From b6c88e3126665cbe1d55344a99f4d03f9d2096c5 Mon Sep 17 00:00:00 2001 From: Gus Brodman Date: Thu, 30 Jul 2026 14:16:57 -0400 Subject: [PATCH] Only forbid DISABLED registrars in the console PENDING registrars may just need to add contacts etc in order to be enabled, and they should be able to use the console to do so. --- .../ui/server/console/ConsoleApiAction.java | 5 +- .../console/ConsoleUsersActionTest.java | 61 +++++++++++++------ .../domains/ConsoleBulkDomainActionTest.java | 12 ---- 3 files changed, 43 insertions(+), 35 deletions(-) diff --git a/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java b/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java index df4aa264816..34589378466 100644 --- a/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java +++ b/core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java @@ -113,11 +113,10 @@ protected static void checkPermission( () -> new ConsolePermissionForbiddenException( String.format("Registrar %s does not exist", registrarId))); - if (!registrar.isLive()) { + if (registrar.getState().equals(Registrar.State.DISABLED)) { throw new ConsolePermissionForbiddenException( String.format( - "Permission forbidden because registrar %s is currently %s", - registrarId, registrar.getState())); + "Permission forbidden because registrar %s is currently DISABLED", registrarId)); } if (!user.getUserRoles().hasPermission(registrarId, permission)) { throw new ConsolePermissionForbiddenException( diff --git a/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java b/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java index 61e8deed5cc..2c70b4dbd84 100644 --- a/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java +++ b/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java @@ -15,6 +15,9 @@ package google.registry.ui.server.console; import static com.google.common.truth.Truth.assertThat; +import static google.registry.testing.DatabaseHelper.loadByKey; +import static google.registry.testing.DatabaseHelper.loadRegistrar; +import static google.registry.testing.DatabaseHelper.persistResource; import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST; import static jakarta.servlet.http.HttpServletResponse.SC_CREATED; import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN; @@ -36,6 +39,7 @@ import google.registry.model.console.RegistrarRole; import google.registry.model.console.User; import google.registry.model.console.UserRoles; +import google.registry.model.registrar.Registrar; import google.registry.persistence.VKey; import google.registry.request.auth.AuthResult; import google.registry.testing.CloudTasksHelper; @@ -126,6 +130,23 @@ void testSuccess_registrarAccess() throws IOException { "[{\"emailAddress\":\"test1@test.com\",\"role\":\"PRIMARY_CONTACT\"},{\"emailAddress\":\"test2@test.com\",\"role\":\"PRIMARY_CONTACT\"}]"); } + @Test + void testSuccess_pendingRegistrar() throws Exception { + persistResource( + loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build()); + AuthResult authResult = + AuthResult.createUser(loadByKey(VKey.create(User.class, "test1@test.com"))); + ConsoleUsersAction action = + createAction( + Optional.of(ConsoleApiParamsUtils.createFake(authResult)), + Optional.of("GET"), + Optional.empty()); + + action.run(); + assertThat(response.getStatus()).isEqualTo(SC_OK); + assertThat(response.getPayload()).contains("test1@test.com"); + } + @Test void testFailure_noPermission() throws IOException { UserRoles userRoles = @@ -205,7 +226,7 @@ void testSuccess_roleEnforcementCreate() throws IOException { @Test void testFailure_noPermissionToDeleteUser() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -248,7 +269,7 @@ void testFailure_userDoesntExist() throws IOException { @Test void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeletion() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -274,7 +295,7 @@ void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeleti @Test void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -282,7 +303,7 @@ void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() thro .setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build()) .build()); String mintedEmail = "abc.TheRegistrar@email.com"; - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress(mintedEmail) .setUserRoles( @@ -311,14 +332,14 @@ void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() thro @Test void testSuccess_removesRole() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 .asBuilder() .setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build()) .build()); - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("test4@test.com") .setUserRoles( @@ -355,7 +376,7 @@ void testSuccess_removesRole() throws IOException { @Test void testFailure_limitedTo4UsersPerRegistrar() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -395,7 +416,7 @@ void testFailure_limitedTo4UsersPerRegistrar() throws IOException { @Test void testSuccess_updatesUserRole() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -404,7 +425,7 @@ void testSuccess_updatesUserRole() throws IOException { .build()); assertThat( - DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com")) + loadByKey(VKey.create(User.class, "test2@test.com")) .getUserRoles() .getRegistrarRoles() .get("TheRegistrar")) @@ -420,7 +441,7 @@ void testSuccess_updatesUserRole() throws IOException { action.run(); assertThat(response.getStatus()).isEqualTo(SC_OK); assertThat( - DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com")) + loadByKey(VKey.create(User.class, "test2@test.com")) .getUserRoles() .getRegistrarRoles() .get("TheRegistrar")) @@ -429,7 +450,7 @@ void testSuccess_updatesUserRole() throws IOException { @Test void testFailure_noPermissionToUpdateUser() throws IOException { - User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User user1 = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser( user1 @@ -461,14 +482,14 @@ void testSuccess_appendUser() throws IOException { new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null))); action.run(); assertThat(response.getStatus()).isEqualTo(SC_OK); - User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com")); + User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com")); assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar")) .isEqualTo(RegistrarRole.TECH_CONTACT); } @Test void testFailure_appendUser_crossTenantNoPermission() throws IOException { - User callingUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com")); + User callingUser = loadByKey(VKey.create(User.class, "test1@test.com")); AuthResult authResult = AuthResult.createUser(callingUser); ConsoleUsersAction action = createAction( @@ -483,7 +504,7 @@ void testFailure_appendUser_crossTenantNoPermission() throws IOException { @Test void testSuccess_appendUser_crossTenantWithPermission() throws IOException { User callingUser = - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("multitenant@test.com") .setUserRoles( @@ -506,7 +527,7 @@ void testSuccess_appendUser_crossTenantWithPermission() throws IOException { new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null))); action.run(); assertThat(response.getStatus()).isEqualTo(SC_OK); - User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com")); + User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com")); assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar")) .isEqualTo(RegistrarRole.TECH_CONTACT); } @@ -515,7 +536,7 @@ void testSuccess_appendUser_crossTenantWithPermission() throws IOException { void testFailure_appendUser_globalAdmin() throws IOException { User user = DatabaseHelper.createAdminUser("email@email.com"); AuthResult authResult = AuthResult.createUser(user); - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("globaladmin@test.com") .setUserRoles( @@ -539,7 +560,7 @@ void testFailure_appendUser_globalAdmin() throws IOException { void testFailure_appendUser_globalRole() throws IOException { User user = DatabaseHelper.createAdminUser("email@email.com"); AuthResult authResult = AuthResult.createUser(user); - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("support@test.com") .setUserRoles( @@ -566,7 +587,7 @@ void testFailure_deleteUser_globalAdmin() throws IOException { User user = DatabaseHelper.createAdminUser("email@email.com"); AuthResult authResult = AuthResult.createUser(user); // Historically associated global admin - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("globaladmin@test.com") .setUserRoles( @@ -596,7 +617,7 @@ void testFailure_updateUser_globalAdmin() throws IOException { User user = DatabaseHelper.createAdminUser("email@email.com"); AuthResult authResult = AuthResult.createUser(user); // Historically associated global admin - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("globaladmin@test.com") .setUserRoles( @@ -626,7 +647,7 @@ void testFailure_updateUser_globalRole() throws IOException { User user = DatabaseHelper.createAdminUser("email@email.com"); AuthResult authResult = AuthResult.createUser(user); // Historically associated user with global role - DatabaseHelper.persistResource( + persistResource( new User.Builder() .setEmailAddress("support@test.com") .setUserRoles( diff --git a/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java b/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java index 4028129d1e3..e407bafc661 100644 --- a/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java +++ b/core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java @@ -251,18 +251,6 @@ void testFailure_disabledRegistrar() { assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); } - @Test - void testFailure_pendingRegistrar() { - persistResource( - loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build()); - JsonElement payload = - GSON.toJsonTree( - ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test")); - ConsoleBulkDomainAction action = createAction("DELETE", payload); - action.run(); - assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN); - } - @Test void testFailure_nonexistentRegistrar() { JsonElement payload =