(generateActualJson(RequestType.NAME, "*.lol"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("cat.lol", "6-LOL")
-                .addDomain("cat2.lol", "B-LOL")
-                .addDomain("domain1.lol", "2D-LOL")
-                .addDomain("domain2.lol", "2C-LOL")
+                .addDomain("cat.lol", domainCatLol.getRepoId())
+                .addDomain("cat2.lol", domainCatLol2.getRepoId())
+                .addDomain("domain1.lol", domains.get(3).getRepoId())
+                .addDomain("domain2.lol", domains.get(2).getRepoId())
                 .setNextQuery("name=*.lol&cursor=ZG9tYWluMi5sb2w%3D")
                 .load("rdap_domains_four_truncated.json"));
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(5L), IncompletenessWarningType.TRUNCATED);
@@ -1038,14 +1039,14 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
   void testDomainMatch_reallyTruncatedResultsSet() {
     // Don't use 10 or more domains for this test, because domain10.lol will come before
     // domain2.lol, and you'll get the wrong domains in the result set.
-    createManyDomainsAndHosts(9, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(9, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NAME,
         "domain*.lol",
-        "32-LOL",
-        "31-LOL",
-        "30-LOL",
-        "2F-LOL",
+        domains.get(8).getRepoId(),
+        domains.get(7).getRepoId(),
+        domains.get(6).getRepoId(),
+        domains.get(5).getRepoId(),
         "name=domain*.lol&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(SearchType.BY_DOMAIN_NAME, Optional.of(5L), IncompletenessWarningType.TRUNCATED);
@@ -1053,16 +1054,16 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testDomainMatch_truncatedResultsAfterMultipleChunks_sql() {
-    createManyDomainsAndHosts(5, 6, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(5, 6, 2);
     rememberWildcardType("domain*.lol");
     assertAboutJson()
         .that(generateActualJson(RequestType.NAME, "domain*.lol"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("domain12.lol", "3C-LOL")
-                .addDomain("domain18.lol", "36-LOL")
-                .addDomain("domain24.lol", "30-LOL")
-                .addDomain("domain30.lol", "2A-LOL")
+                .addDomain("domain12.lol", domains.get(18).getRepoId())
+                .addDomain("domain18.lol", domains.get(12).getRepoId())
+                .addDomain("domain24.lol", domains.get(6).getRepoId())
+                .addDomain("domain30.lol", domains.get(0).getRepoId())
                 .setNextQuery("name=domain*.lol&cursor=ZG9tYWluMzAubG9s")
                 .load("rdap_domains_four_truncated.json"));
     assertThat(response.getStatus()).isEqualTo(200);
@@ -1261,10 +1262,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NS_LDH_NAME,
         "ns1.cat.xn--q9jyb4c",
         jsonFileBuilder()
-            .addDomain("cat.みんな", "15-Q9JYB4C")
+            .addDomain("cat.みんな", domainIdn.getRepoId())
             .addRegistrar("みんな")
-            .addNameserver("ns1.cat.みんな", "11-ROID")
-            .addNameserver("ns2.cat.みんな", "13-ROID")
+            .addNameserver("ns1.cat.みんな", hostNameToHostMap.get("ns1.cat.xn--q9jyb4c").getRepoId())
+            .addNameserver("ns2.cat.みんな", hostNameToHostMap.get("ns2.cat.xn--q9jyb4c").getRepoId())
             .load("rdap_domain_unicode_with_unicode_nameservers.json"));
     verifyMetrics(SearchType.BY_NAMESERVER_NAME, 1, 1);
   }
@@ -1275,10 +1276,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NS_LDH_NAME,
         "ns1.cat.1.test",
         jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1TEST")
+            .addDomain("cat.1.test", domainMultipart.getRepoId())
             .addRegistrar("1.test")
-            .addNameserver("ns1.cat.1.test", "17-ROID")
-            .addNameserver("ns2.cat.2.test", "19-ROID")
+            .addNameserver("ns1.cat.1.test", hostNameToHostMap.get("ns1.cat.1.test").getRepoId())
+            .addNameserver("ns2.cat.2.test", hostNameToHostMap.get("ns2.cat.2.test").getRepoId())
             .load("rdap_domain.json"));
     verifyMetrics(SearchType.BY_NAMESERVER_NAME, 1, 1);
   }
@@ -1289,10 +1290,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         RequestType.NS_LDH_NAME,
         "ns*.cat.1.test",
         jsonFileBuilder()
-            .addDomain("cat.1.test", "1B-1TEST")
+            .addDomain("cat.1.test", domainMultipart.getRepoId())
             .addRegistrar("1.test")
-            .addNameserver("ns1.cat.1.test", "17-ROID")
-            .addNameserver("ns2.cat.2.test", "19-ROID")
+            .addNameserver("ns1.cat.1.test", hostNameToHostMap.get("ns1.cat.1.test").getRepoId())
+            .addNameserver("ns2.cat.2.test", hostNameToHostMap.get("ns2.cat.2.test").getRepoId())
             .load("rdap_domain.json"));
     verifyMetrics(SearchType.BY_NAMESERVER_NAME, 1, 1);
   }
@@ -1430,28 +1431,28 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testNameserverMatch_nontruncatedResultsSet() {
-    createManyDomainsAndHosts(4, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_LDH_NAME,
         "ns1.domain1.lol",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
-        "2A-LOL",
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
+        domains.get(0).getRepoId(),
         "rdap_nontruncated_domains.json");
     verifyMetrics(SearchType.BY_NAMESERVER_NAME, Optional.of(4L), Optional.of(1L));
   }
 
