domain migration

backend/app/services/domain_provisioning.py

@@ -94,11 +94,21 @@ def build_company_dns_records(
     dkim_selector: str,
     dkim_public_key: str,
     platform_spf_include: str,
+    verification_token: str,
 ) -> list[dict]:
-    """Zoho-style records: shared MX host, SPF include, per-domain DKIM/DMARC."""
+    """Zoho-style records: ownership proof, shared MX host, SPF include, DKIM/DMARC."""
+    from app.services.dns_verification import ownership_record_value
+
     dkim_value = f"v=DKIM1; k=rsa; p={dkim_public_key}"
     dmarc_value = f"v=DMARC1; p=quarantine; rua=mailto:dmarc@{domain_name}"
     return [
+        {
+            "record_type": "TXT",
+            "host": namecheap_host("_agmail-verify", domain_name),
+            "value": ownership_record_value(verification_token),
+            "purpose": "ownership",
+            "ttl": 3600,
+        },
         {
             "record_type": "MX",
             "host": namecheap_host("@", domain_name),
@@ -273,12 +283,14 @@ async def provision_mail_domain(
     private_key, public_key = generate_dkim_keys()
     if domain_type == "company":
         mail_host = settings.smtp_public_host
+        verification_token = secrets.token_urlsafe(24)
         dns_records = build_company_dns_records(
             normalized,
             settings.smtp_public_host,
             dkim_selector,
             public_key,
             settings.platform_spf_include,
+            verification_token,
         )
     else:
         dns_records = build_dns_records(
@@ -331,6 +343,48 @@ async def activate_company_domain(session: AsyncSession, domain: MailDomain) ->
     return domain
 
 
+async def ensure_ownership_dns_record(session: AsyncSession, domain: MailDomain) -> str:
+    """Return the ownership verification token, creating a DNS record if missing."""
+    from app.services.dns_verification import ownership_record_value, ownership_token_from_value
+
+    existing = next(
+        (record for record in domain.dns_records if record.purpose == "ownership"),
+        None,
+    )
+    if existing:
+        return ownership_token_from_value(existing.value)
+
+    token = secrets.token_urlsafe(24)
+    session.add(
+        DomainDnsRecord(
+            domain_id=domain.id,
+            record_type="TXT",
+            host=namecheap_host("_agmail-verify", domain.domain_name),
+            value=ownership_record_value(token),
+            purpose="ownership",
+            ttl=3600,
+        )
+    )
+    await session.flush()
+    return token
+
+
+async def account_is_domain_owner(
+    session: AsyncSession,
+    account_id,
+    company_domain_name: str | None,
+) -> bool:
+    if not company_domain_name:
+        return False
+    domain_id = await session.scalar(
+        select(MailDomain.id).where(
+            MailDomain.domain_name == company_domain_name,
+            MailDomain.account_id == account_id,
+        )
+    )
+    return domain_id is not None
+
+
 async def get_account_company_domain(
     session: AsyncSession,
     account_id,