update

readme.plan.md

@@ -1,16 +1,27 @@
-# Plan: Move interestMap from certmanager to smartacme core
+# Plan: Add wildcard domain support to SmartAcme
 
 ## Goal
-- Pull the interest coordination mechanism out of the ICertManager implementations and into the SmartAcme class.
+- Enable SmartAcme to accept wildcard domain inputs like `*.domain.com` or `*.sub.example.com` and correctly request and match wildcard certificates.
 
 ## Steps
-1. Remove `interestMap` from `ICertManager` interface (`ts/interfaces/certmanager.ts`) and its import of `InterestMap`.
+1. [x] Extend SmartacmeCertMatcher:
-2. Strip out `interestMap` property, initialization, and usage from `MemoryCertManager` and `MongoCertManager` (`ts/certmanagers/*.ts`).
+   - [x] Update `getCertificateDomainNameByDomainName()` to handle wildcard prefixes:
-3. In `Smartacme` class (`ts/smartacme.classes.smartacme.ts`):
+       - If input starts with `*.` strip the prefix and return the base domain.
-   - Add a private `interestMap: plugins.lik.InterestMap<string, SmartacmeCert>` property.
+       - For example:
-   - Initialize it in the constructor: `this.interestMap = new plugins.lik.InterestMap((domain) => domain);`.
+         - `*.example.com` → `example.com`
-   - Update `getCertificateForDomain()` and any other consumers to reference `this.interestMap` instead of `this.certmanager.interestMap`.
+         - `*.sub.example.com` → `sub.example.com`
-4. Remove any tests or code that reference the old `interestMap` on `ICertManager` (if any).
+         - `*.a.b.example.com` → `a.b.example.com`
-5. Run CI (`pnpm build` and `pnpm test`) and fix any regressions.
+   - [x] Ensure existing logic for non-wildcards remains unchanged.
-
+2. [x] Update `SmartAcme.getCertificateForDomain()`:
-Please review and confirm before we begin the refactor.
+   - [x] Detect wildcard inputs (`domainArg.startsWith('*.')`).
+   - [x] For wildcard cases, enforce DNS-01 challenge only (throw error if handlers don't support DNS-01).
+   - [x] Use the matcher result to request wildcard certificate identifiers (e.g., `value: '*.baseDomain'`).
+3. [x] Update tests:
+   - [x] Add unit tests in `test/test.certmatcher.ts` for wildcard handling:
+       - `*.example.com` → `example.com`
+       - `*.sub.example.com` → `sub.example.com`
+       - `*.a.b.example.com` → `a.b.example.com`
+   - [x] Add integration stub in `test/test.smartacme.ts` for wildcard input in integration mode:
+       - Call `getCertificateForDomain('*.domain.com')` and expect returned cert `domainName` equals `*.domain.com`.
+4. [x] Update documentation (README.md) if needed.
+5. [x] Run CI (`pnpm build` & `pnpm test`) and fix any regressions.

test/test.certmatcher.ts

@@ -18,4 +18,12 @@ tap.test('should return undefined for deeper domain', async () => {
   expect(result).toEqual(undefined);
 });
 
+// Wildcard domain handling
+tap.test('should strip wildcard prefix and return base domain', async () => {
+  const matcher = new SmartacmeCertMatcher();
+  expect(matcher.getCertificateDomainNameByDomainName('*.example.com')).toEqual('example.com');
+  expect(matcher.getCertificateDomainNameByDomainName('*.sub.example.com')).toEqual('sub.example.com');
+  expect(matcher.getCertificateDomainNameByDomainName('*.a.b.example.com')).toEqual('a.b.example.com');
+});
+
 export default tap.start();

test/test.smartacme.integration.ts

@@ -1,7 +1,7 @@
 import { tap, expect } from '@push.rocks/tapbundle';
 import { Qenv } from '@push.rocks/qenv';
 import * as cloudflare from '@apiclient.xyz/cloudflare';
-import { SmartAcme, MongoCertManager } from '../ts/index.js';
+import { SmartAcme, MongoCertManager, MemoryCertManager } from '../ts/index.js';
 import { Dns01Handler } from '../ts/handlers/Dns01Handler.js';
 
 // Load environment variables for credentials (stored under .nogit/)
@@ -20,7 +20,8 @@ let smartAcmeInstance: SmartAcme;
 tap.test('create SmartAcme instance with DNS-01 handler and start', async () => {
   smartAcmeInstance = new SmartAcme({
     accountEmail: 'domains@lossless.org',
-    certManager: new MongoCertManager({ mongoDbName, mongoDbPass, mongoDbUrl }),
+    // certManager: new MongoCertManager({ mongoDbName, mongoDbPass, mongoDbUrl }),
+    certManager: new MemoryCertManager(),
     environment: 'integration',
     retryOptions: {},
     challengeHandlers: [new Dns01Handler(cfAccount)],

test/test.smartacme.ts

@@ -28,5 +28,20 @@ tap.test('constructor accepts valid challengeHandlers', async () => {
   });
   expect(sa).toBeInstanceOf(SmartAcme);
 });
+// Wildcard certificate stub for integration mode
+tap.test('get wildcard certificate stub in integration mode', async () => {
+  const sa = new SmartAcme({
+    accountEmail: 'domains@lossless.org',
+    certManager: new MemoryCertManager(),
+    environment: 'integration',
+    retryOptions: {},
+    challengeHandlers: [new DummyHandler()],
+  });
+  await sa.start();
+  const domainWildcard = '*.example.com';
+  const cert = await sa.getCertificateForDomain(domainWildcard);
+  expect(cert.domainName).toEqual(domainWildcard);
+  await sa.stop();
+});
 
 export default tap.start();

ts/smartacme.classes.certmatcher.ts

@@ -10,10 +10,17 @@ export class SmartacmeCertMatcher {
    * for wild card certificates
    * @param domainNameArg the domainNameArg to create the scope from
    */
-  public getCertificateDomainNameByDomainName(domainNameArg: string): string {
+  public getCertificateDomainNameByDomainName(domainNameArg: string): string | undefined {
+    // Handle wildcard domains by stripping the '*.' prefix.
+    if (domainNameArg.startsWith('*.')) {
+      return domainNameArg.slice(2);
+    }
     const originalDomain = new plugins.smartstring.Domain(domainNameArg);
+    // For domains with up to 3 levels (no level4), return base domain.
     if (!originalDomain.level4) {
       return `${originalDomain.level2}.${originalDomain.level1}`;
     }
+    // Deeper domains (4+ levels) are not supported.
+    return undefined;
   }
 }

ts/smartacme.classes.smartacme.ts

@@ -221,26 +221,24 @@ export class SmartAcme {
    * @param domainArg
    */
   public async getCertificateForDomain(domainArg: string): Promise<SmartacmeCert> {
+    // Determine if this is a wildcard request (e.g., '*.example.com').
+    const isWildcardRequest = domainArg.startsWith('*.');
+    // Determine the base domain for certificate retrieval/issuance.
     const certDomainName = this.certmatcher.getCertificateDomainNameByDomainName(domainArg);
-    const retrievedCertificate = await this.certmanager.retrieveCertificate(certDomainName);
+    if (!certDomainName) {
-    // integration test stub: bypass ACME and return a dummy certificate
+      throw new Error(`Cannot determine certificate domain for ${domainArg}`);
-    if (this.options.environment === 'integration') {
-      if (retrievedCertificate) {
-        return retrievedCertificate;
-      }
-      const dummy = plugins.smartunique.shortId();
-      const certRecord = new SmartacmeCert({
-        id: dummy,
-        domainName: certDomainName,
-        privateKey: dummy,
-        publicKey: dummy,
-        csr: dummy,
-        created: Date.now(),
-        validUntil: Date.now() + plugins.smarttime.getMilliSecondsFromUnits({ days: 90 }),
-      });
-      await this.certmanager.storeCertificate(certRecord);
-      return certRecord;
     }
+    // Wildcard certificates require DNS-01 challenge support.
+    if (isWildcardRequest) {
+      const hasDnsHandler = this.challengeHandlers.some((h) =>
+        h.getSupportedTypes().includes('dns-01'),
+      );
+      if (!hasDnsHandler) {
+        throw new Error('Wildcard certificate requests require a DNS-01 challenge handler');
+      }
+    }
+    // Retrieve any existing certificate record by base domain.
+    const retrievedCertificate = await this.certmanager.retrieveCertificate(certDomainName);
 
     if (
       !retrievedCertificate &&