From cef2f154900a41e612e5c9f14bca6e0034495527 Mon Sep 17 00:00:00 2001
From: Mark Gregory <mark.gregory@abbeysoftware.com>
Date: Wed, 30 Sep 2026 16:32:29 +0100
Subject: [PATCH] update to provisioner code nwew paddle code

---
 .../Licensing/LicenseTokenVerifier.php        | 26 ++++++++++++++++---
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/app/Services/Licensing/LicenseTokenVerifier.php b/app/Services/Licensing/LicenseTokenVerifier.php
index fa497fc..a13ba47 100755
--- a/app/Services/Licensing/LicenseTokenVerifier.php
+++ b/app/Services/Licensing/LicenseTokenVerifier.php
@@ -14,10 +14,11 @@ final class LicenseTokenVerifier
         }
         $payload = $this->decode($parts[1]);
         $signature = $this->decode($parts[2]);
-        $public = base64_decode((string) config('sonardesk.public_key'), true);
-        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) {
-            throw new RuntimeException('Server licence public key is invalid.');
-        }
+        // Derive the verification key from the same private seed used by LicenseSigner.
+        // Keeping a separate SONARDESK_LICENSE_PUBLIC_KEY allowed the two keys to drift:
+        // activation would sign a perfectly valid token with the new private key, then
+        // /validate would reject that same token using a stale public key.
+        $public = $this->publicKeyFromPrivateSeed();
         if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
             throw new RuntimeException('Licence token signature is invalid.');
         }
@@ -26,6 +27,23 @@ final class LicenseTokenVerifier
         return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
     }
 
+    private function publicKeyFromPrivateSeed(): string
+    {
+        $path = config('sonardesk.private_key_path');
+        if (! $path || ! is_file($path)) {
+            throw new RuntimeException('SONARDESK_LICENSE_PRIVATE_KEY_PATH is not configured or does not exist.');
+        }
+
+        $seed = base64_decode(trim((string) file_get_contents($path)), true);
+        if ($seed === false || strlen($seed) !== SODIUM_CRYPTO_SIGN_SEEDBYTES) {
+            throw new RuntimeException('The SonarDesk private key must be a Base64-encoded 32-byte Ed25519 seed.');
+        }
+
+        $pair = sodium_crypto_sign_seed_keypair($seed);
+
+        return sodium_crypto_sign_publickey($pair);
+    }
+
     private function decode(string $value): string
     {
         $value = strtr($value, '-_', '+/');