@serve.zone/dcrouter 18.6.2 → 18.7.1

package/ts/dns/providers/cloudflare.provider.ts

@@ -13,6 +13,16 @@ import {
   encodeCloudflareTxtContent,
 } from '../txt-record-presentation.js';
 
+interface ICloudflareApiRecord {
+  id?: unknown;
+  name?: unknown;
+  type?: unknown;
+  content?: unknown;
+  ttl?: unknown;
+  priority?: unknown;
+  proxied?: unknown;
+}
+
 /**
  * Cloudflare implementation of IDnsProviderClient.
  *
@@ -23,6 +33,7 @@ import {
  */
 export class CloudflareDnsProvider implements IDnsProviderClient {
   private cfAccount: plugins.cloudflare.CloudflareAccount;
+  private recordListingPromises = new Map<string, Promise<ICloudflareApiRecord[]>>();
 
   constructor(apiToken: string) {
     if (!apiToken) {
@@ -53,23 +64,37 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
   }
 
   public async listRecords(domain: string): Promise<IProviderRecord[]> {
-    const zoneId = await this.cfAccount.zoneManager.getZoneId(domain);
-    const records: any[] = [];
-    // RecordManager.listRecords() intentionally converts provider failures to
-    // an empty array. DNS reconciliation must distinguish an empty zone from
-    // an unavailable provider, so use the raw paginated iterator and let
-    // errors propagate to the durable reconciliation outcome.
-    for await (const record of (this.cfAccount as any).apiAccount.dns.records.list({
-      zone_id: zoneId,
-      per_page: 100,
-    })) {
-      records.push(record);
-    }
+    const records = await this.listApiRecords(domain);
     return records
-      .filter((r) => this.isSupportedType(r.type))
+      .filter((record) => typeof record.type === 'string' && this.isSupportedType(record.type))
       .map((r) => this.fromApiRecord(r));
   }
 
+  public async listRecordIds(domain: string): Promise<string[]> {
+    return (await this.listApiRecords(domain)).map((record) => {
+      const providerRecordId = typeof record?.id === 'string' ? record.id.trim() : '';
+      if (!providerRecordId) {
+        throw new Error('CloudflareDnsProvider: provider response has no record id');
+      }
+      return providerRecordId;
+    });
+  }
+
+  private async listApiRecords(domain: string): Promise<ICloudflareApiRecord[]> {
+    const key = domain.trim().toLowerCase();
+    const pending = this.recordListingPromises.get(key);
+    if (pending) return await pending;
+    const listing = this.cfAccount.recordManager.listRecords(domain);
+    this.recordListingPromises.set(key, listing);
+    try {
+      return await listing;
+    } finally {
+      if (this.recordListingPromises.get(key) === listing) {
+        this.recordListingPromises.delete(key);
+      }
+    }
+  }
+
   public async createRecord(
     domain: string,
     record: IProviderRecordInput,
@@ -85,7 +110,7 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
     if (record.proxied !== undefined) {
       apiRecord.proxied = record.proxied;
     }
-    const created = await (this.cfAccount as any).apiAccount.dns.records.create(apiRecord);
+    const created = await this.cfAccount.apiAccount.dns.records.create(apiRecord);
     return this.fromApiRecord(created);
   }
 
@@ -105,7 +130,7 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
     if (record.proxied !== undefined) {
       apiRecord.proxied = record.proxied;
     }
-    const updated = await (this.cfAccount as any).apiAccount.dns.records.edit(
+    const updated = await this.cfAccount.apiAccount.dns.records.edit(
       providerRecordId,
       apiRecord,
     );
@@ -114,7 +139,7 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
 
   public async deleteRecord(domain: string, providerRecordId: string): Promise<void> {
     const zoneId = await this.cfAccount.zoneManager.getZoneId(domain);
-    await (this.cfAccount as any).apiAccount.dns.records.delete(providerRecordId, {
+    await this.cfAccount.apiAccount.dns.records.delete(providerRecordId, {
       zone_id: zoneId,
     });
   }
@@ -130,7 +155,7 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
     if (record.type !== 'MX') {
       return { content: record.value };
     }
-    const match = record.value.trim().match(/^(\d+)\s+(.+)$/);
+    const match = record.value.trim().match(/^(\d{1,5})\s+([^\s]+)$/);
     if (!match) {
       throw new Error(`CloudflareDnsProvider: invalid MX value "${record.value}"; expected "<priority> <exchange>"`);
     }
@@ -138,14 +163,41 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
     if (!Number.isInteger(priority) || priority < 0 || priority > 65535) {
       throw new Error(`CloudflareDnsProvider: invalid MX priority in "${record.value}"`);
     }
-    return { content: match[2], priority };
+    const exchange = match[2];
+    if (!this.isValidMxExchange(exchange, priority)) {
+      throw new Error(`CloudflareDnsProvider: invalid MX exchange in "${record.value}"`);
+    }
+    return { content: exchange, priority };
   }
 
