feat(license): add offline verification

2026-07-24 14:58:25 +01:00
parent 95c5d531ae
commit 968408b955
1 changed files with 132 additions and 0 deletions
@@ -0,0 +1,132 @@
+package license
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/hyperboloide/lk"
+)
+
+type State string
+
+const (
+	StateValid   State = "valid"
+	StateExpired State = "expired"
+	StateInvalid State = "invalid"
+)
+
+// Reasons a licence is not valid. These are stable identifiers: the API returns
+// them and the UI maps them to messages, so do not reword them casually.
+const (
+	ReasonNoLicense          = "no_license"
+	ReasonBadSignature       = "bad_signature"
+	ReasonDeploymentMismatch = "deployment_mismatch"
+	ReasonInstanceMismatch   = "instance_mismatch"
+	ReasonExpired            = "expired"
+)
+
+// VerifyOpts is what the verifier knows about itself.
+type VerifyOpts struct {
+	InstanceID string    // this instance's own ID; required
+	Deployment string    // "cloud" or "self_hosted"; required
+	Now        time.Time // zero means time.Now()
+}
+
+type Result struct {
+	License License
+	State   State
+	Reason  string
+	// ClockSkewed is set when IssuedAt is in the future, which usually means
+	// the host clock is wrong. It does not by itself invalidate the licence.
+	ClockSkewed bool
+}
+
+// Verify checks a licence blob against this instance.
+//
+// The checks run in a fixed order and stop at the first failure:
+//
+//  1. signature against a trusted public key  -> bad_signature
+//  2. deployment matches this install         -> deployment_mismatch
+//  3. instance ID matches this instance       -> instance_mismatch
+//  4. not past ExpiresAt                      -> expired
+//
+// The order matters. A blob that is both expired and bound to another instance
+// reports instance_mismatch, not expired, because that is the more useful thing
+// to tell the person holding it.
+//
+// No clock tolerance is applied. Terms are a month or a year; a host whose clock
+// is wrong by enough to matter has larger problems, and a tolerance window is a
+// thing to get wrong.
+func Verify(blob string, opts VerifyOpts) Result {
+	if blob == "" {
+		return Result{State: StateInvalid, Reason: ReasonNoLicense}
+	}
+
+	l, err := Parse(blob)
+	if err != nil {
+		return Result{State: StateInvalid, Reason: ReasonBadSignature}
+	}
+
+	res := Result{License: l}
+
+	if l.Deployment != opts.Deployment {
+		res.State, res.Reason = StateInvalid, ReasonDeploymentMismatch
+		return res
+	}
+	if l.InstanceID != opts.InstanceID {
+		res.State, res.Reason = StateInvalid, ReasonInstanceMismatch
+		return res
+	}
+
+	now := opts.Now
+	if now.IsZero() {
+		now = time.Now()
+	}
+	res.ClockSkewed = l.IssuedAt.After(now)
+
+	if !now.Before(l.ExpiresAt) {
+		res.State, res.Reason = StateExpired, ReasonExpired
+		return res
+	}
+
+	res.State = StateValid
+	return res
+}
+
+// Parse verifies the signature only, ignoring binding and expiry.
+//
+// Used to display a licence and to inspect a blob a customer has emailed in.
+// Never use it for enforcement — it does not check who the licence is for.
+func Parse(blob string) (License, error) {
+	parsed, err := lk.LicenseFromB32String(blob)
+	if err != nil {
+		return License{}, fmt.Errorf("licence is not readable: %w", err)
+	}
+
+	keys, err := publicKeys()
+	if err != nil {
+		return License{}, err
+	}
+	if len(keys) == 0 {
+		return License{}, fmt.Errorf("this build trusts no licence signing keys")
+	}
+
+	verified := false
+	for _, k := range keys {
+		ok, err := parsed.Verify(k)
+		if err == nil && ok {
+			verified = true
+			break
+		}
+	}
+	if !verified {
+		return License{}, fmt.Errorf("licence signature does not match any trusted key")
+	}
+
+	var l License
+	if err := json.Unmarshal(parsed.Data, &l); err != nil {
+		return License{}, fmt.Errorf("licence contents are not readable: %w", err)
+	}
+	return l, nil
+}