   @Test
   void testNameserverMatch_truncatedResultsSet() {
-    createManyDomainsAndHosts(5, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(5, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_LDH_NAME,
         "ns1.domain1.lol",
-        "2E-LOL",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
+        domains.get(4).getRepoId(),
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
         "nsLdhName=ns1.domain1.lol&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(
@@ -1463,14 +1464,14 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testNameserverMatch_reallyTruncatedResultsSet() {
-    createManyDomainsAndHosts(9, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(9, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_LDH_NAME,
         "ns1.domain1.lol",
-        "32-LOL",
-        "31-LOL",
-        "30-LOL",
-        "2F-LOL",
+        domains.get(8).getRepoId(),
+        domains.get(7).getRepoId(),
+        domains.get(6).getRepoId(),
+        domains.get(5).getRepoId(),
         "nsLdhName=ns1.domain1.lol&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(
@@ -1484,16 +1485,16 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
   void testNameserverMatch_duplicatesNotTruncated() {
     // 36 nameservers for each of 4 domains; these should translate into two fetches, which should
     // not trigger the truncation warning because all the domains will be duplicates.
-    createManyDomainsAndHosts(4, 1, 36);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 1, 36);
     rememberWildcardType("ns*.domain1.lol");
     assertAboutJson()
         .that(generateActualJson(RequestType.NS_LDH_NAME, "ns*.domain1.lol"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("domain1.lol", "71-LOL")
-                .addDomain("domain2.lol", "70-LOL")
-                .addDomain("domain3.lol", "6F-LOL")
-                .addDomain("domain4.lol", "6E-LOL")
+                .addDomain("domain1.lol", domains.get(3).getRepoId())
+                .addDomain("domain2.lol", domains.get(2).getRepoId())
+                .addDomain("domain3.lol", domains.get(1).getRepoId())
+                .addDomain("domain4.lol", domains.get(0).getRepoId())
                 .load("rdap_nontruncated_domains.json"));
     assertThat(response.getStatus()).isEqualTo(200);
     verifyMetrics(SearchType.BY_NAMESERVER_NAME, Optional.of(4L), Optional.of(36L));
@@ -1501,14 +1502,14 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testNameserverMatch_incompleteResultsSet() {
-    createManyDomainsAndHosts(2, 1, 41);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(2, 1, 41);
     rememberWildcardType("ns*.domain1.lol");
     assertAboutJson()
         .that(generateActualJson(RequestType.NS_LDH_NAME, "ns*.domain1.lol"))
         .isEqualTo(
             jsonFileBuilder()
-                .addDomain("domain1.lol", "79-LOL")
-                .addDomain("domain2.lol", "78-LOL")
+                .addDomain("domain1.lol", domains.get(1).getRepoId())
+                .addDomain("domain2.lol", domains.get(0).getRepoId())
                 .load("rdap_incomplete_domains.json"));
     assertThat(response.getStatus()).isEqualTo(200);
     verifyMetrics(
@@ -1641,10 +1642,10 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
         .isEqualTo(
             wrapInSearchReply(
                 jsonFileBuilder()
-                    .addDomain("cat.lol", "6-LOL")
+                    .addDomain("cat.lol", domainCatLol.getRepoId())
                     .addRegistrar("Yes Virginia <script>")
-                    .addNameserver("ns1.cat.lol", "2-ROID")
-                    .addNameserver("ns2.cat.lol", "4-ROID")
+                    .addNameserver("ns1.cat.lol", hostNs1CatLol.getRepoId())
+                    .addNameserver("ns2.cat.lol", hostNs2CatLol.getRepoId())
                     .load("rdap_domain.json")));
     assertThat(response.getStatus()).isEqualTo(200);
     verifyMetrics(SearchType.BY_NAMESERVER_ADDRESS, 1, 1);
@@ -1667,28 +1668,28 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testAddressMatch_nontruncatedResultsSet() {
-    createManyDomainsAndHosts(4, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(4, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_IP,
         "5.5.5.1",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
-        "2A-LOL",
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
+        domains.get(0).getRepoId(),
         "rdap_nontruncated_domains.json");
     verifyMetrics(SearchType.BY_NAMESERVER_ADDRESS, 4, 1);
   }
 
   @Test
   void testAddressMatch_truncatedResultsSet() {
-    createManyDomainsAndHosts(5, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(5, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_IP,
         "5.5.5.1",
-        "2E-LOL",
-        "2D-LOL",
-        "2C-LOL",
-        "2B-LOL",
+        domains.get(4).getRepoId(),
+        domains.get(3).getRepoId(),
+        domains.get(2).getRepoId(),
+        domains.get(1).getRepoId(),
         "nsIp=5.5.5.1&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(
@@ -1700,14 +1701,14 @@ class RdapDomainSearchActionTest extends RdapSearchActionTestCase<RdapDomainSear
 
   @Test
   void testAddressMatch_reallyTruncatedResultsSet() {
-    createManyDomainsAndHosts(9, 1, 2);
+    ImmutableList<Domain> domains = createManyDomainsAndHosts(9, 1, 2);
     runSuccessfulTestWithFourDomains(
         RequestType.NS_IP,
         "5.5.5.1",
-        "32-LOL",
-        "31-LOL",
-        "30-LOL",
-        "2F-LOL",
+        domains.get(8).getRepoId(),
+        domains.get(7).getRepoId(),
+        domains.get(6).getRepoId(),
+        domains.get(5).getRepoId(),
         "nsIp=5.5.5.1&cursor=ZG9tYWluNC5sb2w%3D",
         "rdap_domains_four_truncated.json");
     verifyMetrics(

core/src/test/java/google/registry/request/JsonResponseTest.java

@@ -18,17 +18,21 @@ import static com.google.common.truth.Truth.assertThat;
 import static google.registry.request.JsonResponse.JSON_SAFETY_PREFIX;
 
 import com.google.common.collect.ImmutableMap;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
 import google.registry.testing.FakeResponse;
+import google.registry.tools.GsonUtils;
 import java.time.Instant;
 import java.util.Map;
-import org.json.simple.JSONValue;
 import org.junit.jupiter.api.Test;
 
 /** Unit tests for {@link JsonResponse}. */
 class JsonResponseTest {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   private FakeResponse fakeResponse = new FakeResponse();
-  private JsonResponse jsonResponse = new JsonResponse(fakeResponse);
+  private JsonResponse jsonResponse = new JsonResponse(fakeResponse, GSON);
 
   @Test
   void testSetStatus() {
@@ -44,9 +48,8 @@ class JsonResponseTest {
     jsonResponse.setPayload(responseValues);
     String payload = fakeResponse.getPayload();
     assertThat(payload).startsWith(JSON_SAFETY_PREFIX);
-    @SuppressWarnings("unchecked")
-    Map<String, Object> responseMap = (Map<String, Object>)
-        JSONValue.parse(payload.substring(JSON_SAFETY_PREFIX.length()));
+    Map<String, Object> responseMap =
+        GSON.fromJson(payload.substring(JSON_SAFETY_PREFIX.length()), new TypeToken<>() {});
     assertThat(responseMap).containsExactlyEntriesIn(responseValues);
   }
 

core/src/test/java/google/registry/request/RequestModuleTest.java

@@ -19,21 +19,26 @@ import static google.registry.request.RequestModule.provideJsonPayload;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.common.net.MediaType;
+import com.google.gson.Gson;
 import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.HttpException.UnsupportedMediaTypeException;
+import google.registry.tools.GsonUtils;
 import org.junit.jupiter.api.Test;
 
