openship 0.1.0 → 0.1.1

package/apps/api/src/modules/domains/domain.routes.ts

@@ -1,9 +1,24 @@
+/**
+ * Domain routes — mounted at /api/domains in app.ts.
+ *
+ * All routes require authentication.
+ */
+
 import { Hono } from "hono";
-import * as domainController from "./domain.controller";
+import { authMiddleware } from "../../middleware";
+import * as ctrl from "./domain.controller";
 
 export const domainRoutes = new Hono();
 
-domainRoutes.get("/", domainController.list);
-domainRoutes.post("/", domainController.add);
-domainRoutes.delete("/:id", domainController.remove);
-domainRoutes.post("/:id/verify", domainController.verify);
+/* All domain routes require authentication */
+domainRoutes.use("*", authMiddleware);
+
+/* ─── Domains ──────────────────────────────────────────────────────────── */
+domainRoutes.get("/", ctrl.list);
+domainRoutes.post("/", ctrl.add);
+domainRoutes.post("/preview", ctrl.preview);
+domainRoutes.delete("/:id", ctrl.remove);
+domainRoutes.post("/:id/verify", ctrl.verify);
+domainRoutes.get("/:id/records", ctrl.records);
+domainRoutes.post("/:id/renew", ctrl.renewSsl);
+domainRoutes.post("/renew-all", ctrl.renewAllSsl);

package/apps/api/src/modules/domains/domain.schema.ts

@@ -0,0 +1,35 @@
+/**
+ * Domain validation schemas — TypeBox for Hono route validation.
+ */
+
+import { Type, type Static } from "@sinclair/typebox";
+
+// ─── Route params ────────────────────────────────────────────────────────────
+
+export const DomainIdParam = Type.Object({
+  id: Type.String({ minLength: 1 }),
+});
+
+// ─── Query params ────────────────────────────────────────────────────────────
+
+export const ListDomainsQuery = Type.Object({
+  projectId: Type.String({ minLength: 1 }),
+});
+
+// ─── Request bodies ──────────────────────────────────────────────────────────
+
+export const AddDomainBody = Type.Object({
+  projectId: Type.String({ minLength: 1 }),
+  hostname: Type.String({
+    minLength: 1,
+    maxLength: 253,
+    pattern: "^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}$",
+  }),
+  isPrimary: Type.Optional(Type.Boolean({ default: false })),
+});
+
+// ─── Inferred types ──────────────────────────────────────────────────────────
+
+export type TDomainIdParam = Static<typeof DomainIdParam>;
+export type TListDomainsQuery = Static<typeof ListDomainsQuery>;
+export type TAddDomainBody = Static<typeof AddDomainBody>;

package/apps/api/src/modules/domains/domain.service.ts

@@ -1,19 +1,385 @@
 /**
- * Domain service — manage custom domains and SSL certificates.
+ * Domain service — custom domains, DNS verification, SSL certificates.
+ *
+ * Cloud mode  → CNAME (target from Oblien) + TXT (verification hash)
+ * Self-hosted → A record (server IP)       + TXT (verification hash)
+ *
+ * verifyDomain only checks DNS. SSL & routing are separate concerns.
  */
 
