src/domain-expiry.ts

Functions

Imports

It imports src/time.ts, src/watcher-detect.ts. Imported by src/watcher-gather.ts.

Source

1import type { Finding } from "./watcher-detect";
2import { DAY_MS } from "./time";
3
4// DOMAIN REGISTRATION EXPIRY, BY RDAP (job_5ac1139641e0, design-portal-insight.md section 5,
5// pulled forward by Dustin on 2026-10-07: dustinedwards.info expires 2026-12-27, and
6// auto-renew being on is no reason to go without the alert).
7//
8// The domains are the registrable names of the configured sites' origins (ops_sites), so
9// nothing here is a list in code. Hosting suffixes a site borrows (workers.dev and the
10// like) are not ours to renew and are left out.
11//
12// RDAP (RFC 9224 bootstrap, RFC 9083 responses): the IANA bootstrap maps a TLD to its
13// registry's RDAP base; `{base}domain/{name}` answers with an `expiration` event. Both are
14// public and need no key. The bootstrap is kept a week and each domain's answer a day, in
15// KV, so a half-hourly watcher pass makes about one RDAP call per domain per day.
16//
17// A finding at EARLY_DAYS before expiry, and a second, new fingerprint at LATE_DAYS, so the
18// last week posts again even if the first finding was dismissed. A domain whose expiry
19// could not be read is not a finding (it says nothing about the domain); the check then
20// counts as not run, so an open finding is not cleared by a read that failed.
21
22export const BOOTSTRAP_URL = "https://data.iana.org/rdap/dns.json";
23const BOOTSTRAP_KEY = "rdap:bootstrap:v1";
24const BOOTSTRAP_TTL_SECONDS = 7 * 86_400;
25export const expiryKey = (domain: string) => `rdap:expiry:v1:${domain}`;
26const EXPIRY_TTL_SECONDS = 86_400;
27const EARLY_DAYS = 30;
28const LATE_DAYS = 7;
29const FETCH_TIMEOUT_MS = 8000;
30
31// Suffixes a site may sit under that are a host's, not a registration of ours.
32const HOSTING_SUFFIXES = ["workers.dev", "pages.dev", "vercel.app", "netlify.app", "github.io"];
33
34/** The registrable domain of a site origin, or null for a hosting suffix or an IP. The
35 *  portfolio's TLDs are all single-label (.info, .app, .com, .org, .dev), so the last two
36 *  labels are the registration; a multi-label public suffix would need the PSL. */
37export function registrableDomain(origin: string): string | null {
38  let host: string;
39  try {
40    host = new URL(origin).hostname.toLowerCase();
41  } catch {
42    return null;
43  }
44  if (/^[\d.]+$/.test(host) || host.includes(":")) return null;
45  if (HOSTING_SUFFIXES.some((s) => host === s || host.endsWith(`.${s}`))) return null;
46  const labels = host.split(".").filter(Boolean);
47  return labels.length >= 2 ? labels.slice(-2).join(".") : null;
48}
49
50/** The RDAP base for a domain's TLD from the IANA bootstrap, or null. */
51export function rdapBase(bootstrap: unknown, domain: string): string | null {
52  const tld = domain.split(".").pop() ?? "";
53  const services = (bootstrap as { services?: unknown })?.services;
54  if (!Array.isArray(services)) return null;
55  for (const entry of services) {
56    if (!Array.isArray(entry) || !Array.isArray(entry[0]) || !Array.isArray(entry[1])) continue;
57    if ((entry[0] as unknown[]).some((t) => typeof t === "string" && t.toLowerCase() === tld)) {
58      const url = (entry[1] as unknown[]).find((u): u is string => typeof u === "string" && u.startsWith("https://"));
59      if (url) return url.endsWith("/") ? url : `${url}/`;
60    }
61  }
62  return null;
63}
64
65/** The `expiration` event's date from an RDAP domain answer, ISO, or null. */
66export function expirationOf(rdap: unknown): string | null {
67  const events = (rdap as { events?: unknown })?.events;
68  if (!Array.isArray(events)) return null;
69  for (const e of events) {
70    const ev = e as { eventAction?: unknown; eventDate?: unknown };
71    if (ev.eventAction === "expiration" && typeof ev.eventDate === "string" && Number.isFinite(Date.parse(ev.eventDate))) return new Date(ev.eventDate).toISOString();
72  }
73  return null;
74}
75
76/** The findings for domains whose expiry is known. */
77export function expiryFindings(expiries: ReadonlyArray<{ domain: string; expires: string }>, now: Date): Finding[] {
78  const out: Finding[] = [];
79  for (const { domain, expires } of expiries) {
80    const days = Math.floor((Date.parse(expires) - now.getTime()) / DAY_MS);
81    if (days > EARLY_DAYS) continue;
82    const late = days <= LATE_DAYS;
83    const fingerprint = `domain-expiry-${late ? "7d" : "30d"}-${domain.replace(/[^a-z0-9]+/g, "-")}`;
84    const headline = days < 0 ? `${domain}'s registration expired ${-days} days ago` : `${domain}'s registration expires in ${days} days`;
85    const evidence = [`RDAP expiration ${expires}`, `read ${now.toISOString()}`];
86    out.push({
87      fingerprint,
88      namespace: "capsid",
89      title: `Watcher: ${headline} [${fingerprint}]`,
90      body: [
91        `The registry's RDAP record says ${domain} expires at ${expires}. Renew it, or confirm auto-renew has run, then fail this job saying so; the finding clears once RDAP shows the new date.`,
92        "",
93        "## Evidence",
94        "",
95        ...evidence.map((line) => `- ${line}`),
96      ].join("\n"),
97      evidence,
98    });
99  }
100  return out;
101}
102
103type Cached = { expires: string; read_at: string };
104
105async function fetchJson(fetchImpl: typeof fetch, url: string): Promise<unknown> {
106  const resp = await fetchImpl(url, { headers: { Accept: "application/rdap+json, application/json" }, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
107  if (!resp.ok) throw new Error(`${url} answered ${resp.status}`);
108  return resp.json();
109}
110
111/**
112 * Each domain's expiry, from KV when read in the last day, otherwise from RDAP. Returns
113 * the expiries it has and the domains it could not read, with why.
114 */
115export async function readExpiries(
116  kv: KVNamespace,
117  domains: readonly string[],
118  fetchImpl: typeof fetch,
119  now: Date
120): Promise<{ expiries: Array<{ domain: string; expires: string }>; failed: Array<{ domain: string; error: string }> }> {
121  const expiries: Array<{ domain: string; expires: string }> = [];
122  const failed: Array<{ domain: string; error: string }> = [];
123  let bootstrap: unknown = null;
124  for (const domain of domains) {
125    const cached = (await kv.get(expiryKey(domain), "json")) as Cached | null;
126    if (cached?.expires) {
127      expiries.push({ domain, expires: cached.expires });
128      continue;
129    }
130    try {
131      if (bootstrap === null) {
132        bootstrap = await kv.get(BOOTSTRAP_KEY, "json");
133        if (!bootstrap) {
134          bootstrap = await fetchJson(fetchImpl, BOOTSTRAP_URL);
135          await kv.put(BOOTSTRAP_KEY, JSON.stringify(bootstrap), { expirationTtl: BOOTSTRAP_TTL_SECONDS });
136        }
137      }
138      const base = rdapBase(bootstrap, domain);
139      if (!base) throw new Error(`the IANA bootstrap names no RDAP server for .${domain.split(".").pop()}`);
140      const expires = expirationOf(await fetchJson(fetchImpl, `${base}domain/${encodeURIComponent(domain)}`));
141      if (!expires) throw new Error("the RDAP answer has no expiration event");
142      await kv.put(expiryKey(domain), JSON.stringify({ expires, read_at: now.toISOString() } satisfies Cached), { expirationTtl: EXPIRY_TTL_SECONDS });
143      expiries.push({ domain, expires });
144    } catch (err) {
145      failed.push({ domain, error: err instanceof Error ? err.message : String(err) });
146    }
147  }
148  return { expiries, failed };
149}