Class AuthenticatedRegistrarAccessor

java.lang.Object
google.registry.request.auth.AuthenticatedRegistrarAccessor

@Immutable public class AuthenticatedRegistrarAccessor extends Object
Allows access only to Registrars the current user has access to.

A user has OWNER role on a Registrar if there exists a RegistrarPoc with that user's gaeId and the registrar as a parent.

An "admin" has in addition OWNER role on #registryAdminRegistrarId and to all non-REAL registrars (see Registrar.getType()).

An "admin" also has ADMIN role on ALL registrars.

A user is an "admin" if they are a GAE-admin, or if their email is in the "Support" G Suite group.

NOTE: to check whether the user is in the "Support" G Suite group, we need a connection to G Suite. This in turn requires we have valid JsonCredentials, which not all environments have set up. This connection will be created lazily (only if needed).

Specifically, we don't instantiate the connection if: (a) gSuiteSupportGroupEmailAddress isn't defined, or (b) the user is logged out, or (c) the user is a GAE-admin, or (d) bypassAdminCheck is true.

  • Field Details

    • bypassAdminCheck

      public static boolean bypassAdminCheck
      Bypass the "isAdmin" check making all users NOT admins.

      Currently our test server doesn't let you change the user after the test server was created. This means we'd need multiple test files to test the same actions as both a "regular" user and an admin.

      To overcome this - we add a flag that lets you dynamically choose whether a user is an admin or not by creating a fake "GAE-admin" user and then bypassing the admin check if they want to fake a "regular" user.

      The reason we don't do it the other way around (have a flag that makes anyone an admin) is that such a flag would be a security risk, especially since VisibleForTesting is unenforced (and you could set it with reflection anyway).

      Instead of having a test flag that elevates permissions (which has security concerns) we add this flag that reduces permissions.

  • Constructor Details

    • AuthenticatedRegistrarAccessor

      @Inject public AuthenticatedRegistrarAccessor(AuthResult authResult, @Config("registryAdminClientId") String registryAdminRegistrarId, @Config("gSuiteSupportGroupEmailAddress") Optional<String> gSuiteSupportGroupEmailAddress, dagger.Lazy<GroupsConnection> lazyGroupsConnection)
  • Method Details