-export async function addDomain(projectId: string, domain: string) {
-  // TODO: Store domain, create TXT verification record
+import { createHmac } from "node:crypto";
+import dns from "node:dns/promises";
+import { repos, type Domain } from "@repo/db";
+import { NotFoundError, ConflictError, ForbiddenError } from "@repo/core";
+import { platform } from "../../lib/controller-helpers";
+import { env } from "../../config/env";
+import type { TAddDomainBody } from "./domain.schema";
+import type { CloudRuntime } from "@repo/adapters";
+
+// ─── Token ───────────────────────────────────────────────────────────────────
+
+/**
+ * Deterministic verification token for a hostname.
+ * HMAC-SHA256(hostname, secret) → hex prefix. Same input always produces
+ * the same output so preview and stored tokens match.
+ */
+function generateToken(hostname: string): string {
+  return createHmac("sha256", env.BETTER_AUTH_SECRET)
+    .update(hostname.toLowerCase())
+    .digest("hex")
+    .slice(0, 16);
+}
+
+// ─── List ────────────────────────────────────────────────────────────────────
+
+export async function listDomains(projectId: string, userId: string) {
+  const project = await repos.project.findById(projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Project", projectId);
+  }
+  return repos.domain.listByProject(projectId);
+}
+
+// ─── Add ─────────────────────────────────────────────────────────────────────
+
+export async function addDomain(userId: string, data: TAddDomainBody) {
+  const project = await repos.project.findById(data.projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Project", data.projectId);
+  }
+
+  const existing = await repos.domain.findByHostname(data.hostname);
+  if (existing) {
+    throw new ConflictError(`Domain "${data.hostname}" is already in use`);
+  }
+
+  const token = generateToken(data.hostname);
+
+  const domain = await repos.domain.create({
+    projectId: data.projectId,
+    hostname: data.hostname,
+    isPrimary: data.isPrimary ?? false,
+    verificationToken: token,
+  });
+
+  if (data.isPrimary) {
+    await repos.domain.setPrimary(data.projectId, domain.id);
+  }
+
+  const records = await buildRecords(domain.hostname, token);
+  return { domain, records };
+}
+
+// ─── Preview records (no auth, no DB write) ──────────────────────────────────
+
+export async function previewRecords(hostname: string) {
+  const token = generateToken(hostname);
+  return buildRecords(hostname, token);
+}
+
+// ─── Get DNS records (existing domain) ───────────────────────────────────────
+
+export async function getDomainRecords(domainId: string, userId: string) {
+  const domain = await getDomainWithAuth(domainId, userId);
+  const token = domain.verificationToken ?? generateToken(domain.hostname);
+  return buildRecords(domain.hostname, token);
+}
+
+// ─── Verify ──────────────────────────────────────────────────────────────────
+//
+// Only checks DNS records. Does NOT provision SSL or register routes.
+
+export async function verifyDomain(domainId: string, userId: string) {
+  const domain = await getDomainWithAuth(domainId, userId);
+
+  if (domain.verified) {
+    return { verified: true, cnameVerified: true, txtVerified: true, message: "Already verified" };
+  }
+
+  const { target } = platform();
+  const token = domain.verificationToken ?? generateToken(domain.hostname);
+
+  // 1. Routing record — cloud: CNAME via Oblien, self-hosted: A record
+  const routeOk = target === "cloud"
+    ? await verifyCname(domain.hostname)
+    : await verifyARecord(domain.hostname);
+
+  // 2. Ownership — TXT record with verification hash
+  const txtOk = await verifyTxt(domain.hostname, token);
+
+  if (routeOk && txtOk) {
+    await repos.domain.markVerified(domainId);
+    return { verified: true, cnameVerified: true, txtVerified: true, message: "Domain verified" };
+  }
+
+  return {
+    verified: false,
+    cnameVerified: routeOk,
+    txtVerified: txtOk,
+    message: verifyMessage(domain.hostname, token, routeOk, txtOk, target),
+  };
+}
+
+// ─── Remove ──────────────────────────────────────────────────────────────────
+
+export async function removeDomain(domainId: string, userId: string) {
+  const domain = await getDomainWithAuth(domainId, userId);
+
+  try {
+    const { routing } = platform();
+    await routing.removeRoute(domain.hostname);
+  } catch (err) {
+    console.error(`[DOMAIN] Failed to remove route for ${domain.hostname}:`, err);
+  }
+
+  await repos.domain.remove(domainId);
 }
 
-export async function verifyDomain(domainId: string) {
-  // TODO: DNS lookup to check verification
+// ─── SSL ─────────────────────────────────────────────────────────────────────
+
+export async function renewDomainSsl(domainId: string, userId: string) {
+  const domain = await getDomainWithAuth(domainId, userId);
+
+  if (!domain.verified) {
+    throw new ForbiddenError("Domain must be verified before SSL can be renewed");
+  }
+
+  const { ssl } = platform();
+  const result = await ssl.renewCert(domain.hostname);
+
+  await repos.domain.updateSsl(domainId, {
+    sslStatus: "active",
+    sslExpiresAt: new Date(result.expiresAt),
+    sslIssuer: result.issuer,
+  });
+
+  return {
+    domain: domain.hostname,
+    sslStatus: "active",
+    expiresAt: result.expiresAt,
+    issuer: result.issuer,
+  };
 }
 
