domains: what you own, who runs its DNS, and the keys

one section, not two. a provider serves many domains so the lists differ, but a
person thinks in DOMAINS — the provider is something the check discovers, and a
key only matters as the answer to "can officer do anything for THIS domain".
two tabs would make somebody hold that join in their head, and the providers
tab would be two rows most of the time. so the key is entered from the row that
needs one and stored against its provider: add it for one cloudflare domain and
every other cloudflare domain turns green at once.

THE CHECK runs before you commit, because its answer is usually the reason you
would or would not add it, and a list of unchecked rows is a list somebody has
to remember to revisit.

it reports five verdicts, not two, and the extra three are the interesting
ones. `private` — atelier.officer.dev resolves to 100.64.x, which is CORRECT
and reads as broken against any public-IP comparison. `unknown` — we could not
establish our own address, so "is that us" has no answer and saying so beats a
confident wrong one. `nowhere` — a name bought ten minutes ago. plus
maybeProxied, because a cloudflare domain resolving to cloudflare is a working
setup rather than a misconfiguration.

NS gives the DNS HOST, not the registrar. officer.dev is godaddy on both counts
here, but a domain bought at godaddy and delegated to cloudflare answers
cloudflare — and that is the one that matters, since its API is what places an
ACME challenge. the UI says so where it would otherwise be read as wrong.

only an apex has NS records, so the lookup walks up to find them. verified
live: platform.officer.dev now answers godaddy instead of nothing.

CREDENTIALS are keyed on the provider, encrypted under this plugin's purpose
key, never returned by any route. scope is narrow|broad and NOT read|write —
DNS-01 works by WRITING a TXT record, so no read-only key can ever issue a
certificate, and offering one would produce a setup that looks configured and
fails at the first renewal sixty days later. the dialog says that out loud.

the form is generated from NPM's own dns-providers template, so the field names
are the provider's and it stays right for providers we have never heard of.
the routes live under /_config, which the manifest already marks ownerOnly: a
DNS key can rewrite every record for a domain, which is strictly more than the
NPM login kept there, and declaring it once beats checking it twice.

tables verified by query rather than by db:push's exit code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

api/dns.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test';
+import { providerFromNameservers, normaliseDomain, looksLikeDomain } from './dns';
+
+/**
+ * The pure half of the DNS check.
+ *
+ * `checkDomain` itself talks to a resolver and to a public-IP service, so a test of it would be a test of
+ * this machine's network. What can actually be WRONG without anybody noticing is in here: which provider a
+ * set of nameservers means, and what counts as a domain.
+ */
+
+describe('providerFromNameservers', () => {
+  test('the common ones', () => {
+    expect(providerFromNameservers(['ana.ns.cloudflare.com', 'bob.ns.cloudflare.com'])).toBe('cloudflare');
+    expect(providerFromNameservers(['ns01.domaincontrol.com'])).toBe('godaddy');
+    expect(providerFromNameservers(['ns-1234.awsdns.org'])).toBe('route53');
+    expect(providerFromNameservers(['ns1.digitalocean.com'])).toBe('digitalocean');
+  });
+
+  test('a trailing dot and capitals, which is how resolvers actually answer', () => {
+    expect(providerFromNameservers(['ANA.NS.CLOUDFLARE.COM.'])).toBe('cloudflare');
+  });
+
+  // `ns-cloud-a1.googledomains.com` ends with `google.com`? No — but `ns1.google.com` does, and a shorter
+  // entry must not win over a longer one that also matches. Longest suffix, always.
+  test('the longest matching suffix wins', () => {
+    expect(providerFromNameservers(['ns-cloud-a1.googledomains.com'])).toBe('google');
+  });
+
+  test('an unrecognised nameserver is null rather than a guess', () => {
+    expect(providerFromNameservers(['ns1.some-small-host.example'])).toBeNull();
+    expect(providerFromNameservers([])).toBeNull();
+  });
+});
+
+describe('normaliseDomain', () => {
+  test('strips what people actually paste', () => {
+    expect(normaliseDomain('  https://Officer.dev/some/path  ')).toBe('officer.dev');
+    expect(normaliseDomain('officer.dev.')).toBe('officer.dev');
+    expect(normaliseDomain('HTTP://OFFICER.DEV')).toBe('officer.dev');
+  });
+});
+
+describe('looksLikeDomain', () => {
+  test('accepts real ones, including a subdomain and a long TLD', () => {
+    expect(looksLikeDomain('officer.dev')).toBe(true);
+    expect(looksLikeDomain('sub.officer.dev')).toBe(true);
+    expect(looksLikeDomain('a-b.example.museum')).toBe(true);
+  });
+
+  test('rejects the obvious nonsense, and leaves the rest to DNS', () => {
+    expect(looksLikeDomain('officer')).toBe(false);
+    expect(looksLikeDomain('-officer.dev')).toBe(false);
+    expect(looksLikeDomain('officer .dev')).toBe(false);
+    expect(looksLikeDomain('')).toBe(false);
+  });
+});