@gusnips/one-click-dns 0.1.0 → 0.1.1

package/README.md

@@ -62,7 +62,16 @@ When the write fails, it throws a `DnsWriteError` with a `code`. Word each code
 | `conflict`          | The name already has another record (`params.type`). They decide what to do with it. |
 | `unavailable`       | The host did not answer. Try again.                                                  |
 
-Cloudflare is the only writer today.
+Four hosts have a writer today. What the person pastes is different for each. Every test uses a fake network, so none of them has run against a real account here:
+
+| Writer         | `token` is              | What it needs                                                           | How far it is checked                                              |
+| -------------- | ----------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| `cloudflare`   | An API token            | `Zone:Read` and `DNS:Edit`                                              | Lifted from featury's live help-center code                        |
+| `porkbun`      | `apikey:secretapikey`   | "API access" turned on for the domain in Porkbun (it is off by default) | Written from the host's API spec. Never run against a real account |
+| `digitalocean` | A personal access token | `domain:read` and `domain:create`, or full access                       | Written from the host's API spec. Never run against a real account |
+| `name-com`     | `username:apitoken`     | API access turned on in Account Settings, Security                      | Written from the host's docs. Never run against a real account     |
+
+`writers` maps a host id to its writer, so `writers[host]` is `undefined` for a host with no writer.
 
 ## One-click links (Domain Connect)
 

package/dist/bounded-fetch-nozW2egX.d.cts

@@ -0,0 +1,5 @@
+/** What the package needs from `fetch`: a function from a URL and options to a response. The
+ *  global `fetch` is one, and so is a test's fake, with no cast. */
+type FetchFn = (url: string, init: RequestInit) => Promise<Response>;
+
+export type { FetchFn as F };

package/dist/bounded-fetch-nozW2egX.d.ts

@@ -0,0 +1,5 @@
+/** What the package needs from `fetch`: a function from a URL and options to a response. The
+ *  global `fetch` is one, and so is a test's fake, with no cast. */
+type FetchFn = (url: string, init: RequestInit) => Promise<Response>;
+
+export type { FetchFn as F };