-  private fromApiRecord(record: any): IProviderRecord {
+  private fromApiRecord(record: ICloudflareApiRecord): IProviderRecord {
+    const providerRecordId = typeof record?.id === 'string' ? record.id.trim() : '';
+    const name = typeof record?.name === 'string' ? record.name.trim() : '';
+    const type = typeof record?.type === 'string' ? record.type : '';
+    const ttl = Number(record?.ttl);
+    if (!providerRecordId) throw new Error('CloudflareDnsProvider: provider response has no record id');
+    if (!name) throw new Error('CloudflareDnsProvider: provider response has no record name');
+    if (!this.isSupportedType(type)) {
+      throw new Error(`CloudflareDnsProvider: provider response has unsupported record type ${type || '<empty>'}`);
+    }
+    if (!Number.isInteger(ttl) || ttl < 1) {
+      throw new Error(`CloudflareDnsProvider: provider response has invalid TTL ${String(record?.ttl)}`);
+    }
+    if (typeof record?.content !== 'string' || (type !== 'TXT' && !record.content.trim())) {
+      throw new Error(`CloudflareDnsProvider: provider response has invalid content for ${type} ${name}`);
+    }
     let value: string;
-    if (record.type === 'MX') {
-      value = `${Number(record.priority)} ${record.content}`;
-    } else if (record.type === 'TXT') {
+    if (type === 'MX') {
+      const priority = Number(record.priority);
+      const exchange = record.content.trim();
+      if (!Number.isInteger(priority) || priority < 0 || priority > 65_535) {
+        throw new Error(`CloudflareDnsProvider: provider response has invalid MX priority ${String(record.priority)}`);
+      }
+      if (!this.isValidMxExchange(exchange, priority)) {
+        throw new Error(`CloudflareDnsProvider: provider response has invalid MX exchange ${exchange}`);
+      }
+      value = `${priority} ${exchange}`;
+    } else if (type === 'TXT') {
       const decoded = decodeTxtRecordContent(String(record.content));
       if (!decoded.ok) {
         throw new Error(
@@ -157,12 +209,27 @@ export class CloudflareDnsProvider implements IDnsProviderClient {
       value = String(record.content);
     }
     return {
-      providerRecordId: String(record.id),
-      name: String(record.name),
-      type: record.type as TDnsRecordType,
+      providerRecordId,
+      name,
+      type: type as TDnsRecordType,
       value,
-      ttl: Number(record.ttl),
+      ttl,
       ...(record.proxied !== undefined ? { proxied: Boolean(record.proxied) } : {}),
     };
   }
+
+  private isValidHostname(value: string): boolean {
+    const hostname = value.toLowerCase().replace(/\.$/, '');
+    return hostname.length > 0
+      && hostname.length <= 253
+      && hostname.split('.').every((label) => (
+        label.length > 0
+        && label.length <= 63
+        && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)
+      ));
+  }
+
+  private isValidMxExchange(value: string, priority: number): boolean {
+    return value === '.' ? priority === 0 : this.isValidHostname(value);
+  }
 }

package/ts/dns/providers/interfaces.ts

@@ -52,6 +52,9 @@ export interface IDnsProviderClient {
   /** List all DNS records for a zone (FQDN). */
   listRecords(domain: string): Promise<IProviderRecord[]>;
 
+  /** List every provider record id, including record types dcrouter does not mirror. */
+  listRecordIds(domain: string): Promise<string[]>;
+
   /** Create a new DNS record at the provider; returns the created record (with id). */
   createRecord(domain: string, record: IProviderRecordInput): Promise<IProviderRecord>;
 

package/ts/email/classes.email-domain.manager.ts

@@ -166,6 +166,7 @@ export class EmailDomainManager {
         throw new Error('DKIM key creator is not ready; email domain was not persisted');
       }
       const keySize = opts.dkimKeySize || 2048;
+      const rotationIntervalDays = this.normalizeRotationIntervalDays(opts.rotationIntervalDays ?? 90);
       await this.dkimCreator.handleDKIMKeysForSelector(domainName, selector, keySize);
       const dnsRecord = await this.dkimCreator.getDNSRecordForDomain(domainName, selector);
       const publicKey = this.extractDkimPublicKey(dnsRecord?.value);
@@ -190,7 +191,7 @@ export class EmailDomainManager {
         keySize,
         publicKey,
         rotateKeys: opts.rotateKeys ?? false,
-        rotationIntervalDays: opts.rotationIntervalDays ?? 90,
+        rotationIntervalDays,
         retirementOverlapDays: 30,
       };
       doc.activeDkim = activeDkim;
@@ -256,7 +257,9 @@ export class EmailDomainManager {
         };
       }
       if (changes.rotateKeys !== undefined) doc.dkim.rotateKeys = changes.rotateKeys;
-      if (changes.rotationIntervalDays !== undefined) doc.dkim.rotationIntervalDays = changes.rotationIntervalDays;
+      if (changes.rotationIntervalDays !== undefined) {
+        doc.dkim.rotationIntervalDays = this.normalizeRotationIntervalDays(changes.rotationIntervalDays);
+      }
       if (changes.rateLimits !== undefined) doc.rateLimits = changes.rateLimits;
       if (changes.remoteIngress !== undefined) {
         doc.remoteIngress = changes.remoteIngress === null
@@ -343,7 +346,7 @@ export class EmailDomainManager {
     if (!doc) throw new Error(`Email domain not found: ${id}`);
     const provisioned = ticket.records
       .filter((record) => record.managedBy === 'mail-dns-reconciler' && !before.has(record.id)).length;
-    return { ...this.resultForDoc(doc, true), provisioned };
+    return { ...this.resultForDoc(doc, !this.hasDnsMutationFailure(doc)), provisioned };
   }
 
   public async validateDns(id: string): Promise<IEmailDomainManagerActionResult> {
@@ -359,7 +362,7 @@ export class EmailDomainManager {
       status: projectMailDnsIntentStatus(intent),
     }));
     return {
-      ...this.resultForDoc(doc, true),
+      ...this.resultForDoc(doc, !this.hasDnsMutationFailure(doc)),
       domain: this.docToInterface(doc),
       records,
     };
@@ -385,15 +388,37 @@ export class EmailDomainManager {
       return { ready: false, reason: 'SmartMTA selector-correct signing capability is unavailable', edgeIds: [] };
     }
     const reconciliation = doc.reconciliation;
+    if (reconciliation?.lifecycleStatus !== 'active') {
+      return { ready: false, reason: 'managed email domain DNS lifecycle is not active', edgeIds: [] };
+    }
+    if (reconciliation.errors.length > 0) {
+      return { ready: false, reason: reconciliation.errors[0].message, edgeIds: [] };
+    }
+    if (!await DomainDoc.findById(doc.linkedDomainId)) {
+      return { ready: false, reason: 'linked DNS domain is missing', edgeIds: [] };
+    }
     if (
       !reconciliation?.activeRevision
       || reconciliation.activeRevision.generation !== reconciliation.desiredGeneration
     ) {
       return { ready: false, reason: 'no current validated active DNS revision', edgeIds: [] };
     }
+    const slots = reconciliation.activeRevision.mxSlots;
+    if (
+      slots.length !== 2
+      || slots[0]?.priority !== 10
+      || slots[1]?.priority !== 20
+      || slots[0].edgeId === slots[1].edgeId
+      || slots[0].hostname === slots[1].hostname
+    ) {
+      return { ready: false, reason: 'validated DNS revision does not contain distinct priority 10/20 MX edges', edgeIds: [] };
+    }
+    if (!reconciliation.intents.every((intent) => intent.status === 'valid')) {
+      return { ready: false, reason: 'managed email DNS intents are not currently valid', edgeIds: [] };
+    }
     const live = await this.dcRouter.mailEdgeEligibility.resolveActiveForDomain(doc);
-    if (live.edges.length === 0) {
-      return { ready: false, reason: live.reason || 'no validated active egress edge is live', edgeIds: [] };
+    if (live.edges.length !== 2) {
+      return { ready: false, reason: live.reason || 'both validated active MX edges must be live', edgeIds: [] };
     }
     return {
       ready: true,
@@ -685,6 +710,13 @@ export class EmailDomainManager {
     return { edgeFilter };
   }
 
+  private normalizeRotationIntervalDays(value: number): number {
+    if (!Number.isInteger(value) || value < 1) {
+      throw new Error('DKIM rotationIntervalDays must be a positive integer');
+    }
+    return value;
+  }
+
   private extractDkimPublicKey(value: unknown): string | undefined {
     if (typeof value !== 'string') return undefined;
     return value.match(/(?:^|;)\s*p=([A-Za-z0-9+/=]+)(?:;|$)/)?.[1];