 /** Unit tests for {@link RequestModule}. */
 final class RequestModuleTest {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   @Test
   void testProvideJsonPayload() {
-    assertThat(provideJsonPayload(MediaType.JSON_UTF_8, "{\"k\":\"v\"}")).containsExactly("k", "v");
+    assertThat(provideJsonPayload(MediaType.JSON_UTF_8, "{\"k\":\"v\"}", GSON))
+        .containsExactly("k", "v");
   }
 
   @Test
   void testProvideJsonPayload_contentTypeWithoutCharsetAllowed() {
-    assertThat(provideJsonPayload(MediaType.JSON_UTF_8.withoutParameters(), "{\"k\":\"v\"}"))
+    assertThat(provideJsonPayload(MediaType.JSON_UTF_8.withoutParameters(), "{\"k\":\"v\"}", GSON))
         .containsExactly("k", "v");
   }
 
@@ -41,14 +46,16 @@ final class RequestModuleTest {
   void testProvideJsonPayload_malformedInput_throws500() {
     BadRequestException thrown =
         assertThrows(
-            BadRequestException.class, () -> provideJsonPayload(MediaType.JSON_UTF_8, "{\"k\":"));
+            BadRequestException.class,
+            () -> provideJsonPayload(MediaType.JSON_UTF_8, "{\"k\":", GSON));
     assertThat(thrown).hasMessageThat().contains("Malformed JSON");
   }
 
   @Test
   void testProvideJsonPayload_emptyInput_throws500() {
     BadRequestException thrown =
-        assertThrows(BadRequestException.class, () -> provideJsonPayload(MediaType.JSON_UTF_8, ""));
+        assertThrows(
+            BadRequestException.class, () -> provideJsonPayload(MediaType.JSON_UTF_8, "", GSON));
     assertThat(thrown).hasMessageThat().contains("Malformed JSON");
   }
 
@@ -56,13 +63,13 @@ final class RequestModuleTest {
   void testProvideJsonPayload_nonJsonContentType_throws415() {
     assertThrows(
         UnsupportedMediaTypeException.class,
-        () -> provideJsonPayload(MediaType.PLAIN_TEXT_UTF_8, "{}"));
+        () -> provideJsonPayload(MediaType.PLAIN_TEXT_UTF_8, "{}", GSON));
   }
 
   @Test
   void testProvideJsonPayload_contentTypeWithWeirdParam_throws415() {
     assertThrows(
         UnsupportedMediaTypeException.class,
-        () -> provideJsonPayload(MediaType.JSON_UTF_8.withParameter("omg", "handel"), "{}"));
+        () -> provideJsonPayload(MediaType.JSON_UTF_8.withParameter("omg", "handel"), "{}", GSON));
   }
 }

core/src/test/java/google/registry/security/JsonHttpTestUtils.java

@@ -20,21 +20,25 @@ import static com.google.common.truth.Truth.assertWithMessage;
 import static google.registry.security.JsonHttp.JSON_SAFETY_PREFIX;
 
 import com.google.common.base.Supplier;
+import com.google.gson.Gson;
+import com.google.gson.JsonSyntaxException;
+import com.google.gson.reflect.TypeToken;
+import google.registry.tools.GsonUtils;
 import java.io.BufferedReader;
 import java.io.StringReader;
 import java.io.StringWriter;
 import java.util.Map;
-import org.json.simple.JSONValue;
-import org.json.simple.parser.ParseException;
 
 /**
  * Helper class for testing JSON RPC servlets.
  */
 public final class JsonHttpTestUtils {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   /** Returns JSON payload for mocked result of {@code rsp.getReader()}. */
   public static BufferedReader createJsonPayload(Map<String, ?> object) {
-    return createJsonPayload(JSONValue.toJSONString(object));
+    return createJsonPayload(GSON.toJson(object));
   }
 
   /** @see #createJsonPayload(Map) */
@@ -58,10 +62,8 @@ public final class JsonHttpTestUtils {
     assertThat(jsonText).startsWith(JSON_SAFETY_PREFIX);
     jsonText = jsonText.substring(JSON_SAFETY_PREFIX.length());
     try {
-      @SuppressWarnings("unchecked")
-      Map<String, Object> json = (Map<String, Object>) JSONValue.parseWithException(jsonText);
-      return json;
-    } catch (ClassCastException | ParseException e) {
+      return GSON.fromJson(jsonText, new TypeToken<>() {});
+    } catch (ClassCastException | JsonSyntaxException e) {
       assertWithMessage("Bad JSON: %s\n%s", e.getMessage(), jsonText).fail();
       throw new AssertionError();
     }

core/src/test/java/google/registry/server/RegistryTestServer.java

@@ -33,7 +33,7 @@ public final class RegistryTestServer {
 
   public static final ImmutableMap<String, Path> RUNFILES =
       new ImmutableMap.Builder<String, Path>()
-          .put("/console/*", PROJECT_ROOT.resolve("console-webapp/staged/dist"))
+          .put("/console/*", PROJECT_ROOT.resolve("console-webapp/staged/dist/browser"))
           .build();
 
   public static final ImmutableList<Route> ROUTES =

core/src/test/java/google/registry/testing/DatabaseHelper.java

@@ -69,6 +69,9 @@ import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.DnsRefreshRequest;
+import google.registry.model.common.FeatureFlag;
+import google.registry.model.common.FeatureFlag.FeatureName;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
@@ -682,6 +685,32 @@ public final class DatabaseHelper {
     return newRegistrars.build();
   }
 
+  /** Persists and returns a {@link FeatureFlag} with a single status starting from the epoch. */
+  public static FeatureFlag persistFeatureFlag(FeatureName featureName, FeatureStatus status) {
+    return persistFeatureFlag(featureName, ImmutableSortedMap.of(START_INSTANT, status));
+  }
+
+  /** Persists and returns a {@link FeatureFlag} with an initial status and one transition. */
+  public static FeatureFlag persistFeatureFlag(
+      FeatureName featureName,
+      FeatureStatus initialStatus,
+      Instant transitionTime,
+      FeatureStatus status) {
+    return persistFeatureFlag(
+        featureName,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, initialStatus)
+            .put(transitionTime, status)
+            .build());
+  }
+
+  /** Persists and returns a {@link FeatureFlag} with a custom status map. */
+  public static FeatureFlag persistFeatureFlag(
+      FeatureName featureName, ImmutableSortedMap<Instant, FeatureStatus> statusMap) {
+    return persistResource(
+        new FeatureFlag.Builder().setFeatureName(featureName).setStatusMap(statusMap).build());
+  }
+
   public static Iterable<BillingBase> getBillingEvents() {
     return tm().transact(
             () ->

core/src/test/java/google/registry/testing/FakeJsonResponse.java

@@ -15,6 +15,7 @@
 package google.registry.testing;
 
 import google.registry.request.JsonResponse;
+import google.registry.tools.GsonUtils;
 import java.util.Map;
 
