Skip to content

Only forbid DISABLED registrars in the console #3188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gbrodman merged 1 commit into from
Jul 30, 2026
+43 −35
Merged

Only forbid DISABLED registrars in the console #3188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions core/src/main/java/google/registry/ui/server/console/ConsoleApiAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,11 +113,10 @@ protected static void checkPermission(
() ->
new ConsolePermissionForbiddenException(
String.format("Registrar %s does not exist", registrarId)));
if (!registrar.isLive()) {
if (registrar.getState().equals(Registrar.State.DISABLED)) {
throw new ConsolePermissionForbiddenException(
String.format(
"Permission forbidden because registrar %s is currently %s",
registrarId, registrar.getState()));
"Permission forbidden because registrar %s is currently DISABLED", registrarId));
}
if (!user.getUserRoles().hasPermission(registrarId, permission)) {
throw new ConsolePermissionForbiddenException(
Expand Down
61 changes: 41 additions & 20 deletions core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@
package google.registry.ui.server.console;

import static com.google.common.truth.Truth.assertThat;
import static google.registry.testing.DatabaseHelper.loadByKey;
import static google.registry.testing.DatabaseHelper.loadRegistrar;
import static google.registry.testing.DatabaseHelper.persistResource;
import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
import static jakarta.servlet.http.HttpServletResponse.SC_CREATED;
import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
Expand All @@ -36,6 +39,7 @@
import google.registry.model.console.RegistrarRole;
import google.registry.model.console.User;
import google.registry.model.console.UserRoles;
import google.registry.model.registrar.Registrar;
import google.registry.persistence.VKey;
import google.registry.request.auth.AuthResult;
import google.registry.testing.CloudTasksHelper;
Expand Down Expand Up @@ -126,6 +130,23 @@ void testSuccess_registrarAccess() throws IOException {
"[{\"emailAddress\":\"test1@test.com\",\"role\":\"PRIMARY_CONTACT\"},{\"emailAddress\":\"test2@test.com\",\"role\":\"PRIMARY_CONTACT\"}]");
}

@Test
void testSuccess_pendingRegistrar() throws Exception {
persistResource(
loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build());
AuthResult authResult =
AuthResult.createUser(loadByKey(VKey.create(User.class, "test1@test.com")));
ConsoleUsersAction action =
createAction(
Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
Optional.of("GET"),
Optional.empty());

action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
assertThat(response.getPayload()).contains("test1@test.com");
}

@Test
void testFailure_noPermission() throws IOException {
UserRoles userRoles =
Expand Down Expand Up @@ -205,7 +226,7 @@ void testSuccess_roleEnforcementCreate() throws IOException {

@Test
void testFailure_noPermissionToDeleteUser() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
Expand Down Expand Up @@ -248,7 +269,7 @@ void testFailure_userDoesntExist() throws IOException {
@Test
void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeletion()
throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
Expand All @@ -274,15 +295,15 @@ void testSuccess_deletesUser_nonConsoleMintedAddress_skipsWorkspaceAccountDeleti

@Test
void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
.asBuilder()
.setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build())
.build());
String mintedEmail = "abc.TheRegistrar@email.com";
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress(mintedEmail)
.setUserRoles(
Expand Down Expand Up @@ -311,14 +332,14 @@ void testSuccess_deletesUser_consoleMintedAddress_deletesWorkspaceAccount() thro

@Test
void testSuccess_removesRole() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
.asBuilder()
.setUserRoles(user1.getUserRoles().asBuilder().setIsAdmin(true).build())
.build());
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("test4@test.com")
.setUserRoles(
Expand Down Expand Up @@ -355,7 +376,7 @@ void testSuccess_removesRole() throws IOException {

@Test
void testFailure_limitedTo4UsersPerRegistrar() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
Expand Down Expand Up @@ -395,7 +416,7 @@ void testFailure_limitedTo4UsersPerRegistrar() throws IOException {

@Test
void testSuccess_updatesUserRole() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
Expand All @@ -404,7 +425,7 @@ void testSuccess_updatesUserRole() throws IOException {
.build());

assertThat(
DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com"))
loadByKey(VKey.create(User.class, "test2@test.com"))
.getUserRoles()
.getRegistrarRoles()
.get("TheRegistrar"))
Expand All @@ -420,7 +441,7 @@ void testSuccess_updatesUserRole() throws IOException {
action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
assertThat(
DatabaseHelper.loadByKey(VKey.create(User.class, "test2@test.com"))
loadByKey(VKey.create(User.class, "test2@test.com"))
.getUserRoles()
.getRegistrarRoles()
.get("TheRegistrar"))
Expand All @@ -429,7 +450,7 @@ void testSuccess_updatesUserRole() throws IOException {

@Test
void testFailure_noPermissionToUpdateUser() throws IOException {
User user1 = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User user1 = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult =
AuthResult.createUser(
user1
Expand Down Expand Up @@ -461,14 +482,14 @@ void testSuccess_appendUser() throws IOException {
new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com"));
User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com"));
assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar"))
.isEqualTo(RegistrarRole.TECH_CONTACT);
}

@Test
void testFailure_appendUser_crossTenantNoPermission() throws IOException {
User callingUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test1@test.com"));
User callingUser = loadByKey(VKey.create(User.class, "test1@test.com"));
AuthResult authResult = AuthResult.createUser(callingUser);
ConsoleUsersAction action =
createAction(
Expand All @@ -483,7 +504,7 @@ void testFailure_appendUser_crossTenantNoPermission() throws IOException {
@Test
void testSuccess_appendUser_crossTenantWithPermission() throws IOException {
User callingUser =
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("multitenant@test.com")
.setUserRoles(
Expand All @@ -506,7 +527,7 @@ void testSuccess_appendUser_crossTenantWithPermission() throws IOException {
new UserData("test3@test.com", null, RegistrarRole.TECH_CONTACT.name(), null)));
action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
User appendedUser = DatabaseHelper.loadByKey(VKey.create(User.class, "test3@test.com"));
User appendedUser = loadByKey(VKey.create(User.class, "test3@test.com"));
assertThat(appendedUser.getUserRoles().getRegistrarRoles().get("TheRegistrar"))
.isEqualTo(RegistrarRole.TECH_CONTACT);
}
Expand All @@ -515,7 +536,7 @@ void testSuccess_appendUser_crossTenantWithPermission() throws IOException {
void testFailure_appendUser_globalAdmin() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user);
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("globaladmin@test.com")
.setUserRoles(
Expand All @@ -539,7 +560,7 @@ void testFailure_appendUser_globalAdmin() throws IOException {
void testFailure_appendUser_globalRole() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user);
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("support@test.com")
.setUserRoles(
Expand All @@ -566,7 +587,7 @@ void testFailure_deleteUser_globalAdmin() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user);
// Historically associated global admin
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("globaladmin@test.com")
.setUserRoles(
Expand Down Expand Up @@ -596,7 +617,7 @@ void testFailure_updateUser_globalAdmin() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user);
// Historically associated global admin
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("globaladmin@test.com")
.setUserRoles(
Expand Down Expand Up @@ -626,7 +647,7 @@ void testFailure_updateUser_globalRole() throws IOException {
User user = DatabaseHelper.createAdminUser("email@email.com");
AuthResult authResult = AuthResult.createUser(user);
// Historically associated user with global role
DatabaseHelper.persistResource(
persistResource(
new User.Builder()
.setEmailAddress("support@test.com")
.setUserRoles(
Expand Down
12 changes: 0 additions & 12 deletions .../src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,18 +251,6 @@ void testFailure_disabledRegistrar() {
assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
}

@Test
void testFailure_pendingRegistrar() {
persistResource(
loadRegistrar("TheRegistrar").asBuilder().setState(Registrar.State.PENDING).build());
JsonElement payload =
GSON.toJsonTree(
ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test"));
ConsoleBulkDomainAction action = createAction("DELETE", payload);
action.run();
assertThat(response.getStatus()).isEqualTo(SC_FORBIDDEN);
}

@Test
void testFailure_nonexistentRegistrar() {
JsonElement payload =
Expand Down
Loading