+294

src/lib/dns.ts

··· 1 1 + // Authoritative DNS verification 2 2 + // Queries authoritative nameservers directly instead of relying on cached resolvers. 3 3 + // See: https://jacob.gold/posts/stop-telling-users-their-dns-is-wrong/ 4 4 + 5 5 + const TYPE_A = 1; 6 6 + const TYPE_NS = 2; 7 7 + const TYPE_CNAME = 5; 8 8 + 9 9 + interface DnsRecord { 10 10 + type: number; 11 11 + data: string; 12 12 + } 13 13 + 14 14 + // --- Wire format encoding --- 15 15 + 16 16 + function encodeName(name: string): Uint8Array { 17 17 + const n = name.endsWith('.') ? name.slice(0, -1) : name; 18 18 + const parts = n.split('.'); 19 19 + const bytes: number[] = []; 20 20 + for (const part of parts) { 21 21 + bytes.push(part.length); 22 22 + for (let i = 0; i < part.length; i++) { 23 23 + bytes.push(part.charCodeAt(i)); 24 24 + } 25 25 + } 26 26 + bytes.push(0); 27 27 + return new Uint8Array(bytes); 28 28 + } 29 29 + 30 30 + function buildQuery(name: string, type: number): Uint8Array { 31 31 + const qname = encodeName(name); 32 32 + const msg = new Uint8Array(12 + qname.length + 4); 33 33 + const id = (Math.random() * 0xffff) | 0; 34 34 + msg[0] = id >> 8; 35 35 + msg[1] = id & 0xff; 36 36 + msg[2] = 0x01; // RD=1 37 37 + msg[5] = 0x01; // QDCOUNT=1 38 38 + msg.set(qname, 12); 39 39 + const off = 12 + qname.length; 40 40 + msg[off] = type >> 8; 41 41 + msg[off + 1] = type & 0xff; 42 42 + msg[off + 3] = 0x01; // CLASS IN 43 43 + return msg; 44 44 + } 45 45 + 46 46 + // --- Wire format decoding --- 47 47 + 48 48 + function decodeName(data: Uint8Array, offset: number): [string, number] { 49 49 + const labels: string[] = []; 50 50 + let pos = offset; 51 51 + let jumped = false; 52 52 + let savedPos = 0; 53 53 + for (let safety = 0; safety < 128 && pos < data.length; safety++) { 54 54 + const len = data[pos]; 55 55 + if (len === 0) { 56 56 + pos++; 57 57 + break; 58 58 + } 59 59 + if ((len & 0xc0) === 0xc0) { 60 60 + if (!jumped) savedPos = pos + 2; 61 61 + pos = ((len & 0x3f) << 8) | data[pos + 1]; 62 62 + jumped = true; 63 63 + continue; 64 64 + } 65 65 + pos++; 66 66 + let label = ''; 67 67 + for (let i = 0; i < len && pos + i < data.length; i++) { 68 68 + label += String.fromCharCode(data[pos + i]); 69 69 + } 70 70 + labels.push(label); 71 71 + pos += len; 72 72 + } 73 73 + return [labels.join('.'), jumped ? savedPos : pos]; 74 74 + } 75 75 + 76 76 + function parseResponse(data: Uint8Array): DnsRecord[] { 77 77 + if (data.length < 12) return []; 78 78 + const qdcount = (data[4] << 8) | data[5]; 79 79 + const ancount = (data[6] << 8) | data[7]; 80 80 + let offset = 12; 81 81 + 82 82 + // Skip questions 83 83 + for (let i = 0; i < qdcount && offset < data.length; i++) { 84 84 + const [, off] = decodeName(data, offset); 85 85 + offset = off + 4; 86 86 + } 87 87 + 88 88 + const records: DnsRecord[] = []; 89 89 + for (let i = 0; i < ancount && offset + 10 < data.length; i++) { 90 90 + const [, nameEnd] = decodeName(data, offset); 91 91 + offset = nameEnd; 92 92 + const type = (data[offset] << 8) | data[offset + 1]; 93 93 + const rdlength = (data[offset + 8] << 8) | data[offset + 9]; 94 94 + offset += 10; 95 95 + if (offset + rdlength > data.length) break; 96 96 + 97 97 + let value = ''; 98 98 + if (type === TYPE_A && rdlength === 4) { 99 99 + value = `${data[offset]}.${data[offset + 1]}.${data[offset + 2]}.${data[offset + 3]}`; 100 100 + } else if (type === TYPE_CNAME || type === TYPE_NS) { 101 101 + [value] = decodeName(data, offset); 102 102 + } 103 103 + if (value) records.push({ type, data: value }); 104 104 + offset += rdlength; 105 105 + } 106 106 + return records; 107 107 + } 108 108 + 109 109 + // --- DNS-over-HTTPS (for finding NS records and as fallback) --- 110 110 + 111 111 + interface DohAnswer { 112 112 + type: number; 113 113 + data: string; 114 114 + } 115 115 + 116 116 + async function dohQuery(name: string, type: string): Promise<DohAnswer[]> { 117 117 + const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=${type}`; 118 118 + const res = await fetch(url, { headers: { Accept: 'application/dns-json' } }); 119 119 + const json: { Answer?: DohAnswer[] } = await res.json(); 120 120 + return json.Answer ?? []; 121 121 + } 122 122 + 123 123 + // --- Find authoritative nameservers (walking up the domain tree) --- 124 124 + 125 125 + async function findNameservers(domain: string): Promise<string[]> { 126 126 + let current = domain; 127 127 + while (current.includes('.')) { 128 128 + const answers = await dohQuery(current, 'NS'); 129 129 + const ns = answers.filter((a) => a.type === TYPE_NS).map((a) => a.data.replace(/\.$/, '')); 130 130 + if (ns.length > 0) return ns; 131 131 + current = current.substring(current.indexOf('.') + 1); 132 132 + } 133 133 + return []; 134 134 + } 135 135 + 136 136 + // --- Resolve hostname to IPs via DoH --- 137 137 + 138 138 + async function resolveToIps(hostname: string): Promise<string[]> { 139 139 + const answers = await dohQuery(hostname, 'A'); 140 140 + return answers.filter((a) => a.type === TYPE_A).map((a) => a.data); 141 141 + } 142 142 + 143 143 + // --- Query nameserver directly via TCP (cloudflare:sockets) --- 144 144 + 145 145 + async function queryViaTcp(serverIp: string, name: string, type: number): Promise<DnsRecord[]> { 146 146 + // @ts-expect-error: cloudflare:sockets is only available in Workers runtime 147 147 + const { connect } = await import('cloudflare:sockets'); 148 148 + 149 149 + const query = buildQuery(name, type); 150 150 + const tcpMsg = new Uint8Array(query.length + 2); 151 151 + tcpMsg[0] = (query.length >> 8) & 0xff; 152 152 + tcpMsg[1] = query.length & 0xff; 153 153 + tcpMsg.set(query, 2); 154 154 + 155 155 + const socket = connect({ hostname: serverIp, port: 53 }); 156 156 + const writer = socket.writable.getWriter(); 157 157 + await writer.write(tcpMsg); 158 158 + writer.releaseLock(); 159 159 + 160 160 + const reader = socket.readable.getReader(); 161 161 + let buffer = new Uint8Array(0); 162 162 + let responseLen = -1; 163 163 + 164 164 + const timeout = setTimeout(() => socket.close(), 5000); 165 165 + try { 166 166 + while (true) { 167 167 + const { value, done } = await reader.read(); 168 168 + if (done) break; 169 169 + const chunk = new Uint8Array(value as ArrayBuffer); 170 170 + const newBuf = new Uint8Array(buffer.length + chunk.length); 171 171 + newBuf.set(buffer); 172 172 + newBuf.set(chunk, buffer.length); 173 173 + buffer = newBuf; 174 174 + 175 175 + if (responseLen === -1 && buffer.length >= 2) { 176 176 + responseLen = (buffer[0] << 8) | buffer[1]; 177 177 + } 178 178 + if (responseLen >= 0 && buffer.length >= responseLen + 2) break; 179 179 + } 180 180 + } finally { 181 181 + clearTimeout(timeout); 182 182 + reader.releaseLock(); 183 183 + socket.close(); 184 184 + } 185 185 + 186 186 + if (buffer.length < 2) return []; 187 187 + return parseResponse(buffer.slice(2, 2 + responseLen)); 188 188 + } 189 189 + 190 190 + // --- Query with TCP, fall back to DoH for local dev --- 191 191 + 192 192 + async function queryAuthoritative( 193 193 + serverIp: string, 194 194 + name: string, 195 195 + type: number 196 196 + ): Promise<DnsRecord[]> { 197 197 + try { 198 198 + return await queryViaTcp(serverIp, name, type); 199 199 + } catch { 200 200 + // cloudflare:sockets not available (local dev) — fall back to DoH 201 201 + const typeStr = type === TYPE_A ? 