 /** Fake implementation of {@link JsonResponse} for testing. */
@@ -23,7 +24,7 @@ public final class FakeJsonResponse extends JsonResponse {
   private Map<String, ?> responseMap;
 
   public FakeJsonResponse() {
-    super(new FakeResponse());
+    super(new FakeResponse(), GsonUtils.provideGson());
   }
 
   @Override

core/src/test/java/google/registry/tools/ConfigureFeatureFlagCommandTest.java

@@ -19,7 +19,7 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -27,7 +27,6 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.common.FeatureFlag;
-import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.testing.FakeClock;
 import java.time.Instant;
@@ -81,14 +80,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testUpdate() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())
@@ -110,14 +102,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testConfigure_multipleFlags() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())
@@ -179,14 +164,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testUpdate_invalidStatusMap() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())

core/src/test/java/google/registry/tools/CreateDomainCommandTest.java

@@ -15,8 +15,10 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static org.joda.money.CurrencyUnit.JPY;
@@ -25,6 +27,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSet;
 import google.registry.dns.writer.VoidDnsWriter;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumListDao;
@@ -49,9 +52,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=ns1.zdns.google,ns2.zdns.google,ns3.zdns.google,ns4.zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -63,9 +66,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=NS1.zdns.google,ns2.ZDNS.google,ns3.zdns.gOOglE,ns4.zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -77,9 +80,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=ns[1-4].zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -91,9 +94,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=NS[1-4].zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -280,15 +283,28 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
   }
 
   @Test
-  void testFailure_invalidDigestLength() {
+  void testFailure_forbiddenAlgorithm() {
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
             () ->
                 runCommandForced(
                     "--client=NewRegistrar",
-                    "--ds_records=1 2 1 abcd",
+                    "--ds_records=1 1 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
                     "example.tld"));
+    assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized algorithm: 1");
+  }
+
+  @Test
+  void testFailure_invalidDigestLength() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                runCommandForced(
+                    "--client=NewRegistrar", "--ds_records=1 2 2 abcd", "example.tld"));
     assertThat(thrown).hasMessageThat().isEqualTo("DS record has an invalid digest length: ABCD");
   }
 

core/src/test/java/google/registry/tools/DeleteFeatureFlagCommandTest.java

@@ -18,10 +18,8 @@ import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.testing.DatabaseHelper.persistResource;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 
-import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.common.FeatureFlag;
 import org.junit.jupiter.api.Test;
 
@@ -30,12 +28,7 @@ public class DeleteFeatureFlagCommandTest extends CommandTestCase<DeleteFeatureF
 
   @Test
   void testSimpleSuccess() throws Exception {
-    persistResource(
-        new FeatureFlag()
-            .asBuilder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, ACTIVE))
-            .build());
+    persistFeatureFlag(TEST_FEATURE, ACTIVE);
     assertThat(tm().transact(() -> FeatureFlag.isActiveNow(TEST_FEATURE))).isTrue();
     runCommandForced("TEST_FEATURE");
     assertThat(FeatureFlag.getUncached(TEST_FEATURE)).isEmpty();

core/src/test/java/google/registry/tools/DigestTypeTest.java

@@ -0,0 +1,48 @@
+// Copyright 2026 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import org.junit.jupiter.api.Test;
+
+/** Unit tests for {@link DigestType}. */
+class DigestTypeTest {
+
+  @Test
+  void testFromWireValue_sha1_returnsSha1() {
+    assertThat(DigestType.fromWireValue(1)).hasValue(DigestType.SHA1);
+  }
+
+  @Test
+  void testFromWireValue_sha256_returnsSha256() {
+    assertThat(DigestType.fromWireValue(2)).hasValue(DigestType.SHA256);
+  }
+
+  @Test
+  void testFromWireValue_gost_returnsEmpty() {
+    assertThat(DigestType.fromWireValue(3)).isEmpty();
+  }
+
+  @Test
+  void testFromWireValue_sha384_returnsSha384() {
+    assertThat(DigestType.fromWireValue(4)).hasValue(DigestType.SHA384);
+  }
+
+  @Test
+  void testFromWireValue_invalid_returnsEmpty() {
+    assertThat(DigestType.fromWireValue(5)).isEmpty();
+  }
+}

core/src/test/java/google/registry/tools/GcpProjectConnectionTest.java

@@ -85,7 +85,8 @@ final class GcpProjectConnectionTest {
     when(lowLevelHttpResponse.getStatusCode()).thenReturn(200);
 
     httpTransport = new TestHttpTransport();
-    connection = new ServiceConnection(false, httpTransport.createRequestFactory());
+    connection =
+        new ServiceConnection(false, httpTransport.createRequestFactory(), GsonUtils.provideGson());
   }
 
   @Test

core/src/test/java/google/registry/tools/GenerateDnsReportCommandTest.java

@@ -31,6 +31,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Lists;
 import com.google.common.net.InetAddresses;
+import com.google.gson.Gson;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.secdns.DomainDsData;
 import google.registry.model.eppcommon.StatusValue;
@@ -41,19 +42,19 @@ import java.io.Reader;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
-import org.json.simple.JSONValue;
-import org.json.simple.parser.ParseException;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 /** Unit tests for {@link GenerateDnsReportCommand}. */
 class GenerateDnsReportCommandTest extends CommandTestCase<GenerateDnsReportCommand> {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   private Path output;
 
-  private Object getOutputAsJson() throws IOException, ParseException {
+  private Object getOutputAsJson() throws IOException {
     try (Reader reader = Files.newBufferedReader(output, UTF_8)) {
-      return JSONValue.parseWithException(reader);
+      return GSON.fromJson(reader, Object.class);
     }
   }
 
@@ -114,6 +115,7 @@ class GenerateDnsReportCommandTest extends CommandTestCase<GenerateDnsReportComm
   void beforeEach() {
     output = tmpDir.resolve("out.dat");
     command.clock = fakeClock;
+    command.gson = GSON;
 
     createTlds("xn--q9jyb4c", "example");
     nameserver1 =

core/src/test/java/google/registry/tools/GetFeatureFlagCommandTest.java

@@ -19,7 +19,7 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -27,7 +27,6 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.EntityYamlUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureFlagNotFoundException;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.testing.FakeClock;
@@ -47,15 +46,7 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testSuccess() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
     runCommand("TEST_FEATURE");
     assertInStdout(
         """
@@ -68,24 +59,13 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testSuccess_multipleArguments() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 3), ACTIVE)
-                    .put(plusWeeks(clock.now(), 6), INACTIVE)
-                    .build())
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
+    persistFeatureFlag(
+        MINIMUM_DATASET_CONTACTS_OPTIONAL,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, INACTIVE)
+            .put(plusWeeks(clock.now(), 3), ACTIVE)
+            .put(plusWeeks(clock.now(), 6), INACTIVE)
             .build());
     runCommand("TEST_FEATURE", "MINIMUM_DATASET_CONTACTS_OPTIONAL");
     assertInStdout(
@@ -114,15 +94,7 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testFailure_oneFlagDoesNotExist() {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
     assertThrows(
         FeatureFlagNotFoundException.class,
         () -> runCommand("TEST_FEATURE", "MINIMUM_DATASET_CONTACTS_OPTIONAL"));

core/src/test/java/google/registry/tools/ListFeatureFlagsCommandTest.java

@@ -18,14 +18,13 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.EntityYamlUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import java.time.Instant;
 import org.junit.jupiter.api.BeforeEach;
@@ -41,49 +40,23 @@ public class ListFeatureFlagsCommandTest extends CommandTestCase<ListFeatureFlag
 
   @Test
   void testSuccess_oneFlag() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(fakeClock.now(), 8), ACTIVE);
     runCommand();
     assertInStdout(loadFile(getClass(), "oneFlag.yaml"));
   }
 
   @Test
   void test_success_manyFlags() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 1), ACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 10), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_PROHIBITED)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, ACTIVE)
-                    .build())
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(fakeClock.now(), 8), ACTIVE);
+    persistFeatureFlag(
+        MINIMUM_DATASET_CONTACTS_OPTIONAL,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, INACTIVE)
+            .put(plusWeeks(fakeClock.now(), 1), ACTIVE)
+            .put(plusWeeks(fakeClock.now(), 8), INACTIVE)
+            .put(plusWeeks(fakeClock.now(), 10), ACTIVE)
             .build());
+    persistFeatureFlag(MINIMUM_DATASET_CONTACTS_PROHIBITED, ACTIVE);
     runCommand();
     assertInStdout(loadFile(getClass(), "threeFlags.yaml"));
   }

core/src/test/java/google/registry/tools/ServiceConnectionTest.java

@@ -26,6 +26,7 @@ import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpRequestFactory;
 import com.google.api.client.http.HttpResponse;
 import com.google.common.collect.ImmutableMap;
+import com.google.gson.Gson;
 import google.registry.request.Action.Service;
 import java.io.ByteArrayInputStream;
 import org.junit.jupiter.api.Test;
@@ -33,10 +34,12 @@ import org.junit.jupiter.api.Test;
 /** Unit tests for {@link google.registry.tools.ServiceConnection}. */
 public class ServiceConnectionTest {
 
+  private static final Gson GSON = GsonUtils.provideGson();
+
   @Test
   void testSuccess_serverUrl_notCanary() {
     ServiceConnection connection =
-        new ServiceConnection(false, null).withService(Service.FRONTEND, false);
+        new ServiceConnection(false, null, GSON).withService(Service.FRONTEND, false);
     String serverUrl = connection.getServer().toString();
     assertThat(serverUrl).isEqualTo("https://frontend.registry.test"); // See default-config.yaml
   }
@@ -52,7 +55,7 @@ public class ServiceConnectionTest {
     when(request.execute()).thenReturn(response);
     when(response.getContent()).thenReturn(ByteArrayInputStream.nullInputStream());
     ServiceConnection connection =
-        new ServiceConnection(false, factory).withService(Service.PUBAPI, true);
+        new ServiceConnection(false, factory, GSON).withService(Service.PUBAPI, true);
     String serverUrl = connection.getServer().toString();
     assertThat(serverUrl).isEqualTo("https://pubapi.registry.test");
     connection.sendGetRequest("/path", ImmutableMap.of());

core/src/test/java/google/registry/tools/UniformRapidSuspensionCommandTest.java

@@ -79,7 +79,7 @@ class UniformRapidSuspensionCommandTest
     runCommandForced(
         "--domain_name=evil.tld",
         "--hosts=urs1.example.com,urs2.example.com",
-        "--dsdata=1 1 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--dsdata=1 1 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--renew_one_year=false");
     eppVerifier
         .expectRegistrarId("CharlestonRoad")
@@ -107,7 +107,7 @@ class UniformRapidSuspensionCommandTest
     runCommandForced(
         "--domain_name=evil.tld",
         "--hosts=urs1.example.com,urs2.example.com",
-        "--dsdata=1 1 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--dsdata=1 1 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--renew_one_year=false");
     eppVerifier
         .expectRegistrarId("CharlestonRoad")
@@ -179,7 +179,7 @@ class UniformRapidSuspensionCommandTest
     runCommandForced(
         "--domain_name=evil.tld",
         "--hosts=urs1.example.com,urs2.example.com",
-        "--dsdata=1 1 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--dsdata=1 1 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--renew_one_year=false");
     eppVerifier
         .expectRegistrarId("CharlestonRoad")
@@ -198,7 +198,7 @@ class UniformRapidSuspensionCommandTest
     runCommandForced(
         "--domain_name=evil.tld",
         "--hosts=URS[1-2].example.com",
-        "--dsdata=1 1 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--dsdata=1 1 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--renew_one_year=false");
     eppVerifier
         .expectRegistrarId("CharlestonRoad")

