check validity of CNAME and TXT records via worker; clean sub-select; middleware slight readability

Author: Soxasora

components/sub-select.js

@@ -52,8 +52,6 @@ export function useSubs ({ prependSubs = DEFAULT_PREPEND_SUBS, sub, filterSubs =
       ...appendSubs])
   }, [data])
 
-  // TODO: can pass custom domain
-
   return subs
 }
 
@@ -81,8 +79,6 @@ export default function SubSelect ({ prependSubs, sub, onChange, size, appendSub
           return
         }
 
-        // TODO: redirect to the custom domain if it has one
-
         let asPath
         // are we currently in a sub (ie not home)
         if (router.query.sub) {

middleware.js

@@ -94,13 +94,12 @@ export async function customDomainMiddleware (request, referrerResp) {
 // TODO: dirty of previous iterations, refactor
 // UNSAFE UNSAFE UNSAFE tokens are visible in the URL
 export function customDomainAuthMiddleware (request, url) {
-  const pathname = url.pathname
   const host = request.headers.get('host')
-  const authDomain = process.env.NEXT_PUBLIC_URL
-  const isCustomDomain = host !== process.env.NEXT_PUBLIC_URL.replace(/^https?:\/\//, '')
-  const secure = process.env.NODE_ENV === 'development'
+  const mainDomain = process.env.NEXT_PUBLIC_URL
+  const pathname = url.pathname
 
   // check for session both in session token and in multi_auth cookie
+  const secure = process.env.NODE_ENV === 'development' // TODO: change this to production
   const sessionCookieName = secure ? '__Secure-next-auth.session-token' : 'next-auth.session-token'
   const multiAuthUserId = request.cookies.get('multi_auth.user-id')?.value
 
@@ -112,14 +111,14 @@ export function customDomainAuthMiddleware (request, url) {
   const hasSession = hasActiveSession || hasMultiAuthSession
   const response = NextResponse.next()
 
-  if (!hasSession && isCustomDomain) {
+  if (!hasSession) {
     // TODO: original request url points to localhost, this is a workaround atm
     const protocol = secure ? 'https' : 'http'
     const originalDomain = `${protocol}://${host}`
     const redirectTarget = `${originalDomain}${pathname}`
 
     // Create the auth sync URL with the correct original domain
-    const syncUrl = new URL(`${authDomain}/api/auth/sync`)
+    const syncUrl = new URL(`${mainDomain}/api/auth/sync`)
     syncUrl.searchParams.set('redirectUrl', redirectTarget)
 
     console.log('AUTH: Redirecting to:', syncUrl.toString())

prisma/migrations/20250311105915_verify_dns_records/migration.sql

@@ -0,0 +1,10 @@
+/*
+  Warnings:
+
+  - Added the required column `cname` to the `CustomDomain` table without a default value. This is not possible if the table is not empty.
+  - Added the required column `verificationTxt` to the `CustomDomain` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- AlterTable
+ALTER TABLE "CustomDomain" ADD COLUMN     "cname" TEXT NOT NULL,
+ADD COLUMN     "verificationTxt" TEXT NOT NULL;

prisma/migrations/20250311112522_domain_verification_job/migration.sql

@@ -0,0 +1,17 @@
+CREATE OR REPLACE FUNCTION schedule_domain_verification_job()
+RETURNS INTEGER
+LANGUAGE plpgsql
+AS $$
+DECLARE
+BEGIN
+    -- every 5 minutes
+    INSERT INTO pgboss.schedule (name, cron, timezone)
+    VALUES ('domainVerification', '*/5 * * * *', 'America/Chicago') ON CONFLICT DO NOTHING;
+    return 0;
+EXCEPTION WHEN OTHERS THEN
+    return 0;
+END;
+$$;
+
+SELECT schedule_domain_verification_job();
+DROP FUNCTION IF EXISTS schedule_domain_verification_job;

prisma/schema.prisma

@@ -1212,6 +1212,8 @@ model CustomDomain {
   sslCertExpiry     DateTime?
   verificationState String?
   lastVerifiedAt    DateTime?
+  cname             String
+  verificationTxt   String
   
