nukebase 2.0.5 → 2.0.6

package/lib/project-commands.js

@@ -857,7 +857,9 @@ async function deleteProject() {
 // nukebase domain remove                   disconnect it
 //
 // The guided flow is the dashboard's modal in the terminal: it prints the two
-// A records to create, polls DNS until both point here (Enter to check now,
+// A records and the ownership TXT (nukebase.<domain> = nukebase-uid=<uid>,
+// which the server requires on a domain's first connection so no other
+// account can claim it) to create, polls DNS until they are in place (Enter to check now,
 // Ctrl+C to give up and come back later), then asks the server to verify and
 // issue the certificate — the slow part, up to a minute at Let's Encrypt.
 // --email is the cert contact; it defaults to the account email in
@@ -886,8 +888,9 @@ async function domainCommand() {
   if (sub) {
     if (args.has('wait')) {
       const ip = await regionIp();
-      printDnsRecords(ip);
-      await waitForDns(sub, ip);
+      const needTxt = (await currentDomain()) !== sub;   // already ours: proven when connected
+      printDnsRecords(ip, needTxt);
+      await waitForDns(sub, ip, needTxt);
     }
     await connectDomain(sub, email);
     process.exit(0);
@@ -916,8 +919,8 @@ async function domainCommand() {
     if (!/^[a-z0-9.-]+\.[a-z]{2,}$/.test(domain)) { console.log(`   "${domain}" does not look like a domain.`); domain = ''; }
   }
 
-  printDnsRecords(ip);
-  await waitForDns(domain, ip);
+  printDnsRecords(ip, true);
+  await waitForDns(domain, ip, true);
 
   // Step 3 — the server does the real verification and issues the cert.
   await connectDomain(domain, email);
@@ -962,12 +965,20 @@ async function regionIp() {
   return null;
 }
 
-function printDnsRecords(ip) {
+// The ownership record the server checks on a domain's first connection.
+const domainTxtValue = () => `nukebase-uid=${uid}`;
+
+function printDnsRecords(ip, withTxt) {
   console.log('\n   Step 1 — point it here. At your registrar (GoDaddy, Namecheap,');
   console.log('   Cloudflare, ...) add these DNS records:\n');
-  console.log('     Type   Name   Value');
-  console.log(`     A      @      ${ip || "(this region's IP — see the dashboard)"}`);
-  console.log(`     A      www    ${ip || '(same)'}`);
+  console.log('     Type   Name       Value');
+  console.log(`     A      @          ${ip || "(this region's IP — see the dashboard)"}`);
+  console.log(`     A      www        ${ip || '(same)'}`);
+  if (withTxt) {
+    console.log(`     TXT    nukebase   ${domainTxtValue()}`);
+    console.log('\n   The TXT record proves the domain is yours, so no other account can');
+    console.log('   connect it. One on your main domain covers its subdomains too.');
+  }
   console.log('\n   If you use Cloudflare, set the records to "DNS only" (grey cloud)');
   console.log('   so the certificate can be issued.\n');
 }
@@ -981,7 +992,7 @@ function printDnsRecords(ip) {
 // long after the server sees it — and on some Windows setups Node's own
 // resolver cannot reach the system DNS server at all (ECONNREFUSED on every
 // name). getaddrinfo is the fallback for a machine that blocks 1.1.1.1.
-async function waitForDns(domain, ip) {
+async function waitForDns(domain, ip, needTxt) {
   console.log('   Step 2 — waiting for DNS. This can take a few minutes.');
   console.log('   Press Enter to check now, Ctrl+C to stop and come back later.\n');
   const dns = require('dns').promises;
@@ -990,19 +1001,31 @@ async function waitForDns(domain, ip) {
     try { return await pub.resolve4(name); } catch (e) {}
     try { return (await dns.lookup(name, { all: true, family: 4 })).map(a => a.address); } catch (e) { return []; }
   };
-  let apexOk = false, wwwOk = false;
+  // Same rule as the server: nukebase.<domain>, then each parent.
+  const want = domainTxtValue().toLowerCase();
+  const txtFound = async () => {
+    const labels = domain.split('.');
+    for (let i = 0; i <= labels.length - 2; i++) {
+      let recs;
+      try { recs = await pub.resolveTxt('nukebase.' + labels.slice(i).join('.')); } catch (e) { continue; }
+      if (recs.some(chunks => chunks.join('').trim().toLowerCase() === want)) return true;
+    }
+    return false;
+  };
+  let apexOk = false, wwwOk = false, txtOk = !needTxt;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   let poke = null;
   rl.on('line', () => { if (poke) poke(); });
   const wait = (ms) => new Promise(res => { poke = res; setTimeout(res, ms); });
   try {
     for (;;) {
-      const [apex, www] = await Promise.all([lookup(domain), lookup(`www.${domain}`)]);
+      const [apex, www, txt] = await Promise.all([lookup(domain), lookup(`www.${domain}`), needTxt ? txtFound() : true]);
       apexOk = ip ? apex.includes(ip) : apex.length > 0;
       wwwOk = ip ? www.includes(ip) : www.length > 0;
+      txtOk = txt;
       const mark = ok => ok ? '✓' : '…';
-      process.stdout.write(`\r   ${mark(apexOk)} ${domain} ${apex.length ? '→ ' + apex.join(', ') : '(no record yet)'}   ${mark(wwwOk)} www ${www.length ? '→ ' + www.join(', ') : '(no record yet)'}      `);
-      if (apexOk) break;
+      process.stdout.write(`\r   ${mark(apexOk)} ${domain} ${apex.length ? '→ ' + apex.join(', ') : '(no record yet)'}   ${mark(wwwOk)} www ${www.length ? '→ ' + www.join(', ') : '(no record yet)'}${needTxt ? `   ${mark(txtOk)} TXT ${txtOk ? 'found' : '(not yet)'}` : ''}      `);
+      if (apexOk && txtOk) break;
       await wait(15000);
     }
   } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nukebase",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "NukeBase CLI: create, deploy and manage NukeBase projects",
   "bin": {
     "nukebase": "bin/nukebase.js"
@@ -17,6 +17,13 @@
     "ws": "^8.20.0"
   },
   "homepage": "https://nukebase.com",
-  "keywords": ["nukebase", "database", "realtime", "hosting", "cli", "deploy"],
+  "keywords": [
+    "nukebase",
+    "database",
+    "realtime",
+    "hosting",
+    "cli",
+    "deploy"
+  ],
   "license": "MIT"
 }