@serve.zone/dcrouter 17.10.1 → 18.0.0

package/ts/opsserver/handlers/certificate.handler.ts

@@ -266,22 +266,35 @@ export class CertificateHandler {
         }
       }
 
-      // Try SmartProxy certificate status if no event data
-      if (status === 'unknown' && info.routeNames.length > 0) {
+      // What the running proxy actually serves. Always queried, not only as a
+      // fallback: the served state is an independent fact from the stored one and
+      // the two must be comparable.
+      let served: interfaces.requests.ICertificateServedState | undefined;
+      if (info.routeNames.length > 0) {
         try {
           const rustStatus = await smartProxy.getCertificateStatus(info.routeNames[0]);
           if (rustStatus) {
-            if (rustStatus.expiresAt > 0) {
-              expiryDate = new Date(rustStatus.expiresAt).toISOString();
-            }
-            if (rustStatus.source) issuer = rustStatus.source;
-            status = rustStatus.isValid ? 'valid' : 'expired';
+            served = {
+              expiryDate: rustStatus.expiresAt > 0
+                ? new Date(rustStatus.expiresAt).toISOString()
+                : undefined,
+              isValid: rustStatus.isValid,
+              source: rustStatus.source || undefined,
+            };
           }
         } catch {
-          // Rust bridge may not support this command yet — ignore
+          // Rust bridge may not support this command yet — leave served unknown.
         }
       }
 
+      // With no event data, the served state is also the best available view of
+      // the issued one.
+      if (status === 'unknown' && served) {
+        if (served.expiryDate) expiryDate = served.expiryDate;
+        if (served.source) issuer = served.source;
+        status = served.isValid ? 'valid' : 'expired';
+      }
+
       // Check persisted cert data from smartdata document classes
       if (status === 'unknown') {
         const cleanDomain = domain.replace(/^\*\.?/, '');
@@ -352,6 +365,23 @@ export class CertificateHandler {
         error = error || backoffInfo.lastError;
       }
 
+      // Issued is not served. A certificate valid in storage while the engine
+      // still presents an invalid or expired one is a failure, however healthy
+      // the issuance path looks — this is exactly what hid a 21-day outage.
+      const servedMismatch = Boolean(
+        served
+        && !served.isValid
+        && (status === 'valid' || status === 'expiring'),
+      );
+      if (servedMismatch) {
+        status = 'failed';
+        error = error
+          || `A valid certificate is stored for '${domain}'`
+            + `${expiryDate ? ` (expires ${expiryDate})` : ''}, but the running proxy is serving an invalid one`
+            + `${served?.expiryDate ? ` (expired ${served.expiryDate})` : ''}. `
+            + 'The issued certificate has not reached the engine.';
+      }
+
       certificates.push({
         domain,
         routeNames: info.routeNames,
@@ -363,6 +393,8 @@ export class CertificateHandler {
         issuedAt,
         error,
         canReprovision: info.canReprovision,
+        served,
+        ...(servedMismatch ? { servedMismatch: true } : {}),
         backoffInfo,
       });
     }
@@ -419,6 +451,21 @@ export class CertificateHandler {
       return { success: false, message: `No routes found for domain '${domain}'` };
     }
 
+    // Refuse before triggering an order that cannot succeed. forceRenew is an
+    // operator override for backoff, not for missing ownership: without a zone we
+    // can prove is ours there is nowhere to place the DNS-01 challenge record.
+    if (dcRouter.dnsManager) {
+      const ownership = await dcRouter.dnsManager.resolveDomainOwnership(domain);
+      if (!ownership.verified) {
+        return {
+          success: false,
+          message:
+            `Cannot provision a certificate for '${domain}': domain ownership is unverified `
+            + `(${ownership.reason}) — ${ownership.detail}`,
+        };
+      }
+    }
+
     // Respect existing backoff unless explicitly overridden. Automated
     // callers (gateway clients retrying cert fetches) used to reset the
     // backoff and trigger a route re-apply on every request, producing a
@@ -488,12 +535,60 @@ export class CertificateHandler {
         // Fallback when DB is disabled and there is no RouteConfigManager
         await smartProxy.updateRoutes(smartProxy.routeManager.getRoutes());
       }
+      const propagation = await this.describeCertPropagationGap(domain, routeNames);
+      if (propagation) {
+        return { success: false, message: propagation };
+      }
       return { success: true, message: forceRenew ? `Certificate force-renewed for domain '${domain}'` : `Certificate reprovisioning triggered for domain '${domain}'` };
     } catch (err: unknown) {
       return { success: false, message: (err as Error).message || `Failed to reprovision certificate for ${domain}` };
     }
   }
 