package/dist/chunk-56ZUD4EQ.js

@@ -0,0 +1,525 @@
+import {
+  normalizeDnsName
+} from "./chunk-P2O7INDB.js";
+
+// src/bounded-fetch.ts
+import { readBounded } from "@gusnips/server";
+async function fetchBounded(doFetch, url, init, limits) {
+  try {
+    const res = await doFetch(url, {
+      ...init,
+      redirect: "manual",
+      signal: AbortSignal.timeout(limits.timeoutMs)
+    });
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      await res.body?.cancel().catch(() => void 0);
+      return { status: res.status || 302, text: "" };
+    }
+    const { bytes, truncated } = await readBounded(res.body, limits.maxBytes);
+    if (truncated) return null;
+    return { status: res.status, text: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+// src/guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/writers/types.ts
+var DnsWriteError = class extends Error {
+  constructor(code, params = {}) {
+    super(MESSAGES[code](params));
+    this.code = code;
+    this.params = params;
+    this.name = "DnsWriteError";
+  }
+  code;
+  params;
+};
+var MESSAGES = {
+  token_invalid: () => "The DNS host didn't accept that token",
+  zone_read_missing: () => "That token can't read your domains",
+  dns_edit_missing: () => "That token can't change DNS records",
+  zone_not_found: (p) => `No zone holds ${p.hostname ?? "that name"}`,
+  conflict: (p) => `${p.hostname ?? "That name"} already has a record${p.type ? ` (type ${p.type})` : ""}`,
+  unavailable: () => "Couldn't reach the DNS host"
+};
+
+// src/writers/policy.ts
+function zoneCandidates(hostname) {
+  const labels = hostname.split(".");
+  const names = [];
+  for (let start = 0; start < labels.length - 1; start++) names.push(labels.slice(start).join("."));
+  return names;
+}
+var unquoted = (content) => content.replace(/"\s+"/g, "").replace(/^"|"$/g, "");
+var sameValue = (record, existing) => record.type === "CNAME" ? normalizeDnsName(existing.content) === normalizeDnsName(record.value) : unquoted(existing.content) === record.value;
+var isSpf = (text) => /^v=spf1(?:\s|$)/i.test(unquoted(text).trim());
+function blocks(record, existing) {
+  if (record.type === "CNAME" || existing.type === "CNAME") return true;
+  return existing.type === "TXT" && isSpf(record.value) && isSpf(existing.content);
+}
+function decide(record, existing, hostname) {
+  const ours = existing.find((r) => r.type === record.type && sameValue(record, r));
+  if (ours) {
+    if (record.type === "CNAME" && ours.proxied === true) return { kind: "unproxy", id: ours.id };
+    return { kind: "unchanged" };
+  }
+  const blocker = existing.find((r) => blocks(record, r));
+  if (blocker) throw new DnsWriteError("conflict", { hostname, type: blocker.type });
+  return { kind: "create" };
+}
+
+// src/writers/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TIMEOUT_MS = 1e4;
+var MAX_BODY_BYTES = 256 * 1024;
+var TOKEN_CODES = /* @__PURE__ */ new Set([1e3, 6003, 6111, 1e4]);
+var CONFLICT_CODES = /* @__PURE__ */ new Set([81053, 81054, 81057]);
+var ID = /^[A-Za-z0-9]{1,64}$/;
+var RECORD_TYPE = /^[A-Z0-9]{1,12}$/;
+function readEnvelope(json) {
+  if (!isObject(json) || typeof json.success !== "boolean") return null;
+  const codes = [];
+  if (Array.isArray(json.errors)) {
+    for (const error of json.errors) {
+      if (!isObject(error)) return null;
+      if (typeof error.code === "number") codes.push(error.code);
+      if (Array.isArray(error.error_chain)) {
+        for (const link of error.error_chain)
+          if (isObject(link) && typeof link.code === "number") codes.push(link.code);
+      }
+    }
+  }
+  return { success: json.success, codes, result: json.result };
+}
+async function call(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API}${path}`,
+    {
+      method: send?.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS, maxBytes: MAX_BODY_BYTES }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: readEnvelope(json) };
+}
+function refusal(answer, stage, subject) {
+  const codes = answer.body?.codes ?? [];
+  const refusedToken = answer.status === 401 || codes.some((c) => TOKEN_CODES.has(c));
+  if (stage === "zones" && refusedToken) return new DnsWriteError("token_invalid");
+  if (codes.some((c) => CONFLICT_CODES.has(c)))
+    return new DnsWriteError("conflict", { ...subject });
+  if (answer.status === 403 || refusedToken) {
+    if (stage === "zones") return new DnsWriteError("zone_read_missing");
+    return new DnsWriteError("dns_edit_missing");
+  }
+  return new DnsWriteError("unavailable");
+}
+function resultOf(answer, stage, subject) {
+  const ok = answer.status >= 200 && answer.status < 300 && answer.body?.success === true;
+  if (!ok) throw refusal(answer, stage, subject);
+  return answer.body?.result;
+}
+function zonesOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string")
+      throw new DnsWriteError("unavailable");
+    if (!ID.test(row.id)) throw new DnsWriteError("unavailable");
+    return { id: row.id, name: row.name };
+  });
+}
+function recordsOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID.test(row.id) || !RECORD_TYPE.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return {
+      id: row.id,
+      type: row.type,
+      content: row.content,
+      proxied: typeof row.proxied === "boolean" ? row.proxied : void 0
+    };
+  });
+}
+var cloudflare = {
+  host: "cloudflare",
+  /** Add the record (DNS only) to the Cloudflare zone that holds its name. An identical record