core/src/test/java/google/registry/tools/UpdateDomainCommandTest.java

@@ -15,6 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.model.domain.rgp.GracePeriodStatus.AUTO_RENEW;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
 import static google.registry.model.eppcommon.StatusValue.SERVER_UPDATE_PROHIBITED;
@@ -22,6 +23,7 @@ import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_CREATE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.TestLogHandlerUtils.assertLogMessage;
 import static google.registry.testing.TestLogHandlerUtils.assertNoLogMessage;
@@ -36,6 +38,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.model.billing.BillingBase.Flag;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -76,10 +79,11 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
         "--add_nameservers=ns1.zdns.google,ns2.zdns.google",
         "--add_statuses=serverDeleteProhibited",
         "--add_ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4"
-            + " 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+            + " 5 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--remove_nameservers=ns3.zdns.google,ns4.zdns.google",
         "--remove_statuses=serverHold",
-        "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3,6 5 4"
+        "--remove_ds_records=7 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,6 5 4"
             + " 768412320F7B0AA5812FCE428DC4706B3CAE50E02A64CAA16A782249BFE8EFC4B7EF1CCB126255D196047DFEDF17A0A9",
         "--password=2fooBAR",
         "example.tld");
@@ -93,10 +97,11 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
         "--add_nameservers=NS[1-2].zdns.google",
         "--add_statuses=serverDeleteProhibited",
         "--add_ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4"
-            + " 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+            + " 5 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--remove_nameservers=ns[3-4].zdns.google",
         "--remove_statuses=serverHold",
-        "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3,6 5 4"
+        "--remove_ds_records=7 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,6 5 4"
             + " 768412320F7B0AA5812FCE428DC4706B3CAE50E02A64CAA16A782249BFE8EFC4B7EF1CCB126255D196047DFEDF17A0A9",
         "--password=2fooBAR",
         "example.tld");
@@ -112,10 +117,11 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
         "--add_nameservers=ns1.zdns.google,ns2.zdns.google",
         "--add_statuses=serverDeleteProhibited",
         "--add_ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4"
-            + " 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+            + " 5 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--remove_nameservers=ns[3-4].zdns.google",
         "--remove_statuses=serverHold",
-        "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3,6 5 4"
+        "--remove_ds_records=7 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,6 5 4"
             + " 768412320F7B0AA5812FCE428DC4706B3CAE50E02A64CAA16A782249BFE8EFC4B7EF1CCB126255D196047DFEDF17A0A9",
         "--password=2fooBAR",
         "example.tld",
@@ -163,7 +169,7 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
         "--add_nameservers=ns2.zdns.google,ns3.zdns.google",
         "--add_statuses=serverDeleteProhibited",
         "--add_ds_records=1 2 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,4"
-            + " 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+            + " 5 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_update_add.xml");
   }
@@ -174,7 +180,8 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
         "--client=NewRegistrar",
         "--remove_nameservers=ns4.zdns.google",
         "--remove_statuses=serverHold",
-        "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3,6 5 4"
+        "--remove_ds_records=7 8 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,6 5 4"
             + " 768412320F7B0AA5812FCE428DC4706B3CAE50E02A64CAA16A782249BFE8EFC4B7EF1CCB126255D196047DFEDF17A0A9",
         "example.tld");
     eppVerifier.verifySent("domain_update_remove.xml");
@@ -230,8 +237,8 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
   void testSuccess_setDsRecords() throws Exception {
     runCommandForced(
         "--client=NewRegistrar",
-        "--ds_records=1 2 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--ds_records=1 2 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,4 5 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_update_set_ds_records.xml");
   }
@@ -240,8 +247,8 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
   void testSuccess_setDsRecords_withUnneededClear() throws Exception {
     runCommandForced(
         "--client=NewRegistrar",
-        "--ds_records=1 2 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,4 5 1"
-            + " A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+        "--ds_records=1 2 2 D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A,4 5 2"
+            + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "--clear_ds_records",
         "example.tld");
     eppVerifier.verifySent("domain_update_set_ds_records.xml");
@@ -532,15 +539,28 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
   }
 
   @Test
-  void testFailure_invalidDigestLength() {
+  void testFailure_forbiddenDsRecordAlgorithm() {
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
             () ->
                 runCommandForced(
                     "--client=NewRegistrar",
-                    "--ds_records=1 2 1 abcd",
+                    "--add_ds_records=1 1 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
                     "example.tld"));
+    assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized algorithm: 1");
+  }
+
+  @Test
+  void testFailure_invalidDigestLength() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                runCommandForced(
+                    "--client=NewRegistrar", "--ds_records=1 2 2 abcd", "example.tld"));
     assertThat(thrown).hasMessageThat().isEqualTo("DS record has an invalid digest length: ABCD");
   }
 
@@ -554,7 +574,8 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
                     "--client=NewRegistrar",
                     "--add_ds_records=1 2 2"
                         + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
-                    "--ds_records=4 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+                    "--ds_records=4 5 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
                     "example.tld"));
     assertThat(thrown)
         .hasMessageThat()
@@ -571,8 +592,10 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
             () ->
                 runCommandForced(
                     "--client=NewRegistrar",
-                    "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
-                    "--ds_records=4 5 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+                    "--remove_ds_records=7 8 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+                    "--ds_records=4 5 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
                     "example.tld"));
     assertThat(thrown)
         .hasMessageThat()
@@ -608,7 +631,8 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
             () ->
                 runCommandForced(
                     "--client=NewRegistrar",
-                    "--remove_ds_records=7 8 1 A94A8FE5CCB19BA61C4C0873D391E987982FBBD3",
+                    "--remove_ds_records=7 8 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
                     "--clear_ds_records",
                     "example.tld"));
     assertThat(thrown)

core/src/test/java/google/registry/ui/server/console/ConsoleHistoryDataActionTest.java

@@ -23,6 +23,8 @@ import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableMap;
 import com.google.gson.Gson;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonParser;
 import google.registry.model.console.ConsoleUpdateHistory;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
@@ -162,6 +164,27 @@ class ConsoleHistoryDataActionTest extends ConsoleActionBaseTestCase {
     assertThat(response.getPayload()).isEqualTo("[]");
   }
 
