@tryghost/domain-validator 3.0.0 → 4.0.0

package/lib/caa.js

@@ -2,17 +2,20 @@ const dns = require('@tryghost/dns');
 const debug = require('@tryghost/debug')('dv:caa');
 
 /**
- * Check if the domain's CAA records allow the given issuer.
+ * Check whether the domain's CAA records allow any of the given issuers.
  *
  * @param {string} customdomain
- * @param {string} issuer - CA identity to check (e.g. 'certainly.com')
- * @returns {Promise<{isCaaValid: boolean, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
+ * @param {string[]} issuers - CA identities in preference order (e.g. ['certainly.com', 'letsencrypt.org'])
+ * @returns {Promise<{isCaaValid: boolean, caaChosenIssuer: string|null, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
  */
-module.exports.validate = (customdomain, issuer) => {
-    debug('Checking CAA for ' + customdomain + ' against ' + issuer);
-    return dns.caa(customdomain, {issuer}).then((result) => {
+module.exports.validate = (customdomain, issuers) => {
+    // Tolerate a missing issuers arg here so we still enter the .catch below
+    // and fail open. dns.caa will throw a clear ValidationError on bad input.
+    debug('Checking CAA for ' + customdomain + ' against ' + (issuers || []).join(', '));
+    return dns.caa(customdomain, {issuers}).then((result) => {
         return {
             isCaaValid: result.allowed,
+            caaChosenIssuer: result.matchedIssuer,
             caaSource: result.source,
             caaAllowedIssuers: result.allowedIssuers,
             caaError: result.error
@@ -29,6 +32,7 @@ module.exports.validate = (customdomain, issuer) => {
         debug('Unexpected CAA error: ' + message);
         return {
             isCaaValid: true,
+            caaChosenIssuer: issuers && issuers[0] ? issuers[0] : null,
             caaSource: null,
             caaAllowedIssuers: [],
             caaError: message

package/lib/validate.js

@@ -24,13 +24,14 @@ const validityReportObject = {
     isDnsValidForSSL: false,
     sslRating: null,
     isCaaValid: true,
+    caaChosenIssuer: null,
     caaSource: null,
     caaAllowedIssuers: [],
     caaError: null,
     message: ''
 };
 
-_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer) => {
+_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuers) => {
     const checkResult = {};
     debug('starting pro');
     return pro.validate('https', subdomain, customdomain, subdirectory, prodomain)
@@ -39,7 +40,7 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer
             debug('got pro, starting dns');
             return Promise.all([
                 dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain),
-                caaIssuer ? caa.validate(customdomain, caaIssuer) : Promise.resolve(null)
+                (caaIssuers && caaIssuers.length > 0) ? caa.validate(customdomain, caaIssuers) : Promise.resolve(null)
             ]);
         })
         .then(([dnsResult, caaResult]) => {
@@ -60,11 +61,12 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer
  * @param {string} customdomain
  * @param {string} subdirectory
  * @param {string} [prodomain=ghost.io]
- * @param {string} [caaIssuer] - CA identity to check CAA records against (e.g. 'certainly.com').
- *                               When omitted, CAA is not checked and isCaaValid defaults to true.
+ * @param {string[]} [caaIssuers] - CA identities to check CAA records against, in preference order
+ *                                  (e.g. ['certainly.com', 'letsencrypt.org']). When omitted or
+ *                                  empty, CAA is not checked and isCaaValid defaults to true.
  */
-module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io', caaIssuer) => _private
-    .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuer)
+module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io', caaIssuers) => _private
+    .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuers)
     .then(function (result) {
         // Deep clone so nested mutable fields (input, caaAllowedIssuers)
         // can't leak across validation calls via the shared template.
@@ -88,7 +90,7 @@ module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'g
             if (!validityReport.isCaaValid) {
                 validityReport.isDnsValidForSSL = false;
                 validityReport.sslRating = 'D';
-                validityReport.message = 'CAA record does not allow ' + caaIssuer
+                validityReport.message = 'CAA record does not allow any of ' + caaIssuers.join(', ')
                     + ' (allowed: ' + (validityReport.caaAllowedIssuers.join(', ') || 'none')
                     + ', source: ' + validityReport.caaSource + ')';
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/domain-validator",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "repository": {
     "type": "git",
     "url": "ssh://git@github.com/TryGhost/Pro",
@@ -31,12 +31,12 @@
   },
   "dependencies": {
     "@tryghost/debug": "2.0.3",
-    "@tryghost/dns": "^0.7.0",
+    "@tryghost/dns": "^0.8.0",
     "@tryghost/errors": "3.0.3",
     "@tryghost/pretty-cli": "3.0.3",
     "bluebird": "3.7.2",
     "got": "11.8.6",
     "lodash": "4.17.23"
   },
-  "gitHead": "c5d1ebb864969de89c1e8a8dcac3f577bceee1dd"
+  "gitHead": "258ac0821f5b06978db14cc5c1879efdf33b927c"
 }