updates

rsync-studio-licensing/app/Console/Commands/RsyncStudioAdminCreate.php

@@ -1,10 +1,36 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\User;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
-final class RsyncStudioAdminCreate extends Command {
- protected $signature='rsync-studio:admin {email} {--name=Administrator}'; protected $description='Create or promote an Rsync Studio licensing administrator';
- public function handle(): int { $email=strtolower(trim($this->argument('email'))); $password=Str::password(24,true,true,false,false); $u=User::firstOrNew(['email'=>$email]); $u->name=$this->option('name'); $u->is_admin=true; $u->email_verified_at=now(); if(!$u->exists){$u->password=Hash::make($password);} $u->save(); $this->info("Administrator ready: {$email}"); if(!$u->wasRecentlyCreated){$this->line('Existing password retained.');}else{$this->warn("Temporary password (shown once): {$password}");} return self::SUCCESS; }
+
+final class RsyncStudioAdminCreate extends Command
+{
+    protected $signature = 'rsync-studio:admin {email} {--name=Administrator}';
+
+    protected $description = 'Create or promote an Rsync Studio licensing administrator';
+
+    public function handle(): int
+    {
+        $email = strtolower(trim($this->argument('email')));
+        $password = Str::password(24, true, true, false, false);
+        $u = User::firstOrNew(['email' => $email]);
+        $u->name = $this->option('name');
+        $u->is_admin = true;
+        $u->email_verified_at = now();
+        if (! $u->exists) {
+            $u->password = Hash::make($password);
+        } $u->save();
+        $this->info("Administrator ready: {$email}");
+        if (! $u->wasRecentlyCreated) {
+            $this->line('Existing password retained.');
+        } else {
+            $this->warn("Temporary password (shown once): {$password}");
+        }
+
+return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioLicenseIssue.php

@@ -1,10 +1,29 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\LicenseProduct;
 use App\Services\Licensing\LicenseIssuer;
 use Illuminate\Console\Command;
+
 class RsyncStudioLicenseIssue extends Command
 {
-    protected $signature='rsync-studio:license:issue {product} {--name=} {--email=}'; protected $description='Issue a manual Rsync Studio licence key';
-    public function handle(LicenseIssuer $issuer): int { $p=LicenseProduct::where('code',$this->argument('product'))->firstOrFail(); [$l,$key]=$issuer->issue($p,$this->option('name')?:null,$this->option('email')?:null); if(!$key){$this->warn('Licence already existed; plaintext key is intentionally not recoverable.');return self::FAILURE;} $this->line('Licence ID: '.$l->id);$this->line('Licence key: '.$key);$this->warn('This is the only time the plaintext key is shown.');return self::SUCCESS; }
+    protected $signature = 'rsync-studio:license:issue {product} {--name=} {--email=}';
+
+    protected $description = 'Issue a manual Rsync Studio licence key';
+
+    public function handle(LicenseIssuer $issuer): int
+    {
+        $p = LicenseProduct::where('code', $this->argument('product'))->firstOrFail();
+        [$l,$key] = $issuer->issue($p, $this->option('name') ?: null, $this->option('email') ?: null);
+        if (! $key) {
+            $this->warn('Licence already existed; plaintext key is intentionally not recoverable.');
+
+            return self::FAILURE;
+        } $this->line('Licence ID: '.$l->id);
+        $this->line('Licence key: '.$key);
+        $this->warn('This is the only time the plaintext key is shown.');
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioLicenseRevoke.php

@@ -1,9 +1,22 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\License;
 use Illuminate\Console\Command;
+
 class RsyncStudioLicenseRevoke extends Command
 {
-    protected $signature='rsync-studio:license:revoke {id} {--reason=Administrative revocation}'; protected $description='Revoke a Rsync Studio licence';
-    public function handle(): int { $l=License::findOrFail($this->argument('id'));$l->update(['revoked_at'=>now(),'revoke_reason'=>$this->option('reason')]);$this->info('Licence revoked.');return self::SUCCESS; }
+    protected $signature = 'rsync-studio:license:revoke {id} {--reason=Administrative revocation}';
+
+    protected $description = 'Revoke a Rsync Studio licence';
+
+    public function handle(): int
+    {
+        $l = License::findOrFail($this->argument('id'));
+        $l->update(['revoked_at' => now(), 'revoke_reason' => $this->option('reason')]);
+        $this->info('Licence revoked.');
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Console/Commands/RsyncStudioProductCreate.php

@@ -1,10 +1,21 @@
 <?php
+
 namespace App\Console\Commands;
+
 use App\Models\LicenseProduct;
 use Illuminate\Console\Command;
+
 class RsyncStudioProductCreate extends Command
 {
-    protected $signature='rsync-studio:product {code} {--name=Rsync Studio} {--edition=Professional} {--activations=1} {--max-major=1} {--provider=} {--product-id=} {--price-id=}';
-    protected $description='Create or update a Rsync Studio licensing product';
-    public function handle(): int { $p=LicenseProduct::updateOrCreate(['code'=>$this->argument('code')],['name'=>$this->option('name'),'edition'=>$this->option('edition'),'activation_limit'=>(int)$this->option('activations'),'max_major_version'=>$this->option('max-major')!==''?(int)$this->option('max-major'):null,'payment_provider'=>$this->option('provider')?:null,'external_product_id'=>$this->option('product-id')?:null,'external_price_id'=>$this->option('price-id')?:null,'active'=>true]); $this->info("Product {$p->code} ready."); return self::SUCCESS; }
+    protected $signature = 'rsync-studio:product {code} {--name=Rsync Studio} {--edition=Professional} {--activations=1} {--max-major=1} {--provider=} {--product-id=} {--price-id=}';
+
+    protected $description = 'Create or update a Rsync Studio licensing product';
+
+    public function handle(): int
+    {
+        $p = LicenseProduct::updateOrCreate(['code' => $this->argument('code')], ['name' => $this->option('name'), 'edition' => $this->option('edition'), 'activation_limit' => (int) $this->option('activations'), 'max_major_version' => $this->option('max-major') !== '' ? (int) $this->option('max-major') : null, 'payment_provider' => $this->option('provider') ?: null, 'external_product_id' => $this->option('product-id') ?: null, 'external_price_id' => $this->option('price-id') ?: null, 'active' => true]);
+        $this->info("Product {$p->code} ready.");
+
+        return self::SUCCESS;
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Admin/AdminController.php

