Add support for changing phone numbers

service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerChangeNumberIntegrationTest.java

@@ -0,0 +1,261 @@
+/*
+ * Copyright 2013-2021 Signal Messenger, LLC
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+package org.whispersystems.textsecuregcm.storage;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.opentable.db.postgres.embedded.LiquibasePreparer;
+import com.opentable.db.postgres.junit5.EmbeddedPostgresExtension;
+import com.opentable.db.postgres.junit5.PreparedDbExtension;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
+import org.whispersystems.textsecuregcm.entities.AccountAttributes;
+import org.whispersystems.textsecuregcm.push.ClientPresenceManager;
+import org.whispersystems.textsecuregcm.redis.RedisClusterExtension;
+import org.whispersystems.textsecuregcm.securebackup.SecureBackupClient;
+import org.whispersystems.textsecuregcm.securestorage.SecureStorageClient;
+import org.whispersystems.textsecuregcm.sqs.DirectoryQueue;
+import org.whispersystems.textsecuregcm.storage.Device.DeviceCapabilities;
+import software.amazon.awssdk.services.dynamodb.model.AttributeDefinition;
+import software.amazon.awssdk.services.dynamodb.model.CreateTableRequest;
+import software.amazon.awssdk.services.dynamodb.model.GlobalSecondaryIndex;
+import software.amazon.awssdk.services.dynamodb.model.KeySchemaElement;
+import software.amazon.awssdk.services.dynamodb.model.KeyType;
+import software.amazon.awssdk.services.dynamodb.model.Projection;
+import software.amazon.awssdk.services.dynamodb.model.ProjectionType;
+import software.amazon.awssdk.services.dynamodb.model.ProvisionedThroughput;
+import software.amazon.awssdk.services.dynamodb.model.ScalarAttributeType;
+
+class AccountsManagerChangeNumberIntegrationTest {
+
+  @RegisterExtension
+  static PreparedDbExtension ACCOUNTS_POSTGRES_EXTENSION =
+      EmbeddedPostgresExtension.preparedDatabase(LiquibasePreparer.forClasspathLocation("accountsdb.xml"));
+
+  private static final String ACCOUNTS_TABLE_NAME = "accounts_test";
+  private static final String NUMBERS_TABLE_NAME = "numbers_test";
+  private static final String NEEDS_RECONCILIATION_INDEX_NAME = "needs_reconciliation_test";
+  private static final String DELETED_ACCOUNTS_LOCK_TABLE_NAME = "deleted_accounts_lock_test";
+  private static final int SCAN_PAGE_SIZE = 1;
+
+  @RegisterExtension
+  static DynamoDbExtension ACCOUNTS_DYNAMO_EXTENSION = DynamoDbExtension.builder()
+      .tableName(ACCOUNTS_TABLE_NAME)
+      .hashKey(Accounts.KEY_ACCOUNT_UUID)
+      .attributeDefinition(AttributeDefinition.builder()
+          .attributeName(Accounts.KEY_ACCOUNT_UUID)
+          .attributeType(ScalarAttributeType.B)
+          .build())
+      .build();
+
+  @RegisterExtension
+  static DynamoDbExtension DELETED_ACCOUNTS_DYNAMO_EXTENSION = DynamoDbExtension.builder()
+      .tableName("deleted_accounts_test")
+      .hashKey(DeletedAccounts.KEY_ACCOUNT_E164)
+      .attributeDefinition(AttributeDefinition.builder()
+          .attributeName(DeletedAccounts.KEY_ACCOUNT_E164)
+          .attributeType(ScalarAttributeType.S).build())
+      .attributeDefinition(AttributeDefinition.builder()
+          .attributeName(DeletedAccounts.ATTR_NEEDS_CDS_RECONCILIATION)
+          .attributeType(ScalarAttributeType.N)
+          .build())
+      .globalSecondaryIndex(GlobalSecondaryIndex.builder()
+          .indexName(NEEDS_RECONCILIATION_INDEX_NAME)
+          .keySchema(KeySchemaElement.builder().attributeName(DeletedAccounts.KEY_ACCOUNT_E164).keyType(KeyType.HASH).build(),
+              KeySchemaElement.builder().attributeName(DeletedAccounts.ATTR_NEEDS_CDS_RECONCILIATION).keyType(KeyType.RANGE).build())
+          .projection(Projection.builder().projectionType(ProjectionType.INCLUDE).nonKeyAttributes(DeletedAccounts.ATTR_ACCOUNT_UUID).build())
+          .provisionedThroughput(ProvisionedThroughput.builder().readCapacityUnits(10L).writeCapacityUnits(10L).build())
+          .build())
+      .build();
+
+  @RegisterExtension
+  static DynamoDbExtension DELETED_ACCOUNTS_LOCK_DYNAMO_EXTENSION = DynamoDbExtension.builder()
+      .tableName(DELETED_ACCOUNTS_LOCK_TABLE_NAME)
+      .hashKey(DeletedAccounts.KEY_ACCOUNT_E164)
+      .attributeDefinition(AttributeDefinition.builder()
+          .attributeName(DeletedAccounts.KEY_ACCOUNT_E164)
+          .attributeType(ScalarAttributeType.S).build())
+      .build();
+
+  @RegisterExtension
+  static RedisClusterExtension CACHE_CLUSTER_EXTENSION = RedisClusterExtension.builder().build();
+
+  private ClientPresenceManager clientPresenceManager;
+  private DeletedAccounts deletedAccounts;
+
+  private AccountsManager accountsManager;
+
+  @BeforeEach
+  void setup() throws InterruptedException {
+
+    {
+      CreateTableRequest createNumbersTableRequest = CreateTableRequest.builder()
+          .tableName(NUMBERS_TABLE_NAME)
+          .keySchema(KeySchemaElement.builder()
+              .attributeName(Accounts.ATTR_ACCOUNT_E164)
+              .keyType(KeyType.HASH)
+              .build())
+          .attributeDefinitions(AttributeDefinition.builder()
+              .attributeName(Accounts.ATTR_ACCOUNT_E164)
+              .attributeType(ScalarAttributeType.S)
+              .build())
+          .provisionedThroughput(DynamoDbExtension.DEFAULT_PROVISIONED_THROUGHPUT)
+          .build();
+
+      ACCOUNTS_DYNAMO_EXTENSION.getDynamoDbClient().createTable(createNumbersTableRequest);
+    }
+
+    final Accounts accounts = new Accounts(
+        ACCOUNTS_DYNAMO_EXTENSION.getDynamoDbClient(),
+        ACCOUNTS_DYNAMO_EXTENSION.getTableName(),
+        NUMBERS_TABLE_NAME,
+        SCAN_PAGE_SIZE);
+
+    {
+      final DynamicConfigurationManager dynamicConfigurationManager = mock(DynamicConfigurationManager.class);
+
+      DynamicConfiguration dynamicConfiguration = new DynamicConfiguration();
+      when(dynamicConfigurationManager.getConfiguration()).thenReturn(dynamicConfiguration);
+
+      deletedAccounts = new DeletedAccounts(DELETED_ACCOUNTS_DYNAMO_EXTENSION.getDynamoDbClient(),
+          DELETED_ACCOUNTS_DYNAMO_EXTENSION.getTableName(),
+          NEEDS_RECONCILIATION_INDEX_NAME);
+
+      final DeletedAccountsManager deletedAccountsManager = new DeletedAccountsManager(deletedAccounts,
+          DELETED_ACCOUNTS_LOCK_DYNAMO_EXTENSION.getLegacyDynamoClient(),
+          DELETED_ACCOUNTS_LOCK_DYNAMO_EXTENSION.getTableName());
+
+      final SecureStorageClient secureStorageClient = mock(SecureStorageClient.class);
+      when(secureStorageClient.deleteStoredData(any())).thenReturn(CompletableFuture.completedFuture(null));
+
+      final SecureBackupClient secureBackupClient = mock(SecureBackupClient.class);
+      when(secureBackupClient.deleteBackups(any())).thenReturn(CompletableFuture.completedFuture(null));
+
+      clientPresenceManager = mock(ClientPresenceManager.class);
+
+      accountsManager = new AccountsManager(
+          accounts,
+          CACHE_CLUSTER_EXTENSION.getRedisCluster(),
+          deletedAccountsManager,
+          mock(DirectoryQueue.class),
+          mock(KeysDynamoDb.class),
+          mock(MessagesManager.class),
+          mock(UsernamesManager.class),
+          mock(ProfilesManager.class),
+          mock(StoredVerificationCodeManager.class),
+          secureStorageClient,
+          secureBackupClient,
+          clientPresenceManager);
+    }
+  }
+
+  @Test
+  void testChangeNumber() throws InterruptedException {
+    final String originalNumber = "+18005551111";
+    final String secondNumber = "+18005552222";
+
+    final Account account = accountsManager.create(originalNumber, "password", null, new AccountAttributes());
+    final UUID originalUuid = account.getUuid();
+
+    accountsManager.changeNumber(account, secondNumber);
+
