From a43a01f0f9fc0fbf5e4ba3eb797df6170a6fc9ba Mon Sep 17 00:00:00 2001
From: Wrongecho <wrongecho@itflow.org>
Date: Thu, 10 Sep 2026 15:16:36 +0000
Subject: [PATCH] API - Add domains create, update, archive and unarchive

---
 api/v1/domains/archive.php      | 23 +++++++++
 api/v1/domains/create.php       | 37 +++++++++++++
 api/v1/domains/domain_model.php | 67 ++++++++++++++++++++++++
 api/v1/domains/read.php         |  6 +--
 api/v1/domains/unarchive.php    | 23 +++++++++
 api/v1/domains/update.php       | 92 +++++++++++++++++++++++++++++++++
 6 files changed, 245 insertions(+), 3 deletions(-)
 create mode 100644 api/v1/domains/archive.php
 create mode 100644 api/v1/domains/create.php
 create mode 100644 api/v1/domains/domain_model.php
 create mode 100644 api/v1/domains/unarchive.php
 create mode 100644 api/v1/domains/update.php

diff --git a/api/v1/domains/archive.php b/api/v1/domains/archive.php
new file mode 100644
index 000000000..4421cc536
--- /dev/null
+++ b/api/v1/domains/archive.php
@@ -0,0 +1,23 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+$domain_id = intval($_POST['domain_id']);
+$update_count = false;
+
+if (!empty($domain_id)) {
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT domain_name FROM domains WHERE domain_id = $domain_id AND domain_client_id = $client_id AND domain_archived_at IS NULL LIMIT 1"));
+
+    if ($row) {
+        $domain_name = escapeSql($row['domain_name']);
+        $update_sql = mysqli_query($mysqli, "UPDATE domains SET domain_archived_at = NOW() WHERE domain_id = $domain_id AND domain_client_id = $client_id AND domain_archived_at IS NULL");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+            logAudit("Domain", "Archive", "$domain_name archived via API ($api_key_name)", $client_id, $domain_id);
+        }
+    }
+}
+
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/api/v1/domains/create.php b/api/v1/domains/create.php
new file mode 100644
index 000000000..bc1585777
--- /dev/null
+++ b/api/v1/domains/create.php
@@ -0,0 +1,37 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+require_once 'domain_model.php';
+
+$insert_id = false;
+
+if (!empty($name) && !empty($client_id)) {
+    // Use the supplied expiry when valid, otherwise look it up from WHOIS.
+    if (strtotime($expire)) {
+        $expire = "'$expire'";
+    } else {
+        $expire = getDomainExpirationDate($name);
+        $expire = strtotime($expire) ? "'$expire'" : 'NULL';
+    }
+
+    // Populate DNS and WHOIS data from the domain rather than accepting it from the API.
+    $records = getDnsRecords($name);
+    $ip = escapeSql($records['a']);
+    $name_servers = escapeSql($records['ns']);
+    $mail_servers = escapeSql($records['mx']);
+    $txt = escapeSql($records['txt']);
+    $raw_whois = escapeSql($records['whois']);
+
+    $insert_sql = mysqli_query($mysqli, "INSERT INTO domains SET domain_name = '$name', domain_description = '$description', domain_expire = $expire, domain_ip = '$ip', domain_name_servers = '$name_servers', domain_mail_servers = '$mail_servers', domain_txt = '$txt', domain_raw_whois = '$raw_whois', domain_notes = '$notes', domain_registrar = $registrar, domain_webhost = $webhost, domain_dnshost = $dnshost, domain_mailhost = $mailhost, domain_client_id = $client_id");
+
+    if ($insert_sql) {
+        $insert_id = mysqli_insert_id($mysqli);
+
+        logAudit("Domain", "Create", "$name via API ($api_key_name)", $client_id, $insert_id);
+        logAudit("API", "Success", "Created domain $name via API ($api_key_name)", $client_id);
+    }
+}
+
+require_once '../create_output.php';
\ No newline at end of file
diff --git a/api/v1/domains/domain_model.php b/api/v1/domains/domain_model.php
new file mode 100644
index 000000000..3198cf0aa
--- /dev/null
+++ b/api/v1/domains/domain_model.php
@@ -0,0 +1,67 @@
+<?php
+
+// Variable assignment from POST (or: blank/from DB is updating)
+
+if (isset($_POST['domain_name'])) {
+    $name = preg_replace("(^https?://)", "", escapeSql($_POST['domain_name']));
+} elseif (isset($domain_row) && isset($domain_row['domain_name'])) {
+    $name = mysqli_real_escape_string($mysqli, $domain_row['domain_name']);
+} else {
+    $name = '';
+}
+
+if (isset($_POST['domain_description'])) {
+    $description = escapeSql($_POST['domain_description']);
+} elseif (isset($domain_row) && isset($domain_row['domain_description'])) {
+    $description = mysqli_real_escape_string($mysqli, $domain_row['domain_description']);
+} else {
+    $description = '';
+}
+
+if (isset($_POST['domain_expire'])) {
+    $expire = escapeSql($_POST['domain_expire']);
+} elseif (isset($domain_row) && !empty($domain_row['domain_expire'])) {
+    $expire = mysqli_real_escape_string($mysqli, $domain_row['domain_expire']);
+} else {
+    $expire = '';
+}
+
+if (isset($_POST['domain_notes'])) {
+    $notes = escapeSql($_POST['domain_notes']);
+} elseif (isset($domain_row) && isset($domain_row['domain_notes'])) {
+    $notes = mysqli_real_escape_string($mysqli, $domain_row['domain_notes']);
+} else {
+    $notes = '';
+}
+
+if (isset($_POST['domain_registrar'])) {
+    $registrar = intval($_POST['domain_registrar']);
+} elseif (isset($domain_row) && isset($domain_row['domain_registrar'])) {
+    $registrar = $domain_row['domain_registrar'];
+} else {
+    $registrar = 0;
+}
+
+if (isset($_POST['domain_webhost'])) {
+    $webhost = intval($_POST['domain_webhost']);
+} elseif (isset($domain_row) && isset($domain_row['domain_webhost'])) {
+    $webhost = $domain_row['domain_webhost'];
+} else {
+    $webhost = 0;
+}
+
+if (isset($_POST['domain_dnshost'])) {
+    $dnshost = intval($_POST['domain_dnshost']);
+} elseif (isset($domain_row) && isset($domain_row['domain_dnshost'])) {
+    $dnshost = $domain_row['domain_dnshost'];
+} else {
+    $dnshost = 0;
+}
+
+if (isset($_POST['domain_mailhost'])) {
+    $mailhost = intval($_POST['domain_mailhost']);
+} elseif (isset($domain_row) && isset($domain_row['domain_mailhost'])) {
+    $mailhost = $domain_row['domain_mailhost'];
+} else {
+    $mailhost = 0;
+}
\ No newline at end of file
diff --git a/api/v1/domains/read.php b/api/v1/domains/read.php
index e75b31c00..b7d7acef1 100644
--- a/api/v1/domains/read.php
+++ b/api/v1/domains/read.php
@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
 // Specific domain via ID (single)
 if (isset($_GET['domain_id'])) {
     $id = intval($_GET['domain_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND 1=1 " . apiClientScopeSql('domain_client_id') . "");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND domain_archived_at IS NULL AND 1=1 " . apiClientScopeSql('domain_client_id') . "");
 
 } elseif (isset($_GET['domain_name'])) {
     // Domain by name
     $name = mysqli_real_escape_string($mysqli, $_GET['domain_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND domain_archived_at IS NULL AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
 
 } else {
     // All domains (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
 }
 
 // Output
diff --git a/api/v1/domains/unarchive.php b/api/v1/domains/unarchive.php
new file mode 100644
index 000000000..180f6a1f5
--- /dev/null
+++ b/api/v1/domains/unarchive.php
@@ -0,0 +1,23 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+$domain_id = intval($_POST['domain_id']);
+$update_count = false;
+
+if (!empty($domain_id)) {
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT domain_name FROM domains WHERE domain_id = $domain_id AND domain_client_id = $client_id AND domain_archived_at IS NOT NULL LIMIT 1"));
+
+    if ($row) {
+        $domain_name = escapeSql($row['domain_name']);
+        $update_sql = mysqli_query($mysqli, "UPDATE domains SET domain_archived_at = NULL WHERE domain_id = $domain_id AND domain_client_id = $client_id AND domain_archived_at IS NOT NULL");
+
+        if ($update_sql) {
+            $update_count = mysqli_affected_rows($mysqli);
+            logAudit("Domain", "Unarchive", "$domain_name unarchived via API ($api_key_name)", $client_id, $domain_id);
+        }
+    }
+}
+
+require_once '../update_output.php';
\ No newline at end of file
diff --git a/api/v1/domains/update.php b/api/v1/domains/update.php
new file mode 100644
index 000000000..f91c65c02
--- /dev/null
+++ b/api/v1/domains/update.php
@@ -0,0 +1,92 @@
+<?php
+
+require_once '../validate_api_key.php';
+require_once '../require_post_method.php';
+
+$domain_id = intval($_POST['domain_id']);
+$update_count = false;
+
+if (!empty($domain_id)) {
+    $domain_row = mysqli_fetch_assoc(mysqli_query($mysqli, "
+        SELECT
+            domains.*,
+            registrar.vendor_name AS registrar_name,
+            dnshost.vendor_name AS dnshost_name,
+            mailhost.vendor_name AS mailhost_name,
+            webhost.vendor_name AS webhost_name
+        FROM domains
+        LEFT JOIN vendors AS registrar ON domains.domain_registrar = registrar.vendor_id
+        LEFT JOIN vendors AS dnshost ON domains.domain_dnshost = dnshost.vendor_id
+        LEFT JOIN vendors AS mailhost ON domains.domain_mailhost = mailhost.vendor_id
+        LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
+        WHERE domain_id = $domain_id AND domain_client_id = $client_id
+        LIMIT 1
+    "));
+
+    $original_domain_info = $domain_row;
+
+    require_once 'domain_model.php';
+
+    // Use the supplied expiry when valid, otherwise look it up from WHOIS.
+    if (strtotime($expire)) {
+        $expire = "'$expire'";
+    } else {
+        $expire = getDomainExpirationDate($name);
+        $expire = strtotime($expire) ? "'$expire'" : 'NULL';
+    }
+
+    // Populate DNS and WHOIS data from the domain rather than accepting it from the API.
+    $records = getDnsRecords($name);
+    $ip = escapeSql($records['a']);
+    $name_servers = escapeSql($records['ns']);
+    $mail_servers = escapeSql($records['mx']);
+    $txt = escapeSql($records['txt']);
+    $raw_whois = escapeSql($records['whois']);
+
+    $update_sql = mysqli_query($mysqli, "UPDATE domains SET domain_name = '$name', domain_description = '$description', domain_expire = $expire, domain_ip = '$ip', domain_name_servers = '$name_servers', domain_mail_servers = '$mail_servers', domain_txt = '$txt', domain_raw_whois = '$raw_whois', domain_notes = '$notes', domain_registrar = $registrar, domain_webhost = $webhost, domain_dnshost = $dnshost, domain_mailhost = $mailhost WHERE domain_id = $domain_id AND domain_client_id = $client_id LIMIT 1");
+
+    if ($update_sql && $domain_row) {
+        // Capture the update result before any history or audit queries run.
+        $update_count = mysqli_affected_rows($mysqli);
+
+        $new_domain_info = mysqli_fetch_assoc(mysqli_query($mysqli, "
+            SELECT
+                domains.*,
+                registrar.vendor_name AS registrar_name,
+                dnshost.vendor_name AS dnshost_name,
+                mailhost.vendor_name AS mailhost_name,
+                webhost.vendor_name AS webhost_name
+            FROM domains
+            LEFT JOIN vendors AS registrar ON domains.domain_registrar = registrar.vendor_id
+            LEFT JOIN vendors AS dnshost ON domains.domain_dnshost = dnshost.vendor_id
+            LEFT JOIN vendors AS mailhost ON domains.domain_mailhost = mailhost.vendor_id
+            LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
+            WHERE domain_id = $domain_id AND domain_client_id = $client_id
+            LIMIT 1
+        "));
+
+        $ignored_columns = [
+            'domain_updated_at',
+            'domain_accessed_at',
+            'domain_registrar',
+            'domain_webhost',
+            'domain_dnshost',
+            'domain_mailhost'
+        ];
+
+        foreach ($original_domain_info as $column => $old_value) {
+            $new_value = $new_domain_info[$column];
+            if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
+                $column = escapeSql($column);
+                $old_value = escapeSql($old_value);
+                $new_value = escapeSql($new_value);
+                mysqli_query($mysqli, "INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id");
+            }
+        }
+
+        logAudit("Domain", "Edit", "$name via API ($api_key_name)", $client_id, $domain_id);
+        logAudit("API", "Success", "Updated domain $name via API ($api_key_name)", $client_id);
+    }
+}
+
+require_once '../update_output.php';
\ No newline at end of file