41 lines
1.5 KiB
Go
41 lines
1.5 KiB
Go
package repository
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
|
|
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
|
)
|
|
|
|
// 创建域名与初始 DNS 绑定共用一个事务，自动续期看不到未绑定的中间状态。
|
|
func (r *SQLProjectMemberRepository) validateInitialDNSBinding(ctx context.Context, tx *sql.Tx, actorID string, item domain.Domain, challengeType string) error {
|
|
if item.DNSAccountID == "" {
|
|
if item.DNSBindingID != "" || item.InitialDNSRevision != 0 {
|
|
return ErrDNSBindingInvalid
|
|
}
|
|
return nil
|
|
}
|
|
if !domain.ValidProjectID(item.DNSAccountID) || !domain.ValidProjectID(item.DNSBindingID) || item.InitialDNSRevision < 1 || challengeType != domain.ChallengeDNS01 {
|
|
return ErrDNSBindingInvalid
|
|
}
|
|
if err := r.authorizeProjectTransaction(ctx, tx, actorID, item.ProjectID, domain.PermissionDNSCredentialUse); err != nil {
|
|
return err
|
|
}
|
|
var projectID, provider, status, verification string
|
|
var revision int64
|
|
if err := tx.QueryRowContext(ctx, Rebind(r.driver, `SELECT project_id, provider, status, verification_state, revision FROM dns_accounts WHERE id = ?`+r.resourceWriteLock()), item.DNSAccountID).
|
|
Scan(&projectID, &provider, &status, &verification, &revision); err != nil {
|
|
return ErrDNSBindingInvalid
|
|
}
|
|
if projectID != item.ProjectID {
|
|
return ErrProjectAccessDenied
|
|
}
|
|
if revision != item.InitialDNSRevision {
|
|
return ErrDNSAccountConflict
|
|
}
|
|
if provider != item.DNSProvider || status != domain.DNSAccountActive || verification != domain.DNSAccountVerified {
|
|
return ErrDNSBindingInvalid
|
|
}
|
|
return nil
|
|
}
|