+  /**
+   * After triggering the apply pipeline, check whether the certificate the proxy
+   * is actually serving is still expired. If it is, the reprovision did not
+   * propagate and reporting success would be a lie.
+   *
+   * The known cause is SmartProxy's own per-domain provisioning cooldown
+   * (`certProvisionFailureCooldownMs`, 30 min default). It is private in-memory
+   * state with no invalidation path: a provisioning sweep skips a cooling-down
+   * domain, and because the sweep returns before its summary log when every
+   * domain is skipped, the skip is not logged either. So a valid certificate can
+   * sit in storage while the proxy keeps serving the expired one, silently.
+   *
+   * Returns undefined when propagation looks fine or cannot be determined —
+   * `getCertificateStatus` goes through the Rust bridge and may be unavailable.
+   */
+  private async describeCertPropagationGap(
+    domain: string,
+    routeNames: string[],
+  ): Promise<string | undefined> {
+    const smartProxy = this.opsServerRef.dcRouterRef.smartProxy;
+    if (!smartProxy || routeNames.length === 0) {
+      return undefined;
+    }
+    let status: Awaited<ReturnType<typeof smartProxy.getCertificateStatus>>;
+    try {
+      status = await smartProxy.getCertificateStatus(routeNames[0]);
+    } catch {
+      // Bridge command unsupported — cannot determine, so do not claim a gap.
+      return undefined;
+    }
+    if (!status || status.isValid || !status.expiresAt || status.expiresAt <= 0) {
+      return undefined;
+    }
+    const servedUntil = new Date(status.expiresAt).toISOString();
+    const message =
+      `Certificate for '${domain}' was issued and stored, but route '${routeNames[0]}' is still serving a `
+      + `certificate that expired at ${servedUntil}. The new certificate did not reach the running proxy: `
+      + 'SmartProxy keeps a private per-domain provisioning cooldown that a sweep cannot clear while it is '
+      + 'active, and it exposes no per-domain invalidation or hot-load API. Toggling this single route off and '
+      + 'back on is the only supported way to force a fresh attempt without restarting dcrouter.';
+    logger.log('error', message, { domain, routeName: routeNames[0] });
+    return message;
+  }
+
   /**
    * After a force-renew, walk every route in the smartproxy that resolves to
    * the same cert identity as `forcedDomain` and write the freshly-issued cert

package/ts/opsserver/handlers/config.handler.ts

@@ -137,7 +137,9 @@ export class ConfigHandler {
       enabled: !!dcRouter.dnsServer,
       port: 53,
       nsDomains: opts.dnsNsDomains || [],
-      scopes: opts.dnsScopes || [],
+      // The delegation-verified authority set. Deployment configuration no
+      // longer contributes: this is database state, and it is the only state.
+      scopes: dcRouter.dnsAuthorityManager?.getEffectiveZoneNames() || [],
       recordCount: dnsRecords.length,
       records: dnsRecords,
       dnsChallenge: dnsChallengeEnabled,

package/ts/opsserver/handlers/dns-authority.handler.ts

@@ -0,0 +1,142 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+import { requireOpsAuth } from '../helpers/auth.js';
+
+/**
+ * DNS authority handlers.
+ *
+ * Adding a zone here is an authority claim — after it succeeds dcrouter answers
+ * for that zone with the `aa` flag on a public port and will request
+ * certificates for it. So it carries the same posture as the other DNS write
+ * surfaces (admin identity or a `:write`-scoped token) *and* the claim itself is
+ * gated on a delegation proof the caller cannot forge. Authorization decides who
+ * may ask; the probe decides whether the answer is yes.
+ */
+export class DnsAuthorityHandler {
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+
+  constructor(private opsServerRef: OpsServer) {
+    this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+    this.registerHandlers();
+  }
+
+  private async requireAuth(
+    request: { identity?: interfaces.data.IIdentity; apiToken?: string },
+    requiredScope?: interfaces.data.TApiTokenScope,
+  ): Promise<string> {
+    const auth = await requireOpsAuth(this.opsServerRef, request, {
+      scope: requiredScope,
+      requireAdminIdentity: requiredScope?.endsWith(':write'),
+    });
+    return auth.userId;
+  }
+
+  private registerHandlers(): void {
+    // Read the authority set: delegation-verified zones, and nothing else.
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetDnsAuthority>(
+        'getDnsAuthority',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            // No manager means the set was never loaded. Reported as
+            // 'unavailable' rather than as an empty set, so a reader cannot
+            // mistake "we could not look" for "there is nothing".
+            return {
+              settings: {
+                zones: [],
+                state: 'unavailable' as const,
+                expectedNameservers: [],
+                updatedAt: 0,
+                updatedBy: '',
+              },
+            };
+          }
+          return { settings: manager.getSettings() };
+        },
+      ),
+    );
+
+    // Probe a zone's delegation without changing anything
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ProbeDnsAuthorityZone>(
+        'probeDnsAuthorityZone',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return {
+              probe: {
+                zone: dataArg.zone,
+                verdict: 'undeterminable' as const,
+                observedNameservers: [],
+                expectedNameservers: [],
+                detail: 'DnsAuthorityManager is not initialized',
+              },
+            };
+          }
+          return { probe: await manager.probeDelegation(dataArg.zone) };
+        },
+      ),
+    );
+
+    // Claim authority over a zone, against a delegation proof
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_VerifyDnsAuthorityZone>(
+        'verifyDnsAuthorityZone',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'dns-authority:write');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { success: false, message: 'DnsAuthorityManager is not initialized' };
+          }
+          const result = await manager.verifyZone(dataArg.zone, userId);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.(['dns', 'routes'], {
+              reason: 'dns-authority-verified',
+            });
+          }
+          return result;
+        },
+      ),
+    );
+
+    // Drop a verified zone. Every zone is revocable — there is no bootstrap floor.
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_RevokeDnsAuthorityZone>(
+        'revokeDnsAuthorityZone',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'dns-authority:write');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { success: false, message: 'DnsAuthorityManager is not initialized' };
+          }
+          const result = await manager.revokeZone(dataArg.zone, userId);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.(['dns', 'routes'], {
+              reason: 'dns-authority-revoked',
+            });
+          }
+          return result;
+        },
+      ),
+    );
+
+    // Compare declared authority against observed delegation, both directions
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetDnsAuthorityDrift>(
+        'getDnsAuthorityDrift',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { drift: [] };
+          }
+          return { drift: await manager.auditDelegationDrift() };
+        },
+      ),
+    );
+  }
+}

