6 Commits

Include renames

Author	SHA1	Message	Date
mrhid6andClaude Opus 5	fbd93d0ea5	feat(admin): Paddle client behind an interface, config, and the event idempotency record ... Client is a thin REST client (net/http) rather than the vendor SDK: the surface we need is two calls, and a hand-rolled client has no version-drift risk and no dependency in go.sum. All Paddle wire shapes live only in http.go. PADDLE_API_KEY and PADDLE_WEBHOOK_SECRET are boot-required — an unverified webhook endpoint is one anyone can issue licences through. paddle_events carries a unique index on event_id for webhook idempotency. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-27 10:36:26 +01:00
mrhid6andClaude Opus 5	c4e6ad5485	feat(license): metered licensing — catalogue, entitlements, and enforcement ... Implements spec 7 tasks 2-10 on top of the six-plan payload from task 1. Admin: plans re-keyed on (deployment, tier); new catalogue collection holds every Paddle price ID (one row per priceable component); new entitlements collection holds desired beside granted. admin/internal/catalogue owns both folds — entitlement to licence limits, and entitlement to Paddle line items — so the base allowance is subtracted in exactly one place. licensing.Issue now snapshots the instance's granted entitlement, never desired. Free is enforced per account AND deployment. Staff endpoints for plans, catalogue and entitlements; Free self-hosted can be claimed and renewed on its annual term; the reaper stays cloud-only. Server: enforces the monitor cap, audit-log retention (daily sweep, skips Unlimited and lapsed instances), and gates the OIDC callback. Unset limits are filled from the seed plan at the single decode site so old blobs never read as zero. Frontends: adminsite gains a catalogue price-ID editor, six-plan allowance screen, and a catalogue-driven PlanConfigurator mounted on the staff instance page. web shows monitors, audit retention and support level on the licence page. Docs: CLAUDE.md, spec index and plan 5 preamble updated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-27 09:37:39 +01:00
mrhid6andClaude Opus 5	a7b9af4422	feat(admin): account roles and the instance_members index ... Phase 2 created cloud instances without recording who owns them on this side, because the collection did not exist. The boot backfill reconstructs one member row per instance from the hq-sourced control-plane owner, and marks every existing customer_user an owner — they all created their own account. Backfill lives in models rather than db: db is the connection layer and models already imports it for SeedPlans, so db -> models would cycle. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 16:23:02 +01:00
mrhid6andClaude Opus 5	983655d2a1	feat(admin): cloudprov, the instance provisioning write path ... Admin's second and final write path into the control plane. It creates instances and users and nothing else; inject still owns exactly three licence fields and is untouched. The owner's password hash is copied from the HQ account, not shared. The two diverge on the next password change, which is accepted: propagating a hash across two databases is worse than two passwords that started equal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 13:14:12 +01:00
mrhid6andClaude Opus 5	b8fcf89ee7	feat(admin): documents, indexes and the plan seed ... Adds admin's own documents, its unique indexes and the plan seed from shared/license. Licences are append-only -- a renewal writes a new row and supersedes the old one -- because the history is the support tool. Plans are seeded with $setOnInsert only, so a redeploy never stamps over staff edits to limits, features or Paddle IDs. admin_instances.instance_id unique is a correctness property, not an optimisation: without it two customers could both claim one self-hosted UUID and both be issued licences for it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:00:37 +01:00
mrhid6andClaude Opus 5	64eac6dbc7	feat(admin): module skeleton, config and two database connections ... Adds the admin module: env config with fail-fast validation, two MongoDB connections (its own vantage_admin database plus a narrow path into the control plane), the boot sequence and the image. Config refuses to start without a signing key, and both Mongo URIs must name their database inline -- admin talks to two databases, so a bare MONGO_DB would be ambiguous about which. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 18:58:44 +01:00