+    assertTrue(accountsManager.get(originalNumber).isEmpty());
+
+    assertTrue(accountsManager.get(secondNumber).isPresent());
+    assertEquals(Optional.of(originalUuid), accountsManager.get(secondNumber).map(Account::getUuid));
+
+    assertEquals(secondNumber, accountsManager.get(originalUuid).map(Account::getNumber).orElseThrow());
+
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(originalNumber));
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));
+  }
+
+  @Test
+  void testChangeNumberReturnToOriginal() throws InterruptedException {
+    final String originalNumber = "+18005551111";
+    final String secondNumber = "+18005552222";
+
+    Account account = accountsManager.create(originalNumber, "password", null, new AccountAttributes());
+    final UUID originalUuid = account.getUuid();
+
+    account = accountsManager.changeNumber(account, secondNumber);
+    accountsManager.changeNumber(account, originalNumber);
+
+    assertTrue(accountsManager.get(originalNumber).isPresent());
+    assertEquals(Optional.of(originalUuid), accountsManager.get(originalNumber).map(Account::getUuid));
+
+    assertTrue(accountsManager.get(secondNumber).isEmpty());
+
+    assertEquals(originalNumber, accountsManager.get(originalUuid).map(Account::getNumber).orElseThrow());
+
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(originalNumber));
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));
+  }
+
+  @Test
+  void testChangeNumberContested() throws InterruptedException {
+    final String originalNumber = "+18005551111";
+    final String secondNumber = "+18005552222";
+
+    final Account account = accountsManager.create(originalNumber, "password", null, new AccountAttributes());
+    final UUID originalUuid = account.getUuid();
+
+    final Account existingAccount = accountsManager.create(secondNumber, "password", null, new AccountAttributes());
+    final UUID existingAccountUuid = existingAccount.getUuid();
+
+    accountsManager.update(existingAccount, a -> a.addDevice(new Device(Device.MASTER_ID, "test", "token", "salt", null, null, null, true, 1, null, 0, 0, null, 0, new DeviceCapabilities())));
+
+    accountsManager.changeNumber(account, secondNumber);
+
+    assertTrue(accountsManager.get(originalNumber).isEmpty());
+
+    assertTrue(accountsManager.get(secondNumber).isPresent());
+    assertEquals(Optional.of(originalUuid), accountsManager.get(secondNumber).map(Account::getUuid));
+
+    assertEquals(secondNumber, accountsManager.get(originalUuid).map(Account::getNumber).orElseThrow());
+
+    verify(clientPresenceManager).displacePresence(existingAccountUuid, Device.MASTER_ID);
+
+    assertEquals(Optional.of(existingAccountUuid), deletedAccounts.findUuid(originalNumber));
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));
+  }
+
+  @Test
+  void testChangeNumberChaining() throws InterruptedException {
+    final String originalNumber = "+18005551111";
+    final String secondNumber = "+18005552222";
+
+    final Account account = accountsManager.create(originalNumber, "password", null, new AccountAttributes());
+    final UUID originalUuid = account.getUuid();
+
+    final Account existingAccount = accountsManager.create(secondNumber, "password", null, new AccountAttributes());
+    final UUID existingAccountUuid = existingAccount.getUuid();
+
+    accountsManager.changeNumber(account, secondNumber);
+
+    final Account reRegisteredAccount = accountsManager.create(originalNumber, "password", null, new AccountAttributes());
+
+    assertEquals(existingAccountUuid, reRegisteredAccount.getUuid());
+
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(originalNumber));
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));
+
+    accountsManager.changeNumber(reRegisteredAccount, secondNumber);
+
+    assertEquals(Optional.of(originalUuid), deletedAccounts.findUuid(originalNumber));
+    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));
+  }
+}

