fix: nil check and valid apex domain check

Author: zachsmith1

api/v1alpha/domain_types.go

@@ -57,6 +57,10 @@ const (
 	// DNS or HTTP.
 	DomainConditionVerified = "Verified"
 
+	// DomainConditionValidDomain indicates whether the provided domain name is
+	// registrable (i.e., a valid eTLD+1) and suitable for verification/registration.
+	DomainConditionValidDomain = "ValidDomain"
+
 	// This condition tracks verification attempts via DNS.
 	DomainConditionVerifiedDNS = "VerifiedDNS"
 
@@ -88,6 +92,13 @@ const (
 	// DomainReasonVerified indicates domain ownership has been successfully
 	// verified
 	DomainReasonVerified = "Verified"
+
+	// DomainReasonInvalidDomain indicates the provided domain name is not
+	// registrable (e.g., only a public suffix like "com"), and flows are paused.
+	DomainReasonInvalidDomain = "InvalidApex"
+
+	// DomainReasonValid indicates the provided domain name is registrable.
+	DomainReasonValid = "Valid"
 )
 
 // DomainVerificationStatus represents the verification status of a domain

internal/controller/domain_controller.go

@@ -78,11 +78,51 @@ func (r *DomainReconciler) Reconcile(ctx context.Context, req mcreconcile.Reques
 
 	origStatus := domain.Status.DeepCopy()
 
+	// Validate domain is registrable (eTLD+1 present and not a public suffix only)
+	validCond := conditionutil.FindStatusConditionOrDefault(domain.Status.Conditions, &metav1.Condition{
+		Type:               networkingv1alpha.DomainConditionValidDomain,
+		Status:             metav1.ConditionUnknown,
+		Reason:             networkingv1alpha.DomainReasonValid,
+		Message:            "",
+		LastTransitionTime: metav1.Now(),
+	})
+	validCond.ObservedGeneration = domain.Generation
+
+	apex, apexErr := registeredApex(domain.Spec.DomainName)
+	registrable := (apexErr == nil && apex != "")
+	if registrable {
+		validCond.Status = metav1.ConditionTrue
+		validCond.Reason = networkingv1alpha.DomainReasonValid
+		validCond.Message = "Domain is registrable"
+	} else {
+		validCond.Status = metav1.ConditionFalse
+		validCond.Reason = networkingv1alpha.DomainReasonInvalidDomain
+		validCond.Message = "Domain is not registrable (public-suffix only or invalid)"
+		// Clear timers to avoid auto-retries
+		if domain.Status.Verification != nil {
+			domain.Status.Verification.NextVerificationAttempt = metav1.Time{}
+		}
+		if domain.Status.Registration != nil {
+			domain.Status.Registration.NextRegistrationAttempt = metav1.Time{}
+		}
+	}
+	apimeta.SetStatusCondition(&domain.Status.Conditions, *validCond)
+
+	// Persist and short-circuit if invalid
+	if validCond.Status == metav1.ConditionFalse {
+		if !equality.Semantic.DeepEqual(*origStatus, domain.Status) {
+			if err := cl.GetClient().Status().Update(ctx, domain); err != nil {
+				return ctrl.Result{}, fmt.Errorf("failed updating domain status: %w", err)
+			}
+		}
+		return ctrl.Result{}, nil
+	}
+
 	// Delegate all verification work (including timers/backoff)
 	nextVerification := r.reconcileVerification(ctx, domain)
 
 	// Delegate all registration work (including timers/backoff)
-	nextRegistration := r.reconcileRegistration(ctx, domain)
+	nextRegistration := r.reconcileRegistration(ctx, domain, apex)
 
 	// Persist status if changed
 	if !equality.Semantic.DeepEqual(*origStatus, domain.Status) {
@@ -355,7 +395,7 @@ func defaultHTTPGet(ctx context.Context, url string) ([]byte, *http.Response, er
 
 // reconcileRegistration keeps Status.Registration fresh and schedules independent timers.
 // Returns the next registration attempt time (zero if none).
-func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *networkingv1alpha.Domain) time.Time {
+func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *networkingv1alpha.Domain, apex string) time.Time {
 	logger := log.FromContext(ctx)
 
 	st := &d.Status
@@ -370,12 +410,7 @@ func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *network
 		return st.Registration.NextRegistrationAttempt.Time
 	}
 
-	apex, err := registeredApex(d.Spec.DomainName)
-	if err != nil || apex == "" {
-		// if we cannot compute apex, short backoff
-		st.Registration.NextRegistrationAttempt = metav1.NewTime(now.Add(r.Config.DomainRegistration.RetryBackoff.Duration))
-		return st.Registration.NextRegistrationAttempt.Time
-	}
+	// apex is guaranteed valid by the ValidDomain gate
 	st.Apex = strings.EqualFold(strings.TrimSuffix(d.Spec.DomainName, "."), apex)
 
 	ctxLookup, cancel := context.WithTimeout(ctx, r.Config.DomainRegistration.LookupTimeout.Duration)
@@ -400,7 +435,7 @@ func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *network
 		st.Registration.NextRegistrationAttempt = metav1.NewTime(now.Add(r.Config.DomainRegistration.RetryBackoff.Duration))
 		return st.Registration.NextRegistrationAttempt.Time
 	}
-	reg := r.mapRDAPDomainToRegistration(rdapDomain)
+	reg := r.mapRDAPDomainToRegistration(*rdapDomain)
 
 	// Registry from bootstrap (authoritative)
 	if resp.BootstrapAnswer != nil && len(resp.BootstrapAnswer.URLs) > 0 {
@@ -464,7 +499,7 @@ func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *network
 	}
 
 	reg.Source = "rdap"
-	st.Registration = reg
+	st.Registration = &reg
 
 	// Schedule next refresh (with jitter)
 	interval := r.Config.DomainRegistration.RefreshInterval.Duration
@@ -475,21 +510,18 @@ func (r *DomainReconciler) reconcileRegistration(ctx context.Context, d *network
 }
 
 // mapRDAPDomainToRegistration maps a raw RDAP domain into our Registration model.
-func (r *DomainReconciler) mapRDAPDomainToRegistration(d *rdap.Domain) *networkingv1alpha.Registration {
-	reg := &networkingv1alpha.Registration{}
-	if d == nil {
-		return reg
-	}
+func (r *DomainReconciler) mapRDAPDomainToRegistration(d rdap.Domain) networkingv1alpha.Registration {
+	reg := networkingv1alpha.Registration{}
 
 	reg.Domain = d.LDHName
 	reg.Handle = d.Handle
 
 	// IDs & statuses
 	reg.RegistryDomainID = pickRegistryDomainID(d.PublicIDs)
-	copyStatuses(reg, d.Status)
+	copyStatuses(&reg, d.Status)
 
 	// Lifecycle timestamps
-	applyLifecycleFromEvents(reg, d.Events)
+	applyLifecycleFromEvents(&reg, d.Events)
 
 	// DNSSEC
 	if d.SecureDNS != nil {

internal/controller/domain_controller_test.go

@@ -421,6 +421,65 @@ func TestDomainVerification(t *testing.T) {
 	}
 }
 
+func TestValidDomainGate_InvalidApex_SetsConditionAndSkipsFlows(t *testing.T) {
+	testScheme := runtime.NewScheme()
+	assert.NoError(t, scheme.AddToScheme(testScheme))
+	assert.NoError(t, networkingv1alpha.AddToScheme(testScheme))
+
+	operatorConfig := config.NetworkServicesOperator{}
+	config.SetObjectDefaults_NetworkServicesOperator(&operatorConfig)
+
+	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test", UID: uuid.NewUUID()}}
+
+	// Domain with non-registrable name (public suffix only)
+	dom := &networkingv1alpha.Domain{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: ns.Name,
+			Name:      "invalid",
+		},
+		Spec: networkingv1alpha.DomainSpec{DomainName: "com"},
+	}
+
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(testScheme).
+		WithObjects(dom, ns).
+		WithStatusSubresource(dom).
+		Build()
+
+	reconciler := &DomainReconciler{
+		mgr:         &fakeMockManager{cl: fakeClient},
+		Config:      operatorConfig,
+		timeNow:     time.Now,
+		httpGet:     func(ctx context.Context, url string) ([]byte, *http.Response, error) { return nil, nil, nil },
+		lookupTXT:   func(ctx context.Context, name string) ([]string, error) { return nil, nil },
+		lookupNS:    func(ctx context.Context, name string) ([]*net.NS, error) { return nil, &net.DNSError{IsNotFound: true} },
+		lookupIP:    func(ctx context.Context, name string) ([]net.IPAddr, error) { return nil, nil },
+		rdapDo:      func(ctx context.Context, req *rdap.Request) (*rdap.Response, error) { return &rdap.Response{}, nil },
+		rdapQueryIP: func(ctx context.Context, ip string) (*rdap.IPNetwork, error) { return nil, nil },
+	}
+
+	req := mcreconcile.Request{Request: reconcile.Request{NamespacedName: client.ObjectKey{Namespace: ns.Name, Name: dom.Name}}}
+	_, err := reconciler.Reconcile(context.Background(), req)
+	assert.NoError(t, err)
+
+	// Fetch and assert conditions were set and flows skipped
+	got := &networkingv1alpha.Domain{}
+	assert.NoError(t, fakeClient.Get(context.Background(), client.ObjectKey{Namespace: ns.Name, Name: dom.Name}, got))
+
+	cond := apimeta.FindStatusCondition(got.Status.Conditions, networkingv1alpha.DomainConditionValidDomain)
+	if assert.NotNil(t, cond, "ValidDomain condition missing") {
+		assert.Equal(t, metav1.ConditionFalse, cond.Status)
+		assert.Equal(t, networkingv1alpha.DomainReasonInvalidDomain, cond.Reason)
+	}
+	// Timers should be zeroed so no automatic retries
+	if got.Status.Verification != nil {
+		assert.True(t, got.Status.Verification.NextVerificationAttempt.IsZero())
+	}
+	if got.Status.Registration != nil {
+		assert.True(t, got.Status.Registration.NextRegistrationAttempt.IsZero())
+	}
+}
+
 func newDomain(namespace, name string, opts ...func(*networkingv1alpha.Domain)) *networkingv1alpha.Domain {
 	domain := &networkingv1alpha.Domain{
 		ObjectMeta: metav1.ObjectMeta{