@@ -1,14 +1,49 @@
 <?php
+
 namespace App\Http\Controllers\Admin;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
-use App\Models\LicenseProduct;
+use App\Models\LicenseActivation;
 use App\Models\User;
 use Illuminate\Http\Request;
-final class AdminController extends Controller {
- public function index(){ return view('admin.index',['licenseCount'=>License::count(),'activeCount'=>License::whereNull('revoked_at')->count(),'activationCount'=>\App\Models\LicenseActivation::whereNull('deactivated_at')->count(),'userCount'=>User::count()]); }
- public function licenses(Request $r){ $q=License::with('product')->latest(); if($s=trim((string)$r->query('q'))) $q->where(fn($x)=>$x->where('customer_email','like',"%{$s}%")->orWhere('customer_name','like',"%{$s}%")->orWhere('license_key_last4','like',"%{$s}%")); return view('admin.licenses',['licenses'=>$q->paginate(50)->withQueryString()]); }
- public function show(License $license){$license->load(['product','activations']); return view('admin.license',compact('license'));}
- public function revoke(Request $request,License $license){$data=$request->validate(['reason'=>['nullable','string','max:255']]);$license->update(['revoked_at'=>now(),'revoke_reason'=>$data['reason']?:'Revoked by administrator']);return back()->with('status','Licence revoked.');}
- public function restore(License $license){$license->update(['revoked_at'=>null,'revoke_reason'=>null]);return back()->with('status','Licence restored.');}
+
+final class AdminController extends Controller
+{
+    public function index()
+    {
+        return view('admin.index', ['licenseCount' => License::count(), 'activeCount' => License::whereNull('revoked_at')->count(), 'activationCount' => LicenseActivation::whereNull('deactivated_at')->count(), 'userCount' => User::count()]);
+    }
+
+    public function licenses(Request $r)
+    {
+        $q = License::with('product')->latest();
+        if ($s = trim((string) $r->query('q'))) {
+            $q->where(fn ($x) => $x->where('customer_email', 'like', "%{$s}%")->orWhere('customer_name', 'like', "%{$s}%")->orWhere('license_key_last4', 'like', "%{$s}%"));
+        }
+
+return view('admin.licenses', ['licenses' => $q->paginate(50)->withQueryString()]);
+    }
+
+    public function show(License $license)
+    {
+        $license->load(['product', 'activations']);
+
+        return view('admin.license', compact('license'));
+    }
+
+    public function revoke(Request $request, License $license)
+    {
+        $data = $request->validate(['reason' => ['nullable', 'string', 'max:255']]);
+        $license->update(['revoked_at' => now(), 'revoke_reason' => $data['reason'] ?: 'Revoked by administrator']);
+
+        return back()->with('status', 'Licence revoked.');
+    }
+
+    public function restore(License $license)
+    {
+        $license->update(['revoked_at' => null, 'revoke_reason' => null]);
+
+        return back()->with('status','Licence restored.');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Admin/SupportTicketController.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+final class SupportTicketController extends Controller
+{
+    public function index(Request $request)
+    {
+        $tickets = SupportTicket::query()
+            ->with('assignee')
+            ->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
+            ->latest()
+            ->paginate(50)
+            ->withQueryString();
+
+        return view('admin.support.index', compact('tickets'));
+    }
+
+    public function show(SupportTicket $ticket)
+    {
+        $ticket->load(['user', 'assignee']);
+        if (auth()->user()) {
+            auth()->user()->unreadNotifications()->get()
+                ->filter(fn ($notification) => (int) ($notification->data['support_ticket_id'] ?? 0) === $ticket->id)
+                ->each->markAsRead();
+        }
+
+        return view('admin.support.show', [
+            'ticket' => $ticket,
+            'admins' => User::query()->where('is_admin', true)->orderBy('name')->get(['id', 'name', 'email']),
+        ]);
+    }
+
+    public function update(Request $request, SupportTicket $ticket): RedirectResponse
+    {
+        $data = $request->validate([
+            'status' => ['required', 'in:new,open,waiting,resolved,closed'],
+            'priority' => ['required', 'in:low,normal,high,urgent'],
+            'assigned_to' => ['nullable', 'integer', 'exists:users,id'],
+        ]);
+
+        if ($data['assigned_to'] ?? null) {
+            abort_unless(User::whereKey($data['assigned_to'])->where('is_admin', true)->exists(), 422);
+        }
+
+        $data['resolved_at'] = in_array($data['status'], ['resolved', 'closed'], true)
+            ? ($ticket->resolved_at ?? now())
+            : null;
+        $ticket->update($data);
+
+        return back()->with('status', 'Support ticket updated.');
+    }
+}

rsync-studio-licensing/app/Http/Controllers/Api/LicenseActivationController.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
@@ -17,37 +18,147 @@ final class LicenseActivationController extends Controller
     public function activate(Request $request, LicenseSigner $signer): JsonResponse
     {
         $data = $request->validate([
-            'licenseKey'=>['required','string','max:128'],
-            'installationID'=>['required','uuid'],
-            'appVersion'=>['required','string','max:32'],
-            'platform'=>['required','string','max:32'],
+            'licenseKey' => ['required', 'string', 'max:128'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
         ]);
 
-        return DB::transaction(function () use ($data,$signer) {
-            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))->lockForUpdate()->first();
-            if (!$license) throw ValidationException::withMessages(['licenseKey'=>'The licence key is not valid.']);
-            if (!$license->is_usable) return response()->json(['message'=>'This licence is expired or has been revoked.'], 403);
+        return DB::transaction(function () use ($data, $signer) {
+            $license = License::where('license_key_hash', LicenseKey::hash($data['licenseKey']))
+                ->lockForUpdate()
+                ->first();
 
-            $activation = LicenseActivation::where('license_id',$license->id)->where('installation_id',strtolower($data['installationID']))->first();
-            if ($activation && $activation->deactivated_at === null) {
-                $activation->update(['last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-            } else {
-                $activeCount = LicenseActivation::where('license_id',$license->id)->whereNull('deactivated_at')->count();
-                if ($activeCount >= $license->activation_limit) return response()->json(['message'=>'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
-                if ($activation) $activation->update(['deactivated_at'=>null,'activated_at'=>now(),'last_seen_at'=>now(),'platform'=>$data['platform'],'app_version'=>$data['appVersion']]);
-                else LicenseActivation::create(['license_id'=>$license->id,'installation_id'=>strtolower($data['installationID']),'platform'=>$data['platform'],'app_version'=>$data['appVersion'],'activated_at'=>now(),'last_seen_at'=>now()]);
+            if (! $license) {
+                throw ValidationException::withMessages(['licenseKey' => 'The licence key is not valid.']);
             }
-            return response()->json(['licenseToken'=>$signer->sign($license, $data['installationID'])]);
+
+            if (! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $installationID = strtolower($data['installationID']);
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', $installationID)
+                ->first();
+
+            if ($activation && $activation->deactivated_at === null) {
+                $activation->update([
+                    'last_seen_at' => now(),
+                    'platform' => $data['platform'],
+                    'app_version' => $data['appVersion'],
+                ]);
+            } else {
+                $activeCount = LicenseActivation::where('license_id', $license->id)
+                    ->whereNull('deactivated_at')
+                    ->count();
+
+                if ($activeCount >= $license->activation_limit) {
+                    return response()->json(['message' => 'This licence has reached its activation limit. Deactivate another Mac first.'], 409);
+                }
+
+                if ($activation) {
+                    $activation->update([
+                        'deactivated_at' => null,
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                    ]);
+                } else {
+                    LicenseActivation::create([
+                        'license_id' => $license->id,
+                        'installation_id' => $installationID,
+                        'platform' => $data['platform'],
+                        'app_version' => $data['appVersion'],
+                        'activated_at' => now(),
+                        'last_seen_at' => now(),
+                    ]);
+                }
+            }
+
+            return response()->json([
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
+        });
+    }
+
+    public function validateInstallation(
+        Request $request,
+        LicenseTokenVerifier $verifier,
+        LicenseSigner $signer,
+    ): JsonResponse {
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+            'appVersion' => ['required', 'string', 'max:32'],
+            'platform' => ['required', 'string', 'max:32'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        return DB::transaction(function () use ($data, $payload, $signer) {
+            $license = License::whereKey((string) ($payload['licenseID'] ?? ''))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $license || ! $license->is_usable) {
+                return response()->json(['message' => 'This licence is expired or has been revoked.'], 403);
+            }
+
+            $activation = LicenseActivation::where('license_id', $license->id)
+                ->where('installation_id', strtolower($data['installationID']))
+                ->first();
+
+            if (! $activation || $activation->deactivated_at !== null) {
+                return response()->json(['message' => 'This Mac has been deactivated from the licence portal.'], 403);
+            }
+
+            $activation->update([
+                'last_seen_at' => now(),
+                'platform' => $data['platform'],
+                'app_version' => $data['appVersion'],
+            ]);
+
+            return response()->json([
+                'active' => true,
+                // Refreshing the signed token also applies subscription edition/expiry changes
+                // without requiring the user to reactivate manually.
+                'licenseToken' => $signer->sign($license, $data['installationID']),
+            ]);
         });
     }
 
     public function deactivate(Request $request, LicenseTokenVerifier $verifier): JsonResponse
     {
-        $data = $request->validate(['licenseToken'=>['required','string','max:8192'],'installationID'=>['required','uuid']]);
-        try { $payload = $verifier->verify($data['licenseToken']); }
-        catch (\Throwable) { return response()->json(['message'=>'The licence token is invalid.'], 400); }
-        if (strcasecmp((string)($payload['installationID'] ?? ''), $data['installationID']) !== 0) return response()->json(['message'=>'The installation does not match this licence token.'], 400);
-        LicenseActivation::where('license_id',(string)($payload['licenseID'] ?? ''))->where('installation_id',strtolower($data['installationID']))->whereNull('deactivated_at')->update(['deactivated_at'=>now(),'last_seen_at'=>now()]);
-        return response()->json((object)[]);
+        $data = $request->validate([
+            'licenseToken' => ['required', 'string', 'max:8192'],
+            'installationID' => ['required', 'uuid'],
+        ]);
+
+        try {
+            $payload = $verifier->verify($data['licenseToken']);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'The licence token is invalid.'], 400);
+        }
+
+        if (strcasecmp((string) ($payload['installationID'] ?? ''), $data['installationID']) !== 0) {
+            return response()->json(['message' => 'The installation does not match this licence token.'], 400);
+        }
+
+        LicenseActivation::where('license_id', (string) ($payload['licenseID'] ?? ''))
+            ->where('installation_id', strtolower($data['installationID']))
+            ->whereNull('deactivated_at')
+            ->update(['deactivated_at' => now(), 'last_seen_at' => now()]);
+
+        return response()->json((object) []);
     }
 }

rsync-studio-licensing/app/Http/Controllers/Api/PaymentWebhookController.php

@@ -1,8 +1,10 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Models\LicenseWebhookEvent;
+use App\Services\Licensing\LicenseDeliveryService;
 use App\Services\Payments\LemonSqueezyWebhookVerifier;
 use App\Services\Payments\PaddleWebhookVerifier;
 use App\Services\Payments\PurchaseProvisioner;
@@ -12,26 +14,65 @@ use Illuminate\Support\Facades\DB;
 
 final class PaymentWebhookController extends Controller
 {
-    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner): JsonResponse
+    public function __invoke(string $provider, Request $request, PurchaseProvisioner $provisioner, LicenseDeliveryService $delivery): JsonResponse
     {
-        $raw=(string)$request->getContent();
-        $verifier=match($provider){'paddle'=>app(PaddleWebhookVerifier::class),'lemon-squeezy'=>app(LemonSqueezyWebhookVerifier::class),default=>null};
-        if (!$verifier) return response()->json(['message'=>'Unknown webhook provider.'],404);
-        try { $verifier->verify($request,$raw); } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Invalid webhook signature.'],400); }
-        try { $payload=json_decode($raw,true,flags:JSON_THROW_ON_ERROR); } catch (\Throwable) { return response()->json(['message'=>'Invalid JSON.'],400); }
-        $externalID=(string)($provider==='paddle'?($payload['event_id']??''):($payload['meta']['event_name']??'').':'.($payload['data']['id']??''));
-        $eventType=(string)($provider==='paddle'?($payload['event_type']??'unknown'):($payload['meta']['event_name']??'unknown'));
-        if ($externalID==='') return response()->json(['message'=>'Webhook event has no stable identifier.'],400);
+        $raw = (string) $request->getContent();
+        $verifier = match ($provider) {
+            'paddle' => app(PaddleWebhookVerifier::class),'lemon-squeezy' => app(LemonSqueezyWebhookVerifier::class),default => null
+        };
+        if (! $verifier) {
+            return response()->json(['message' => 'Unknown webhook provider.'], 404);
+        }
+        try {
+            $verifier->verify($request, $raw);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Invalid webhook signature.'], 400);
+        }
+        try {
+            $payload = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
+        } catch (\Throwable) {
+            return response()->json(['message' => 'Invalid JSON.'], 400);
+        }
+        $externalID = (string) ($provider === 'paddle' ? ($payload['event_id'] ?? '') : ($payload['meta']['event_name'] ?? '').':'.($payload['data']['id'] ?? ''));
+        $eventType = (string) ($provider === 'paddle' ? ($payload['event_type'] ?? 'unknown') : ($payload['meta']['event_name'] ?? 'unknown'));
+        if ($externalID === '') {
+            return response()->json(['message' => 'Webhook event has no stable identifier.'], 400);
+        }
 
         try {
-            DB::transaction(function() use($provider,$externalID,$eventType,$payload,$raw,$provisioner){
-                $event=LicenseWebhookEvent::firstOrCreate(['provider'=>$provider,'external_event_id'=>$externalID],['event_type'=>$eventType,'payload_sha256'=>hash('sha256',$raw),'payload'=>$payload]);
-                if ($event->processed_at) return;
-                if (!hash_equals($event->payload_sha256,hash('sha256',$raw))) throw new \RuntimeException('Webhook ID was reused with a different payload.');
-                try { $provisioner->provision($provider,$payload); $event->update(['processed_at'=>now(),'processing_error'=>null]); }
-                catch (\Throwable $e) { $event->update(['processing_error'=>mb_substr($e->getMessage(),0,4000)]); throw $e; }
+            DB::transaction(function () use ($provider, $externalID, $eventType, $payload, $raw, $provisioner) {
+                $event = LicenseWebhookEvent::firstOrCreate(['provider' => $provider, 'external_event_id' => $externalID], ['event_type' => $eventType, 'payload_sha256' => hash('sha256', $raw), 'payload' => $payload]);
+                if ($event->processed_at) {
+                    return;
+                }
+                if (! hash_equals($event->payload_sha256, hash('sha256', $raw))) {
+                    throw new \RuntimeException('Webhook ID was reused with a different payload.');
+                }
+                try {
+                    $provisioner->provision($provider, $payload);
+                    $event->update(['processed_at' => now(), 'processing_error' => null]);
+                } catch (\Throwable $e) {
+                    $event->update(['processing_error' => mb_substr($e->getMessage(), 0, 4000)]);
+                    throw $e;
+                }
             });
-        } catch (\Throwable $e) { report($e); return response()->json(['message'=>'Webhook could not be processed.'],500); }
-        return response()->json(['ok'=>true]);
+        } catch (\Throwable $e) {
+            report($e);
+
+            return response()->json(['message' => 'Webhook could not be processed.'], 500);
+        }
+
+        // Delivery is intentionally outside the webhook transaction. A temporary mail
+        // outage must not roll back an otherwise valid Paddle event. Pending outbox
+        // rows remain available for portal resend or a later webhook delivery attempt.
+        try {
+            $delivery->deliverPending(10);
+        } catch (\Throwable $e) {
+            report($e);
+        }
+
+        return response()->json(['ok' => true]);
     }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -1,14 +1,35 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
-final class AuthenticatedSessionController extends Controller {
- public function create(){ return view('auth.login'); }
- public function store(Request $request){
-   $credentials=$request->validate(['email'=>['required','email'],'password'=>['required','string']]);
-   if(!Auth::attempt(['email'=>strtolower($credentials['email']),'password'=>$credentials['password']], $request->boolean('remember'))){ return back()->withErrors(['email'=>'The supplied credentials are invalid.'])->onlyInput('email'); }
-   $request->session()->regenerate(); return redirect()->intended(route('portal.index'));
- }
- public function destroy(Request $request){ Auth::logout(); $request->session()->invalidate(); $request->session()->regenerateToken(); return redirect()->route('login'); }
+
+final class AuthenticatedSessionController extends Controller
+{
+    public function create()
+    {
+        return view('auth.login');
+    }
+
+    public function store(Request $request)
+    {
+        $credentials = $request->validate(['email' => ['required', 'email'], 'password' => ['required', 'string']]);
+        if (! Auth::attempt(['email' => strtolower($credentials['email']), 'password' => $credentials['password']], $request->boolean('remember'))) {
+            return back()->withErrors(['email' => 'The supplied credentials are invalid.'])->onlyInput('email');
+        }
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('portal.index'));
+    }
+
+    public function destroy(Request $request)
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/EmailVerificationController.php

@@ -1,10 +1,31 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\EmailVerificationRequest;
 use Illuminate\Http\Request;
-final class EmailVerificationController extends Controller {
- public function notice(){ return view('auth.verify-email'); }
- public function verify(EmailVerificationRequest $request){ $request->fulfill(); return redirect()->route('portal.index')->with('status','Email verified.'); }
- public function resend(Request $request){ if(!$request->user()->hasVerifiedEmail()) $request->user()->sendEmailVerificationNotification(); return back()->with('status','Verification link sent.'); }
+
+final class EmailVerificationController extends Controller
+{
+    public function notice()
+    {
+        return view('auth.verify-email');
+    }
+
+    public function verify(EmailVerificationRequest $request)
+    {
+        $request->fulfill();
+
+        return redirect()->route('portal.index')->with('status', 'Email verified.');
+    }
+
+    public function resend(Request $request)
+    {
+        if (! $request->user()->hasVerifiedEmail()) {
+            $request->user()->sendEmailVerificationNotification();
+        }
+
+return back()->with('status', 'Verification link sent.');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/PasswordController.php