   @@index([domain])
   @@index([createdAt])

worker/domainVerification.js

@@ -0,0 +1,83 @@
+import createPrisma from '@/lib/create-prisma'
+import { promises as dnsPromises } from 'node:dns'
+
+// TODO: Add comments
+export async function domainVerification () {
+  const models = createPrisma({ connectionParams: { connection_limit: 1 } })
+
+  try {
+    const domains = await models.customDomain.findMany()
+
+    for (const domain of domains) {
+      const { domain: domainName, verificationTxt, cname, id } = domain
+      try {
+        const { txtValid, cnameValid, error } = await verifyDomain(domainName, verificationTxt, cname)
+        console.log(`${domainName}: TXT ${txtValid ? 'valid' : 'invalid'}, CNAME ${cnameValid ? 'valid' : 'invalid'}`)
+
+        // verificationState is based on the results of the TXT and CNAME checks
+        const verificationState = (txtValid && cnameValid) ? 'VERIFIED' : 'FAILED'
+        await models.customDomain.update({
+          where: { id },
+          data: { verificationState, lastVerifiedAt: new Date() }
+        })
+
+        if (error) {
+          console.log(`${domainName} verification error:`, error)
+        }
+      } catch (error) {
+        console.error(`Failed to verify domain ${domainName}:`, error)
+
+        // Update to FAILED on any error
+        await models.customDomain.update({
+          where: { id },
+          data: { verificationState: 'NOT_VERIFIED', lastVerifiedAt: new Date() }
+        })
+      }
+    }
+  } catch (error) {
+    console.error(error)
+  }
+}
+
+async function verifyDomain (domainName, verificationTxt, cname) {
+  const result = {
+    txtValid: false,
+    cnameValid: false,
+    error: null
+  }
+
+  // TXT Records checking
+  // TODO: we should give a randomly generated string to the user and check if it's included in the TXT record
+  try {
+    const txtRecords = await dnsPromises.resolve(domainName, 'TXT')
+    const txtText = txtRecords.flat().join(' ')
+
+    // the TXT record should include the verificationTxt that we have in the database
+    result.txtValid = txtText.includes(verificationTxt)
+  } catch (error) {
+    if (error.code === 'ENODATA' || error.code === 'ENOTFOUND') {
+      result.error = `TXT record not found: ${error.code}`
+    } else {
+      result.error = `TXT error: ${error.message}`
+    }
+  }
+
+  // CNAME Records checking
+  try {
+    const cnameRecords = await dnsPromises.resolve(domainName, 'CNAME')
+
+    // the CNAME record should include the cname that we have in the database
+    result.cnameValid = cnameRecords.some(record =>
+      record.includes(cname)
+    )
+  } catch (error) {
+    if (!result.error) { // this is to avoid overriding the error from the TXT check
+      if (error.code === 'ENODATA' || error.code === 'ENOTFOUND') {
+        result.error = `CNAME record not found: ${error.code}`
+      } else {
+        result.error = `CNAME error: ${error.message}`
+      }
+    }
+  }
+  return result
+}

worker/index.js

@@ -37,6 +37,7 @@ import { payWeeklyPostBounty, weeklyPost } from './weeklyPosts'
 import { expireBoost } from './expireBoost'
 import { payingActionConfirmed, payingActionFailed } from './payingAction'
 import { autoDropBolt11s } from './autoDropBolt11'
+import { domainVerification } from './domainVerification'
 
 // WebSocket polyfill
 import ws from 'isomorphic-ws'
@@ -122,6 +123,7 @@ async function work () {
     await boss.work('imgproxy', jobWrapper(imgproxy))
     await boss.work('deleteUnusedImages', jobWrapper(deleteUnusedImages))
   }
+  await boss.work('domainVerification', jobWrapper(domainVerification))
   await boss.work('expireBoost', jobWrapper(expireBoost))
   await boss.work('weeklyPost-*', jobWrapper(weeklyPost))
   await boss.work('payWeeklyPostBounty', jobWrapper(payWeeklyPostBounty))