service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsTest.java

@@ -7,6 +7,7 @@ package org.whispersystems.textsecuregcm.storage;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -24,6 +25,11 @@ import java.util.Optional;
 import java.util.Random;
 import java.util.Set;
 import java.util.UUID;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.LinkedBlockingDeque;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import org.assertj.core.api.AssertionsForClassTypes;
 import org.jdbi.v3.core.transaction.TransactionException;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Disabled;
@@ -42,6 +48,7 @@ import software.amazon.awssdk.services.dynamodb.model.KeySchemaElement;
 import software.amazon.awssdk.services.dynamodb.model.KeyType;
 import software.amazon.awssdk.services.dynamodb.model.ScalarAttributeType;
 import software.amazon.awssdk.services.dynamodb.model.TransactWriteItemsRequest;
+import software.amazon.awssdk.services.dynamodb.model.TransactionCanceledException;
 import software.amazon.awssdk.services.dynamodb.model.TransactionConflictException;
 import software.amazon.awssdk.services.dynamodb.model.UpdateItemRequest;
 
@@ -412,6 +419,52 @@ class AccountsTest {
     verifyStoredState("+14151112222", account.getUuid(), account, false);
   }
 
+  @Test
+  public void testChangeNumber() {
+    final String originalNumber = "+14151112222";
+    final String targetNumber = "+14151113333";
+
+    final Device device = generateDevice(1);
+    final Account account = generateAccount(originalNumber, UUID.randomUUID(), Collections.singleton(device));
+
+    accounts.create(account);
+
+    {
+      final Optional<Account> retrieved = accounts.get(originalNumber);
+      assertThat(retrieved).isPresent();
+
+      verifyStoredState(originalNumber, account.getUuid(), retrieved.get(), account);
+    }
+
+    accounts.changeNumber(account, targetNumber);
+
+    assertThat(accounts.get(originalNumber)).isEmpty();
+
+    {
+      final Optional<Account> retrieved = accounts.get(targetNumber);
+      assertThat(retrieved).isPresent();
+
+      verifyStoredState(targetNumber, account.getUuid(), retrieved.get(), account);
+    }
+  }
+
+  @Test
+  public void testChangeNumberConflict() {
+    final String originalNumber = "+14151112222";
+    final String targetNumber = "+14151113333";
+
+    final Device existingDevice = generateDevice(1);
+    final Account existingAccount = generateAccount(targetNumber, UUID.randomUUID(), Collections.singleton(existingDevice));
+
+    final Device device = generateDevice(1);
+    final Account account = generateAccount(originalNumber, UUID.randomUUID(), Collections.singleton(device));
+
+    accounts.create(account);
+    accounts.create(existingAccount);
+
+    assertThrows(TransactionCanceledException.class, () -> accounts.changeNumber(account, targetNumber));
+  }
+
   private Device generateDevice(long id) {
     Random       random       = new Random(System.currentTimeMillis());
     SignedPreKey signedPreKey = new SignedPreKey(random.nextInt(), "testPublicKey-" + random.nextInt(), "testSignature-" + random.nextInt());

service/src/test/java/org/whispersystems/textsecuregcm/storage/DeletedAccountsManagerTest.java

@@ -26,6 +26,7 @@ import java.util.UUID;
 
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 class DeletedAccountsManagerTest {
 
@@ -85,16 +86,16 @@ class DeletedAccountsManagerTest {
   }
 
   @Test
-  void testLockAndTakeWithException() throws InterruptedException {
+  void testLockAndTakeWithException() {
     final UUID uuid = UUID.randomUUID();
     final String e164 = "+18005551234";
 
     deletedAccounts.put(uuid, e164, true);
 
-    deletedAccountsManager.lockAndTake(e164, maybeUuid -> {
+    assertThrows(RuntimeException.class, () -> deletedAccountsManager.lockAndTake(e164, maybeUuid -> {
       assertEquals(Optional.of(uuid), maybeUuid);
       throw new RuntimeException("OH NO");
-    });
+    }));
 
     assertEquals(Optional.of(uuid), deletedAccounts.findUuid(e164));
   }

service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java

@@ -66,6 +66,7 @@ import org.whispersystems.textsecuregcm.controllers.RateLimitExceededException;
 import org.whispersystems.textsecuregcm.entities.AccountAttributes;
 import org.whispersystems.textsecuregcm.entities.AccountCreationResult;
 import org.whispersystems.textsecuregcm.entities.ApnRegistrationId;
+import org.whispersystems.textsecuregcm.entities.ChangePhoneNumberRequest;
 import org.whispersystems.textsecuregcm.entities.GcmRegistrationId;
 import org.whispersystems.textsecuregcm.entities.RegistrationLock;
 import org.whispersystems.textsecuregcm.entities.RegistrationLockFailure;
@@ -105,6 +106,7 @@ class AccountControllerTest {
   private static final String SENDER_TRANSFER    = "+14151111112";
 
   private static final UUID   SENDER_REG_LOCK_UUID = UUID.randomUUID();
+  private static final UUID   SENDER_TRANSFER_UUID = UUID.randomUUID();
 
   private static final String ABUSIVE_HOST             = "192.168.1.1";
   private static final String RESTRICTED_HOST          = "192.168.1.2";
@@ -200,6 +202,11 @@ class AccountControllerTest {
     when(senderRegLockAccount.getRegistrationLock()).thenReturn(new StoredRegistrationLock(Optional.of(registrationLockCredentials.getHashedAuthenticationToken()), Optional.of(registrationLockCredentials.getSalt()), System.currentTimeMillis()));
     when(senderRegLockAccount.getLastSeen()).thenReturn(System.currentTimeMillis());
     when(senderRegLockAccount.getUuid()).thenReturn(SENDER_REG_LOCK_UUID);
+    when(senderRegLockAccount.getNumber()).thenReturn(SENDER_REG_LOCK);
+
+    when(senderTransfer.getRegistrationLock()).thenReturn(new StoredRegistrationLock(Optional.empty(), Optional.empty(), System.currentTimeMillis()));
+    when(senderTransfer.getUuid()).thenReturn(SENDER_TRANSFER_UUID);
+    when(senderTransfer.getNumber()).thenReturn(SENDER_TRANSFER);
 
     when(pendingAccountsManager.getCodeForNumber(SENDER)).thenReturn(Optional.of(new StoredVerificationCode("1234", System.currentTimeMillis(), "1234-push", null)));
     when(pendingAccountsManager.getCodeForNumber(SENDER_OLD)).thenReturn(Optional.empty());
@@ -1124,6 +1131,203 @@ class AccountControllerTest {
     assertThat(response.getStatus()).isEqualTo(200);
   }
 
+  @Test
+  void testChangePhoneNumber() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(AuthHelper.VALID_ACCOUNT, number);
+  }
+
+  @Test
+  void testChangePhoneNumberSameNumber() throws InterruptedException {
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(AuthHelper.VALID_NUMBER, "567890", null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberNoPendingCode() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.empty());
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(403);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberIncorrectCode() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code + "-incorrect", null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(403);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockNotRequired() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(false);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredNotProvided() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, null),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(423);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredIncorrect() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+    final String reglock = "setec-astronomy";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+    when(existingRegistrationLock.verify(anyString())).thenReturn(false);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, reglock),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(423);
+    verify(accountsManager, never()).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccountReglockRequiredCorrect() throws InterruptedException {
+    final String number = "+18005559876";
+    final String code = "987654";
+    final String reglock = "setec-astronomy";
+
+    when(pendingAccountsManager.getCodeForNumber(number)).thenReturn(Optional.of(
+        new StoredVerificationCode(code, System.currentTimeMillis(), "push", null)));
+
+    final StoredRegistrationLock existingRegistrationLock = mock(StoredRegistrationLock.class);
+    when(existingRegistrationLock.requiresClientRegistrationLock()).thenReturn(true);
+    when(existingRegistrationLock.verify(reglock)).thenReturn(true);
+
+    final Account existingAccount = mock(Account.class);
+    when(existingAccount.getNumber()).thenReturn(number);
+    when(existingAccount.getUuid()).thenReturn(UUID.randomUUID());
+    when(existingAccount.getRegistrationLock()).thenReturn(existingRegistrationLock);
+
+    when(accountsManager.get(number)).thenReturn(Optional.of(existingAccount));
+
+    final Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/number")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.entity(new ChangePhoneNumberRequest(number, code, reglock),
+                MediaType.APPLICATION_JSON_TYPE));
+
+    assertThat(response.getStatus()).isEqualTo(204);
+    verify(accountsManager).changeNumber(eq(AuthHelper.VALID_ACCOUNT), any());
+  }
+
   @Test
   void testSetRegistrationLock() {
     Response response =

service/src/test/java/org/whispersystems/textsecuregcm/tests/storage/AccountsManagerTest.java

@@ -7,6 +7,7 @@ package org.whispersystems.textsecuregcm.tests.storage;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.argThat;
@@ -27,7 +28,9 @@ import io.lettuce.core.cluster.api.sync.RedisAdvancedClusterCommands;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
 import java.util.function.Consumer;
+import java.util.function.Supplier;
 import java.util.stream.Stream;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -36,7 +39,6 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.stubbing.Answer;
-import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
 import org.whispersystems.textsecuregcm.entities.AccountAttributes;
 import org.whispersystems.textsecuregcm.entities.SignedPreKey;
 import org.whispersystems.textsecuregcm.push.ClientPresenceManager;
@@ -50,7 +52,6 @@ import org.whispersystems.textsecuregcm.storage.ContestedOptimisticLockException
 import org.whispersystems.textsecuregcm.storage.DeletedAccountsManager;
 import org.whispersystems.textsecuregcm.storage.Device;
 import org.whispersystems.textsecuregcm.storage.Device.DeviceCapabilities;
-import org.whispersystems.textsecuregcm.storage.DynamicConfigurationManager;
 import org.whispersystems.textsecuregcm.storage.KeysDynamoDb;
 import org.whispersystems.textsecuregcm.storage.MessagesManager;
 import org.whispersystems.textsecuregcm.storage.ProfilesManager;
@@ -63,7 +64,6 @@ class AccountsManagerTest {
   private Accounts accounts;
   private DeletedAccountsManager deletedAccountsManager;
   private DirectoryQueue directoryQueue;
-  private DynamicConfigurationManager dynamicConfigurationManager;
   private KeysDynamoDb keys;
   private MessagesManager messagesManager;
   private ProfilesManager profilesManager;
@@ -84,7 +84,6 @@ class AccountsManagerTest {
     accounts = mock(Accounts.class);
     deletedAccountsManager = mock(DeletedAccountsManager.class);
     directoryQueue = mock(DirectoryQueue.class);
-    dynamicConfigurationManager = mock(DynamicConfigurationManager.class);
     keys = mock(KeysDynamoDb.class);
     messagesManager = mock(MessagesManager.class);
     profilesManager = mock(ProfilesManager.class);
@@ -92,8 +91,14 @@ class AccountsManagerTest {
     //noinspection unchecked
     commands = mock(RedisAdvancedClusterCommands.class);
 
-    final DynamicConfiguration dynamicConfiguration = new DynamicConfiguration();
-    when(dynamicConfigurationManager.getConfiguration()).thenReturn(dynamicConfiguration);
+    doAnswer((Answer<Void>) invocation -> {
+      final Account account = invocation.getArgument(0, Account.class);
+      final String number = invocation.getArgument(1, String.class);
+
+      account.setNumber(number);
+
+      return null;
+    }).when(accounts).changeNumber(any(), anyString());
 
     doAnswer(invocation -> {
       //noinspection unchecked
@@ -101,6 +106,12 @@ class AccountsManagerTest {
       return null;
     }).when(deletedAccountsManager).lockAndTake(anyString(), any());
 