@@ -1,5 +1,7 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\PasswordReset;
@@ -7,9 +9,35 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password as PasswordRule;
-final class PasswordController extends Controller {
- public function requestForm(){ return view('auth.forgot-password'); }
- public function email(Request $request){ $request->validate(['email'=>['required','email']]); $status=Password::sendResetLink(['email'=>strtolower($request->email)]); return $status===Password::RESET_LINK_SENT?back()->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
- public function resetForm(Request $request,string $token){ return view('auth.reset-password',['token'=>$token,'email'=>$request->query('email')]); }
- public function reset(Request $request){ $data=$request->validate(['token'=>['required'],'email'=>['required','email'],'password'=>['required','confirmed',PasswordRule::min(12)->letters()->mixedCase()->numbers()]]); $status=Password::reset($data,function(User $user,string $password){$user->forceFill(['password'=>$password,'remember_token'=>Str::random(60)])->save();event(new PasswordReset($user));}); return $status===Password::PASSWORD_RESET?redirect()->route('login')->with('status',__($status)):back()->withErrors(['email'=>__($status)]); }
+
+final class PasswordController extends Controller
+{
+    public function requestForm()
+    {
+        return view('auth.forgot-password');
+    }
+
+    public function email(Request $request)
+    {
+        $request->validate(['email' => ['required', 'email']]);
+        $status = Password::sendResetLink(['email' => strtolower($request->email)]);
+
+        return $status === Password::RESET_LINK_SENT ? back()->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
+
+    public function resetForm(Request $request, string $token)
+    {
+        return view('auth.reset-password', ['token' => $token, 'email' => $request->query('email')]);
+    }
+
+    public function reset(Request $request)
+    {
+        $data = $request->validate(['token' => ['required'], 'email' => ['required', 'email'], 'password' => ['required', 'confirmed', PasswordRule::min(12)->letters()->mixedCase()->numbers()]]);
+        $status = Password::reset($data, function (User $user, string $password) {
+            $user->forceFill(['password' => $password, 'remember_token' => Str::random(60)])->save();
+            event(new PasswordReset($user));
+        });
+
+        return $status === Password::PASSWORD_RESET ? redirect()->route('login')->with('status', __($status)) : back()->withErrors(['email' => __($status)]);
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Auth/RegisteredUserController.php

@@ -1,15 +1,29 @@
 <?php
+
 namespace App\Http\Controllers\Auth;
+
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Auth\Events\Registered;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Validation\Rules\Password;
-final class RegisteredUserController extends Controller {
- public function create(){ return view('auth.register'); }
- public function store(Request $request){
-   $data=$request->validate(['name'=>['required','string','max:120'],'email'=>['required','email','max:255','unique:users,email'],'password'=>['required','confirmed',Password::min(12)->letters()->mixedCase()->numbers()]]);
-   $user=User::create(['name'=>$data['name'],'email'=>strtolower($data['email']),'password'=>$data['password']]); event(new Registered($user)); Auth::login($user); $request->session()->regenerate(); return redirect()->route('verification.notice');
- }
+
+final class RegisteredUserController extends Controller
+{
+    public function create()
+    {
+        return view('auth.register');
+    }
+
+    public function store(Request $request)
+    {
+        $data = $request->validate(['name' => ['required', 'string', 'max:120'], 'email' => ['required', 'email', 'max:255', 'unique:users,email'], 'password' => ['required', 'confirmed', Password::min(12)->letters()->mixedCase()->numbers()]]);
+        $user = User::create(['name' => $data['name'], 'email' => strtolower($data['email']), 'password' => $data['password']]);
+        event(new Registered($user));
+        Auth::login($user);
+        $request->session()->regenerate();
+
+        return redirect()->route('verification.notice');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/CheckoutController.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Contracts\View\View;
+use RuntimeException;
+
+final class CheckoutController extends Controller
+{
+    public function __invoke(): View
+    {
+        $paddle = config('rsync-studio.paddle');
+        $token = trim((string) ($paddle['client_side_token'] ?? ''));
+
+        if ($token === '') {
+            throw new RuntimeException('PADDLE_CLIENT_SIDE_TOKEN is not configured.');
+        }
+
+        $plans = [
+            'personal-monthly' => ['name' => 'Personal', 'billing' => 'Monthly', 'display_price' => '£1.99 / month', 'price_id' => $paddle['personal_monthly_price_id'], 'activation_limit' => 1],
+            'personal-annual' => ['name' => 'Personal', 'billing' => 'Annual', 'display_price' => '£14.99 / year', 'price_id' => $paddle['personal_annual_price_id'], 'activation_limit' => 1],
+            'professional-monthly' => ['name' => 'Professional', 'billing' => 'Monthly', 'display_price' => '£3.99 / month', 'price_id' => $paddle['professional_monthly_price_id'], 'activation_limit' => 3],
+            'professional-annual' => ['name' => 'Professional', 'billing' => 'Annual', 'display_price' => '£29.99 / year', 'price_id' => $paddle['professional_annual_price_id'], 'activation_limit' => 3],
+        ];
+
+        foreach ($plans as $plan) {
+            if (trim((string) $plan['price_id']) === '') {
+                throw new RuntimeException('One or more Paddle price IDs are not configured.');
+            }
+        }
+
+        return view('checkout.buy', [
+            'plans' => $plans,
+            'paddleToken' => $token,
+            'paddleEnvironment' => (string) ($paddle['environment'] ?? 'sandbox'),
+        ]);
+    }
+}

rsync-studio-licensing/app/Http/Controllers/Portal/PortalController.php

@@ -1,15 +1,142 @@
 <?php
+
 namespace App\Http\Controllers\Portal;
+
 use App\Http\Controllers\Controller;
 use App\Models\License;
 use App\Models\LicenseDeliveryOutbox;
+use App\Models\LicenseProduct;
+use App\Services\Payments\PaddleClient;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Mail;
-final class PortalController extends Controller {
- private function owned(Request $request){ return License::with(['product','activations'])->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]); }
- public function index(Request $request){ return view('portal.index',['licenses'=>$this->owned($request)->latest()->get()]); }
- public function show(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $license->load(['product','activations']); return view('portal.show',compact('license')); }
- public function deactivate(Request $request,License $license,int $activation){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $item=$license->activations()->whereKey($activation)->firstOrFail(); if(!$item->deactivated_at){$item->update(['deactivated_at'=>now()]);} return back()->with('status','Activation released.'); }
- public function resend(Request $request,License $license){ abort_unless(strtolower((string)$license->customer_email)===strtolower($request->user()->email),404); $out=LicenseDeliveryOutbox::where('license_id',$license->id)->first(); if(!$out) return back()->withErrors(['licence'=>'This licence was issued manually and its full key is not recoverable. Contact support.']); $plain=Crypt::decryptString($out->encrypted_license_key); Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.",fn($m)=>$m->to($request->user()->email)->subject('Your Rsync Studio licence key')); $out->update(['delivered_at'=>now()]); return back()->with('status','Licence key sent to your verified email address.'); }
+use RuntimeException;
+
+final class PortalController extends Controller
+{
+    public function __construct(private PaddleClient $paddle) {}
+
+    private function owned(Request $request)
+    {
+        return License::with(['product', 'activations'])
+            ->whereRaw('lower(customer_email) = ?', [strtolower($request->user()->email)]);
+    }
+
+    public function index(Request $request)
+    {
+        $licenses = $this->owned($request)->latest()->get();
+        $hasProfessional = $licenses->contains(fn (License $license) => $license->is_usable && $license->edition === 'Professional');
+
+        return view('portal.index', compact('licenses', 'hasProfessional'));
+    }
+
+    public function show(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $license->load(['product', 'activations']);
+
+        return view('portal.show', compact('license'));
+    }
+
+    public function upgrade(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless($license->edition === 'Personal' && $license->is_usable, 422);
+
+        $targetPriceID = $this->professionalPriceFor($license);
+        $targetProduct = LicenseProduct::query()
+            ->where('payment_provider', 'paddle')
+            ->where('external_price_id', $targetPriceID)
+            ->where('active', true)
+            ->firstOrFail();
+
+        try {
+            $subscription = $this->paddle->updateSubscriptionPrice($license->external_subscription_id, $targetPriceID);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        // Apply the entitlement immediately. Paddle webhooks remain authoritative and
+        // will reconcile subscription status/current-period details afterwards.
+        $license->update([
+            'license_product_id' => $targetProduct->id,
+            'edition' => $targetProduct->edition,
+            'activation_limit' => $targetProduct->activation_limit,
+            'max_major_version' => $targetProduct->max_major_version,
+            'external_price_id' => $targetPriceID,
+            'subscription_status' => (string) ($subscription['status'] ?? $license->subscription_status),
+            'revoked_at' => null,
+            'revoke_reason' => null,
+        ]);
+
+        return redirect()->route('portal.show', $license)->with('status', 'Upgraded to Professional. Your existing Paddle subscription was changed; no second subscription was created.');
+    }
+
+    public function cancel(Request $request, License $license): RedirectResponse
+    {
+        $this->authorise($request, $license);
+        abort_unless($license->payment_provider === 'paddle' && $license->external_subscription_id, 422);
+        abort_unless(! in_array($license->subscription_status, ['canceled'], true), 422);
+
+        try {
+            $this->paddle->cancelSubscriptionImmediately($license->external_subscription_id);
+        } catch (RuntimeException $exception) {
+            return back()->withErrors(['licence' => $exception->getMessage()]);
+        }
+
+        $license->update([
+            'subscription_status' => 'canceled',
+            'expires_at' => now(),
+            'revoked_at' => now(),
+            'revoke_reason' => 'Subscription canceled from licence portal',
+            'cancel_scheduled_at' => null,
+        ]);
+
+        return redirect()->route('portal.index')->with('status', 'Subscription canceled in Paddle and the licence is no longer active.');
+    }
+
+    public function deactivate(Request $request, License $license, int $activation)
+    {
+        $this->authorise($request, $license);
+        $item = $license->activations()->whereKey($activation)->firstOrFail();
+        if (! $item->deactivated_at) {
+            $item->update(['deactivated_at' => now()]);
+        }
+
+        return back()->with('status', 'Mac deactivated. Rsync Studio will detect this through the licensing API.');
+    }
+
+    public function resend(Request $request, License $license)
+    {
+        $this->authorise($request, $license);
+        $out = LicenseDeliveryOutbox::where('license_id', $license->id)->first();
+        if (! $out) {
+            return back()->withErrors(['licence' => 'This licence was issued manually and its full key is not recoverable. Contact support.']);
+        }
+
+        $plain = Crypt::decryptString($out->encrypted_license_key);
+        Mail::raw("Your Rsync Studio licence key is:\n\n{$plain}\n\nKeep this key private.", fn ($m) => $m->to($request->user()->email)->subject('Your Rsync Studio licence key'));
+        $out->update(['delivered_at' => now()]);
+
+        return back()->with('status', 'Licence key sent to your verified email address.');
+    }
+
+    private function authorise(Request $request, License $license): void
+    {
+        abort_unless(strtolower((string) $license->customer_email) === strtolower($request->user()->email), 404);
+    }
+
+    private function professionalPriceFor(License $license): string
+    {
+        $paddle = config('rsync-studio.paddle');
+        $current = (string) $license->external_price_id;
+
+        if ($current === (string) ($paddle['personal_annual_price_id'] ?? '')) {
+            return (string) ($paddle['professional_annual_price_id'] ?? '');
+        }
+
+        return (string) ($paddle['professional_monthly_price_id'] ?? '');
+    }
 }

rsync-studio-licensing/app/Http/Controllers/Support/SupportController.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers\Support;
+
+use App\Http\Controllers\Controller;
+use App\Models\SupportTicket;
+use App\Models\User;
+use App\Notifications\NewSupportTicket;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Str;
+
+final class SupportController extends Controller
+{
+    public function create(Request $request)
+    {
+        return view('support', [
+            'categories' => [
+                'technical' => 'Technical support',
+                'licensing' => 'Licence & activation',
+                'billing' => 'Billing & subscription',
+                'feature' => 'Feature request',
+                'privacy' => 'Privacy / data request',
+                'general' => 'General enquiry',
+            ],
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        // Honeypot: bots tend to fill hidden fields. Return success without retaining spam.
+        if (filled($request->input('company_website'))) {
+            return back()->with('status', 'Your support request has been received.');
+        }
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:120'],
+            'email' => ['required', 'email:rfc', 'max:254'],
+            'category' => ['required', 'in:technical,licensing,billing,feature,privacy,general'],
+            'subject' => ['required', 'string', 'max:180'],
+            'message' => ['required', 'string', 'min:10', 'max:10000'],
+            'privacy_notice' => ['accepted'],
+        ]);
+
+        $ticket = SupportTicket::create([
+            'user_id' => $request->user()?->id,
+            'reference' => $this->reference(),
+            'name' => $data['name'],
+            'email' => strtolower($data['email']),
+            'category' => $data['category'],
+            'subject' => $data['subject'],
+            'message' => $data['message'],
+            'privacy_notice_accepted_at' => now(),
+        ]);
+
+        $this->notifyTeam($ticket);
+
+        Mail::raw(
+            "We received your Rsync Studio support request.\n\nReference: {$ticket->reference}\nSubject: {$ticket->subject}\n\nWe will reply to this email address. Please keep the reference in any follow-up.",
+            fn ($mail) => $mail->to($ticket->email)->subject("Rsync Studio support request {$ticket->reference}")
+        );
+
+        return redirect()->route('support')->with('status', "Support request {$ticket->reference} received. A confirmation has been emailed to you.");
+    }
+
+    private function notifyTeam(SupportTicket $ticket): void
+    {
+        if (config('rsync-studio.support.notify_admin_users', true)) {
+            User::query()->where('is_admin', true)->get()->each->notify(new NewSupportTicket($ticket));
+        }
+
+        $emails = collect(config('rsync-studio.support.alert_emails', []))
+            ->filter(fn ($email) => filter_var($email, FILTER_VALIDATE_EMAIL))
+            ->unique()
+            ->values();
+
+        if ($emails->isNotEmpty()) {
+            Notification::route('mail', $emails->all())->notify(new NewSupportTicket($ticket));
+        }
+    }
+
+    private function reference(): string
+    {
+        do {
+            $reference = 'RS-'.now()->format('ymd').'-'.Str::upper(Str::random(6));
+        } while (SupportTicket::where('reference', $reference)->exists());
+
+        return $reference;
+    }
+}

rsync-studio-licensing/app/Http/Middleware/AdminOnly.php

@@ -1,11 +1,17 @@
 <?php
+
 namespace App\Http\Middleware;
+
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
-final class AdminOnly {
-    public function handle(Request $request, Closure $next): Response {
+
+final class AdminOnly
+{
+    public function handle(Request $request, Closure $next): Response
+    {
         abort_unless($request->user()?->is_admin === true, 403);
+
         return $next($request);
     }
 }

rsync-studio-licensing/app/Models/License.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Concerns\HasUuids;
@@ -9,11 +10,27 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
 class License extends Model
 {
     use HasUuids;
+
     public $incrementing = false;
+
     protected $keyType = 'string';
-    protected $fillable = ['license_product_id','license_key_hash','license_key_last4','customer_name','customer_email','edition','activation_limit','max_major_version','expires_at','revoked_at','revoke_reason','payment_provider','external_order_id','external_customer_id'];
-    protected $casts = ['expires_at'=>'datetime','revoked_at'=>'datetime','activation_limit'=>'integer','max_major_version'=>'integer'];
-    public function product(): BelongsTo { return $this->belongsTo(LicenseProduct::class, 'license_product_id'); }
-    public function activations(): HasMany { return $this->hasMany(LicenseActivation::class); }
-    public function getIsUsableAttribute(): bool { return $this->revoked_at === null && ($this->expires_at === null || $this->expires_at->isFuture()); }
+
+    protected $fillable = ['license_product_id', 'license_key_hash', 'license_key_last4', 'customer_name', 'customer_email', 'edition', 'activation_limit', 'max_major_version', 'expires_at', 'revoked_at', 'revoke_reason', 'payment_provider', 'external_order_id', 'external_customer_id', 'external_subscription_id', 'external_price_id', 'subscription_status', 'current_period_ends_at', 'cancel_scheduled_at'];
+
+    protected $casts = ['expires_at' => 'datetime', 'revoked_at' => 'datetime', 'activation_limit' => 'integer', 'max_major_version' => 'integer', 'current_period_ends_at' => 'datetime', 'cancel_scheduled_at' => 'datetime'];
+
+    public function product(): BelongsTo
+    {
+        return $this->belongsTo(LicenseProduct::class, 'license_product_id');
+    }
+
+    public function activations(): HasMany
+    {
+        return $this->hasMany(LicenseActivation::class);
+    }
+
+    public function getIsUsableAttribute(): bool
+    {
+        return $this->revoked_at === null && ($this->expires_at === null || $this->expires_at->isFuture());
+    }
 }

rsync-studio-licensing/app/Models/LicenseActivation.php

@@ -1,9 +1,14 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseActivation extends Model
 {
     public $timestamps = false;
-    protected $fillable = ['license_id','installation_id','installation_name','platform','app_version','activated_at','last_seen_at','deactivated_at'];
-    protected $casts = ['activated_at'=>'datetime','last_seen_at'=>'datetime','deactivated_at'=>'datetime'];
+
+    protected $fillable = ['license_id', 'installation_id', 'installation_name', 'platform', 'app_version', 'activated_at', 'last_seen_at', 'deactivated_at'];
+
+    protected $casts = ['activated_at' => 'datetime', 'last_seen_at' => 'datetime', 'deactivated_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/LicenseDeliveryOutbox.php

@@ -1,9 +1,14 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseDeliveryOutbox extends Model
 {
     protected $table = 'license_delivery_outbox';
-    protected $fillable = ['license_id','encrypted_license_key','recipient_email','delivered_at'];
-    protected $casts = ['delivered_at'=>'datetime'];
+
+    protected $fillable = ['license_id', 'encrypted_license_key', 'recipient_email', 'delivered_at'];
+
+    protected $casts = ['delivered_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/LicenseProduct.php

@@ -1,10 +1,12 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Model;
 
 class LicenseProduct extends Model
 {
-    protected $fillable = ['code','name','edition','activation_limit','max_major_version','payment_provider','external_product_id','external_price_id','active'];
-    protected $casts = ['active'=>'boolean','activation_limit'=>'integer','max_major_version'=>'integer'];
+    protected $fillable = ['code', 'name', 'edition', 'activation_limit', 'max_major_version', 'payment_provider', 'external_product_id', 'external_price_id', 'active'];
+
+    protected $casts = ['active' => 'boolean', 'activation_limit' => 'integer', 'max_major_version' => 'integer'];
 }

rsync-studio-licensing/app/Models/LicenseWebhookEvent.php

@@ -1,8 +1,12 @@
 <?php
+
 namespace App\Models;
+
 use Illuminate\Database\Eloquent\Model;
+
 class LicenseWebhookEvent extends Model
 {
-    protected $fillable = ['provider','external_event_id','event_type','payload_sha256','payload','processed_at','processing_error'];
-    protected $casts = ['payload'=>'array','processed_at'=>'datetime'];
+    protected $fillable = ['provider', 'external_event_id', 'event_type', 'payload_sha256', 'payload', 'processed_at', 'processing_error'];
+
+    protected $casts = ['payload' => 'array', 'processed_at' => 'datetime'];
 }

rsync-studio-licensing/app/Models/SupportTicket.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Prunable;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class SupportTicket extends Model
+{
+    use Prunable;
+
+    protected $fillable = [
+        'user_id', 'assigned_to', 'reference', 'name', 'email', 'category',
+        'subject', 'message', 'status', 'priority', 'privacy_notice_accepted_at',
+        'resolved_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'privacy_notice_accepted_at' => 'datetime',
+            'resolved_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function assignee(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'assigned_to');
+    }
+
+    public function prunable(): Builder
+    {
+        $days = max(30, (int) config('rsync-studio.privacy.support_retention_days', 730));
+
+        return static::query()
+            ->whereNotNull('resolved_at')
+            ->where('resolved_at', '<=', now()->subDays($days));
+    }
+}

rsync-studio-licensing/app/Models/User.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Models;
 
 use Illuminate\Contracts\Auth\MustVerifyEmail;
@@ -9,7 +10,13 @@ use Illuminate\Notifications\Notifiable;
 class User extends Authenticatable implements MustVerifyEmail
 {
     use HasFactory, Notifiable;
-    protected $fillable = ['name','email','password','is_admin'];
-    protected $hidden = ['password','remember_token'];
-    protected function casts(): array { return ['email_verified_at'=>'datetime','password'=>'hashed','is_admin'=>'boolean']; }
+
+    protected $fillable = ['name', 'email', 'password', 'is_admin'];
+
+    protected $hidden = ['password', 'remember_token'];
+
+    protected function casts(): array
+    {
+        return ['email_verified_at' => 'datetime', 'password' => 'hashed', 'is_admin' => 'boolean'];
+    }
 }

rsync-studio-licensing/app/Notifications/NewSupportTicket.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\SupportTicket;
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+class NewSupportTicket extends Notification
+{
+    use Queueable;
+
+    public function __construct(public readonly SupportTicket $ticket) {}
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable instanceof AnonymousNotifiable ? ['mail'] : ['database', 'mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("New Rsync Studio support request {$this->ticket->reference}")
+            ->greeting('New support request')
+            ->line("{$this->ticket->name} <{$this->ticket->email}>")
+            ->line("Category: {$this->ticket->category}")
+            ->line("Subject: {$this->ticket->subject}")
+            ->line($this->ticket->message)
+            ->action('Open support ticket', route('admin.support.show', $this->ticket));
+    }
+
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'support_ticket_id' => $this->ticket->id,
+            'reference' => $this->ticket->reference,
+            'subject' => $this->ticket->subject,
+            'email' => $this->ticket->email,
+        ];
+    }
+}

rsync-studio-licensing/app/Services/Licensing/LicenseDeliveryService.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Services\Licensing;
+
+use App\Models\LicenseDeliveryOutbox;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Mail;
+
+final class LicenseDeliveryService
+{
+    public function deliverPending(int $limit = 20): int
+    {
+        $delivered = 0;
+        $pending = LicenseDeliveryOutbox::query()
+            ->whereNull('delivered_at')
+            ->whereNotNull('recipient_email')
+            ->where('recipient_email', '!=', '')
+            ->oldest()
+            ->limit(max(1, min($limit, 100)))
+            ->get();
+
+        foreach ($pending as $outbox) {
+            $plain = Crypt::decryptString($outbox->encrypted_license_key);
+            $recipient = strtolower(trim((string) $outbox->recipient_email));
+            if ($recipient === '') {
+                continue;
+            }
+
+            Mail::raw(
+                "Thank you for choosing Rsync Studio.\n\nYour licence key is:\n\n{$plain}\n\nOpen Rsync Studio → Settings → Licence and enter this key to activate your Mac.\n\nKeep this key private. You can manage activations from the Rsync Studio licence portal.",
+                fn ($message) => $message->to($recipient)->subject('Your Rsync Studio licence key')
+            );
+
+            $outbox->update(['delivered_at' => now()]);
+            $delivered++;
+        }
+
+        return $delivered;
+    }
+}

rsync-studio-licensing/app/Services/Licensing/LicenseIssuer.php

@@ -1,41 +1,45 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use App\Models\License;
-use App\Models\LicenseProduct;
 use App\Models\LicenseDeliveryOutbox;
-use Illuminate\Support\Facades\DB;
+use App\Models\LicenseProduct;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
 
 final class LicenseIssuer
 {
     public function issue(LicenseProduct $product, ?string $name, ?string $email, ?string $provider = null, ?string $orderID = null, ?string $customerID = null, bool $queueDelivery = false): array
     {
-        return DB::transaction(function () use ($product,$name,$email,$provider,$orderID,$customerID,$queueDelivery) {
+        return DB::transaction(function () use ($product, $name, $email, $provider, $orderID, $customerID, $queueDelivery) {
             if ($provider && $orderID) {
-                $existing = License::where('payment_provider',$provider)->where('external_order_id',$orderID)->first();
-                if ($existing) return [$existing, null];
+                $existing = License::where('payment_provider', $provider)->where('external_order_id', $orderID)->first();
+                if ($existing) {
+                    return [$existing, null];
+                }
             }
             $plain = LicenseKey::generate();
             $license = License::create([
-                'license_product_id'=>$product->id,
-                'license_key_hash'=>LicenseKey::hash($plain),
-                'license_key_last4'=>substr(LicenseKey::normalize($plain), -4),
-                'customer_name'=>$name,
-                'customer_email'=>$email ? strtolower(trim($email)) : null,
-                'edition'=>$product->edition,
-                'activation_limit'=>$product->activation_limit,
-                'max_major_version'=>$product->max_major_version,
-                'payment_provider'=>$provider,
-                'external_order_id'=>$orderID,
-                'external_customer_id'=>$customerID,
+                'license_product_id' => $product->id,
+                'license_key_hash' => LicenseKey::hash($plain),
+                'license_key_last4' => substr(LicenseKey::normalize($plain), -4),
+                'customer_name' => $name,
+                'customer_email' => $email ? strtolower(trim($email)) : null,
+                'edition' => $product->edition,
+                'activation_limit' => $product->activation_limit,
+                'max_major_version' => $product->max_major_version,
+                'payment_provider' => $provider,
+                'external_order_id' => $orderID,
+                'external_customer_id' => $customerID,
             ]);
             if ($queueDelivery) {
                 LicenseDeliveryOutbox::updateOrCreate(
-                    ['license_id'=>$license->id],
-                    ['encrypted_license_key'=>Crypt::encryptString($plain),'recipient_email'=>$license->customer_email,'delivered_at'=>null]
+                    ['license_id' => $license->id],
+                    ['encrypted_license_key' => Crypt::encryptString($plain), 'recipient_email' => $license->customer_email, 'delivered_at' => null]
                 );
             }
+
             return [$license, $plain];
         });
     }

rsync-studio-licensing/app/Services/Licensing/LicenseKey.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 final class LicenseKey
@@ -7,7 +8,10 @@ final class LicenseKey
     {
         $alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
         $raw = '';
-        for ($i=0; $i<20; $i++) $raw .= $alphabet[random_int(0, strlen($alphabet)-1)];
+        for ($i = 0; $i < 20; $i++) {
+            $raw .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+        }
+
         return implode('-', str_split($raw, 5));
     }
 

rsync-studio-licensing/app/Services/Licensing/LicenseSigner.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use App\Models\License;
@@ -26,21 +27,28 @@ final class LicenseSigner
         ksort($payload, SORT_STRING);
         $json = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
         $sig = sodium_crypto_sign_detached($json, $secret);
+
         return 'RS3.'.self::b64url($json).'.'.self::b64url($sig);
     }
 
     public function publicKeyBase64(): string
     {
         $pair = sodium_crypto_sign_seed_keypair($this->privateSeed());
+
         return base64_encode(sodium_crypto_sign_publickey($pair));
     }
 
     private function privateSeed(): string
     {
         $path = config('rsync-studio.private_key_path');
-        if (!$path || !is_file($path)) throw new RuntimeException('RSYNC_STUDIO_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('RSYNC_STUDIO_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
         $decoded = base64_decode(trim((string) file_get_contents($path)), true);
-        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) throw new RuntimeException('The Rsync Studio private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The Rsync Studio private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
         return $decoded;
     }
 

rsync-studio-licensing/app/Services/Licensing/LicenseTokenVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Licensing;
 
 use RuntimeException;
@@ -8,21 +9,32 @@ final class LicenseTokenVerifier
     public function verify(string $token): array
     {
         $parts = explode('.', trim($token));
-        if (count($parts) !== 3 || $parts[0] !== 'RS3') throw new RuntimeException('Invalid licence token.');
+        if (count($parts) !== 3 || $parts[0] !== 'RS3') {
+            throw new RuntimeException('Invalid licence token.');
+        }
         $payload = $this->decode($parts[1]);
         $signature = $this->decode($parts[2]);
         $public = base64_decode((string) config('rsync-studio.public_key'), true);
-        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) throw new RuntimeException('Server licence public key is invalid.');
-        if (!sodium_crypto_sign_verify_detached($signature, $payload, $public)) throw new RuntimeException('Licence token signature is invalid.');
+        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) {
+            throw new RuntimeException('Server licence public key is invalid.');
+        }
+        if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
+            throw new RuntimeException('Licence token signature is invalid.');
+        }
         $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
+
         return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
     }
+
     private function decode(string $value): string
     {
         $value = strtr($value, '-_', '+/');
         $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
         $out = base64_decode($value, true);
-        if ($out === false) throw new RuntimeException('Invalid Base64URL value.');
+        if ($out === false) {
+            throw new RuntimeException('Invalid Base64URL value.');
+        }
+
         return $out;
     }
 }

rsync-studio-licensing/app/Services/Payments/LemonSqueezyWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,8 +11,12 @@ final class LemonSqueezyWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.lemon_squeezy.webhook_secret');
         $signature = (string) $request->header('X-Signature');
-        if ($secret === '' || $signature === '') throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
-        $expected = hash_hmac('sha256',$rawBody,$secret);
-        if (!hash_equals($expected,$signature)) throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        if ($secret === '' || $signature === '') {
+            throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
+        }
+        $expected = hash_hmac('sha256', $rawBody, $secret);
+        if (! hash_equals($expected, $signature)) {
+            throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        }
     }
 }

rsync-studio-licensing/app/Services/Payments/PaddleClient.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+final class PaddleClient
+{
+    public function customer(?string $customerID): ?array
+    {
+        if (! $customerID || ! config('rsync-studio.paddle.api_key')) {
+            return null;
+        }
+
+        $response = $this->request()->get('/customers/'.$customerID);
+
+        if (! $response->successful()) {
+            return null;
+        }
+        $data = $response->json('data');
+
+        return is_array($data) ? $data : null;
+    }
+
+    public function updateSubscriptionPrice(string $subscriptionID, string $priceID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->patch('/subscriptions/'.$subscriptionID, [
+            'proration_billing_mode' => 'prorated_immediately',
+            'items' => [[
+                'price_id' => $priceID,
+                'quantity' => 1,
+            ]],
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not update the subscription.');
+    }
+
+    public function cancelSubscriptionImmediately(string $subscriptionID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->post('/subscriptions/'.$subscriptionID.'/cancel', [
+            'effective_from' => 'immediately',
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not cancel the subscription.');
+    }
+
+    private function request()
+    {
+        return Http::baseUrl((string) config('rsync-studio.paddle.api_url'))
+            ->withToken((string) config('rsync-studio.paddle.api_key'))
+            ->acceptJson()
+            ->timeout(15);
+    }
+
+    private function requireWritableConfiguration(): void
+    {
+        if (trim((string) config('rsync-studio.paddle.api_key')) === '') {
+            throw new RuntimeException('Paddle subscription management is not configured.');
+        }
+    }
+
+    private function subscriptionData(Response $response, string $fallback): array
+    {
+        if (! $response->successful()) {
+            $detail = trim((string) ($response->json('error.detail') ?? ''));
+            throw new RuntimeException($detail !== '' ? $detail : $fallback);
+        }
+
+        $data = $response->json('data');
+        if (! is_array($data)) {
+            throw new RuntimeException($fallback);
+        }
+
+        return $data;
+    }
+}

rsync-studio-licensing/app/Services/Payments/PaddleWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,15 +11,28 @@ final class PaddleWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.paddle.webhook_secret');
         $header = (string) $request->header('Paddle-Signature');
-        if ($secret === '' || $header === '') throw new RuntimeException('Paddle webhook verification is not configured.');
+        if ($secret === '' || $header === '') {
+            throw new RuntimeException('Paddle webhook verification is not configured.');
+        }
         $parts = [];
-        foreach (explode(';', $header) as $part) { [$k,$v] = array_pad(explode('=',trim($part),2),2,null); if ($k && $v) $parts[$k][]=$v; }
-        $ts = isset($parts['ts'][0]) ? (int)$parts['ts'][0] : 0;
+        foreach (explode(';', $header) as $part) {
+            [$k,$v] = array_pad(explode('=', trim($part), 2), 2, null);
+            if ($k && $v) {
+                $parts[$k][] = $v;
+            }
+        }
+        $ts = isset($parts['ts'][0]) ? (int) $parts['ts'][0] : 0;
         $signatures = $parts['h1'] ?? [];
-        $tolerance = max(1,(int)config('rsync-studio.paddle.timestamp_tolerance',300));
-        if (!$ts || abs(time()-$ts)>$tolerance) throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        $tolerance = max(1, (int) config('rsync-studio.paddle.timestamp_tolerance', 300));
+        if (! $ts || abs(time() - $ts) > $tolerance) {
+            throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        }
         $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
-        foreach ($signatures as $signature) if (hash_equals($expected,$signature)) return;
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return;
+            }
+        }
         throw new RuntimeException('Paddle webhook signature is invalid.');
     }
 }

rsync-studio-licensing/app/Services/Payments/PurchaseProvisioner.php

@@ -1,47 +1,246 @@
 <?php
+
 namespace App\Services\Payments;
 
 use App\Models\License;
 use App\Models\LicenseProduct;
 use App\Services\Licensing\LicenseIssuer;
+use Illuminate\Support\Carbon;
 use RuntimeException;
 
 final class PurchaseProvisioner
 {
-    public function __construct(private LicenseIssuer $issuer) {}
+    public function __construct(private LicenseIssuer $issuer, private PaddleClient $paddle) {}
 
     public function provision(string $provider, array $event): void
     {
-        $normalized = match ($provider) {
-            'paddle' => $this->fromPaddle($event),
-            'lemon-squeezy' => $this->fromLemonSqueezy($event),
-            default => throw new RuntimeException('Unsupported payment provider.'),
-        };
-        if ($normalized['action'] === 'ignore') return;
-        if ($normalized['action'] === 'revoke') {
-            License::where('payment_provider',$provider)->where('external_order_id',$normalized['orderID'])->whereNull('revoked_at')->update(['revoked_at'=>now(),'revoke_reason'=>'Payment refunded or reversed']);
+        if ($provider === 'paddle') {
+            $this->provisionPaddle($event);
+
             return;
         }
-        $product = LicenseProduct::where('payment_provider',$provider)->where(function($q) use($normalized){ $q->where('external_price_id',$normalized['priceID'])->orWhere('external_product_id',$normalized['productID']); })->where('active',true)->first();
-        if (!$product) throw new RuntimeException('No active licence product maps to this payment item.');
-        $this->issuer->issue($product,$normalized['name'],$normalized['email'],$provider,$normalized['orderID'],$normalized['customerID'], true);
+
+        if ($provider === 'lemon-squeezy') {
+            $this->provisionLemonSqueezy($event);
+
+            return;
+        }
+
+        throw new RuntimeException('Unsupported payment provider.');
     }
 