+   *  is left as it is; the same CNAME behind the proxy gets the proxy turned off. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const subject = { hostname, type: record.type };
+    let zoneId;
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: candidate });
+      const zones = zonesOf(
+        resultOf(await call(doFetch, token, `/zones?${query}`), "zones", subject)
+      );
+      zoneId = zones.find((z) => normalizeDnsName(z.name) === candidate)?.id;
+      if (zoneId) break;
+    }
+    if (!zoneId) throw new DnsWriteError("zone_not_found", { hostname });
+    const existing = recordsOf(
+      resultOf(
+        await call(
+          doFetch,
+          token,
+          `/zones/${zoneId}/dns_records?${new URLSearchParams({ name: hostname })}`
+        ),
+        "records",
+        subject
+      )
+    );
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    if (decision.kind === "unproxy") {
+      resultOf(
+        await call(doFetch, token, `/zones/${zoneId}/dns_records/${decision.id}`, {
+          method: "PATCH",
+          body: { proxied: false }
+        }),
+        "records",
+        subject
+      );
+      return "unproxied";
+    }
+    resultOf(
+      await call(doFetch, token, `/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        body: {
+          type: record.type,
+          name: hostname,
+          content: record.value,
+          // A proxied record hides the CNAME our checker reads.
+          ...record.type === "CNAME" ? { proxied: false } : {},
+          // 1 is Cloudflare's "automatic".
+          ttl: 1,
+          ...comment ? { comment } : {}
+        }
+      }),
+      "records",
+      subject
+    );
+    return "created";
+  }
+};
+
+// src/writers/digitalocean.ts
+var API2 = "https://api.digitalocean.com/v2";
+var TIMEOUT_MS2 = 1e4;
+var MAX_BODY_BYTES2 = 512 * 1024;
+var RECORD_TYPE2 = /^[A-Z0-9]{1,12}$/;
+async function call2(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API2}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BODY_BYTES2 }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: isObject(json) ? json : null };
+}
+function refusal2(answer, stage, hostname) {
+  if (answer.status === 401) return new DnsWriteError("token_invalid");
+  if (answer.status === 403)
+    return new DnsWriteError(stage === "reading" ? "zone_read_missing" : "dns_edit_missing");
+  if (answer.status === 422 && stage === "writing")
+    return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function recordsOf2(body) {
+  const rows = body?.domain_records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  return rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "number" || typeof row.type !== "string" || typeof row.data !== "string" || !RECORD_TYPE2.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: String(row.id), type: row.type, content: row.data };
+  });
+}
+var digitalocean = {
+  host: "digitalocean",
+  /** Add the record to the DigitalOcean domain that holds its name. An identical record is left
+   *  as it is. DigitalOcean has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: hostname, per_page: "200" });
+      const answer = await call2(
+        doFetch,
+        token,
+        `/domains/${encodeURIComponent(candidate)}/records?${query}`
+      );
+      if (answer.status === 200) {
+        zone = candidate;
+        existing = recordsOf2(answer.body);
+        break;
+      }
+      if (answer.status !== 404) throw refusal2(answer, "reading", hostname);
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const name = hostname === zone ? "@" : hostname.slice(0, -(zone.length + 1));
+    const created = await call2(doFetch, token, `/domains/${encodeURIComponent(zone)}/records`, {
+      body: {
+        type: record.type,
+        name,
+        data: record.type === "CNAME" ? `${normalizeDnsName(record.value)}.` : record.value,
+        // The API lists these as required for a TXT; they mean nothing for one.
+        ...record.type === "TXT" ? { flags: null, tag: null } : {}
+      }
+    });
+    if (created.status !== 201) throw refusal2(created, "writing", hostname);
+    return "created";
+  }
+};
+
+// src/writers/namecom.ts
+var API3 = "https://api.name.com/core/v1";
+var TIMEOUT_MS3 = 1e4;
+var MAX_BODY_BYTES3 = 512 * 1024;
+var PER_PAGE = 500;
+var MAX_PAGES = 10;
+var TTL = 300;
+var RECORD_TYPE3 = /^[A-Z0-9]{1,12}$/;
+function basicOf(token) {
+  const at = token.indexOf(":");
+  return at > 0 && at < token.length - 1 && !/\s/.test(token) ? btoa(token) : null;
+}
+async function call3(doFetch, basic, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API3}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        Authorization: `Basic ${basic}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BODY_BYTES3 }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: isObject(json) ? json : null };
+}
+function refusal3(answer, stage, hostname) {
+  if (answer.status === 401) return new DnsWriteError("token_invalid");
+  if (answer.status === 403)
+    return new DnsWriteError(stage === "reading" ? "zone_read_missing" : "dns_edit_missing");
+  if (answer.status === 409) return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function pageOf(body) {
+  const rows = body?.records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  const records = rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "number" || typeof row.type !== "string" || typeof row.answer !== "string" || typeof row.fqdn !== "string" || !RECORD_TYPE3.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: String(row.id), type: row.type, content: row.answer, name: row.fqdn };
