@serve.zone/dcrouter 18.5.0 → 18.6.1

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -32,7 +32,7 @@ export class GatewayClientHandler {
   private async requireAuth(
     request: { identity?: interfaces.data.IIdentity; apiToken?: string },
     requiredScope?: interfaces.data.TApiTokenScope,
-    options: { allowCandidate?: boolean } = {},
+    options: { allowCandidate?: boolean; loadManagedZoneNames?: boolean } = {},
   ): Promise<TAuthContext> {
     return await requireGatewayMachineAuth(
       this.opsServerRef,
@@ -351,6 +351,48 @@ export class GatewayClientHandler {
       ),
     );
 
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<plugins.servezoneInterfaces.requests.gateway.IReq_GetGatewayClientMailDomainCount>(
+        'getGatewayClientMailDomainCount',
+        async (dataArg) => {
+          const auth = await this.requireAuth(dataArg, 'gateway-clients:read', {
+            loadManagedZoneNames: false,
+          });
+          this.assertCapability(auth, 'readMail');
+          const untypedRequest = dataArg as Record<string, unknown>;
+          for (const forbiddenKey of [
+            'owner',
+            'gatewayClientId',
+            'gatewayClientType',
+            'workHosterId',
+            'workHosterType',
+            'appInstanceId',
+          ]) {
+            if (Object.prototype.hasOwnProperty.call(untypedRequest, forbiddenKey)) {
+              throw new plugins.typedrequest.TypedResponseError(
+                'mail-domain count ownership is derived from the gateway-client credential',
+              );
+            }
+          }
+          if (
+            auth.isAdmin
+            || auth.policy?.role !== 'gatewayClient'
+            || !auth.gatewayClient
+            || !auth.policy.gatewayClient
+          ) {
+            throw new plugins.typedrequest.TypedResponseError('gateway-client credential required');
+          }
+          const manager = this.opsServerRef.dcRouterRef.workAppMailManager;
+          return {
+            count: await manager.countMailDomains({
+              gatewayClientType: auth.gatewayClient.type,
+              gatewayClientId: auth.gatewayClient.id,
+            }),
+          };
+        },
+      ),
+    );
+
     this.typedrouter.addTypedHandler(
       new plugins.typedrequest.TypedHandler<plugins.servezoneInterfaces.requests.gateway.IReq_GetGatewayClientDomains>(
         'getGatewayClientDomains',

package/ts/opsserver/helpers/gateway-client-auth.ts

@@ -17,6 +17,8 @@ export type TGatewayCredentialState = 'candidate' | 'active' | 'manual';
 
 export interface IRequireGatewayMachineAuthOptions {
   allowCandidate?: boolean;
+  /** Skip managed DNS-domain loading for APIs that do not evaluate hostnames. */
+  loadManagedZoneNames?: boolean;
 }
 
 export function getGatewayCredentialState(
@@ -124,8 +126,10 @@ export async function requireGatewayMachineAuth(
     scope: scopeArg,
     requireAdminIdentity: false,
   });
-  const managedZoneNames = (await opsServerRefArg.dcRouterRef.dnsManager?.listDomains() || [])
-    .map((domainArg) => domainArg.name);
+  const managedZoneNames = optionsArg.loadManagedZoneNames === false
+    ? []
+    : (await opsServerRefArg.dcRouterRef.dnsManager?.listDomains() || [])
+      .map((domainArg) => domainArg.name);
 
   if (auth.isAdmin) {
     return {

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.5.0',
+  version: '18.6.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }