allow user to fuck with <user>.endpoints

api/dns.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"database/sql"
+	"fmt"
 	"log"
 	"net/http"
 	"strconv"
@@ -20,10 +21,23 @@ type FormError struct {
 
 func userCanFuckWithDNSRecord(dbConn *sql.DB, user *database.User, record *database.DNSRecord) bool {
 	ownedByUser := (user.ID == record.UserID)
+	if !ownedByUser {
+		return false
+	}
 
 	if !record.Internal {
-		publicallyOwnedByUser := (record.Name == user.Username || strings.HasSuffix(record.Name, "."+user.Username))
+		userOwnedDomains := []string{
-		return ownedByUser && publicallyOwnedByUser
+			fmt.Sprintf("%s", user.Username),
+			fmt.Sprintf("%s.endpoints", user.Username),
+		}
+
+		for _, domain := range userOwnedDomains {
+			isInSubDomain := strings.HasSuffix(record.Name, "."+domain)
+			if domain == record.Name || isInSubDomain {
+				return true
+			}
+		}
+		return false
 	}
 
 	owner, err := database.FindFirstDomainOwnerId(dbConn, record.Name)