move into sonardesk

2026-10-12 14:50:13 +01:00
parent 5f0d2ceb72
commit 38b4a7406f
879 changed files with 24021 additions and 1 deletions
@@ -0,0 +1,54 @@
+<?php
+
+namespace Modules\Licensing\Services;
+
+use Modules\Licensing\Models\LicenseDeliveryOutbox;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Mail;
+
+final class LicenseDeliveryService
+{
+    public function deliverPending(int $limit = 20): int
+    {
+        $delivered = 0;
+        $pending = LicenseDeliveryOutbox::query()
+            ->with('license')
+            ->whereNull('delivered_at')
+            ->whereNotNull('recipient_email')
+            ->where('recipient_email', '!=', '')
+            ->oldest()
+            ->limit(max(1, min($limit, 100)))
+            ->get();
+
+        foreach ($pending as $outbox) {
+            $license = $outbox->license;
+            if (! $license) {
+                continue;
+            }
+
+            $plain = Crypt::decryptString($outbox->encrypted_license_key);
+            $recipient = strtolower(trim((string) $outbox->recipient_email));
+            if ($recipient === '') {
+                continue;
+            }
+
+            $data = [
+                'customerName' => $license->customer_name,
+                'edition' => $license->edition,
+                'licenseKey' => $plain,
+                'expiresAt' => $license->expires_at,
+                'portalUrl' => config('sonardesk.portal_url') ?: url('/portal'),
+                'downloadUrl' => route('release'),
+            ];
+
+            Mail::send(['html' => 'emails.license-key', 'text' => 'emails.license-key-text'], $data, function ($message) use ($recipient): void {
+                $message->to($recipient)->subject('Your SonarDesk licence key');
+            });
+
+            $outbox->update(['delivered_at' => now()]);
+            $delivered++;
+        }
+
+        return $delivered;
+    }
+}
@@ -0,0 +1,46 @@
+<?php
+
+namespace Modules\Licensing\Services;
+
+use Modules\Licensing\Models\License;
+use Modules\Licensing\Models\LicenseDeliveryOutbox;
+use Modules\Licensing\Models\LicenseProduct;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+
+final class LicenseIssuer
+{
+    public function issue(LicenseProduct $product, ?string $name, ?string $email, ?string $provider = null, ?string $orderID = null, ?string $customerID = null, bool $queueDelivery = false): array
+    {
+        return DB::transaction(function () use ($product, $name, $email, $provider, $orderID, $customerID, $queueDelivery) {
+            if ($provider && $orderID) {
+                $existing = License::where('payment_provider', $provider)->where('external_order_id', $orderID)->first();
+                if ($existing) {
+                    return [$existing, null];
+                }
+            }
+            $plain = LicenseKey::generate();
+            $license = License::create([
+                'license_product_id' => $product->id,
+                'license_key_hash' => LicenseKey::hash($plain),
+                'license_key_last4' => substr(LicenseKey::normalize($plain), -4),
+                'customer_name' => $name,
+                'customer_email' => $email ? strtolower(trim($email)) : null,
+                'edition' => $product->edition,
+                'activation_limit' => $product->activation_limit,
+                'max_major_version' => $product->max_major_version,
+                'payment_provider' => $provider,
+                'external_order_id' => $orderID,
+                'external_customer_id' => $customerID,
+            ]);
+            if ($queueDelivery) {
+                LicenseDeliveryOutbox::updateOrCreate(
+                    ['license_id' => $license->id],
+                    ['encrypted_license_key' => Crypt::encryptString($plain), 'recipient_email' => $license->customer_email, 'delivered_at' => null]
+                );
+            }
+
+            return [$license, $plain];
+        });
+    }
+}
@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Licensing\Services;
+
+final class LicenseKey
+{
+    public static function generate(): string
+    {
+        $alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        $raw = '';
+        for ($i = 0; $i < 20; $i++) {
+            $raw .= $alphabet[random_int(0, strlen($alphabet) - 1)];
+        }
+
+        return implode('-', str_split($raw, 5));
+    }
+
+    public static function normalize(string $value): string
+    {
