Lucas RayanandClaude Sonnet 5.5
6e49ca00e2
The reconciler never wrote the BIMI record: only the console's verification knew about it, so a stored logo was never published to the zone. - SyncDnsRecordsInput carries the BIMI logo and certificate URLs; the record is created, updated (a= added or dropped) and, when the logo is removed, deleted. Only a record carrying this reconciler's comment is retired: one made by hand is left alone - bimi.Publish decides the record in one place for the timer sweep, the console's button and the panel's verification. A held certificate is advertised only while it is valid for the logo being served: replacing the logo ends the certificate, and a record that kept naming it makes every receiver reject BIMI, including those that need no certificate - saving or removing the logo or the certificate triggers the reconciliation in the background; the panel shows the record as the server writes it, says when a certificate is held back and why, and has a publish-now button - a read error is not 'no logo': the sync leaves the record alone instead of deleting it over a database hiccup Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
53 lines
1.8 KiB
Go
53 lines
1.8 KiB
Go
package bimi
|
|
|
|
import (
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// Publication is what the domain's BIMI DNS record should say right now.
|
|
//
|
|
// One decision, taken in one place, because three things have to agree on it:
|
|
// the record the reconciler writes to the zone, the one the console expects to
|
|
// find there, and the setup check. They used to compute it separately, and the
|
|
// reconciler did not compute it at all, so a logo that was stored was never
|
|
// published.
|
|
type Publication struct {
|
|
// LogoURL is empty when the domain has no logo: then there is no record.
|
|
LogoURL string
|
|
// CertificateURL is the a= tag, empty when none should be published.
|
|
CertificateURL string
|
|
// Withheld says why a certificate that is held here is not being published.
|
|
Withheld string
|
|
}
|
|
|
|
// Publish decides the record for a domain.
|
|
//
|
|
// A certificate held here is published only while it is valid for the logo
|
|
// being served. The certificate vouches for one exact SVG, so the moment the
|
|
// logo is replaced it stops applying, and a record that still names it makes
|
|
// receivers reject BIMI outright, including the ones that would have shown the
|
|
// logo without a certificate. Withholding it keeps those working and leaves the
|
|
// reason for the console to show.
|
|
func Publish(svg, pem []byte, externalURL, domain, logoURL, hostedCertificateURL string, now time.Time) Publication {
|
|
if len(svg) == 0 {
|
|
return Publication{}
|
|
}
|
|
p := Publication{LogoURL: logoURL, CertificateURL: strings.TrimSpace(externalURL)}
|
|
|
|
if len(pem) == 0 {
|
|
return p
|
|
}
|
|
|
|
if _, violations := InspectCertificate(pem, domain, svg, now); len(violations) > 0 {
|
|
rules := make([]string, 0, len(violations))
|
|
for _, v := range violations {
|
|
rules = append(rules, v.Rule)
|
|
}
|
|
p.Withheld = strings.Join(rules, ", ")
|
|
return p
|
|
}
|
|
p.CertificateURL = hostedCertificateURL
|
|
return p
|
|
}
|