New updates

2026-09-09 08:23:43 +01:00
parent 868604b848
commit 5b9c19c52f
107 changed files with 11126 additions and 8 deletions
@@ -0,0 +1,42 @@
+<?php
+namespace App\Services\Licensing;
+
+use App\Models\License;
+use App\Models\LicenseProduct;
+use App\Models\LicenseDeliveryOutbox;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Crypt;
+
+final class LicenseIssuer
+{
+    public function issue(LicenseProduct $product, ?string $name, ?string $email, ?string $provider = null, ?string $orderID = null, ?string $customerID = null, bool $queueDelivery = false): array
+    {
+        return DB::transaction(function () use ($product,$name,$email,$provider,$orderID,$customerID,$queueDelivery) {
+            if ($provider && $orderID) {
+                $existing = License::where('payment_provider',$provider)->where('external_order_id',$orderID)->first();
+                if ($existing) return [$existing, null];
+            }
+            $plain = LicenseKey::generate();
+            $license = License::create([
+                'license_product_id'=>$product->id,
+                'license_key_hash'=>LicenseKey::hash($plain),
+                'license_key_last4'=>substr(LicenseKey::normalize($plain), -4),
+                'customer_name'=>$name,
+                'customer_email'=>$email ? strtolower(trim($email)) : null,
+                'edition'=>$product->edition,
+                'activation_limit'=>$product->activation_limit,
+                'max_major_version'=>$product->max_major_version,
+                'payment_provider'=>$provider,
+                'external_order_id'=>$orderID,
+                'external_customer_id'=>$customerID,
+            ]);
+            if ($queueDelivery) {
+                LicenseDeliveryOutbox::updateOrCreate(
+                    ['license_id'=>$license->id],
+                    ['encrypted_license_key'=>Crypt::encryptString($plain),'recipient_email'=>$license->customer_email,'delivered_at'=>null]
+                );
+            }
+            return [$license, $plain];
+        });
+    }
+}
@@ -0,0 +1,23 @@
+<?php
+namespace App\Services\Licensing;
+
+final class LicenseKey
+{
+    public static function generate(): string
+    {
+        $alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        $raw = '';
+        for ($i=0; $i<20; $i++) $raw .= $alphabet[random_int(0, strlen($alphabet)-1)];
+        return implode('-', str_split($raw, 5));
+    }
+
+    public static function normalize(string $value): string
+    {
+        return strtoupper(preg_replace('/[^A-Z0-9]/i', '', trim($value)) ?? '');
+    }
+
+    public static function hash(string $value): string
+    {
+        return hash('sha256', self::normalize($value));
+    }
+}
@@ -0,0 +1,51 @@
+<?php
+namespace App\Services\Licensing;
+
+use App\Models\License;
+use Carbon\CarbonInterface;
+use RuntimeException;
+
+final class LicenseSigner
+{
+    public function sign(License $license, string $installationID, ?CarbonInterface $issuedAt = null): string
+    {
+        $seed = $this->privateSeed();
+        $pair = sodium_crypto_sign_seed_keypair($seed);
+        $secret = sodium_crypto_sign_secretkey($pair);
+
+        $payload = [
+            'customerEmail' => $license->customer_email,
+            'customerName' => $license->customer_name,
+            'edition' => $license->edition,
+            'expiresAt' => $license->expires_at?->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'installationID' => strtolower($installationID),
+            'issuedAt' => ($issuedAt ?? now())->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'licenseID' => strtolower((string) $license->id),
+            'maxMajorVersion' => $license->max_major_version,
+        ];
+        ksort($payload, SORT_STRING);
+        $json = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
+        $sig = sodium_crypto_sign_detached($json, $secret);
+        return 'RS3.'.self::b64url($json).'.'.self::b64url($sig);
+    }
+
+    public function publicKeyBase64(): string
+    {
+        $pair = sodium_crypto_sign_seed_keypair($this->privateSeed());
+        return base64_encode(sodium_crypto_sign_publickey($pair));
+    }
+
+    private function privateSeed(): string
+    {
+        $path = config('rsync-studio.private_key_path');
+        if (!$path || !is_file($path)) throw new RuntimeException('RSYNC_STUDIO_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        $decoded = base64_decode(trim((string) file_get_contents($path)), true);
+        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) throw new RuntimeException('The Rsync Studio private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        return $decoded;
+    }
+
+    private static function b64url(string $value): string
+    {
+        return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
+    }
+}
@@ -0,0 +1,28 @@
+<?php
+namespace App\Services\Licensing;
+
+use RuntimeException;
+
+final class LicenseTokenVerifier
+{
+    public function verify(string $token): array
+    {
+        $parts = explode('.', trim($token));
+        if (count($parts) !== 3 || $parts[0] !== 'RS3') throw new RuntimeException('Invalid licence token.');
+        $payload = $this->decode($parts[1]);
+        $signature = $this->decode($parts[2]);
+        $public = base64_decode((string) config('rsync-studio.public_key'), true);
+        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) throw new RuntimeException('Server licence public key is invalid.');
+        if (!sodium_crypto_sign_verify_detached($signature, $payload, $public)) throw new RuntimeException('Licence token signature is invalid.');
+        $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
+        return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
+    }
+    private function decode(string $value): string
+    {
+        $value = strtr($value, '-_', '+/');
+        $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
+        $out = base64_decode($value, true);
+        if ($out === false) throw new RuntimeException('Invalid Base64URL value.');
+        return $out;
+    }
+}