#10: implement Cloudflare DNS automation engine (13 records & system aliases)

services/protocols/internal/infrastructure/postgres/alias_repository.go

@@ -0,0 +1,50 @@
+package postgres
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type AliasRepository struct {
+	pool *pgxpool.Pool
+}
+
+func NewAliasRepository(pool *pgxpool.Pool) *AliasRepository {
+	return &AliasRepository{pool: pool}
+}
+
+func (r *AliasRepository) EnsureSystemAliases(ctx context.Context, domainName, adminEmail string) error {
+	var domainID uuid.UUID
+	err := r.pool.QueryRow(ctx, `SELECT id FROM domains WHERE name = $1`, domainName).Scan(&domainID)
+	if err != nil {
+		return fmt.Errorf("find domain %s: %w", domainName, err)
+	}
+
+	systemAliasPrefixes := []string{"postmaster", "abuse", "dmarc", "tlsrpt"}
+
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin tx: %w", err)
+	}
+	defer tx.Rollback(ctx)
+
+	for _, prefix := range systemAliasPrefixes {
+		sourceAddr := fmt.Sprintf("%s@%s", prefix, domainName)
+		destArray := []string{adminEmail}
+
+		_, err := tx.Exec(ctx, `
+			INSERT INTO aliases (domain_id, source_address, destination_addresses, is_active, is_system)
+			VALUES ($1, $2, $3, true, true)
+			ON CONFLICT (domain_id, source_address)
+			DO UPDATE SET destination_addresses = EXCLUDED.destination_addresses, is_system = true
+		`, domainID, sourceAddr, destArray)
+		if err != nil {
+			return fmt.Errorf("upsert system alias %s: %w", sourceAddr, err)
+		}
+	}
+
+	return tx.Commit(ctx)
+}

services/protocols/internal/infrastructure/postgres/alias_repository_test.go

@@ -0,0 +1,41 @@
+package postgres
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func TestAliasRepository_EnsureSystemAliases(t *testing.T) {
+	dbURL := os.Getenv("TEST_DATABASE_URL")
+	if dbURL == "" {
+		t.Skip("TEST_DATABASE_URL not set - skipping Postgres integration test")
+	}
+
+	ctx := context.Background()
+	pool, err := NewPool(ctx, dbURL)
+	if err != nil {
+		t.Fatalf("connect pool: %v", err)
+	}
+	defer pool.Close()
+
+	domainID := uuid.New()
+	if _, err := pool.Exec(ctx, `INSERT INTO domains (id, name, punycode_name) VALUES ($1, 'dnsalias.test', 'dnsalias.test')`, domainID); err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	defer pool.Exec(ctx, `DELETE FROM domains WHERE id = $1`, domainID)
+
+	repo := NewAliasRepository(pool)
+
+	if err := repo.EnsureSystemAliases(ctx, "dnsalias.test", "admin@dnsalias.test"); err != nil {
+		t.Fatalf("EnsureSystemAliases: %v", err)
+	}
+
+	// Verify postmaster, abuse, dmarc, tlsrpt aliases exist
+	var count int
+	if err := pool.QueryRow(ctx, `SELECT count(*) FROM aliases WHERE domain_id = $1 AND is_system = true`, domainID).Scan(&count); err != nil || count != 4 {
+		t.Fatalf("expected 4 system aliases in DB, got count=%d, err=%v", count, err)
+	}
+}