dns

Overview ¶

Package dns forwards the console's DNS dashboard traffic (/v1/dns/*) to the Hanzo DNS control plane (dns/plugin/hanzodns), which owns the authoritative zone/record store. cloud serves console.hanzo.ai (the DnsModule) but holds no DNS state of its own, so without this thin head console.hanzo.ai/v1/dns/* 404s and the dashboard shows empty zones.

SHAPE. One prefix (/v1/dns/*), every verb, full path passthrough, forwarded to a service whose base URL comes from env (HANZO_DNS_URL) -- the SAME shape and env convention the domain product uses to reach the same plane. It builds a FRESH upstream request and sets only the headers it means to send, so no inbound header (a stray cookie, a forged X-*, an injected Authorization copy) is blindly relayed.

ISOLATION -- BEARER RELAY, NO STANDING CRED. The DNS plane is OIDC-gated and keys every zone per-org: it re-validates the caller's OWN bearer and derives the org from the `owner` claim. This head relays that identity UNCHANGED -- the caller's validated bearer as Authorization (cloud.CallerBearer), plus the server-validated org as X-Org-Id -- and substitutes NO service credential (which would collapse tenants). So a caller in org A can reach only org A's zones, exactly as if it had called the DNS plane directly. Fail-closed: a request with no validated principal is refused 403 before any byte leaves cloud.