fix(store,api): идемпотентный import (UNIQUE+ON CONFLICT) + PATCH привязки шаблона к домену

internal/store/tenant.go

@@ -2,8 +2,10 @@ package store
 
 import (
 	"context"
+	"errors"
 
 	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
 
 	"github.com/vasyakrg/dns-autoresolver/internal/provider"
 	"github.com/vasyakrg/dns-autoresolver/internal/store/db"
@@ -166,6 +168,12 @@ func (s *Store) DeleteDomain(ctx context.Context, id, projectID uuid.UUID) error
 // ImportDomains creates one domain per zone inside a single transaction: if
 // any zone fails to be created, the whole batch is rolled back so callers
 // never observe a partially-imported set of domains.
+//
+// Import is idempotent: zones that already have a domain for this project
+// (enforced by the domains_project_zone_uniq constraint) are silently
+// skipped via ON CONFLICT DO NOTHING rather than erroring or duplicating —
+// so a repeated POST .../import never creates duplicate domains. Only the
+// zones that were actually newly created are returned.
 func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]Domain, error) {
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
@@ -176,11 +184,16 @@ func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUI
 	q := s.q.WithTx(tx)
 	out := make([]Domain, 0, len(zones))
 	for _, z := range zones {
-		d, err := q.CreateDomain(ctx, db.CreateDomainParams{
+		d, err := q.ImportDomain(ctx, db.ImportDomainParams{
 			ID: uuid.New(), ProjectID: projectID, ProviderAccountID: accountID,
 			ZoneName: z.Name, ZoneID: z.ID, TemplateID: nil,
 		})
 		if err != nil {
+			if errors.Is(err, pgx.ErrNoRows) {
+				// ON CONFLICT DO NOTHING: this zone was already imported
+				// for this project — skip it rather than fail the batch.
+				continue
+			}
 			return nil, err
 		}
 		out = append(out, domainFromDB(d))
@@ -190,3 +203,22 @@ func (s *Store) ImportDomains(ctx context.Context, projectID, accountID uuid.UUI
 	}
 	return out, nil
 }
+
+// SetDomainTemplate attaches (or clears, when templateID is nil) the DNS
+// template used to check/apply a domain. When templateID is non-nil it must
+// belong to the same project — verified via scoped GetTemplate — otherwise
+// a caller could bind a domain to another tenant's template.
+func (s *Store) SetDomainTemplate(ctx context.Context, domainID, projectID uuid.UUID, templateID *uuid.UUID) (Domain, error) {
+	if templateID != nil {
+		if _, err := s.GetTemplate(ctx, *templateID, projectID); err != nil {
+			return Domain{}, err
+		}
+	}
+	d, err := s.q.UpdateDomainTemplate(ctx, db.UpdateDomainTemplateParams{
+		ID: domainID, ProjectID: projectID, TemplateID: templateID,
+	})
+	if err != nil {
+		return Domain{}, err
+	}
+	return domainFromDB(d), nil
+}