-export async function removeDomain(domainId: string) {
-  // TODO: Remove domain and revoke certificate
+export { renewExpiringCerts } from "../../lib/ssl-scheduler";
+
+export async function renewUserCerts(userId: string) {
+  const projects = await repos.project.listByUser(userId, { page: 1, perPage: 1000 });
+  const results: Array<{ domain: string; status: string; error?: string }> = [];
+
+  for (const p of projects.rows) {
+    const domains = await repos.domain.listByProject(p.id);
+    for (const d of domains) {
+      if (d.sslStatus !== "active" || !d.sslExpiresAt) continue;
+      const daysLeft = (new Date(d.sslExpiresAt).getTime() - Date.now()) / (1000 * 60 * 60 * 24);
+      if (daysLeft > 14) continue;
+      try {
+        await renewDomainSsl(d.id, userId);
+        results.push({ domain: d.hostname, status: "renewed" });
+      } catch (err) {
+        results.push({ domain: d.hostname, status: "failed", error: err instanceof Error ? err.message : String(err) });
+      }
+    }
+  }
+
+  return { renewed: results.filter((r) => r.status === "renewed").length, results };
 }
 
-export async function provisionSSL(domain: string) {
-  // TODO: Issue Let's Encrypt certificate
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+async function getDomainWithAuth(domainId: string, userId: string): Promise<Domain> {
+  const domain = await repos.domain.findById(domainId);
+  if (!domain) throw new NotFoundError("Domain", domainId);
+
+  const project = await repos.project.findById(domain.projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Domain", domainId);
+  }
+
+  return domain;
+}
+
+// ── DNS resolution (Google DNS-over-HTTPS → node:dns fallback) ───────────────
+
+const GOOGLE_DNS = "https://dns.google/resolve";
+
+interface GoogleDnsAnswer {
+  name: string;
+  type: number;
+  data: string;
+}
+
+/** Query Google public DNS API. Falls back to node:dns on failure. */
+async function resolveRecords(
+  name: string,
+  type: "A" | "CNAME" | "TXT",
+): Promise<string[]> {
+  const rrtype: Record<string, number> = { A: 1, CNAME: 5, TXT: 16 };
+
+  try {
+    const url = `${GOOGLE_DNS}?name=${encodeURIComponent(name)}&type=${rrtype[type]}`;
+    const res = await fetch(url, {
+      headers: { accept: "application/dns-json" },
+      signal: AbortSignal.timeout(5_000),
+    });
+
+    if (res.ok) {
+      const json = (await res.json()) as { Answer?: GoogleDnsAnswer[] };
+      return (json.Answer ?? []).map((a) => a.data.replace(/^"|"$/g, ""));
+    }
+  } catch { /* Google DNS unreachable */ }
+
+  // Fallback — local resolver
+  try {
+    switch (type) {
+      case "A":
+        return await dns.resolve4(name);
+      case "CNAME":
+        return await dns.resolveCname(name);
+      case "TXT": {
+        const rows = await dns.resolveTxt(name);
+        return rows.flat();
+      }
+    }
+  } catch { /* no records */ }
+
+  return [];
+}
+
+// ── DNS checks ───────────────────────────────────────────────────────────────
+
+/** Cloud: ask Oblien if the CNAME is pointing correctly. */
+async function verifyCname(hostname: string): Promise<boolean> {
+  const { runtime } = platform();
+  try {
+    const cloud = runtime as CloudRuntime;
+    const result = await cloud.verifyDomain(hostname);
+    return result.cname;
+  } catch {
+    return false;
+  }
+}
+
+/** Self-hosted: check if an A record resolves to our server IP. */
+async function verifyARecord(hostname: string): Promise<boolean> {
+  const serverIp = await getServerIp();
