fix: Match DNS add to the owning record

Adding a record looked up the RecordSet by zone and type only,
then took items[0]. Zones with more than one RecordSet of that
type appended to the wrong object or created a duplicate, and
the operator webhook rejected it as already claimed.

Resolve by (zone, type, name). Cancel in-flight list fetches on
delete so a stale refetch cannot put the row back.

Fixes: #1511

Author: mattdjenkinson

app/modules/watch/use-resource-watch.ts

@@ -47,6 +47,7 @@ export function useResourceWatch<T>({
   getItemKey,
   updateListCache,
   updateSingleCache,
+  applyCacheUpdates = true,
   ...watchOptions
 }: UseResourceWatchOptions<T>) {
   const queryClient = useQueryClient();
@@ -56,6 +57,7 @@ export function useResourceWatch<T>({
   const getItemKeyRef = useRef(getItemKey);
   const updateListCacheRef = useRef(updateListCache);
   const updateSingleCacheRef = useRef(updateSingleCache);
+  const applyCacheUpdatesRef = useRef(applyCacheUpdates);
   const invalidateTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
   const subscriptionStartTimeRef = useRef<number>(0);
   const lastRefetchTimeRef = useRef<number>(0);
@@ -72,6 +74,7 @@ export function useResourceWatch<T>({
   getItemKeyRef.current = getItemKey;
   updateListCacheRef.current = updateListCache;
   updateSingleCacheRef.current = updateSingleCache;
+  applyCacheUpdatesRef.current = applyCacheUpdates;
   throttleMsRef.current = throttleMs;
   debounceMsRef.current = debounceMs;
   skipInitialSyncRef.current = skipInitialSync;
@@ -137,6 +140,10 @@ export function useResourceWatch<T>({
         // Call custom event handler if provided
         onEventRef.current?.(transformedEvent);
 
+        if (!applyCacheUpdatesRef.current) {
+          return;
+        }
+
         // Update React Query cache based on event type
         switch (event.type) {
           case 'ADDED':

app/modules/watch/watch.types.ts

@@ -94,4 +94,11 @@ export interface UseResourceWatchOptions<T> extends WatchOptions {
    * @example (oldData, newItem) => ({ ...newItem, preservedField: oldData.preservedField })
    */
   updateSingleCache?: (oldData: T | undefined, newItem: T) => T;
+  /**
+   * When false, watch events are forwarded to `onEvent` only — the hook does
+   * not write the query cache. Use when cache items are a different shape
+   * than the watched object (e.g. flattened DNS rows vs DNSRecordSet).
+   * @default true
+   */
+  applyCacheUpdates?: boolean;
 }

app/resources/dns-records/dns-record.adapter.test.ts

@@ -1,4 +1,7 @@
 import {
+  mergeRecordSetIntoListCache,
+  ownerNameForResource,
+  removeRecordSetFromListCache,
   toCreateDnsRecordSetPayload,
   toDnsRecordSet,
   toDnsRecordSetList,
@@ -146,15 +149,116 @@ describe('toFlattenedDnsRecords', () => {
   });
 });
 
+describe('mergeRecordSetIntoListCache', () => {
+  it('replaces only the rows for that RecordSet after a record is removed', () => {
+    const previous = toFlattenedDnsRecords([
+      {
+        uid: 'rs-txt',
+        name: 'zone-txt-apex',
+        recordType: 'TXT',
+        dnsZoneId: 'z',
+        records: [
+          { name: '@', txt: { content: 'keep' } },
+          { name: '@', txt: { content: 'drop' } },
+        ],
+      },
+      {
+        uid: 'rs-www',
+        name: 'zone-txt-www',
+        recordType: 'TXT',
+        dnsZoneId: 'z',
+        records: [{ name: 'www', txt: { content: 'www-verify' } }],
+      },
+    ] as never);
+
+    const patched = {
+      uid: 'rs-txt',
+      name: 'zone-txt-apex',
+      recordType: 'TXT',
+      dnsZoneId: 'z',
+      records: [{ name: '@', txt: { content: 'keep' } }],
+    } as DnsRecordSet;
+
+    const merged = mergeRecordSetIntoListCache(previous, patched);
+    expect(merged.map((r) => `${r.recordSetName}:${r.value}`).sort()).toEqual([
+      'zone-txt-apex:keep',
+      'zone-txt-www:www-verify',
+    ]);
+  });
+});
+
+describe('removeRecordSetFromListCache', () => {
+  it('drops every flattened row for a deleted RecordSet', () => {
+    const previous = toFlattenedDnsRecords([
+      {
+        uid: 'rs-txt',
+        name: 'zone-txt-apex',
+        recordType: 'TXT',
+        dnsZoneId: 'z',
+        records: [{ name: '@', txt: { content: 'gone' } }],
+      },
+      {
+        uid: 'rs-www',
+        name: 'zone-txt-www',
+        recordType: 'TXT',
+        dnsZoneId: 'z',
+        records: [{ name: 'www', txt: { content: 'stay' } }],
+      },
+    ] as never);
+
+    const remaining = removeRecordSetFromListCache(previous, 'zone-txt-apex');
+    expect(remaining?.map((r) => r.recordSetName)).toEqual(['zone-txt-www']);
+  });
+});
+
+describe('ownerNameForResource', () => {
+  it('maps apex names to apex', () => {
+    expect(ownerNameForResource('@')).toBe('apex');
+    expect(ownerNameForResource('')).toBe('apex');
+    expect(ownerNameForResource(undefined)).toBe('apex');
+  });
+
+  it('sanitizes service and wildcard names for DNS-1123', () => {
+    expect(ownerNameForResource('_dmarc')).toBe('dmarc');
+    expect(ownerNameForResource('*')).toBe('wildcard');
+    expect(ownerNameForResource('*.cdn')).toBe('wildcard-cdn');
+    expect(ownerNameForResource('www')).toBe('www');
+  });
+});
+
 describe('toCreateDnsRecordSetPayload', () => {
-  it('derives a lowercased name from zone id + record type', () => {
+  it('includes a sanitized owner suffix so same-type RecordSets do not collide', () => {
     const payload = toCreateDnsRecordSetPayload(
-      { dnsZoneRef: { name: 'acme-zone' }, recordType: 'A', records: [] } as never,
+      {
+        dnsZoneRef: { name: 'acme-zone' },
+        recordType: 'TXT',
+        records: [{ name: '@', txt: { content: 'v=spf1 -all' } }],
+      } as never,
       'Acme-Zone'
     );
     expect(payload.kind).toBe('DNSRecordSet');
-    expect(payload.metadata?.name).toBe('acme-zone-a');
-    expect(payload.spec?.recordType).toBe('A');
+    expect(payload.metadata?.name).toBe('acme-zone-txt-apex');
+    expect(payload.spec?.recordType).toBe('TXT');
+  });
+
+  it('uses the owner name for subdomain RecordSets', () => {
+    const payload = toCreateDnsRecordSetPayload(
+      {
+        dnsZoneRef: { name: 'acme-zone' },
+        recordType: 'A',
+        records: [{ name: 'www', a: { content: '1.2.3.4' } }],
+      } as never,
+      'acme-zone'
+    );
+    expect(payload.metadata?.name).toBe('acme-zone-a-www');
+  });
+
+  it('defaults empty records to an apex suffix', () => {
+    const payload = toCreateDnsRecordSetPayload(
+      { dnsZoneRef: { name: 'acme-zone' }, recordType: 'A', records: [] } as never,
+      'Acme-Zone'
+    );
+    expect(payload.metadata?.name).toBe('acme-zone-a-apex');
   });
 });
 

app/resources/dns-records/dns-record.adapter.ts

@@ -9,7 +9,9 @@ import { ComMiloapisNetworkingDnsV1Alpha1DnsRecordSet } from '@/modules/control-
 import { ControlPlaneStatus } from '@/resources/base';
 import { transformControlPlaneStatus } from '@/utils/helpers/control-plane.helper';
 import { extractValue } from '@/utils/helpers/dns/flatten.helper';
+import { normalizeRecordName } from '@/utils/helpers/dns/record-comparison.helper';
 import { getDnsRecordTypePriority } from '@/utils/helpers/dns/record-type.helper';
+import { sanitizeForK8s } from '@/utils/helpers/format.helper';
 
 /** Labels set by the Gateway controller when a DNSRecordSet is created for Application Load Balancer (proxy) */
 const DNS_SOURCE_KIND_LABEL = 'dns.datumapis.com/source-kind';
@@ -132,6 +134,31 @@ export function toFlattenedDnsRecordsByPriority(recordSets: DnsRecordSet[]): Fla
   return toFlattenedDnsRecords(recordSets);
 }
 
+/**
+ * Replace flattened list rows for one RecordSet with rows from that object.
+ * Used by create/update mutations and by the RecordSet watch (cache is flattened
+ * rows, watch events are whole RecordSets).
+ */
+export function mergeRecordSetIntoListCache(
+  old: FlattenedDnsRecord[] | undefined,
+  recordSet: DnsRecordSet
+): FlattenedDnsRecord[] {
+  const newRows = toFlattenedDnsRecords([recordSet]);
+  if (!old) return newRows;
+  return [...old.filter((record) => record.recordSetName !== recordSet.name), ...newRows];
+}
+
+/**
+ * Drop every flattened row that belonged to a deleted RecordSet.
+ */
+export function removeRecordSetFromListCache(
+  old: FlattenedDnsRecord[] | undefined,
+  recordSetName: string
+): FlattenedDnsRecord[] | undefined {
+  if (!old) return old;
+  return old.filter((record) => record.recordSetName !== recordSetName);
+}
+
 /**
  * Extract TTL from record
  */
@@ -142,18 +169,36 @@ function extractTTL(record: any): number | undefined {
   return undefined;
 }
 
+/**
+ * DNS-1123 owner suffix for a RecordSet resource name.
+ * Apex (`@` / empty) becomes `apex` so same-type RecordSets at different
+ * names do not collide on `{zone}-{type}`.
+ */
+export function ownerNameForResource(name: string | undefined | null): string {
+  const normalized = normalizeRecordName(name);
+  if (normalized === '@') return 'apex';
+  if (normalized === '*') return 'wildcard';
+  if (normalized.startsWith('*.')) {
+    const rest = sanitizeForK8s(normalized.slice(2)).replace(/^\.+|\.+$/g, '');
+    return rest ? `wildcard-${rest}` : 'wildcard';
+  }
+  const sanitized = sanitizeForK8s(normalized).replace(/^\.+|\.+$/g, '');
+  return sanitized || 'apex';
+}
+
 /**
  * Transform CreateDnsRecordSetInput to API payload
  */
 export function toCreateDnsRecordSetPayload(
   input: CreateDnsRecordSetInput,
   dnsZoneId: string
 ): ComMiloapisNetworkingDnsV1Alpha1DnsRecordSet {
+  const ownerName = ownerNameForResource(input.records?.[0]?.name);
   return {
     kind: 'DNSRecordSet',
     apiVersion: 'dns.networking.miloapis.com/v1alpha1',
     metadata: {
-      name: `${dnsZoneId}-${input.recordType}`.toLowerCase(),
+      name: `${dnsZoneId}-${input.recordType}-${ownerName}`.toLowerCase(),
     },
     spec: {
       dnsZoneRef: input.dnsZoneRef,