Poweradmin\Domain\Service\Zone

Catalog zone membership.

Pure rules for the opt-in change approval workflow: whether a user's zone changes are written directly, filed as a change request, or refused, and who may review a request.

Outcome of a DnssecKeyService request, the key or keys it concerns, and the accepted values when a new key was refused as invalid.

Lists, adds, activates, deactivates and removes the DNSSEC keys of a zone the one way the web key pages and the API agree on: validate a new key against what the server offers, refuse changes when PowerDNS cannot be asked, has DNSSEC off or the zone is presigned, and audit what changed.

Turns a DNSSEC private key into the ISC (BIND "Private-key-format") text the PowerDNS API takes. The API reads no PEM; only pdnsutil import-zone-key-pem does.

Maps each reverse zone to the forward zones its PTR records point at, with a PTR count per forward zone.

Finds the records a new zone would hide in its closest existing parent zone.

Records in the closest parent zone that a new zone hides, because PowerDNS answers from the most specific zone.

Mirrors zone ownership into the PowerDNS account field.

Outcome of filing, approving, rejecting or cancelling a change request.

Files zone change requests and applies the reviewer's decision.

Counts the zones a user may see; the backend-specific query lives in the zone repository.

Resolves the user-owner and group-owner assignment for a new zone, applying the active zone_ownership_mode and permission rules. The API hands in the typed request input; the web forms hand in the owner and groups they parsed.

One row of the zone editor's record table as the caller wants it: the record it refers to and the values to store, already decoded from whatever form or request carried them.

One posted editor row that differs from the zone: the normalised row as it will be written and the log holding the stored state it replaces.

Saves the zone editor's record table: the edit gate, the stale-form check, the per-row diff and write, the record and zone comments, and the SOA serial bump that closes a save.

One submission of the zone editor's record table.

A user or group that a change would take past its zone limit.

Creates zones for the API with the same checks the web form applies. Failures come back as

message is the API wording, the code lets the web forms word it themselves.

Outcome of a ZoneMetadataService write, with the metadata kind and options the caller needs to word a refusal.

The zone metadata rules the editor and the API share: what a kind accepts, who may change it, what the active backend can store, and how a change is persisted and logged. Callers parse their input and word the refusals.

Blocks creating a zone that overlaps an existing zone owned by another user.

The last-owner rule: a zone keeps at least one owner of a kind the ownership mode allows. Every writer removes owners through here, so the check and the delete share one transaction and two concurrent removals cannot both pass.

Who owns which of a page of zones, resolved once so per-row controls do not query per zone. Ownership is direct (zones.owner) or through any group the user belongs to.

The owner choice a zone creation request made, as ZoneCreateOwnershipResolver reads it: the user owner may be omitted (the caller becomes owner), given as null (no user owner) or given as an id; the groups may be omitted or listed.

How many zones a user or group may own, and whether a change would exceed it.

Resolves the dns.zone_ownership_mode setting into ownership-side flags.

Why ZoneOwnershipGuard refused an owner removal. Callers word the code for their own audience; the mode tells them what kind of replacement to suggest.

Outcome of {ZoneCreateOwnershipResolver}: either a resolved owner/group assignment for the new zone, or an error with its refusal. The error carries a code so the web forms can word it themselves; the message is the API text.

How a zone editor save ended, with what the page needs to report it and, for a refused stale form, the rows to put back in front of the operator.

Outcome of a ZoneSigningService sign or unsign request plus the detail text callers may show.

Signs and unsigns zones the one way every entry point agrees on: refuse presigned zones and invalid zones, bump the SOA serial so secondaries notice, verify what PowerDNS reports afterwards, rectify, and audit.

Checks a zone is fit for DNSSEC signing and formats the reasons when it is not.