Custom domains for multi-tenant apps on Vercel

/**
 * Vercel's API, not DomainKit, attaches the customer's hostname to your own Vercel project. The
 * response names the registrable domain (`apexName`) and any TXT proof Vercel still wants.
 */
export const addToProject = async (input: {
  readonly hostname: string;
  readonly token: string;
}) => {
  const response = await fetch(`https://api.vercel.com/v10/projects/${projectId}/domains`, {
    method: "POST",
    headers: vercelHeaders(input.token),
    body: JSON.stringify({ name: input.hostname }),
  });
  if (!response.ok) throw new Error(`Vercel refused ${input.hostname}: ${response.status}`);
  return (await response.json()) as {
    readonly name: string;
    readonly apexName: string;
    readonly verified: boolean;
    readonly verification?: ReadonlyArray<{
      readonly type: string;
      readonly domain: string;
      readonly value: string;
    }>;
  };
};

/**
 * Where Vercel says the hostname should point: a CNAME target for a subdomain, an address for an
 * apex domain. Read it from Vercel's domain configuration rather than hard-coding a value.
 */
export const recommendedRoute = async (input: {
  readonly hostname: string;
  readonly apexName: string;
  readonly token: string;
}) => {
  const response = await fetch(
    `https://api.vercel.com/v6/domains/${input.hostname}/config?projectIdOrName=${projectId}`,
    { headers: vercelHeaders(input.token) },
  );
  if (!response.ok)
    throw new Error(`Vercel config failed for ${input.hostname}: ${response.status}`);
  const config = (await response.json()) as {
    readonly recommendedCNAME?: ReadonlyArray<{ readonly rank: number; readonly value: string }>;
    readonly recommendedIPv4?: ReadonlyArray<{
      readonly rank: number;
      readonly value: ReadonlyArray<string>;
    }>;
  };
  const best = <A extends { readonly rank: number }>(options: ReadonlyArray<A> | undefined) =>
    [...(options ?? [])].sort((left, right) => left.rank - right.rank)[0];
  const address = best(config.recommendedIPv4)?.value[0];
  const cname = best(config.recommendedCNAME)?.value;
  const route =
    input.hostname === input.apexName ? (address ? { address } : null) : cname ? { cname } : null;
  if (route === null) throw new Error(`Vercel gave no route for ${input.hostname}`);
  return route;
};

/**
 * What Vercel told you the customer must add: where the hostname should point, and any TXT proof
 * Vercel asked for. Pass the values Vercel returned; do not copy them from a docs page.
 */
export interface HostnameInput {
  readonly hostname: string;
  readonly route: { readonly cname: string } | { readonly address: string };
  /** Vercel omits `verification` when it needs no ownership proof. */
  readonly verification?:
    | ReadonlyArray<{ readonly domain: string; readonly value: string }>
    | undefined;
}

export const requirements = (input: HostnameInput) => [
  "cname" in input.route
    ? DnsRecord.cname({
        name: input.hostname,
        target: input.route.cname,
        purpose: "Send traffic to your app",
      })
    : DnsRecord.a({
        name: input.hostname,
        address: input.route.address,
        purpose: "Send traffic to your app",
      }),
  ...(input.verification ?? []).map((record) =>
    DnsRecord.txt({
      name: record.domain,
      value: record.value,
      purpose: "Prove you own the domain",
    }),
  ),
];

/**
 * Adding OAuth adds one method to the same definition. Scope ids come from the OAuth client you
 * registered with Cloudflare; the default set is `zone.read`, `dns.read`, `dns.write`,
 * `offline_access`.
 */
export const withOAuth = Cloudflare.provider({
  oauth: {
    clientId: Config.String("CF_CLIENT_ID"),
    clientSecret: Config.Redacted("CF_CLIENT_SECRET"),
  },
});

/**
 * A marketplace install redirects like OAuth but is not OAuth: the flow starts at the integration's
 * install URL and exchanges a one-time code at Vercel's token endpoint.
 */
export const withIntegration = Vercel.provider({
  integration: {
    clientId: Config.String("VERCEL_CLIENT_ID"),
    clientSecret: Config.Redacted("VERCEL_CLIENT_SECRET"),
    slug: "acme-domains",
  },
});

/**
 * Connect and attach the registrable domain (`apexName`), not the subdomain. Vercel's ownership
 * TXT record sits at `_vercel.<apexName>`, so the plan, the connection, and the later observation
 * all use the apex. `Resolved` means the customer already connected an account that reaches it.
 */
export const connectApex = (apexName: string) =>
  Effect.gen(function* () {
    const discovery = yield* Connect.discover(apexName);
    if (discovery._tag !== "Resolved") return discovery;
    return yield* Connect.attach({
      connectionId: discovery.connectionId,
      domain: apexName,
      target: discovery.target,
    });
  });

/**
 * One plan per apex. Pass every hostname the customer has under it: a later plan replaces the
 * earlier one as the receipt that observation reads, so a second hostname rebuilds the plan from
 * all of them. The records already in the zone become no-ops. This step never writes.
 */
export const planForCustomer = (input: {
  readonly apexName: string;
  readonly hostnames: ReadonlyArray<HostnameInput>;
}) => {
  const records = new Map(
    input.hostnames
      .flatMap(requirements)
      .map((record) => [`${record._tag}|${record.name}|${DnsRecord.data(record)}`, record]),
  );
  return Provision.plan({ domain: input.apexName, requirements: [...records.values()] });
};

/**
 * Two calls, with the customer's decision between them. Show `Plan.writes(plan)` first; run
 * `approveReviewedPlan` only when they press approve, then `applyApproved`. Apply re-plans and
 * fails `Stale` when the zone moved. A partial receipt is data: its `outcomes` say which write
 * failed and why.
 */
export const approveReviewedPlan = (planId: Plan.PlanId) => Provision.approve(planId);

export const applyApproved = (approval: Approval.Model) =>
  Effect.map(Provision.apply(approval), (receipt) => ({
    complete: Receipt.isComplete(receipt),
    written: Receipt.applied(receipt).length,
    outcomes: receipt.outcomes,
  }));

/**
 * Run this from your own job until the hostname works. It observes the apex's DNS first and attaches
 * Vercel's answer only afterwards. Pass `requirements` while nothing has been applied, when the
 * customer added the records by hand or the plan is not applied yet; once a receipt exists, DNS is
 * checked against it. Vercel, not DNS, decides when it serves the
 * hostname, so its answer is host evidence beside DomainKit's observation. The status is `ok` only
 * when Vercel has verified the domain and its configuration reports `misconfigured: false`. The
 * `source` carries the hostname, so two hostnames under one domain keep separate rows. A request
 * that errors or is rejected is `failed`, not a hostname that is merely waiting.
 */
export const recordVercelStatus = (input: {
  readonly apexName: string;
  readonly hostname: string;
  readonly token: string;
  readonly requirements?: ReadonlyArray<DnsRecord.Model>;
}) =>
  Effect.gen(function* () {
    // DNS first, so the returned readiness reflects this run's observation, not only Vercel's answer.
    yield* Verify.observe(
      input.requirements === undefined
        ? { domain: input.apexName }
        : { domain: input.apexName, requirements: input.requirements },
    );
    const ask = (url: string) =>
      Effect.tryPromise(async () => {
        const response = await fetch(url, { headers: vercelHeaders(input.token) });
        if (!response.ok) return { body: null, problem: `HTTP ${response.status}` };
        try {
          return { body: (await response.json()) as unknown, problem: null };
        } catch {
          return { body: null, problem: `HTTP ${response.status} with an unreadable body` };
        }
      }).pipe(
        Effect.catch((error) =>
          Effect.succeed({ body: null, problem: `request error: ${String(error)}` }),
        ),
      );
    const domain = yield* ask(
      `https://api.vercel.com/v9/projects/${projectId}/domains/${input.hostname}`,
    );
    const config = yield* ask(
      `https://api.vercel.com/v6/domains/${input.hostname}/config?projectIdOrName=${projectId}`,
    );
    const verified = (domain.body as { readonly verified?: boolean } | null)?.verified === true;
    const misconfigured =
      (config.body as { readonly misconfigured?: boolean } | null)?.misconfigured !== false;
    const failed = domain.body === null || config.body === null;
    const observedAt = yield* DateTime.now;
    return yield* Verify.attachEvidence({
      domain: input.apexName,
      evidence: [
        new Verify.HostEvidence({
          source: `vercel-domain:${input.hostname}`,
          status: failed ? "failed" : verified && !misconfigured ? "ok" : "pending",
          label: `Vercel serves ${input.hostname}`,
          detail: failed
            ? `Vercel request failed (${domain.problem ?? config.problem})`
            : verified && !misconfigured
              ? null
              : verified
                ? "Vercel reports the DNS as misconfigured"
                : "Vercel has not verified the domain yet",
          observedAt,
        }),
      ],
    });
  });