+  @Test
+  void testSuccess_limitsResults() {
+    for (int i = 0; i < 10; i++) {
+      DatabaseHelper.persistResource(
+          new ConsoleUpdateHistory.Builder()
+              .setType(ConsoleUpdateHistory.Type.REGISTRAR_UPDATE)
+              .setDescription("TheRegistrar|some detail " + i)
+              .setActingUser(fteUser)
+              .setUrl("https://test.com")
+              .setMethod("GET")
+              .setModificationTime(clock.now())
+              .build());
+    }
+    ConsoleHistoryDataAction action =
+        createAction(AuthResult.createUser(fteUser), "TheRegistrar", Optional.empty(), 5);
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_OK);
+    JsonArray payload = JsonParser.parseString(response.getPayload()).getAsJsonArray();
+    assertThat(payload.size()).isEqualTo(5);
+  }
+
   @Test
   void testFailure_getByRegistrar_noPermission() {
     ConsoleHistoryDataAction action =
@@ -192,10 +215,15 @@ class ConsoleHistoryDataActionTest extends ConsoleActionBaseTestCase {
 
   private ConsoleHistoryDataAction createAction(
       AuthResult authResult, String registrarId, Optional<String> consoleUserEmail) {
+    return createAction(authResult, registrarId, consoleUserEmail, 500);
+  }
+
+  private ConsoleHistoryDataAction createAction(
+      AuthResult authResult, String registrarId, Optional<String> consoleUserEmail, int limit) {
     consoleApiParams = ConsoleApiParamsUtils.createFake(authResult);
     when(consoleApiParams.request().getMethod()).thenReturn("GET");
     response = (FakeResponse) consoleApiParams.response();
     return new ConsoleHistoryDataAction(
-        consoleApiParams, SUPPORT_EMAIL, registrarId, consoleUserEmail);
+        consoleApiParams, SUPPORT_EMAIL, limit, registrarId, consoleUserEmail);
   }
 }

core/src/test/java/google/registry/ui/server/console/ConsoleOteActionTest.java

@@ -27,6 +27,7 @@ import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.gson.reflect.TypeToken;
 import google.registry.model.OteStatsTestHelper;
 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
@@ -44,7 +45,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.stream.Collectors;
-import org.json.simple.JSONArray;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -131,7 +131,7 @@ class ConsoleOteActionTest extends ConsoleActionBaseTestCase {
             Optional.of(new OteCreateData("theregistrar", "contact@registry.example")));
     action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
     action.run();
-    var obsResponse = GSON.fromJson(response.getPayload(), Map.class);
+    Map<String, Object> obsResponse = GSON.fromJson(response.getPayload(), new TypeToken<>() {});
     assertThat(
             ImmutableMap.of(
                 "theregistrar-1", "theregistrar-sunrise",
@@ -175,7 +175,7 @@ class ConsoleOteActionTest extends ConsoleActionBaseTestCase {
             Action.Method.GET, authResult, "theregistrar-1", Optional.empty(), Optional.empty());
     action.run();
 
-    List<Map<String, ?>> responseMaps = GSON.fromJson(response.getPayload(), JSONArray.class);
+    List<Map<String, ?>> responseMaps = GSON.fromJson(response.getPayload(), new TypeToken<>() {});
     assertThat(response.getStatus()).isEqualTo(SC_OK);
     assertTrue(
         responseMaps.stream().allMatch(status -> Boolean.TRUE.equals(status.get("completed"))));
@@ -191,7 +191,7 @@ class ConsoleOteActionTest extends ConsoleActionBaseTestCase {
             Action.Method.GET, authResult, "theregistrar-1", Optional.empty(), Optional.empty());
     action.run();
 
-    List<Map<String, ?>> responseMaps = GSON.fromJson(response.getPayload(), JSONArray.class);
+    List<Map<String, ?>> responseMaps = GSON.fromJson(response.getPayload(), new TypeToken<>() {});
     assertThat(response.getStatus()).isEqualTo(SC_OK);
     assertThat(
             responseMaps.stream()

core/src/test/java/google/registry/ui/server/console/PasswordResetVerifyActionTest.java

@@ -85,6 +85,16 @@ public class PasswordResetVerifyActionTest extends ConsoleActionBaseTestCase {
         .isTrue();
   }
 
+  @Test
+  void testFailure_post_replay() throws Exception {
+    createAction("POST", verificationCode, "newPassword1").run();
+    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
+
+    // Attempting to reuse the same code should fail
+    createAction("POST", verificationCode, "newPassword2").run();
+    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_BAD_REQUEST);
+  }
+
   @Test
   void testFailure_get_invalidVerificationCode() throws Exception {
     createAction("GET", "invalid", null).run();

core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java

@@ -45,6 +45,7 @@ import google.registry.testing.ConsoleApiParamsUtils;
 import google.registry.testing.FakeResponse;
 import google.registry.ui.server.console.ConsoleActionBaseTestCase;
 import google.registry.ui.server.console.ConsoleApiParams;
+import java.util.Collections;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -173,7 +174,9 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase {
 
   @Test
   void testFailure_badActionString() {
-    ConsoleBulkDomainAction action = createAction("bad", GSON.toJsonTree(ImmutableMap.of()));
+    ConsoleBulkDomainAction action =
+        createAction(
+            "bad", GSON.toJsonTree(ImmutableMap.of("domainList", ImmutableList.of("domain.tld"))));
     action.run();
     assertThat(response.getStatus()).isEqualTo(SC_BAD_REQUEST);
     assertThat(response.getPayload())
@@ -190,6 +193,29 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase {
     assertThat(response.getPayload()).isEqualTo("Bulk action payload must be present");
   }
 
+  @Test
+  void testFailure_listTooLarge() {
+    JsonElement payload =
+        GSON.toJsonTree(
+            ImmutableMap.of(
+                "domainList", Collections.nCopies(6, "domain.tld"), "reason", "reason"));
+    ConsoleBulkDomainAction action = createAction("DELETE", payload, fteUser, 5);
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_BAD_REQUEST);
+    assertThat(response.getPayload())
+        .isEqualTo("Cannot process more than 5 domains in a single bulk action");
+  }
+
+  @Test
+  void testFailure_emptyList() {
+    JsonElement payload =
+        GSON.toJsonTree(ImmutableMap.of("domainList", ImmutableList.of(), "reason", "reason"));
+    ConsoleBulkDomainAction action = createAction("DELETE", payload);
+    action.run();
+    assertThat(response.getStatus()).isEqualTo(SC_BAD_REQUEST);
+    assertThat(response.getPayload()).isEqualTo("Domain list cannot be empty");
+  }
+
   @Test
   void testFailure_noPermission() {
     JsonElement payload =
@@ -232,15 +258,20 @@ public class ConsoleBulkDomainActionTest extends ConsoleActionBaseTestCase {
   // }
 
   private ConsoleBulkDomainAction createAction(String action, JsonElement payload) {
-    return createAction(action, payload, fteUser);
+    return createAction(action, payload, fteUser, 500);
   }
 
