selfpost/internal/store/domains.go

package store

import (
	"database/sql"
	"errors"
	"fmt"
	"strings"
	"time"

	"modernc.org/sqlite"
	sqlite3 "modernc.org/sqlite/lib"
)

// ErrDomainExists is returned by AddDomain when the domain is already managed.
var ErrDomainExists = errors.New("domain already exists")

// ErrDomainNotFound is returned when a domain id/name does not exist.
var ErrDomainNotFound = errors.New("domain not found")

// Domain is a sending domain managed through the panel (product.md §
// Multi-domain model). The DKIM key material itself lives on disk under /data;
// this row records the selector and metadata. AppCount is populated by the
// listing queries, not stored.
type Domain struct {
	ID           int64
	Name         string
	DKIMSelector string
	// Where DMARC aggregate reports go: the address itself, "" meaning no
	// reports (which is what a new domain has). Whether it is the hosted
	// address or one typed for the domain is told by its value; the store does
	// not know the server's hostname.
	DMARCRua  string
	CreatedAt time.Time
	AppCount  int
}

// AddDomain inserts a new sending domain. The caller is responsible for having
// validated name (security.md) before it reaches SQL; the query is parameterised
// regardless. A duplicate name maps to ErrDomainExists.
func (s *Store) AddDomain(name, selector string) (Domain, error) {
	now := time.Now().UTC()
	res, err := s.db.Exec(
		"INSERT INTO domains (name, dkim_selector, created_at) VALUES (?, ?, ?)",
		name, selector, now.Format(time.RFC3339),
	)
	if err != nil {
		if isUniqueViolation(err) {
			return Domain{}, ErrDomainExists
		}
		return Domain{}, fmt.Errorf("insert domain: %w", err)
	}
	id, err := res.LastInsertId()
	if err != nil {
		return Domain{}, fmt.Errorf("domain id: %w", err)
	}
	return Domain{ID: id, Name: name, DKIMSelector: selector, CreatedAt: now}, nil
}

// ListDomains returns every domain with its bound-application count (product.md),
// ordered by name.
func (s *Store) ListDomains() ([]Domain, error) {
	rows, err := s.db.Query(`
		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
		FROM domains d
		ORDER BY d.name`)
	if err != nil {
		return nil, fmt.Errorf("list domains: %w", err)
	}
	defer rows.Close()

	var out []Domain
	for rows.Next() {
		d, err := scanDomain(rows)
		if err != nil {
			return nil, err
		}
		out = append(out, d)
	}
	return out, rows.Err()
}

// ListDomainsForUser returns the sending domains a domain user reaches, with
// application counts, ordered by name: the assigned ones, or every domain when
// the user's All flag is set — which is how a domain added later is included.
// The filter is in the query, so a caller cannot forget it.
func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
	rows, err := s.db.Query(`
		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
		FROM domains d
		WHERE EXISTS (SELECT 1 FROM users u WHERE u.id = ? AND u.all_domains = 1)
		   OR EXISTS (SELECT 1 FROM user_domains ud WHERE ud.user_id = ? AND ud.domain_id = d.id)
		ORDER BY d.name`, userID, userID)
	if err != nil {
		return nil, fmt.Errorf("list domains for user: %w", err)
	}
	defer rows.Close()

	var out []Domain
	for rows.Next() {
		d, err := scanDomain(rows)
		if err != nil {
			return nil, err
		}
		out = append(out, d)
	}
	return out, rows.Err()
}

// GetDomain returns a single domain (with its application count) by id, or
// ErrDomainNotFound.
func (s *Store) GetDomain(id int64) (Domain, error) {
	row := s.db.QueryRow(`
		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
		FROM domains d
		WHERE d.id = ?`, id)
	d, err := scanDomain(row)
	if errors.Is(err, sql.ErrNoRows) {
		return Domain{}, ErrDomainNotFound
	}
	if err != nil {
		return Domain{}, err
	}
	return d, nil
}

// DeleteDomain removes a domain. Its applications and their address/binding rows
// go with it via ON DELETE CASCADE (product.md). Returns ErrDomainNotFound if no
// such row existed.
func (s *Store) DeleteDomain(id int64) error {
	res, err := s.db.Exec("DELETE FROM domains WHERE id = ?", id)
	if err != nil {
		return fmt.Errorf("delete domain: %w", err)
	}
	n, err := res.RowsAffected()
	if err != nil {
		return fmt.Errorf("delete domain rows: %w", err)
	}
	if n == 0 {
		return ErrDomainNotFound
	}
	return nil
}

// scanRow is the minimal surface shared by *sql.Row and *sql.Rows.
type scanRow interface {
	Scan(dest ...any) error
}

func scanDomain(r scanRow) (Domain, error) {
	var (
		d         Domain
		createdAt string
	)
	if err := r.Scan(&d.ID, &d.Name, &d.DKIMSelector, &d.DMARCRua, &createdAt, &d.AppCount); err != nil {
		return Domain{}, err
	}
	d.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
	return d, nil
}

// isForeignKeyViolation reports whether err is a SQLite FOREIGN KEY conflict.
func isForeignKeyViolation(err error) bool {
	var se *sqlite.Error
	return errors.As(err, &se) && se.Code() == sqlite3.SQLITE_CONSTRAINT_FOREIGNKEY
}

// isUniqueViolation reports whether err is a SQLite UNIQUE/PRIMARY-KEY conflict,
// so callers can turn a duplicate insert into a friendly domain-level error.
func isUniqueViolation(err error) bool {
	var se *sqlite.Error
	if errors.As(err, &se) {
		code := se.Code()
		return code == sqlite3.SQLITE_CONSTRAINT_UNIQUE || code == sqlite3.SQLITE_CONSTRAINT_PRIMARYKEY
	}
	return false
}

// SetDomainDMARCAddress sets where the domain's aggregate reports go; "" means
// no reports.
func (s *Store) SetDomainDMARCAddress(id int64, rua string) error {
	res, err := s.db.Exec("UPDATE domains SET dmarc_rua = ? WHERE id = ?", rua, id)
	if err != nil {
		return fmt.Errorf("update domain dmarc rua: %w", err)
	}
	n, err := res.RowsAffected()
	if err != nil {
		return fmt.Errorf("update domain dmarc rua rows: %w", err)
	}
	if n == 0 {
		return ErrDomainNotFound
	}
	return nil
}

// DomainExists reports whether a sending domain with this name is configured.
// Used by the DMARC ingest path to refuse reports for domains this relay does
// not send for (security.md: report XML is attacker-supplied input).
func (s *Store) DomainExists(name string) (bool, error) {
	var n int
	err := s.db.QueryRow(
		"SELECT COUNT(*) FROM domains WHERE name = ? COLLATE NOCASE", strings.TrimSpace(name),
	).Scan(&n)
	if err != nil {
		return false, fmt.Errorf("domain exists %q: %w", name, err)
	}
	return n > 0, nil
}