@tryghost/domain-validator 2.0.0 → 4.0.0

package/lib/caa.js

@@ -0,0 +1,41 @@
+const dns = require('@tryghost/dns');
+const debug = require('@tryghost/debug')('dv:caa');
+
+/**
+ * Check whether the domain's CAA records allow any of the given issuers.
+ *
+ * @param {string} customdomain
+ * @param {string[]} issuers - CA identities in preference order (e.g. ['certainly.com', 'letsencrypt.org'])
+ * @returns {Promise<{isCaaValid: boolean, caaChosenIssuer: string|null, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
+ */
+module.exports.validate = (customdomain, issuers) => {
+    // Tolerate a missing issuers arg here so we still enter the .catch below
+    // and fail open. dns.caa will throw a clear ValidationError on bad input.
+    debug('Checking CAA for ' + customdomain + ' against ' + (issuers || []).join(', '));
+    return dns.caa(customdomain, {issuers}).then((result) => {
+        return {
+            isCaaValid: result.allowed,
+            caaChosenIssuer: result.matchedIssuer,
+            caaSource: result.source,
+            caaAllowedIssuers: result.allowedIssuers,
+            caaError: result.error
+        };
+    }).catch((err) => {
+        // Fail open: dns.caa fails open internally on DNS errors, but guard
+        // against unexpected throws (bad arguments, future regressions) so
+        // CAA can never take down the rest of the validity report. Tolerate
+        // non-Error rejections (null/undefined/strings) so this handler
+        // itself can never throw.
+        const message = (err && typeof err.message === 'string')
+            ? err.message
+            : String(err || 'UNKNOWN');
+        debug('Unexpected CAA error: ' + message);
+        return {
+            isCaaValid: true,
+            caaChosenIssuer: issuers && issuers[0] ? issuers[0] : null,
+            caaSource: null,
+            caaAllowedIssuers: [],
+            caaError: message
+        };
+    });
+};

package/lib/validate.js

@@ -1,6 +1,7 @@
 const _ = require('lodash');
 const dns = require('./dns');
 const pro = require('./pro');
+const caa = require('./caa');
 const debug = require('@tryghost/debug')('dv:validate');
 
 const _private = {};
@@ -22,20 +23,29 @@ const validityReportObject = {
     dnsRating: null,
     isDnsValidForSSL: false,
     sslRating: null,
+    isCaaValid: true,
+    caaChosenIssuer: null,
+    caaSource: null,
+    caaAllowedIssuers: [],
+    caaError: null,
     message: ''
 };
 
-_private.doChecks = (subdomain, customdomain, subdirectory, prodomain) => {
+_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuers) => {
     const checkResult = {};
     debug('starting pro');
     return pro.validate('https', subdomain, customdomain, subdirectory, prodomain)
         .then((proResult) => {
             checkResult.pro = proResult;
             debug('got pro, starting dns');
-            return dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain);
+            return Promise.all([
+                dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain),
+                (caaIssuers && caaIssuers.length > 0) ? caa.validate(customdomain, caaIssuers) : Promise.resolve(null)
+            ]);
         })
-        .then((dnsResult) => {
+        .then(([dnsResult, caaResult]) => {
             checkResult.dns = dnsResult;
+            checkResult.caa = caaResult;
             debug('got dns, returning');
             return checkResult;
         });
@@ -43,16 +53,24 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain) => {
 
 /**
  * check health
- * @param {Object} blog
  *
  * - returns a validity report
  * - does NOT error unless something goes wrong
+ *
+ * @param {string} subdomain
+ * @param {string} customdomain
+ * @param {string} subdirectory
+ * @param {string} [prodomain=ghost.io]
+ * @param {string[]} [caaIssuers] - CA identities to check CAA records against, in preference order
+ *                                  (e.g. ['certainly.com', 'letsencrypt.org']). When omitted or
+ *                                  empty, CAA is not checked and isCaaValid defaults to true.
  */
-module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io') => _private
-    .doChecks(subdomain, customdomain, subdirectory, prodomain)
+module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io', caaIssuers) => _private
+    .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuers)
     .then(function (result) {
-        // Make a new validity report
-        const validityReport = _.clone(validityReportObject);
+        // Deep clone so nested mutable fields (input, caaAllowedIssuers)
+        // can't leak across validation calls via the shared template.
+        const validityReport = _.cloneDeep(validityReportObject);
 
         // Store the inputted details
         validityReport.input.subdomain = subdomain;
@@ -64,8 +82,25 @@ module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'g
         // Do a few last DNS-related checks, and then output validity values
         _.merge(validityReport, _.omit(result.dns, 'raw'));
 
+        if (result.caa) {
+            _.merge(validityReport, result.caa);
+
+            // CAA blocking issuance means SSL can't be provisioned going forward,
+            // even if DNS currently points at Ghost — treat it like a DNS failure.
+            if (!validityReport.isCaaValid) {
+                validityReport.isDnsValidForSSL = false;
+                validityReport.sslRating = 'D';
+                validityReport.message = 'CAA record does not allow any of ' + caaIssuers.join(', ')
+                    + ' (allowed: ' + (validityReport.caaAllowedIssuers.join(', ') || 'none')
+                    + ', source: ' + validityReport.caaSource + ')';
+            }
+        }
+
         if (validityReport.isProxy) {
-            validityReport.message = validityReport.isProxyValid ? 'Found a valid proxy' : 'Found invalid proxy config';
+            const proxyMessage = validityReport.isProxyValid ? 'Found a valid proxy' : 'Found invalid proxy config';
+            validityReport.message = validityReport.message
+                ? validityReport.message + '; ' + proxyMessage
+                : proxyMessage;
         }
 
         validityReport.raw = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/domain-validator",
-  "version": "2.0.0",
+  "version": "4.0.0",
   "repository": {
     "type": "git",
     "url": "ssh://git@github.com/TryGhost/Pro",
@@ -31,12 +31,12 @@
   },
   "dependencies": {
     "@tryghost/debug": "2.0.3",
-    "@tryghost/dns": "^0.6.0",
+    "@tryghost/dns": "^0.8.0",
     "@tryghost/errors": "3.0.3",
     "@tryghost/pretty-cli": "3.0.3",
     "bluebird": "3.7.2",
     "got": "11.8.6",
     "lodash": "4.17.23"
   },
-  "gitHead": "ef060c71be33d265e7d97e4579ed83c3e3fdac09"
+  "gitHead": "258ac0821f5b06978db14cc5c1879efdf33b927c"
 }