@tryghost/domain-validator 1.6.0 → 3.0.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2013-2025 Ghost Foundation
+Copyright (c) 2013-2026 Ghost Foundation
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -18,4 +18,4 @@
 
 # Copyright & License
 
-Copyright (c) 2013-2025 Ghost Foundation - Released under the [MIT license](LICENSE).
+Copyright (c) 2013-2026 Ghost Foundation - Released under the [MIT license](LICENSE).

package/lib/caa.js

@@ -0,0 +1,37 @@
+const dns = require('@tryghost/dns');
+const debug = require('@tryghost/debug')('dv:caa');
+
+/**
+ * Check if the domain's CAA records allow the given issuer.
+ *
+ * @param {string} customdomain
+ * @param {string} issuer - CA identity to check (e.g. 'certainly.com')
+ * @returns {Promise<{isCaaValid: boolean, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
+ */
+module.exports.validate = (customdomain, issuer) => {
+    debug('Checking CAA for ' + customdomain + ' against ' + issuer);
+    return dns.caa(customdomain, {issuer}).then((result) => {
+        return {
+            isCaaValid: result.allowed,
+            caaSource: result.source,
+            caaAllowedIssuers: result.allowedIssuers,
+            caaError: result.error
+        };
+    }).catch((err) => {
+        // Fail open: dns.caa fails open internally on DNS errors, but guard
+        // against unexpected throws (bad arguments, future regressions) so
+        // CAA can never take down the rest of the validity report. Tolerate
+        // non-Error rejections (null/undefined/strings) so this handler
+        // itself can never throw.
+        const message = (err && typeof err.message === 'string')
+            ? err.message
+            : String(err || 'UNKNOWN');
+        debug('Unexpected CAA error: ' + message);
+        return {
+            isCaaValid: true,
+            caaSource: null,
+            caaAllowedIssuers: [],
+            caaError: message
+        };
+    });
+};

package/lib/pro.js

@@ -150,19 +150,19 @@ _private.isCertificateError = error => /certificate/.test(error.context);
 
 // Checks a Pro site using the provided details, and returning a responseObject
 module.exports.validate = (proto, subdomain, customdomain, subdirectory, prodomain) => {
-    const url = _private.buildUrl(proto, customdomain, subdirectory);
+    const firstAttemptUrl = _private.buildUrl(proto, customdomain, subdirectory);
 
-    debug('Validating ' + url);
-    return request.domain(url)
+    debug('Validating ' + firstAttemptUrl);
+    return request.domain(firstAttemptUrl)
         .then((result) => {
             debug('Response received');
             return _private.buildResponse(result, proto, subdomain, customdomain, subdirectory, prodomain);
         })
         .catch(() => {
-            const url = _private.buildUrl('http', customdomain, subdirectory);
+            const secondAttemptUrl = _private.buildUrl('http', customdomain, subdirectory);
 
-            debug('Validating ' + url);
-            return request.domain(url)
+            debug('Validating ' + secondAttemptUrl);
+            return request.domain(secondAttemptUrl)
                 .then((result) => {
                     debug('HTTP response received');
                     const response = _private.buildResponse(result, 'http', subdomain, customdomain, subdirectory, prodomain);

package/lib/request.js

@@ -18,7 +18,7 @@ const staticLookup = () => async (hostname, _options, callback) => {
         const ips = await resolver.resolve(hostname);
 
         if (ips.length === 0) {
-            return callback(new Error(`Unable to resolve ${hostname}`));
+            return callback(new errors.InternalServerError({message: `Unable to resolve ${hostname}`}));
         }
 
         if (nodeVersion >= 20) {
@@ -34,20 +34,27 @@ const staticLookup = () => async (hostname, _options, callback) => {
 };
 
 module.exports.domain = (url) => {
-    const httpModule = new URL(url).protocol === 'https:' ? https : http;
-    const httpAgent = new httpModule.Agent({lookup: staticLookup()});
-
+    /**
+     * @type {import('got').Options}
+     */
     const options = {
         // We want to capture details of different hops
         followRedirect: false,
         // Don't allow the request to go on for more than 15 seconds
-        timeout: 15000,
+        timeout: {
+            request: 15000
+        },
         // If the network errors, retry 1 time:
-        retries: 1,
+        retry: {
+            limit: 1
+        },
         headers: {
             'X-Ghost-Proxy': true
         },
-        agent: httpAgent
+        agent: {
+            http: new http.Agent({lookup: staticLookup()}),
+            https: new https.Agent({lookup: staticLookup()})
+        }
     };
 
     const responses = [];
@@ -59,11 +66,11 @@ module.exports.domain = (url) => {
         const statusCode = res.statusCode;
         const headers = {};
 
