--- Sender identity (decision 4 / Slice 4) --- These primitive accessors back the senderidentity.RawStore interface (string status, JSON dns records) so the core store stays decoupled from the senderidentity package (and its River + AWS SDK deps). The adapter in senderidentity converts to its typed
(ctx context.Context, domain string)
| 617 | // GetDKIMKeyInternal this is unscoped — call only with a server-resolved |
| 618 | // domain. |
| 619 | func (s *Store) SendingProvisionInputs(ctx context.Context, domain string) (selector string, privateKeyDER []byte, ok bool, err error) { |
| 620 | norm := normalizeDomain(domain) |
| 621 | var blob []byte |
| 622 | err = s.pool.QueryRow(ctx, |
| 623 | `SELECT COALESCE(dkim_selector, ''), dkim_private_key FROM domains WHERE domain = $1`, |
| 624 | norm, |
| 625 | ).Scan(&selector, &blob) |
| 626 | if err != nil { |
| 627 | return "", nil, false, err // includes pgx.ErrNoRows (domain gone) |
| 628 | } |
| 629 | if selector == "" || len(blob) == 0 { |
| 630 | return "", nil, false, nil |
| 631 | } |
| 632 | privateKeyDER, err = s.unsealDKIM(blob, norm) |
| 633 | if err != nil { |
| 634 | return "", nil, false, fmt.Errorf("dkim key unseal: %w", err) |
| 635 | } |
| 636 | return selector, privateKeyDER, true, nil |
| 637 | } |
| 638 | |
| 639 | // SetSendingStatus writes the sending lifecycle state for a domain and stamps |
| 640 | // sending_last_checked_at. recordsJSON may be nil (cleared). dkimStatus and |