4 Commits

Include renames

Author	SHA1	Message	Date
mrhid6andClaude Opus 5	c4e6ad5485	feat(license): metered licensing — catalogue, entitlements, and enforcement ... Implements spec 7 tasks 2-10 on top of the six-plan payload from task 1. Admin: plans re-keyed on (deployment, tier); new catalogue collection holds every Paddle price ID (one row per priceable component); new entitlements collection holds desired beside granted. admin/internal/catalogue owns both folds — entitlement to licence limits, and entitlement to Paddle line items — so the base allowance is subtracted in exactly one place. licensing.Issue now snapshots the instance's granted entitlement, never desired. Free is enforced per account AND deployment. Staff endpoints for plans, catalogue and entitlements; Free self-hosted can be claimed and renewed on its annual term; the reaper stays cloud-only. Server: enforces the monitor cap, audit-log retention (daily sweep, skips Unlimited and lapsed instances), and gates the OIDC callback. Unset limits are filled from the seed plan at the single decode site so old blobs never read as zero. Frontends: adminsite gains a catalogue price-ID editor, six-plan allowance screen, and a catalogue-driven PlanConfigurator mounted on the staff instance page. web shows monitors, audit retention and support level on the licence page. Docs: CLAUDE.md, spec index and plan 5 preamble updated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-27 09:37:39 +01:00
mrhid6andClaude Opus 5	3a6c5ebae8	fix(admin): licence and plan features serialise as [], never null ... Free has no features, so a nil Go slice served "features": null. The portal's type said string[], called .length on it, and took the page down. The guarantee lives on a named Features type with its own MarshalJSON rather than at each of the six places a licence or plan is serialised, because the seventh is the one that would have been forgotten. Applying it at marshal time also fixes rows already holding null in Mongo, which a write-side fix alone would not. Same class, found while checking the rest: staffListInstances built its expiring filter from a nil []string, marshalling to $in: null, which Mongo rejects — so the quiet week when nothing is expiring is precisely when the staff Operations page's own query would have failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-26 18:10:07 +01:00
mrhid6andClaude Opus 5	c829cc41d9	feat(admin): linking, relink and the scoped customer API ... Every customer handler that names an instance resolves it through ownedInstance, which returns 404 rather than 403 for another account's instance -- a 403 confirms the instance exists, which is an existence oracle over customer data. The unique index on admin_instances.instance_id, not the pre-check, is what actually prevents two accounts owning one instance. Relink issues a replacement covering the REMAINING term, so it cannot be used to extend a subscription, and the old licence is not revoked because offline verification has no revocation -- its instance binding is what stops it. The route table lands with the staff handlers in the next commit so every commit builds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:09:13 +01:00
mrhid6andClaude Opus 5	427191b14c	feat(admin): licence issuance with plan snapshots and supersession ... Issue is the only place that signs. It records the licence, supersedes its predecessor and updates the instance -- but deliberately does not deliver. The ordering matters: a licence recorded but not delivered is recoverable, because the customer can download it. A licence delivered but not recorded is a support mystery with no paper trail. Free stays cloud-only through one comparison of plan against instance deployment, not a flag. Renewals reset relink_count because the cap is per term. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:01:47 +01:00