   private ConsoleBulkDomainAction createAction(String action, JsonElement payload, User user) {
+    return createAction(action, payload, user, 500);
+  }
+
+  private ConsoleBulkDomainAction createAction(
+      String action, JsonElement payload, User user, int limit) {
     AuthResult authResult = AuthResult.createUser(user);
     ConsoleApiParams params = ConsoleApiParamsUtils.createFake(authResult);
     when(params.request().getMethod()).thenReturn("POST");
     response = (FakeResponse) params.response();
     return new ConsoleBulkDomainAction(
-        params, eppController, "TheRegistrar", action, Optional.ofNullable(payload));
+        params, eppController, limit, "TheRegistrar", action, Optional.ofNullable(payload));
   }
 }

core/src/test/java/google/registry/webdriver/ConsoleScreenshotTest.java

@@ -174,7 +174,9 @@ public class ConsoleScreenshotTest {
     // Script that set cursor to transparent to prevent blanking cursor flakiness when comparing
     // screenshots
     String script =
-        "document.styleSheets[0].insertRule(\"html * {caret-color: transparent !important;}\")";
+        "var style = document.createElement('style');"
+            + "style.innerHTML = 'html * {caret-color: transparent !important;}';"
+            + "document.head.appendChild(style);";
     driver.executeScript(script);
   }
 

core/src/test/java/google/registry/webdriver/README.md

@@ -12,7 +12,7 @@ for more information on using webdriver.
 2. Missing golden images
   * If you added a new test using screenshot comparison, you have to generate
     the golden image for that test in advance and copy it to
-    [goldens/](https://github.com/google/nomulus/tree/master/core/src/test/java/google/registry/webdriver/goldens)
+    [goldens/](https://github.com/google/nomulus/tree/master/core/src/test/resources/google/registry/webdriver/goldens)
     folder. There
     is an auxiliary Gradle build task to help with this, and here are some examples:
     ```shell

core/src/test/resources/google/registry/beam/rde/reducer_brda.xml

@@ -4,7 +4,6 @@
     <rde:rdeMenu>
         <rde:version>1.0</rde:version>
         <rde:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rde:objURI>
-        <rde:objURI>urn:ietf:params:xml:ns:rdeEppParams-1.0</rde:objURI>
         <rde:objURI>urn:ietf:params:xml:ns:rdeHeader-1.0</rde:objURI>
         <rde:objURI>urn:ietf:params:xml:ns:rdeRegistrar-1.0</rde:objURI>
     </rde:rdeMenu>
@@ -12,45 +11,10 @@
 <rdeDomain:domain/>
 <rdeRegistrar:registrar/>
 
-<rdeEppParams:eppParams>
-    <rdeEppParams:version>1.0</rdeEppParams:version>
-    <rdeEppParams:lang>en</rdeEppParams:lang>
-    <rdeEppParams:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rdeEppParams:objURI>
-    <rdeEppParams:objURI>urn:ietf:params:xml:ns:rdeHost-1.0</rdeEppParams:objURI>
-    <rdeEppParams:svcExtension>
-        <epp:extURI>urn:ietf:params:xml:ns:launch-1.0</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:rgp-1.0</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:secDNS-1.1</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.6</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.11</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.12</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:epp:fee-1.0</epp:extURI>
-    </rdeEppParams:svcExtension>
-    <rdeEppParams:dcp>
-        <epp:access>
-            <epp:all/>
-        </epp:access>
-        <epp:statement>
-            <epp:purpose>
-                <epp:admin/>
-                <epp:prov/>
-            </epp:purpose>
-            <epp:recipient>
-                <epp:ours/>
-                <epp:public/>
-            </epp:recipient>
-            <epp:retention>
-                <epp:stated/>
-            </epp:retention>
-        </epp:statement>
-    </rdeEppParams:dcp>
-</rdeEppParams:eppParams>
-
 <rdeHeader:header>
     <rdeHeader:tld>soy</rdeHeader:tld>
     <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
     <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1</rdeHeader:count>
-    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeEppParams-1.0">1</rdeHeader:count>
 </rdeHeader:header>
 
 </rde:contents>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata.xml

@@ -22,7 +22,7 @@
         <secDNS:maxSigLife>604800</secDNS:maxSigLife>
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_8_records.xml

@@ -21,51 +21,51 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:create>
     </extension>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_9_records.xml

@@ -21,55 +21,55 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12353</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_bad_algorithms.xml

@@ -27,19 +27,19 @@
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
@@ -51,19 +51,19 @@
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_bad_digest_types.xml

@@ -21,49 +21,49 @@
           xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>100</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>3</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_forbidden_algorithm.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <command>
+    <create>
+      <domain:create
+          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:period unit="y">2</domain:period>
+        <domain:ns>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+          <domain:hostObj>ns2.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:create>
+    </create>
+    <extension>
+      <secDNS:create
+          xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
+        <secDNS:dsData>
+          <secDNS:keyTag>12345</secDNS:keyTag>
+          <secDNS:alg>1</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
+        </secDNS:dsData>
+      </secDNS:create>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_no_maxsiglife.xml

@@ -21,9 +21,9 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:create>
     </extension>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_sha1.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <command>
+    <create>
+      <domain:create
+          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:period unit="y">2</domain:period>
+        <domain:ns>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+          <domain:hostObj>ns2.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:create>
+    </create>
+    <extension>
+      <secDNS:create
+          xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
+        <secDNS:dsData>
+          <secDNS:keyTag>12345</secDNS:keyTag>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>1</secDNS:digestType>
+          <secDNS:digest>49FD46E6C4B45C55D4AC49FD46E6C4B45C55D4AC</secDNS:digest>
+        </secDNS:dsData>
+      </secDNS:create>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_wrong_extension.xml

@@ -20,7 +20,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_info_response_dsdata.xml

@@ -34,9 +34,9 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:infData>
     </extension>

core/src/test/resources/google/registry/flows/domain/domain_info_response_dsdata_addperiod.xml

@@ -33,9 +33,9 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:infData>
       <rgp:infData xmlns:rgp="urn:ietf:params:xml:ns:rgp-1.0">

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_add_rem.xml

@@ -14,17 +14,17 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
-            <secDNS:digestType>1</secDNS:digestType>
-            <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+            <secDNS:alg>8</secDNS:alg>
+            <secDNS:digestType>2</secDNS:digestType>
+            <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>
         </secDNS:rem>
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
-            <secDNS:digestType>1</secDNS:digestType>
-            <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
+            <secDNS:alg>8</secDNS:alg>
+            <secDNS:digestType>2</secDNS:digestType>
+            <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>
         </secDNS:add>
       </secDNS:update>

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_add_rem_same.xml

@@ -14,7 +14,7 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
           </secDNS:dsData>
@@ -22,7 +22,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
           </secDNS:dsData>