feat(integration): add domain CRUD endpoints to integration API #270

New Issue

MrUnknownDE · 2026-04-05T17:04:14+02:00

MrUnknownDE commented

2026-04-05 17:04:14 +02:00

Originally created by @ChanningHe on 2/8/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Add 6 domain CRUD endpoints to integration API (get, create, update, delete, dns-records, restart)
Create verifyApiKeyDomainAccess middleware for domain-org ownership validation
Enable API key holders to fully manage domains programmatically

How to test?

API_KEY="xxxxxx"
ORG_ID="test-org"
BASE_URL="http://localhost:3003/v1"

# --- 1. Create a domain (PUT) ---
curl -s -X PUT "$BASE_URL/org/$ORG_ID/domain" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "wildcard", "baseDomain": "test.example.com"}'
# Expected: 201 Created, response includes domainId

# --- 2. Get a domain (GET) ---
DOMAIN_ID="<domainId from step 1>"
curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 200 OK, returns domain details

# --- 3. Get DNS records (GET) ---
curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID/dns-records" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 200 OK, returns array of DNS records

# --- 4. Update a domain (PATCH) ---
curl -s -X PATCH "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"preferWildcardCert": true}'
# Expected: 200 OK, returns updated domain

# --- 5. Restart a domain (POST) ---
curl -s -X POST "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID/restart" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 200 OK

# --- 6. Delete a domain (DELETE) ---
curl -s -X DELETE "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 200 OK

# --- 7. Verify deletion (GET should return 404) ---
curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 404 Not Found

# --- Security tests ---

# No auth → 401
curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID"
# Expected: 401 Unauthorized

# Wrong org → 403
curl -s "$BASE_URL/org/wrong-org/domain/$DOMAIN_ID" \
  -H "Authorization: Bearer $API_KEY"
# Expected: 403 Forbidden

*Originally created by @ChanningHe on 2/8/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description - Add 6 domain CRUD endpoints to integration API (get, create, update, delete, dns-records, restart) - Create `verifyApiKeyDomainAccess` middleware for domain-org ownership validation - Enable API key holders to fully manage domains programmatically ## How to test? ``` API_KEY="xxxxxx" ORG_ID="test-org" BASE_URL="http://localhost:3003/v1" # --- 1. Create a domain (PUT) --- curl -s -X PUT "$BASE_URL/org/$ORG_ID/domain" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"type": "wildcard", "baseDomain": "test.example.com"}' # Expected: 201 Created, response includes domainId # --- 2. Get a domain (GET) --- DOMAIN_ID="<domainId from step 1>" curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \ -H "Authorization: Bearer $API_KEY" # Expected: 200 OK, returns domain details # --- 3. Get DNS records (GET) --- curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID/dns-records" \ -H "Authorization: Bearer $API_KEY" # Expected: 200 OK, returns array of DNS records # --- 4. Update a domain (PATCH) --- curl -s -X PATCH "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"preferWildcardCert": true}' # Expected: 200 OK, returns updated domain # --- 5. Restart a domain (POST) --- curl -s -X POST "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID/restart" \ -H "Authorization: Bearer $API_KEY" # Expected: 200 OK # --- 6. Delete a domain (DELETE) --- curl -s -X DELETE "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \ -H "Authorization: Bearer $API_KEY" # Expected: 200 OK # --- 7. Verify deletion (GET should return 404) --- curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" \ -H "Authorization: Bearer $API_KEY" # Expected: 404 Not Found # --- Security tests --- # No auth → 401 curl -s "$BASE_URL/org/$ORG_ID/domain/$DOMAIN_ID" # Expected: 401 Unauthorized # Wrong org → 403 curl -s "$BASE_URL/org/wrong-org/domain/$DOMAIN_ID" \ -H "Authorization: Bearer $API_KEY" # Expected: 403 Forbidden ```

MrUnknownDE closed this issue

2026-04-05 17:04:14 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#270