Method ClaimOrCreateDomain

internal/identity/store.go:480–554

ClaimOrCreateDomain implements the atomic create/claim logic from the design doc. Creates if new, returns the existing row when the same user already owns it (verified or not), and errors if a different user owns it. The verification_token and DKIM keypair are minted on first INSERT and remain stabl

(ctx context.Context, domain, userID string)

// domain before invoking this — the store has no concept of a reserved
// domain.
func (s *Store) ClaimOrCreateDomain(ctx context.Context, domain, userID string) (*Domain, error) {
	domain = normalizeDomain(domain)

	verificationToken := "e2a-verify=" + generateID()

	// Generate a DKIM keypair for this domain. Failures here are
	// non-fatal — the columns are nullable and the outbound signer
	// treats a missing key as "skip DKIM". We still log because key gen
	// failing is a hard signal (entropy exhaustion or an OS-level
	// CSPRNG bug) that ops should see.
	var dkimSelector string
	var dkimPubKey string
	var dkimPrivKey []byte
	if kp, kerr := dkim.GenerateKeypair(); kerr == nil {
		// Encrypt the private key at rest (#144). On seal failure (catastrophic
		// RNG) drop ALL three DKIM columns so we never publish a public key /
		// selector without a usable private key — non-fatal, same posture as a
		// keygen failure (the signer treats a missing key as "skip DKIM").
		sealed, serr := s.sealDKIM(kp.PrivateKeyDER, domain)
		if serr != nil {
			log.Printf("[identity] dkim key seal failed for %s: %v", domain, serr)
		} else {
			dkimSelector = kp.Selector
			dkimPubKey = kp.PublicKeyDNS
			dkimPrivKey = sealed
		}
	} else {
		log.Printf("[identity] dkim keygen failed for %s: %v", domain, kerr)
	}

	// Atomic upsert. The conflict branch only fires for a same-user
	// re-claim of an unverified row, and runs as a no-op SET so
	// RETURNING surfaces the existing row. DKIM columns and the
	// verification_token are only written on a true INSERT, so they
	// stay stable across re-claims — DKIM stability avoids
	// invalidating signatures on mail in flight, and token stability
	// means a caller who already published the TXT record on DNS
	// isn't silently invalidated. A different-user conflict falls
	// through to the SELECT below and returns "domain not available",
	// preventing squatting on an unverified row whose TXT record the
	// original owner may have already published.
	d := &Domain{}
	err := s.pool.QueryRow(ctx,
		`INSERT INTO domains (domain, user_id, verified, verification_token, dkim_selector, dkim_public_key, dkim_private_key)
		 VALUES ($1, $2, false, $3, $4, $5, $6)
		 ON CONFLICT (domain) DO UPDATE
		 SET user_id = domains.user_id
		 WHERE domains.verified = false AND domains.user_id = $2
		 RETURNING domain, user_id, verified, verification_token, created_at, verified_at, is_primary, last_checked_at, COALESCE(dkim_selector, ''), COALESCE(dkim_public_key, ''), sending_status, COALESCE(sending_error, ''), sending_dns_records, sending_last_checked_at, COALESCE(sending_dkim_status, ''), COALESCE(sending_mail_from_status, '')`,
		domain, userID, verificationToken, nullIfEmpty(dkimSelector), nullIfEmpty(dkimPubKey), nullIfEmptyBytes(dkimPrivKey),
	).Scan(&d.Domain, &d.UserID, &d.Verified, &d.VerificationToken, &d.CreatedAt, &d.VerifiedAt, &d.IsPrimary, &d.LastCheckedAt, &d.DKIMSelector, &d.DKIMPublicKey, &d.SendingStatus, &d.SendingError, &d.SendingDNSRecordsJSON, &d.SendingLastCheckedAt, &d.SendingDkimStatus, &d.SendingMailFromStatus)

	if err == nil {
		return d, nil
	}

	// No row returned — the row exists but the conflict UPDATE was
	// skipped because either it's already verified or a different user