Add owner-managed 301 and 302 URL redirects to network records

Author: ralyodio

docs/w3bs-net.md

@@ -38,3 +38,18 @@ W3BS is an independent Moshpit instance: W3BS names, owner ids and DNS writes st
 A configured Moshpit resolver maps the W3BS realm `label.namespace.w3bs.org` to this instance, querying its resolve and records APIs. It does not treat bare `label.namespace` on the primary network as the same ownership. Active instance records are authoritative within that explicitly configured realm, including over public parking answers; inactive local names cannot be revived through primary-network fallback. A name with no custom address records goes to the W3BS gateway so its existing HTTPS destination can redirect there. Custom AAAA or CNAME records override the gateway address; TXT/MX coexist with its default address. DNS changes publish immediately in the instance; cached resolver/browser answers still follow TTL.
 
 DNS answers and HTTPS certificates are separate rollout gates. Standard browser access to every new `*.namespace.w3bs.org` requires public DNS and a publicly trusted certificate for that suffix. A generic `*.w3bs.org` certificate does not cover two labels. The primary Moshpit CA intentionally refuses public TLDs and must not be changed to mint arbitrary `.org` certificates to work around missing registrar credentials. Resolver routing is not evidence that public DNS or HTTPS is ready. Preserve that distinction when reporting a new name live.
+
+### URL redirects
+
+At `/net/records`, each active name you own has a URL redirect form. Enter a complete HTTPS URL (including a path), choose **301 permanent** or **302 temporary**, then save. Existing registration destinations appear here as 302 redirects. Saving/removing gives inline feedback without refreshing the page. A 301 can be remembered by browsers; use 302 while testing.
+
+Authenticated owner API:
+
+```http
+PUT /api/net/v1/names/blue.example/redirect
+Content-Type: application/json
+
+{"target":"https://example.com/page","status":301}
+```
+
+`DELETE` at that same endpoint removes the destination. Only the local owner of an active name in an active namespace can change it. Redirect changes update the resolver record and publish a federation activation event. Redirects and AAAA/CNAME records are mutually exclusive, since those records route visitors away from the gateway. TXT/MX records can coexist. Redirects require working gateway DNS and HTTPS; setting a URL does not provision a public certificate or change registrar DNS.

public/net-records.js

@@ -50,7 +50,35 @@ function render(){
     const button=el('button','Publish record',{type:'submit',className:'button primary'});form.append(button);
     type.addEventListener('change',()=>{value.placeholder=help[type.value];priorityLabel.hidden=type.value!=='MX';});
     form.addEventListener('submit',async event=>{event.preventDefault();await perform(button,()=>api(path,{method:'POST',body:JSON.stringify({type:type.value,value:value.value,ttl:Number(ttl.value),priority:Number(priority.value)})}));});
-    card.append(form,feedback);root.append(card);
+    card.append(form,feedback);
+    const redirectForm=el('form',null,{className:'net-dns-form'});
+    const target=el('input',null,{name:'target',type:'url',required:true,maxLength:2048,value:item.target||'',placeholder:'https://example.com/your-page'});
+    target.setAttribute('aria-label','Destination URL');
+    const targetLabel=el('label','Destination URL');targetLabel.append(target);
+    const code=el('select',null,{name:'status'});code.setAttribute('aria-label','Redirect type');
+    code.append(el('option','301 — Permanent',{value:'301'}),el('option','302 — Temporary',{value:'302'}));code.value=String(item.redirect_status||301);
+    if(!item.target)code.value='301';
+    const codeLabel=el('label','Redirect type');codeLabel.append(code);
+    const save=el('button','Save redirect',{type:'submit',className:'button primary'});
+    const remove=el('button','Remove redirect',{type:'button',className:'button'});remove.hidden=!item.target;
+    const message=el('p','',{className:'net-status'});message.setAttribute('role','status');message.setAttribute('aria-live','polite');
+    const summary=el('p',item.target?`${item.redirect_status} → ${item.target}`:'No URL redirect set.',{className:'net-help'});
+    const redirectPath=`/api/net/v1/names/${encodeURIComponent(item.name)}/redirect`;
+    const changeRedirect=async(clear)=>{
+      save.disabled=true;remove.disabled=true;message.textContent='Saving…';message.classList.remove('net-error');
+      try{
+        const data=await api(redirectPath,clear?{method:'DELETE'}:{method:'PUT',body:JSON.stringify({target:target.value,status:Number(code.value)})});
+        item.target=data.target;item.redirect_status=data.redirectStatus;remove.hidden=!data.target;
+        target.value=data.target||'';summary.textContent=data.target?`${data.redirectStatus} → ${data.target}`:'No URL redirect set.';
+        message.textContent=data.target?'URL redirect saved.':'URL redirect removed.';
+      }catch(error){message.textContent=error.message;message.classList.add('net-error');}
+      finally{save.disabled=false;remove.disabled=false;}
+    };
+    redirectForm.append(targetLabel,codeLabel,save,remove);
+    redirectForm.addEventListener('submit',event=>{event.preventDefault();changeRedirect(false);});
+    remove.addEventListener('click',()=>changeRedirect(true));
+    card.append(el('h3','URL redirect'),el('p','Send visitors to a complete HTTPS URL, including its path. Choose 301 for a permanent move or 302 for a temporary destination. Browsers may remember permanent redirects. AAAA/CNAME records must be removed to use the redirect gateway. The hostname must resolve to the gateway and have a valid HTTPS certificate.',{className:'net-help'}),summary,redirectForm,message);
+    root.append(card);
   }
 }
 document.querySelector('#net-dns-filter').addEventListener('submit',event=>{event.preventDefault();render();});

src/net-records.mjs

@@ -32,7 +32,7 @@ export function normalizeNetRecord(input, name) {
   return { type, value, ttl, priority };
 }
 
-export function createNetRecords(db) {
+export function createNetRecords(db, announceRedirect = async () => {}) {
   let writes = Promise.resolve();
   const transaction = (fn) => {
     const next = writes.then(() => db.transaction(fn));
@@ -54,7 +54,29 @@ export function createNetRecords(db) {
   }
   return {
     async owned(ownerId) {
-      return db.all('SELECT n.label,n.tld,n.status,n.target,t.status AS namespace_status FROM net_names n JOIN net_tlds t ON t.tld=n.tld WHERE n.owner_id=? ORDER BY n.tld,n.label',[ownerId]);
+      return db.all('SELECT n.label,n.tld,n.status,n.target,t.status AS namespace_status,COALESCE(r.status,302) AS redirect_status FROM net_names n JOIN net_tlds t ON t.tld=n.tld LEFT JOIN net_url_redirects r ON r.tld=n.tld AND r.label=n.label WHERE n.owner_id=? ORDER BY n.tld,n.label',[ownerId]);
+    },
+    async setRedirect(name, ownerId, target, status = 301) {
+      if (target !== null) {
+        let url;
+        try { url = new URL(target); } catch {}
+        if (typeof target !== 'string' || target.length > 2048 || !url || url.protocol !== 'https:' || url.username || url.password)
+          throw new W3bsError('INVALID_TARGET','Enter a complete HTTPS destination URL.',400);
+        if ([name, `${name}.w3bs.org`].includes(url.hostname.toLowerCase()))
+          throw new W3bsError('REDIRECT_LOOP','A name cannot redirect to itself.',400);
+        target = url.href;
+        if (![301,302].includes(status)) throw new W3bsError('INVALID_REDIRECT_STATUS','Choose 301 permanent or 302 temporary.',400);
+      }
+      return transaction(async tx => {
+        const [tld,label] = await authorize(tx,name,ownerId);
+        if (target && (await rows(tx,tld,label)).some(r=>['AAAA','CNAME'].includes(r.type)))
+          throw new W3bsError('REDIRECT_DNS_CONFLICT','Remove AAAA or CNAME records first so this name uses the W3BS redirect gateway.',409);
+        await tx.run('UPDATE net_names SET target=? WHERE tld=? AND label=?',[target,tld,label]);
+        if (target) await tx.run('INSERT INTO net_url_redirects(tld,label,status) VALUES(?,?,?) ON CONFLICT(tld,label) DO UPDATE SET status=excluded.status',[tld,label,status]);
+        else await tx.run('DELETE FROM net_url_redirects WHERE tld=? AND label=?',[tld,label]);
+        await announceRedirect(tx,name,target,target ? status : 302,ownerId);
+        return { target, redirectStatus: target ? status : 302 };
+      });
     },
     async list(name) {
       const [tld,label] = parts(name);
@@ -65,6 +87,8 @@ export function createNetRecords(db) {
       const record = normalizeNetRecord(input,name);
       return transaction(async tx => {
         const [tld,label] = await authorize(tx,name,ownerId);
+        if (['AAAA','CNAME'].includes(record.type) && (await tx.get('SELECT target FROM net_names WHERE tld=? AND label=?',[tld,label]))?.target)
+          throw new W3bsError('REDIRECT_DNS_CONFLICT','Remove the URL redirect first before pointing this name at another server.',409);
         const existing = await rows(tx,tld,label);
         if (existing.some(r=>r.type==='CNAME' && (record.type!=='CNAME' || r.value!==record.value)) || (record.type==='CNAME' && existing.some(r=>r.type!=='CNAME')))
           throw new W3bsError('CNAME_CONFLICT','CNAME must be the only record on a name. Remove the existing records first.',409);

src/net-routes.mjs

@@ -417,7 +417,10 @@ export function createNet({
         `<section class="page-head compact"><div class="eyebrow">W3BS NET · ${e(record.status)}</div><h1>${e(name)}</h1><p>This local W3BS record is not active, so the federation backfill is not used for it.</p><a class="button" href="https://w3bs.org/net">W3BS Net</a></section>`,
       ));
     }
-    if (record.target) return res.redirect(302, record.target);
+    if (record.target) {
+      res.set('Cache-Control', 'no-store');
+      return res.redirect(record.redirectStatus === 301 ? 301 : 302, record.target);
+    }
     res.set('X-W3BS-Net-Source', record.source === 'w3bs' ? 'w3bs-primary' : 'w3bs-federation');
     return res.type('html').send(shell(
       name,
@@ -477,19 +480,37 @@ export function createNet({
       if (!name) throw new W3bsError('INVALID_NAME','Use label.namespace.',400);
       res.json({ name, records:await network.dns.remove(name,user.id,req.params.id) });
     });
+    app.put('/api/net/v1/names/:name/redirect', async (req,res) => {
+      const user = await requireAccount(req);
+      const name = safeName(req.params.name);
+      if (!name) throw new W3bsError('INVALID_NAME','Use label.namespace.',400);
+      res.set('Cache-Control','no-store');
+      res.json({ name, ...await network.dns.setRedirect(name,user.id,req.body?.target,req.body?.status ?? 301) });
+    });
+    app.delete('/api/net/v1/names/:name/redirect', async (req,res) => {
+      const user = await requireAccount(req);
+      const name = safeName(req.params.name);
+      if (!name) throw new W3bsError('INVALID_NAME','Use label.namespace.',400);
+      res.json({ name, ...await network.dns.setRedirect(name,user.id,null) });
+    });
     app.get('/net/records', async (req,res) => {
       const { user } = await authorized(req);
       res.set('Cache-Control','no-store');
       res.type('html').send(shell('DNS Records · W3BS Net','Publish DNS records on names you own in this Moshpit instance.','/net',`
-        <section class="page-head compact"><div class="eyebrow">W3BS NET · MOSHPIT INSTANCE</div><h1>DNS <em>records.</em></h1>
-        <p>Real records on the names you hold: AAAA for IPv6, CNAME to another hostname, MX for mail and TXT for verification. Changes publish to this W3BS instance immediately; existing resolver caches follow the record’s TTL.</p>
+        <section class="page-head compact"><div class="eyebrow">W3BS NET · MOSHPIT INSTANCE</div><h1>DNS &amp; <em>redirects.</em></h1>
+        <p>Send a name to any HTTPS URL with a 301 permanent or 302 temporary URL redirect. Or publish DNS records on the names you hold: AAAA for IPv6, CNAME to another hostname, MX for mail and TXT for verification. Changes publish to this W3BS instance immediately; existing resolver caches follow the record’s TTL.</p>
         <p class="net-help">W3BS is a separate Moshpit instance. Your names and records belong here; imported primary-network records remain read-only backfill. The public gateway name is <code>name.namespace.w3bs.org</code>.</p>
         <nav class="net-tabs" aria-label="Network"><a href="/net">Network</a><a href="/net/register">Register</a><a href="/net/records" aria-current="page">DNS Records</a></nav></section>
         ${user ? `<section class="net-block"><form id="net-dns-filter" role="search"><label for="dns-filter">Filter your names</label><input id="dns-filter" name="q" placeholder="dumb.fuck, fuck, dumb.*" autocomplete="off"><button class="button" type="submit">Filter</button></form><p id="dns-status" class="net-status" role="status" aria-live="polite">Loading your names…</p><div id="dns-names"></div></section><script type="module" src="/assets/net-records.js"></script>` : `<section class="net-block"><p>Sign in to publish records on names you own in W3BS.</p><a class="button primary" href="/login?next=%2Fnet%2Frecords">Sign in →</a></section>`}
         <section class="net-block"><h2>Publish from a script</h2><p>Use the existing W3BS OAuth bearer from <code>w3bs login</code>. Primary-network API keys do not grant W3BS ownership.</p><pre>POST /api/net/v1/names/blue.example/records
 { "type": "AAAA", "value": "2606:4700:4700::1111", "ttl": 300 }
 
-GET /api/net/v1/dns/records?name=blue.example</pre></section>`, 'noindex'));
+GET /api/net/v1/dns/records?name=blue.example
+
+PUT /api/net/v1/names/blue.example/redirect
+{ "target": "https://example.com/path", "status": 301 }
+
+DELETE /api/net/v1/names/blue.example/redirect</pre></section>`, 'noindex'));
     });
     app.get('/api/net/v1/resolve/:name', async (req, res) => {
       res.set('Access-Control-Allow-Origin', '*');

src/net-store.mjs

@@ -44,6 +44,10 @@ const TABLES = (sequence) => `
     UNIQUE(tld,label,type,value,priority)
   );
   CREATE INDEX IF NOT EXISTS net_dns_name ON net_dns_records(tld,label);
+  CREATE TABLE IF NOT EXISTS net_url_redirects (
+    tld TEXT NOT NULL, label TEXT NOT NULL, status INTEGER NOT NULL,
+    PRIMARY KEY(tld,label)
+  );
   CREATE TABLE IF NOT EXISTS net_events (
     seq ${sequence},
     event_id TEXT NOT NULL UNIQUE,
@@ -230,8 +234,9 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
     const safeLimit = Math.max(1, Math.min(200, Number(limit) || 100));
     const local = await db.all(
       `SELECT n.tld, n.label, n.target, n.status, n.source, n.created_at,
-              t.policy, n.owner_id
+              t.policy, n.owner_id, COALESCE(r.status,302) AS redirect_status
          FROM net_names n JOIN net_tlds t ON t.tld = n.tld
+         LEFT JOIN net_url_redirects r ON r.tld=n.tld AND r.label=n.label
         WHERE n.status = 'active' AND t.status = 'active'
           AND (? = '' OR lower(n.label || '.' || n.tld) LIKE ?)
         ORDER BY n.tld, n.label LIMIT ?`,
@@ -281,6 +286,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
       .map(([name, value]) => ({
         name,
         target: publicTarget(value.event.data?.target),
+        redirectStatus: value.event.data?.redirectStatus === 301 ? 301 : 302,
         source: value.source,
         importedAt: value.importedAt,
         status: 'federated',
@@ -317,6 +323,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
           tld: row.tld,
           label: row.label,
           target: row.target,
+          redirectStatus: row.redirect_status,
           status: row.status,
           source: 'w3bs',
           claimed: Boolean(row.owner_id),
@@ -330,8 +337,9 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
   async function resolveName(name) {
     const [label, tld] = String(name ?? '').toLowerCase().split('.');
     const local = await db.get(
-      `SELECT n.tld, n.label, n.target, n.status, n.owner_id, n.created_at, t.policy
+      `SELECT n.tld, n.label, n.target, n.status, n.owner_id, n.created_at, t.policy, COALESCE(r.status,302) AS redirect_status
          FROM net_names n JOIN net_tlds t ON t.tld = n.tld
+         LEFT JOIN net_url_redirects r ON r.tld=n.tld AND r.label=n.label
         WHERE n.tld = ? AND n.label = ? AND n.status = 'active' AND t.status = 'active'`,
       [tld, label],
     );
@@ -341,6 +349,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
         source: 'w3bs',
         status: 'active',
         target: local.target,
+        redirectStatus: local.redirect_status,
         claimed: Boolean(local.owner_id),
         createdAt: local.created_at,
       };
@@ -374,6 +383,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
         source: remote.source,
         status: 'federated',
         target: publicTarget(remote.event.data?.target),
+        redirectStatus: remote.event.data?.redirectStatus === 301 ? 301 : 302,
         claimed: Boolean(remote.event.data?.claimed),
         importedAt: remote.importedAt,
       };
@@ -524,7 +534,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
     }
     if (kind !== 'name') return { error: 'invalid_kind' };
     const [label, tld] = String(subject).toLowerCase().split('.');
-    const row = await db.get('SELECT * FROM net_names WHERE tld = ? AND label = ?', [tld, label]);
+    const row = await db.get('SELECT n.*, COALESCE(r.status,302) AS redirect_status FROM net_names n LEFT JOIN net_url_redirects r ON r.tld=n.tld AND r.label=n.label WHERE n.tld = ? AND n.label = ?', [tld, label]);
     if (!row) return { error: 'not_found' };
     if (status === 'active') {
       const namespace = await db.get('SELECT status FROM net_tlds WHERE tld = ?', [tld]);
@@ -542,6 +552,7 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
           data: {
             name: `${label}.${tld}`,
             target: row.target,
+            redirectStatus: row.redirect_status,
             status,
             claimed: Boolean(row.owner_id),
           },
@@ -820,7 +831,10 @@ export function createNetworkStore(db, { instance = 'https://w3bs.org' } = {}) {
   }
 
   return {
-    dns: createNetRecords(db),
+    dns: createNetRecords(db, (tx, name, target, redirectStatus, actor) => announce(tx, {
+      type: 'name.activated', subject: name, actor,
+      data: { name, target, redirectStatus, status: 'active', claimed: true },
+    })),
     ensureDefaults,
     registry,
     resolveName,