fixup: simplify wildcard domain parsing

Author: favonia

internal/domain/domain.go

@@ -58,13 +58,6 @@ type Normalization struct {
 	RemovedExtraTrailingDots bool
 }
 
-func (normalization Normalization) combine(other Normalization) Normalization {
-	return Normalization{
-		RemovedLeadingDots:       normalization.RemovedLeadingDots || other.RemovedLeadingDots,
-		RemovedExtraTrailingDots: normalization.RemovedExtraTrailingDots || other.RemovedExtraTrailingDots,
-	}
-}
-
 // normalizeBoundary removes compatibility dots at a name's boundaries. A
 // single final root dot is silent; two or more final dots are recorded. An
 // all-dot spelling is root cleanup, not leading-dot cleanup.
@@ -95,6 +88,15 @@ func hasEmptyInteriorLabel(ascii string) bool {
 	return strings.HasPrefix(ascii, ".") || strings.Contains(ascii, "..")
 }
 
+// wildcardSuffix recognizes both a bare wildcard and a wildcard with a suffix
+// after whole-input normalization has exposed its canonical dot separators.
+func wildcardSuffix(ascii string) (string, bool) {
+	if ascii == "*" {
+		return "", true
+	}
+	return strings.CutPrefix(ascii, "*.")
+}
+
 // ErrTooFewLabels means a domain name has fewer than two labels after
 // normalization — a single label (com, localhost), the empty/root name (.),
 // or a bare "*". Such a name cannot be a reasonable target domain name.
@@ -131,11 +133,18 @@ func New(input string) (Domain, Normalization, error) {
 	ascii, err := profileKeepingLeadingDots.ToASCII(input)
 	normalized, normalization := normalizeBoundary(ascii)
 
-	if suffix, ok := strings.CutPrefix(normalized, "*."); ok {
-		return newWildcard(suffix, normalization, strings.HasPrefix(suffix, "."))
-	}
-	if normalized == "*" {
-		return Wildcard(""), normalization, ErrTooFewLabels
+	if suffix, ok := wildcardSuffix(normalized); ok {
+		wildcard, wildcardErr := validateNormalizedWildcardSuffix(suffix)
+		if wildcardErr != nil {
+			if errors.Is(wildcardErr, ErrEmptyInteriorLabel) {
+				return nil, Normalization{}, wildcardErr
+			}
+			return wildcard, Normalization{}, wildcardErr
+		}
+		if wildcard == "" {
+			return wildcard, normalization, ErrTooFewLabels
+		}
+		return wildcard, normalization, nil
 	}
 	if strings.IndexByte(normalized, '.') == -1 {
 		return FQDN(normalized), normalization, ErrTooFewLabels
@@ -156,28 +165,20 @@ func New(input string) (Domain, Normalization, error) {
 	return FQDN(normalized), normalization, nil
 }
 
-func newWildcard(
-	suffix string, outerNormalization Normalization, includesWildcardMarker bool,
-) (Domain, Normalization, error) {
+// validateNormalizedWildcardSuffix expects a suffix cut from a whole input
+// after boundary normalization. It re-runs IDNA without the wildcard marker so
+// the marker's own error does not mask errors in the suffix. Target-specific
+// wildcard policy belongs to the caller, so an empty suffix is valid here.
+func validateNormalizedWildcardSuffix(suffix string) (Wildcard, error) {
 	ascii, err := profileKeepingLeadingDots.ToASCII(suffix)
-	normalized, normalization := normalizeBoundary(ascii)
-	normalization = outerNormalization.combine(normalization)
 	if err != nil {
-		return Wildcard(normalized), Normalization{
-			RemovedLeadingDots:       false,
-			RemovedExtraTrailingDots: false,
-		}, err
+		normalized, _ := normalizeBoundary(ascii)
+		return Wildcard(normalized), err
 	}
 	if hasEmptyInteriorLabel(suffix) {
-		return nil, Normalization{
-			RemovedLeadingDots:       false,
-			RemovedExtraTrailingDots: false,
-		}, newEmptyInteriorLabelError(includesWildcardMarker)
-	}
-	if normalized == "" {
-		return Wildcard(""), normalization, ErrTooFewLabels
+		return "", newEmptyInteriorLabelError(strings.HasPrefix(suffix, "."))
 	}
-	return Wildcard(normalized), normalization, nil
+	return Wildcard(ascii), nil
 }
 
 // CompareDomain compares two domains by their ASCII representations.

internal/domain/domain_test.go

@@ -38,6 +38,7 @@ func TestNew(t *testing.T) {
 		{"*.example.org", w("example.org"), normalization(false, false), nil},
 		{"*.example.org.", w("example.org"), normalization(false, false), nil},
 		{"*.example.org..", w("example.org"), normalization(false, true), nil},
+		{"..*.example.org...", w("example.org"), normalization(true, true), nil},
 		{"......", f(""), normalization(false, true), domain.ErrTooFewLabels},
 		{"*......", w(""), normalization(false, true), domain.ErrTooFewLabels},
 		{"a..example.org", nil, normalization(false, false), domain.ErrEmptyInteriorLabel},
@@ -206,6 +207,15 @@ func TestNewTooFewLabels(t *testing.T) {
 	}
 }
 
+func TestNewTooFewLabelsTakesPrecedenceOverIDNAErrors(t *testing.T) {
+	t.Parallel()
+
+	got, normalization, err := domain.New("\u0080")
+	require.Equal(t, domain.FQDN("xn--a"), got)
+	require.Empty(t, normalization)
+	require.ErrorIs(t, err, domain.ErrTooFewLabels)
+}
+
 func TestConstructedDomainInvariant(t *testing.T) {
 	t.Parallel()
 

internal/domain/fqdn.go

@@ -1,7 +1,5 @@
 package domain
 
-import "strings"
-
 // FQDN is a fully qualified domain in its ASCII form.
 type FQDN string
 
@@ -33,15 +31,5 @@ func (f FQDN) HasStrictSuffix(s Suffix) bool {
 
 // Zones starts from a.b.c for the domain a.b.c.
 func (f FQDN) Zones(yield func(Suffix) bool) {
-	domain := string(f)
-	for {
-		if !yield(Suffix(domain)) {
-			return
-		}
-		if i := strings.IndexRune(domain, '.'); i == -1 {
-			return
-		} else {
-			domain = domain[i+1:]
-		}
-	}
+	walkZonesASCII(string(f), yield)
 }

internal/domain/suffix.go

@@ -22,17 +22,11 @@ func NewSuffix(input string) (Suffix, Normalization, error) {
 	ascii, err := profileKeepingLeadingDots.ToASCII(input)
 	normalized, normalization := normalizeBoundary(ascii)
 
-	if suffix, ok := strings.CutPrefix(normalized, "*."); ok {
-		_, suffixNormalization, suffixErr := newWildcard(suffix, normalization, strings.HasPrefix(suffix, "."))
-		if suffixErr != nil && !errors.Is(suffixErr, ErrTooFewLabels) {
-			return "", Normalization{
-				RemovedLeadingDots:       false,
-				RemovedExtraTrailingDots: false,
-			}, suffixErr
+	if suffix, ok := wildcardSuffix(normalized); ok {
+		_, wildcardErr := validateNormalizedWildcardSuffix(suffix)
+		if wildcardErr != nil {
+			return "", Normalization{}, wildcardErr
 		}
-		return "", normalization.combine(suffixNormalization), ErrWildcardSuffix
-	}
-	if normalized == "*" {
 		return "", normalization, ErrWildcardSuffix
 	}
 
@@ -80,3 +74,16 @@ func hasStrictSuffixASCII(s, suffix string) bool {
 	}
 	return strings.HasSuffix(s, suffix) && len(s) > len(suffix) && s[len(s)-len(suffix)-1] == '.'
 }
+
+func walkZonesASCII(name string, yield func(Suffix) bool) {
+	for {
+		if !yield(Suffix(name)) {
+			return
+		}
+		if i := strings.IndexRune(name, '.'); i == -1 {
+			return
+		} else {
+			name = name[i+1:]
+		}
+	}
+}

internal/domain/suffix_test.go

@@ -110,7 +110,9 @@ func TestNewSuffix(t *testing.T) {
 		{"*.a..org", "", expectedNormalization(false, false), domain.ErrEmptyInteriorLabel},
 		{"*.example.org", "", expectedNormalization(false, false), domain.ErrWildcardSuffix},
 		{"*.example.org..", "", expectedNormalization(false, true), domain.ErrWildcardSuffix},
+		{"..*.example.org...", "", expectedNormalization(true, true), domain.ErrWildcardSuffix},
 		{"*", "", expectedNormalization(false, false), domain.ErrWildcardSuffix},
+		{"*......", "", expectedNormalization(false, true), domain.ErrWildcardSuffix},
 	} {
 		t.Run(tc.input, func(t *testing.T) {
 			t.Parallel()

internal/domain/wildcard.go

@@ -1,7 +1,5 @@
 package domain
 
-import "strings"
-
 // Wildcard is a fully qualified zone name in its ASCII form, represnting the wildcard domain name
 // under the zone. For example, Wildcard("example.org") represents *.example.org.
 type Wildcard string
@@ -39,15 +37,5 @@ func (w Wildcard) HasStrictSuffix(s Suffix) bool {
 
 // Zones starts from a.b.c for the wildcard domain *.a.b.c.
 func (w Wildcard) Zones(yield func(Suffix) bool) {
-	domain := string(w)
-	for {
-		if !yield(Suffix(domain)) {
-			return
-		}
-		if i := strings.IndexRune(domain, '.'); i == -1 {
-			return
-		} else {
-			domain = domain[i+1:]
-		}
-	}
+	walkZonesASCII(string(w), yield)
 }

internal/domain/wildcard_internal_test.go

@@ -0,0 +1,15 @@
+package domain
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateNormalizedWildcardSuffixLeavesTargetPolicyToCaller(t *testing.T) {
+	t.Parallel()
+
+	wildcard, err := validateNormalizedWildcardSuffix("")
+	require.NoError(t, err)
+	require.Equal(t, Wildcard(""), wildcard)
+}