'A' : type === TYPE_CNAME ? 'CNAME' : 'NS'; 202 202 + return (await dohQuery(name, typeStr)).map((a) => ({ type: a.type, data: a.data })); 203 203 + } 204 204 + } 205 205 + 206 206 + // --- Main verification --- 207 207 + 208 208 + export interface DnsVerifyResult { 209 209 + ok: boolean; 210 210 + error?: string; 211 211 + hint?: string; 212 212 + } 213 213 + 214 214 + function normalize(s: string): string { 215 215 + return s.replace(/\.$/, '').toLowerCase(); 216 216 + } 217 217 + 218 218 + export async function verifyDomainDns( 219 219 + domain: string, 220 220 + expectedTarget: string 221 221 + ): Promise<DnsVerifyResult> { 222 222 + // Find authoritative nameservers 223 223 + const nameservers = await findNameservers(domain); 224 224 + if (nameservers.length === 0) { 225 225 + return { ok: false, error: `Could not find nameservers for "${domain}".` }; 226 226 + } 227 227 + 228 228 + // Try each nameserver until one responds 229 229 + for (const ns of nameservers) { 230 230 + const ips = await resolveToIps(ns); 231 231 + if (ips.length === 0) continue; 232 232 + 233 233 + const nsIp = ips[0]; 234 234 + 235 235 + // Check CNAME records 236 236 + const cnameRecords = await queryAuthoritative(nsIp, domain, TYPE_CNAME); 237 237 + const cnames = cnameRecords.filter((r) => r.type === TYPE_CNAME); 238 238 + 239 239 + if (cnames.length > 0) { 240 240 + if (cnames.length > 1) { 241 241 + return { 242 242 + ok: false, 243 243 + error: `Multiple CNAME records found for "${domain}": ${cnames.map((r) => r.data).join(', ')}. Remove duplicate records so only one remains.` 244 244 + }; 245 245 + } 246 246 + const got = normalize(cnames[0].data); 247 247 + const want = normalize(expectedTarget); 248 248 + if (got !== want) { 249 249 + return { 250 250 + ok: false, 251 251 + error: `CNAME for "${domain}" points to "${got}" instead of "${want}".`, 252 252 + hint: `If you're using Cloudflare, make sure the proxy (orange cloud) is turned off for this record.` 253 253 + }; 254 254 + } 255 255 + return { ok: true }; 256 256 + } 257 257 + 258 258 + // No CNAME — check A records (root/apex domains with CNAME flattening or A records) 259 259 + const aRecords = await queryAuthoritative(nsIp, domain, TYPE_A); 260 260 + const aValues = aRecords.filter((r) => r.type === TYPE_A); 261 261 + 262 262 + if (aValues.length > 0) { 263 263 + // Resolve the expected target to get its IPs for comparison 264 264 + const expectedIps = await resolveToIps(expectedTarget); 265 265 + if (expectedIps.length === 0) { 266 266 + return { 267 267 + ok: false, 268 268 + error: `Could not resolve "${expectedTarget}" to verify A records.` 269 269 + }; 270 270 + } 271 271 + const expectedSet = new Set(expectedIps); 272 272 + const unexpected = aValues.filter((r) => !expectedSet.has(r.data)); 273 273 + if (unexpected.length > 0) { 274 274 + return { 275 275 + ok: false, 276 276 + error: `A record(s) for "${domain}" include unexpected IPs: ${unexpected.map((r) => r.data).join(', ')}. Expected only IPs matching "${expectedTarget}" (${expectedIps.join(', ')}).`, 277 277 + hint: `If you're using Cloudflare, make sure the proxy (orange cloud) is turned off for this record.` 278 278 + }; 279 279 + } 280 280 + return { ok: true }; 281 281 + } 282 282 + 283 283 + // Neither CNAME nor A found 284 284 + return { 285 285 + ok: false, 286 286 + error: `No CNAME or A record found for "${domain}". Please add a CNAME record pointing to "${expectedTarget}".` 287 287 + }; 288 288 + } 289 289 + 290 290 + return { 291 291 + ok: false, 292 292 + error: `Could not reach any nameserver for "${domain}".` 293 293 + }; 294 294 + }

+1 -1

src/lib/website/Account.svelte

··· 47 47 </Popover> 48 48 </div> 49 49 50 50 - <CustomDomainModal /> 50 50 + <CustomDomainModal publicationUrl={data.publication?.url} /> 51 51 {/if}

+116 -11

src/lib/website/CustomDomainModal.svelte

··· 7 7 </script> 8 8 9 9 <script lang="ts"> 10 10 - import { putRecord, getRecord } from '$lib/atproto/methods'; 10 10 + import { putRecord, getRecord, getHandleOrDid } from '$lib/atproto/methods'; 11 11 import { user } from '$lib/atproto'; 12 12 import { Button, Input } from '@foxui/core'; 13 13 import Modal from '$lib/components/modal/Modal.svelte'; 14 14 import { launchConfetti } from '@foxui/visual'; 15 15 16 16 - let step: 'input' | 'instructions' | 'verifying' | 'success' | 'error' = $state('input'); 16 16 + let { publicationUrl }: { publicationUrl?: string } = $props(); 17 17 + 18 18 + let currentDomain = $derived( 19 19 + publicationUrl?.startsWith('https://') && !publicationUrl.includes('blento.app') 20 20 + ? publicationUrl.replace('https://', '') 21 21 + : '' 22 22 + ); 23 23 + 24 24 + let step: 'current' | 'input' | 'instructions' | 'verifying' | 'removing' | 'success' | 'error' = 25 25 + $state('input'); 17 26 let domain = $state(''); 18 27 let errorMessage = $state(''); 28 28 + let errorHint = $state(''); 19 29 20 30 $effect(() => { 21 21 - if (!customDomainModalState.visible) { 31 31 + if (customDomainModalState.visible) { 32 32 + step = currentDomain ? 'current' : 'input'; 33 33 + } else { 22 34 step = 'input'; 23 35 domain = ''; 24 36 errorMessage = ''; 37 37 + errorHint = ''; 25 38 } 26 39 }); 27 40 41 41 + async function removeDomain() { 42 42 + step = 'removing'; 43 43 + try { 44 44 + const existing = await getRecord({ 45 45 + collection: 'site.standard.publication', 46 46 + rkey: 'blento.self' 47 47 + }); 48 48 + 49 49 + if (existing?.value) { 50 50 + const { url: _url, ...rest } = existing.value as Record<string, unknown>; 51 51 + await putRecord({ 52 52 + collection: 'site.standard.publication', 53 53 + rkey: 'blento.self', 54 54 + record: rest 55 55 + }); 56 56 + } 57 57 + 58 58 + step = 'input'; 59 59 + } catch (err: unknown) { 60 60 + errorMessage = err instanceof Error ? err.message : String(err); 61 61 + step = 'error'; 62 62 + } 63 63 + } 64 64 + 28 65 function goToInstructions() { 29 66 if (!domain.trim()) return; 30 67 step = 'instructions'; ··· 33 70 async function verify() { 34 71 step = 'verifying'; 35 72 try { 73 73 + // Step 1: Verify DNS records 74 74 + const dnsRes = await fetch('/api/verify-domain', { 75 75 + method: 'POST', 76 76 + headers: { 'Content-Type': 'application/json' }, 77 77 + body: JSON.stringify({ domain }) 78 78 + }); 79 79 + 80 80 + const dnsData = await dnsRes.json(); 81 81 + 82 82 + if (!dnsRes.ok || dnsData.error) { 83 83 + errorMessage = dnsData.error; 84 84 + errorHint = dnsData.hint || ''; 85 85 + step = 'error'; 86 86 + return; 87 87 + } 88 88 + 89 89 + // Step 2: Write URL to ATProto profile 36 90 const existing = await getRecord({ 37 91 collection: 'site.standard.publication', 38 92 rkey: 'blento.self' ··· 47 101 } 48 102 }); 49 103 50 50 - const res = await fetch('/api/verify-domain', { 104 104 + // Step 3: Activate domain in KV (server verifies profile has the URL) 105 105 + const activateRes = await fetch('/api/activate-domain', { 51 106 method: 'POST', 52 107 headers: { 'Content-Type': 'application/json' }, 53 108 body: JSON.stringify({ did: user.did, domain }) 54 109 }); 55 110 56 56 - const data = await res.json(); 111 111 + const activateData = await activateRes.json(); 57 112 58 58 - if (data.success) { 59 59 - launchConfetti(); 60 60 - step = 'success'; 61 61 - } else if (data.error) { 62 62 - errorMessage = data.error; 113 113 + if (!activateRes.ok || activateData.error) { 114 114 + errorMessage = activateData.error; 115 115 + errorHint = ''; 63 116 step = 'error'; 117 117 + return; 64 118 } 119 119 + 120 120 + // Refresh cached profile 121 121 + if (user.profile) { 122 122 + fetch(`/${getHandleOrDid(user.profile)}/api/refresh`).catch(() => {}); 123 123 + } 124 124 + 125 125 + launchConfetti(); 126 126 + step = 'success'; 65 127 } catch (err: unknown) { 66 128 errorMessage = err instanceof Error ? err.message : String(err); 67 129 step = 'error'; ··· 74 136 </script> 75 137 76 138 <Modal bind:open={customDomainModalState.visible}> 77 77 - {#if step === 'input'} 139 139 + {#if step === 'current'} 140 140 + <h3 class="text-base-900 dark:text-base-100 font-semibold" id="custom-domain-modal-title"> 141 141 + Custom Domain 142 142 + </h3> 143 143 + 144 144 + <div 145 145 + class="bg-base-200 dark:bg-base-700 mt-2 flex items-center justify-between rounded-2xl px-3 py-2 font-mono text-sm" 146 146 + > 147 147 + <span>{currentDomain}</span> 148 148 + </div> 149 149 + 150 150 + <div class="mt-4 flex gap-2"> 151 151 + <Button variant="ghost" onclick={removeDomain}>Remove</Button> 152 152 + <Button variant="ghost" onclick={() => (step = 'input')}>Change</Button> 153 153 + <Button onclick={() => customDomainModalState.hide()}>Close</Button> 154 154 + </div> 155 155 + {:else if step === 'input'} 78 156 <h3 class="text-base-900 dark:text-base-100 font-semibold" id="custom-domain-modal-title"> 79 157 Custom Domain 80 158 </h3> ··· 150 228 </svg> 151 229 <span class="text-base-600 dark:text-base-400 text-sm">Verifying...</span> 152 230 </div> 231 231 + {:else if step === 'removing'} 232 232 + <h3 class="text-base-900 dark:text-base-100 font-semibold" id="custom-domain-modal-title"> 233 233 + Removing... 234 234 + </h3> 235 235 + 236 236 + <div class="mt-4 flex items-center gap-2"> 237 237 + <svg 238 238 + class="text-base-500 size-5 animate-spin" 239 239 + xmlns="http://www.w3.org/2000/svg" 240 240 + fill="none" 241 241 + viewBox="0 0 24 24" 242 242 + > 243 243 + <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" 244 244 + ></circle> 245 245 + <path 246 246 + class="opacity-75" 247 247 + fill="currentColor" 248 248 + d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" 249 249 + ></path> 250 250 + </svg> 251 251 + <span class="text-base-600 dark:text-base-400 text-sm">Removing domain...</span> 252 252 + </div> 153 253 {:else if step === 'success'} 154 254 <h3 class="text-base-900 dark:text-base-100 font-semibold" id="custom-domain-modal-title"> 155 255 Domain verified! ··· 170 270 <p class="mt-2 text-sm text-red-500 dark:text-red-400"> 171 271 {errorMessage} 172 272 </p> 273 273 + {#if errorHint} 274 274 + <p class="mt-1 text-sm font-bold text-red-500 dark:text-red-400"> 275 275 + {errorHint} 276 276 + </p> 277 277 + {/if} 173 278 174 279 <div class="mt-4 flex gap-2"> 175 280 <Button variant="ghost" onclick={() => customDomainModalState.hide()}>Close</Button>

