feat(dns): one zone list — the name opens its records, and DNSSEC lives in the row's ⋯ menu — GH #1918

[shukiv]

GH #1918 (johnnyq): merge the DNS page's Zones and DNSSEC tabs. Clicking the domain name opens its records, and the DNSSEC actions and the zone delete move into a ⋯ menu.

What changes (admin and tenant DNS page)

• One list. The DNSSEC tab is gone. Old ?tab=dnssec links and the existing /dnssec redirects land on the list.
• The domain name links to the zone's records. This is a real <Link> with an href, so middle-click works. The Manage Records button is gone.
  • A row whose DNS is hosted elsewhere keeps a plain name and its Enable DNS button. That is the row's only action, so it stays visible instead of becoming a one-item menu.
• The row's ⋯ menu follows the Mail Domains pattern (GH Suggestion: UI Mail Domain Drill Down #1387):
  • Enable DNSSEC on an unsigned, provisioned zone.
  • View DS & keys and Disable DNSSEC on a signed zone.
  • Delete zone, or Delete domain for a DNS-only domain. A signed zone's delete stays disabled with the "Disable DNSSEC before deleting this zone" hint.
• View DS & keys opens a modal with the keys (type, tag, algorithm, state) and the DS records to copy to the registrar. The admin's signing note (NSEC3 / ECDSAP256SHA256 / pdnsutil) moved into it.

Behavior changes beyond layout

• Disable DNSSEC now confirms first. The old tab's switch turned signing off in one click. Doing that while the registrar still publishes the DS makes validating resolvers reject the zone, so the confirm tells the user to remove the DS first.
• An unprovisioned, unsigned row has no DNSSEC action. The old tab listed every domain and offered the switch regardless. But PUT /domains/:id/dnssec runs pdnsutil on the zone, so it failed there anyway. A signed row always offers Disable, so a stuck state can still be cleared.
• New hook. DNSSEC is flipped through useSetDNSSEC, which takes the domain at call time and also refreshes ["list","dns/zones"] so the Signed tag follows. DNSSECTable and the per-id useUpdateDNSSEC are removed (no other users).

Docs

dns.md, admin/dns-zones.md, user/dnssec.md and platform/dnssec.md now describe the menu. The user and platform pages still pointed at a Domain Edit DNSSEC toggle that no longer exists.

Tests

• DNSZoneInventory.test.tsx (12 tests):
  • the name links per audience;
  • no tab and no Manage Records button;
  • the menu contents per row state;
  • Disable confirms before it PUTs, and Enable doesn't confirm;
  • an unprovisioned row has no menu;
  • the keys modal;
  • the GH Feature: Ability to Delete DNS Zone #1611 facet states.
• useDNSSEC.test.tsx: the PUT targets the domain given at call time and invalidates the zone list (prefix match), with unrelated keys untouched.
• tests/e2e/dns-zone-menu.spec.ts (Chromium, built SPA, mocked API):
  • link href, no tab and no Manage Records;
  • ⋯ → Enable DNSSEC → PUT → the tag flips to Signed;
  • View DS & keys shows the key and DS;
  • Disable shows the DS warning and PUTs only after the confirm, then the tag flips to Unsigned;
  • no horizontal overflow at 390px.
• Falsified:
  • The old inventory fails 9 unit tests and all 3 e2e tests.
  • Removing the confirm fails the confirm test.
  • Dropping the zone-list refresh fails the hook test and the e2e Enable → Signed flip.
• Ran: full vitest (157 files, 931 passed), tsc -b, eslint (0 errors), and the Playwright spec.

https://claude.ai/code/session_0173PcNd4h6NceYPc4FuhvXj