calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-25 13:35:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix #2937

Browse Source
This commit is contained in:
Owen
2026-08-24 11:42:35 -04:00
parent 935410b15e
commit 5b782a842c
1 changed files with 32 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/certificates/createCertificate.ts
+32 -28
View File
@@ -23,6 +23,12 @@ export async function createCertificate(
throw new Error(`Domain with ID ${domainId} not found`); throw new Error(`Domain with ID ${domainId} not found`);
} }
// Note: certificates.domain has a global UNIQUE constraint (it is not
// scoped per-domainId), so existence must be checked by domain value
// alone. Filtering on domainId here as well can cause this check to
// miss an existing cert (e.g. if it was stored under a different but
// still-valid domainId), leading to an INSERT that then fails on the
// unique constraint.
let existing: Certificate[] = []; let existing: Certificate[] = [];
if (domainRecord.type == "ns" || domainRecord.type == "wildcard") { if (domainRecord.type == "ns" || domainRecord.type == "wildcard") {
const domainLevelDown = domain.split(".").slice(1).join("."); const domainLevelDown = domain.split(".").slice(1).join(".");
@@ -32,16 +38,13 @@ export async function createCertificate(
.select() .select()
.from(certificates) .from(certificates)
.where( .where(
and( or(
eq(certificates.domainId, domainId), eq(certificates.domain, domain),
or( and(
eq(certificates.domain, domain), eq(certificates.wildcard, true),
and( or(
eq(certificates.wildcard, true), eq(certificates.domain, domainLevelDown),
or( eq(certificates.domain, wildcardPrefixed)
eq(certificates.domain, domainLevelDown),
eq(certificates.domain, wildcardPrefixed)
)
) )
) )
) )
@@ -51,12 +54,7 @@ export async function createCertificate(
existing = await trx existing = await trx
.select() .select()
.from(certificates) .from(certificates)
.where( .where(eq(certificates.domain, domain)); // exact match for non-NS domains
and(
eq(certificates.domainId, domainId),
eq(certificates.domain, domain) // exact match for non-NS domains
)
);
} }
if (existing.length > 0) { if (existing.length > 0) {
@@ -87,16 +85,22 @@ export async function createCertificate(
} }
} }
// No cert found, create a new one in pending state // No cert found, create a new one in pending state. onConflictDoNothing
await trx.insert(certificates).values({ // guards against the domain having been inserted concurrently (or under
domain: domainToWrite, // a different domainId) between the existence check above and this
domainId, // insert, since certificates.domain is globally unique.
wildcard: await trx
domainRecord.type == "ns" || .insert(certificates)
(domainRecord.type == "wildcard" && .values({
domainRecord.preferWildcardCert), // we can only create wildcard certs for NS domains domain: domainToWrite,
status: "pending", domainId,
updatedAt: Math.floor(Date.now() / 1000), wildcard:
createdAt: Math.floor(Date.now() / 1000) domainRecord.type == "ns" ||
}); (domainRecord.type == "wildcard" &&
domainRecord.preferWildcardCert), // we can only create wildcard certs for NS domains
status: "pending",
updatedAt: Math.floor(Date.now() / 1000),
createdAt: Math.floor(Date.now() / 1000)
})
.onConflictDoNothing();
} }