+        return strtoupper(preg_replace('/[^A-Z0-9]/i', '', trim($value)) ?? '');
+    }
+
+    public static function hash(string $value): string
+    {
+        return hash('sha256', self::normalize($value));
+    }
+}
@@ -0,0 +1,59 @@
+<?php
+
+namespace Modules\Licensing\Services;
+
+use Modules\Licensing\Models\License;
+use Carbon\CarbonInterface;
+use RuntimeException;
+
+final class LicenseSigner
+{
+    public function sign(License $license, string $installationID, ?CarbonInterface $issuedAt = null): string
+    {
+        $seed = $this->privateSeed();
+        $pair = sodium_crypto_sign_seed_keypair($seed);
+        $secret = sodium_crypto_sign_secretkey($pair);
+
+        $payload = [
+            'customerEmail' => $license->customer_email,
+            'customerName' => $license->customer_name,
+            'edition' => $license->edition,
+            'expiresAt' => $license->expires_at?->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'installationID' => strtolower($installationID),
+            'issuedAt' => ($issuedAt ?? now())->utc()->format('Y-m-d\\TH:i:s\\Z'),
+            'licenseID' => strtolower((string) $license->id),
+            'maxMajorVersion' => $license->max_major_version,
+        ];
+        ksort($payload, SORT_STRING);
+        $json = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR);
+        $sig = sodium_crypto_sign_detached($json, $secret);
+
+        return 'RS3.'.self::b64url($json).'.'.self::b64url($sig);
+    }
+
+    public function publicKeyBase64(): string
+    {
+        $pair = sodium_crypto_sign_seed_keypair($this->privateSeed());
+
+        return base64_encode(sodium_crypto_sign_publickey($pair));
+    }
+
+    private function privateSeed(): string
+    {
+        $path = config('sonardesk.private_key_path');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('SONARDESK_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
+        $decoded = base64_decode(trim((string) file_get_contents($path)), true);
+        if ($decoded === false || strlen($decoded) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The SonarDesk private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
+        return $decoded;
+    }
+
+    private static function b64url(string $value): string
+    {
+        return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
+    }
+}
@@ -0,0 +1,58 @@
+<?php
+
+namespace Modules\Licensing\Services;
+
+use RuntimeException;
+
+final class LicenseTokenVerifier
+{
+    public function verify(string $token): array
+    {
+        $parts = explode('.', trim($token));
+        if (count($parts) !== 3 || $parts[0] !== 'RS3') {
+            throw new RuntimeException('Invalid licence token.');
+        }
+        $payload = $this->decode($parts[1]);
+        $signature = $this->decode($parts[2]);
+        // Derive the verification key from the same private seed used by LicenseSigner.
+        // Keeping a separate SONARDESK_LICENSE_PUBLIC_KEY allowed the two keys to drift:
+        // activation would sign a perfectly valid token with the new private key, then
+        // /validate would reject that same token using a stale public key.
+        $public = $this->publicKeyFromPrivateSeed();
+        if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
+            throw new RuntimeException('Licence token signature is invalid.');
+        }
+        $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);
+
+        return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
+    }
+
+    private function publicKeyFromPrivateSeed(): string
+    {
+        $path = config('sonardesk.private_key_path');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('SONARDESK_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
+
+        $seed = base64_decode(trim((string) file_get_contents($path)), true);
+        if ($seed === false || strlen($seed) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The SonarDesk private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
+        $pair = sodium_crypto_sign_seed_keypair($seed);
+
+        return sodium_crypto_sign_publickey($pair);
+    }
+
+    private function decode(string $value): string
+    {
+        $value = strtr($value, '-_', '+/');
+        $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
+        $out = base64_decode($value, true);
+        if ($out === false) {
+            throw new RuntimeException('Invalid Base64URL value.');
+        }
+
+        return $out;
+    }
+}