feat: remove domains whose zones vanished at the provider on import

internal/store/tenant.go

@@ -187,25 +187,30 @@ func (s *Store) GetDomain(ctx context.Context, id, projectID uuid.UUID) (Domain,
 	return domainFromDB(d), nil
 }
 
-// ImportDomains creates one domain per zone inside a single transaction: if
-// any zone fails to be created, the whole batch is rolled back so callers
-// never observe a partially-imported set of domains.
+// ImportDomains synchronises a provider account's zones with the domains
+// stored for it, inside a single transaction: zones without a domain are
+// created (ON CONFLICT DO NOTHING keeps repeated imports idempotent), and
+// domains whose zone no longer exists at the provider are deleted. Deletion
+// is scoped to accountID — a project may hold several provider accounts, and
+// one account's zone list says nothing about another's domains.
 //
-// Import is idempotent: zones that already have a domain for this project
-// (enforced by the domains_project_zone_uniq constraint) are silently
-// skipped via ON CONFLICT DO NOTHING rather than erroring or duplicating —
-// so a repeated POST .../import never creates duplicate domains. Only the
-// zones that were actually newly created are returned.
-func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]Domain, error) {
+// An empty zone list removes nothing: it is indistinguishable from an account
+// that temporarily lost access to its zones, and the cost of being wrong is
+// every domain of the account gone along with its check history.
+//
+// Returns the domains actually created and the ones actually removed.
+func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]Domain, []Domain, error) {
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	defer tx.Rollback(ctx) // no-op once Commit has succeeded
 
 	q := s.q.WithTx(tx)
-	out := make([]Domain, 0, len(zones))
+	created := make([]Domain, 0, len(zones))
+	zoneIDs := make([]string, 0, len(zones))
 	for _, z := range zones {
+		zoneIDs = append(zoneIDs, z.ID)
 		d, err := q.ImportDomain(ctx, db.ImportDomainParams{
 			ID: uuid.New(), ProjectID: projectID, ProviderAccountID: accountID,
 			ZoneName: z.Name, ZoneID: z.ID, TemplateID: nil,
@@ -216,14 +221,28 @@ func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUI
 				// for this project — skip it rather than fail the batch.
 				continue
 			}
-			return nil, err
+			return nil, nil, err
 		}
-		out = append(out, domainFromDB(d))
+		created = append(created, domainFromDB(d))
 	}
+
+	removed := make([]Domain, 0)
+	if len(zoneIDs) > 0 {
+		gone, err := q.DeleteDomainsNotInZones(ctx, db.DeleteDomainsNotInZonesParams{
+			ProjectID: projectID, ProviderAccountID: accountID, ZoneIds: zoneIDs,
+		})
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, d := range gone {
+			removed = append(removed, domainFromDB(d))
+		}
+	}
+
 	if err := tx.Commit(ctx); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	return out, nil
+	return created, removed, nil
 }
 
 // SetDomainTemplate attaches (or clears, when templateID is nil) the DNS