feat: remove domains whose zones vanished at the provider on import

internal/store/db/domains.sql.go

@@ -75,6 +75,47 @@ func (q *Queries) DeleteDomain(ctx context.Context, arg DeleteDomainParams) erro
 	return err
 }
 
+const deleteDomainsNotInZones = `-- name: DeleteDomainsNotInZones :many
+DELETE FROM domains
+WHERE project_id = $1 AND provider_account_id = $2 AND zone_id <> ALL($3::text[])
+RETURNING id, project_id, provider_account_id, zone_name, zone_id, template_id, created_at, last_check_status
+`
+
+type DeleteDomainsNotInZonesParams struct {
+	ProjectID         uuid.UUID `json:"project_id"`
+	ProviderAccountID uuid.UUID `json:"provider_account_id"`
+	ZoneIds           []string  `json:"zone_ids"`
+}
+
+func (q *Queries) DeleteDomainsNotInZones(ctx context.Context, arg DeleteDomainsNotInZonesParams) ([]Domain, error) {
+	rows, err := q.db.Query(ctx, deleteDomainsNotInZones, arg.ProjectID, arg.ProviderAccountID, arg.ZoneIds)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []Domain
+	for rows.Next() {
+		var i Domain
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ProviderAccountID,
+			&i.ZoneName,
+			&i.ZoneID,
+			&i.TemplateID,
+			&i.CreatedAt,
+			&i.LastCheckStatus,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getDomain = `-- name: GetDomain :one
 SELECT id, project_id, provider_account_id, zone_name, zone_id, template_id, created_at, last_check_status FROM domains WHERE id = $1 AND project_id = $2
 `

internal/store/queries/domains.sql

@@ -37,3 +37,8 @@ UPDATE domains SET last_check_status = $2 WHERE id = $1 AND project_id = $3;
 
 -- name: CountDriftDomains :one
 SELECT count(*) FROM domains WHERE last_check_status = 'drift';
+
+-- name: DeleteDomainsNotInZones :many
+DELETE FROM domains
+WHERE project_id = $1 AND provider_account_id = $2 AND zone_id <> ALL($3::text[])
+RETURNING *;

internal/store/store_test.go

@@ -103,13 +103,16 @@ func TestImportDomains_CommitsAllOnSuccess(t *testing.T) {
 		{ID: "z1", Name: "a.example.com"},
 		{ID: "z2", Name: "b.example.com"},
 	}
-	doms, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
+	doms, removed, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(doms) != 2 {
 		t.Fatalf("expected 2 domains returned, got %d", len(doms))
 	}
+	if len(removed) != 0 {
+		t.Fatalf("expected 0 removed domains, got %d", len(removed))
+	}
 
 	list, err := s.ListDomains(ctx, defaultProject)
 	if err != nil {
@@ -131,7 +134,7 @@ func TestImportDomains_RollsBackAllOnError(t *testing.T) {
 		{ID: "z1", Name: "a.example.com"},
 		{ID: "z2", Name: "b.example.com"},
 	}
-	if _, err := s.ImportDomains(ctx, defaultProject, bogusAccountID, zones); err == nil {
+	if _, _, err := s.ImportDomains(ctx, defaultProject, bogusAccountID, zones); err == nil {
 		t.Fatal("expected FK violation error, got nil")
 	}
 
@@ -161,7 +164,7 @@ func TestImportDomains_IdempotentOnRepeat(t *testing.T) {
 		{ID: "z1", Name: "a.example.com"},
 		{ID: "z2", Name: "b.example.com"},
 	}
-	first, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
+	first, _, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -169,13 +172,16 @@ func TestImportDomains_IdempotentOnRepeat(t *testing.T) {
 		t.Fatalf("expected 2 domains on first import, got %d", len(first))
 	}
 
-	second, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
+	second, removed, err := s.ImportDomains(ctx, defaultProject, acc.ID, zones)
 	if err != nil {
 		t.Fatalf("expected repeat import to succeed idempotently, got error: %v", err)
 	}
 	if len(second) != 0 {
 		t.Fatalf("expected 0 newly-created domains on repeat import, got %d", len(second))
 	}
+	if len(removed) != 0 {
+		t.Fatalf("expected 0 removed domains on repeat import with the same zones, got %d", len(removed))
+	}
 
 	list, err := s.ListDomains(ctx, defaultProject)
 	if err != nil {
@@ -207,7 +213,7 @@ func TestSetDomainTemplate_ClosesImportCheckLoop(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	doms, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
+	doms, _, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -255,7 +261,7 @@ func TestSetDomainTemplate_RejectsForeignProjectTemplate(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	doms, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
+	doms, _, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -289,7 +295,7 @@ func seedDomain(t *testing.T, s *Store, ctx context.Context) Domain {
 	if err != nil {
 		t.Fatal(err)
 	}
-	doms, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
+	doms, _, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{{ID: "z1", Name: "a.example.com"}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -363,3 +369,140 @@ func TestCustomRecordsDeleteAndCascade(t *testing.T) {
 		t.Fatalf("expected cascade to remove keys with the domain, got %+v", keys)
 	}
 }
+
+// seedAccount creates an additional provider account for an existing
+// project — used to test that ImportDomains scopes its deletions to a
+// single account, not the whole project.
+func seedAccount(t *testing.T, s *Store, ctx context.Context, projectID uuid.UUID) Account {
+	t.Helper()
+	acc, err := s.Queries().CreateAccount(ctx, db.CreateAccountParams{
+		ID: uuid.New(), ProjectID: projectID, Provider: "selectel", SecretEnc: "enc-blob",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return accountFromDB(acc)
+}
+
+// TestImportDomainsRemovesVanishedZones verifies the sync behavior added to
+// ImportDomains: a domain whose zone no longer appears in the provider's
+// zone list is deleted on the next import, closing the orphan-domain gap
+// (previously such a domain sat forever in status "error").
+func TestImportDomainsRemovesVanishedZones(t *testing.T) {
+	s, ctx := newStore(t)
+	acc, err := s.Queries().CreateAccount(ctx, db.CreateAccountParams{
+		ID: uuid.New(), ProjectID: defaultProject, Provider: "selectel", SecretEnc: "enc-blob",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, removed, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{
+		{ID: "z1", Name: "one.example.com."},
+		{ID: "z2", Name: "two.example.com."},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(created) != 2 || len(removed) != 0 {
+		t.Fatalf("first import: expected 2 created / 0 removed, got %d/%d", len(created), len(removed))
+	}
+
+	// z2 disappeared at the provider — re-import must remove its domain.
+	created, removed, err = s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{
+		{ID: "z1", Name: "one.example.com."},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(created) != 0 {
+		t.Fatalf("expected nothing new to be created, got %+v", created)
+	}
+	if len(removed) != 1 || removed[0].ZoneID != "z2" {
+		t.Fatalf("expected the vanished zone's domain to be removed, got %+v", removed)
+	}
+	left, err := s.ListDomains(ctx, defaultProject)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) != 1 || left[0].ZoneID != "z1" {
+		t.Fatalf("expected only z1 to survive, got %+v", left)
+	}
+}
+
+// TestImportDomainsEmptyZoneListRemovesNothing verifies the safety guard: an
+// empty zone list from the provider is indistinguishable from a temporary
+// loss of access, so it must never delete anything.
+func TestImportDomainsEmptyZoneListRemovesNothing(t *testing.T) {
+	s, ctx := newStore(t)
+	acc, err := s.Queries().CreateAccount(ctx, db.CreateAccountParams{
+		ID: uuid.New(), ProjectID: defaultProject, Provider: "selectel", SecretEnc: "enc-blob",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, _, err := s.ImportDomains(ctx, defaultProject, acc.ID, []provider.Zone{
+		{ID: "z1", Name: "one.example.com."},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	created, removed, err := s.ImportDomains(ctx, defaultProject, acc.ID, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(created) != 0 || len(removed) != 0 {
+		t.Fatalf("empty zone list must be a no-op, got %d created / %d removed", len(created), len(removed))
+	}
+	left, err := s.ListDomains(ctx, defaultProject)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) != 1 {
+		t.Fatalf("expected the domain to survive an empty zone list, got %+v", left)
+	}
+}
+
+// TestImportDomainsOnlyTouchesItsOwnAccount verifies deletion is scoped to
+// the account being imported: a project may hold several provider accounts,
+// and one account's zone list says nothing about another account's domains.
+func TestImportDomainsOnlyTouchesItsOwnAccount(t *testing.T) {
+	s, ctx := newStore(t)
+	accA, err := s.Queries().CreateAccount(ctx, db.CreateAccountParams{
+		ID: uuid.New(), ProjectID: defaultProject, Provider: "selectel", SecretEnc: "enc-blob",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	accB := seedAccount(t, s, ctx, defaultProject)
+
+	if _, _, err := s.ImportDomains(ctx, defaultProject, accB.ID, []provider.Zone{
+		{ID: "zb", Name: "b.example.com."},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := s.ImportDomains(ctx, defaultProject, accA.ID, []provider.Zone{
+		{ID: "za", Name: "a.example.com."},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Re-importing accA with the same single zone must not touch accB's domains.
+	_, removed, err := s.ImportDomains(ctx, defaultProject, accA.ID, []provider.Zone{
+		{ID: "za", Name: "a.example.com."},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(removed) != 0 {
+		t.Fatalf("import for one account must not remove another account's domains, got %+v", removed)
+	}
+	left, err := s.ListDomains(ctx, defaultProject)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) != 2 {
+		t.Fatalf("expected both accounts' domains to survive, got %+v", left)
+	}
+}