+67

src/routes/api/activate-domain/+server.ts

··· 1 1 + import { json } from '@sveltejs/kit'; 2 2 + import { isDid } from '@atcute/lexicons/syntax'; 3 3 + import { getRecord } from '$lib/atproto/methods'; 4 4 + import type { Did } from '@atcute/lexicons'; 5 5 + 6 6 + export async function POST({ request, platform }) { 7 7 + let body: { did: string; domain: string }; 8 8 + try { 9 9 + body = await request.json(); 10 10 + } catch { 11 11 + return json({ error: 'Invalid JSON body' }, { status: 400 }); 12 12 + } 13 13 + 14 14 + const { did, domain } = body; 15 15 + 16 16 + if (!did || !domain) { 17 17 + return json({ error: 'Missing required fields: did, domain' }, { status: 400 }); 18 18 + } 19 19 + 20 20 + if (!isDid(did)) { 21 21 + return json({ error: 'Invalid DID format' }, { status: 400 }); 22 22 + } 23 23 + 24 24 + // Validate domain format 25 25 + if ( 26 26 + !/^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$/.test( 27 27 + domain 28 28 + ) 29 29 + ) { 30 30 + return json({ error: 'Invalid domain format' }, { status: 400 }); 31 31 + } 32 32 + 33 33 + // Verify the user's ATProto profile has this domain set 34 34 + try { 35 35 + const record = await getRecord({ 36 36 + did: did as Did, 37 37 + collection: 'site.standard.publication', 38 38 + rkey: 'blento.self' 39 39 + }); 40 40 + 41 41 + const url = (record?.value as Record<string, unknown>)?.url; 42 42 + if (url !== `https://${domain}`) { 43 43 + return json( 44 44 + { 45 45 + error: `Profile does not have this domain set. Expected "https://${domain}" but got "${url || '(none)'}".` 46 46 + }, 47 47 + { status: 403 } 48 48 + ); 49 49 + } 50 50 + } catch { 51 51 + return json({ error: 'Failed to verify profile record.' }, { status: 500 }); 52 52 + } 53 53 + 54 54 + // Write to CUSTOM_DOMAINS KV 55 55 + const kv = platform?.env?.CUSTOM_DOMAINS; 56 56 + if (!kv) { 57 57 + return json({ error: 'KV storage not available.' }, { status: 500 }); 58 58 + } 59 59 + 60 60 + try { 61 61 + await kv.put(domain.toLowerCase(), did); 62 62 + } catch { 63 63 + return json({ error: 'Failed to register domain.' }, { status: 500 }); 64 64 + } 65 65 + 66 66 + return json({ success: true }); 67 67 + }