-    private function fromPaddle(array $e): array
+    private function provisionPaddle(array $event): void
     {
-        $type=(string)($e['event_type']??''); $d=$e['data']??[];
-        if (in_array($type,['transaction.refunded','transaction.canceled'],true)) return ['action'=>'revoke','orderID'=>(string)($d['id']??''),'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if ($type!=='transaction.completed') return ['action'=>'ignore'];
-        $item=$d['items'][0]??[]; $price=$item['price']??[]; $product=$price['product_id']??($item['product_id']??null);
-        return ['action'=>'issue','orderID'=>(string)($d['id']??''),'priceID'=>(string)($price['id']??($item['price_id']??'')),'productID'=>(string)($product??''),'name'=>$d['custom_data']['customer_name']??null,'email'=>$d['custom_data']['customer_email']??null,'customerID'=>isset($d['customer_id'])?(string)$d['customer_id']:null];
+        $type = (string) ($event['event_type'] ?? '');
+        $data = $event['data'] ?? [];
+
+        if (str_starts_with($type, 'subscription.')) {
+            $this->syncPaddleSubscription($type, $data);
+
+            return;
+        }
+
+        if ($type === 'transaction.completed') {
+            $this->syncPaddleTransaction($data);
+
+            return;
+        }
+
+        if ($type === 'transaction.refunded') {
+            $transactionID = (string) ($data['id'] ?? '');
+            if ($transactionID !== '') {
+                License::where('payment_provider', 'paddle')
+                    ->where('external_order_id', $transactionID)
+                    ->whereNull('external_subscription_id')
+                    ->whereNull('revoked_at')
+                    ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded']);
+            }
+        }
     }
 
-    private function fromLemonSqueezy(array $e): array
+    private function syncPaddleSubscription(string $type, array $data): void
     {
-        $type=(string)($e['meta']['event_name']??''); $a=$e['data']['attributes']??[];
-        $order=(string)($e['data']['id']??($a['order_id']??''));
-        if (in_array($type,['order_refunded','subscription_expired'],true)) return ['action'=>'revoke','orderID'=>$order,'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if (!in_array($type,['order_created','subscription_created'],true)) return ['action'=>'ignore'];
-        return ['action'=>'issue','orderID'=>$order,'priceID'=>(string)($a['variant_id']??''),'productID'=>(string)($a['product_id']??''),'name'=>$a['user_name']??null,'email'=>$a['user_email']??null,'customerID'=>isset($a['customer_id'])?(string)$a['customer_id']:null];
+        $subscriptionID = (string) ($data['id'] ?? '');
+        if ($subscriptionID === '') {
+            throw new RuntimeException('Paddle subscription webhook has no subscription ID.');
+        }
+
+        $status = (string) ($data['status'] ?? '');
+        $item = $this->firstRecurringItem($data['items'] ?? []);
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+
+        $license = License::where('payment_provider', 'paddle')
+            ->where('external_subscription_id', $subscriptionID)
+            ->first();
+
+        if (! $license) {
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+            $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+            [$license] = $this->issuer->issue(
+                $product,
+                $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+                $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+                'paddle',
+                $this->nullableString($data['transaction_id'] ?? null),
+                $this->nullableString($data['customer_id'] ?? null),
+                true,
+            );
+            $license->external_subscription_id = $subscriptionID;
+        } elseif ($priceID !== '' && $priceID !== $license->external_price_id) {
+            // Upgrades/downgrades change the entitlement attached to the existing key.
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $license->license_product_id = $product->id;
+            $license->edition = $product->edition;
+            $license->activation_limit = $product->activation_limit;
+            $license->max_major_version = $product->max_major_version;
+        }
+
+        $periodEnd = $data['current_billing_period']['ends_at'] ?? null;
+        $scheduled = $data['scheduled_change'] ?? null;
+        $cancelAt = is_array($scheduled) && ($scheduled['action'] ?? null) === 'cancel'
+            ? ($scheduled['effective_at'] ?? null)
+            : null;
+
+        $license->external_customer_id = $this->nullableString($data['customer_id'] ?? null) ?? $license->external_customer_id;
+        $license->external_price_id = $priceID !== '' ? $priceID : $license->external_price_id;
+        $license->subscription_status = $status !== '' ? $status : $license->subscription_status;
+        $license->current_period_ends_at = $periodEnd ? Carbon::parse($periodEnd) : $license->current_period_ends_at;
+        $license->cancel_scheduled_at = $cancelAt ? Carbon::parse($cancelAt) : null;
+
+        if (in_array($status, ['active', 'trialing'], true)) {
+            $license->revoked_at = null;
+            $license->revoke_reason = null;
+            // Trialing/active subscriptions remain valid through the current period.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : null;
+        } elseif ($status === 'past_due') {
+            // Do not instantly kill a licence on the first failed renewal. Preserve the
+            // period Paddle says is current; a later canceled event ends entitlement.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : ($license->expires_at ?? now()->addDays(7));
+        } elseif (in_array($status, ['canceled', 'paused'], true)) {
+            $license->expires_at = now();
+            $license->revoked_at = now();
+            $license->revoke_reason = $status === 'paused' ? 'Subscription paused' : 'Subscription canceled';
+        }
+
+        $license->save();
+    }
+
+    private function syncPaddleTransaction(array $data): void
+    {
+        $subscriptionID = $this->nullableString($data['subscription_id'] ?? null);
+        $transactionID = (string) ($data['id'] ?? '');
+
+        // Recurring purchases are provisioned from subscription events because those
+        // events contain the authoritative trial/status/current-period state.
+        if ($subscriptionID) {
+            License::where('payment_provider', 'paddle')
+                ->where('external_subscription_id', $subscriptionID)
+                ->whereNull('external_order_id')
+                ->update(['external_order_id' => $transactionID ?: null]);
+
+            return;
+        }
+
+        // Keep support for any future one-time Paddle licence product.
+        $item = $data['items'][0] ?? [];
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+        $product = $this->mappedProduct('paddle', $priceID, $productID);
+        $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+        $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+            $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+            'paddle',
+            $transactionID,
+            $this->nullableString($data['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function provisionLemonSqueezy(array $event): void
+    {
+        $type = (string) ($event['meta']['event_name'] ?? '');
+        $attributes = $event['data']['attributes'] ?? [];
+        $order = (string) ($event['data']['id'] ?? $attributes['order_id'] ?? '');
+
+        if (in_array($type, ['order_refunded', 'subscription_expired'], true)) {
+            License::where('payment_provider', 'lemon-squeezy')
+                ->where('external_order_id', $order)
+                ->whereNull('revoked_at')
+                ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded or subscription expired']);
+
+            return;
+        }
+
+        if (! in_array($type, ['order_created', 'subscription_created'], true)) {
+            return;
+        }
+
+        $product = $this->mappedProduct(
+            'lemon-squeezy',
+            (string) ($attributes['variant_id'] ?? ''),
+            (string) ($attributes['product_id'] ?? ''),
+        );
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($attributes['user_name'] ?? null),
+            $this->nullableString($attributes['user_email'] ?? null),
+            'lemon-squeezy',
+            $order,
+            $this->nullableString($attributes['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function mappedProduct(string $provider, string $priceID, string $productID): LicenseProduct
+    {
+        // Price IDs are the authoritative mapping because monthly and annual prices
+        // intentionally share the same Paddle product ID.
+        if ($priceID !== '') {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_price_id', $priceID)
+                ->where('active', true)
+                ->first();
+        } else {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_product_id', $productID)
+                ->where('active', true)
+                ->first();
+        }
+
+        if (! $product) {
+            throw new RuntimeException("No active licence product maps to {$provider} price {$priceID} / product {$productID}.");
+        }
+
+        return $product;
+    }
+
+    private function firstRecurringItem(array $items): array
+    {
+        foreach ($items as $item) {
+            if (($item['recurring'] ?? true) === true) {
+                return $item;
+            }
+        }
+
+        return $items[0] ?? [];
+    }
+
+    private function nullableString(mixed $value): ?string
+    {
+        if (! is_scalar($value)) {
+            return null;
+        }
+        $value = trim((string) $value);
+
+        return $value === '' ? null : $value;
     }
 }

rsync-studio-licensing/app/Services/Payments/WebhookVerifier.php

@@ -1,4 +1,10 @@
 <?php
+
 namespace App\Services\Payments;
+
 use Illuminate\Http\Request;
-interface WebhookVerifier { public function verify(Request $request, string $rawBody): void; }
+
+interface WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void;
+}