internal/store/tenant.go

@@ -187,25 +187,30 @@ func (s *Store) GetDomain(ctx context.Context, id, projectID uuid.UUID) (Domain,
 	return domainFromDB(d), nil
 }
 
-// ImportDomains creates one domain per zone inside a single transaction: if
-// any zone fails to be created, the whole batch is rolled back so callers
-// never observe a partially-imported set of domains.
+// ImportDomains synchronises a provider account's zones with the domains
+// stored for it, inside a single transaction: zones without a domain are
+// created (ON CONFLICT DO NOTHING keeps repeated imports idempotent), and
+// domains whose zone no longer exists at the provider are deleted. Deletion
+// is scoped to accountID — a project may hold several provider accounts, and
+// one account's zone list says nothing about another's domains.
 //
-// Import is idempotent: zones that already have a domain for this project
-// (enforced by the domains_project_zone_uniq constraint) are silently
-// skipped via ON CONFLICT DO NOTHING rather than erroring or duplicating —
-// so a repeated POST .../import never creates duplicate domains. Only the
-// zones that were actually newly created are returned.
-func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]Domain, error) {
+// An empty zone list removes nothing: it is indistinguishable from an account
+// that temporarily lost access to its zones, and the cost of being wrong is
+// every domain of the account gone along with its check history.
+//
+// Returns the domains actually created and the ones actually removed.
+func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]Domain, []Domain, error) {
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	defer tx.Rollback(ctx) // no-op once Commit has succeeded
 
 	q := s.q.WithTx(tx)
-	out := make([]Domain, 0, len(zones))
+	created := make([]Domain, 0, len(zones))
+	zoneIDs := make([]string, 0, len(zones))
 	for _, z := range zones {
+		zoneIDs = append(zoneIDs, z.ID)
 		d, err := q.ImportDomain(ctx, db.ImportDomainParams{
 			ID: uuid.New(), ProjectID: projectID, ProviderAccountID: accountID,
 			ZoneName: z.Name, ZoneID: z.ID, TemplateID: nil,
@@ -216,14 +221,28 @@ func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUI
 				// for this project — skip it rather than fail the batch.
 				continue
 			}
-			return nil, err
+			return nil, nil, err
 		}
-		out = append(out, domainFromDB(d))
+		created = append(created, domainFromDB(d))
 	}
+
+	removed := make([]Domain, 0)
+	if len(zoneIDs) > 0 {
+		gone, err := q.DeleteDomainsNotInZones(ctx, db.DeleteDomainsNotInZonesParams{
+			ProjectID: projectID, ProviderAccountID: accountID, ZoneIds: zoneIDs,
+		})
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, d := range gone {
+			removed = append(removed, domainFromDB(d))
+		}
+	}
+
 	if err := tx.Commit(ctx); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	return out, nil
+	return created, removed, nil
 }
 
 // SetDomainTemplate attaches (or clears, when templateID is nil) the DNS