-        _.reduce(res.headers, (headers, value, name) => {
+        _.reduce(res.headers, (updatedHeaders = {}, value, name) => {
             if (_.startsWith(name, 'x-ghost') || _.includes(['server', 'location', 'x-amz-cf-id'], name)) {
-                headers[name] = value;
+                updatedHeaders[name] = value;
             }
-            return headers;
+            return updatedHeaders;
         }, headers);
 
         responses.push({statusCode, headers});
@@ -86,9 +93,12 @@ module.exports.domain = (url) => {
             .then(handleResponse)
             .then(() => resolve(responses))
             .catch((error) => {
-                reject(new errors.BadRequestError(
-                    _.merge({message: 'Domain could not be requested', property: url, context: error.message}, error)
-                ));
+                reject(new errors.BadRequestError({
+                    message: 'Domain could not be requested',
+                    property: url,
+                    context: error.message,
+                    code: error.code
+                }));
             });
     });
 };

package/lib/validate.js

@@ -1,6 +1,7 @@
 const _ = require('lodash');
 const dns = require('./dns');
 const pro = require('./pro');
+const caa = require('./caa');
 const debug = require('@tryghost/debug')('dv:validate');
 
 const _private = {};
@@ -22,20 +23,28 @@ const validityReportObject = {
     dnsRating: null,
     isDnsValidForSSL: false,
     sslRating: null,
+    isCaaValid: true,
+    caaSource: null,
+    caaAllowedIssuers: [],
+    caaError: null,
     message: ''
 };
 
-_private.doChecks = (subdomain, customdomain, subdirectory, prodomain) => {
+_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer) => {
     const checkResult = {};
     debug('starting pro');
     return pro.validate('https', subdomain, customdomain, subdirectory, prodomain)
         .then((proResult) => {
             checkResult.pro = proResult;
             debug('got pro, starting dns');
-            return dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain);
+            return Promise.all([
+                dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain),
+                caaIssuer ? caa.validate(customdomain, caaIssuer) : Promise.resolve(null)
+            ]);
         })
-        .then((dnsResult) => {
+        .then(([dnsResult, caaResult]) => {
             checkResult.dns = dnsResult;
+            checkResult.caa = caaResult;
             debug('got dns, returning');
             return checkResult;
         });
@@ -43,16 +52,23 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain) => {
 
 /**
  * check health
- * @param {Object} blog
  *
  * - returns a validity report
  * - does NOT error unless something goes wrong
+ *
+ * @param {string} subdomain
+ * @param {string} customdomain
+ * @param {string} subdirectory
+ * @param {string} [prodomain=ghost.io]
+ * @param {string} [caaIssuer] - CA identity to check CAA records against (e.g. 'certainly.com').
+ *                               When omitted, CAA is not checked and isCaaValid defaults to true.
  */
-module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io') => _private
-    .doChecks(subdomain, customdomain, subdirectory, prodomain)
+module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io', caaIssuer) => _private
+    .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuer)
     .then(function (result) {
-        // Make a new validity report
-        const validityReport = _.clone(validityReportObject);
+        // Deep clone so nested mutable fields (input, caaAllowedIssuers)
+        // can't leak across validation calls via the shared template.
+        const validityReport = _.cloneDeep(validityReportObject);
 
         // Store the inputted details
         validityReport.input.subdomain = subdomain;
@@ -64,8 +80,25 @@ module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'g
         // Do a few last DNS-related checks, and then output validity values
         _.merge(validityReport, _.omit(result.dns, 'raw'));
 
+        if (result.caa) {
+            _.merge(validityReport, result.caa);
+
+            // CAA blocking issuance means SSL can't be provisioned going forward,
+            // even if DNS currently points at Ghost — treat it like a DNS failure.
+            if (!validityReport.isCaaValid) {
+                validityReport.isDnsValidForSSL = false;
+                validityReport.sslRating = 'D';
+                validityReport.message = 'CAA record does not allow ' + caaIssuer
+                    + ' (allowed: ' + (validityReport.caaAllowedIssuers.join(', ') || 'none')
+                    + ', source: ' + validityReport.caaSource + ')';
+            }
+        }
+
         if (validityReport.isProxy) {
-            validityReport.message = validityReport.isProxyValid ? 'Found a valid proxy' : 'Found invalid proxy config';
+            const proxyMessage = validityReport.isProxyValid ? 'Found a valid proxy' : 'Found invalid proxy config';
+            validityReport.message = validityReport.message
+                ? validityReport.message + '; ' + proxyMessage
+                : proxyMessage;
         }
 
         validityReport.raw = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/domain-validator",
-  "version": "1.6.0",
+  "version": "3.0.0",
   "repository": {
     "type": "git",
     "url": "ssh://git@github.com/TryGhost/Pro",
@@ -25,18 +25,18 @@
     "test": "NODE_ENV=testing mocha -- $(find test -name '*.test.js')"
   },
   "devDependencies": {
-    "mocha": "8.4.0",
+    "mocha": "11.7.5",
     "should": "13.2.3",
-    "sinon": "9.2.4"
+    "sinon": "21.0.3"
   },
   "dependencies": {
-    "@tryghost/debug": "0.1.17",
-    "@tryghost/dns": "^0.5.1",
-    "@tryghost/errors": "1.2.14",
-    "@tryghost/pretty-cli": "1.2.9",
+    "@tryghost/debug": "2.0.3",
+    "@tryghost/dns": "^0.7.0",
+    "@tryghost/errors": "3.0.3",
+    "@tryghost/pretty-cli": "3.0.3",
     "bluebird": "3.7.2",
-    "got": "8.3.2",
-    "lodash": "4.17.21"
+    "got": "11.8.6",
+    "lodash": "4.17.23"
   },
-  "gitHead": "3533c8bcfe1cc531fdc88955e3a8ce42ed7bc4fa"
+  "gitHead": "c5d1ebb864969de89c1e8a8dcac3f577bceee1dd"
 }