feat(routes): Domain-Registry-Bindung — Präfix + verifizierte Basis, Carve-out, Grandfathering, Nudge - #185
Merged
Merged
Conversation
…ear stale freetext on L4-none
…ree-text) Replace single edit-route-domain input with dropdown+prefix (public routes) or freetext fallback (internal/stale). Preselects verified base or injects unverified-legacy option with warning. Remaps all 6 edit-side JS call sites, migrates data-dns to edit-route-domain-freetext, adds i18n+GC.t for unverified_base_option and unverified_base_prefix_warning.
Add discreet amber badge to routes where baseUnverified is true — reads GC.t['routes.unverified_base_badge'] (with tooltip pointing to Settings → General → Domains). Badge participates in existing extraTags +N collapse logic. Both i18n keys added to en/de and all three layout GC.t allow-lists.
…e in affected suites
CallMeTechie
added a commit
that referenced
this pull request
Jun 25, 2026
…ring pending rows (#186) * fix(domains): skip non-public-TLD bases in boot seeding + prune lingering pending rows Non-public bases (.internal/.lan/...) can never verify against public DNS, so they lingered as permanent 'pending' noise on the Domains page once B made them visible. Now they are never seeded, and existing auto-seeded pending non-public rows are pruned on boot. Verified rows are never touched; routes read routes.domain directly and nothing FKs to the domains table. Follow-up to the A→C→B domain initiative (B = PR #185). * test(domains): use Set.has to dodge CodeQL url-substring FP; prepare delete stmt once
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routen nutzen die Domain-Registry (Teilprojekt B)
Schließt die 3-teilige Domain-Initiative A → C → B ab. Routen beziehen ihre öffentliche Domain künftig aus der verifizierten Registry statt aus Freitext.
Was sich ändert
präfix.basis..internal/.lan/...via bestehendemisPublicDomain): bleiben Freitext, kein Verify (interner CA). Rein-interne Deployments können weiter Routen anlegen.config.app.baseUrl) oder den Portal-Host (effectivePortalHost, lazy) übernehmen.Architektur / Risiko-Minimierung
routes.domainbleibt der maßgebliche volle FQDN; Caddy/dns-Build-Pfad unverändert. Die Registry-Bindung ist eine Validierungsregel.POST/PUT /api/v1/routes-Handler durchgesetzt. Die ursprünglich geplante zusätzliche Service-Layer-Defense wurde nach dem finalen Review bewusst entfernt —services/routes.jsist ein geteilter Chokepoint (Service-Bundles u. a.), eine Erzwingung dort hätte interne Aufrufer regressiert. Carve-out-Klassifizierung ist konsistent über Policy + List-API-Flags (domainIsPublic/baseUnverified) + Edit-Pfad-Erkennung (alle serverseitig, keine Client-Reimplementierung vonisPublicDomain).Tests
tests/route_domain_assemble,route_domain_policy,api_routes_registry,routes_registry_ui.*.example.com-Routen) seeden jetzt eine verifizierte Basis.Bekannte Punkte (dokumentiert)
gc.internal) → diese bleiben dauerhaftpending(Rauschen, kein Funktionsfehler). Folge-Empfehlung: kleiner A-Fix, der!isPublicDomain-Basen überspringt.🤖 Generated with Claude Code
https://claude.ai/code/session_01Nfanfu8v8xvSMCbuAmd8Sq