@serve.zone/dcrouter 17.10.0 → 17.10.2

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '17.10.0',
+    version: '17.10.2',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxTQUFTO0lBQ2xCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "17.10.0",
+  "version": "17.10.2",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.10.0',
+  version: '17.10.2',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/dns/classes.gateway-route-dns-reconciler.ts

@@ -132,8 +132,12 @@ export class GatewayRouteDnsReconciler {
     const targetIp = optionsArg.delete
       ? undefined
       : this.getDesiredTargetIp(optionsArg.gatewayClientId, hostname);
-    const proxied = optionsArg.proxied ?? false;
-    const workKey = this.buildWorkKey(optionsArg, hostname, mode, targetIp, proxied);
+    // Routes synced before proxy intent was persisted carry no intent at all.
+    // Resolving that to a hardcoded default here would delete a live proxied
+    // record and recreate it unproxied, so the intent stays undefined until it
+    // can be resolved against the current record state under the hostname lock.
+    const proxiedIntent = optionsArg.proxied;
+    const workKey = this.buildWorkKey(optionsArg, hostname, mode, targetIp, proxiedIntent);
     const latestIntent = this.latestIntentByHostname.get(hostname);
     if (latestIntent?.workKey === workKey) return await latestIntent.promise;
 
@@ -156,7 +160,7 @@ export class GatewayRouteDnsReconciler {
         mode,
         checkedAt,
         targetIp,
-        proxied,
+        proxiedIntent,
         executionArg.providerZoneRefreshes,
       );
     });
@@ -184,7 +188,7 @@ export class GatewayRouteDnsReconciler {
     mode: Exclude<plugins.servezoneInterfaces.data.TGatewayRouteDnsMode, 'skip'>,
     checkedAt: number,
     targetIp: string | undefined,
-    proxied: boolean,
+    proxiedIntent: boolean | undefined,
     providerZoneRefreshes?: Map<string, Promise<IProviderZoneRefreshResult>>,
   ): Promise<TGatewayDnsResult> {
     const claimOwnerId = this.buildClaimOwnerId(optionsArg.gatewayClientId, hostname);
@@ -294,6 +298,11 @@ export class GatewayRouteDnsReconciler {
       );
     }
 
+    // Absent proxy intent must never be read as "not proxied": that would make
+    // the desired lookup miss a live proxied record and replace it with an
+    // unproxied one, exposing the origin. Fall back to the stored record state
+    // the same way dnsMode and ingress fall back to their persisted values.
+    const proxied = proxiedIntent ?? this.getStoredProxiedState(records, recordType, claimOwnerId);
     const desired = records.find((recordArg) => recordArg.type === recordType
       && recordArg.value === targetIp
       && recordArg.ttl === GATEWAY_ROUTE_DNS_TTL
@@ -620,7 +629,7 @@ export class GatewayRouteDnsReconciler {
     hostnameArg: string,
     modeArg: Exclude<plugins.servezoneInterfaces.data.TGatewayRouteDnsMode, 'skip'>,
     targetIpArg: string | undefined,
-    proxiedArg: boolean,
+    proxiedArg: boolean | undefined,
   ): string {
     return JSON.stringify({
       hostname: hostnameArg,
@@ -629,11 +638,37 @@ export class GatewayRouteDnsReconciler {
       mode: modeArg,
       delete: optionsArg.delete === true,
       targetIp: targetIpArg || null,
-      proxied: proxiedArg,
+      proxied: proxiedArg ?? null,
       claims: this.getActiveClaimsForHostname(hostnameArg),
     });
   }
 
+  /**
+   * Recover the effective proxy state for a claim whose route carries no
+   * explicit proxy intent. Preferring the reconciler's own record keeps managed
+   * proxying stable, and falling back to any address record under the hostname
+   * keeps an operator's proxy protection when automation claims the hostname.
+   */
+  private getStoredProxiedState(
+    recordsArg: DnsRecordDoc[],
+    recordTypeArg: 'A' | 'AAAA',
+    claimOwnerIdArg: string,
+  ): boolean {
+    const isOwned = (recordArg: DnsRecordDoc) => recordArg.managedBy === GATEWAY_ROUTE_DNS_MANAGED_BY
+      && recordArg.managedOwnerId === claimOwnerIdArg;
+    const preferenceOrder: Array<(recordArg: DnsRecordDoc) => boolean> = [
+      (recordArg) => recordArg.type === recordTypeArg && isOwned(recordArg),
+      (recordArg) => isOwned(recordArg),
+      (recordArg) => recordArg.type === recordTypeArg,
+      () => true,
+    ];
+    for (const matches of preferenceOrder) {
+      const candidate = recordsArg.find((recordArg) => matches(recordArg));
+      if (candidate) return candidate.proxied === true;
+    }
+    return false;
+  }
+
   private async refreshProviderZone(
     zoneIdArg: string,
     providerZoneRefreshesArg?: Map<string, Promise<IProviderZoneRefreshResult>>,

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -1383,6 +1383,12 @@ export class GatewayClientHandler {
         ? { gatewayDnsProxied: dnsProxied } : {}),
     };
     const normalizedRoute = this.normalizeGatewayClientRoute(validatedRoute, resolvedOwnership, externalKey);
+    if (
+      validatedRoute.remoteIngress === undefined
+      && existingRoute?.route.remoteIngress
+    ) {
+      normalizedRoute.remoteIngress = structuredClone(existingRoute.route.remoteIngress);
+    }
     if (!normalizedRoute.ingress) {
       const existingIngress = existingRoute?.route.ingress;
       normalizedRoute.ingress = existingIngress
@@ -1396,6 +1402,7 @@ export class GatewayClientHandler {
         + `${existingIngress ? 'preserved stored policy' : 'applied legacy directHub+smartVpn compatibility policy'}`,
       );
     }
+    this.assertGatewayRouteHasIngressPath(normalizedRoute);
 
     if (existingRoute) {
       const snapshot = structuredClone(existingRoute);
@@ -1770,6 +1777,21 @@ export class GatewayClientHandler {
     return normalizedRoute;
   }
 
+  private assertGatewayRouteHasIngressPath(
+    routeArg: interfaces.data.IDcRouterRouteConfig,
+  ): void {
+    if (
+      routeArg.ingress?.directHub
+      || routeArg.ingress?.smartVpn
+      || routeArg.remoteIngress?.enabled
+    ) {
+      return;
+    }
+    throw new plugins.typedrequest.TypedResponseError(
+      'gateway route must enable directHub, smartVpn, or RemoteIngress',
+    );
+  }
+
   private assertGatewayClientRouteOwnership(
     ownership: TResolvedGatewayClientOwnership,
     route?: interfaces.data.IDcRouterRouteConfig,

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.10.0',
+  version: '17.10.2',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }