Repository: appwrite/appwrite
File: app/controllers/api/proxy.php (PHP)

Code before:
            )
        ]
    ))
    ->param('domain', null, new ValidatorDomain(), 'Domain name.')
    ->param('resourceType', null, new WhiteList(['api', 'function']), 'Action definition for the rule. Possible values are "api", "function"')
    ->param('resourceId', '', new UID(), 'ID of resource for the action type. If resourceType is "api", leave empty. If resourceType is "function", provide ID of the function.', true)
    ->inject('response')
    ->inject('project')
    ->inject('queueForCertificates')
    ->inject('queueForEvents')
    ->inject('dbForPlatform')
    ->inject('dbForProject')
    ->action(function (string $domain, string $resourceType, string $resourceId, Response $response, Document $project, Certificate $queueForCertificates, Event $queueForEvents, Database $dbForPlatform, Database $dbForProject) {

        $mainDomain = System::getEnv('_APP_DOMAIN', '');
        if ($domain === $mainDomain) {
            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'You cannot assign your main domain to specific resource. Please use subdomain or a different domain.');
        }

        $denyListString = System::getEnv('_APP_CUSTOM_DOMAIN_DENY_LIST', '');
        $deniedDomains = array_map('trim', explode(',', $denyListString));

        foreach ($deniedDomains as $deniedDomain) {
            if (str_ends_with($domain, $deniedDomain)) {
                throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'You cannot assign your functions domain or its subdomain to a specific resource. Please use a different domain.');
            }
        }

        if ($domain === 'localhost' || $domain === APP_HOSTNAME_INTERNAL) {
            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'This domain name is not allowed. Please pick another one.');
        }

        // TODO: @christyjacob remove once we migrate the rules in 1.7.x
        if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
            $document = $dbForPlatform->getDocument('rules', md5($domain));
        } else {
            $document = $dbForPlatform->findOne('rules', [
                Query::equal('domain', [$domain]),
            ]);
        }


        if (!$document->isEmpty()) {
            if ($document->getAttribute('projectId') === $project->getId()) {
                $resourceType = $document->getAttribute('resourceType');
                $resourceId = $document->getAttribute('resourceId');
                $message = "Domain already assigned to '{$resourceType}' service";
                if (!empty($resourceId)) {
                    $message .= " with ID '{$resourceId}'";
                }


Review comment (suggestion):
for backwards compatibility lets merge the two variables `_APP_DOMAIN_FUNCTIONS` and `_APP_CUSTOM_DOMAIN_DENY_LIST` so that we dont accidentally forget it

Code after:
            )
        ]
    ))
    ->param('domain', null, new ValidatorDomain(), 'Domain name.')
    ->param('resourceType', null, new WhiteList(['api', 'function']), 'Action definition for the rule. Possible values are "api", "function"')
    ->param('resourceId', '', new UID(), 'ID of resource for the action type. If resourceType is "api", leave empty. If resourceType is "function", provide ID of the function.', true)
    ->inject('response')
    ->inject('project')
    ->inject('queueForCertificates')
    ->inject('queueForEvents')
    ->inject('dbForPlatform')
    ->inject('dbForProject')
    ->action(function (string $domain, string $resourceType, string $resourceId, Response $response, Document $project, Certificate $queueForCertificates, Event $queueForEvents, Database $dbForPlatform, Database $dbForProject) {

        $mainDomain = System::getEnv('_APP_DOMAIN', '');
        if ($domain === $mainDomain) {
            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'You cannot assign your main domain to specific resource. Please use subdomain or a different domain.');
        }

        $functionsDomain = System::getEnv('_APP_DOMAIN_FUNCTIONS');
        $denyListDomains = System::getEnv('_APP_CUSTOM_DOMAIN_DENY_LIST');

        if (!empty($denyListDomains)) {
            $functionsDomain .= ',' . $denyListDomains;
        }

        $deniedDomains = array_map('trim', explode(',', $functionsDomain));

        foreach ($deniedDomains as $deniedDomain) {
            if (str_ends_with($domain, $deniedDomain)) {
                throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'You cannot assign your functions domain or its subdomain to a specific resource. Please use a different domain.');
            }
        }

        if ($domain === 'localhost' || $domain === APP_HOSTNAME_INTERNAL) {
            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'This domain name is not allowed. Please pick another one.');
        }

        // TODO: @christyjacob remove once we migrate the rules in 1.7.x
        if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
            $document = $dbForPlatform->getDocument('rules', md5($domain));
        } else {
            $document = $dbForPlatform->findOne('rules', [
                Query::equal('domain', [$domain]),
            ]);
        }


        if (!$document->isEmpty()) {
            if ($document->getAttribute('projectId') === $project->getId()) {
                $resourceType = $document->getAttribute('resourceType');