+  if (!serverIp) return false;
+
+  const records = await resolveRecords(hostname, "A");
+  return records.includes(serverIp);
+}
+
+/** Check _openship-challenge.{hostname} TXT record for verification token. */
+async function verifyTxt(hostname: string, token: string): Promise<boolean> {
+  const records = await resolveRecords(`_openship-challenge.${hostname}`, "TXT");
+  return records.some((v) => v === token);
+}
+
+// ── Server IP detection ──────────────────────────────────────────────────────
+
+let cachedServerIp: string | null = null;
+
+/** Resolve the server's public IP: SERVER_IP env → ipify API → BETTER_AUTH_URL. */
+async function getServerIp(): Promise<string | null> {
+  if (cachedServerIp) return cachedServerIp;
+
+  // 1. Explicit env
+  if (env.SERVER_IP) {
+    cachedServerIp = env.SERVER_IP;
+    return cachedServerIp;
+  }
+
+  // 2. Auto-detect via ipify
+  try {
+    const res = await fetch("https://api.ipify.org?format=json", {
+      signal: AbortSignal.timeout(3_000),
+    });
+    if (res.ok) {
+      const { ip } = (await res.json()) as { ip: string };
+      if (ip) {
+        cachedServerIp = ip;
+        return cachedServerIp;
+      }
+    }
+  } catch { /* ipify unreachable */ }
+
+  // 3. Fallback — parse BETTER_AUTH_URL hostname if it's an IP
+  try {
+    const host = new URL(env.BETTER_AUTH_URL).hostname;
+    if (host !== "localhost" && host !== "127.0.0.1" && host !== "0.0.0.0") {
+      cachedServerIp = host;
+      return cachedServerIp;
+    }
+  } catch { /* invalid URL */ }
+
+  return null;
+}
+
+// ── Record generation ────────────────────────────────────────────────────────
+
+type DnsRecord =
+  | { type: "CNAME"; host: string; value: string }
+  | { type: "A"; host: string; value: string }
+  | { type: "TXT"; host: string; value: string };
+
+/**
+ * Build the DNS records the user needs to add.
+ *
+ * Cloud       → CNAME @ → <target from Oblien>
+ * Self-hosted → A     @ → <server public IP>
+ * Both        → TXT _openship-challenge → <verification hash>
+ */
+async function buildRecords(
+  hostname: string,
+  token: string,
+): Promise<{ mode: "cloud" | "selfhosted"; records: DnsRecord[] }> {
+  const { target, runtime } = platform();
+
+  const txt: DnsRecord = { type: "TXT", host: "_openship-challenge", value: token };
+
+  if (target === "cloud") {
+    let cnameTarget: string | null = null;
+    try {
+      const cloud = runtime as CloudRuntime;
+      const result = await cloud.verifyDomain(hostname);
+      cnameTarget = result.requiredRecords.cname.target;
+    } catch { /* Oblien unreachable */ }
+
+    return {
+      mode: "cloud",
+      records: [{ type: "CNAME", host: "@", value: cnameTarget ?? "" }, txt],
+    };
+  }
+
+  // Self-hosted — A record
+  const serverIp = await getServerIp();
+  return {
+    mode: "selfhosted",
+    records: [{ type: "A", host: "@", value: serverIp ?? "" }, txt],
+  };
+}
+
+/** Build a human-readable verification failure message. */
+function verifyMessage(
+  hostname: string,
+  token: string,
+  routeOk: boolean,
+  txtOk: boolean,
+  target: string,
+): string {
+  const parts: string[] = [];
+
+  if (!routeOk) {
+    parts.push(
+      target === "cloud"
+        ? `CNAME record not found for ${hostname}`
+        : `A record not pointing to server for ${hostname}`,
+    );
+  }
+
+  if (!txtOk) {
+    parts.push(`TXT record _openship-challenge.${hostname} must equal "${token}"`);
+  }
+
+  return parts.join(". ");
 }