+    final SecureStorageClient storageClient = mock(SecureStorageClient.class);
+    when(storageClient.deleteStoredData(any())).thenReturn(CompletableFuture.completedFuture(null));
+
+    final SecureBackupClient backupClient = mock(SecureBackupClient.class);
+    when(backupClient.deleteBackups(any())).thenReturn(CompletableFuture.completedFuture(null));
+
     accountsManager = new AccountsManager(
         accounts,
         RedisClusterHelper.buildMockRedisCluster(commands),
@@ -111,10 +122,9 @@ class AccountsManagerTest {
         mock(UsernamesManager.class),
         profilesManager,
         mock(StoredVerificationCodeManager.class),
-        mock(SecureStorageClient.class),
-        mock(SecureBackupClient.class),
-        mock(ClientPresenceManager.class)
-    );
+        storageClient,
+        backupClient,
+        mock(ClientPresenceManager.class));
   }
 
   @Test
@@ -159,7 +169,6 @@ class AccountsManagerTest {
 
   @Test
   void testGetAccountByNumberNotInCache() {
-    final boolean dynamoEnabled = true;
     UUID uuid = UUID.randomUUID();
     Account account = new Account("+14152222222", uuid, new HashSet<>(), new byte[16]);
 
@@ -182,7 +191,6 @@ class AccountsManagerTest {
 
   @Test
   void testGetAccountByUuidNotInCache() {
-    final boolean dynamoEnabled = true;
     UUID uuid = UUID.randomUUID();
     Account account = new Account("+14152222222", uuid, new HashSet<>(), new byte[16]);
 
@@ -458,4 +466,66 @@ class AccountsManagerTest {
         Arguments.of(false, 2, 1)
     );
   }
+
+  @Test
+  void testChangePhoneNumber() throws InterruptedException {
+    doAnswer(invocation -> invocation.getArgument(2, Supplier.class).get())
+        .when(deletedAccountsManager).lockAndPut(anyString(), anyString(), any());
+
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID uuid = UUID.randomUUID();
+
+    Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, targetNumber);
+
+    assertEquals(targetNumber, account.getNumber());
+
+    verify(directoryQueue).changePhoneNumber(argThat(a -> a.getUuid().equals(uuid)), eq(originalNumber), eq(targetNumber));
+  }
+
+  @Test
+  void testChangePhoneNumberSameNumber() throws InterruptedException {
+    final String number = "+14152222222";
+
+    Account account = new Account(number, UUID.randomUUID(), new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, number);
+
+    assertEquals(number, account.getNumber());
+    verify(deletedAccountsManager, never()).lockAndPut(anyString(), anyString(), any());
+    verify(directoryQueue, never()).changePhoneNumber(any(), any(), any());
+  }
+
+  @Test
+  void testChangePhoneNumberExistingAccount() throws InterruptedException {
+    doAnswer(invocation -> invocation.getArgument(2, Supplier.class).get())
+        .when(deletedAccountsManager).lockAndPut(anyString(), anyString(), any());
+
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID existingAccountUuid = UUID.randomUUID();
+    final UUID uuid = UUID.randomUUID();
+
+    final Account existingAccount = new Account(targetNumber, existingAccountUuid, new HashSet<>(), new byte[16]);
+    when(accounts.get(targetNumber)).thenReturn(Optional.of(existingAccount));
+
+    Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+    account = accountsManager.changeNumber(account, targetNumber);
+
+    assertEquals(targetNumber, account.getNumber());
+
+    verify(directoryQueue).changePhoneNumber(argThat(a -> a.getUuid().equals(uuid)), eq(originalNumber), eq(targetNumber));
+    verify(directoryQueue, never()).deleteAccount(any());
+  }
+
+  @Test
+  void testChangePhoneNumberViaUpdate() {
+    final String originalNumber = "+14152222222";
+    final String targetNumber = "+14153333333";
+    final UUID uuid = UUID.randomUUID();
+
+    final Account account = new Account(originalNumber, uuid, new HashSet<>(), new byte[16]);
+
+    assertThrows(AssertionError.class, () -> accountsManager.update(account, a -> a.setNumber(targetNumber)));
+  }
 }