-30

src/routes/api/reloadRecent/+server.ts

··· 1 1 - import { getDetailedProfile } from '$lib/atproto'; 2 2 - import { createCache } from '$lib/cache'; 3 3 - import { json } from '@sveltejs/kit'; 4 4 - import type { AppBskyActorDefs } from '@atcute/bluesky'; 5 5 - 6 6 - export async function GET({ platform }) { 7 7 - const cache = createCache(platform); 8 8 - if (!cache) return json('no cache'); 9 9 - 10 10 - const existingUsers = await cache.get('meta', 'updatedBlentos'); 11 11 - 12 12 - const existingUsersArray: AppBskyActorDefs.ProfileViewDetailed[] = existingUsers 13 13 - ? JSON.parse(existingUsers) 14 14 - : []; 15 15 - 16 16 - const existingUsersSet = new Set(existingUsersArray.map((v) => v.did)); 17 17 - 18 18 - const newProfilesPromises: Promise<AppBskyActorDefs.ProfileViewDetailed | undefined>[] = []; 19 19 - for (const did of Array.from(existingUsersSet)) { 20 20 - const profile = getDetailedProfile({ did }); 21 21 - newProfilesPromises.push(profile); 22 22 - if (newProfilesPromises.length > 20) break; 23 23 - } 24 24 - 25 25 - const newProfiles = await Promise.all(newProfilesPromises); 26 26 - 27 27 - await cache.put('meta', 'updatedBlentos', JSON.stringify(newProfiles)); 28 28 - 29 29 - return json('ok'); 30 30 - }

-32

src/routes/api/update/+server.ts

··· 1 1 - import { createCache } from '$lib/cache'; 2 2 - import { getCache, loadData } from '$lib/website/load'; 3 3 - import { env } from '$env/dynamic/private'; 4 4 - import { json } from '@sveltejs/kit'; 5 5 - import type { AppBskyActorDefs } from '@atcute/bluesky'; 6 6 - 7 7 - export async function GET({ platform }) { 8 8 - const cache = createCache(platform); 9 9 - if (!cache) return json('no cache'); 10 10 - 11 11 - const existingUsers = await cache.get('meta', 'updatedBlentos'); 12 12 - 13 13 - const existingUsersArray: AppBskyActorDefs.ProfileViewDetailed[] = existingUsers 14 14 - ? JSON.parse(existingUsers) 15 15 - : []; 16 16 - 17 17 - const existingUsersHandle = existingUsersArray.map((v) => v.handle); 18 18 - 19 19 - for (const handle of existingUsersHandle) { 20 20 - if (!handle) continue; 21 21 - 22 22 - try { 23 23 - const cached = await getCache(handle, 'self', cache); 24 24 - if (!cached) await loadData(handle, cache, true, 'self', env); 25 25 - } catch (error) { 26 26 - console.error(error); 27 27 - return json('error'); 28 28 - } 29 29 - } 30 30 - 31 31 - return json('ok'); 32 32 - }

