fix(certificates): normalize domain case instead of rejecting it

[loks0n]

Summary

Domain::validate() rejected any domain that was not already lowercase. DNS labels are case-insensitive (RFC 4343), so case carries no meaning — folding it is the correct handling. Rejecting turns a cosmetic difference into a hard failure on data that already exists.

Proxy compounded it. Every public method called select(), which validated into a local variable and threw the result away, so the raw domain still reached the provider:

public function deleteCertificate(string $domain, ?string $domainType = null): void
{
    foreach ($this->select($domain, $domainType) as $provider) {
        $provider->deleteCertificate($domain, $domainType);   // original, not normalized
    }
}

Normalization now happens once at each public entry point, so the canonical value reaches both the appDomain comparison in select() and the provider call.

Incident

Appwrite Cloud 1.45.22, production fra1, 2026-08-28. Deleting a proxy rule whose stored domain had mixed case threw InvalidArgumentException out of Domain::validate(). The throw aborted the delete job before the certificate row was removed, orphaning it.

Verification

• DomainTest: case folding, plus rejection of empty / scheme / port / path / trailing-slash / underscore
• ProxyTest: asserts the provider receives the canonical domain, and that a mixed-case app domain still routes to the app provider — which only holds if folding happens before the appDomain comparison
• Both hunks seen red independently: reverting the Domain fold and reverting the Proxy entry-point normalization each fail the new tests
• Full suite 77 tests / 180 assertions, Pint, PHPStan — all clean

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR changes domain validation from rejecting uppercase hostnames to returning their lowercase canonical form. It also normalizes domains at every proxy lifecycle entry point so routing comparisons and delegated provider calls consistently receive the canonical hostname.

• Canonicalizes domain case while retaining malformed-hostname validation.
• Normalizes all five proxy certificate operations before routing and delegation.
• Adds focused tests for mixed-case routing, provider forwarding, and malformed domains.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or quality issues identified.

The changed validation preserves hostname checks while canonicalizing case, and every reachable proxy routing and delegation path now consistently uses the returned canonical domain.

Important Files Changed

Filename	Overview
src/Cdn/Domain.php	Canonicalizes hostname case before validation while preserving rejection of malformed hostname forms.
src/Cdn/Certificates/Provider/Proxy.php	Moves normalization to each public lifecycle entry point so both provider selection and forwarding use the canonical domain.
tests/Cdn/DomainTest.php	Covers lowercase canonicalization and representative malformed-domain inputs.
tests/Cdn/Certificates/Provider/ProxyTest.php	Verifies mixed-case application-domain routing and normalized custom-provider delegation.

_{Reviews (1): Last reviewed commit: "fix(certificates): normalize domain case..." | Re-trigger Greptile}