Build a Custom Domain SSL Provisioner

// src/domains/provisioner.ts — Custom domain SSL with Let's Encrypt and auto-renewal
import { pool } from "../db";
import { Redis } from "ioredis";
import { randomBytes } from "node:crypto";
import { Resolver } from "node:dns/promises";

const redis = new Redis(process.env.REDIS_URL!);
const resolver = new Resolver();

interface CustomDomain {
  id: string;
  customerId: string;
  domain: string;
  status: "pending_dns" | "verifying" | "provisioning" | "active" | "error" | "expired";
  dnsVerified: boolean;
  sslStatus: "none" | "provisioning" | "active" | "renewing" | "expired" | "error";
  sslExpiresAt: string | null;
  dnsRecords: { type: string; name: string; value: string; verified: boolean }[];
  errorMessage: string | null;
  createdAt: string;
}

const PLATFORM_CNAME = process.env.PLATFORM_CNAME || "app.platform.com";
const ACME_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";

// Add custom domain
export async function addDomain(customerId: string, domain: string): Promise<CustomDomain> {
  // Validate domain format
  if (!/^([a-z0-9-]+\.)+[a-z]{2,}$/i.test(domain)) {
    throw new Error("Invalid domain format");
  }

  // Check not already registered
  const { rows: [existing] } = await pool.query(
    "SELECT id FROM custom_domains WHERE domain = $1", [domain]
  );
  if (existing) throw new Error("Domain already registered");

  const id = `dom-${randomBytes(6).toString("hex")}`;
  const verificationToken = randomBytes(16).toString("hex");

  const dnsRecords = [
    { type: "CNAME", name: domain, value: PLATFORM_CNAME, verified: false },
    { type: "TXT", name: `_acme-challenge.${domain}`, value: verificationToken, verified: false },
  ];

  const customDomain: CustomDomain = {
    id, customerId, domain,
    status: "pending_dns",
    dnsVerified: false,
    sslStatus: "none",
    sslExpiresAt: null,
    dnsRecords,
    errorMessage: null,
    createdAt: new Date().toISOString(),
  };

  await pool.query(
    `INSERT INTO custom_domains (id, customer_id, domain, status, dns_verified, ssl_status, dns_records, created_at)
     VALUES ($1, $2, $3, 'pending_dns', false, 'none', $4, NOW())`,
    [id, customerId, domain, JSON.stringify(dnsRecords)]
  );

  return customDomain;
}

// Verify DNS configuration
export async function verifyDNS(domainId: string): Promise<{ verified: boolean; details: string[] }> {
  const { rows: [dom] } = await pool.query("SELECT * FROM custom_domains WHERE id = $1", [domainId]);
  if (!dom) throw new Error("Domain not found");

  const records = JSON.parse(dom.dns_records);
  const details: string[] = [];
  let allVerified = true;

  for (const record of records) {
    try {
      if (record.type === "CNAME") {
        const cnames = await resolver.resolveCname(record.name).catch(() => []);
        const verified = cnames.some((c: string) => c.endsWith(record.value) || c === record.value + ".");
        record.verified = verified;
        details.push(`CNAME ${record.name}: ${verified ? "✓ verified" : "✗ not found (expected: " + record.value + ")"}`); 
        if (!verified) allVerified = false;
      } else if (record.type === "TXT") {
        const txts = await resolver.resolveTxt(`_acme-challenge.${dom.domain}`).catch(() => []);
        const verified = txts.some((t: string[]) => t.join("").includes(record.value));
        record.verified = verified;
        details.push(`TXT _acme-challenge: ${verified ? "✓ verified" : "✗ not found"}`);
        if (!verified) allVerified = false;
      }
    } catch (e: any) {
      record.verified = false;
      details.push(`${record.type} ${record.name}: ✗ DNS error (${e.code || e.message})`);
      allVerified = false;
    }
  }

  await pool.query(
    "UPDATE custom_domains SET dns_verified = $2, dns_records = $3, status = $4 WHERE id = $1",
    [domainId, allVerified, JSON.stringify(records), allVerified ? "verifying" : "pending_dns"]
  );

  if (allVerified) {
    // Auto-trigger SSL provisioning
    provisionSSL(domainId).catch(() => {});
  }

  return { verified: allVerified, details };
}

// Provision SSL certificate
export async function provisionSSL(domainId: string): Promise<void> {
  const { rows: [dom] } = await pool.query("SELECT * FROM custom_domains WHERE id = $1", [domainId]);
  if (!dom || !dom.dns_verified) throw new Error("DNS not verified");

  await pool.query(
    "UPDATE custom_domains SET ssl_status = 'provisioning', status = 'provisioning' WHERE id = $1",
    [domainId]
  );

  try {
    // In production: use ACME protocol (node-acme-client) to get Let's Encrypt cert
    // Simplified: simulate certificate provisioning
    const expiresAt = new Date(Date.now() + 90 * 86400000).toISOString();  // 90 days

    await pool.query(
      "UPDATE custom_domains SET ssl_status = 'active', ssl_expires_at = $2, status = 'active', error_message = NULL WHERE id = $1",
      [domainId, expiresAt]
    );

    // Configure reverse proxy routing
    await redis.set(`domain:route:${dom.domain}`, JSON.stringify({
      customerId: dom.customer_id, domainId, sslActive: true,
    }));

    // Schedule renewal check (60 days from now)
    await redis.setex(`domain:renew:${domainId}`, 60 * 86400, "check");

  } catch (error: any) {
    await pool.query(
      "UPDATE custom_domains SET ssl_status = 'error', status = 'error', error_message = $2 WHERE id = $1",
      [domainId, error.message]
    );
  }
}

// Check and renew expiring certificates
export async function checkRenewals(): Promise<{ renewed: number; errors: number }> {
  const { rows: expiring } = await pool.query(
    `SELECT * FROM custom_domains WHERE ssl_status = 'active' AND ssl_expires_at < NOW() + INTERVAL '30 days'`
  );

  let renewed = 0, errors = 0;

  for (const dom of expiring) {
    try {
      await pool.query("UPDATE custom_domains SET ssl_status = 'renewing' WHERE id = $1", [dom.id]);
      await provisionSSL(dom.id);
      renewed++;
    } catch {
      errors++;
    }
  }

  return { renewed, errors };
}

// Get domain status for customer
export async function getDomainStatus(customerId: string): Promise<CustomDomain[]> {
  const { rows } = await pool.query(
    "SELECT * FROM custom_domains WHERE customer_id = $1 ORDER BY created_at DESC",
    [customerId]
  );
  return rows.map((r: any) => ({ ...r, dnsRecords: JSON.parse(r.dns_records) }));
}

// Remove custom domain
export async function removeDomain(domainId: string): Promise<void> {
  const { rows: [dom] } = await pool.query("SELECT domain FROM custom_domains WHERE id = $1", [domainId]);
  if (dom) {
    await redis.del(`domain:route:${dom.domain}`);
  }
  await pool.query("DELETE FROM custom_domains WHERE id = $1", [domainId]);
}