3 Commits

Include renames

Author	SHA1	Message	Date
mrhid6andClaude Opus 5	3a6c5ebae8	fix(admin): licence and plan features serialise as [], never null ... Free has no features, so a nil Go slice served "features": null. The portal's type said string[], called .length on it, and took the page down. The guarantee lives on a named Features type with its own MarshalJSON rather than at each of the six places a licence or plan is serialised, because the seventh is the one that would have been forgotten. Applying it at marshal time also fixes rows already holding null in Mongo, which a write-side fix alone would not. Same class, found while checking the rest: staffListInstances built its expiring filter from a nil []string, marshalling to $in: null, which Mongo rejects — so the quiet week when nothing is expiring is precisely when the staff Operations page's own query would have failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 18:10:07 +01:00
mrhid6andClaude Opus 5	c829cc41d9	feat(admin): linking, relink and the scoped customer API ... Every customer handler that names an instance resolves it through ownedInstance, which returns 404 rather than 403 for another account's instance -- a 403 confirms the instance exists, which is an existence oracle over customer data. The unique index on admin_instances.instance_id, not the pre-check, is what actually prevents two accounts owning one instance. Relink issues a replacement covering the REMAINING term, so it cannot be used to extend a subscription, and the old licence is not revoked because offline verification has no revocation -- its instance binding is what stops it. The route table lands with the staff handlers in the next commit so every commit builds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:09:13 +01:00
mrhid6andClaude Opus 5	427191b14c	feat(admin): licence issuance with plan snapshots and supersession ... Issue is the only place that signs. It records the licence, supersedes its predecessor and updates the instance -- but deliberately does not deliver. The ordering matters: a licence recorded but not delivered is recoverable, because the customer can download it. A licence delivered but not recorded is a support mystery with no paper trail. Free stays cloud-only through one comparison of plan against instance deployment, not a flag. Renewals reset relink_count because the cap is per term. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:01:47 +01:00