+  });
+  return { records, more: typeof body?.nextPage === "number" };
+}
+var namecom = {
+  host: "name-com",
+  /** Add the record to the Name.com domain that holds its name. An identical record is left as
+   *  it is. Name.com has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const basic = basicOf(token);
+    if (!basic) throw new DnsWriteError("token_invalid");
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const path = `/domains/${encodeURIComponent(candidate)}/records`;
+      const first = await call3(doFetch, basic, `${path}?perPage=${PER_PAGE}`);
+      if (first.status === 404) continue;
+      if (first.status !== 200) throw refusal3(first, "reading", hostname);
+      zone = candidate;
+      let page = pageOf(first.body);
+      existing = page.records;
+      for (let next = 2; page.more && next <= MAX_PAGES; next++) {
+        const answer = await call3(doFetch, basic, `${path}?perPage=${PER_PAGE}&page=${next}`);
+        if (answer.status !== 200) throw refusal3(answer, "reading", hostname);
+        page = pageOf(answer.body);
+        existing = existing.concat(page.records);
+      }
+      if (page.more) throw new DnsWriteError("unavailable");
+      break;
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const here = existing.filter(
+      (r) => r.name !== void 0 && normalizeDnsName(r.name) === hostname
+    );
+    const decision = decide(record, here, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const host = hostname === zone ? "@" : hostname.slice(0, -(zone.length + 1));
+    const created = await call3(doFetch, basic, `/domains/${encodeURIComponent(zone)}/records`, {
+      body: { host, type: record.type, answer: record.value, ttl: TTL }
+    });
+    if (created.status !== 200) throw refusal3(created, "writing", hostname);
+    const stored = created.body?.answer;
+    if (typeof stored !== "string" || !sameValue(record, { content: stored }))
+      throw new DnsWriteError("unavailable");
+    return "created";
+  }
+};
+
+// src/writers/porkbun.ts
+var API4 = "https://api.porkbun.com/api/json/v3";
+var TIMEOUT_MS4 = 1e4;
+var MAX_BODY_BYTES4 = 256 * 1024;
+var KEY_CODES = /* @__PURE__ */ new Set([
+  "API_KEY_REQUIRED",
+  "INVALID_API_KEYS_001",
+  "INVALID_TOKEN",
+  "INVALID_USER"
+]);
+var ACCESS_CODES = /* @__PURE__ */ new Set(["API_ACCESS_DISABLED", "IP_NOT_ALLOWED", "DOMAIN_NOT_ALLOWED"]);
+var NOT_A_ZONE_CODES = /* @__PURE__ */ new Set(["INVALID_DOMAIN", "DOMAIN_NOT_FOUND"]);
+var ID2 = /^[0-9]{1,20}$/;
+var RECORD_TYPE4 = /^[A-Z0-9]{1,12}$/;
+function keysOf(token) {
+  const at = token.indexOf(":");
+  const key = token.slice(0, at);
+  const secret = token.slice(at + 1);
+  return at > 0 && secret && !/\s/.test(token) ? { key, secret } : null;
+}
+async function call4(doFetch, keys, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API4}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        "X-API-Key": keys.key,
+        "X-Secret-API-Key": keys.secret,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS4, maxBytes: MAX_BODY_BYTES4 }
+  );
+  if (!res) return { code: "", ok: false, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  const body = isObject(json) ? json : null;
+  return {
+    code: typeof body?.code === "string" ? body.code : "",
+    ok: res.status === 200 && body?.status === "SUCCESS",
+    body
+  };
+}
+function refusal4(answer, hostname) {
+  if (KEY_CODES.has(answer.code)) return new DnsWriteError("token_invalid");
+  if (ACCESS_CODES.has(answer.code)) return new DnsWriteError("dns_edit_missing");
+  if (answer.code === "RECORD_CONFLICT") return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function recordsOf3(body) {
+  const rows = body?.records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  return rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID2.test(row.id) || !RECORD_TYPE4.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: row.id, type: row.type, content: row.content, name: row.name };
+  });
+}
+var porkbun = {
+  host: "porkbun",
+  /** Add the record to the Porkbun domain that holds its name. An identical record is left as
+   *  it is. Porkbun has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const keys = keysOf(token);
+    if (!keys) throw new DnsWriteError("token_invalid");
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const answer = await call4(doFetch, keys, `/dns/retrieve/${encodeURIComponent(candidate)}`);
+      if (answer.ok) {
+        zone = candidate;
+        existing = recordsOf3(answer.body).filter(
+          (r) => r.name !== void 0 && normalizeDnsName(r.name) === hostname
+        );
+        break;
+      }
+      if (!NOT_A_ZONE_CODES.has(answer.code)) throw refusal4(answer, hostname);
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const subdomain = hostname === zone ? "" : hostname.slice(0, -(zone.length + 1));
+    const created = await call4(doFetch, keys, `/dns/create/${encodeURIComponent(zone)}`, {
+      body: {
+        name: subdomain,
+        type: record.type,
+        content: record.value,
+        ...comment ? { notes: comment } : {}
+      }
+    });
+    if (created.code === "DUPLICATE_RECORD") return "unchanged";
+    if (!created.ok) throw refusal4(created, hostname);
+    return "created";
+  }
+};
+
+// src/writers/index.ts
+var writers = {
+  cloudflare,
+  digitalocean,
+  "name-com": namecom,
+  porkbun
+};
+
+export {
+  fetchBounded,
+  isObject,
+  DnsWriteError,
+  cloudflare,
+  digitalocean,
+  namecom,
+  porkbun,
+  writers
+};