+15 -69

src/routes/api/verify-domain/+server.ts

··· 1 1 import { json } from '@sveltejs/kit'; 2 2 - import type { Did } from '@atcute/lexicons'; 3 3 - import { getClient, getRecord } from '$lib/atproto/methods'; 2 2 + import { verifyDomainDns } from '$lib/dns'; 4 3 5 5 - export async function POST({ request, platform }) { 6 6 - let body: { did: string; domain: string }; 4 4 + const EXPECTED_TARGET = 'blento-proxy.fly.dev'; 5 5 + 6 6 + export async function POST({ request }) { 7 7 + let body: { domain: string }; 7 8 try { 8 9 body = await request.json(); 9 10 } catch { 10 11 return json({ error: 'Invalid JSON body' }, { status: 400 }); 11 12 } 12 13 13 13 - const { did, domain } = body; 14 14 + const { domain } = body; 14 15 15 15 - if (!did || !domain) { 16 16 - return json({ error: 'Missing required fields: did and domain' }, { status: 400 }); 16 16 + if (!domain) { 17 17 + return json({ error: 'Missing required field: domain' }, { status: 400 }); 17 18 } 18 19 19 20 // Validate domain format ··· 25 26 return json({ error: 'Invalid domain format' }, { status: 400 }); 26 27 } 27 28 28 28 - // Check the user's site.standard.publication record 29 29 - try { 30 30 - const client = await getClient({ did: did as Did }); 31 31 - const record = await getRecord({ 32 32 - did: did as Did, 33 33 - collection: 'site.standard.publication', 34 34 - rkey: 'blento.self', 35 35 - client 36 36 - }); 37 37 - 38 38 - const recordUrl = record?.value?.url; 39 39 - const expectedUrl = `https://${domain}`; 40 40 - 41 41 - if (recordUrl !== expectedUrl) { 42 42 - return json( 43 43 - { 44 44 - error: `Publication record URL does not match. Expected "${expectedUrl}", got "${recordUrl || '(not set)'}".` 45 45 - }, 46 46 - { status: 400 } 47 47 - ); 48 48 - } 49 49 - } catch { 50 50 - return json( 51 51 - { error: 'Could not read site.standard.publication record. Make sure it exists.' }, 52 52 - { status: 400 } 53 53 - ); 54 54 - } 55 55 - 56 56 - // Verify CNAME via DNS-over-HTTPS 29 29 + // Verify DNS by querying authoritative nameservers directly. 30 30 + // This gives instant, accurate results instead of relying on cached resolvers. 31 31 + // Checks CNAME for subdomains and A records for root/apex domains. 32 32 + // See: https://jacob.gold/posts/stop-telling-users-their-dns-is-wrong/ 57 33 try { 58 58 - const dohUrl = `https://mozilla.cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=CNAME`; 59 59 - const dnsRes = await fetch(dohUrl, { 60 60 - headers: { Accept: 'application/dns-json' } 61 61 - }); 62 62 - const dnsData = await dnsRes.json(); 63 63 - 64 64 - const cnameTarget = 'blento-proxy.fly.dev.'; 65 65 - const cnameTargetNoDot = 'blento-proxy.fly.dev'; 66 66 - 67 67 - const hasCname = dnsData.Answer?.some( 68 68 - (answer: { type: number; data: string }) => 69 69 - answer.type === 5 && (answer.data === cnameTarget || answer.data === cnameTargetNoDot) 70 70 - ); 71 71 - 72 72 - if (!hasCname) { 73 73 - return json( 74 74 - { 75 75 - error: `CNAME record not found. Please set a CNAME for "${domain}" pointing to "blento-proxy.fly.dev".` 76 76 - }, 77 77 - { status: 400 } 78 78 - ); 34 34 + const result = await verifyDomainDns(domain, EXPECTED_TARGET); 35 35 + if (!result.ok) { 36 36 + return json({ error: result.error, hint: result.hint }, { status: 400 }); 79 37 } 80 38 } catch { 81 39 return json({ error: 'Failed to verify DNS records.' }, { status: 500 }); 82 82 - } 83 83 - 84 84 - // Write to CUSTOM_DOMAINS KV 85 85 - const kv = platform?.env?.CUSTOM_DOMAINS; 86 86 - if (!kv) { 87 87 - return json({ error: 'Domain storage is not available.' }, { status: 500 }); 88 88 - } 89 89 - 90 90 - try { 91 91 - await kv.put(domain, did); 92 92 - } catch { 93 93 - return json({ error: 'Failed to save custom domain.' }, { status: 500 }); 94 40 } 95 41 96 42 return json({ success: true });

+4 -1

vite.config.ts

··· 10 10 port: 5179 11 11 }, 12 12 build: { 13 13 - sourcemap: true 13 13 + sourcemap: true, 14 14 + rollupOptions: { 15 15 + external: ['cloudflare:sockets'] 16 16 + } 14 17 } 15 18 });