package/ts/opsserver/handlers/dns-provider.handler.ts

@@ -138,6 +138,12 @@ export class DnsProviderHandler {
           if (!dnsManager) return { success: false, message: 'DnsManager not initialized' };
           const result = await dnsManager.deleteProvider(dataArg.id, dataArg.force ?? false);
           if (result.success) {
+            // Removing a provider removes the credentialed zone listing that
+            // proved ownership for its domains, so the ownership-gated private
+            // route DNS overlay must be re-derived rather than left serving.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'DNS provider deletion',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'dns-provider-deleted',

package/ts/opsserver/handlers/domain.handler.ts

@@ -138,6 +138,13 @@ export class DomainHandler {
           if (!dnsManager) return { success: false, message: 'DnsManager not initialized' };
           const ok = await dnsManager.deleteDomain(dataArg.id);
           if (ok) {
+            // The private-route DNS overlay is derived from routes but gated on
+            // domain ownership, so deleting a domain invalidates it even though no
+            // route changed. Without this it keeps answering authoritatively for a
+            // zone we no longer manage until an unrelated route apply.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'domain deletion',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'domain-deleted',
@@ -183,6 +190,11 @@ export class DomainHandler {
             deleteExistingProviderRecords: dataArg.deleteExistingProviderRecords,
           });
           if (result.success) {
+            // Migrating away from a provider can drop the proof that made the
+            // overlay's hostnames servable, so re-derive it here too.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'domain migration',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'domain-migrated',

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -604,7 +604,7 @@ export class GatewayClientHandler {
         enabled: Boolean(dcRouter.remoteIngressManager?.getHubSettings().enabled),
       },
       dns: {
-        authoritative: Boolean(dcRouter.options.dnsScopes?.length),
+        authoritative: Boolean(dcRouter.dnsAuthorityManager?.getEffectiveZoneNames().length),
         providerManaged: Boolean(dcRouter.dnsManager),
       },
       http3: {

package/ts/opsserver/handlers/index.ts

@@ -17,6 +17,7 @@ export * from './network-target.handler.js';
 export * from './users.handler.js';
 export * from './dns-provider.handler.js';
 export * from './domain.handler.js';
+export * from './dns-authority.handler.js';
 export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';

package/ts/readme.md

@@ -58,7 +58,7 @@ await router.start();
 - SmartProxy for HTTP/HTTPS/TCP routes
 - `UnifiedEmailServer` for SMTP ingress, delivery, managed app address bindings, and outbound SMTP submission when `emailConfig` is present
 - DB-backed managers for routes, API tokens, target profiles, domains, records, ACME config, and email domains when the DB is enabled
-- embedded authoritative DNS and DoH route generation from `dnsNsDomains` and `dnsScopes`
+- embedded authoritative DNS and DoH route generation from `dnsNsDomains` plus the delegation-verified zones held in the database
 - VPN, RADIUS, and remote ingress services when their config blocks are enabled
 - OpsServer and the dashboard, which start on every boot
 - an admin-JWT authenticated read-only MCP endpoint at `/mcp` for safe route, DNS, email, RemoteIngress, and VPN summaries

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.10.1',
+  version: '18.0.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }