torbscript/language
Watch
1
0
Fork
You've already forked language
 0
Code Issues 145 Pull requests 6 Projects Releases 16 Packages 3 Wiki Activity Actions 10

registry: a failed domain lookup keeps the one-time code; refuse .local and .internal domains #710

New issue
Open
opened 2026-11-07 22:38:31 +00:00 by orion · 1 comment
orion commented 2026-11-07 22:38:31 +00:00
Collaborator

Context

Two findings from the review of PR #355 (#341, an organisation proves a domain), not filed when it landed:

  1. claimDomain in tools/registry/src/registry.trb calls proved(caller, code, "owners", ...) before domainChecked looks up the TXT record. A lookup that finds no record answers 422, and the second factor's one-time code is spent anyway: the owner fixes the zone and has to wait for a new code.
  2. domainOf in tools/registry/src/domains.trb refuses a numeric last label and localhost, but foo.local (mDNS, RFC 6762) and foo.internal (reserved for private use) pass, and no badge should ever say an organisation holds one of them.

Source

Goal

A failed proof costs the owner nothing but the retry, and only domains on the public DNS can be proved.

Acceptance criteria

  • A claim whose lookup finds no torb-owner=<owner> record answers 422 and the same one-time code still proves the next attempt; a test in tools/registry/tests/ shows both calls
  • The code is still spent by a claim that succeeds, and a wrong code still answers as today before any lookup
  • domainOf refuses a domain whose last label is local, internal, localhost, test, example or invalid (RFC 6761, RFC 6762), with a message naming the rule; a test per label
  • The doc comment of claimDomain says when the code is taken

Dependencies

None.

Seed

No: tools/registry/ only.

Size

One PR, one or two commits (fix(registry): ...).

## Context Two findings from the review of PR #355 (#341, an organisation proves a domain), not filed when it landed: 1. `claimDomain` in [`tools/registry/src/registry.trb`](https://git.torb.dev/torbscript/language/src/branch/main/tools/registry/src/registry.trb) calls `proved(caller, code, "owners", ...)` before `domainChecked` looks up the `TXT` record. A lookup that finds no record answers `422`, and the second factor's one-time code is spent anyway: the owner fixes the zone and has to wait for a new code. 2. `domainOf` in [`tools/registry/src/domains.trb`](https://git.torb.dev/torbscript/language/src/branch/main/tools/registry/src/domains.trb) refuses a numeric last label and `localhost`, but `foo.local` (mDNS, RFC 6762) and `foo.internal` (reserved for private use) pass, and no badge should ever say an organisation holds one of them. ## Source - [`docs/design/RELEASE.md`](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/RELEASE.md), the registry's owner domains (#341). - The review notes of PR #355. ## Goal A failed proof costs the owner nothing but the retry, and only domains on the public DNS can be proved. ## Acceptance criteria - [ ] A claim whose lookup finds no `torb-owner=<owner>` record answers `422` and the same one-time code still proves the next attempt; a test in `tools/registry/tests/` shows both calls - [ ] The code is still spent by a claim that succeeds, and a wrong code still answers as today before any lookup - [ ] `domainOf` refuses a domain whose last label is `local`, `internal`, `localhost`, `test`, `example` or `invalid` (RFC 6761, RFC 6762), with a message naming the rule; a test per label - [ ] The doc comment of `claimDomain` says when the code is taken ## Dependencies None. ## Seed No: `tools/registry/` only. ## Size One PR, one or two commits (`fix(registry): ...`).
orion commented 2026-11-07 22:38:33 +00:00
Author
Collaborator

[loop:torbscript] re-sweep: filed as homeless work from the review notes of PR #355 (#341), checked against main: claimDomain still calls proved before domainChecked, and domainOf still lets .local and .internal through. Label loop, no ready: refine confirms whether test, example and invalid belong in the same refusal.

[loop:torbscript] re-sweep: filed as homeless work from the review notes of PR #355 (#341), checked against `main`: `claimDomain` still calls `proved` before `domainChecked`, and `domainOf` still lets `.local` and `.internal` through. Label `loop`, no `ready`: refine confirms whether `test`, `example` and `invalid` belong in the same refusal.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
loop/125-cli-completions
loop/783-registry-commands-std-cli
loop/781-xxhash-lz4-frame
loop/776-web-middleware-app
loop/779-std-transform-2d
loop/763-tierb-probe
probe/763-tier-b
loop/705-fix-candidate
orion/456-tierb-probe
loop/164-measure2
loop/207-measure
loop/164-prototype
probe/207-count
loop/205-measure
loop/140-hide-staged
nightly-20261113
nightly-20261112
nightly-20261111
nightly-20261103
nightly-20261031
nightly-20261029
nightly-20261027
nightly-20261026
nightly-20261025
nightly-20261024
nightly-20261023
nightly-20261021
nightly-20261020
nightly-20261015
nightly-20261014
seeds
Labels
Clear labels   
loop
Backlog item of the project loop (Orion), see CONTRIBUTING

  
queue/failed
Ejected from the merge queue (conflict or red CI)

  
queue/queued
Approved, waiting in the merge queue

  
ready
Refined to the definition of ready

  
status/parked
Parked with a reason in the newest loop comment

No labels
loop
queue/failed
queue/queued
ready
status/parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
torbscript/language#710
No description provided.